Function at 0x100a85d
Capabilities:
Delete file
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x106c
call fcn.0100b6c0
mov eax, dword [0x10253cc]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
mov word [ebp - 0x804], bx
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x802]
rep stosd dword es:[edi], eax
push edx
push dword [ebp + 8]
mov dword [ebp - 0x100c], ebx
mov dword [ebp - 0x1010], ebx
stosw word es:[edi], ax
call fcn.0100a18b
call fcn.01015072
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
shl eax, 2
push eax
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
cmp eax, ebx
mov dword [ebp - 0x1014], eax
jne 0x100a8d6
push 0xe
pop esi
jmp 0x100adb0
call fcn.01015072
shl eax, 2
push eax
push ebx
call edi
push eax
call esi
cmp eax, ebx
mov dword [ebp - 0x1008], eax
jne 0x100a8f7
push 0xe
pop esi
jmp 0x100ad82
push 0x16
xor eax, eax
pop ecx
lea edi, [ebp - 0x106c]
rep stosd dword es:[edi], eax
mov ax, word [0x1026ed0]
push 0x12c
push eax
call fcn.01007da9
cmp dword [0x1025238], ebx
pop ecx
pop ecx
je 0x100a990
mov esi, dword [0x1025228]
cmp esi, ebx
je 0x100a990
xor eax, eax
mov ax, word [0x1026ed0]
push 0x12f
push eax
call fcn.01007da9
pop ecx
pop ecx
jmp 0x100a976
mov ecx, dword [ebp - 0x1010]
mov eax, dword [ebp - 0x1008]
inc dword [ebp - 0x1010]
mov dword [eax + ecx*4], esi
xor eax, eax
mov ax, word [0x1026ed0]
push esi
push 0x1001778
push eax
call fcn.01007d8e
push esi
call fcn.0100b244
add esp, 0x10
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x100a940
xor eax, eax
mov ax, word [0x1026ed0]
push 0x1001380
push eax
call fcn.01007d8e
pop ecx
pop ecx
cmp dword [0x10250f8], ebx
je 0x100aa1f
mov edi, dword [0x10250e8]
cmp edi, ebx
je 0x100aa1f
xor eax, eax
mov ax, word [0x1026ed0]
push 0x130
push eax
call fcn.01007da9
pop ecx
pop ecx
jmp 0x100aa05
mov ecx, dword [ebp - 0x100c]
mov eax, dword [ebp - 0x1014]
inc dword [ebp - 0x100c]
push 2
push edi
mov dword [eax + ecx*4], edi
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
xor eax, eax
mov ax, word [0x1026ed0]
push edi
push 0x1001778
push eax
call fcn.01007d8e
push edi
call fcn.0100b244
add esp, 0x10
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x100a9bd
xor eax, eax
mov ax, word [0x1026ed0]
push 0x1001380
push eax
call fcn.01007d8e
pop ecx
pop ecx
cmp dword [0x10251b8], ebx
je 0x100aae7
mov eax, dword [0x10251a8]
cmp eax, ebx
je 0x100aa4e
push eax
mov dword [ebp - 0x1044], eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0100b525
pop ecx
pop ecx
jmp 0x100aaf5
mov edi, 0x400
push edi
lea eax, [ebp - 0x804]
push eax
call fcn.01015bab
mov esi, eax
cmp esi, ebx
jne 0x100ad82
push edi
lea eax, [ebp - 0x1004]
push eax
push 0x136
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x804]
push 0x1001774
push eax
mov dword [ebp - 0x1044], eax
call fcn.0100c4ba
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x100aadc
push 0x17
push 0x1001764
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x100aad1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x100aad1
push eax
push 0x100175c
push esi
call fcn.0100c4d6
add esp, 0xc
push esi
call fcn.0100c3d7
jmp 0x100aa48
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100ad80
or byte [ebp - 0x101b], 1
mov word [ebp - 0x1004], bx
xor eax, eax
cmp dword [0x1025368], ebx
sete al
cmp dword [0x10252f8], ebx
lea eax, [eax*4 + 1]
mov edi, eax
je 0x100ab25
mov eax, dword [0x10252e8]
