Function at 0x1000359a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push 0x68
mov eax, 0x10082ddb
call fcn.1005825d
xor edi, edi
jmp 0x10003768
push ebx
lea ecx, [ebp - 0x28]
call fcn.10002198
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edx, 0xf
mov dword [ebp - 4], edi
cmova eax, ecx
seta byte [ebp - 0x61]
cmp byte [eax], 0x5f
lea eax, [ebp - 0x28]
jne 0x1000360f
push eax
push 0x10087860
lea eax, [ebp - 0x40]
push eax
call fcn.100017a2
push eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x100ad380
call fcn.10001ee1
mov ecx, dword [0x100ad3a0]
push ebx
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0x40]
jmp 0x10003757
cmp byte [ebp - 0x61], 0
cmovne eax, ecx
cmp byte [eax], 0x21
jne 0x10003651
lea eax, [ebp - 0x61]
push eax
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002149
lea ecx, [ebp - 0x28]
call fcn.10002eed
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002e58
lea ecx, [ebp - 0x40]
call fcn.10002eed
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp edx, 0xf
lea eax, [ebp - 0x28]
cmova eax, ecx
movsx eax, byte [eax]
push eax
call fcn.1005d130
pop ecx
test eax, eax
jne 0x10003698
lea eax, [ebp - 0x61]
push eax
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002149
lea ecx, [ebp - 0x28]
call fcn.10002eed
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002e58
lea ecx, [ebp - 0x40]
call fcn.10002eed
mov esi, edi
cmp dword [ebp - 0x18], esi
jbe 0x10003708
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp ecx, 0xf
lea eax, [ebp - 0x28]
cmova eax, edx
movsx eax, byte [eax + esi]
push eax
call fcn.1005d130
mov edx, dword [ebp - 0x28]
pop ecx
mov ecx, dword [ebp - 0x14]
test eax, eax
jne 0x100036d2
cmp ecx, 0xf
lea eax, [ebp - 0x28]
cmova eax, edx
cmp byte [eax + esi], 0x5f
jne 0x100036da
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x100036a5
jmp 0x10003708
lea eax, [ebp - 0x61]
push eax
push esi
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002149
lea ecx, [ebp - 0x28]
call fcn.10002eed
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002e58
lea ecx, [ebp - 0x40]
call fcn.10002eed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.10023969
push eax
push 0x10087864
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.10001777
push eax
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 3
push eax
mov ecx, 0x100ad380
call fcn.10001ee1
mov ecx, dword [0x100ad3a0]
push ebx
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x40]
mov dword [esi + 0x28], eax
call fcn.10002eed
lea ecx, [ebp - 0x5c]
call fcn.10002eed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10002eed
mov ecx, dword [0x100ad3a0]
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
test ebx, ebx
jne 0x100035ad
push 0xa
push 0x457
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100038e2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100038e2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x100038e2
mov ebx, dword [eax]
lea esi, [eax + 4]
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push esi
push eax
mov dword [0x100ad39c], eax
call fcn.1005a7a0
mov ecx, dword [esi + ebx]
lea eax, [ebx + 4]
add eax, esi
mov dword [ebp - 0x70], ecx
add esp, 0xc
mov dword [ebp - 0x68], eax
test ecx, ecx
jle 0x10003845
mov esi, ecx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.10003423
mov eax, dword [0x100ad39c]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x48], eax
jl 0x100038e2
add eax, ebx
cmp dword [ebp - 0x48], eax
jge 0x100038e2
lea eax, [ebp - 0x60]
mov ecx, 0x100ad38c
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.10001e55
or dword [ebp - 4], 0xffffffff
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov dword [ecx + 0x28], eax
lea ecx, [ebp - 0x60]
call fcn.10002eed
inc edi
cmp edi, esi
jl 0x100037ea
mov eax, dword [ebp - 0x68]
mov edi, dword [eax]
add eax, 4
mov dword [ebp - 0x68], eax
test edi, edi
jle 0x10003889
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.10003423
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 4], 5
call fcn.100033ac
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
sub eax, esi
add dword [esi], eax
call fcn.10002eed
sub edi, 1
jne 0x10003851
mov eax, dword [ebp - 0x68]
mov edi, dword [eax]
add eax, 4
mov dword [ebp - 0x68], eax
test edi, edi
jle 0x100038c8
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10003423
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 6
call fcn.100033ac
add dword [esi], eax
lea ecx, [ebp - 0x44]
or dword [ebp - 4], 0xffffffff
call fcn.10002eed
sub edi, 1
jne 0x10003895
mov ecx, 0x100ad380
call fcn.1000300e
mov ecx, 0x100ad38c
call fcn.1000300e
call fcn.1005820c
ret
call fcn.10003373
int3