Function at 0x1011c720
Capabilities:
Create thread
Encrypt data using rc4 ksa
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
mov dword [ebp - 0x148], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0xa8], esi
or byte [edi + 0x12ac], 4
mov dword [edi + 0x1b0], eax
lea eax, [edi + 0xa8]
test byte [0x11cd362c], 1
je 0x1011c7b8
test eax, eax
je 0x1011c7b8
cmp dword [0x11cd3624], 0
jne 0x1011c784
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c7b8
mov edx, dword [0x11cd3618]
xor eax, eax
mov ebx, dword [0x11cd3614]
test edx, edx
je 0x1011c7b8
lea ecx, [ebx + 4]
nop dword [eax]
cmp dword [ecx], 0x15f512
je 0x1011c7b2
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c7a0
jmp 0x1011c7b8
add eax, eax
mov esi, dword [ebx + eax*8 + 0xc]
mov dword [edi + 0xa8], esi
lea eax, [edi + 0x84]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011c815
test eax, eax
je 0x1011c815
cmp dword [0x11cd3624], 0
jne 0x1011c7ea
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c815
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011c815
lea ecx, [esi + 4]
nop
cmp dword [ecx], 0
je 0x1011c80f
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c800
jmp 0x1011c815
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0x84], ebx
lea eax, [edi + 0x8c]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011c875
test eax, eax
je 0x1011c875
cmp dword [0x11cd3624], 0
jne 0x1011c847
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c875
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011c875
lea ecx, [esi + 4]
nop dword [eax]
cmp dword [ecx], 0
je 0x1011c86f
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c860
jmp 0x1011c875
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0x8c], ebx
lea eax, [edi + 0x90]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011c8d5
test eax, eax
je 0x1011c8d5
cmp dword [0x11cd3624], 0
jne 0x1011c8a7
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c8d5
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011c8d5
lea ecx, [esi + 4]
nop dword [eax]
cmp dword [ecx], 0
je 0x1011c8cf
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c8c0
jmp 0x1011c8d5
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0x90], ebx
lea eax, [edi + 0x94]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011c935
test eax, eax
je 0x1011c935
cmp dword [0x11cd3624], 0
jne 0x1011c907
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c935
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011c935
lea ecx, [esi + 4]
nop dword [eax]
cmp dword [ecx], 0
je 0x1011c92f
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c920
jmp 0x1011c935
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0x94], ebx
lea esi, [edi + 0x98]
test byte [0x11cd362c], 1
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
je 0x1011c999
test esi, esi
je 0x1011c999
cmp dword [0x11cd3624], 0
jne 0x1011c96d
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c993
mov edx, dword [0x11cd3618]
xor eax, eax
mov ebx, dword [0x11cd3614]
test edx, edx
je 0x1011c993
lea ecx, [ebx + 4]
cmp dword [ecx], 0
je 0x1011ca47
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c982
mov eax, dword [ebp - 0x12c]
mov dword [esi], eax
lea esi, [edi + 0x9c]
test byte [0x11cd362c], 1
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
je 0x1011c9f5
test esi, esi
je 0x1011c9f5
cmp dword [0x11cd3624], 0
jne 0x1011c9cd
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011c9ef
mov edx, dword [0x11cd3618]
xor eax, eax
mov ebx, dword [0x11cd3614]
test edx, edx
je 0x1011c9ef
lea ecx, [ebx + 4]
cmp dword [ecx], 0
je 0x1011ca52
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011c9e2
mov eax, dword [ebp - 0x12c]
