Function at 0x10005770
Capabilities:
Resume thread
Terminate thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10009400
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x5b8
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5b8], edx
mov dword [ebp - 0x5b4], ecx
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x5bc], eax
mov al, byte [ebx + 0x10]
mov byte [ebp - 0x5a9], al
mov eax, dword [ebx + 0x14]
push 0x1000a350
mov dword [ebp - 0x5b0], edi
mov dword [ebp - 0x5c4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10005802
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, 0x1010000b
jmp 0x10005ca5
push str.NtCreateThreadEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x5c0], eax
test eax, eax
jne 0x1000582a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, 0x10100001
jmp 0x10005ca5
xor esi, esi
cmp byte [ebp - 0x5a9], 0
je 0x10005aa9
xorps xmm0, xmm0
mov dword [ebp - 0x224], esi
movups xmmword [ebp - 0x23c], xmm0
push 0x1000a350
movq qword [ebp - 0x22c], xmm0
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x100058d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push edi
call esi
push str.NtQuerySystemInformation
push edi
mov dword [ebp - 0x228], eax
call esi
cmp dword [ebp - 0x228], 0
mov dword [ebp - 0x224], eax
je 0x100058d4
test eax, eax
je 0x100058d4
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x230], 0x10000
mov dword [ebp - 0x238], 0
call fcn.100054e0
mov esi, dword [ebp - 0x5b4]
mov dword [ebp - 4], 0
test esi, esi
je 0x10005955
cmp dword [ebp - 0x238], 0
jne 0x100058fd
lea ecx, [ebp - 0x23c]
call fcn.100054e0
test al, al
je 0x10005955
push esi
mov dword [ebp - 0x22c], esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, dword [ebp - 0x23c]
mov edi, eax
mov esi, dword [edx]
lea ecx, [esi + edx]
cmp ecx, edx
je 0x10005936
nop dword [eax + eax]
cmp dword [edx + 0x44], edi
je 0x10005949
add edx, esi
mov dword [ebp - 0x23c], edx
mov esi, dword [edx]
lea eax, [edx + esi]
cmp eax, edx
jne 0x10005920
cmp dword [edx + 0x44], edi
je 0x10005949
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
jmp 0x10005955
lea eax, [edx + 0xb8]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x238], 0
je 0x10005a87
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
push 0x18
lea eax, [ebp - 0x534]
xorps xmm0, xmm0
push eax
push 0
push dword [ebp - 0x22c]
movups xmmword [ebp - 0x534], xmm0
movq qword [ebp - 0x524], xmm0
call dword [ebp - 0x228]
test eax, eax
js 0x10005a87
mov eax, dword [ebp - 0x530]
test eax, eax
je 0x10005a87
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x544]
push 0
push 0x10
push ecx
push eax
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x10005a87
push 0
push 0x30
lea eax, [ebp - 0x5a8]
push eax
push dword [ebp - 0x538]
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x10005a87
mov eax, dword [ebp - 0x598]
mov esi, dword [ebp - 0x59c]
push 0x208
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x220]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
nop dword [eax]
push 0
push 0x34
lea eax, [ebp - 0x578]
push eax
push esi
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x10005a6f
movzx eax, word [ebp - 0x54c]
push 0
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x548]
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x10005a6f
movzx eax, word [ebp - 0x54c]
shr eax, 1
cmp word [ebp + eax*2 - 0x222], 0x65
je 0x10005a7f
cmp esi, dword [ebp - 0x240]
je 0x10005a87
mov esi, dword [ebp - 0x578]
jmp 0x10005a20
mov esi, dword [ebp - 0x55c]
jmp 0x10005a89
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x10005aa3
push eax
call fcn.1000829d
add esp, 4
mov edi, dword [ebp - 0x5b0]
mov cl, byte [ebp - 0x5a9]
xor eax, eax
push 0
push 0
push 0
push 0
test cl, cl
mov dword [ebp - 0x51c], 0
mov edx, 7
cmovne eax, edx
push eax
push dword [ebp - 0x5bc]
mov eax, dword [ebp - 0x5b8]
cmovne eax, esi
push eax
push dword [ebp - 0x5b4]
lea eax, [ebp - 0x51c]
push 0
push 0x1fffff
push eax
call dword [ebp - 0x5c0]
test eax, eax
js 0x10005c9e
mov esi, dword [ebp - 0x51c]
test esi, esi
je 0x10005c9e
cmp byte [ebp - 0x5a9], 0
je 0x10005c0b
push 0x2c8
lea eax, [ebp - 0x514]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x518], 0x10002
lea eax, [ebp - 0x518]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x10005b79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0x51c]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10100005
jmp 0x10005ca5
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x518]
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x10005bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0x51c]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10100006
jmp 0x10005ca5
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10005c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0x51c]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10100007
jmp 0x10005ca5
mov esi, dword [ebp - 0x51c]
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10005c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0x51c]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10100009
jmp 0x10005ca5
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x10005c80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x51c]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1010000a
jmp 0x10005ca5
mov ecx, dword [ebp - 0x5c4]
mov eax, dword [ebp - 0x244]
push dword [ebp - 0x51c]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10005ca5
mov dword [edi], eax
mov eax, 0x10100004
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10008286
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret