Function at 0x10002110
Capabilities:
Create thread
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013ef86
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov ecx, 0x101a6368
mov dword [ebp - 0x840], 0x101a6368
call fcn.10003058
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [0x101a6368], 0x1018016c
call fcn.10125f90
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 0
push eax
lea ecx, [ebp - 0x814]
call fcn.10002ce0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x814]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x100021c5
push 0x80070057
call fcn.10002ba0
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x100021e8
push esi
lea ecx, [ebp - 0x814]
call fcn.100029c0
mov eax, dword [ebp - 0x814]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.101290a7
mov eax, dword [ebp - 0x814]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x100021bb
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x814]
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x814]
cmp dword [eax - 0xc], ecx
jl 0x100023be
push 0x101800a4
push eax
call fcn.10125784
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x814]
test ecx, ecx
je 0x100023be
sub ecx, eax
sar ecx, 1
test ecx, ecx
jle 0x100023be
push 0x1c
lea eax, [ebp - 0x830]
push eax
push 0x100020e0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x82c]
push 0x101800bc
push 0x6590
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x838], eax
test eax, eax
jne 0x100022a7
mov byte [ebp - 4], al
or eax, 0xffffffff
mov edx, dword [ebp - 0x814]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100023da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100023da
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x838]
mov edi, eax
push esi
mov dword [ebp - 0x83c], edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov esi, eax
call fcn.10128e70
push dword [ebp - 0x83c]
mov edi, eax
push esi
push edi
call fcn.10125a10
add esp, 0x10
push 0x101800cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x83c]
movups xmmword [ebp - 0x834], xmm0
push 0x101800e0
mov dword [ebp - 0x834], edi
mov edi, dword [ebp - 0x838]
push edi
movups xmmword [ebp - 0x824], xmm0
mov dword [ebp - 0x830], eax
call esi
push 0x101800f8
push edi
mov dword [ebp - 0x82c], eax
call esi
push 0x10180110
push edi
mov dword [ebp - 0x828], eax
call esi
push 0x1018011c
push edi
mov dword [ebp - 0x824], eax
call esi
push 0x10180130
push edi
mov dword [ebp - 0x820], eax
call esi
push 0x10180150
push edi
mov dword [ebp - 0x81c], eax
call esi
lea ecx, [ebp - 0x834]
mov dword [ebp - 0x818], eax
call fcn.10001cd0
push 0x1c
lea eax, [ebp - 0x830]
push eax
push 0x100020e0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0
push dword [ebp - 0x82c]
push 0x10002100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x814]
lea esi, [eax - 0x10]
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100023da
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 0x101a6368
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10122e96
mov esp, ebp
pop ebp
ret