mov dword [esi], eax
lea eax, [edi + 0xa0]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011ca60
test eax, eax
je 0x1011ca60
cmp dword [0x11cd3624], 0
jne 0x1011ca23
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011ca60
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011ca60
lea ecx, [esi + 4]
cmp dword [ecx], 0
je 0x1011ca5a
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011ca38
jmp 0x1011ca60
add eax, eax
mov eax, dword [ebx + eax*8 + 0xc]
jmp 0x1011c999
add eax, eax
mov eax, dword [ebx + eax*8 + 0xc]
jmp 0x1011c9f5
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0xa0], ebx
lea eax, [edi + 0xa4]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011cabc
test eax, eax
je 0x1011cabc
cmp dword [0x11cd3624], 0
jne 0x1011ca92
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011cabc
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011cabc
lea ecx, [esi + 4]
cmp dword [ecx], 0
je 0x1011cab6
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011caa7
jmp 0x1011cabc
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0xa4], ebx
lea eax, [edi + 0xac]
test byte [0x11cd362c], 1
mov ebx, dword [eax]
je 0x1011cb1b
test eax, eax
je 0x1011cb1b
cmp dword [0x11cd3624], 0
jne 0x1011caee
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011cb1b
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011cb1b
lea ecx, [esi + 4]
cmp dword [ecx], 0x15f522
je 0x1011cb15
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011cb03
jmp 0x1011cb1b
add eax, eax
mov ebx, dword [esi + eax*8 + 0xc]
mov dword [edi + 0xac], ebx
lea esi, [edi + 0xb0]
test byte [0x11cd362c], 1
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
je 0x1011cb8a
test esi, esi
je 0x1011cb8a
cmp dword [0x11cd3624], 0
jne 0x1011cb53
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011cb84
mov edx, dword [0x11cd3618]
xor eax, eax
mov ebx, dword [0x11cd3614]
test edx, edx
je 0x1011cb84
lea ecx, [ebx + 4]
nop dword [eax + eax]
cmp dword [ecx], 0x88318
je 0x1011cd1a
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011cb70
mov eax, dword [ebp - 0x12c]
mov dword [esi], eax
lea ebx, [edi + 0xb4]
test byte [0x11cd362c], 1
je 0x1011cbe4
test ebx, ebx
je 0x1011cbe4
cmp dword [0x11cd3624], 0
jne 0x1011cbb6
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1011cbe4
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1011cbe4
lea ecx, [esi + 4]
nop dword [eax + eax]
cmp dword [ecx], 0xc96f61
je 0x1011cd25
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1011cbd0
mov eax, 0x17
mov dword [ebx], eax
mov eax, dword [edi + 0x100]
mov eax, dword [eax + 0xf7c]
cmp dword [eax + 0x1838], 0x57ad
jne 0x1011cc14
or byte [edi + 0xf9], 0x80
mov dword [edi + 0xa8], 0x53855200
mov edx, dword [edi + 0x84]
mov esi, 1
mov eax, dword [edi + 0x94]
mov ecx, esi
cmp eax, esi
mov ebx, edx
cmova ecx, eax
mov eax, edx
shr eax, 5
xor al, byte [edi + 0xf9]
and al, 1
mov dword [edi + 0x94], ecx
xor byte [edi + 0xf9], al
mov ecx, edx
mov al, byte [edi + 0xf9]
shr ecx, 6
add cl, cl
shr ebx, 8
xor cl, al
shl bl, 3
and cl, 2
xor cl, al
mov eax, edx
shr eax, 7
shl al, 2
xor al, cl
and al, 4
xor al, cl
mov ecx, edx
xor bl, al
shr ecx, 4
shl cl, 5
and bl, 8
xor bl, al
mov eax, edx
shr eax, 3
and al, 1
mov byte [edi + 0xf9], bl
or cl, al
mov eax, edx
shr eax, 1
and al, 1
shl cl, 2
or cl, al
mov eax, edx
and ecx, 0xffffff87
shr eax, 2
mov dword [ebp - 0x12c], ecx
and al, 1
mov ecx, edx
shr ecx, 0x1d
and cl, 1
shl cl, 5
or cl, al
mov eax, edx
shr eax, 0x14
add cl, cl
or byte [ebp - 0x12c], cl
mov ecx, dword [ebp - 0x12c]
shl al, 5
not al
and al, 0x20
or cl, al
mov eax, edx
shr eax, 0x13
shl al, 4
shr edx, 0x10
not al
and al, 0x10
shl dl, 3
or cl, al
not dl
movzx eax, word [edi + 0xa4]
and dl, 8
or cl, dl
mov dword [edi + 0xe8], eax
movzx eax, word [edi + 0xa6]
mov byte [edi + 0xf8], cl
mov dword [edi + 0xec], eax
test cl, 4
jne 0x1011cd30
test bl, 8
jne 0x1011cd30
xor al, al
jmp 0x1011cd32
add eax, eax
mov eax, dword [ebx + eax*8 + 0xc]
jmp 0x1011cb8a
add eax, eax
mov eax, dword [esi + eax*8 + 0xc]
jmp 0x1011cbe9
mov al, 0x10
and bl, 0xef
or bl, al
movzx eax, byte [edi + 0xad]
mov dword [edi + 0xf0], eax
movzx eax, byte [edi + 0xae]
and dword [edi + 0xac], 0xff
test cl, 0x40
mov ecx, dword [0x11d20664]
mov byte [edi + 0xf9], bl
mov dword [edi + 0xf4], eax
je 0x1011cd91
test ecx, ecx
jne 0x1011cd91
cmp esi, dword [0x11d0d278]
mov ecx, esi
mov dword [0x11d20664], ecx
sbb eax, eax
mov dword [0x11d0d280], 0
neg eax
mov dword [0x11d0d284], eax
mov eax, dword [edi + 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
test al, 0x40
je 0x1011d385
test al, 8
je 0x1011d385
test ecx, ecx
je 0x1011d385
lea eax, [ebp - 0x138]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 0x144], eax
call eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
mov dword [edi + 0x1330], eax
mov eax, dword [edi + 0xa8]
mov dword [edi + 0x1334], ecx
cmp eax, 0x57236402
ja 0x1011ce2f
je 0x1011ce0e
cmp eax, 0x32469276
jne 0x1011ce3d
or byte [edi + 0xf9], 0x20
mov dl, byte [edi + 0xf9]
and dl, 0xbf
jmp 0x1011ce87
mov eax, dword [ebp + 0xc]
shr eax, 1
shl al, 5
xor al, byte [edi + 0xf9]
and al, 0x20
xor byte [edi + 0xf9], al
mov dl, byte [edi + 0xf9]
and dl, 0xbf
jmp 0x1011ce87
cmp eax, 0x89624578
je 0x1011ce77
cmp eax, 0x96184013
je 0x1011ce4f
and byte [edi + 0xf9], 0xdf
mov dl, byte [edi + 0xf9]
and dl, 0xbf
jmp 0x1011ce87
mov ecx, dword [ebp + 0xc]
mov dl, byte [edi + 0xf9]
shr ecx, 1
and dl, 0xdf
and cl, 1
mov al, cl
shl cl, 6
shl al, 5
or dl, al
mov byte [edi + 0xf9], dl
and dl, 0xbf
or dl, cl
jmp 0x1011ce87
or byte [edi + 0xf9], 0x20
mov dl, byte [edi + 0xf9]
or dl, 0x40
mov byte [edi + 0xf9], dl
xor edx, edx
mov eax, dword [edi + 0x8c]
div dword [edi + 0x12a0]
mov ecx, dword [edi + 0x90]
add ecx, 0x200
cmp eax, ecx
push 0x880
cmovbe eax, ecx
add eax, 0x7f
and eax, 0xffffff80
mov dword [edi + 0xe4], eax
lea eax, [edi + 0x1480]
push 0
push eax
call fcn.10425c00
mov dword [edi + 0x1480], 0
lea ecx, [edi + 0x1388]
mov dword [edi + 0x1500], 0
add esp, 0xc
mov dword [edi + 0x1580], 0
xor eax, eax
mov byte [edi + 0x198c], 0
mov dword [edi + 0x1990], 0xb5
mov dword [edi + 0x1980], 0
mov dword [edi + 0x1984], 0
mov dword [edi + 0x1988], 6
mov dword [edi + 0x1410], 0
mov byte [edi + 0x160c], 0
mov dword [edi + 0x1610], 2
mov dword [edi + 0x1600], 0
mov dword [edi + 0x1604], 0
mov dword [edi + 0x1608], 2
mov dword [edi + 0x136c], 0
nop word [eax + eax]
mov dword [edi + eax + 0x1680], 0
lea ecx, [ecx + 4]
sub eax, 0xffffff80
mov dword [ecx - 0x1c], 0
mov dword [ecx - 4], 0
cmp eax, 0x300
jb 0x1011cf70
xor eax, eax
lea ecx, [edi + 0x141c]
nop
mov dword [edi + eax + 0x1a00], 0
lea ecx, [ecx + 4]
sub eax, 0xffffff80
mov dword [ecx - 0xc], 0
mov dword [ecx - 4], 0
cmp eax, 0x100
jb 0x1011cfa0
push 0x200
lea eax, [edi + 0x1b00]
push 0
push eax
call fcn.10425c00
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
add esp, 0xc
mov dword [edi + 0x134c], 0
mov dword [edi + 0x1350], 0
mov dword [edi + 0x1354], 0
push 0x1f0003
push 0
push 0
push 0x7fffffff
push 0
mov dword [edi + 0x13a8], 0
mov dword [edi + 0x13ac], 0
push 0
mov dword [edi + 0x12b0], 0xad
mov byte [edi + 0x12b4], 0
mov dword [edi + 0x12b8], 0xad
mov dword [edi + 0x1194], 0
mov dword [edi + 0x1404], 0
mov dword [edi + 0x118c], 0
mov dword [edi + 0x1190], 0
