Function at 0x1021f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 2
pop ebx
push 4
xor esi, esi
pop edi
push 0x7530
push esi
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
mov dword [0x103c510], esi
call fcn.0101191b
call fcn.01032977
test eax, eax
je 0x1022003
lea eax, [ebp - 0xc]
push eax
call fcn.010325f1
test eax, eax
jne 0x1022003
cmp dword [ebp - 0xc], esi
je 0x1022003
push esi
call fcn.010326b7
push edi
lea eax, [ebp - 0x44]
push eax
call fcn.01021938
push edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call sub.FXSEVENT.dll_InitializeEventLog
test eax, eax
jne 0x102202a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10223be
call fcn.010256de
test eax, eax
je 0x1022382
call fcn.01025805
test eax, eax
je 0x1022382
mov edi, 0x10000000
push edi
mov ecx, 0x103d5cc
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103c1a0
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103c1bc
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103c234
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103c29c
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103d604
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103c2ec
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103d620
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103d688
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103c2cc
call fcn.010328b4
test eax, eax
je 0x1022382
push edi
mov ecx, 0x103d63c
call fcn.010328b4
test eax, eax
je 0x1022382
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 1
push 1
push esi
call edi
cmp eax, esi
mov dword [0x103d52c], eax
je 0x1022382
push 4
call fcn.01033ada
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1022382
push 0x1002efc
push 0x3c
push esi
push 0x8000004
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov dword [0x103c51c], eax
jne 0x102217b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov edi, eax
call fcn.01033cc9
jmp 0x102238a
push dword [ebp - 4]
call fcn.01033cc9
push esi
push esi
push esi
push ebx
push dword [0x103c51c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [0x103c518], eax
je 0x1022382
push 0x100000
call fcn.01033ada
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1022382
push 0x1002e80
push esi
push 1
push eax
call edi
cmp eax, esi
mov dword [0x103c514], eax
je 0x1022166
push dword [ebp - 4]
call fcn.01033cc9
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call edi
or eax, 1
push eax
call edi
lea eax, [ebp - 8]
push eax
call fcn.01021e02
mov edi, eax
cmp edi, esi
jne 0x10223bc
call fcn.01014822
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1022233
push 0x18
pop eax
call fcn.0102e8e0
mov edi, esp
cmp edi, esi
je 0x102221f
push dword [ebp - 0xc]
push 0x1001814
push edi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push edi
push 0xc0007d3c
push 1
push 1
push 1
call sub.FXSEVENT.dll_FaxLog
add esp, 0x14
call fcn.01028083
mov edi, eax
cmp edi, esi
jne 0x1022249
call fcn.0100a26d
mov edi, eax
cmp edi, esi
je 0x1022272
push 0x18
pop eax
call fcn.0102e8e0
mov ebx, esp
cmp ebx, esi
je 0x1022267
push edi
push 0x1001814
push ebx
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push ebx
push 0xc0007d2c
jmp 0x10223ae
mov ecx, dword [0x103d8d4]
call fcn.010290ee
mov edi, eax
cmp edi, esi
jne 0x102238a
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
mov dword [0x103d5c4], ecx
lea ecx, [ebp - 0x14]
push ecx
push esi
push eax
push 0x1021b8e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x10223bc
push 0x4e20
push esi
push ebx
call fcn.0101191b
mov dword [ebp - 0xc], esi
push 0x2710
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, esi
je 0x1022305
cmp edi, 0x102
jne 0x1022377
mov eax, dword [0x103d5c4]
add dword [ebp - 0xc], 0x2710
imul eax, eax, 0x7530
cmp dword [ebp - 0xc], eax
jg 0x1022372
push 0x7530
push esi
push ebx
call fcn.0101191b
jmp 0x10222c0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1022377
push dword [ebp - 4]
mov edi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x10223bc
push 0x40007d01
push esi
push 3
push 1
call sub.FXSEVENT.dll_FaxLog
add esp, 0x10
push dword [0x103c094]
push 0x1002e68
call fcn.01011ad4
mov edi, eax
cmp edi, esi
jne 0x102238a
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push 0x1021df9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x103c510], eax
je 0x102238a
xor eax, eax
jmp 0x10223be
mov edi, 0x65b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10223bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0x18
pop eax
call fcn.0102e8e0
mov ebx, esp
cmp ebx, esi
je 0x10223a8
push edi
push 0x1001814
push ebx
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push ebx
push 0xc0007d29
push 1
push 1
push 1
call sub.FXSEVENT.dll_FaxLog
add esp, 0x14
mov eax, edi
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret