Function at 0x1010f8b
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
je 0x101466a
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100180a
mov dword [eax - 4], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 0x14
cmp eax, 0x1048d64
jl 0x1009bf4
mov eax, dword [0x10484f4]
mov dword [0x1048ae0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push ebx
push ebx
push ebx
push ebx
mov dword [0x1048ae4], eax
mov dword [0x1048ae8], ebx
mov dword [0x1048aec], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, edi
mov dword [0x1048af0], eax
call fcn.0100166e
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp dword [0x10482d0], ebx
je 0x1009ce8
lea ecx, [ebp - 0x30]
call fcn.01008948
mov esi, 0x1009d7c
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.01012d94
cmp eax, ebx
lea ecx, [ebp - 0x30]
jl 0x101a416
push esi
call fcn.01012ddb
cmp eax, ebx
jl 0x101a430
push 1
push esi
call fcn.010086d0
mov esi, eax
mov dword [ebp - 0x1c], esi
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
mov byte [ebp - 4], 2
push esi
js 0x101a435
lea ecx, [ebp - 0x30]
call fcn.010087ff
cmp eax, ebx
jl 0x101a441
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.01012e23
cmp eax, ebx
mov byte [ebp - 4], 1
push esi
jl 0x101a439
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.010087f1
push ebx
push ebx
push ebx
push 2
push 4
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
cmp esi, ebx
jl 0x101a444
push dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
jl 0x1014699
push 1
push 4
push edi
call fcn.0100b297
cmp eax, ebx
jl 0x101a501
mov esi, dword [ebp - 0x18]
push 0x1003960
push dword [esi + 0x4e0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1009d4e
mov ecx, esi
call fcn.0100e8ad
push ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.01003908
mov esi, dword [sym.imp.USER32.dll_SetWinEventHook]
push ebx
push ebx
push ebx
push 0x1001539
push ebx
push 0x8003
push 0x8002
call esi
jmp 0x101a456
mov ecx, eax
call fcn.010039c9
push ebx
push ebx
push ebx
push 0x1003e09
push ebx
push 0x20
push 0x20
call esi
jmp 0x101a460
push ebx
push ebx
push ebx
push 0x100e1ae
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov ecx, dword [ebp - 0x18]
add esp, 0x18
push 0xffffffffffffffff
mov dword [ecx + 0x558], eax
push dword [0x1048af0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10489ac]
cmp eax, 0x10489ac
je 0x100e174
test byte [eax + 0x1c], 0x10
jne 0x101a4bb
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov esi, ecx
or esi, edx
mov edi, 0x610
mov esi, 0x1009464
jne 0x101a4dc
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x101a4f1
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100180a
push 0x30
mov eax, 0x1043fb5
call fcn.01001a8e
mov edi, ecx
mov dword [ebp - 0x18], edi
push 0x1010fec
call fcn.0100164a
pop ecx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
cmp eax, ebx
setge cl
cmp eax, ebx
mov dword [edi + 0x970], ecx
jl 0x101a3ac
push 1
mov esi, 0x80000002
push esi
mov ecx, edi
call fcn.01005b3f
push ebx
mov ecx, edi
cmp dword [0x10482d0], ebx
je 0x101a3c9
jmp 0x101a3be
mov ecx, edi
call fcn.010170f1
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [edi + 0x4f0], ebx
mov edi, section..data
mov ecx, edi
call fcn.01009d87
mov ecx, edi
call fcn.01001652
mov eax, 0x1048ae4
jmp 0x1009bf4
mov eax, dword [0x10489ac]
cmp eax, 0x10489ac
je 0x1014680
test byte [eax + 0x1c], 0x10
jne 0x101a513
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x101a534
cmp dword [ebp - 0x14], ebx
jne 0x101a548
mov esi, dword [ebp - 0x18]
add esi, 0x50c
mov eax, dword [esi]
cmp eax, ebx
je 0x10146b5
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
call fcn.01001b72
push 0x10146c8
call fcn.0100164a
pop ecx
call fcn.01001a75
ret
push eax
push 0x101a780
call fcn.0100164a
pop ecx
pop ecx
jmp 0x1010fc6
push esi
call fcn.01005b3f
jmp 0x1011026
push 0x80000001
call fcn.01005b3f
test eax, eax
jge 0x1011026
push ebx
push esi
mov ecx, edi
call fcn.01005b3f
cmp eax, ebx
jl 0x101a404
push 0x80000001
mov ecx, edi
call fcn.010283b0
cmp eax, ebx
jge 0x1011026
push eax
push 0x101a708
jmp 0x101a40a
push eax
push 0x101a690
call fcn.0100164a
pop ecx
pop ecx
jmp 0x1011026
mov byte [ebp - 4], bl
call fcn.010087f1
push dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1014699
lea ecx, [ebp - 0x30]
jmp 0x101a416
mov byte [ebp - 4], 1
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x101a430
push esi
jmp 0x101a435
push esi
push 0x101a618
call fcn.0100164a
pop ecx
pop ecx
jmp 0x1009d06
call fcn.010015fd
jmp 0x100e119
cmp dword [0x10482d0], ebx
je 0x100e134
push 0x101a5e8
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, ebx
setne byte [ebp - 0xd]
cmp eax, ebx
je 0x101a48e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], bl
jne 0x100e134
mov eax, dword [ebp - 0x18]
push 2
push ebx
push ebx
push 0x103102a
mov dword [eax + 0x51c], ebx
push ebx
mov eax, 0x8005
push eax
push eax
call esi
mov dword [ebp - 0x14], eax
jmp 0x100e134
push 0x101a5cc
push 0x101cbe8
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01022472
mov eax, dword [0x10489ac]
jmp 0x100e174
push 1
push edx
push ecx
push edi
push esi
call fcn.010152d6
mov eax, dword [0x10489ac]
jmp 0x100e18e
push 2
push eax
push ecx
push edi
push esi
call fcn.010152d6
jmp 0x100e19e
push eax
push 0x101a558
call fcn.0100164a
pop ecx
pop ecx
jmp 0x1014699
push 0x101a5cc
push 0x101cbe8
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01022472
mov eax, dword [0x10489ac]
jmp 0x1014680
push 1
push eax
push ecx
push 0x61c
push esi
call fcn.010152d6
jmp 0x1014690
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnhookWinEvent]
jmp 0x1014699