Function at 0x10023a00
Capabilities:
Link many functions at runtime
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc64
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 0x18], eax
cmp dword [0x1011fd7c], 0x97
je 0x10023a34
cmp dword [0x1011fd7c], 4
je 0x10023a34
cmp dword [0x1011fd7c], 0x99
jne 0x10023a4a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ecx
push str.call_Engine_start_PID__d_
push 0
call fcn.1003b780
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1002429d
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x1002429d
call fcn.1000fc80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.1000fce0
add esp, 4
test eax, eax
je 0x10023b24
push str.TC_IO32
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10023a99
jmp 0x1002429d
cmp dword [0x1011fd7c], 0x97
je 0x10023aba
cmp dword [0x1011fd7c], 4
je 0x10023aba
cmp dword [0x1011fd7c], 0x99
jne 0x10023ad0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
push str.TC_IO32_start_PID__d_
push 0
call fcn.1003b780
add esp, 0xc
mov ecx, dword [0x10280c5c]
and ecx, 8
neg ecx
sbb ecx, ecx
and ecx, 2
add ecx, 2
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
push 0x1798
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [ebp + 0x10]
and edx, 4
jne 0x10023b1a
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002429d
movzx edx, byte [0x1011c7f6]
test edx, edx
je 0x10023bad
cmp dword [0x1011fd7c], 0x97
je 0x10023b50
cmp dword [0x1011fd7c], 4
je 0x10023b50
cmp dword [0x1011fd7c], 0x99
jne 0x10023b66
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ecx
push str.call_Engine_TC_CARE_WITHDLL_1LIKE0_start_PID__d_
push 0
call fcn.1003b780
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
push 0xd03
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [ebp + 0x10]
and edx, 4
jne 0x10023ba3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002429d
cmp dword [0x100676bc], 0x501
je 0x100241f9
mov edx, dword [0x10280c5c]
and edx, 8
jne 0x10023bd4
movzx eax, byte [ebp + 0x14]
test eax, eax
jne 0x100241f9
cmp dword [0x1011fd7c], 0x97
je 0x10023bf5
cmp dword [0x1011fd7c], 4
je 0x10023bf5
cmp dword [0x1011fd7c], 0x99
jne 0x10023c0b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
push str.InjectDll2_EZH_INJ_start_PID__d_
push 0
call fcn.1003b780
add esp, 0xc
cmp dword [0x10146d50], 0
jne 0x10023f12
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.1003e4a0
add esp, 0xc
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0xc20], 0
push 0x1ff
push 0
lea ecx, [ebp - 0xc1f]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0xa20], 0
push 0x1ff
push 0
lea edx, [ebp - 0xa1f]
push edx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x420], 0
push 0x1ff
push 0
lea eax, [ebp - 0x41f]
push eax
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x820], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x81f]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x620], 0
push 0x1ff
push 0
lea edx, [ebp - 0x61f]
push edx
call fcn.1003e4a0
add esp, 0xc
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x10023ce7
mov dword [ebp - 0xc28], str.__s_12
jmp 0x10023cf1
mov dword [ebp - 0xc28], 0x1005c3d4
push str.LhSetExclusiveACL
mov ecx, dword [ebp - 0xc28]
push ecx
lea edx, [ebp - 0xc20]
push edx
call fcn.1003e8fe
add esp, 0xc
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x10023d23
mov dword [ebp - 0xc2c], str.__s_16
jmp 0x10023d2d
mov dword [ebp - 0xc2c], 0x1005c3f0
push str.LhInstallHook
mov ecx, dword [ebp - 0xc2c]
push ecx
lea edx, [ebp - 0xa20]
push edx
call fcn.1003e8fe
add esp, 0xc
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x10023d5f
mov dword [ebp - 0xc30], 0x1005c408
jmp 0x10023d69
mov dword [ebp - 0xc30], 0x1005c410
push str.LhUninstallAllHooks
mov ecx, dword [ebp - 0xc30]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.1003e8fe
add esp, 0xc
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x10023d9b
mov dword [ebp - 0xc34], str.__s_0
jmp 0x10023da5
mov dword [ebp - 0xc34], 0x1005c438
push str.LhWaitForPendingRemovals
mov ecx, dword [ebp - 0xc34]
push ecx
lea edx, [ebp - 0x820]
push edx
call fcn.1003e8fe
add esp, 0xc
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x10023dd7
mov dword [ebp - 0xc38], str.__s_28
jmp 0x10023de1
mov dword [ebp - 0xc38], 0x1005c454
push str.RhInjectLibrary
mov ecx, dword [ebp - 0xc38]
push ecx
lea edx, [ebp - 0x620]
push edx
call fcn.1003e8fe
add esp, 0xc
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x10023e37
cmp dword [0x100676bc], 0x501
jg 0x10023e1f
mov dword [ebp - 0xc3c], 0x1005989a
jmp 0x10023e29
mov dword [ebp - 0xc3c], 0x1005989b
mov ecx, dword [ebp - 0xc3c]
mov dword [ebp - 0x21c], ecx
jmp 0x10023e65
cmp dword [0x100676bc], 0x501
jg 0x10023e4f
