Function at 0x10001560
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x308
cmp eax, 3
push ebx
push ebp
mov ebp, dword [esp + 0x314]
push esi
push edi
mov dword [0x1011f618], ebp
ja case.default.0x10001584
jmp dword [eax*4 + 0x10001b34]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x214]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
push ebp
call fcn.10017090
add esp, 0x10
test eax, eax
je 0x10001804
mov al, byte [esp + 0x3a]
xor ebx, ebx
cmp al, bl
je 0x100015ca
lea ecx, [esp + 0x34]
call fcn.10001000
lea ecx, [esp + 0x34]
call fcn.10001040
mov al, 0xe
push 0x1dc
mov byte [esp + 0x1e], al
mov byte [esp + 0x26], al
lea eax, [esp + 0x14]
mov ecx, 0x77
lea esi, [esp + 0x3c]
mov edi, 0x1011ec30
push eax
push 0x64
rep movsd dword es:[edi], dword [esi]
push 0x1011ec30
mov byte [esp + 0x20], 4
mov byte [esp + 0x21], 8
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0xc8
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x18
mov byte [esp + 0x29], 0x61
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x22
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x90
mov byte [esp + 0x31], 0x66
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], pe_nt_image_headers32
mov byte [esp + 0x35], 2
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
call fcn.10019a80
mov al, byte [esp + 0x5d]
add esp, 0x10
cmp al, bl
je 0x1000169b
lea ecx, [esp + 0x34]
push ecx
push ebx
push ebx
push 0x100189b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x48]
sub ecx, 0x1dc
cmp al, bl
mov dword [esp + 0x30], ecx
je 0x100016f2
mov edx, dword [0x1011f638]
push edx
call fcn.10025190
add esp, 4
mov esi, eax
push 4
push 0x1000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1011f638]
push esi
mov dword [0x1011f620], eax
push eax
mov eax, dword [esp + 0x38]
push eax
push ecx
call fcn.10025110
add esp, 0x10
mov dword [esp + 0x30], eax
jmp 0x10001724
mov edx, dword [esp + 0x30]
push 4
push 0x1000
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [0x1011f638]
mov dword [0x1011f620], eax
mov ecx, dword [esp + 0x30]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x3b]
cmp ah, 1
jne 0x10001734
call fcn.10019570
jmp 0x10001771
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x214]
and eax, 0xff
push ecx
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x53]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [0x1011f620]
push eax
push ecx
push ebx
push edx
call fcn.10017670
add esp, 0x1c
mov dword [0x1011f5f4], eax
mov eax, dword [0x1011f638]
push 0x8000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [0x1011f5f4], ebx
je 0x100017df
mov al, byte [esp + 0x3c]
cmp al, 1
mov eax, dword [0x1011ec28]
jne 0x1000179d
mov dword [0x1011f5fc], eax
push eax
mov ecx, 0x77
sub esp, 0x1dc
lea esi, [esp + 0x218]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x1011f5fc]
push ecx
call fcn.10018540
add esp, 0x1e4
test eax, eax
je case.default.0x10001584
push ebp
call fcn.10016dd0
add esp, 4
test eax, eax
jne case.default.0x10001584
push 0x10
push str.Error
push str.Cant_load_dll_from_memory_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret 0xc
push 0x10
push str.Error
push str.Cant_load_dll_from_Res_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret 0xc
mov al, 0xe
lea edx, [esp + 0x10]
mov byte [esp + 0x1a], al
mov byte [esp + 0x22], al
push 0x1dc
mov ecx, 0x77
mov esi, 0x1011ec30
lea edi, [esp + 0x3c]
push edx
lea eax, [esp + 0x40]
xor ebx, ebx
push 0x64
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [esp + 0x20], 4
mov byte [esp + 0x21], 8
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0xc8
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x18
mov byte [esp + 0x29], 0x61
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x22
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x90
mov byte [esp + 0x31], 0x66
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], pe_nt_image_headers32
mov byte [esp + 0x35], 2
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
call fcn.10019a30
mov eax, dword [0x1011f5f4]
add esp, 0x10
cmp eax, ebx
je case.default.0x10001584
cmp byte [esp + 0x3c], bl
jne case.default.0x10001584
mov ecx, dword [0x1011f5fc]
push 2
push ecx
call fcn.10018510
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret 0xc
mov al, 0xe
lea edx, [esp + 0x10]
mov byte [esp + 0x1a], al
mov byte [esp + 0x22], al
push 0x1dc
mov ecx, 0x77
mov esi, 0x1011ec30
lea edi, [esp + 0x3c]
push edx
lea eax, [esp + 0x40]
xor ebx, ebx
push 0x64
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [esp + 0x20], 4
mov byte [esp + 0x21], 8
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0xc8
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x18
mov byte [esp + 0x29], 0x61
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x22
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x90
mov byte [esp + 0x31], 0x66
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], pe_nt_image_headers32
mov byte [esp + 0x35], 2
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
call fcn.10019a30
mov eax, dword [0x1011f5f4]
add esp, 0x10
cmp eax, ebx
je case.default.0x10001584
cmp byte [esp + 0x3c], bl
jne case.default.0x10001584
mov ecx, dword [0x1011f5fc]
push 3
push ecx
call fcn.10018510
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret 0xc
mov al, 0xe
lea edx, [esp + 0x10]
mov byte [esp + 0x1a], al
mov byte [esp + 0x22], al
push 0x1dc
mov ecx, 0x77
mov esi, 0x1011ec30
lea edi, [esp + 0x3c]
push edx
lea eax, [esp + 0x40]
xor ebx, ebx
push 0x64
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [esp + 0x20], 4
mov byte [esp + 0x21], 8
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0xc8
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x18
mov byte [esp + 0x29], 0x61
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x22
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x90
mov byte [esp + 0x31], 0x66
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], pe_nt_image_headers32
mov byte [esp + 0x35], 2
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
call fcn.10019a30
mov eax, dword [0x1011f5f4]
add esp, 0x10
cmp eax, ebx
je case.default.0x10001584
cmp byte [esp + 0x3c], 1
jne 0x10001af9
lea ecx, [esp + 0x34]
push ecx
push ebx
push ebx
push 0x10018ba0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret 0xc
cmp byte [esp + 0x3b], bl
je 0x10001b13
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push 0x10018ba0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x1011f5fc]
push eax
call fcn.100184f0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x308
ret 0xc