Function at 0x6fc782
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Terminate process

Disassembly:
push 0xa5c
mov eax, 0x7afd15
call fcn.00774621
mov ebx, ecx
mov dword [ebp - 0xa34], ebx
call fcn.00402330
push 0xfffffffffffffff0
mov ecx, ebx
call fcn.006fb27f
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, ebx
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.006fb27f
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, eax
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0xa44], eax
push 0x4f
pop ecx
mov esi, str.fNZlsN89I6Gp25WcD5WYuGeE3nowGaWIuaHK1qLvZlBTlHkdNW29bfHBrzSowB8yCvG1d0GPKH67epQvZyGadgTSXSar5DkUiph6PdpddUDM2Q3wMW4tD5gj2zHDCz9HRItpl9On3qN6BnjWS1zUkETjbSA0b1tHw6qGMQrIF80NcwFwmoXjd79c4lQpG4Y603JTTOyqOo10wzGBjJ04WiUUOpNIE7jaxM5BOpwB9UZj4UfioJy82m5bcOgLgNpSul9qm8dgslicxC3QnQL46BQl8XounNBdIUYzeaWEwhrKPZsx1Ky8GdRTZ4pL0
mov dword [ebp - 4], eax
lea edi, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x604]
movsw word es:[edi], word [esi]
call fcn.00405a00
lea eax, [ebp - 0x604]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xa4c]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x604]
mov byte [ebp - 4], 0
call fcn.006eb1be
lea eax, [ebp - 0x5d4]
mov ecx, ebx
push eax
call fcn.006fb27f
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x5c8]
mov ecx, ebx
sub eax, dword [ebp - 0x5d0]
push 0x20
push eax
mov eax, dword [ebp - 0x5cc]
sub eax, dword [ebp - 0x5d4]
push eax
push dword [ebp - 0x5d0]
push dword [ebp - 0x5d4]
push 0
call fcn.006fb27f
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.006f15c5
push dword [ebx + 4]
lea ecx, [ebx + 0x38]
call fcn.006f726c
lea eax, [ebx + 0x30]
push eax
lea ecx, [ebx + 0x38]
call fcn.006f6894
xor eax, eax
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa38], eax
push 0x7b
pop ecx
mov esi, str.oiEQs1TdAzsa2TYhtQ5ACKBH2BktCjNdcVqu39TsjXlNq7gWOzJVRmxPXyodVXPvAks9ZMzuIFTlvBPDKe3ImxkeMTVqG57FqHqtJp84q2z67EQWgVfeCUj6uFilxWW4XqKDlwzHaYyzaxbYzfXsyIW6auLRh2UvxvQZVt0oGMQpkP6QsDaE113OelGdB0n8QQRbJYEIRMTqQAFFfUMVmK01b7BRlBVoXi0IrREWa4w4Wbq4iFXUpslY9KWiFXlzGrsS6rFu2f5beNixVTQeKSV3x9Vf1noydKVTiqJEmaJc9X5R6uhVNhHPZJyHUQ0dmqgXr8gNYN8610BJj3mogFKFt1mQxLpJxxZOSKyhg3sCqsl7bTBQXOWkRuqhtyoQbivXjmAfQJ6kYKBIjkmpBZQDyeOrJanogkQi64yBVEshujbpBnepQQ4Keme69rsJ6FUxN2mLnkekzx7JxvJIhaeaYNskwrBUG4fraE1sTYeQs
mov byte [ebp - 4], 2
lea edi, [ebp - 0x5c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x61c]
call fcn.00405a00
lea eax, [ebp - 0x61c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xa40]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x61c]
mov byte [ebp - 4], 2
call fcn.006eb1be
lea ecx, [ebp - 0x818]
call fcn.00704508
mov byte [ebp - 4], 4
call fcn.006f7211
mov ecx, eax
call fcn.006f56f0
test al, al
je 0x6fc980
lea eax, [ebp - 0x6d0]
push eax
call fcn.006f6fc5
pop ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0x89c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 5
call dword [eax + 0x24]
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00524130
push eax
lea ecx, [ebp - 0x6d0]
call fcn.006f51e1
lea ecx, [ebp - 0x89c]
mov byte [ebp - 4], 5
call fcn.006f50ed
lea ecx, [ebp - 0x6d0]
call fcn.00524130
push eax
call fcn.006fa8a5
pop ecx
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 4
call fcn.006f50ed
call fcn.00402330
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
dec eax
sub eax, 1
je 0x6fcb3a
dec eax
sub eax, 1
jne 0x6fcb6c
mov eax, dword [ebx]
mov ecx, ebx
push str.ZIPRES
call dword [eax + 0x38]
push eax
call fcn.006f7202
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 0xa30], esi
test esi, esi
je 0x6fccc4
push esi
call fcn.006f7202
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xa2c], eax
test eax, eax
jne 0x6fc9ec
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x6fccc4
xor eax, eax
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa58], eax
mov dword [ebp - 0xa54], eax
push 0x6a
pop ecx
