Function at 0x1011fc4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push 0x144
push dword [0x1021d74]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], ebx
call fcn.01018604
mov esi, eax
cmp esi, ebx
jne 0x1012003
xor eax, eax
jmp 0x101270d
push edi
push dword [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
call fcn.0100eab1
mov edi, eax
cmp edi, ebx
je 0x10124ad
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x101249c
mov al, byte [edi]
cmp al, 0x2f
jne 0x1012054
cmp byte [edi + 1], al
jne 0x1012054
call fcn.0101286d
jmp 0x101205c
cmp al, 0x2d
je 0x101206f
cmp al, 0x2f
je 0x101206f
cmp dword [esi], ebx
jne 0x1012067
mov dword [esi], edi
jmp 0x1012489
mov dword [esi + 4], edi
jmp 0x1012489
lea eax, [edi + 1]
movsx ecx, byte [eax]
add ecx, 0xffffffc1
cmp ecx, 0x39
ja case.0x1012088.64
movzx ecx, byte [ecx + 0x1012748]
jmp dword [ecx*4 + 0x1012714]
inc edi
inc edi
mov al, byte [edi]
test al, al
je 0x10120e5
xor ecx, ecx
inc ecx
movsx eax, al
cmp eax, 0x64
jg 0x10120b4
je 0x10120ae
sub eax, 0x44
je 0x10120ae
sub eax, 8
jmp 0x10120b7
or dword [esi + 0x18], 2
jmp 0x10120de
sub eax, 0x6c
je 0x10120da
sub eax, 6
je 0x10120d4
dec eax
je 0x10120cf
sub eax, 5
jne case.0x1012088.64
mov dword [esi + 0x28], ecx
jmp 0x10120de
or dword [esi + 0x18], ecx
jmp 0x10120de
or dword [esi + 0x18], 8
jmp 0x10120de
or dword [esi + 0x18], 4
inc edi
mov al, byte [edi]
test al, al
jne 0x101209a
cmp dword [esi + 0x18], ebx
jne 0x10120f1
mov dword [esi + 0x18], 6
push ebx
call fcn.0100eab1
mov dword [esi + 8], eax
jmp 0x1012489
inc edi
inc edi
mov al, byte [edi]
test al, al
je 0x1012195
xor ecx, ecx
inc ecx
movsx eax, al
cmp eax, 0x61
jg 0x1012147
je 0x101213e
cmp eax, 0x4c
jg 0x1012139
je 0x101217a
sub eax, 0x41
je 0x101213e
sub eax, 5
je 0x1012186
dec eax
je 0x1012180
dec eax
dec eax
jne case.0x1012088.64
or dword [esi + 0x1c], ecx
jmp 0x101218a
sub eax, 0x52
jmp 0x101215b
or dword [esi + 0x1c], 0x80
jmp 0x101218a
sub eax, 0x66
je 0x1012186
dec eax
je 0x1012180
dec eax
dec eax
je 0x1012134
sub eax, 3
je 0x101217a
sub eax, 6
je 0x1012174
dec eax
je 0x101216e
sub eax, 5
jne case.0x1012088.64
mov dword [esi + 0x28], ecx
jmp 0x101218a
or dword [esi + 0x1c], 0x40
jmp 0x101218a
or dword [esi + 0x1c], 8
jmp 0x101218a
or dword [esi + 0x1c], 4
jmp 0x101218a
or dword [esi + 0x1c], 0x20
jmp 0x101218a
or dword [esi + 0x1c], 0x10
inc edi
mov al, byte [edi]
test al, al
jne 0x101210e
cmp dword [esi + 0x1c], ebx
jne 0x10121a1
mov dword [esi + 0x1c], 0x3e
push ebx
call fcn.0100eab1
mov dword [esi + 0xc], eax
jmp 0x1012489
push ebx
call fcn.0100eab1
cmp eax, ebx
je 0x10124fc
cmp byte [eax], 0
je 0x10124fc
mov dword [esi + 0x10], eax
jmp 0x1012489
xor ecx, ecx
inc ecx
mov dword [esi + 0x38], ecx
cmp byte [edi + 2], 0x31
jne 0x10121df
mov dword [esi + 0x3c], ecx
mov edi, eax
inc edi
inc edi
cmp byte [edi], 0
jne 0x10121ee
push ebx
call fcn.0100eab1
mov edi, eax
cmp edi, ebx
je 0x1012508
cmp byte [edi], 0
je 0x1012508
push edi
call fcn.01012981
jmp 0x1012489
add edi, 2
cmp byte [edi], 0
jne 0x101233e
mov dword [esi + 0x2c], 1
mov dword [ebp - 8], ebx
jmp 0x101233e
movsx eax, al
cmp eax, 0x55
jg 0x1012269
je 0x101228a
sub eax, 0x21
je 0x1012328
sub eax, 0x22
je 0x1012307
dec eax
je 0x10122dd
sub eax, 0xb
je 0x10122c2
dec eax
je 0x10122a8
dec eax
dec eax
jne case.0x1012088.64
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [esi + 0x2c], eax
mov dword [ebp - 8], ebx
jmp 0x1012339
sub eax, 0x63
je 0x1012307
dec eax
je 0x10122dd
sub eax, 0xb
je 0x10122c2
dec eax
je 0x10122a8
dec eax
dec eax
je 0x1012258
sub eax, 3
jne case.0x1012088.64
inc edi
cmp byte [edi], 0
jne 0x1012298
push ebx
call fcn.0100eab1
mov edi, eax
cmp edi, ebx
je 0x1012328
push edi
call fcn.010129fe
jmp 0x101231f
inc edi
cmp byte [edi], 0
jne 0x10122b6
push ebx
call fcn.0100eab1
mov edi, eax
cmp edi, ebx
je 0x1012328
push edi
call fcn.01013b09
jmp 0x101231f
cmp dword [ebp - 0xc], ebx
jne 0x1012514
lea eax, [edi + 1]
push eax
mov dword [ebp - 0x10], 1
call fcn.010129bb
jmp 0x101231f
cmp dword [ebp - 0x10], ebx
jne 0x1012514
inc edi
cmp byte [edi], 0
mov dword [ebp - 0xc], 1
jne 0x10122fb
push ebx
call fcn.0100eab1
mov edi, eax
cmp edi, ebx
je 0x1012328
push edi
call fcn.0101287d
jmp 0x101231f
inc edi
cmp byte [edi], 0
jne 0x1012315
push ebx
call fcn.0100eab1
mov edi, eax
cmp edi, ebx
je 0x1012328
push edi
call fcn.01013b29
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
cmp dword [esi + 0x2c], ebx
jne 0x1012334
mov dword [ebp - 8], 1
call fcn.0101286d
cmp edi, ebx
je 0x1012348
inc edi
mov al, byte [edi]
test al, al
jne 0x1012225
cmp dword [ebp - 8], ebx
jne 0x1012489
and dword [ebp - 8], 0
mov dword [esi + 0x2c], 1
jmp 0x1012489
push ebx
call fcn.0100eab1
mov dword [esi + 0x14], eax
jmp 0x1012489
mov dword [esi + 0x24], 1
jmp 0x1012489
mov dword [esi + 0x24], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1012489
mov dword [0x10200ac], ebx
jmp 0x1012489
mov dword [0x1021118], 1
jmp 0x1012489
add edi, 2
mov al, byte [edi]
test al, al
jne 0x10123d3
xor eax, eax
inc eax
mov dword [0x10201d8], ebx
mov dword [0x10201dc], ebx
mov dword [0x10201e0], ebx
mov dword [0x10201e4], eax
mov dword [0x10201e8], eax
mov dword [0x10201ec], ebx
jmp 0x1012489
xor ebx, ebx
movsx eax, al
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x4c
pop ecx
jne 0x10123ed
mov dword [0x10201d8], ebx
jmp 0x1012463
movsx eax, byte [edi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x52
pop ecx
jne 0x1012405
mov dword [0x10201dc], ebx
jmp 0x1012463
movsx eax, byte [edi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x53
pop ecx
jne 0x101241d
mov dword [0x10201e0], ebx
jmp 0x1012463
movsx eax, byte [edi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x44
pop ecx
jne 0x1012435
mov dword [0x10201e4], ebx
jmp 0x1012463
movsx eax, byte [edi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x4f
pop ecx
jne 0x101244d
mov dword [0x10201e8], ebx
jmp 0x1012463
movsx eax, byte [edi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x49
pop ecx
jne 0x1012467
mov dword [0x10201ec], ebx
xor ebx, ebx
jmp 0x101247e
movsx eax, byte [edi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x2d
pop ecx
jne 0x1012520
xor ebx, ebx
inc ebx
inc edi
mov al, byte [edi]
test al, al
jne 0x10123d5
push 0
call fcn.0100eab1
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x1012033
cmp dword [ebp - 8], ebx
je 0x10124ad
cmp dword [esi + 4], ebx
jne 0x10124ad
mov dword [esi + 0x2c], 1
cmp dword [esi + 0x38], ebx
je 0x10124c5
mov eax, dword [esi]
cmp eax, ebx
je 0x10124c5
