Function at 0x1000ceb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1004efb0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x24], eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x20], eax
call fcn.1000af90
test al, 1
jne 0x1000cf07
jmp 0x1000cf44
xor eax, eax
lea eax, [0x10258ae8]
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
sub esp, 4
mov dword [esp], 0
call fcn.101fbc1e
mov ecx, dword [0x1027a944]
mov edx, dword [0x1027a948]
mov eax, ecx
xor eax, 0xffffffff
mov esi, ecx
xor esi, 0xffffffff
or eax, esi
xor eax, 0xffffffff
mov esi, edx
xor esi, 0xffffffff
or eax, esi
xor ecx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, 0xdec60402
mov ecx, eax
xor ecx, 0xffffffff
or ecx, 0x1b429c7d
xor ecx, 0xffffffff
or eax, 0xe4bd6382
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and ecx, 0x6bda0f91
and eax, 0x9425f06e
sub eax, ecx
cmp eax, 0x800a7c2f
je 0x1000d31c
call fcn.10009cf0
lea ecx, [0x10290acc]
call fcn.1000d420
and al, 1
movzx eax, al
cmp eax, 0
jne 0x1000d02f
mov eax, dword [0x1027a95c]
or eax, dword [0x1027a960]
mov edx, eax
and edx, 0x7e3defb9
mov ecx, eax
or ecx, 0x7e3defb9
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x81c21046
or eax, 0x81c21046
imul eax, edx
add eax, ecx
add eax, 0x9465434f
sub eax, 0xd36b1a73
mov dword [ebp - 0x2c], eax
lea eax, [0x10290acc]
sub esp, 4
mov dword [esp], eax
call fcn.1000b2f0
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 0x2c1a456e
jbe 0x1000d331
jmp 0x1000d02f
mov eax, dword [0x1027a964]
xor edx, edx
div dword [0x1027a968]
add eax, 0xa0322bb5
mov ecx, eax
xor ecx, 0x1da311f8
and eax, 0xe25cee07
shl eax, 1
sub eax, ecx
mov ecx, eax
xor ecx, 0xf3bbc121
and eax, 0xc443ede
shl eax, 1
sub eax, ecx
cmp eax, 0xdf784640
jae 0x1000d34a
mov ecx, dword [0x1027a96c]
mov esi, dword [0x1027a970]
mov edi, esi
xor edi, 0xffffffff
mov edx, ecx
and edx, edi
mov eax, ecx
or eax, edi
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, esi
or ecx, esi
imul ecx, edx
add ecx, eax
sub ecx, 0xb7db7d18
add ecx, 0x9f459ff9
sub ecx, 0xf65fd23b
sub ecx, 0x9f459ff9
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or eax, 0x2d65f4e2
xor ecx, 0xffffffff
or ecx, 0xd29a0b1d
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov dword [ebp - 0x34], eax
xor eax, eax
lea eax, [0x1000b2d0]
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x11170
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, 0x102
setne cl
mov byte [ebp - 0x2d], cl
cmp eax, 0xf0ace951
ja 0x1000d34a
mov al, byte [ebp - 0x2d]
test al, 1
jne 0x1000d15d
jmp 0x1000d1c8
mov ecx, dword [0x1027a974]
mov edx, dword [0x1027a978]
mov eax, ecx
xor eax, 0xffffffff
mov esi, ecx
xor esi, 0xffffffff
or eax, esi
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
sub eax, 0xcfabc401
sub eax, 0x497d29a5
imul eax, eax, 0xaf0c51a2
cmp eax, 0x364d68d2
jae 0x1000d3a8
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
sub esp, 4
mov eax, esp
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, 2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [0x1027a984]
add ecx, dword [0x1027a988]
and ecx, 0x17d7170d
mov eax, ecx
and eax, 0x6977c4bb
or ecx, 0x6977c4bb
add eax, ecx
imul eax, eax, 0xe199edab
mov dword [ebp - 0x10], 0xffffffff
cmp eax, 0x98455ee8
je 0x1000d3be
mov eax, dword [ebp - 0x24]
mov edx, dword [0x1027a98c]
mov esi, dword [0x1027a990]
mov ecx, edx
and ecx, esi
or edx, esi
add ecx, edx
and ecx, 0x83e1e10a
add ecx, 0x468ddda1
or ecx, 0x8d3275a9
mov dword [ebp - 0x38], ecx
sub esp, 4
mov dword [esp], eax
call fcn.1000c8c0
mov eax, dword [ebp - 0x38]
add esp, 4
cmp eax, 0xda31e54f
jae 0x1000d3be
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
sub esp, 4
mov eax, esp
mov dword [eax], ecx
call fcn.1000c6c0
add esp, 4
jmp 0x1000d267
mov eax, dword [0x1027a994]
xor edx, edx
div dword [0x1027a998]
mov ecx, 0x6efb54ba
xor edx, edx
div ecx
sub eax, 0x576cece9
mov ecx, eax
and ecx, 0x5f5de5ce
shl ecx, 1
xor eax, 0x5f5de5ce
add eax, ecx
cmp eax, 0x6bd15e78
ja 0x1000d3d4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.10097250
add esp, 8
jmp 0x1000d2c2
call fcn.1000a530
jmp 0x1000d2cc
sub esp, 0x18
mov eax, esp
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0x1000af80
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
call fcn.10006d40
jmp 0x1000d30b
xor eax, eax
sub esp, 4
mov dword [esp], 0
call fcn.101fbc1e
call fcn.10009cf0
lea ecx, [0x10290acc]
call fcn.1000d420
jmp 0x1000cfaa
lea eax, [0x10290acc]
sub esp, 4
mov dword [esp], eax
call fcn.1000b2f0
add esp, 4
jmp 0x1000cfc8
xor eax, eax
lea eax, [0x1000b2d0]
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x11170
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1000d06e
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d19f
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.1000c8c0
add esp, 4
jmp 0x1000d201
jmp 0x1000d29e