Function at 0x3000d170
Capabilities:
Create thread
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
sub esp, 0xa8
push ebp
push esi
push edi
push 0
mov esi, ecx
mov eax, dword [esi + 0x24]
mov edi, dword [esi + 0x34]
mov ecx, dword [esi + 0xc8]
push 0
push eax
push 0
push 0x30293acc
lea eax, [esp + 0x23]
lea ebp, [esi + 0x34]
push eax
push edi
mov byte [esp + 0x2b], 0
call fcn.300057d0
test al, al
je 0x3000d1b8
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 0xa8
ret
test edi, edi
push ebx
je 0x3000d27d
push str.res:__
push edi
call fcn.30074f60
add esp, 8
test eax, eax
je 0x3000d28c
push str.res:__RESOURCE_ID_
push edi
call fcn.30074f60
push eax
call fcn.30075200
mov ecx, dword [esi + 0xc8]
mov edi, dword [ecx + 0xf88]
add esp, 0xc
movzx edx, ax
push str.SPLA
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x3000d376
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x3000d27d
mov eax, dword [esi]
mov ecx, esi
mov byte [esp + 0x13], 1
call dword [eax + 0x18]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
mov edi, eax
push ebp
push ebx
mov ecx, edi
call fcn.300f1780
mov ecx, edi
call fcn.300f2690
mov byte [esi + 0xcc], 1
mov eax, dword [edi + 0x218]
test eax, eax
jne 0x3000d26f
mov ecx, edi
call fcn.300e4110
push eax
push 1
mov ecx, edi
call fcn.300f2e80
mov byte [esi + 0x21], 1
mov al, byte [esp + 0x13]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xa8
ret
mov eax, dword [esi + 0x68]
cmp eax, 2
mov edi, 4
je 0x3000d2d9
cmp eax, edi
je 0x3000d2d9
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x3000d150
push 0
push 0
mov byte [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0xec], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov byte [esp + 7], 1
mov al, byte [esp + 7]
pop ebp
add esp, 0xa8
ret
mov ecx, dword [esi + 0xc8]
call fcn.300f88b0
lea ecx, [esp + 0x24]
push ecx
mov ebx, eax
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
test al, al
jne 0x3000d4c1
cmp dword [esp + 0x28], edi
jbe 0x3000d3b0
mov eax, dword [esi + 0x68]
xor ebx, ebx
cmp eax, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x18]
jne 0x3000d351
push 0x30293828
call fcn.30074eb0
mov eax, dword [esi + 0x40]
push eax
lea ecx, [esp + 0x1c]
call fcn.30074eb0
mov ecx, dword [esi + 0x58]
push ecx
lea ecx, [esp + 0x1c]
call fcn.30074eb0
jmp 0x3000d35a
mov edx, dword [esi + 0x58]
push edx
call fcn.30074d90
mov eax, dword [esp + 0x18]
push eax
call fcn.3011e7c0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x3000d383
lea ecx, [esp + 0x18]
call fcn.30025af0
pop ebx
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xa8
ret
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov ebx, eax
call fcn.30208320
add esp, 4
lea ecx, [esp + 0x18]
call fcn.30025af0
jmp 0x3000d3e2
push ebx
mov ecx, ebp
call fcn.3011b010
mov edi, eax
test edi, edi
je 0x3000d376
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
mov ebx, eax
call fcn.30208320
add esp, 4
cmp ebx, 0xffffffff
je 0x3000d49f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
test al, al
je 0x3000d498
mov eax, dword [ebp]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
test al, al
je 0x3000d376
push 0
push ebx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x3000d489
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x34]
push 0x10000
call fcn.3007a1f0
mov edi, eax
add esp, 4
test edi, edi
je 0x3000d489
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [esp + 0x13], 1
lea esp, [esp]
push 0
lea eax, [esp + 0x18]
push eax
push 0x10000
push edi
push ebx
call ebp
test eax, eax
je 0x3000d47b
mov eax, dword [esp + 0x14]
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 0x20]
mov eax, dword [esp + 0x14]
test eax, eax
ja 0x3000d450
jmp 0x3000d480
mov byte [esp + 0x13], 0
push edi
call fcn.30208320
add esp, 4
mov al, byte [esp + 0x13]
test al, al
je 0x3000d498
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
test al, al
jne 0x3000d27d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov al, byte [esp + 0x13]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xa8
ret
push 0x24
call fcn.3007a1f0
add esp, 4
test eax, eax
je 0x3000d4da
mov ecx, eax
call fcn.3000be60
mov edi, eax
jmp 0x3000d4dc
xor edi, edi
push ebx
push ebp
mov ecx, edi
call fcn.3000c000
test al, al
mov ecx, esi
jne 0x3000d50a
mov edx, dword [esi]
call dword [edx + 0x28]
test edi, edi
je 0x3000d4fd
push 1
mov ecx, edi
call fcn.3000c520
pop ebx
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xa8
ret
mov eax, dword [esi]
call dword [eax + 0x1c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
mov ebx, eax
test ebx, ebx
je 0x3000d4f0
mov eax, dword [esi + 0xe0]
mov dword [edi + 0x18], eax
push edi
mov ecx, ebx
mov dword [esi + 0xe0], 0
call fcn.300e1550
mov eax, dword [edi]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x34]
mov eax, dword [ebx + 0x2d0]
test eax, eax
je 0x3000d552
mov byte [esi + 0xcc], 1
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0xa8
ret