or byte [ebp - 0x101b], 8
mov dword [ebp - 0x1054], eax
jmp 0x100ab53
lea eax, [ebp - 0x1004]
push eax
call fcn.0100b244
test eax, eax
pop ecx
je 0x100ab53
lea eax, [ebp - 0x1004]
push eax
xor eax, eax
mov ax, word [0x1026ed0]
push 0x131
push eax
call fcn.01007da9
add esp, 0xc
cmp dword [0x1025338], ebx
je 0x100ab7e
mov eax, dword [0x1025328]
or byte [ebp - 0x101b], 0x10
push edi
push eax
mov dword [ebp - 0x1040], eax
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
cmp dword [0x10251f8], ebx
je 0x100aba9
mov eax, dword [0x10251e8]
or dword [ebp - 0x101c], 8
push edi
push eax
mov dword [ebp - 0x1050], eax
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
cmp dword [0x10252a8], ebx
je 0x100abb8
or byte [ebp - 0x101b], 2
cmp dword [0x1025138], ebx
je 0x100abe3
mov eax, dword [0x1025128]
or byte [ebp - 0x101c], 0x80
push edi
push eax
mov dword [ebp - 0x1048], eax
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
cmp dword [0x1025178], ebx
je 0x100ac0e
mov eax, dword [0x1025168]
or byte [ebp - 0x101b], 4
push edi
push eax
mov dword [ebp - 0x104c], eax
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
test word [ebp - 0x101c], 0xc88
jne 0x100ac60
mov eax, dword [0x1025128]
mov ecx, dword [0x1025168]
or word [ebp - 0x101c], 0x480
push edi
push eax
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x104c], ecx
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
push edi
push dword [0x1025168]
call fcn.01008b1f
mov esi, eax
cmp esi, ebx
jne 0x100ad82
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x100c]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1060], eax
lea eax, [ebp - 0x106c]
push eax
call fcn.01015502
mov esi, eax
cmp esi, ebx
jne 0x100ad82
xor eax, eax
mov ax, word [0x1026ed0]
push 0x12d
push eax
call fcn.01007da9
test byte [ebp - 0x101c], 0x80
pop ecx
pop ecx
je 0x100ace0
push dword [ebp - 0x1048]
xor eax, eax
mov ax, word [0x1026ed0]
push 0x132
push eax
call fcn.01007da9
add esp, 0xc
test byte [ebp - 0x101b], 4
je 0x100ad05
push dword [ebp - 0x104c]
xor eax, eax
mov ax, word [0x1026ed0]
push 0x134
push eax
call fcn.01007da9
add esp, 0xc
test byte [ebp - 0x101c], 8
je 0x100ad2a
push dword [ebp - 0x1050]
xor eax, eax
mov ax, word [0x1026ed0]
push 0x133
push eax
call fcn.01007da9
add esp, 0xc
test byte [ebp - 0x101b], 8
je 0x100ad4f
push dword [ebp - 0x1054]
xor eax, eax
mov ax, word [0x1026ed0]
push 0x137
push eax
call fcn.01007da9
add esp, 0xc
test byte [ebp - 0x101b], 0x10
je 0x100ad74
push dword [ebp - 0x1040]
xor eax, eax
mov ax, word [0x1026ed0]
push 0x138
push eax
call fcn.01007da9
add esp, 0xc
lea eax, [ebp - 0x106c]
push eax
call fcn.010150c2
mov esi, eax
cmp dword [ebp - 0x1008], ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x100ada0
push dword [ebp - 0x1008]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
push dword [ebp - 0x1014]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
lea eax, [ebp - 0x804]
push eax
call fcn.0100b244
test eax, eax
pop ecx
je 0x100adce
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ax, word [0x1026ed0]
push 0x1001380
push eax
call fcn.01007d8e
cmp esi, ebx
pop ecx
pop ecx
je 0x100ae03
cmp esi, 6
je 0x100adf4
push esi
call fcn.0100a171
jmp 0x100ae18
xor eax, eax
mov ax, word [0x1026ed2]
push 0x12e
jmp 0x100ae10
xor eax, eax
mov ax, word [0x1026ed0]
push 0x23b
push eax
call fcn.01007da9
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0100ae9f
leave
ret