Function at 0x1004d350
Capabilities:
Resume thread

Disassembly:
sub esp, 0x2dc
mov eax, dword [0x100c2d54]
xor eax, esp
mov dword [esp + 0x2d8], eax
mov eax, dword [esp + 0x2e0]
push ebp
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0xc], eax
je 0x1004d380
mov ecx, dword [0x101daa84]
mov dword [eax], ecx
test cl, cl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101daa7c], eax
je 0x1004d3ab
mov eax, 0x10dd
pop ebp
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.1005df84
add esp, 0x2dc
ret 4
cmp dword [0x101daa80], ebp
je 0x1004d3c4
test ch, ch
call fcn.1004d240
test eax, 0x3aba
jmp 0x1004d6da
push ebx
push esi
push edi
test bh, bh
mov ecx, ecx
test ebx, ebx
mov esi, dword [0x101daa8c]
cmp esi, ebp
je 0x1004d4b6
mov ebx, 0xd
cmp dword [esi + 4], ebp
je 0x1004d45f
mov eax, dword [esi + 0x10]
test bh, bh
mov edx, dword [esi + 0x10]
mov edi, dword [edx + 0x20]
mov esi, esi
mov ecx, dword [esi + 0x10]
movzx edx, byte [ecx + 0x17]
cmp edi, edx
jge 0x1004d433
mov dword [esp + 0x10], ebp
test edi, edi
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x10]
push ecx
push ebp
push eax
add edx, edi
push edx
call fcn.1004de50
mov dl, dl
cmp dword [esp + 0x10], ebp
jne 0x1004d433
mov edi, eax
sub edi, dword [esi + 0x10]
test dh, dh
mov ecx, dword [esi + 0x10]
movzx edx, byte [ecx + 0x17]
cmp edi, edx
jl 0x1004d401
mov eax, dword [esi + 0x10]
movzx ecx, byte [eax + 0x17]
cmp edi, ecx
je 0x1004d453
mov dword [0x101daa80], ebx
test esi, esi
mov edx, dword [esi + 8]
mov dword [0x101daa84], edx
test ch, ch
mov al, al
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
xchg ebx, eax
xchg ebx, eax
jmp 0x1004d4ac
test eax, eax
push edx
pop edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
add eax, dword [esi + 0xc]
lea edx, [eax + 5]
test edx, edx
mov byte [eax], 0xe9
add eax, 1
sub ecx, edx
mov dword [eax], ecx
mov bl, bl
test dh, dh
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x18]
add eax, 4
cmp eax, ecx
jae 0x1004d49c
nop
mov byte [eax], 0xcc
add eax, 1
mov ecx, ecx
cmp eax, ecx
jb 0x1004d490
mov esi, esi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
test edi, edi
test edi, edi
push ebx
pop ebx
mov esi, dword [esi]
cmp esi, ebp
jne 0x1004d3e0
mov edi, dword [0x101daa88]
cmp edi, ebp
je 0x1004d596
mov ebp, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dh, dh
mov dword [esp + 0x1c], 0x10001
test esi, esi
mov eax, dword [edi + 4]
lea edx, [esp + 0x1c]
push edx
push eax
call ebp
test eax, eax
je 0x1004d58a
mov esi, dword [0x101daa8c]
test esi, esi
je 0x1004d58a
mov eax, dword [esp + 0xd4]
cmp dword [esi + 4], 0
je 0x1004d542
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jb 0x1004d580
lea edx, [ecx + 4]
cmp eax, edx
jae 0x1004d580
sub eax, ecx
mov dword [esp + 0xd4], eax
test edx, edx
mov eax, dword [esi + 0xc]
add dword [esp + 0xd4], eax
mov ebp, ebp
mov edx, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
push edx
call ebx
mov ah, ah
jmp 0x1004d579
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jb 0x1004d580
mov edx, dword [esi + 0x10]
movzx edx, byte [edx + 0x17]
add edx, ecx
cmp eax, edx
jae 0x1004d580
sub eax, ecx
mov dword [esp + 0xd4], eax
mov bl, bl
mov eax, dword [esi + 0x10]
add dword [esp + 0xd4], eax
test ah, ah
mov edx, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
push edx
call ebx
nop
mov eax, dword [esp + 0xd4]
mov esi, dword [esi]
test esi, esi
jne 0x1004d504
mov edi, dword [edi]
test edi, edi
jne 0x1004d4d0
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
test bh, bh
mov esi, dword [0x101daa8c]
cmp esi, ebp
je 0x1004d64f
mov ebp, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dl, dl
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.1002e9f0
test edx, edx
mov edx, dword [esi + 0x10]
movzx eax, byte [edx + 0x17]
mov ecx, dword [esi + 0xc]
push eax
push ecx
push ebx
call ebp
test eax, 0x2ed0
xor ecx, ecx
cmp dword [esi + 4], ecx
je 0x1004d632
mov eax, dword [esi + 0x10]
cmp eax, ecx
je 0x1004d632
mov edx, eax
and edx, 0xffff0000
test ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov ecx, ecx
mov edi, dword [edx + 8]
mov dword [eax + 0x18], edi
test eax, 0x79b5
mov dword [edx + 8], eax
mov dh, dh
mov ebp, ebp
mov dword [esi + 0x10], ecx
xchg ebx, eax
xchg ebx, eax
nop
mov edi, dword [esi]
mov ah, ah
push esi
call fcn.100504eb
add esp, 4
push ecx
pop ecx
mov esi, edi
test ecx, ecx
test edi, edi
jne 0x1004d5b4
xor ebp, ebp
mov dword [0x101daa8c], ebp
test bl, bl
mov esi, dword [0x101daa70]
cmp esi, ebp
je 0x1004d67e
test edx, edx
lea edx, [esp + 0x14]
push edx
push 0x20
push 0x10000
push esi
call fcn.1002e9f0
mov ecx, ecx
mov esi, dword [esi + 4]
cmp esi, ebp
jne 0x1004d661
test ah, ah
mov esi, dword [0x101daa88]
cmp esi, ebp
je 0x1004d6af
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 4]
push eax
call ebx
test ah, ah
mov edi, dword [esi]
push ebx
pop ebx
push esi
call fcn.100504eb
add esp, 4
test al, al
mov esi, edi
push ecx
pop ecx
cmp edi, ebp
jne 0x1004d690
mov dword [0x101daa88], ebp
test eax, 0x5132
mov dword [0x101daa7c], ebp
push ebx
pop ebx
mov eax, dword [esp + 0x18]
cmp eax, ebp
pop edi
pop esi
pop ebx
je 0x1004d6da
mov ecx, dword [0x101daa84]
mov dword [eax], ecx
test eax, 0x6d7c
mov ecx, dword [esp + 0x2dc]
mov eax, dword [0x101daa80]
pop ebp
xor ecx, esp
call fcn.1005df84
add esp, 0x2dc
ret 4