Function at 0x401694
Capabilities:
Check for software breakpoints
Extract resource via kernel32 functions
Terminate process
Write file on windows

Disassembly:
push 2
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov edi, 0x4534d0
mov ebx, dword [ebp + 0xc]
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov esi, eax
test esi, esi
jne 0x4016d3
mov eax, dword [ebp + 0x14]
push eax
call fcn.00401430
pop ecx
test eax, eax
jne 0x40171f
xor eax, eax
jmp 0x4019d6
push esi
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4016ed
xor eax, eax
jmp 0x4019d6
je 0x4016f2
jne 0x4016f2
jmp 0x40167e
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_LockResource
mov dword [0x44f378], eax
cmp dword [0x44f378], 0
jne 0x401710
xor eax, eax
jmp 0x4019d6
push esi
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_SizeofResource
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x1c8
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
sub edx, 0x1c8
add edx, dword [0x44f378]
push edx
push ebx
call fcn.00405b60
add esp, 0xc
mov ecx, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], ecx
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x4017c5
mov eax, 0x40ecf0
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x4017c5
mov edx, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], edx
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x4017c5
mov ecx, sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0x14]
mov al, byte [esi]
cmp al, 0xcc
je 0x4017c5
mov eax, sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x4017c5
push edi
lea edi, [ebp - 0x21c]
mov esi, 0x44f38e
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x21c]
push 0x124
push eax
lea edx, [ebx + 0xa4]
push 0x64
push edx
call fcn.00403e1c
add esp, 0x10
xor esi, esi
push 0x1c8
push ebx
lea eax, [ebp - 0x1fc]
push eax
call fcn.00405b60
add esp, 0xc
push 0x1c8
lea edx, [ebp - 0x1fc]
push edx
push ebx
call fcn.00405b60
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x320]
push eax
mov edx, dword [ebx + 0x1c0]
push edx
mov ecx, dword [ebx + 0x1c4]
push ecx
push esi
call fcn.0040d2c4
test eax, eax
je 0x401868
push 0
push 1
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReleaseSemaphore
mov edx, dword [ebx + 0x1bc]
push edx
lea ecx, [ebx + 0xa4]
push ecx
add ebx, 0xb8
push ebx
push 0
call sub.USER32.DLL_MessageBoxA
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4019d6
push 0
push 1
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_ReleaseSemaphore
lea ecx, [ebp - 0x320]
lea eax, [ebx + 0x98]
push ecx
push 0xc
push eax
call fcn.00403d64
add esp, 0xc
test eax, eax
jne 0x401897
xor eax, eax
jmp 0x4019d6
lea edx, [ebp - 0x320]
push edx
push 0x98
push ebx
call fcn.00403d64
add esp, 0xc
test eax, eax
jne 0x4018b7
xor eax, eax
jmp 0x4019d6
mov edx, dword [ebx + 0x98]
lea ecx, [ebp - 0x24]
push edx
push 0x44f48c
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
mov eax, dword [ebx + 0x9c]
push eax
push 0x44f48f
lea edx, [ebp - 0x30]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
lea ecx, [ebp - 0x320]
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x24]
push ecx
push 0
push eax
push edx
xor ecx, ecx
xor eax, eax
mov cl, byte [ebx + 0xa1]
push ecx
mov al, byte [ebx + 0xa2]
push eax
call fcn.00402d88
add esp, 0x18
test eax, eax
jne 0x40191c
inc esi
jmp 0x4017dc
cmp byte [ebx + 9], 0
je 0x40193c
lea edx, [ebp - 0x320]
push edx
push ebx
call fcn.004013a4
add esp, 8
test eax, eax
jne 0x40193c
inc esi
jmp 0x4017dc
push 0xffffffffffffffff
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x320]
lea edx, [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x31]
push ecx
push 0
push eax
call fcn.0040d20c
test eax, eax
jne 0x401987
push 0
push 1
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_ReleaseSemaphore
lea ecx, [ebp - 0x320]
push ecx
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov eax, 1
jmp 0x4019d6
push 0
push 1
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_ReleaseSemaphore
inc esi
jmp 0x4017dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret