Function at 0x1000381f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov ecx, dword [0x100ae4a0]
mov eax, dword [ecx]
push ebx
push esi
push edi
call dword [eax + 4]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x10003a15
mov al, byte [ebp - 1]
push edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x18], al
call fcn.10004041
push ebx
call fcn.10022f00
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x18]
call fcn.100042cb
cmp dword [ebp - 0x14], edi
je 0x10003871
lea ecx, [ebp - 0x18]
call fcn.10004015
mov eax, dword [ebp - 0x14]
jmp 0x10003876
mov eax, 0x100875b4
cmp byte [eax], 0x5f
jne 0x100038b5
mov ecx, dword [0x100ae4a0]
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push 0x100922c8
push eax
call fcn.10005118
add esp, 0xc
push eax
mov ecx, 0x100ae460
call fcn.10003d8c
mov dword [eax], esi
push 1
lea ecx, [ebp - 0x48]
jmp 0x100039f4
cmp dword [ebp - 0x14], edi
je 0x100038c7
lea ecx, [ebp - 0x18]
call fcn.10004015
mov eax, dword [ebp - 0x14]
jmp 0x100038cc
mov eax, 0x100875b4
movsx eax, byte [eax]
push eax
call fcn.1002314c
test eax, eax
pop ecx
jne 0x1000390f
lea eax, [ebp - 1]
push eax
push dword [0x100875b0]
lea eax, [ebp - 0x18]
push 1
push eax
lea ecx, [ebp - 0x38]
call fcn.10003e41
push dword [0x100875b0]
lea eax, [ebp - 0x38]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.10003ec5
push 1
lea ecx, [ebp - 0x38]
call fcn.10004041
xor esi, esi
cmp dword [ebp - 0x10], edi
jbe 0x100039ab
cmp dword [ebp - 0x10], esi
jb 0x10003933
cmp dword [ebp - 0x14], edi
je 0x10003933
lea ecx, [ebp - 0x18]
call fcn.10004015
mov eax, dword [ebp - 0x14]
add eax, esi
jmp 0x10003938
mov eax, 0x100875b4
movsx eax, byte [eax]
push eax
call fcn.1002314c
test eax, eax
pop ecx
jne 0x10003969
cmp dword [ebp - 0x10], esi
jb 0x1000395f
cmp dword [ebp - 0x14], edi
je 0x1000395f
lea ecx, [ebp - 0x18]
call fcn.10004015
mov eax, dword [ebp - 0x14]
add eax, esi
jmp 0x10003964
mov eax, 0x100875b4
cmp byte [eax], 0x5f
jne 0x10003971
inc esi
cmp dword [ebp - 0x10], esi
ja 0x1000391f
jmp 0x100039ab
mov al, byte [ebp - 1]
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], al
call fcn.10004041
push esi
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x28]
call fcn.10003ec5
push dword [0x100875b0]
lea eax, [ebp - 0x28]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.10003ec5
push 1
lea ecx, [ebp - 0x28]
call fcn.10004041
mov ecx, dword [0x100ae4a0]
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.10003c6f
push eax
lea eax, [ebp - 0x58]
push 0x100922c4
push eax
call fcn.10005118
add esp, 0xc
push eax
mov ecx, 0x100ae460
call fcn.10003d8c
push 1
lea ecx, [ebp - 0x58]
mov dword [eax], esi
call fcn.10004041
push 1
lea ecx, [ebp - 0x68]
call fcn.10004041
push 1
lea ecx, [ebp - 0x18]
call fcn.10004041
mov ecx, dword [0x100ae4a0]
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
jmp 0x10003837
push 0xa
push 0x457
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, edi
jne 0x10003a33
push str.Cant_find_resource
call fcn.10003b73
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, edi
jne 0x10003a4b
push str.Cant_load_resource
call fcn.10003b73
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x10003a63
push str.Cant_lock_resource
call fcn.10003b73
mov eax, dword [ebp - 8]
mov esi, dword [eax]
push 4
pop ebx
add dword [ebp - 8], ebx
push 0x40
push 0x3000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push dword [ebp - 8]
mov dword [0x100ae49c], eax
push eax
call fcn.100224b0
add dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add dword [ebp - 8], ebx
add esp, 0xc
cmp eax, edi
jle 0x10003aea
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10003b91
mov eax, dword [0x100ae49c]
cmp dword [ebp - 0x5c], eax
jl 0x10003abe
add eax, esi
cmp dword [ebp - 0x5c], eax
jl 0x10003ac8
push str.Illegal_symbol_value
call fcn.10003b73
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x100ae470
call fcn.10003d8c
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x6c]
call fcn.10004041
dec edi
jne 0x10003aa0
xor edi, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add dword [ebp - 8], ebx
cmp eax, edi
jle 0x10003b24
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10003b91
mov esi, dword [ebp - 0x5c]
lea eax, [ebp - 0x6c]
push eax
call fcn.10003bf6
sub eax, esi
add dword [esi], eax
push 1
lea ecx, [ebp - 0x6c]
call fcn.10004041
dec edi
jne 0x10003af8
xor edi, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add dword [ebp - 8], ebx
cmp eax, edi
jle 0x10003b5a
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10003b91
mov esi, dword [ebp - 0x5c]
lea eax, [ebp - 0x6c]
push eax
call fcn.10003bf6
add dword [esi], eax
push 1
lea ecx, [ebp - 0x6c]
call fcn.10004041
dec edi
jne 0x10003b32
mov ecx, 0x100ae460
call fcn.10004276
mov ecx, 0x100ae470
call fcn.10004276
pop edi
pop esi
pop ebx
leave
ret