mov esi, str.2f65SbGOp6bhGGPbp1m8uFGJ8BtvBuIupgE72ZX2oiAoA5W9t82eElu3Wzf1DOSaUqtyVdIUIWA7v30y0QggsRbnjfr3Q3xksccAZnnPqjPrdyUXWGSLRrqKtCtk9dxJi8tMzuBOqEcZ6G0zENq8Qi66gVvqwTx6kIA5O5ACSwya50slSnKSawHYearhcc5LVGhu9A2ktGJEYeKBQDgijF1Cq5xt7akrNCtboOg6xCIa1vY2KM3CbUJQzsYYOsihNNCOdQK7K0mJ5ZJr01dbsryRGqoepDWfH5WUzr6GW61vKRZ97pYWCuTwqFxMOYxKfp44u3Cyx7xeqXM676X1t7hgCMzjbYMgta4D9bErkrZcrdTWrhYpKoRQpcdlUDvVXO6olaOXrN1t0dIQTy3BbUQYdZshwEOZIoiZWryW2
mov byte [ebp - 4], 8
lea edi, [ebp - 0x3d4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3d4]
push eax
lea ecx, [ebp - 0x634]
movsw word es:[edi], word [esi]
call fcn.00405a00
lea eax, [ebp - 0x634]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0xa5c]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 8
call fcn.006eb1be
push dword [ebp - 0xa30]
call fcn.006f7202
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x6fca74
lea ecx, [ebp - 0xa5c]
jmp 0x6fccbf
push edi
call fcn.006e619d
mov dword [0x8d51f0], eax
pop ecx
test eax, eax
je 0x6fcaa0
push edi
push dword [ebp - 0xa2c]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x8d51f0]
call fcn.00750d30
add esp, 0xc
push 0x7bba40
lea ecx, [ebp - 0x5ec]
call fcn.00405a00
mov eax, dword [ebp - 0x5dc]
xor esi, esi
and dword [ebp - 0xa2c], esi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xa50], eax
test edi, edi
je 0x6fcb00
mov ebx, dword [ebp - 0xa2c]
push esi
lea ecx, [ebp - 0x5ec]
call fcn.004141a0
mov ecx, dword [0x8d51f0]
mov al, byte [eax]
xor byte [ebx + ecx], al
inc esi
xor eax, eax
cmp esi, dword [ebp - 0xa50]
cmovge esi, eax
inc ebx
cmp ebx, edi
jb 0x6fcad2
mov ebx, dword [ebp - 0xa34]
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
push dword [0x8d51f0]
call fcn.006fa8f3
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x5ec]
call fcn.006eb1be
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 4
call fcn.006eb210
jmp 0x6fcb6c
mov eax, dword [ebx]
lea ecx, [ebp - 0x920]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
push 1
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00524130
push eax
call fcn.006fa955
pop ecx
pop ecx
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 4
call fcn.006f50ed
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
cmp eax, 3
mov eax, dword [ebx]
jne 0x6fcbc9
lea ecx, [ebp - 0x9a4]
push ecx
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.00524130
push eax
call fcn.00754cf9
pop ecx
lea ecx, [ebp - 0x9a4]
movzx esi, ax
mov byte [ebp - 4], 4
call fcn.006f50ed
push 0
lea edi, [ebx + 0x38]
push edi
lea eax, [ebx + 0x34]
push eax
push 0x8728b4
push esi
lea ecx, [ebp - 0x818]
call fcn.00705259
mov esi, eax
jmp 0x6fcc0d
lea ecx, [ebp - 0xa28]
push ecx
mov ecx, ebx
lea esi, [ebx + 0x34]
call dword [eax + 0x28]
push 0
lea edi, [ebx + 0x38]
mov byte [ebp - 4], 0xc
push edi
push esi
push 0
mov ecx, eax
call fcn.00524130
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x818]
call fcn.00705259
lea ecx, [ebp - 0xa28]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.006f50ed
test esi, esi
jne 0x6fcc2c
push 0x10
push str.Duilib
push 0x8728cc
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.006ebfa4
push esi
mov ecx, edi
call fcn.006f68c1
xor eax, eax
mov dword [ebp - 0xa68], eax
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xa60], eax
push 0x35
pop ecx
mov esi, str.AfzvgMdwOabjJ2Kl6pigA0kJO3fMjhUzzrhghtrOClQ1U9Lb7qQv0UOU4deo1QhfUMBBgnc2cP427JogrXT2bmKZxynnT6H7KIOS1kG0k5tg2zaKvuZvEYWJyajm46xM3Z9IMyEVGJGFa8Tvz1GLfhUA0zcJeCus56Zvx4cif3SAo3FZZLBYgj5S4JxK42Yf3ZHtVbk0UqJumDhm8EXED
mov byte [ebp - 4], 0xd
lea edi, [ebp - 0xe8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x64c]
movsw word es:[edi], word [esi]
call fcn.00405a00
lea eax, [ebp - 0x64c]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0xa68]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 0xd
call fcn.006eb1be
lea eax, [ebx + 0x2c]
push eax
lea ecx, [ebx + 0x38]
call fcn.006f67cb
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
lea ecx, [ebx + 0x38]
call fcn.006f747c
lea ecx, [ebp - 0xa68]
call fcn.006eb210
lea ecx, [ebp - 0x818]
call fcn.007036d2
lea ecx, [ebp - 0xa40]
call fcn.006eb210
lea ecx, [ebp - 0xa4c]
call fcn.006eb210
xor eax, eax
call fcn.007745cb
ret 0x10