Function at 0x10003090
Capabilities:
Create thread
Read file on windows
Terminate thread

Disassembly:
sub esp, 0x28
mov eax, dword [0x10035b10]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, 0x1003a278
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100030a6
sub eax, edx
push esi
cmp eax, 4
ja 0x10003142
push 0x1002f304
push 0x1002f76c
call fcn.10011568
mov esi, eax
add esp, 8
test esi, esi
je 0x10003338
xor eax, eax
push esi
push 0x1e
push 1
push 0x1003a278
mov dword [0x1003a278], eax
mov dword [0x1003a27c], eax
mov dword [0x1003a280], eax
mov dword [0x1003a284], eax
mov dword [0x1003a288], eax
mov dword [0x1003a28c], eax
mov dword [0x1003a290], eax
mov word [0x1003a294], ax
call fcn.10011c8c
push esi
call fcn.100115f6
push 0x1002f76c
call fcn.1001172e
mov eax, 0x1003a278
add esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003130
sub eax, edx
cmp eax, 4
jbe 0x10003338
push ebp
push 0
push 0
push 0
push 0x10003000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1002f76c
mov dword [esp + 0xc], eax
call fcn.1001172e
mov ebp, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 4
push 0x1002f79c
push 0
call ebp
test eax, eax
je 0x10003318
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push 0x1002f520
push 0
push eax
call edi
test eax, eax
je 0x10003317
push ebx
push 0
push 0x1002f534
push 0
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 2
push eax
call esi
push 2
push eax
call esi
push 2
push eax
call esi
push 2
push eax
call esi
push 2
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push 0xa000a
push 0
mov esi, eax
push 0x201
push esi
call ebx
push 0xa000a
push 0
push 0x202
push esi
call ebx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1002f778
push 0x1002f520
call ebp
mov ebp, eax
test ebp, ebp
je 0x10003316
push 0
push 0x1002f764
push 0
push ebp
call edi
test eax, eax
je 0x10003316
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov word [esp + 0x30], cx
mov ecx, 0x1003a278
mov esi, ecx
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10003250
sub ecx, esi
lea edi, [esp + 0x14]
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10003260
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1e
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call edi
push 0x1002f7a8
push 0x1002f534
push 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowExA]
call ebp
mov esi, eax
test esi, esi
je 0x10003316
push 0xa000a
push 0
push 0x201
push esi
call ebx
push 0xa000a
push 0
push 0x202
push esi
call ebx
push 0x7d0
call edi
push 0x1002f790
push 0x1002f520
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10003316
push 0x1002f7b0
push 0x1002f534
push 0
push eax
call ebp
push 0xa000a
push 0
mov esi, eax
push 0x201
push esi
call ebx
push 0xa000a
push 0
push 0x202
push esi
call ebx
pop ebx
pop edi
mov edx, dword [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001116a
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
mov eax, 1
call fcn.1001116a
add esp, 0x28
ret