Function at 0x10018ef0
Capabilities:
Delete file
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x424], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x206
lea eax, [esp + 0x22e]
push esi
push eax
mov ebx, ecx
mov edi, edx
mov word [esp + 0x234], si
call fcn.1003d360
add esp, 0xc
push 0x206
lea ecx, [esp + 0x26]
push esi
push ecx
mov dword [esp + 0x28], esi
mov word [esp + 0x2c], si
call fcn.1003d360
add esp, 0xc
mov ebp, 1
push ebp
push 0x1005ac5c
lea edx, [esp + 0x230]
push 0x104
push edx
call fcn.10003980
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push 0x1000fe90
push 6
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [esp + 0x14]
cmp eax, esi
jne 0x10018fd6
test byte [0x10065ac4], 1
jne 0x10018fa7
or dword [0x10065ac4], ebp
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
push str.GetCurrentModuleHandle_failed.
mov ebx, 0x10065ac8
call fcn.1001e430
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100191aa
and eax, 0xffff
or eax, 0x80070000
jmp 0x100191aa
push 0x104
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10019013
test byte [0x10065ac4], 1
jne 0x1001900c
or dword [0x10065ac4], ebp
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
push str.GetModuleFileName_failed.
jmp 0x10018fac
push 0x28
push esi
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebp, eax
cmp ebp, esi
jne 0x1001903c
push str.GetCurrentModuleHandle_failed.
push ecx
call fcn.100020c0
add esp, 4
mov ebx, eax
jmp 0x10018fb1
push ebx
lea eax, [esp + 0x22c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001907e
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.FindResourceW_failed.
push ecx
call fcn.100020c0
add esp, 4
mov ebx, eax
call fcn.1001e430
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x10018fc1
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100190a4
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.LoadResource_failed.
jmp 0x1001905e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push edi
mov dword [esp + 0x34], eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x10019135
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x10019135
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateFileW_failed.
push ecx
mov esi, eax
call fcn.100020c0
add esp, 4
mov ebx, eax
call fcn.1001e430
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jle 0x10019131
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x100191aa
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10019193
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WriteFile_failed.
push ecx
mov edi, eax
call fcn.100020c0
add esp, 4
mov ebx, eax
call fcn.1001e430
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jle 0x1001918f
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
jmp 0x100191aa
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0x42c
ret