Function at 0x104a38f
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
call fcn.01049de0
mov edi, 0x10d39d4
jmp 0x104a3b1
push esi
push edi
call fcn.01083dee
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
call fcn.01049de0
mov esi, eax
test esi, esi
jne 0x104a39d
push edi
call fcn.01083cc9
pop edi
pop esi
jmp 0x1073e19
push ebx
or ebx, 0xffffffff
cmp dword [0x10ceff4], ebx
jne 0x1073e2a
xor eax, eax
inc eax
pop ebx
ret
mov eax, dword [0x10d73d0]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1073e73
add dword [0x10d7338], 1
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1073e64
push ebx
push dword [0x10d73d0]
call esi
push dword [0x10d73d0]
call edi
and dword [0x10d73d0], 0
mov eax, dword [0x10d73d8]
cmp eax, ebx
je 0x1073e88
push eax
call sub.NTMSAPI.dll_CloseNtmsNotification
mov dword [0x10d73d8], ebx
push 0x10d7354
call fcn.0106fac8
test ax, ax
jne 0x1073e9c
call fcn.010725bf
mov eax, dword [0x10d73d4]
test eax, eax
je 0x1073eb5
cmp eax, ebx
je 0x1073eb5
push eax
call sub.NTMSAPI.dll_CloseNtmsSession
mov dword [0x10d73d4], ebx
mov eax, dword [0x10d73cc]
test eax, eax
je 0x1073ed1
push ebx
push eax
call esi
push dword [0x10d73cc]
call edi
and dword [0x10d73cc], 0
push ebp
call fcn.010707f3
call fcn.0106fb12
mov esi, dword [sym.imp.msvcrt.dll_free]
jmp 0x1073f1e
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
je 0x1073f0a
lea ebp, [edi + 0x14]
push ebx
push ebp
call fcn.01083dee
push ebx
call esi
pop ecx
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
jne 0x1073ef3
push edi
push 0x10d72f8
call fcn.01083dee
push edi
call esi
pop ecx
call fcn.0106fb12
mov edi, eax
test edi, edi
jne 0x1073ee4
jmp 0x1073f5b
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
je 0x1073f4c
lea ebp, [edi + 0x14]
push ebx
push ebp
call fcn.01083dee
push ebx
call esi
pop ecx
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
jne 0x1073f35
push edi
push 0x10d7324
call fcn.01083dee
push edi
call esi
pop ecx
call fcn.0106fa80
mov edi, eax
test edi, edi
jne 0x1073f26
jmp 0x1073f9d
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
je 0x1073f8e
lea ebp, [edi + 0x14]
push ebx
push ebp
call fcn.01083dee
push ebx
call esi
pop ecx
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
jne 0x1073f77
push edi
push 0x10d738c
call fcn.01083dee
push edi
call esi
pop ecx
call fcn.0106fa91
mov edi, eax
test edi, edi
jne 0x1073f68
jmp 0x1073fdf
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
je 0x1073fd0
lea ebp, [edi + 0x14]
push ebx
push ebp
call fcn.01083dee
push ebx
call esi
pop ecx
push edi
call fcn.0106fb31
mov ebx, eax
test ebx, ebx
jne 0x1073fb9
push edi
push 0x10d730c
call fcn.01083dee
push edi
call esi
pop ecx
call fcn.0106faa2
mov edi, eax
test edi, edi
jne 0x1073faa
call fcn.010707fd
mov eax, dword [0x10ceff8]
cmp eax, 0xffffffff
pop ebp
je 0x1074006
push eax
push dword [0x10ceff4]
call sub.NTMSAPI.dll_EndNtmsDeviceChangeDetection
push dword [0x10ceff4]
call sub.NTMSAPI.dll_CloseNtmsSession
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [0x10ceff4], 0xffffffff
push 0x10d733c
call esi
push 0x10d73a4
call esi
pop edi
pop esi
xor eax, eax
pop ebx
ret