Function at 0x6c3972b6
Capabilities:
Check if file exists
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9b8
mov eax, dword [0x6c3a70b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x9b4], eax
mov esi, eax
add eax, 0x24
mov ecx, dword [eax]
xor ebx, ebx
mov dword [ebp - 0x9b0], ebx
mov dword [ebp - 0x9ac], ecx
cmp ecx, ebx
je 0x6c397334
mov ecx, dword [0x6c3a7048]
and cl, 0xf
mov esi, 0xc0000bbd
cmp cl, 2
jb 0x6c39732d
push ebx
push 4
lea ecx, [ebp - 0x9ac]
push ecx
push 4
push eax
push 4
lea eax, [ebp - 0x9b4]
push eax
push esi
push 0x444
push 0x2e
push 0xb2d
call fcn.6c3774d9
add esp, 0x2c
mov eax, esi
jmp 0x6c3977aa
push edi
mov edi, 0xeb0
push edi
push 0xb31
push 0x6c372c94
call fcn.6c375051
mov dword [ebp - 0x9ac], eax
cmp eax, ebx
jne 0x6c397363
mov dword [ebp - 0x9b0], 0xc0000bbb
jmp 0x6c397775
mov ecx, dword [ebp - 0x9b4]
push edi
mov dword [ecx + 0x24], eax
push ebx
push dword [ebp - 0x9ac]
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x9a8], ebx
cmp dword [ebp - 0x9a8], 0x20
jae 0x6c39772c
mov eax, dword [esi + 0x18]
mov edx, dword [ebp - 0x9a8]
mov ecx, dword [ebp - 0x9ac]
mov dword [ecx + edx*4 + 0xe00], eax
inc dword [ebp - 0x9a8]
mov esi, dword [esi + 0xc]
cmp esi, ebx
jne 0x6c397382
mov eax, dword [ebp - 0x9ac]
mov ecx, dword [ebp - 0x9a8]
mov dword [eax + 0xe98], ecx
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x9a8], ebx
cmp dword [eax + 0xe98], ebx
jbe 0x6c397447
mov ecx, dword [ebp - 0x9a8]
imul ecx, ecx, 0x68
lea eax, [eax + ecx + 0x10]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x9a8]
mov ecx, dword [ebp - 0x9ac]
imul eax, eax, 0x68
lea eax, [ecx + eax + 0x18]
mov dword [eax + 4], eax
mov dword [eax], eax
mov ecx, dword [ebp - 0x9a8]
mov eax, dword [ebp - 0x9ac]
imul ecx, ecx, 0x68
mov dword [ecx + eax + 0x5c], eax
mov eax, dword [ebp - 0x9a8]
mov ecx, dword [ebp - 0x9ac]
imul eax, eax, 0x68
lea eax, [eax + ecx + 0x60]
mov dword [eax + 4], eax
mov dword [eax], eax
inc dword [ebp - 0x9a8]
mov eax, dword [ebp - 0x9ac]
mov ecx, dword [ebp - 0x9a8]
cmp ecx, dword [eax + 0xe98]
jb 0x6c3973d8
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 0xe9c], 1
call esi
mov ecx, dword [ebp - 0x9ac]
push ebx
push ebx
push ebx
push ebx
mov dword [ecx + 0xe88], eax
call esi
mov ecx, dword [ebp - 0x9ac]
mov dword [ecx + 0xe84], eax
mov esi, dword [ebp - 0x9ac]
cmp dword [esi + 0xe88], ebx
je 0x6c397763
cmp dword [esi + 0xe84], ebx
je 0x6c397763
xor edi, edi
mov dword [ebp - 0x9a8], edi
cmp dword [esi + 0xe98], ebx
jbe 0x6c397589
push 0x1a0
lea eax, [ebp - 0x9a4]
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x804]
mov dword [ebp - 0x9a4], eax
mov eax, edi
imul eax, eax, 0x68
add eax, esi
mov dword [ebp - 0x80c], eax
push 0x400
mov dword [ebp - 0x824], 0x6c392bcb
mov dword [ebp - 0x814], 0x6c396e8e
mov dword [ebp - 0x990], 0x10000000
push dword [esi + edi*4 + 0xe00]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.msvcrt.dll__wfullpath]
add esp, 0x18
lea eax, [ebp - 0x9a4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenTraceW]
mov ecx, dword [ebp - 0x9ac]
mov esi, dword [ebp - 0x9a8]
mov dword [ecx + esi*8 + 0xd00], eax
mov eax, dword [ebp - 0x9ac]
mov ecx, dword [ebp - 0x9a8]
mov dword [eax + ecx*8 + 0xd04], edx
mov esi, dword [ebp - 0x9ac]
mov edi, dword [ebp - 0x9a8]
mov eax, dword [esi + edi*8 + 0xd00]
mov ecx, dword [esi + edi*8 + 0xd04]
mov edx, eax
or edx, ecx
je 0x6c3976a3
cmp eax, 0xffffffff
jne 0x6c397576
cmp ecx, ebx
je 0x6c3976a3
inc edi
mov dword [ebp - 0x9a8], edi
cmp edi, dword [esi + 0xe98]
jb 0x6c3974ad
lea eax, [ebp - 0x9b8]
push eax
push ebx
push esi
push 0x6c397086
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x9ac]
mov dword [ecx + 0xe80], eax
mov eax, dword [ebp - 0x9ac]
cmp dword [eax + 0xe80], ebx
jne 0x6c397738
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x6c3a7048]
and cl, 0xf
mov dword [ebp - 0x9b0], eax
cmp cl, 2
jb 0x6c3975e9
push ebx
push eax
push ebx
push 0x2e
push 0xb79
call fcn.6c3774d9
add esp, 0x14
mov eax, dword [ebp - 0x9ac]
xor ecx, ecx
mov dword [ebp - 0x9a8], ecx
cmp dword [eax + 0xe98], ebx
jbe 0x6c39776d
push dword [eax + ecx*8 + 0xd04]
push dword [eax + ecx*8 + 0xd00]
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov dword [ebp - 0x9b0], eax
cmp eax, ebx
je 0x6c39767f
mov eax, dword [0x6c3a7048]
and al, 0xf
cmp al, 2
jb 0x6c39767f
mov eax, dword [ebp - 0x9ac]
mov ecx, dword [ebp - 0x9a8]
push ebx
push dword [eax + ecx*4 + 0xe00]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x9a8]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x9ac]
push dword [eax + ecx*4 + 0xe00]
lea eax, [eax + ecx*8 + 0xd00]
push 8
push eax
push dword [ebp - 0x9b0]
push 0x13
push 0x2e
push 0xb84
call fcn.6c3774d9
add esp, 0x24
mov ecx, dword [ebp - 0x9a8]
mov eax, dword [ebp - 0x9ac]
inc ecx
mov dword [ebp - 0x9a8], ecx
cmp ecx, dword [eax + 0xe98]
jae 0x6c39776d
jmp 0x6c397603
mov eax, dword [0x6c3a7048]
and al, 0xf
cmp al, 2
jb 0x6c3976fb
push ebx
push 4
lea eax, [ebp - 0x9a8]
push eax
push dword [esi + edi*4 + 0xe00]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x9a8]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x9ac]
push dword [eax + ecx*4 + 0xe00]
push ebx
push 1
push 0x2e
push 0xb66
call fcn.6c3774d9
mov esi, dword [ebp - 0x9ac]
mov edi, dword [ebp - 0x9a8]
add esp, 0x24
cmp edi, ebx
ja 0x6c397707
jmp 0x6c39772c
mov esi, dword [ebp - 0x9ac]
dec edi
mov dword [ebp - 0x9a8], edi
push dword [esi + edi*8 + 0xd04]
push dword [esi + edi*8 + 0xd00]
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov edi, dword [ebp - 0x9a8]
cmp edi, ebx
ja 0x6c397701
mov dword [ebp - 0x9b0], 0xc0000bca
jmp 0x6c397775
push 0xffffffffffffffff
push dword [eax + 0xe84]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x9ac]
cmp byte [eax + 0xeaf], 1
jne 0x6c3977a3
mov eax, dword [eax + 0xea8]
mov dword [ebp - 0x9b0], eax
jmp 0x6c39776d
mov dword [ebp - 0x9b0], 0xc0000bbc
cmp dword [ebp - 0x9b0], ebx
je 0x6c3977a3
mov eax, dword [ebp - 0x9b4]
cmp dword [eax + 0x24], ebx
je 0x6c3977a3
mov esi, dword [eax + 0x58]
mov ecx, esi
or ecx, 0x10000
push ebx
mov dword [eax + 0x58], ecx
push dword [ebp - 0x9b4]
call fcn.6c39554f
mov eax, dword [ebp - 0x9b4]
mov dword [eax + 0x58], esi
mov eax, dword [ebp - 0x9b0]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.6c371640
leave
ret 4