mov dword [ebp - 0xc40], 0x100598a3
jmp 0x10023e59
mov dword [ebp - 0xc40], 0x100598ab
mov edx, dword [ebp - 0xc40]
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
push eax
push 0x1011ef18
push 0x1005c458
lea ecx, [ebp - 0x218]
push ecx
call fcn.1003e8fe
add esp, 0x10
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10146d5c], eax
lea eax, [ebp - 0xc20]
push eax
mov ecx, dword [0x10146d5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10146d40], eax
lea edx, [ebp - 0xa20]
push edx
mov eax, dword [0x10146d5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10146d44], eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [0x10146d5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10146d48], eax
lea eax, [ebp - 0x820]
push eax
mov ecx, dword [0x10146d5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10146d4c], eax
lea edx, [ebp - 0x620]
push edx
mov eax, dword [0x10146d5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10146d50], eax
cmp dword [0x10146d50], 0
je 0x100241c7
mov dword [ebp - 0x10], 0x1011ed18
cmp dword [ebp - 0x10], 0
jne 0x10023f38
mov dword [ebp - 0xc44], 0
jmp 0x10023f97
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x10023f5d
mov dword [ebp - 0xc48], 0
jmp 0x10023f8b
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.10040080
mov dword [ebp - 0xc4c], esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc4c]
push edx
call fcn.1000fc90
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xc44], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc44]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
call dword [0x10146d50]
mov dword [ebp - 0xc24], eax
cmp dword [ebp - 0xc24], 0xc0000225
je 0x10023fe8
cmp dword [ebp - 0xc24], 0
je 0x10023fe8
cmp dword [ebp - 0xc24], 0xc00000f3
je 0x10023fe8
cmp dword [ebp - 0xc24], 0xc00000f2
jne 0x10023fed
jmp 0x10024091
push 0x46
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10], 0x1011ed18
cmp dword [ebp - 0x10], 0
jne 0x1002400e
mov dword [ebp - 0xc50], 0
jmp 0x1002406d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x10024033
mov dword [ebp - 0xc54], 0
jmp 0x10024061
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.10040080
mov dword [ebp - 0xc58], esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc58]
push edx
call fcn.1000fc90
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0xc50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc50]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
call dword [0x10146d50]
mov dword [ebp - 0xc24], eax
cmp dword [ebp - 0xc24], 0xc0000225
je 0x100240be
cmp dword [ebp - 0xc24], 0
je 0x100240be
cmp dword [ebp - 0xc24], 0xc00000f3
je 0x100240be
cmp dword [ebp - 0xc24], 0xc00000f2
jne 0x100240c3
jmp 0x10024167
push 0x46
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10], 0x1011ed18
cmp dword [ebp - 0x10], 0
jne 0x100240e4
mov dword [ebp - 0xc5c], 0
jmp 0x10024143
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x10024109
mov dword [ebp - 0xc60], 0
jmp 0x10024137
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.10040080
mov dword [ebp - 0xc64], esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc64]
push edx
call fcn.1000fc90
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xc5c], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc5c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
call dword [0x10146d50]
mov dword [ebp - 0xc24], eax
mov ecx, dword [ebp + 0x10]
and ecx, 4
jne 0x10024184
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x1011fd7c], 0x97
je 0x100241a5
cmp dword [0x1011fd7c], 4
je 0x100241a5
cmp dword [0x1011fd7c], 0x99
jne 0x100241c0
push 0x1011ed18
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
push str.InjectDll2_EZH_tc_P:_d__s
push 0
call fcn.1003b780
add esp, 0x10
jmp 0x1002429d
cmp dword [0x1011fd7c], 0x97
je 0x100241e8
cmp dword [0x1011fd7c], 4
je 0x100241e8
cmp dword [0x1011fd7c], 0x99
jne 0x100241f7
push str.InjectDll2_MS_INJ_start
push 0
call fcn.1003b780
add esp, 8
jmp 0x10024229
cmp dword [0x1011fd7c], 0x97
je 0x1002421a
cmp dword [0x1011fd7c], 4
je 0x1002421a
cmp dword [0x1011fd7c], 0x99
jne 0x10024229
push str.InjectDll3_MS_INJ_start
push 0
call fcn.1003b780
add esp, 8
cmp dword [0x1011fd7c], 0x97
je 0x1002424a
cmp dword [0x1011fd7c], 4
je 0x1002424a
cmp dword [0x1011fd7c], 0x99
jne 0x10024260
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ecx
push str.call_Engine_xxx_start_PID__d_
push 0
call fcn.1003b780
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
push 0xd03
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [ebp + 0x10]
and edx, 4
jne 0x1002429d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [ebp - 0xc64]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret