Function at 0x1002714e
Capabilities:
Link many functions at runtime
Resume thread

Disassembly:
push ebp
sub esp, 0xc00
lea ebp, [esp - 4]
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0xc00], eax
push 4
mov eax, 0x1005f10e
call fcn.100473a2
mov eax, dword [ebp + 0xc0c]
mov edi, dword [ebp + 0xc10]
mov dword [ebp - 0x10], eax
mov eax, dword [0x1015668c]
mov esi, 0x97
xor ebx, ebx
cmp eax, esi
je 0x1002719d
cmp eax, 4
je 0x1002719d
cmp eax, 0x99
jne 0x100271ae
push dword [edi + 8]
push str.call_Engine_start_PID__d_
push ebx
call fcn.100412e2
add esp, 0xc
cmp edi, ebx
je 0x100276ef
mov eax, dword [edi]
cmp eax, ebx
je 0x100276ef
push eax
call fcn.1002c57b
pop ecx
test eax, eax
je 0x10027248
push str.TC_IO32
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x100276ef
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x100271f7
cmp eax, 4
je 0x100271f7
cmp eax, 0x99
jne 0x10027208
push dword [edi + 8]
push str.TC_IO32_start_PID__d_
push ebx
call fcn.100412e2
add esp, 0xc
test byte [0x102d3d98], 8
push 0
pop eax
setne al
lea eax, [eax + eax + 2]
push eax
push dword [edi + 8]
push 0x1798
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_PostMessageA]
test byte [ebp + 0xc14], 4
jne 0x100276ef
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100276e6
cmp byte [0x1015188b], bl
je 0x10027281
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x10027265
cmp eax, 4
je 0x10027265
cmp eax, 0x99
jne 0x10027276
push dword [edi + 8]
push str.call_Engine_2_start_PID__d_
push ebx
call fcn.100412e2
add esp, 0xc
push ebx
push dword [edi + 8]
push 0xd03
jmp 0x10027222
cmp dword [0x10078cd8], 0x501
je 0x10027712
test byte [0x102d3d98], 8
jne 0x100272a6
cmp byte [ebp + 0xc18], bl
jne 0x10027712
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x100272bb
cmp eax, 4
je 0x100272bb
cmp eax, 0x99
jne 0x100272cc
push dword [edi + 8]
push str.InjectDll2_EZH_INJ_start_PID__d_
push ebx
call fcn.100412e2
add esp, 0xc
cmp dword [0x10185ec4], ebx
jne 0x100274d4
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x801]
push ebx
push eax
mov byte [ebp + 0x800], bl
call fcn.10045030
push esi
lea eax, [ebp + 0xa01]
push ebx
push eax
mov byte [ebp + 0xa00], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x601]
push ebx
push eax
mov byte [ebp + 0x600], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x401]
push ebx
push eax
mov byte [ebp + 0x400], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x201]
push ebx
push eax
mov byte [ebp + 0x200], bl
call fcn.10045030
push esi
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.10045030
add esp, 0x48
mov esi, 0x100614c0
mov eax, str.__s_12
cmp byte [0x10084690], bl
jne 0x10027366
mov eax, esi
push str.LhSetExclusiveACL
push eax
lea eax, [ebp + 0xa00]
push eax
call fcn.10045378
add esp, 0xc
mov eax, str.__s_16
cmp byte [0x10084690], bl
jne 0x1002738a
mov eax, esi
push str.LhInstallHook
push eax
lea eax, [ebp + 0x600]
push eax
call fcn.10045378
add esp, 0xc
mov eax, str.__s_0
cmp byte [0x10084690], bl
jne 0x100273ae
mov eax, esi
push str.LhUninstallAllHooks
push eax
lea eax, [ebp + 0x400]
push eax
call fcn.10045378
add esp, 0xc
mov eax, str.__s_0
cmp byte [0x10084690], bl
jne 0x100273d2
mov eax, esi
push str.LhWaitForPendingRemovals
push eax
lea eax, [ebp + 0x200]
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], bl
je 0x100273f4
mov esi, str.__s_28
push str.RhInjectLibrary
lea eax, [ebp]
push esi
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], bl
je 0x10027428
cmp dword [0x10078cd8], 0x501
jg 0x10027421
mov eax, str.tcxEZH32.dll
jmp 0x1002743e
mov eax, str.tc_EZH32.dll
jmp 0x1002743e
cmp dword [0x10078cd8], 0x501
