Function at 0x100ef880
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get thread local storage value
Query environment variable
Resolve function by parsing pe exports
Resume thread
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10125b46
mov eax, dword fs:[0]
push eax
sub esp, 0x610
mov eax, dword [0x1016e750]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, esp
push eax
lea eax, [esp + 0x620]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x24], 0
cmp byte [0x10172223], 0
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], edi
movdqu xmmword [esp + 0x8c], xmm0
je 0x100efb43
mov edx, str._In_MsiTracker_mode_
mov ecx, 0x101578c8
call fcn.10043b30
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100ef950
mov ecx, eax
call fcn.100c2780
test eax, eax
jne 0x100ef96b
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100efb03
mov ecx, eax
call fcn.100c2780
test eax, eax
je 0x100efb03
mov edx, str.MsiTracker___MSIEXEC_launch_detected__
mov ecx, 0x101578c8
call fcn.10043b30
mov ecx, dword [esp + 0x4c]
mov eax, ebx
mov edx, dword [esp + 0x1c]
or eax, 4
push edi
push ecx
push dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
push esi
push eax
push dword [esp + 0x70]
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x4c]
call fcn.100ef6d0
push dword [edi]
mov esi, eax
lea eax, [esp + 0x14]
push esi
push str.MsiTracker__CreateProcessAsUserWNext_returned__d:_lpProcessInformation__hProcess0x_x
push eax
call fcn.10044f30
add esp, 0x10
mov dword [esp + 0x628], 0
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov dword [esp + 0x628], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [esp + 0x10]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100efa07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x100efadb
push ecx
mov eax, esp
push dword [0x1017507c]
push str.AppVirtDll__s.dll
push eax
call fcn.10044f30
add esp, 0xc
lea ecx, [esp + 0x24]
xor edx, edx
call fcn.1003d710
add esp, 4
mov dword [esp + 0x628], 1
xor eax, eax
cmp dword [0x101750c4], eax
mov edx, dword [edi]
mov ecx, dword [esp + 0x20]
setne al
push eax
push dword [edi + 8]
call fcn.10059b40
push eax
lea eax, [esp + 0x1c]
push str.MsiTracker__InjectLibrary_returned__d
push eax
call fcn.10044f30
add esp, 0x14
mov byte [esp + 0x628], 2
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 1
mov ecx, ebx
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100efaa5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x628], 0xffffffff
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x100efacb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x3c], 4
jne 0x100efadb
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [esp + 0x620]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.10103392
mov esp, ebp
pop ebp
ret 0x2c
mov edx, str.MsiTracker_mode_only:_skipping_hook
mov ecx, 0x101578c8
call fcn.10043b30
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x1c]
push edi
push ecx
push dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
push esi
push ebx
push dword [esp + 0x70]
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x4c]
call fcn.100ef6d0
jmp 0x100efadd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x1016f5d0]
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [0x1017045d], 0
mov dword [esp + 0x84], eax
je 0x100efb12
test al, 1
je 0x100efb79
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100efb12
or eax, 1
push eax
push dword [0x1016f5d0]
mov dword [esp + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100efba9
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x30], eax
mov dword [esp + 0x628], 3
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100efbde
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x38], edi
mov byte [esp + 0x628], 4
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100efc10
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
push ecx
mov eax, esp
mov byte [esp + 0x62c], 5
push dword [0x1017507c]
mov dword [esp + 0x84], 0
push str.AppVirtDll__s.dll
push eax
call fcn.10044f30
add esp, 0xc
lea ecx, [esp + 0x7c]
xor edx, edx
call fcn.1003d710
mov eax, esp
mov byte [esp + 0x62c], 6
push dword [0x1017507c]
push str.AppVirtDll64__s.dll
push eax
call fcn.10044f30
add esp, 0xc
lea ecx, [esp + 0x8c]
xor edx, edx
call fcn.1003d710
add esp, 4
push dword [esp + 0x28]
mov byte [esp + 0x62c], 7
lea ecx, [esp + 0x90]
mov eax, dword [esp + 0x14]
test eax, eax
push 0x44
cmovne ecx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x54]
push dword [ecx]
push ebx
push dword [esp + 0x6c]
push dword [esp + 0x54]
push dword [esp + 0x44]
push dword [esp + 0x38]
push str.ApiInit:_lpApplicationName_slpCommandLine_slpCurrentDirectory_sbInheritHandles_ddwCreationFlags0x_xStartupInfo.cb_d_known_d_hToken_x
push eax
call fcn.10044f30
add esp, 0x28
mov byte [esp + 0x628], 8
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 7
or esi, 0xffffffff
mov edx, dword [esp + 0x10]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100efd09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x4c]
cmp dword [eax], 0x44
jb 0x100efd5b
push dword [eax + 0x34]
push dword [eax + 4]
push dword [eax + 8]
push dword [eax + 0x40]
push dword [eax + 0x3c]
push dword [eax + 0x38]
lea eax, [esp + 0x28]
push str.ApiInit_cont_:_StartupInfo:_StdIn_xStdOut_xStdErr_dDesk_pReserved_pReserved2_x
push eax
call fcn.10044f30
add esp, 0x20
mov byte [esp + 0x628], 9
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
lea ecx, [esp + 0x10]
mov byte [esp + 0x628], 7
call fcn.10024080
mov edx, ebx
lea ecx, [esp + 0x10]
call fcn.100eef80
push ecx
mov ecx, esp
mov byte [esp + 0x62c], 0xa
push dword [eax]
push str.Remarkable_dwCreationFlags_flags:__s
push ecx
call fcn.10044f30
add esp, 0xc
call fcn.100ee5f0
mov byte [esp + 0x62c], 7
add esp, 4
mov edx, dword [esp + 0x10]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100efdae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x100efef3
cmp dword [esp + 0x2c], 0
je 0x100efef3
push ebx
lea ecx, [esp + 0x34]
call fcn.100240c0
lea ecx, [esp + 0x30]
call fcn.10024250
mov ecx, eax
call fcn.100242d0
push 0x22
push 0x22
lea ecx, [esp + 0x38]
call fcn.100309e0
mov ecx, eax
call fcn.10042b30
push dword [esp + 0x2c]
lea ecx, [esp + 0x18]
call fcn.100240c0
lea ecx, [esp + 0x14]
call fcn.10024250
mov ecx, eax
call fcn.100242d0
push eax
lea ecx, [esp + 0x18]
call fcn.100244b0
push 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.100267b0
mov ecx, eax
mov byte [esp + 0x628], 0xb
call fcn.100f1190
lea ecx, [esp + 0x10]
mov byte [esp + 0x628], 7
mov bl, al
call fcn.10024080
test bl, bl
je 0x100efea7
push 0x22
lea ecx, [esp + 0x18]
call fcn.10042b30
push eax
lea ecx, [esp + 0x18]
call fcn.100244b0
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jle 0x100eff51
push 0x22
push eax
call fcn.101033a1
add esp, 8
test eax, eax
je 0x100eff51
sub eax, dword [esp + 0x14]
sar eax, 1
cmp eax, 0xffffffff
je 0x100eff51
inc eax
lea ecx, [esp + 0x14]
push eax
push 0
call fcn.10026580
jmp 0x100eff51
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jle 0x100efed7
push 0x20
push eax
call fcn.101033a1
add esp, 8
test eax, eax
je 0x100efed7
sub eax, dword [esp + 0x14]
sar eax, 1
cmp eax, 0xffffffff
je 0x100efed7
push eax
push 0
lea ecx, [esp + 0x1c]
call fcn.10026580
lea ecx, [esp + 0x14]
call fcn.10024250
mov ecx, eax
call fcn.100242d0
push eax
lea ecx, [esp + 0x18]
call fcn.100244b0
jmp 0x100eff51
mov eax, dword [esp + 0x54]
and eax, 0xfffffffe
push eax
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
je 0x100eff1c
push 1
push ecx
mov ecx, esp
push ebx
call fcn.10023fc0
lea edx, [esp + 0x1c]
jmp 0x100eff35
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100eff41
push 1
push ecx
mov ecx, esp
lea ebx, [esp + 0x1c]
