Function at 0x10017eb
Capabilities:
Extract resource via kernel32 functions
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x1006040]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x414]
xor esi, esi
push eax
mov ebx, ecx
push 0x104
mov dword [ebp - 0x628], ebx
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x61c], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1001af0
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebx + 0x210]
push eax
push esi
mov dword [ebp - 0x634], eax
push 0x10011a8
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
je 0x1001af0
lea eax, [ebx + 0x418]
push eax
push esi
push 0x10011a0
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
je 0x1001af0
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1001af0
push 0x12c
push 0x3e9
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1001af0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001af0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 0x630], eax
je 0x1001af0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x1001af0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push 0x80
push 5
push eax
push eax
push 0x40000000
push dword [ebp - 0x634]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x620], eax
je 0x1001af0
push esi
lea ecx, [ebp - 0x624]
push ecx
push edi
push dword [ebp - 0x630]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call edi
test eax, eax
je 0x1001af0
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x620], 0xffffffff
xor eax, eax
push eax
push 0x80
push 5
push eax
push eax
mov eax, dword [ebp - 0x628]
push 0x40000000
add eax, 0x418
push eax
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x618], eax
je 0x1001af0
push esi
lea eax, [ebp - 0x624]
push eax
push str._TsecRoot_xmlns_x_schema:file:__
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str._TsecRoot_xmlns_x_schema:file:__
push dword [ebp - 0x618]
call edi
test eax, eax
je 0x1001af0
xor ecx, ecx
push ecx
push ecx
push 0x208
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x628]
push 0xffffffffffffffff
add eax, 0x210
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1001af0
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x618]
call edi
test eax, eax
je 0x1001af0
push esi
lea eax, [ebp - 0x624]
push eax
push str.___r_n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.___r_n
push dword [ebp - 0x618]
call edi
test eax, eax
je 0x1001af0
mov eax, dword [ebp - 0x628]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
add eax, 4
push eax
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x61c], eax
je 0x1001af0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 0x62c]
push ecx
push 0x200
lea ecx, [ebp - 0x614]
push ecx
push eax
jmp 0x1001aac
cmp dword [ebp - 0x62c], 0
jbe 0x1001ab2
push 0
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 0x62c]
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0x618]
call edi
test eax, eax
je 0x1001af0
push 0
lea eax, [ebp - 0x62c]
push eax
push 0x200
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0x61c]
call ebx
test eax, eax
jne 0x1001a66
push dword [ebp - 0x61c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x61c], 0xffffffff
push 0
lea eax, [ebp - 0x624]
push eax
mov ebx, str._r_n__TsecRoot_
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push dword [ebp - 0x618]
call edi
test eax, eax
je 0x1001af0
push dword [ebp - 0x618]
jmp 0x1001b65
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1001b02
call esi
mov esi, eax
jmp 0x1001b12
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jge 0x1001b2c
mov eax, dword [ebp - 0x628]
and word [eax + 0x210], 0
and word [eax + 0x418], 0
cmp dword [ebp - 0x620], 0xffffffff
je 0x1001b41
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x618], 0xffffffff
je 0x1001b56
push dword [ebp - 0x618]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x61c], 0xffffffff
je 0x1001b6b
push dword [ebp - 0x61c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.01004bb2
leave
ret