Function at 0x1000a950
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, eax
lea eax, [ebp - 0x40]
push eax
push esi
mov dword [ebp - 0x40], 0x3c
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov ecx, esi
call fcn.1000bfd0
test eax, eax
je 0x1000a993
xor ecx, ecx
jmp 0x1000a980
cmp eax, dword [ecx*8 + 0x1004f428]
je 0x1000ab40
inc ecx
cmp ecx, 0xb
jb 0x1000a980
xor eax, eax
test al, 0x40
je 0x1000ab4d
cmp byte [0x1005af69], 0
push ebx
push edi
jne 0x1000a9ed
push 0
push 0
push 0
push 0x1000a7b0
push 0
push 0
mov byte [0x1005af69], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x1000a9ed
lea ecx, [ebp - 4]
push ecx
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000a9ed
test byte [ebp - 4], 2
jne 0x1000a9ed
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1000a6b0
cmp dword [0x1005af80], 0
mov edi, 0x1005af70
je 0x1000aa0e
cmp dword [edi + 4], esi
je 0x1000aa76
mov edi, dword [edi + 0x10]
cmp dword [edi + 0x10], 0
jne 0x1000aa00
cmp dword [edi + 4], esi
je 0x1000aa76
mov edx, dword [0x1004fb44]
push 0x14
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [edi + 0x10], eax
mov edi, eax
mov eax, dword [0x100503d8]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [edi + 8], eax
mov eax, dword [0x100505e8]
mov ecx, dword [eax + 0x128]
mov edx, dword [eax + 0x124]
mov eax, dword [0x100503d8]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [edi + 8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
push 0
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
mov dword [edi + 4], esi
push 0x485
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x100503d8]
push 0
push edx
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PrintWindow]
mov eax, dword [0x100503d8]
push 0x3e
push eax
push 0x317
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi + 8]
push 0
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov edx, dword [ebp - 0x3c]
test edx, edx
jns 0x1000aae8
xor edx, edx
mov dword [ebp - 0x3c], edx
mov esi, dword [ebp - 0x38]
test esi, esi
jns 0x1000aaf4
xor esi, esi
mov dword [ebp - 0x38], esi
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x2c]
sub ebx, ecx
push ebx
sub eax, esi
push eax
sub ecx, edx
mov edx, dword [0x100503d8]
push ecx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.100069c0
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [ecx*8 + 0x1004f42c]
jmp 0x1000a995
mov ecx, dword [0x100503d8]
push 0
push ecx
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PrintWindow]
mov edx, dword [0x100503d8]
push 0x3e
push edx
push 0x317
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 1
lea ecx, [ebp - 0x3c]
call fcn.100069c0
pop esi
mov esp, ebp
pop ebp
ret