Function at 0x1000c210
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100ef8a9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, 1
push ebx
push esi
call fcn.100081d0
cmp esi, 0x64
ja 0x1000660f
je 0x100065a7
cmp esi, 8
ja case.0x1000647a.2
jmp dword [esi*4 + 0x100066cc]
mov eax, dword [0x10123f64]
test eax, eax
je case.0x1000647a.2
mov esi, 0x10123f28
call fcn.100b6e10
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [0x10124134]
test ecx, ecx
je 0x100064cb
mov edi, 0x10123fec
mov esi, 0x101240f8
call fcn.100b8340
call fcn.100b6e10
xor eax, eax
lea ecx, [eax + 4]
mov esi, 0x10123fec
call fcn.100b7a10
mov dword [0x101245ac], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, 2
xor eax, eax
mov esi, 0x10123fec
call fcn.100b7a10
mov dword [0x1012452c], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, ebx
jmp 0x100064fa
mov dword [0x101247ac], ebx
mov dword [0x1012462c], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push ebx
push 0
call sub.MHFilterDll.dll_Ordinal_5
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov edx, dword [0x10124308]
mov eax, dword [edx + 0x10]
push ebx
mov ecx, 0x10124308
mov dword [0x101247ac], ebx
call eax
mov ecx, dword [0x10124344]
test ecx, ecx
je case.0x1000647a.2
mov esi, 0x10124308
call fcn.100b6e10
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x100f5f74
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x10]
push edx
mov edi, 0x10124518
call fcn.100ca6e0
mov eax, dword [esp + 0x10]
push eax
mov edi, 0x10124598
call fcn.100ca6e0
mov ecx, dword [esp + 0x10]
push ecx
mov edi, 0x10124618
call fcn.100ca6e0
call sub.MHFilterDll.dll__UpdateFileLastOpenMask_0
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
cmp esi, 0xffffffff
jne case.0x1000647a.2
xor edi, edi
cmp dword [0x10124828], edi
jne 0x10006644
push edi
push edi
push 0x1012481c
push 0x1000cbd0
push edi
push edi
mov dword [0x10124824], edi
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x10124828], eax
call fcn.10005f90
mov edx, dword [0x10124028]
test edx, edx
je 0x10006681
mov esi, 0x10123fec
call fcn.100b6e10
mov eax, dword [0x101240f4]
mov dword [0x101240f4], eax
and dword [0x101240f4], 0xfffffff8
mov eax, dword [0x101240f4]
push eax
push 2
call sub.MHFilterDll.dll_Ordinal_5
mov ecx, dword [0x101240f4]
mov eax, dword [0x1012429c]
cmp eax, edi
je 0x10006691
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edi
push 0x10124264
push 0x100b6e60
push edi
push edi
mov dword [0x101242a0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1012429c], eax
mov dword [0x101246ac], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 4]
jmp 0x10006430