Function at 0x10106a40
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c5b86
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1023c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 0x4d8]
test eax, eax
jne 0x10106a8b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
call sym.HncOfficeFramework.dll_int___cdecl_HncAtlVfsExt::InitializePath_struct_IHncVfsShellPidl_const___int___struct_HWND____
add esp, 0xc
test eax, eax
je 0x10106a77
call fcn.10108490
mov edi, dword [eax + 0x10]
test edi, edi
je 0x10106ad9
push dword [esi + 0x4d8]
push dword [edi]
call dword [sym.imp.HncVfs.dll_int___cdecl_HncVfsShell::ComparePidl_struct_IHncVfsShellPidl_const___struct_IHncVfsShellPidl_const__]
add esp, 8
test eax, eax
je 0x10106bd0
push 0x2710
mov dword [edi + 8], 1
push dword [esi + 0x4d4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.10108490
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [eax + 4]
call ebx
call fcn.10108490
mov dword [eax + 8], 0
call fcn.10108490
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [eax + 4]
call edi
push 0x1023fa54
call ebx
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_void___thiscall_CHncShellListCtrlVL::DeleteAllShellItems_void_
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::DeleteAllItems_void_
push 0x1023fa54
call edi
push 0xc
call fcn.100854b0
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push dword [eax + 0x4d8]
call dword [sym.imp.HncVfs.dll_struct_IHncVfsShellPidl____cdecl_HncVfsShell::CopyPidl_struct_IHncVfsShellPidl_const__]
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0xffffffff
call fcn.10108490
push dword [eax + 4]
call ebx
call fcn.10108490
mov dword [eax + 0x10], esi
call fcn.10108490
push dword [eax + 4]
call edi
call fcn.10108490
push dword [eax + 4]
call ebx
call dword [sym.imp.HncFoundation.dll_HncGetWinVersion]
mov ebx, dword [ebp - 0x10]
cmp eax, 9
jb 0x10106be7
mov ecx, ebx
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncShellListCtrlVL::IsInMyNetworkFolder_void_
test eax, eax
je 0x10106be7
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push 0x10106c40
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x10106be7
mov esi, dword [ebp - 0x10]
call fcn.10108490
push edi
mov dword [eax + 8], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10108490
mov dword [eax + 8], 0
call fcn.10108490
push dword [ebx + 0x4d4]
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
mov ecx, ebx
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncShellListCtrlVL::_EnumerateItems_unsigned_long_int_
push dword [ebx + 0x4d4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret