Function at 0x100b2b50
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov eax, dword [ebp + 0x48]
mov dword [ebx + 0x418], eax
mov cx, word [ebp + 0x4c]
mov word [ebx + 0x42c], cx
mov eax, dword [ebp]
dec eax
je 0x100b2c5c
dec eax
jne 0x100b2cca
mov edi, dword [ebp + 0x18]
lea edx, [ebx + 0xcc]
test edi, edi
jne 0x100b2b93
mov edi, str.anonymous
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x1cc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x100b2bc2
mov edi, str.anonymous_123.com
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx + 0xcc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x2d0]
push ecx
push 0x100
push edx
mov edx, dword [ebp + 0x14]
push 0x100
push eax
push edx
call fcn.100b96f0
mov eax, dword [ebp + 0x60]
add esp, 0x18
cmp eax, 3
jne 0x100b2c54
mov eax, dword [ebx + 0x54c]
and eax, 0xff00
cmp eax, 0x1000
jne 0x100b2c39
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.100b96b0
add esp, 8
mov dword [ebx + 0x3e0], eax
jmp 0x100b2cca
cmp eax, 0x2000
jne 0x100b2cca
mov edx, dword [ebp + 0x5c]
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.100b96b0
add esp, 8
mov dword [ebx + 0x3e0], eax
jmp 0x100b2cca
mov esi, dword [ebp + 0x64]
test esi, esi
jne 0x100b2c67
xor eax, eax
jmp 0x100b2c70
push esi
call fcn.100de3fc
add esp, 4
test esi, esi
mov dword [ebx + 0xa8], eax
jne 0x100b2c7f
mov eax, dword [ebp + 0x54]
jmp 0x100b2c8b
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.100de3fc
add esp, 4
mov dword [ebx + 0xac], eax
mov edx, dword [ebp + 0x50]
mov dword [ebx + 0xb0], edx
mov eax, dword [ebp + 0x74]
test eax, eax
jne 0x100b2cb2
mov eax, dword [ebp + 0x14]
push 0x400
push eax
call fcn.100bc0b0
add esp, 8
mov dword [ebx + 0xb4], eax
mov ecx, dword [ebp + 0x78]
mov dword [ebx + 0xc0], ecx
mov edx, dword [ebp + 0x70]
mov dword [ebx + 0xb8], edx
mov eax, dword [ebx + 0x54c]
and eax, 0xff00
cmp eax, 0x3000
jne 0x100b2ce6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov esi, dword [esp + 0x1c]
mov edi, 1
test esi, esi
je 0x100b2d57
mov eax, dword [ebx + 8]
sub eax, 3
je 0x100b2d1d
dec eax
jne 0x100b2d3a
mov eax, dword [ebx + 0x3f4]
test eax, eax
je 0x100b2d3a
push eax
call fcn.100da8ae
add esp, 4
mov dword [ebx + 0x3f4], 0
jmp 0x100b2d3a
mov eax, dword [ebx + 0x3e4]
test eax, eax
je 0x100b2d3a
push eax
call fcn.100da8ae
add esp, 4
mov dword [ebx + 0x3e4], 0
push esi
push ebx
call fcn.100b3270
add esp, 8
test eax, eax
je 0x100b2db0
push ebx
mov dword [ebx + 0x64], edi
call fcn.100b6a80
add esp, 4
mov dword [ebx + 0x18], eax
push ebx
call fcn.100b6180
push 8
call fcn.100da997
mov esi, eax
add esp, 8
test esi, esi
je 0x100b2db0
cmp dword [ebx + 0x64], edi
je 0x100b2d79
mov ecx, dword [ebp + 0x20]
mov dword [esi], ecx
jmp 0x100b2d8a
lea edx, [ebx + 0x94]
push edx
call fcn.100b6980
add esp, 4
mov dword [esi], eax
lea eax, [esp + 0x18]
mov dword [esi + 4], ebx
push eax
push 0
push esi
push 0x100b37c0
push 0
push 0
call fcn.100dc238
add esp, 0x18
test eax, eax
jne 0x100b2de1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.100bac10
lea edx, [ebx + 0xa4]
mov dword [ebx + 0xc], 0
push edx
call fcn.100ba770
push ebx
push 0x10188e88
call fcn.10090590
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [ebx + 0x560], eax
mov eax, dword [0x10188e80]
test eax, eax
jne 0x100b2dfd
mov eax, edi
pop edi
pop esi
mov dword [0x10188e80], ebx
pop ebp
pop ebx
ret
mov eax, dword [0x10188e84]
push eax
call fcn.100bac30
mov ecx, dword [0x10188e80]
mov dword [ecx + 0x440], ebx
mov edx, dword [0x10188e84]
push edx
mov dword [0x10188e80], ebx
call fcn.100bac40
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret