Function at 0x1000bad0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100f1539
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1011f07c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, 1
push ebx
push esi
call fcn.100081f0
cmp esi, 0x64
ja 0x1000666f
je 0x10006607
cmp esi, 8
ja case.0x100064da.2
jmp dword [esi*4 + 0x1000672c]
mov eax, dword [0x10122f64]
test eax, eax
je case.0x100064da.2
mov esi, 0x10122f28
call fcn.100b6770
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [0x10123134]
test ecx, ecx
je 0x1000652b
mov edi, 0x10122fec
mov esi, 0x101230f8
call fcn.100b7cb0
call fcn.100b6770
xor eax, eax
lea ecx, [eax + 4]
mov esi, 0x10122fec
call fcn.100b7380
mov dword [0x101235ac], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, 2
xor eax, eax
mov esi, 0x10122fec
call fcn.100b7380
mov dword [0x1012352c], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, ebx
jmp 0x1000655a
mov dword [0x1012378c], ebx
mov dword [0x1012362c], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push ebx
push 0
call sub.MHFilterDll.dll_Ordinal_5
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov edx, dword [0x10123308]
mov eax, dword [edx + 0x10]
push ebx
mov ecx, 0x10123308
mov dword [0x1012378c], ebx
call eax
mov ecx, dword [0x10123344]
test ecx, ecx
je case.0x100064da.2
mov esi, 0x10123308
call fcn.100b6770
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x100f4f74
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x10]
push edx
mov edi, 0x10123518
call fcn.100ca6d0
mov eax, dword [esp + 0x10]
push eax
mov edi, 0x10123598
call fcn.100ca6d0
mov ecx, dword [esp + 0x10]
push ecx
mov edi, 0x10123618
call fcn.100ca6d0
call sub.MHFilterDll.dll__UpdateFileLastOpenMask_0
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
cmp esi, 0xffffffff
jne case.0x100064da.2
xor edi, edi
cmp dword [0x10123808], edi
jne 0x100066a4
push edi
push edi
push 0x101237fc
push 0x1000c480
push edi
push edi
mov dword [0x10123804], edi
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x10123808], eax
call fcn.10005ff0
mov edx, dword [0x10123028]
test edx, edx
je 0x100066e1
mov esi, 0x10122fec
call fcn.100b6770
mov eax, dword [0x101230f4]
mov dword [0x101230f4], eax
and dword [0x101230f4], 0xfffffff8
mov eax, dword [0x101230f4]
push eax
push 2
call sub.MHFilterDll.dll_Ordinal_5
mov ecx, dword [0x101230f4]
mov eax, dword [0x1012329c]
cmp eax, edi
je 0x100066f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edi
push 0x10123264
push 0x100b67c0
push edi
push edi
mov dword [0x101232a0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1012329c], eax
mov dword [0x101236ac], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 4]
jmp 0x10006490