Function at 0x100017d0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3b4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
push ebx
mov edi, eax
call esi
mov cl, 0x6a
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], cl
lea ecx, [esp + 0xc]
push ecx
lea edx, [eax + 0x1000]
push edi
lea ecx, [ebx + 0x10]
mov byte [esp + 0x14], 0x8b
mov byte [esp + 0x15], 0x44
mov byte [esp + 0x16], 0x24
mov byte [esp + 0x17], 4
mov byte [esp + 0x18], 0x85
mov byte [esp + 0x19], 0xc0
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], 0xf
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1f], 0xff
mov byte [esp + 0x20], 0x68
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x6b
mov byte [esp + 0x23], 0x45
call fcn.10002710
test eax, eax
je 0x10001896
push str.game.dll
call esi
cmp eax, ebx
je 0x10001896
lea edx, [esp + 0xc]
push edx
lea edx, [eax + 0x537ee3]
push edi
lea ecx, [ebx + 4]
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x15], 0x58
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x57
call fcn.10002710
test eax, eax
jne 0x100018ab
push edi
call fcn.10004710
call fcn.10004260
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100010f0
cmp eax, 1
je 0x100019b3
push 0x208
lea eax, [esp + 0x1bc]
push ebx
push eax
call fcn.10008880
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1bc]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x1b8]
push 0x104
push edx
call fcn.10007f0b
add esp, 8
lea eax, [esp + 0x1b8]
push eax
call fcn.10001000
cmp eax, 0x27f522b1
je 0x100019cb
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [esp + 0x38]
push 0x10015d38
push ecx
call esi
lea edx, [esp + 0x80]
push 0x10015d50
push edx
call esi
mov edx, dword [0x1001f054]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
lea ecx, [esp + 0x2c]
push ecx
xor eax, eax
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push 0x4a
lea eax, [esp + 0x44]
push edx
mov dword [esp + 0x3c], 0x1040400
mov dword [esp + 0x40], 0x180
mov dword [esp + 0x44], eax
mov dword [0x1001b3ec], 0x1001f000
call esi
mov eax, dword [0x1001b3ec]
mov ecx, dword [eax + 0x54]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x1001b3ec]
mov eax, dword [edx + 0x54]
push ebx
push 0xf120
push 0x112
push eax
call esi
mov ecx, dword [0x1001b3ec]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push ebx
push 0x1001afd8
mov dword [0x1001b3ec], 0x1001f000
call fcn.10008880
add esp, 0xc
mov dword [0x1001b3dc], ebx
mov dword [0x1001b3d8], ebx
cmp dword [0x1001f05c], ebx
je 0x10001a19
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10002940
mov eax, dword [0x1001b3ec]
mov dword [eax + 0x5c], ebx
mov dword [0x1001b3f0], 1
call fcn.1000636a
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100066c0
push 0x10004bc0
push 0x1001d204
call fcn.10006a8f
push 0x10004c40
push 0x1001a070
call fcn.10006a8f
call fcn.10006a87
push 0x1001f404
push ebx
push ebx
push 0x10001af0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov dword [0x1001b3f4], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret