Function at 0x100140c0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get common file path
Link many functions at runtime
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10049040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10014772
sub eax, 1
jne 0x1001478f
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x1004c1ac], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1003641c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1001bfb8
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1004c33c], eax
call fcn.10011f50
call fcn.10011af0
push 0
push 0
push 0
push 0x100112d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10036428
push dword [0x1004c33c]
call edi
push 0x10036454
push dword [0x1004c33c]
mov dword [0x1004c194], eax
call edi
push 0x10036468
push dword [0x1004c33c]
mov dword [0x1004c198], eax
call edi
push 0x10036480
push dword [0x1004c33c]
mov dword [0x1004c19c], eax
call edi
push 0x10036490
push dword [0x1004c33c]
mov dword [0x1004c1a0], eax
call edi
mov dword [0x1004c1a4], eax
lea eax, [ebp - 0x114]
push eax
push sym.d3d8.dll_Direct3DCreate8
push 6
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.10018640
movq xmm0, qword [str.d3d8.ini]
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
movq qword [eax], xmm0
mov cx, word [0x100362a0]
mov word [eax + 8], cx
lea eax, [ebp - 0x108]
push eax
push 0
push str.ForceWindowedMode
push str.MAIN
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
setne byte [0x1004c1b4]
push 0
push str.Direct3D8DisableMaximizedWindowedModeShim
push str.MAIN
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.FPSLimit
push str.MAIN
setne byte [0x1004c1b5]
call esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10035450]
lea eax, [ebp - 0x108]
push eax
push 0
push str.FullScreenRefreshRateInHz
cvtpd2ps xmm0, xmm0
push str.MAIN
movss dword [0x1004c1bc], xmm0
call esi
mov dword [0x1004c1c0], eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.DisplayFPSCounter
push str.MAIN
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.UsePrimaryMonitor
push str.FORCEWINDOWED
setne byte [0x1004c1bb]
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
push 1
push str.CenterWindow
push str.FORCEWINDOWED
setne byte [0x1004c1b6]
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.BorderlessFullscreen
push str.FORCEWINDOWED
setne byte [0x1004c1b7]
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.AlwaysOnTop
push str.FORCEWINDOWED
setne byte [0x1004c1b8]
call esi
test eax, eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.DoNotNotifyOnTaskSwitch
push str.FORCEWINDOWED
setne byte [0x1004c1b9]
call esi
movss xmm0, dword [0x1004c1bc]
test eax, eax
setne byte [0x1004c1ba]
comiss xmm0, dword [0x100365e8]
jbe 0x10014444
lea eax, [ebp - 0x108]
push eax
push 1
push str.FPSLimitMode
push str.MAIN
call esi
xor ebx, ebx
cmp eax, 2
sete bl
inc ebx
cmp eax, 2
jne 0x100143dc
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movss xmm1, dword [0x1004c1bc]
movsd xmm0, qword [0x10036600]
cvtps2pd xmm1, xmm1
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
divsd xmm0, xmm1
movsd qword [0x1004c308], xmm0
call fcn.10016ca0
movaps xmm1, xmm0
divsd xmm1, qword [0x10036600]
jmp 0x1001440c
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
call fcn.10016ca0
movaps xmm1, xmm0
movss xmm0, dword [0x1004c1bc]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
lea eax, [ebp - 0x11c]
movsd qword [0x1004c2f8], xmm1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x11c]
call fcn.10016ca0
divsd xmm0, qword [0x1004c2f8]
movsd qword [0x1004c300], xmm0
jmp 0x10014446
xor ebx, ebx
cmp byte [0x1004c1b5], 0
