Function at 0x10003700
Capabilities:
Extract resource via kernel32 functions
Get system information on windows
Link many functions at runtime
Resume thread
Suspend thread

Disassembly:
sub esp, 0x14
push 0x1005c4d0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jle 0x1000371e
mov eax, 1
add esp, 0x14
ret 4
push ebp
xor ebp, ebp
cmp dword [0x1005c4cc], ebp
push esi
push edi
jne 0x10003739
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1005c4cc], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push 0x1002036c
push 0x1002b714
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x1002b704
push 0x1002b714
mov dword [0x1005c464], eax
call edi
push eax
call esi
push 0x1002b728
push 0x1002b714
mov dword [0x1005c4a0], eax
call edi
push eax
call esi
push 0x10020354
push 0x1002b714
mov dword [0x1005c49c], eax
call edi
push eax
call esi
push 0x1002033c
push 0x1002b714
mov dword [0x1005c4c8], eax
call edi
push eax
call esi
push 0x10020320
push 0x1002b714
mov dword [0x1005c494], eax
call edi
push eax
call esi
push 0x10020308
push 0x1002b714
mov dword [0x1005c4c4], eax
call edi
push eax
call esi
push 0x100202f4
push 0x1002b714
mov dword [0x1005c460], eax
call edi
push eax
call esi
push 0x1005c470
mov dword [0x1005c45c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 4
call fcn.10002e89
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x10003813
push ebp
mov ecx, ebx
mov dword [ebx], ebp
call fcn.100035c0
mov dword [0x1005c46c], ebx
jmp 0x10003819
mov dword [0x1005c46c], ebp
lea eax, [esp + 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100038df
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
push 1
mov dword [esp + 0x20], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edx
call ebp
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x100038d2
push eax
lea ecx, [esp + 0x20]
call fcn.10002def
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
push 1
push edx
call ebp
test eax, eax
je 0x100038c5
mov ecx, dword [ebx]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov edx, dword [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.100035c0
mov ebp, dword [esp + 0x18]
mov ecx, dword [0x1005c46c]
push ebp
call fcn.100035c0
push ebp
call fcn.10002e75
mov eax, dword [esp + 0x20]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x100038d2
push ebx
call fcn.10002e75
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
mov eax, dword [0x1005c438]
cmp eax, ebp
je 0x100038ee
push eax
call fcn.100030e0
push 0x100202e4
push 0x1002bfb4
mov dword [0x1005c4bc], ebp
mov dword [0x1005c498], 0x10020228
mov dword [0x1005c4b8], ebp
call edi
push eax
call esi
cmp eax, ebp
mov dword [0x1005c468], eax
je 0x1000392e
push 0x1005c4b8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x1005c468]
push 0x10020218
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebp
mov dword [0x1005c4b0], eax
je 0x10003a75
push 0x100201f8
push eax
call esi
mov dword [0x1005c4a8], eax
mov eax, dword [0x1005c4b0]
cmp eax, ebp
je 0x100039b5
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edx, dword [0x1005c4b0]
mov ebx, eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
mov eax, dword [0x1005c4b0]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test ebp, ebp
je 0x100039b3
cmp word [ebp + 0x26], 0
lea eax, [ebp + 0x26]
jne 0x100039a9
jmp 0x100039a0
add eax, 2
cmp word [eax], 0
je 0x100039a0
movzx ecx, word [eax + 0x12]
mov dword [0x1005c4ac], ecx
xor ebp, ebp
push 0x100201dc
push 0x1002b714
call edi
push eax
call esi
mov edi, dword [esp + 0x28]
cmp edi, ebp
mov dword [0x1005c4a4], eax
pop ebx
je 0x100039df
mov edx, dword [0x1005c430]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x1005c444]
mov eax, dword [0x1005c43c]
mov edx, dword [0x1005c44c]
neg ecx
push eax
mov eax, dword [0x1005c450]
sbb ecx, ecx
and ecx, dword [0x1005c440]
push ecx
mov ecx, dword [0x1005c454]
push edx
mov edx, dword [0x1005c458]
push eax
push ecx
push edx
push edi
call fcn.10003040
add esp, 0x1c
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp edi, ebp
je 0x10003a6a
mov eax, dword [0x1005c448]
cmp eax, ebp
je 0x10003a3c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x1005c448], ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
push ebp
push 2
push 0x1005c4d8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x1005c4d8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret 4
mov dword [0x1005c4a8], ebp
jmp 0x100039b5