Function at 0x10049d90
Capabilities:
Enumerate threads
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1008cf5b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x100a8810]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a8810]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
xor eax, eax
xor ebx, ebx
push 0x2c8
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x7c]
push ebx
push eax
mov ebp, ecx
or edi, 0xffffffff
mov dword [esp + 0x34], ebx
xor esi, esi
mov dword [esp + 0x80], ebx
call fcn.10054210
push 0x103
lea ecx, [esp + 0x351]
push ebx
push ecx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], ebx
mov byte [esp + 0x358], bl
call fcn.10054210
push 0x2c
lea edx, [esp + 0x64]
push ebx
push edx
mov dword [esp + 0x68], ebx
call fcn.10054210
lea ecx, [ebp + 0x10]
add esp, 0x24
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
call fcn.1002c570
mov dword [esp + 0x450], ebx
cmp dword [ebp + 0x7c], ebx
je 0x10049e64
mov dword [ebp + 0x7c], ebx
jmp 0x10049e77
lea ecx, [ebp + 0x6c]
call fcn.10035f10
cmp eax, 0x2bf20
jb 0x1004a084
lea ecx, [ebp + 0x6c]
call fcn.10035ed0
call fcn.10008650
test eax, eax
je 0x1004a084
push ebx
push 4
call fcn.1000b7c0
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x1004a084
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x30], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1004a07a
lea esp, [esp]
cmp esi, ebx
je 0x10049ecc
push esi
call fcn.1000b6a0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x34], eax
jne 0x1004a061
mov edx, dword [esp + 0x30]
push edx
push ebx
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, ebx
je 0x1004a061
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x80]
lea edi, [ebp + 0x28]
push str.NtGetContextThread
mov ecx, edi
mov dword [esp + 0x84], 0x10010
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], eax
call fcn.10009cc0
cmp dword [esp + 0x14], ebx
jl 0x1004a061
cmp dword [esp + 0x78], ebx
jne 0x10049f61
cmp dword [esp + 0x7c], ebx
jne 0x10049f61
cmp dword [esp + 0x80], ebx
jne 0x10049f61
cmp dword [esp + 0x84], ebx
jne 0x10049f61
cmp byte [esp + 0x8c], bl
je 0x1004a061
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x50], eax
push 5
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x2c]
push eax
mov dword [esp + 0x60], ecx
push str.NtQueryInformationThread
mov ecx, edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 9
mov dword [esp + 0x60], 4
call fcn.10009cc0
cmp dword [esp + 0x14], ebx
jl 0x1004a061
cmp dword [esp + 0x18], ebx
je 0x1004a061
push 0x104
lea ecx, [esp + 0x344]
push ebx
push ecx
call fcn.10054210
mov eax, dword [esp + 0x24]
push 0x104
lea edx, [esp + 0x350]
push edx
push eax
call fcn.10034690
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0x9c]
add esp, 0x18
push 0x104
lea ecx, [esp + 0x344]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.10049c70
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x7c]
push eax
mov dword [esp + 0x54], ecx
push str.NtSetContextThread
mov ecx, edi
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x54], esi
call fcn.10009cc0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10049ec0
xor edi, edi
mov eax, dword [esp + 0x1c]
push eax
call fcn.1000b6a0
mov dword [esp + 0x450], 0xffffffff
mov ecx, dword [esp + 0x20]
call fcn.1002c580
mov eax, edi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.10053b60
add esp, 0x440
ret