mov eax, str.tcxEZH64.dll
jle 0x1002743e
mov eax, str.tc_EZH64.dll
push eax
push 0x10154e28
lea eax, [ebp + 0x800]
push str._s_s
push eax
call fcn.10045378
add esp, 0x10
lea eax, [ebp + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp + 0xa00]
push ecx
push eax
mov dword [0x10185ed0], eax
call esi
mov dword [0x10185eb4], eax
lea eax, [ebp + 0x600]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185eb8], eax
lea eax, [ebp + 0x400]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185ebc], eax
lea eax, [ebp + 0x200]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185ec0], eax
lea eax, [ebp]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185ec4], eax
cmp eax, ebx
je 0x1002766d
push 3
lea eax, [ebp + 0xb00]
mov esi, 0x10154c28
push esi
lea ecx, [ebp + 0xafc]
mov dword [ebp + 0xafc], eax
call fcn.1000cc50
push ebx
push ebx
push ebx
push dword [ebp + 0xafc]
mov dword [ebp - 4], ebx
push ebx
push ebx
push dword [edi + 8]
call dword [0x10185ec4]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xb00]
cmp dword [ebp + 0xafc], eax
je 0x1002752b
push dword [ebp + 0xafc]
call fcn.10046e73
pop ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xc0000225
je 0x10027620
cmp eax, ebx
je 0x100275a9
cmp eax, 0xc00000f3
je 0x100275a9
cmp eax, 0xc00000f2
je 0x100275a9
push 0x46
call dword [sym.imp.KERNEL32.dll_Sleep]
push 3
lea eax, [ebp + 0xb00]
push esi
lea ecx, [ebp + 0xafc]
mov dword [ebp + 0xafc], eax
call fcn.1000cc50
push ebx
push ebx
push ebx
push dword [ebp + 0xafc]
mov dword [ebp - 4], 1
push ebx
push ebx
push dword [edi + 8]
call dword [0x10185ec4]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xb00]
cmp dword [ebp + 0xafc], eax
je 0x100275a9
push dword [ebp + 0xafc]
call fcn.10046e73
pop ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xc0000225
je 0x10027620
cmp eax, ebx
je 0x10027620
cmp eax, 0xc00000f3
je 0x10027620
cmp eax, 0xc00000f2
je 0x10027620
push 0x46
call dword [sym.imp.KERNEL32.dll_Sleep]
push 3
lea eax, [ebp + 0x900]
push esi
lea ecx, [ebp + 0x8fc]
mov dword [ebp + 0x8fc], eax
call fcn.1000cc50
push ebx
push ebx
push ebx
push dword [ebp + 0x8fc]
mov dword [ebp - 4], 2
push ebx
push ebx
push dword [edi + 8]
call dword [0x10185ec4]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0x900]
cmp dword [ebp + 0x8fc], eax
je 0x10027620
push dword [ebp + 0x8fc]
call fcn.10046e73
pop ecx
test byte [ebp + 0xc14], 4
jne 0x1002763a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1015668c]
cmp eax, 0x97
je 0x10027656
cmp eax, 4
je 0x10027656
cmp eax, 0x99
jne 0x100276ef
push esi
push dword [edi + 8]
push str.InjectDll2_EZH_tc_P:_d__s
push ebx
call fcn.100412e2
add esp, 0x10
jmp 0x100276ef
mov eax, dword [0x1015668c]
cmp eax, 0x97
je 0x10027685
cmp eax, 4
je 0x10027685
cmp eax, 0x99
jne 0x10027697
push str.InjectDll2_MS_INJ_start
push ebx
call fcn.100412e2
mov eax, dword [0x1015668c]
pop ecx
pop ecx
mov esi, 0x97
cmp eax, esi
je 0x100276ac
cmp eax, 4
je 0x100276ac
cmp eax, 0x99
jne 0x100276bd
push dword [edi + 8]
push str.call_Engine_xxx_start_PID__d_
push ebx
call fcn.100412e2
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push ebx
push dword [edi + 8]
push 0xd03
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_PostMessageA]
test byte [ebp + 0xc14], 4
jne 0x100276ef
push 0x64
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc00]
xor ecx, ebp
call fcn.1004501f
add ebp, 0xc04
leave
ret
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x1002772b
cmp eax, 4
je 0x1002772b
cmp eax, 0x99
jne 0x1002769c
push str.InjectDll3_MS_INJ_start
push ebx
call fcn.100412e2
mov eax, dword [0x1015668c]
pop ecx
pop ecx
jmp 0x1002769c