mov dword [edi + 0x1358], 0
mov dword [edi + 0x135c], 0
mov dword [edi + 0x1360], 0
mov dword [edi + 0x1364], 0
mov dword [edi + 0x1368], 0
mov dword [edi + 0x13b0], 0xffffffff
mov dword [edi + 0x13b4], 0xffffffff
mov byte [edi + 0x13b8], 1
call esi
push 0x1f0003
push 0
push 0
push 0x7fffffff
push 0
push 0
mov dword [edi + 0x430], eax
call esi
cmp dword [edi + 0x430], 0xffffffff
mov dword [edi + 0x434], eax
je 0x1011d37e
cmp eax, 0xffffffff
je 0x1011d37e
push dword [edi + 0x80]
mov ebx, dword [edi + 0xa0]
lea eax, [ebp - 0x24]
push 0x1046c350
push 0x20
push eax
mov dword [edi + 0x42c], edi
call fcn.100da4c0
mov eax, dword [edi + 0x400]
add esp, 0x10
cmp dword [eax], 0
jne 0x1011d1a9
mov eax, dword [edi + 0x400]
mov esi, 0x10000
cmp ebx, esi
cmova esi, ebx
mov dword [eax], 1
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x40c]
push 0x20
push eax
call fcn.1043c4a1
mov eax, dword [edi + 0x400]
add esp, 0xc
add eax, 8
lock inc dword [eax]
lea eax, [edi + 0x408]
test esi, esi
push eax
mov eax, dword [edi + 0x400]
push 0x10004
push eax
mov eax, 0x2800
push 0x1012bc10
cmovne eax, esi
push eax
push 0
call fcn.1043ce9b
add esp, 0x18
mov dword [edi + 0x404], eax
cmp eax, 0xffffffff
jne 0x1011d1b3
mov eax, dword [edi + 0x400]
add eax, 8
lock dec dword [eax]
mov eax, dword [edi + 0x400]
mov dword [eax], 0
mov eax, 0x80004005
jmp 0x1011d387
xor ecx, ecx
lea eax, [ebp - 0x134]
lock or dword [eax], ecx
push dword [edi + 0x404]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or byte [edi + 0x12ac], 8
lea ecx, [edi + 0xb8]
push 0x100
call fcn.100481f0
lea eax, [ebp - 0x140]
push eax
call dword [ebp - 0x144]
mov esi, dword [ebp - 0x140]
mov ecx, esi
sub ecx, dword [edi + 0x1330]
mov edx, dword [ebp - 0x13c]
mov eax, edx
sbb eax, dword [edi + 0x1334]
add dword [edi + 0x1338], ecx
mov ecx, dword [0x11d20668]
adc dword [edi + 0x133c], eax
mov dword [edi + 0x1334], edx
mov edx, dword [0x11d2066c]
mov dword [edi + 0x1330], esi
call fcn.104511a0
mov edx, dword [edi + 0x133c]
mov ecx, dword [edi + 0x1338]
movsd qword [ebp - 0x140], xmm0
call fcn.104511a0
movaps xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x11d0d380]
movlpd qword [ebp - 0x138], xmm0
movsd xmm0, qword [0x1122d530]
mulsd xmm1, qword [ebp - 0x140]
comisd xmm1, xmm0
jb 0x1011d299
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x1011d299
mov esi, dword [ebp - 0x138]
mov ebx, dword [ebp - 0x134]
add esi, 0
adc ebx, 0x80000000
jmp 0x1011d2a5
mov ebx, dword [ebp - 0x134]
mov esi, dword [ebp - 0x138]
movaps xmm0, xmm1
call fcn.104510f0
add eax, esi
mov dword [edi + 0xec0], eax
lea eax, [ebp - 0x150]
adc edx, ebx
push eax
mov dword [edi + 0xec4], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
mov dword [edi + 0xeb0], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
mov dword [edi + 0xeb4], ecx
push eax
mov dword [ebp - 0x12c], 0x100
call dword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
mov ebx, 0x100
cmp dword [ebp - 0x12c], ebx
cmovb ebx, dword [ebp - 0x12c]
xor edx, edx
shr ebx, 3
test ebx, ebx
je 0x1011d34c
lea esi, [edi + 0xed0]
nop dword [eax + eax]
mov eax, dword [ebp + edx*8 - 0x128]
lea esi, [esi + 0x10]
mov ecx, dword [ebp + edx*8 - 0x124]
inc edx
mov dword [esi - 0x10], eax
mov dword [esi - 0xc], ecx
cmp edx, ebx
jb 0x1011d330
push dword [ebp - 0x148]
mov ecx, edi
call fcn.1012ae30
mov eax, dword [edi + 0x100]
mov ecx, edi
mov eax, dword [eax]
mov eax, dword [eax + 0x7a68]
mov eax, dword [eax + 0x2dd0]
mov dword [edi + 0x1328], eax
call fcn.1011d740
xor eax, eax
jmp 0x1011d387
mov eax, 0x80070057
jmp 0x1011d387
mov eax, esi
and byte [edi + 0x12ac], 0xfb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0x10