Function at 0x1000f160
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1005b034]
xor eax, esp
mov dword [esp + 0x28], eax
cmp byte [0x100672c1], 0
push ebx
push esi
push edi
je 0x1000f457
mov byte [0x100672c1], 0
call fcn.10018a20
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
call esi
mov ebx, eax
call fcn.1000ee50
lea ecx, [esp + 0x10]
call fcn.1000eef0
mov edi, eax
mov esi, 0x10168c8c
call fcn.10003280
cmp dword [esp + 0x24], 0x10
jb 0x1000f1cb
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x1000f150
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x10]
push ecx
call fcn.10018cf0
add esp, 4
mov edi, eax
mov esi, 0x1017308c
call fcn.10003280
cmp dword [esp + 0x24], 0x10
jb 0x1000f20b
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
push ebx
push ebx
push ebx
push 0x1000e620
push ebx
push ebx
mov byte [0x1017653b], 1
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x18
push ebx
push ebx
push ebx
push fcn.1000cf00
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10005840
push ebx
push ebx
mov dword [0x101774d4], 0x1004e5f0
mov byte [0x101774de], 1
mov byte [0x101742d7], bl
mov byte [0x101744ea], bl
mov byte [0x101774d8], bl
mov word [0x101774cc], bx
mov word [0x101774cf], bx
mov dword [0x101774da], ebx
mov byte [0x10176778], bl
call esi
call fcn.10017560
test al, al
jne 0x1000f2b3
push 0x100672c8
call fcn.100305a0
add esp, 4
mov dword [0x101768e4], ebx
call fcn.10009890
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1003e6b0
mov esp, ebp
pop ebp
ret
call fcn.100312b0
call fcn.1000e6f0
test al, al
jne 0x1000f2c6
call fcn.1002f350
push ebx
push ebx
push ebx
push 0x1000d110
push ebx
push ebx
call esi
cmp dword [0x10172f44], 1
jne 0x1000f2f3
push 0x1004e510
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.PluginRG.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.1000e7c0
cmp byte [0x10176778], bl
je 0x1000f31e
mov esi, dword [0x101774ec]
mov dword [0x10176550], esi
mov ecx, 9
mov edi, 0x101768ec
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x100040c0
push ebx
push ebx
call esi
call fcn.1001a2c0
test al, al
jne 0x1000f338
call fcn.10030550
lea eax, [esp + 0x10]
mov edi, eax
mov dword [esp + 0x10], vtable.._AV___Impl_no_alloc0_U___Callable_obj_V_lambda2___A0x0c8786a9___0A__tr1_std__X_tr1_std__.0
mov dword [esp + 0x20], eax
call fcn.1000ed30
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x1000f369
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
mov eax, edi
cmp ecx, eax
setne al
movzx eax, al
push eax
call edx
sub esp, 0x18
mov ecx, 0x1003c1c0
mov dword [esp + 0x24], esp
mov eax, esp
test ecx, ecx
jne 0x1000f380
mov dword [eax + 0x10], ebx
jmp 0x1000f39a
cmp eax, ebx
je 0x1000f397
mov dword [eax], vtable.std::tr1::_Impl_base0_void_.0
mov dword [eax], vtable.std::tr1::_Impl_no_alloc0_struct_std::tr1::_Callable_fun_void____cdecl__const__void___0___void_.0
mov dword [eax + 4], 0x1003c1c0
mov dword [eax + 0x10], eax
call fcn.1003c080
add esp, 0x18
call fcn.100109c0
call fcn.10009ec0
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
push ebx
push 0x10017890
mov byte [0x101744e9], 1
call edi
push ebx
push 0x100382d0
call edi
mov byte [0x101744e9], bl
call fcn.1003ca70
push ebx
push ebx
push ebx
push 0x10024f60
push ebx
push ebx
mov byte [0x101774df], bl
call esi
mov dword [0x101775ac], eax
call fcn.1002f480
cmp byte [0x10176778], bl
je 0x1000f42d
push ebx
push ebx
push ebx
push 0x1000d2e0
push ebx
push ebx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
push str.GetVolumeInformationA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1000f42d
mov esi, eax
call fcn.1000ecf0
lea ecx, [esp + 0x10]
call fcn.1000d6a0
mov edi, eax
mov esi, 0x10168c70
call fcn.10003280
cmp dword [esp + 0x24], 0x10
jb 0x1000f457
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003e6b0
mov esp, ebp
pop ebp
ret