mov dword [0x1004c160], ebx
je 0x100144a7
push 0x10036428
push dword [0x1004c33c]
call edi
mov ebx, eax
test ebx, ebx
je 0x100144a7
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10c]
push eax
push 0x40
push 4
lea edi, [ebx + 6]
push edi
call esi
mov eax, dword [ebx + 2]
mov dword [edi], 0
mov dword [eax], 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x10c]
push 4
push edi
call esi
mov byte [0x1004c1b4], 0
cmp byte [0x1004c1ba], 0
je 0x1001475d
push 0x104
push 0x1004c1c8
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
push 0x10013b00
push str.RegisterClassA
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013d10
push str.RegisterClassW
mov dword [0x1004c164], eax
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013bb0
push str.RegisterClassExA
mov dword [0x1004c168], eax
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013c60
push str.RegisterClassExW
mov dword [0x1004c16c], eax
call fcn.10012fd0
add esp, 0x50
mov dword [0x1004c170], eax
push 0
push 0
push 0
push 0x10013670
push str.GetForegroundWindow
call fcn.10012fd0
push 0
push 0
push 0
push 0x100135d0
push str.GetActiveWindow
mov dword [0x1004c174], eax
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013620
push str.GetFocus
mov dword [0x1004c178], eax
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013a40
push 0x10036388
mov dword [0x1004c17c], eax
call fcn.10012fd0
add esp, 0x50
mov dword [0x1004c180], eax
push 0
push 0
push 0
push 0x10013ad0
push str.LoadLibraryW
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013a70
push str.LoadLibraryExA
mov dword [0x1004c184], eax
call fcn.10012fd0
push 0
push 0
push 0
push 0x10013aa0
push 0x100363b8
mov dword [0x1004c188], eax
call fcn.10012fd0
push 0
push 0
push 0
push 0x100135a0
push 0x100363c8
mov dword [0x1004c18c], eax
call fcn.10012fd0
add esp, 0x50
mov dword [0x1004c190], eax
push 0
push 0
push 0
push 0x10013690
push 0x100363d4
call fcn.10012fd0
push 0
push 0
push dword [0x1004c33c]
push 0x10013690
push 0x100363d4
call fcn.10012fd0
add esp, 0x28
cmp dword [0x1004c174], 0
push 0
push 0
push dword [0x1004c33c]
push 0x10013670
push str.GetForegroundWindow
jne 0x1001465f
call fcn.10012fd0
mov dword [0x1004c174], eax
jmp 0x10014664
call fcn.10012fd0
add esp, 0x14
push str.ole32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x10014758
cmp dword [0x1004c164], 0
push 0
push 0
push esi
push 0x10013b00
push str.RegisterClassA
jne 0x100146a0
call fcn.10012fd0
mov dword [0x1004c164], eax
jmp 0x100146a5
call fcn.10012fd0
add esp, 0x14
cmp dword [0x1004c168], 0
push 0
push 0
push esi
push 0x10013d10
push str.RegisterClassW
jne 0x100146cc
call fcn.10012fd0
mov dword [0x1004c168], eax
jmp 0x100146d1
call fcn.10012fd0
add esp, 0x14
cmp dword [0x1004c16c], 0
push 0
push 0
push esi
push 0x10013bb0
push str.RegisterClassExA
jne 0x100146f8
call fcn.10012fd0
mov dword [0x1004c16c], eax
jmp 0x100146fd
call fcn.10012fd0
add esp, 0x14
cmp dword [0x1004c170], 0
push 0
push 0
push esi
push 0x10013c60
push str.RegisterClassExW
jne 0x10014724
call fcn.10012fd0
mov dword [0x1004c170], eax
jmp 0x10014729
call fcn.10012fd0
add esp, 0x14
cmp dword [0x1004c178], 0
push 0
push 0
push esi
push 0x100135d0
push str.GetActiveWindow
jne 0x10014750
call fcn.10012fd0
mov dword [0x1004c178], eax
jmp 0x10014755
call fcn.10012fd0
add esp, 0x14
call fcn.10010d00
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016b64
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x1004c160], 2
jne 0x10014783
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push dword [0x1004c33c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.10016b64
mov esp, ebp
pop ebp
ret 0xc