Function at 0x10004119
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
pushal
cmp dword [ebp + 0xc], 1
jne 0x100041e1
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push dword [ebp + 8]
call fcn.10002da1
lea eax, [ebp - 0x104]
push eax
push 0x10
lea eax, [ebp - 0x114]
push eax
call fcn.10001e13
push 9
lea eax, [ebp - 0x11d]
push eax
call fcn.100037e0
lea eax, [ebp - 0x11d]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_lstrcmpiA
push eax
push 9
lea eax, [ebp - 0x11d]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x10004495
push 0x1f4
push 0x10008ace
call sub.ntdll.dll_RtlZeroMemory
push 0x10008caa
call sub.KERNEL32.dll_InitializeCriticalSection
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x10008ace], eax
and dword [0x10008ad6], 0
push ecx
push esp
push 0
push 0
push 0x10003a5e
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [0x10008ad2], eax
pop ecx
jmp 0x10004495
cmp dword [ebp + 0xc], 0
jne 0x1000432f
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
lea eax, [ebp - 0x104]
push eax
push 0x10
lea eax, [ebp - 0x114]
push eax
call fcn.10001e13
push 9
lea eax, [ebp - 0x11d]
push eax
call fcn.100037e0
lea eax, [ebp - 0x11d]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_lstrcmpiA
push eax
push 9
lea eax, [ebp - 0x11d]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x10004322
cmp dword [0x10008ad2], 0
je 0x100042a4
push dword [0x10008ad2]
call fcn.10001caf
or eax, eax
je 0x10004292
mov dword [0x10008ad6], 1
push 0x3e8
push dword [0x10008ad2]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x10004292
push 0
push dword [0x10008ad2]
call sub.KERNEL32.dll_TerminateThread
push dword [0x10008ad2]
call sub.KERNEL32.dll_CloseHandle
and dword [0x10008ad2], 0
cmp dword [0x10008ada], 0
je 0x100042c0
push dword [0x10008ada]
push 0
call sub.USER32.dll_KillTimer
and dword [0x10008ada], eax
cmp dword [0x10008ae2], 0
je 0x10004318
push dword [0x10008ae2]
call fcn.10001caf
or eax, eax
je 0x10004306
mov dword [0x10008ae6], 1
push 0x12c
push dword [0x10008ae2]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x10004306
push 0
push dword [0x10008ae2]
call sub.KERNEL32.dll_TerminateThread
push dword [0x10008ae2]
call sub.KERNEL32.dll_CloseHandle
and dword [0x10008ae2], 0
push 0x10008caa
call sub.KERNEL32.dll_DeleteCriticalSection
push dword [ebp + 8]
call fcn.10003017
jmp 0x10004495
cmp dword [ebp + 0xc], 0x8000
jne 0x10004345
push dword [ebp + 8]
call fcn.10002f34
jmp 0x10004495
cmp dword [ebp + 0xc], 0x8001
jne 0x10004495
mov edi, dword [ebp + 0x10]
cmp dword [edi], 0x92c
jne 0x10004495
push 0x10007214
push dword [edi + 8]
push dword [edi + 4]
call fcn.100030ef
or eax, eax
je 0x10004495
push 0x100
lea eax, [edi + 0xc]
push eax
call fcn.1000387f
push 0x10
lea eax, [edi + 0x10c]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [str.m_XT_Y__]
push eax
push dword [0x10008250]
push 0x10008255
lea eax, [edi + 0x10c]
push eax
call fcn.1000314d
push 0x200
lea eax, [edi + 0x11c]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x10008269]
push eax
push dword [0x10008265]
push 0x1000826a
lea eax, [edi + 0x11c]
push eax
call fcn.1000314d
push 0x200
lea eax, [edi + 0x31c]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x1000847e]
push eax
push dword [0x1000847a]
push str.iuuq_..999903247_bnl.umy4.qnru__rq
lea eax, [edi + 0x31c]
push eax
call fcn.1000314d
push 0x200
lea eax, [edi + 0x51c]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x10008693]
push eax
push dword [0x1000868f]
push 0x10008694
lea eax, [edi + 0x51c]
push eax
call fcn.1000314d
push 0x200
lea eax, [edi + 0x71c]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x100088a8]
push eax
push dword [0x100088a4]
push 0x100088a9
lea eax, [edi + 0x71c]
push eax
call fcn.1000314d
push 0x10
lea eax, [edi + 0x91c]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x10008abd]
push eax
push dword [0x10008ab9]
push 0x10008abe
lea eax, [edi + 0x91c]
push eax
call fcn.1000314d
popal
xor eax, eax
inc eax
leave
ret 0xc