Function at 0x100bf94
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 1
xor ebx, ebx
pop ebp
mov dword [esp + 0x10], ebx
push 0x128
mov dword [esp + 0x18], ebp
push dword [0x10149c8]
call sub.GUtils.dll_gmem_get
mov esi, eax
push dword [esp + 0x20]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
call fcn.0100bde2
mov edi, eax
cmp edi, ebx
je 0x100c120
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x100c120
mov al, byte [edi]
cmp al, 0x2d
je 0x100c012
cmp al, 0x2f
je 0x100c012
cmp dword [esi + 4], ebx
jne 0x100c00a
mov dword [esi + 4], edi
jmp 0x100c0d5
mov dword [esi + 8], edi
jmp 0x100c0d5
movsx eax, byte [edi + 1]
lea ecx, [edi + 1]
cmp eax, 0x44
jg 0x100c030
jne 0x100c0db
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x14], ebx
jmp 0x100c0d5
cmp eax, 0x64
jg 0x100c03c
je 0x100c024
sub eax, 0x4c
jmp 0x100c03f
sub eax, 0x6c
je 0x100c0b8
dec eax
dec eax
je 0x100c0ad
dec eax
je 0x100c0a5
sub eax, 3
je 0x100c09b
dec eax
je 0x100c05c
dec eax
jne 0x100c11d
mov dword [esi + 0x1c], ebp
jmp 0x100c0d5
mov al, byte [ecx]
cmp al, bl
je 0x100c084
movsx eax, al
cmp eax, 0x4c
jg 0x100c212
je 0x100c25d
cmp eax, 0x44
jne 0x100c11d
or dword [esi + 0x14], 2
inc ecx
jmp 0x100c05c
cmp dword [esi + 0x14], ebx
jne 0x100c090
mov dword [esi + 0x14], 6
push ebx
call fcn.0100bde2
mov dword [esi + 0xc], eax
jmp 0x100c0d5
push ebx
call fcn.0100bde2
mov dword [esi], eax
jmp 0x100c0d5
mov dword [0x101309c], ebx
jmp 0x100c0d5
push ebx
call fcn.0100bde2
mov dword [esi + 0x10], eax
jmp 0x100c0d5
movsx eax, byte [edi + 2]
push eax
mov dword [esp + 0x14], ebp
call dword [sym.imp.MSVCRT.dll_toupper]
cmp eax, 0x52
pop ecx
jne 0x100c0d5
mov dword [esp + 0x10], 2
push ebx
jmp 0x100bfd5
cmp eax, 0x3f
jne 0x100c11d
push ebx
xor esi, esi
call fcn.0100bbb5
inc edi
cmp byte [edi + 1], bl
lea eax, [edi + 1]
je 0x100c0fb
cmp byte [edi], 0x3f
jne 0x100c0f7
inc esi
mov edi, eax
jmp 0x100c0e9
cmp esi, 2
jne 0x100c208
push 0x10014e4
push 0x100195c
push 0x10019a0
call fcn.010067d9
jmp 0x100c208
push ebx
jmp 0x100c177
cmp dword [esp + 0x10], ebx
je 0x100c191
cmp dword [esi + 8], ebx
je 0x100c132
push 0x2b1
jmp 0x100c171
cmp dword [esp + 0x10], ebp
jne 0x100c149
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
mov ecx, dword [esi + 8]
lea eax, [esi + 0x24]
mov dword [esi + 4], eax
jmp 0x100c15e
cmp dword [esi + 4], ebx
jne 0x100c155
mov dword [esi + 4], 0x10016b0
mov ecx, dword [esi + 4]
lea eax, [esi + 0x24]
mov dword [esi + 8], eax
push ecx
mov ebp, eax
call fcn.0100a2f8
mov edi, eax
cmp edi, ebx
jne 0x100c181
push 0x2b2
call fcn.0100e675
push eax
call fcn.0100bbb5
jmp 0x100c208
push ebp
push edi
call fcn.0100a543
push edi
call fcn.0100a525
push 1
pop ebp
cmp dword [esi + 0x1c], ebx
jne 0x100c1a3
cmp dword [esp + 0x10], ebx
jne 0x100c1a3
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1c], eax
cmp dword [esi + 4], ebx
je 0x100c208
cmp dword [esi + 8], ebx
jne 0x100c1b4
mov dword [esi + 8], 0x10016b0
call fcn.0100d092
cmp dword [esi + 0xc], ebx
je 0x100c1cc
push 6
push dword [0x10149c4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x1014af4]
call fcn.0100a6ed
mov dword [0x10145f8], eax
mov dword [0x10145f4], ebp
mov dword [esi + 0x18], eax
lea eax, [esp + 0x18]
push eax
push ebx
push esi
push fcn.0100d7af
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x1014604], eax
jne 0x100c208
push esi
call fcn.0100d7af
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
cmp eax, 0x58
jg 0x100c22d
je 0x100c24c
sub eax, 0x52
je 0x100c254
dec eax
jne 0x100c11d
or dword [esi + 0x14], ebp
jmp 0x100c081
sub eax, 0x64
je 0x100c07d
sub eax, 8
je 0x100c25d
sub eax, 6
je 0x100c254
dec eax
je 0x100c225
sub eax, 5
jne 0x100c11d
mov dword [esi + 0x20], ebp
jmp 0x100c081
or dword [esi + 0x14], 8
jmp 0x100c081
or dword [esi + 0x14], 4
jmp 0x100c081