Function at 0x1010fa3
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
je 0x10146aa
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100180a
mov dword [eax - 4], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 0x14
cmp eax, 0x1048d64
jl 0x1009c14
mov eax, dword [0x10484f4]
mov dword [0x1048ae0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push ebx
push ebx
push ebx
push ebx
mov dword [0x1048ae4], eax
mov dword [0x1048ae8], ebx
mov dword [0x1048aec], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, edi
mov dword [0x1048af0], eax
call fcn.0100166e
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp dword [0x10482d0], ebx
je 0x1009d08
lea ecx, [ebp - 0x30]
call fcn.01008940
mov esi, 0x1009d9c
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.01012dac
cmp eax, ebx
lea ecx, [ebp - 0x30]
jl 0x101a3b6
push esi
call fcn.01012df3
cmp eax, ebx
jl 0x101a3d0
push 1
push esi
call fcn.010086c8
mov esi, eax
mov dword [ebp - 0x1c], esi
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
mov byte [ebp - 4], 2
push esi
js 0x101a3d5
lea ecx, [ebp - 0x30]
call fcn.010087f7
cmp eax, ebx
jl 0x101a3e1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.01012e3b
cmp eax, ebx
mov byte [ebp - 4], 1
push esi
jl 0x101a3d9
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.010087e9
push ebx
push ebx
push ebx
push 2
push 4
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
cmp esi, ebx
jl 0x101a3e4
push dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
jl 0x10146d9
push 1
push 4
push edi
call fcn.0100b2b7
cmp eax, ebx
jl 0x101a4a1
mov esi, dword [ebp - 0x18]
push 0x1003958
push dword [esi + 0x4e0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1009d6e
mov ecx, esi
call fcn.0100e64d
push ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.01003900
mov esi, dword [sym.imp.USER32.dll_SetWinEventHook]
push ebx
push ebx
push ebx
push 0x1001539
push ebx
push 0x8003
push 0x8002
call esi
jmp 0x101a3f6
mov ecx, eax
call fcn.010039c1
push ebx
push ebx
push ebx
push 0x1003e01
push ebx
push 0x20
push 0x20
call esi
jmp 0x101a400
push ebx
push ebx
push ebx
push 0x100df4e
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov ecx, dword [ebp - 0x18]
add esp, 0x18
push 0xffffffffffffffff
mov dword [ecx + 0x558], eax
push dword [0x1048af0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10489ac]
cmp eax, 0x10489ac
je 0x100df14
test byte [eax + 0x1c], 0x10
jne 0x101a45b
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov esi, ecx
or esi, edx
mov edi, 0x610
mov esi, 0x1009484
jne 0x101a47c
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x101a491
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100180a
push 0x30
mov eax, 0x1043fdd
call fcn.01001a8e
mov edi, ecx
mov dword [ebp - 0x18], edi
push 0x1011004
call fcn.0100164a
pop ecx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
cmp eax, ebx
setge cl
cmp eax, ebx
mov dword [edi + 0x970], ecx
jl 0x101a34c
push 1
mov esi, 0x80000002
push esi
mov ecx, edi
call fcn.01005b3b
push ebx
mov ecx, edi
cmp dword [0x10482d0], ebx
je 0x101a369
jmp 0x101a35e
mov ecx, edi
call fcn.01017129
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [edi + 0x4f0], ebx
mov edi, section..data
mov ecx, edi
call fcn.01009da7
mov ecx, edi
call fcn.01001652
mov eax, 0x1048ae4
jmp 0x1009c14
mov eax, dword [0x10489ac]
cmp eax, 0x10489ac
je 0x10146c0
test byte [eax + 0x1c], 0x10
jne 0x101a4b3
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x101a4d4
cmp dword [ebp - 0x14], ebx
jne 0x101a4e8
mov esi, dword [ebp - 0x18]
add esi, 0x50c
mov eax, dword [esi]
cmp eax, ebx
je 0x10146f5
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
call fcn.01001b72
push 0x1014708
call fcn.0100164a
pop ecx
call fcn.01001a75
ret
push eax
push 0x101a720
call fcn.0100164a
pop ecx
pop ecx
jmp 0x1010fde
push esi
call fcn.01005b3b
jmp 0x101103e
push 0x80000001
call fcn.01005b3b
test eax, eax
jge 0x101103e
push ebx
push esi
mov ecx, edi
call fcn.01005b3b
cmp eax, ebx
jl 0x101a3a4
push 0x80000001
mov ecx, edi
call fcn.01028338
cmp eax, ebx
jge 0x101103e
push eax
push 0x101a6a8
jmp 0x101a3aa
push eax
push 0x101a630
call fcn.0100164a
pop ecx
pop ecx
jmp 0x101103e
mov byte [ebp - 4], bl
call fcn.010087e9
push dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10146d9
lea ecx, [ebp - 0x30]
jmp 0x101a3b6
mov byte [ebp - 4], 1
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x101a3d0
push esi
jmp 0x101a3d5
push esi
push 0x101a5b8
call fcn.0100164a
pop ecx
pop ecx
jmp 0x1009d26
call fcn.010015fd
jmp 0x100deb9
cmp dword [0x10482d0], ebx
je 0x100ded4
push 0x101a588
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, ebx
setne byte [ebp - 0xd]
cmp eax, ebx
je 0x101a42e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], bl
jne 0x100ded4
mov eax, dword [ebp - 0x18]
push 2
push ebx
push ebx
push 0x1031052
mov dword [eax + 0x51c], ebx
push ebx
mov eax, 0x8005
push eax
push eax
call esi
mov dword [ebp - 0x14], eax
jmp 0x100ded4
push 0x101a56c
push 0x101cb70
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010223fa
mov eax, dword [0x10489ac]
jmp 0x100df14
push 1
push edx
push ecx
push edi
push esi
call fcn.01015316
mov eax, dword [0x10489ac]
jmp 0x100df2e
push 2
push eax
push ecx
push edi
push esi
call fcn.01015316
jmp 0x100df3e
push eax
push 0x101a4f8
call fcn.0100164a
pop ecx
pop ecx
jmp 0x10146d9
push 0x101a56c
push 0x101cb70
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010223fa
mov eax, dword [0x10489ac]
jmp 0x10146c0
push 1
push eax
push ecx
push 0x61c
push esi
call fcn.01015316
jmp 0x10146d0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnhookWinEvent]
jmp 0x10146d9