Function at 0x100199b0
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
sub eax, ebx
push edi
je 0x10019c19
dec eax
jne 0x10019ccf
mov eax, dword [ebp + 8]
push eax
mov dword [0x10034fdc], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [0x1003503c], ebx
jne 0x10019a0e
call dword [sym.imp.USER32.dll_GetCursor]
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetPixel]
push ebx
call dword [sym.imp.GDI32.dll_GetBkColor]
push ebx
call dword [sym.imp.GDI32.dll_GetBkMode]
mov dword [0x1003503c], 1
mov ecx, 0x46
xor eax, eax
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x220], ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
lea eax, [ebp - 0x220]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
test eax, eax
je 0x10019a46
cmp esi, dword [ebp - 0x20c]
je 0x10019a4d
push ebx
call dword [sym.imp.KERNEL32.dll_ExitThread]
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x104]
push edx
call fcn.100299ec
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.10019e20
lea edi, [eax + 1]
add esp, 0xc
mov dword [ebp + 8], edi
mov esi, 0x10003f0c
push edi
push esi
call fcn.10019d40
add esp, 8
test eax, eax
jne 0x10019b00
add esi, 0x38
cmp esi, 0x100049fc
jl 0x10019a88
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0x10004bc4
push ebx
push 0x1f0003
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x10035020], eax
jne 0x10019b07
push 0x10004b04
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [ebp + 0xc]
mov dword [0x10035020], eax
push ecx
push ebx
push ebx
push 0x10019840
push ebx
push ebx
call esi
lea edx, [ebp + 0xc]
mov dword [0x10034ffc], eax
push edx
push ebx
push ebx
push 0x10019970
push ebx
push ebx
call esi
mov dword [0x10035000], eax
jmp 0x10019b14
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10035020], ebx
cmp dword [0x10035038], ebx
jne 0x10019b26
mov dword [0x10035038], 1
mov eax, dword [ebp + 8]
push 0x10004b2c
push eax
call fcn.10019d40
add esp, 8
test eax, eax
je 0x10019bf1
lea ecx, [ebp + 0xc]
push ecx
push ebx
push ebx
push 0x10019300
push ebx
push ebx
call esi
push 0x10004b9c
push ebx
push 0x1f0003
mov dword [0x10034fec], eax
call edi
cmp eax, ebx
mov dword [0x10035018], eax
jne 0x10019c04
push 0x10004b9c
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10035018], eax
mov eax, dword [0x10034ff0]
cmp eax, ebx
jne 0x10019b9d
lea edx, [ebp + 0xc]
push edx
push ebx
push ebx
push 0x100196a0
push ebx
push ebx
call esi
mov dword [0x10034ff0], eax
cmp dword [0x10034ff4], ebx
jne 0x10019bb9
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x10019700
push ebx
push ebx
call esi
mov dword [0x10034ff4], eax
cmp dword [0x10034fe8], ebx
jne 0x10019bd5
lea ecx, [ebp + 0xc]
push ecx
push ebx
push ebx
push 0x10019760
push ebx
push ebx
call esi
mov dword [0x10034fe8], eax
cmp dword [0x10034fe4], ebx
jne 0x10019bf1
lea edx, [ebp + 0xc]
push edx
push ebx
push ebx
push 0x100192f0
push ebx
push ebx
call esi
mov dword [0x10034fe4], eax
call fcn.10018ca0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, sym.imp.KERNEL32.dll_ResumeThread
lea eax, sym.imp.KERNEL32.dll_SetComputerNameW
lea eax, sym.imp.KERNEL32.dll_SetConsoleTitleW
lea eax, sym.imp.KERNEL32.dll_SetEndOfFile
mov eax, dword [0x10034fe4]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, ebx
je 0x10019c4a
push ebx
push eax
call esi
mov dword [0x10034fe4], ebx
mov eax, dword [0x10034fe8]
cmp eax, ebx
je 0x10019c5d
push ebx
push eax
call esi
mov dword [0x10034fe8], ebx
mov eax, dword [0x10034ff8]
cmp eax, ebx
je 0x10019c70
push ebx
push eax
call esi
mov dword [0x10034ff8], ebx
mov eax, dword [0x10034ff0]
cmp eax, ebx
je 0x10019c83
push ebx
push eax
call esi
mov dword [0x10034ff0], ebx
mov eax, dword [0x10034ffc]
cmp eax, ebx
je 0x10019c96
push ebx
push eax
call esi
mov dword [0x10034ffc], ebx
mov eax, dword [0x10034fec]
cmp eax, ebx
je 0x10019ca9
push ebx
push eax
call esi
mov dword [0x10034fec], ebx
mov eax, dword [0x10034ff4]
cmp eax, ebx
je 0x10019cbc
push ebx
push eax
call esi
mov dword [0x10034ff4], ebx
mov eax, dword [0x10035000]
cmp eax, ebx
je 0x10019ccf
push ebx
push eax
call esi
mov dword [0x10035000], ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc