Function at 0x10140630
Capabilities:
Create thread
Get file size
Parse pe header
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
push esi
push edi
sub eax, 0
je 0x10140683
sub eax, 1
jne 0x101412ca
mov esi, dword [ebp + 8]
test esi, esi
je 0x1014065d
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push esi
push 0x101405c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x102b6290], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x102b6290], 0
je 0x101411d3
mov eax, dword fs:[0x2c]
mov ecx, dword [0x102999e4]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x102bb8e8]
mov dword [esp + 0x48], esi
cmp eax, dword [esi + 4]
jle 0x10140bcd
push 0x102bb8e8
call fcn.101e23b9
add esp, 4
cmp dword [0x102bb8e8], 0xffffffff
jne 0x10140bcd
push 0
push 0x80
push 3
push 0
push 5
push connect
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0
push str.c:windows_syswow64_ntdll.dll
movq qword [esp + 0x84], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push esi
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x20], eax
xor edi, edi
mov ecx, dword [eax + 0x3c]
lea esi, [eax + 0xf8]
add esi, ecx
mov dword [esp + 0x1c], esi
movzx edx, word [ecx + eax + 6]
mov eax, dword [ecx + eax + 0x78]
mov ecx, esi
mov dword [esp + 0x30], edx
mov dword [esp + 8], eax
test edx, edx
je 0x10140a1b
nop
mov esi, dword [ecx + 0xc]
cmp eax, esi
jb 0x1014077a
mov eax, dword [ecx + 0x10]
add eax, esi
cmp dword [esp + 8], eax
jb 0x101409a8
mov eax, dword [esp + 8]
inc edi
add ecx, 0x28
cmp edi, edx
jb 0x10140760
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
xor esi, esi
nop dword [eax + eax]
mov edi, dword [ecx + 0xc]
cmp eax, edi
jb 0x101407ba
mov eax, dword [ecx + 0x10]
add eax, edi
cmp dword [esp + 8], eax
jb 0x101409da
mov eax, dword [esp + 8]
inc esi
add ecx, 0x28
cmp esi, edx
jb 0x101407a0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov dword [esp + 8], eax
test edx, edx
je 0x10140807
xor esi, esi
mov edi, dword [ecx + 0xc]
cmp eax, edi
jb 0x101407fb
mov eax, dword [ecx + 0x10]
add eax, edi
cmp dword [esp + 8], eax
jb 0x10140a2c
mov eax, dword [esp + 8]
inc esi
add ecx, 0x28
cmp esi, edx
jb 0x101407e1
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x20]
mov dword [esp + 8], eax
test edx, edx
je 0x10140844
xor esi, esi
mov edi, dword [ecx + 0xc]
cmp eax, edi
jb 0x1014083c
mov eax, dword [ecx + 0x10]
add eax, edi
cmp dword [esp + 8], eax
jb 0x10140a6d
mov eax, dword [esp + 8]
inc esi
add ecx, 0x28
cmp esi, edx
jb 0x10140822
xor ecx, ecx
mov eax, dword [esp + 0xc]
xor edi, edi
add ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 0x14], edi
cmp dword [eax + 0x18], edi
jbe 0x10140ba5
mov eax, dword [esp + 0x18]
xor esi, esi
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + edi*2]
mov edi, dword [ecx + eax*4]
mov eax, dword [esp + 0x1c]
mov ecx, eax
test edx, edx
je 0x101408a4
nop dword [eax]
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10140894
mov eax, dword [ecx + 0x10]
add eax, edx
cmp edi, eax
jb 0x10140a83
mov edx, dword [esp + 0x30]
inc esi
add ecx, 0x28
cmp esi, edx
jb 0x10140880
mov eax, dword [esp + 0x1c]
mov ecx, eax
xor eax, eax
mov dword [esp + 0x34], eax
test edx, edx
je 0x101408ef
mov eax, dword [esp + 0x14]
xor esi, esi
mov edi, dword [esp + 8]
mov edx, dword [ecx + 0xc]
cmp dword [edi + eax*4], edx
mov edi, dword [esp + 0x30]
jb 0x101408e7
mov eax, dword [ecx + 0x10]
mov edi, dword [esp + 0x14]
add eax, edx
mov edx, dword [esp + 8]
cmp dword [edx + edi*4], eax
mov edx, dword [ecx + 0xc]
mov edi, dword [esp + 0x30]
jb 0x10140aa7
mov eax, dword [esp + 0x14]
inc esi
add ecx, 0x28
cmp esi, edi
jb 0x101408b6
mov edi, dword [esp + 0x14]
xor esi, esi
push 1
lea ecx, [esp + 0x8c]
call fcn.100e5c20
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x88]
lea edx, [esi + edx]
call fcn.100511a0
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x90]
call fcn.10050eb0
lea ecx, [esp + 0x70]
call fcn.1000d6b0
mov ecx, eax
call fcn.10008550
lea ecx, [esp + 0x70]
mov esi, eax
call fcn.1000d660
cmp esi, 0x6b372c05
jne 0x10140b68
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
cmp byte [ecx + edx], 0xb8
jne 0x10140b68
mov al, byte [ecx + edx + 5]
cmp al, 0xb9
jne 0x10140ac4
cmp dword [ecx + edx + 0xa], 0x424548d
jne 0x10140b68
cmp dword [ecx + edx + 0xd], 0xc015ff64
jne 0x10140b68
movzx eax, word [ecx + edx + 0x11]
test ax, ax
jne 0x10140b68
movzx eax, byte [ecx + edx + 0x13]
test al, al
je 0x10140aee
jmp 0x10140b68
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x1c]
sub eax, esi
add eax, dword [esp + 8]
cmp eax, dword [esp + 0x28]
jb 0x101409cf
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x1c]
jmp 0x10140795
mov edi, dword [esp + 0x20]
add edi, eax
jmp 0x1014078a
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x1c]
sub eax, edi
add eax, dword [esp + 8]
mov edi, dword [esp + 0x20]
cmp eax, dword [esp + 0x28]
jb 0x10140a05
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov eax, dword [eax + 0x24]
mov dword [esp + 8], eax
jmp 0x101407df
add edi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov eax, dword [eax + 0x24]
mov dword [esp + 8], eax
jmp 0x101407df
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
jmp 0x101407ca
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x1c]
sub eax, edi
add eax, dword [esp + 8]
mov edi, dword [esp + 0x20]
cmp eax, dword [esp + 0x28]
jb 0x10140a57
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], edi
mov eax, dword [eax + 0x20]
mov dword [esp + 8], eax
jmp 0x10140820
add edi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], edi
mov eax, dword [eax + 0x20]
mov dword [esp + 8], eax
jmp 0x10140820
mov eax, dword [ecx + 0x14]
sub eax, edi
add eax, dword [esp + 8]
cmp eax, dword [esp + 0x28]
sbb ecx, ecx
and ecx, eax
jmp 0x10140846
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x1c]
sub eax, edx
add eax, edi
mov dword [esp + 0x34], eax
cmp eax, dword [esp + 0x28]
jb 0x101408b0
xor eax, eax
mov dword [esp + 0x34], eax
jmp 0x101408b0
mov eax, dword [ecx + 0x14]
mov edi, dword [esp + 0x14]
sub eax, edx
mov ecx, dword [esp + 8]
add eax, dword [ecx + edi*4]
cmp eax, dword [esp + 0x28]
sbb esi, esi
and esi, eax
jmp 0x101408f5
cmp al, 0xba
jne 0x10140b10
cmp dword [ecx + edx + 6], 0x7ffe0300
jne 0x10140ade
mov eax, 0x12ff
cmp word [ecx + edx + 0xa], ax
je 0x10140aee
mov eax, 0xd2ff
cmp word [ecx + edx + 0xa], ax
jne 0x10140b68
mov eax, dword [ecx + edx + 1]
mov dword [esp + 0x4c], eax
mov ax, word [ecx + edx + 0xd]
mov word [esp + 0x50], ax
movq xmm0, qword [esp + 0x4c]
mov dword [esp + 0x24], 0xa
jmp 0x10140b62
cmp al, 0x33
jne 0x10140b68
cmp byte [ecx + edx + 6], 0xc9
jne 0x10140b68
cmp dword [ecx + edx + 7], 0x424548d
jne 0x10140b68
cmp dword [ecx + edx + 0xb], 0xc015ff64
jne 0x10140b68
movzx eax, word [ecx + edx + 0xf]
test ax, ax
jne 0x10140b68
movzx eax, byte [ecx + edx + 0x11]
test al, al
jne 0x10140b68
mov eax, dword [ecx + edx + 1]
mov dword [esp + 0x38], eax
mov ax, word [ecx + edx + 0x16]
mov word [esp + 0x3c], ax
movq xmm0, qword [esp + 0x38]
mov dword [esp + 0x24], 7
movq qword [esp + 0x68], xmm0
lea ecx, [esp + 0xd8]
call fcn.100e5b50
lea eax, [esp + 0xd8]
mov dword [esp + 0xd8], 0x1025a2b4
push eax
call fcn.101e056c
mov eax, dword [esp + 0x10]
inc edi
mov edx, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x14], edi
cmp edi, dword [eax + 0x18]
jb 0x10140861
movq xmm0, qword [esp + 0x68]
mov eax, dword [esp + 0x24]
push 0x102bb8e8
movq qword [0x102bb8dc], xmm0
mov dword [0x102bb8e4], eax
call fcn.101e236f
mov esi, dword [esp + 0x4c]
add esp, 4
mov eax, dword [0x102bb8ec]
cmp eax, dword [esi + 4]
jle 0x10141165
push 0x102bb8ec
call fcn.101e23b9
add esp, 4
cmp dword [0x102bb8ec], 0xffffffff
jne 0x10141165
mov eax, dword [0x102b6288]
test eax, eax
jne 0x1014114f
mov eax, dword [0x102bb8e4]
cmp eax, 7
je 0x10140fc9
cmp eax, 0xa
je 0x10140c1f
xor eax, eax
jmp 0x1014114f
mov eax, dword [0x102bb904]
cmp eax, dword [esi + 4]
jle 0x10140c81
push 0x102bb904
call fcn.101e23b9
add esp, 4
cmp dword [0x102bb904], 0xffffffff
jne 0x10140c81
lea eax, [esp + 0x65]
mov dword [esp + 0x28], 0x25ff
push eax
lea ecx, [esp + 0x32]
mov word [esp + 0x30], 0
push ecx
lea edx, [esp + 0x30]
mov ecx, 0x102bb8f8
push edx
call fcn.1012dcd0
push 0x10210f20
call fcn.101e2242
push 0x102bb904
call fcn.101e236f
add esp, 8
mov eax, dword [0x102bb8f4]
cmp eax, dword [esi + 4]
jle 0x10140cf8
push 0x102bb8f4
call fcn.101e23b9
add esp, 4
cmp dword [0x102bb8f4], 0xffffffff
jne 0x10140cf8
lea eax, [esp + 0x66]
mov dword [esp + 0x38], 0xb8
push eax
lea ecx, [esp + 0x4b]
mov dword [esp + 0x40], 0xba00
push ecx
lea edx, [esp + 0x40]
mov dword [esp + 0x48], 0xd2ff0000
push edx
mov ecx, 0x102bb908
mov word [esp + 0x50], 0xc2
mov byte [esp + 0x52], 0
call fcn.1012dcd0
push 0x10210f80
call fcn.101e2242
push 0x102bb8f4
call fcn.101e236f
add esp, 8
mov eax, dword [0x102bb8fc]
mov esi, 0x5a4d
sub eax, dword [0x102bb8f8]
mov dword [esp + 0xc], eax
mov eax, dword [0x102bb924]
test eax, eax
jne 0x10140dc2
mov ecx, 0xa62a3b3b
call fcn.1016fc50
mov edi, dword [eax + 4]
cmp word [edi], si
je 0x10140d32
xor eax, eax
jmp 0x10140dbd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10140d42
xor eax, eax
jmp 0x10140dbd
mov edx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [edx + edi + 0x14]
add edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [edx + 0x20]
add ecx, edi
mov dword [esp + 8], ecx
test eax, eax
je 0x10140d97
nop word [eax + eax]
mov ecx, dword [ecx + esi*4]
add ecx, edi
call fcn.10008550
mov edx, dword [esp + 0x10]
cmp eax, 0xca67b978
mov eax, dword [edx + 0x14]
je 0x10140d93
mov ecx, dword [esp + 8]
inc esi
cmp esi, eax
jb 0x10140d70
jmp 0x10140d97
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
mov esi, 0x5a4d
cmp ecx, eax
jbe 0x10140da8
xor eax, eax
jmp 0x10140dbd
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [0x102bb924], eax
push 0x40
push 0x3000
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x102b628c
push 0xffffffffffffffff
call eax
mov eax, dword [0x102bb8fc]
mov ecx, dword [0x102bb8f8]
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [0x102b616c]
test eax, eax
jne 0x10140e9d
mov ecx, 0xa62a3b3b
call fcn.1016fc50
mov edi, dword [eax + 4]
cmp word [edi], si
je 0x10140e10
xor eax, eax
jmp 0x10140e92
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10140e20
xor eax, eax
jmp 0x10140e92
mov edx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [edx + edi + 0x14]
add edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [edx + 0x20]
add ecx, edi
mov dword [esp + 8], ecx
test eax, eax
je 0x10140e6c
mov ecx, dword [ecx + esi*4]
add ecx, edi
call fcn.10008550
mov edx, dword [esp + 0x10]
cmp eax, 0xbb40d3d
mov eax, dword [edx + 0x14]
je 0x10140e68
mov ecx, dword [esp + 8]
inc esi
cmp esi, eax
jb 0x10140e45
jmp 0x10140e6c
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
mov esi, 0x5a4d
cmp ecx, eax
jbe 0x10140e7d
xor eax, eax
jmp 0x10140e92
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov ecx, dword [0x102bb8f8]
mov dword [0x102b616c], eax
mov dword [ecx + 2], eax
push dword [esp + 0xc]
push dword [0x102bb8f8]
push dword [0x102b628c]
call fcn.101e3770
mov eax, dword [0x102bb90c]
add esp, 0xc
sub eax, dword [0x102bb908]
mov dword [esp + 0xc], eax
mov eax, dword [0x102bb924]
mov dword [esp + 0x24], 0
test eax, eax
jne 0x10140f7d
mov ecx, 0xa62a3b3b
call fcn.1016fc50
mov edi, dword [eax + 4]
cmp word [edi], si
je 0x10140ef5
xor eax, eax
jmp 0x10140f78
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10140f05
xor eax, eax
jmp 0x10140f78
mov edx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [edx + edi + 0x14]
add edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [edx + 0x20]
add ecx, edi
mov dword [esp + 8], ecx
test eax, eax
je 0x10140f57
nop word [eax + eax]
mov ecx, dword [ecx + esi*4]
add ecx, edi
call fcn.10008550
mov edx, dword [esp + 0x10]
cmp eax, 0xca67b978
mov eax, dword [edx + 0x14]
je 0x10140f53
mov ecx, dword [esp + 8]
inc esi
cmp esi, eax
jb 0x10140f30
jmp 0x10140f57
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x10140f63
xor eax, eax
jmp 0x10140f78
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [0x102bb924], eax
push 0x40
push 0x3000
lea ecx, [esp + 0x14]
push ecx
push 0
lea ecx, [esp + 0x34]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x102bb90c]
mov ecx, dword [0x102bb908]
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [0x102b628c]
mov dword [ecx + 6], eax
push dword [esp + 0xc]
push dword [0x102bb908]
push dword [esp + 0x2c]
call fcn.101e3770
mov eax, dword [esp + 0x30]
jmp 0x10141147
mov eax, dword [0x102bb920]
cmp eax, dword [esi + 4]
jle 0x1014104c
push 0x102bb920
call fcn.101e23b9
add esp, 4
cmp dword [0x102bb920], 0xffffffff
jne 0x1014104c
lea eax, [esp + 0x67]
mov dword [esp + 0x4c], 0xb8
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], 0x8dc93300
push ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x5c], 0x64042454
push edx
mov ecx, 0x102bb914
mov dword [esp + 0x64], 0xc015ff
mov dword [esp + 0x68], 0xc4830000
mov dword [esp + 0x6c], 0xc204
call fcn.1012dcd0
push 0x10210ec0
call fcn.101e2242
push 0x102bb920
call fcn.101e236f
add esp, 8
mov eax, dword [0x102bb918]
sub eax, dword [0x102bb914]
mov dword [esp + 0x30], eax
mov eax, dword [0x102bb924]
mov dword [esp + 0x34], 0
test eax, eax
jne 0x10141110
mov ecx, 0xa62a3b3b
call fcn.1016fc50
mov edi, dword [eax + 4]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1014108e
xor eax, eax
jmp 0x1014110b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1014109e
xor eax, eax
jmp 0x1014110b
mov edx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [edx + edi + 0x14]
add edx, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edx + 0x20]
add ecx, edi
mov dword [esp + 0x18], ecx
test eax, eax
je 0x101410ea
mov ecx, dword [ecx + esi*4]
add ecx, edi
call fcn.10008550
mov edx, dword [esp + 0x24]
cmp eax, 0xca67b978
mov eax, dword [edx + 0x14]
je 0x101410e6
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, eax
jb 0x101410c3
jmp 0x101410ea
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jbe 0x101410f6
xor eax, eax
jmp 0x1014110b
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [0x102bb924], eax
push 0x40
push 0x3000
lea ecx, [esp + 0x38]
push ecx
push 0
lea ecx, [esp + 0x44]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x102bb918]
mov ecx, dword [0x102bb914]
sub eax, ecx
push eax
push ecx
push dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
call fcn.101e3770
mov eax, dword [esp + 0x40]
mov dword [0x102b6288], eax
add esp, 0xc
push 0x102bb8ec
mov dword [0x102bb8f0], eax
call fcn.101e236f
mov esi, dword [esp + 0x4c]
add esp, 4
mov eax, dword [0x102bb928]
cmp eax, dword [esi + 4]
jle 0x101411ae
push 0x102bb928
call fcn.101e23b9
add esp, 4
cmp dword [0x102bb928], 0xffffffff
jne 0x101411ae
cmp dword [0x102bb8e4], 7
mov ecx, 0xd
mov eax, 0x16
cmovne eax, ecx
push 0x102bb928
mov dword [0x102bb92c], eax
call fcn.101e236f
add esp, 4
mov edx, dword [0x102bb8f0]
mov eax, dword [0x102bb8dc]
movzx ecx, word [0x102bb8e0]
push dword [0x102b6290]
mov dword [edx + 1], eax
mov eax, dword [0x102bb92c]
mov dword [eax + edx], ecx
call edx
cmp dword [ebp + 0x10], 0
jne 0x101412ca
push 4
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 1
push eax
call fcn.10127b30
mov edi, dword [0x10297f58]
mov esi, dword [0x10297f54]
cmp esi, edi
je 0x1014121e
mov ecx, dword [0x1029a484]
push dword [esi + 4]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
add esi, 8
cmp esi, edi
jne 0x10141201
mov esi, dword [0x10297f54]
mov eax, dword [0x102b2014]
mov dword [0x10297f58], esi
test eax, eax
je 0x10141234
push eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
call fcn.10136000
push ecx
call fcn.1016e4f0
push dword [0x102b2184]
push 0xfffffffffffffffc
push dword [0x102b2180]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edi, dword [0x102b20bc]
mov esi, dword [0x102b20b8]
cmp esi, edi
je 0x1014126e
mov eax, dword [esi]
call eax
add esi, 4
cmp esi, edi
jne 0x10141263
push 1
push 0x75
mov ecx, 0x102a5854
call fcn.10164720
push 1
push 0x74
mov ecx, 0x102a5858
call fcn.10164720
push 1
push 1
mov ecx, 0x102a585c
call fcn.10164720
push 1
push 0x75
mov ecx, 0x102a5860
call fcn.10164720
push 1
push 0x74
mov ecx, 0x102a5864
call fcn.10164720
push 1
push 1
mov ecx, 0x102a5868
call fcn.10164720
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc