Function at 0x10209ab
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10a6184]
push ebx
push esi
push edi
mov edi, 0x10a6184
cmp eax, edi
je 0x10209ec
test byte [eax + 0x1c], 1
je 0x10209ec
cmp byte [eax + 0x19], 5
jb 0x10209ec
push dword [ebp + 8]
mov ebx, 0x1004af8
push ebx
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
jmp 0x10209f1
mov ebx, 0x1004af8
mov ecx, dword [0x10a7d74]
test ecx, ecx
mov dword [ebp - 4], ecx
jne 0x1020a13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009676
mov esi, eax
mov eax, dword [0x10a6184]
jmp 0x1020a15
xor esi, esi
cmp eax, edi
je 0x1020a39
test byte [eax + 0x1c], 2
je 0x1020a39
cmp byte [eax + 0x19], 4
jb 0x1020a39
push esi
push ebx
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
xor edi, edi
cmp dword [ebp - 4], edi
je 0x1020a97
movzx eax, word [ebp + 8]
push 0x3f9
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1020a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009676
mov esi, eax
jmp 0x1020a6b
xor esi, esi
mov eax, dword [0x10a6184]
cmp eax, 0x10a6184
je 0x1020a97
test byte [eax + 0x1c], 2
je 0x1020a97
cmp byte [eax + 0x19], 4
jb 0x1020a97
push esi
push ebx
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
and dword [ebp + 8], 0
test edi, edi
je 0x1020aee
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 8], eax
jne 0x1020ac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009676
mov esi, eax
jmp 0x1020ac2
xor esi, esi
mov eax, dword [0x10a6184]
cmp eax, 0x10a6184
je 0x1020aee
test byte [eax + 0x1c], 2
je 0x1020aee
cmp byte [eax + 0x19], 4
jb 0x1020aee
push esi
push ebx
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x1020b47
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [ebp - 8], eax
jne 0x1020b19
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009676
mov esi, eax
jmp 0x1020b1b
xor esi, esi
mov eax, dword [0x10a6184]
cmp eax, 0x10a6184
je 0x1020b47
test byte [eax + 0x1c], 2
je 0x1020b47
cmp byte [eax + 0x19], 4
jb 0x1020b47
push esi
push ebx
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
cmp dword [ebp - 8], 0
je 0x1020c71
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov eax, dword [0x10a6184]
mov esi, ebx
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, 0x80004005
cmp eax, 0x10a6184
je 0x1020b9e
test byte [eax + 0x1c], 2
je 0x1020b9e
cmp byte [eax + 0x19], 4
jb 0x1020b9e
push esi
push 0x1004af8
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
test ebx, ebx
je 0x1020c6c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
xor esi, esi
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1020bd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009676
mov esi, eax
mov eax, dword [0x10a6184]
cmp eax, 0x10a6184
je 0x1020c09
test byte [eax + 0x1c], 2
je 0x1020c09
cmp byte [eax + 0x19], 4
jb 0x1020c09
push esi
push 0x1004af8
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
cmp edi, 0xffffffff
je 0x1020c6c
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
mov dword [ebp + 8], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1020c35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009676
mov esi, eax
mov eax, dword [0x10a6184]
cmp eax, 0x10a6184
je 0x1020c60
test byte [eax + 0x1c], 2
je 0x1020c60
cmp byte [eax + 0x19], 4
jb 0x1020c60
push esi
push 0x1004af8
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10a6184]
mov ebx, 0x1004af8
cmp eax, 0x10a6184
je 0x1020ca2
test byte [eax + 0x1c], 1
je 0x1020ca2
movzx ecx, byte [eax + 0x19]
xor edx, edx
test esi, esi
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x1020ca2
push esi
push ebx
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8