push eax
call fcn.10023fc0
mov edx, ebx
lea ecx, [esp + 0x38]
call fcn.1002bed0
add esp, 8
push dword [esp + 0x54]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x70]
lea eax, [esp + 0x14]
push dword [esp + 0x44]
push dword [esp + 0x38]
push str.CreateProcessW:_FullFileName_s__lpCurrentDirectory_s__lpEnvironment_p
push eax
call fcn.10044f30
add esp, 0x14
mov byte [esp + 0x628], 0xc
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 7
mov ecx, esi
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100effa8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x14]
call fcn.10024250
mov ecx, eax
call fcn.100242d0
push eax
lea ecx, [esp + 0x18]
call fcn.100244b0
cmp dword [0x101751cc], 0
je 0x100f00ef
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x1012ec40
call fcn.10023fc0
push ecx
mov byte [esp + 0x630], 0xd
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.cmd.exe
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [esp + 0x634], 0xe
call fcn.100447b0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x634], 7
call fcn.10044c80
add esp, 0xc
mov byte [esp + 0x628], 0xf
mov ebx, 1
mov ecx, dword [eax]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x24], ebx
setne al
test eax, eax
jne 0x100f0045
push 0x80004005
call fcn.100223c0
push ecx
push dword [esp + 0x34]
call fcn.10103523
add esp, 8
test eax, eax
jne 0x100f008f
push 3
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.100267b0
mov dword [esp + 0x628], 0x10
mov ebx, 3
push 0x10157d2c
mov ecx, eax
mov dword [esp + 0x28], ebx
call fcn.10024160
mov byte [esp + 0x47], 1
test eax, eax
je 0x100f0094
mov byte [esp + 0x47], 0
test bl, 2
je 0x100f00a9
and ebx, 0xfffffffd
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.10024080
mov dword [esp + 0x628], 7
test bl, 1
je 0x100f00c9
and ebx, 0xfffffffe
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], ebx
call fcn.10024080
cmp byte [esp + 0x47], 0
je 0x100f00ef
mov edx, str._CreateProcessW:_hiding_cmd__c_black_window
mov ecx, 0x101578c8
call fcn.10043b30
mov eax, dword [esp + 0x3c]
and eax, 0xffffffe7
or eax, 0x8000000
mov dword [esp + 0x3c], eax
push 0xa28
call fcn.10104809
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x54]
and eax, 0xfffffffe
mov dword [esp + 0x48], eax
push eax
push dword [0x1016f5d0]
call ebx
push 0
push esi
push 0x514
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [esi], 0
je 0x100f013a
push esi
lea ecx, [esp + 0x34]
call fcn.100240c0
push esi
call fcn.10103713
add esp, 4
push dword [esp + 0x54]
push dword [0x1016f5d0]
call ebx
push 0xa4
lea eax, [esp + 0x51c]
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x520], 0
call fcn.101078f0
add esp, 0xc
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f0195
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0x628], 0x11
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f01c7
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x80], ebx
push ecx
mov byte [esp + 0x62c], 0x12
mov esi, esp
mov ecx, dword [esp + 0x34]
lea ecx, [ecx - 0x10]
call fcn.10024750
add eax, 0x10
lea edx, [esp + 0x518]
lea ecx, [esp + 0x54]
mov dword [esi], eax
call fcn.1002af10
add esp, 4
test eax, eax
jne 0x100f0492
push ecx
mov ecx, esp
lea edx, [esp + 0x34]
push str..exe
lea esi, [esp + 0x51c]
call fcn.10026820
add esp, 4
lea ecx, [esp + 0x54]
mov edx, esi
call fcn.1002af10
add esp, 4
test eax, eax
jne 0x100f0492
lea ecx, [esp + 0x24]
call fcn.10023f70
mov byte [esp + 0x628], 0x29
mov ecx, 1
mov esi, dword [esp + 0x24]
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x100f027b
push 0x514
lea ecx, [esp + 0x28]
call fcn.100249c0
mov esi, dword [esp + 0x24]
push esi
push 0x514
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ecx
lea ecx, [esp + 0x28]
call fcn.10024210
push esi
lea eax, [esp + 0x24]
push str.CreateProcessW:_Non_virtual_executable._CurDir_s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x628], 0x2a
