Function at 0x10011320
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x1001b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
push edi
mov edi, dword [0x1001c1e8]
push edi
mov dword [ebp - 0x35c], eax
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
mov edi, dword [0x1001c1e4]
push edi
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
mov edi, dword [0x1001c200]
push edi
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
mov edi, dword [0x1001c1fc]
push edi
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
mov edi, dword [0x1001c1f4]
push edi
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
mov edi, dword [0x1001c1ec]
push edi
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
push 0x100
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa], ax
mov dword [ebp - 8], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
push edx
push eax
push 0x23
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], 6
push eax
mov dword [ebp - 0x118], 3
mov word [ebp - 0xc], cx
call edi
test eax, eax
je 0x10011590
push 0x100
lea eax, [ebp - 0x228]
mov dword [ebp - 0x23c], 0x11c
push 0
push eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x126], ax
mov dword [ebp - 0x124], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x238], 6
mov ecx, 1
mov dword [ebp - 0x234], 1
push eax
mov word [ebp - 0x128], cx
call edi
test eax, eax
je 0x10011590
push 0x100
lea eax, [ebp - 0x344]
mov dword [ebp - 0x358], 0x11c
push 0
push eax
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x348], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x242], ax
mov dword [ebp - 0x240], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [ebp - 0x358]
mov dword [ebp - 0x354], 6
xor ecx, ecx
mov dword [ebp - 0x350], 1
push eax
mov word [ebp - 0x244], cx
call edi
test eax, eax
jne 0x100115a7
mov edi, dword [0x1001c1f0]
push edi
call ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, 1
jae 0x100115c6
mov eax, dword [ebp - 0x35c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], 0x15846954
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10012545
mov esp, ebp
pop ebp
ret
call fcn.1000b5b0
int3