Function at 0x10002110
Capabilities:
Create thread
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013ef66
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov ecx, 0x101a6368
mov dword [ebp - 0x844], 0x101a6368
call fcn.10003038
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [0x101a6368], 0x10180164
call fcn.10125f70
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 0
push eax
lea ecx, [ebp - 0x814]
call fcn.10002cc0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x814]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x100021c5
push 0x80070057
call fcn.10002b80
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x100021e8
push esi
lea ecx, [ebp - 0x814]
call fcn.100029a0
mov eax, dword [ebp - 0x814]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.10129087
mov eax, dword [ebp - 0x814]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x100021bb
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x814]
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x814]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [eax - 0xc], ecx
jl 0x1000236d
push 0x101800a4
push eax
call fcn.10125764
add esp, 8
test eax, eax
je 0x1000236d
sub eax, dword [ebp - 0x814]
sar eax, 1
test eax, eax
jle 0x1000236d
push 0x1c
lea eax, [ebp - 0x830]
push eax
push 0x100020e0
call esi
mov edi, dword [ebp - 0x82c]
push 0x101800bc
push 0x6592
push edi
mov dword [ebp - 0x838], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x840], eax
test eax, eax
je 0x1000236d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x840]
mov edi, eax
push dword [ebp - 0x838]
mov dword [ebp - 0x83c], edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov esi, eax
call fcn.10128e50
push dword [ebp - 0x83c]
mov edi, eax
push esi
push edi
call fcn.101259f0
add esp, 0x10
push 0x101800c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x83c]
movups xmmword [ebp - 0x834], xmm0
push 0x101800d8
mov dword [ebp - 0x834], edi
mov edi, dword [ebp - 0x838]
push edi
movups xmmword [ebp - 0x824], xmm0
mov dword [ebp - 0x830], eax
call esi
push 0x101800f0
push edi
mov dword [ebp - 0x82c], eax
call esi
push 0x10180108
push edi
mov dword [ebp - 0x828], eax
call esi
push 0x10180114
push edi
mov dword [ebp - 0x824], eax
call esi
push 0x10180128
push edi
mov dword [ebp - 0x820], eax
call esi
push 0x10180148
push edi
mov dword [ebp - 0x81c], eax
call esi
lea ecx, [ebp - 0x834]
mov dword [ebp - 0x818], eax
call fcn.10001cd0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x830]
push eax
push 0x100020e0
call esi
push 0
push 0
push dword [ebp - 0x82c]
push 0x10002100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov esi, dword [ebp - 0x814]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100023bf
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 0x101a6368
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10122e6d
mov esp, ebp
pop ebp
ret