Function at 0x1002e861
Capabilities:
Extract resource via kernel32 functions
Resume thread

Disassembly:
mov eax, 0x1007f874
call fcn.1007e728
sub esp, 0x60
push ebx
push esi
push edi
mov edi, ecx
push 1
push edi
call fcn.1002873d
pop ecx
pop ecx
mov dword [ebp - 0x18], 0xfffc
lea ecx, [ebp - 0x3c]
push 1
call fcn.10012956
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1002e8a8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov dword [eax + ecx*4], 0xcf1813f1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1002e898
mov dword [ebp - 0x14], ebx
jmp 0x1002e8c1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0x1b71
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002e8b3
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 5
mov eax, dword [ebp - 0x3c]
setne cl
mov dword [eax], ecx
test ecx, ecx
jne 0x1002e907
mov eax, dword [ebp - 0x28]
test eax, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
sub ecx, eax
jne 0x1002e907
mov ecx, ebx
jmp 0x1002e90a
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x28]
jne 0x1002e95b
push 2
pop esi
push esi
lea ecx, [ebp - 0x48]
call fcn.10012956
mov dword [ebp - 0x18], ebx
jmp 0x1002e944
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e934
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
dec dword [eax]
call fcn.10012bab
jmp 0x1002ea23
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xffffffe4
cmp dword [ebp - 0x18], 4
je 0x1002ea13
push 2
pop esi
push 1
lea ecx, [ebp - 0x54]
call fcn.10012956
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x14], 0xfffffff8
push 1
call fcn.10012956
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1002e9a5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e999
mov dword [ebp - 0x14], ebx
jmp 0x1002e9bd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x24], 0x8ac29ba1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e9af
mov dword [ebp - 0x14], ebx
jmp 0x1002e9d7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 0xb5dfeb07
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e9c7
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov eax, dword [ebp - 0x3c]
setg cl
mov dword [eax], ecx
lea ecx, [ebp - 0x60]
call fcn.10012bab
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.10012bab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x1002e972
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002ea23
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10012bab
push edi
call fcn.1001272c
pop ecx
mov esi, eax
mov dword [ebp - 0x18], ebx
jmp 0x1002ea4b
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x6c], 0xec0ae971
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ea3d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002ea65
push 0x83b
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002ea76
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret