Function at 0x1002c76
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa4
push esi
push edi
xor eax, eax
xor esi, esi
mov ecx, 0x280
mov edi, 0x100b9a8
push 0x18
mov dword [ebp + 0x70], esi
rep stosd dword es:[edi], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x1002cb0
mov dword [eax], 0x10015cc
mov dword [eax + 4], esi
mov dword [eax + 0x14], esi
jmp 0x1002cb2
xor eax, eax
cmp eax, esi
mov dword [0x100bd78], eax
je 0x1002eb3
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jl 0x1002eb3
push 0x100bd18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x1002cef
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002eb3
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push esi
push esi
call edi
push esi
push esi
push esi
push esi
mov dword [0x100bd6c], eax
call edi
push esi
push esi
push 1
push esi
mov dword [0x100bd70], eax
call edi
cmp dword [0x100bd6c], esi
mov dword [0x100bd74], eax
je 0x1002eb3
cmp dword [0x100bd70], esi
je 0x1002eb3
cmp eax, esi
je 0x1002eb3
push esi
push esi
push 1
push esi
call edi
cmp eax, esi
mov dword [0x100bd48], eax
je 0x1002ce4
push esi
push esi
push 1
push esi
mov dword [0x100bd64], eax
call edi
cmp eax, esi
mov dword [0x100bd34], eax
je 0x1002ce4
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x30]
push 0x1002b8c
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
call edi
cmp eax, esi
jne 0x1002d88
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002eb2
mov dword [0x100bd5c], eax
lea eax, [ebp - 0x30]
push 0x1002bb4
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
call edi
cmp eax, esi
je 0x1002d7d
mov edi, dword [ebp + 0x7c]
push 5
mov dword [0x100bd60], eax
mov dword [0x100c3a0], esi
mov dword [0x100b9ac], esi
mov dword [0x100b9b0], 0x10029bc
mov dword [0x100b9b4], esi
mov dword [0x100b9b8], esi
mov dword [0x100b9bc], edi
mov dword [0x100b9c0], esi
mov dword [0x100b9c4], esi
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x100b9ac
mov dword [0x100b9c8], eax
mov dword [0x100b9cc], esi
mov dword [0x100b9d0], 0x1002bd8
call dword [sym.imp.USER32.dll_RegisterClassW]
cmp ax, si
mov dword [ebp + 0x70], eax
je 0x1002eb2
push esi
push edi
push esi
push esi
push 0x64
push 0x64
push esi
push esi
push 0xcf0000
push 0x1002bf8
push 0x1002c1c
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, esi
mov dword [0x100b9a8], eax
je 0x1002eb2
push 0x1002c3c
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
cmp eax, esi
mov dword [0x100bd08], eax
jne 0x1002e5e
mov dword [0x100bd08], 0x42a
xor edi, edi
inc edi
mov dword [0x100b9dc], edi
call fcn.0100177e
lea eax, [ebp + 0x6c]
push eax
push esi
push esi
push 0x1003f96
push esi
push esi
mov dword [0x100bd0c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1002eb2
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x1002ea5
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
lea eax, [ebp + 0x50]
push esi
push eax
call edi
test eax, eax
jne 0x1002e91
pop ebx
call fcn.010017fa
mov eax, dword [0x100b9a8]
cmp eax, esi
je 0x1002ec8
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp word [ebp + 0x70], si
pop edi
pop esi
je 0x1002ede
push dword [ebp + 0x7c]
push 0x1002c58
call dword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
add ebp, 0x74
leave
ret 4