Function at 0x100f5e9
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101908c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [0x1004444]
mov dword [ebp - 0xc], esi
mov esi, dword [0x1004448]
push edi
mov dword [ebp - 8], esi
mov esi, 0x1004434
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], edx
movsd dword es:[edi], dword [esi]
cmp eax, edx
je 0x100f716
xor esi, esi
cmp si, word [eax]
je 0x100f716
cmp ecx, edx
je 0x100f58f
mov dword [ecx], edx
push ebx
push edx
push eax
call fcn.0100f341
mov dword [ebp - 0x24], eax
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x100f5d7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x100f5ba
and eax, ebx
or eax, edi
test eax, eax
jge 0x100f5ca
call esi
test eax, eax
jle 0x100f5c6
and eax, ebx
or eax, edi
mov esi, eax
jmp 0x100f5cf
mov esi, 0x80004005
test esi, esi
jl 0x100f6ea
mov eax, dword [ebp - 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100f5dd
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x100f69e
mov esi, dword [sym.imp.msvcrt.dll__wcsnicmp]
push 3
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x24]
call esi
add esp, 0xc
test eax, eax
je 0x100f69e
push 7
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call esi
add esp, 0xc
test eax, eax
je 0x100f69e
and dword [ebp - 0x2c], 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x24]
call fcn.0100f515
mov esi, eax
test esi, esi
jl 0x100f6ea
cmp dword [ebp - 0x2c], 1
lea eax, [ebp - 0x20]
push eax
jne 0x100f675
mov eax, dword [ebp - 0x24]
add eax, 2
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0100f2db
mov esi, eax
test esi, esi
jl 0x100f6ea
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100f698
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
mov dword [eax], ecx
jmp 0x100f698
push dword [ebp - 0x24]
lea eax, [ebp - 0xc]
push eax
call fcn.0100f2db
mov esi, eax
test esi, esi
jl 0x100f6ea
cmp dword [ebp - 0x28], 0
je 0x100f698
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
add eax, 8
mov dword [ecx], eax
cmp dword [ebp - 0x20], 0
jne 0x100f6ee
push dword [ebp - 0x30]
call fcn.0100e6f6
mov dword [ebp - 0x20], eax
test eax, eax
je 0x100f6b1
xor esi, esi
jmp 0x100f6dc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x100f6c3
and eax, ebx
or eax, edi
test eax, eax
jge 0x100f6d3
call esi
test eax, eax
jle 0x100f6cf
and eax, ebx
or eax, edi
mov esi, eax
jmp 0x100f6d8
mov esi, 0x80004005
test esi, esi
jl 0x100f6ea
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100f6ee
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x100f6ee
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0
pop ebx
je 0x100f707
push dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x20]
jmp 0x100f720
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100d691
leave
ret 8