push ebx
push ebx
push ebx
push eax
call fcn.010135b5
test eax, eax
je 0x1012508
cmp dword [esi + 0x2c], ebx
je 0x1012676
cmp dword [esi + 0x38], ebx
jne 0x1012676
cmp dword [esi + 4], ebx
je 0x101256d
mov dword [ebp - 4], 0x2b2
jmp 0x101265c
mov dword [ebp - 4], ebx
xor eax, eax
push eax
call fcn.0100e9d8
jmp 0x1012699
mov dword [ebp - 4], 0x342
jmp 0x101265c
mov dword [ebp - 4], 0x32b
jmp 0x101265c
mov dword [ebp - 4], 0x328
jmp 0x101265c
and dword [ebp - 4], 0
jmp 0x10124ef
push ebx
xor esi, esi
call fcn.0100e9d8
inc edi
lea eax, [edi + 1]
cmp byte [eax], 0
je 0x1012699
cmp byte [edi], 0x3f
jne 0x1012541
inc esi
mov edi, eax
lea eax, [edi + 1]
cmp byte [eax], 0
jne 0x101253b
cmp esi, 2
jne 0x1012699
push 0x10016b8
push 0x100214c
push 0x1001ad0
call fcn.01007e32
jmp 0x1012699
mov edi, dword [ebp - 0x10]
cmp edi, ebx
jne 0x101262f
cmp dword [ebp - 0xc], ebx
jne 0x101262f
cmp dword [esi], ebx
jne 0x101258b
mov dword [esi], 0x1001950
cmp dword [ebp - 0x14], ebx
jne 0x101259f
mov eax, dword [esi]
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
lea eax, [esi + 0x40]
mov dword [esi], eax
jmp 0x10125a7
mov edi, dword [esi]
lea eax, [esi + 0x40]
mov dword [esi + 4], eax
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.01013f48
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x1012652
push ebx
call fcn.010134a2
test eax, eax
je 0x101261a
push edi
mov ebx, 0x200
push ebx
push dword [ebp + 8]
call fcn.0101627b
add esp, 0xc
push 1
push edi
call fcn.010134c4
test eax, eax
je 0x1012607
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10125ee
sub ecx, edi
inc ecx
push ecx
push eax
push dword [0x1021d74]
call fcn.01018410
jmp 0x1012623
push 0x1001690
push ebx
push dword [ebp + 8]
call fcn.01016202
add esp, 0xc
jmp 0x1012623
push dword [ebp + 8]
push ebx
call fcn.01013474
push dword [ebp - 0x14]
call fcn.01013449
xor ebx, ebx
jmp 0x1012676
mov eax, dword [esi]
cmp eax, ebx
je 0x1012643
cmp dword [ebp - 0xc], ebx
je 0x1012643
mov dword [ebp - 4], 0x329
jmp 0x101265c
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.0101446f
cmp dword [ebp - 4], ebx
je 0x1012669
cmp dword [ebp - 4], 0
je 0x10124ef
push dword [ebp - 4]
call fcn.0100e6ab
jmp 0x10124f1
mov eax, dword [ebp - 0xc]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
cmp dword [esi + 0x24], ebx
jne 0x1012686
cmp dword [esi + 0x2c], ebx
jne 0x1012686
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x24], eax
cmp dword [ebp - 0x10], ebx
jne 0x10126ac
cmp dword [ebp - 0xc], ebx
jne 0x10126ac
cmp dword [esi + 0x38], ebx
jne 0x10126ac
cmp dword [esi], ebx
jne 0x101269e
xor eax, eax
inc eax
jmp 0x101270c
cmp dword [esi + 4], ebx
jne 0x10126af
mov dword [esi + 4], 0x1001950
jmp 0x10126af
mov dword [esi + 0x24], ebx
call fcn.0100fae3
cmp dword [esi + 8], ebx
jne 0x10126be
cmp dword [esi + 0xc], ebx
je 0x10126cc
push 6
push dword [0x1021df0]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x1021dec]
call fcn.0100b88b
xor edi, edi
mov dword [0x1021128], eax
inc edi
mov dword [0x1021124], edi
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push fcn.0101003c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x1021140], eax
jne 0x101270a
push esi
call fcn.0101003c
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4