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
lea ecx, [esp + 0x20]
mov byte [esp + 0x628], 0x29
call fcn.10024080
mov edi, dword [esp + 0x40]
test edi, edi
jne 0x100f031b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100f031b
push esi
lea eax, [esp + 0x24]
mov edi, esi
push str.CreateProcessW:_Special_CurDir_case:_changing_lpCurrentDirectory_to:__s
push eax
mov dword [esp + 0x4c], edi
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x628], 0x2b
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
lea ecx, [esp + 0x20]
mov byte [esp + 0x628], 0x29
call fcn.10024080
push 0x1012ec60
lea ecx, [esp + 0x3c]
call fcn.100240c0
test edi, edi
je 0x100f03dc
cmp word [edi], 0
je 0x100f03dc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100f03dc
push ecx
mov ecx, esp
lea esi, [esp + 0x518]
push edi
call fcn.10023fc0
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.1002af10
add esp, 4
test eax, eax
je 0x100f03bf
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x48]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov edx, dword [esp + 0x588]
lea ecx, [esp + 0x30]
add eax, 0x10
mov dword [esi], eax
call fcn.1003d3b0
add esp, 0x10
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x62c], 0x2c
call fcn.100244b0
lea ecx, [esp + 0x20]
mov byte [esp + 0x628], 0x29
call fcn.10024080
jmp 0x100f03dc
push 0x1012ec60
lea ecx, [esp + 0x3c]
call fcn.100240c0
mov edx, str.CreateProcessW:_Setting_NewCurrentDirectory__
mov ecx, 0x101578c8
call fcn.10043b30
push dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [0x1016f5d0]
call esi
push dword [esp + 0x60]
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
push dword [esp + 0x58]
mov edi, dword [esp + 0x3c]
mov eax, edi
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x20]
push ecx
cmp dword [edi - 0xc], 0
mov ecx, dword [esp + 0x30]
cmove eax, dword [esp + 0x48]
push eax
push dword [esp + 0x7c]
mov eax, dword [esp + 0x4c]
or eax, 4
push eax
push dword [esp + 0x70]
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x4c]
call fcn.100ef6d0
push dword [esp + 0x54]
mov dword [esp + 0x2c], eax
push dword [0x1016f5d0]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp dword [esp + 0x28], 0
mov dword [esp + 0x60], eax
jne 0x100f047c
call esi
cmp eax, 0x2e4
jne 0x100f047c
mov edx, str.ERROR_ELEVATION_REQUIRED__non_virtual_
mov ecx, 0x101578c8
call fcn.10043b30
lea ecx, [esp + 0x24]
mov byte [esp + 0x628], 0x12
call fcn.10024080
jmp 0x100f0e77
mov esi, dword [esp + 0x50]
push 0
push 0
push 0
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 1
push ecx
mov ecx, eax
mov dword [esp + 0x44], eax
mov ebx, esp
call fcn.10024750
mov edx, dword [esp + 0x588]
lea ecx, [esp + 0x30]
add eax, 0x10
mov dword [ebx], eax
call fcn.1003d3b0
add esp, 0x10
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x62c], 0x13
call fcn.100244b0
mov byte [esp + 0x628], 0x12
or ecx, 0xffffffff
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0508
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x48]
mov dword [esp + 0x78], 0
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ecx
mov ecx, dword [esp + 0x34]
mov ebx, esp
lea ecx, [ecx - 0x10]
call fcn.10024750
add eax, 0x10
lea ecx, [esp + 0x78]
mov dword [ebx], eax
call fcn.1005ba10
add esp, 4
push eax
push dword [esp + 0x78]
lea eax, [esp + 0x28]
push dword [esp + 0x38]
push str.IsPE64__s__d__OK_d_
push eax
call fcn.10044f30
add esp, 0x14
mov byte [esp + 0x628], 0x14
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 0x12
or ebx, 0xffffffff
mov edx, dword [esp + 0x20]
mov ecx, ebx
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0597
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x54]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp byte [0x10172222], 0
mov eax, dword [esp + 0x514]
je 0x100f0734
test al, al
js 0x100f07a8
lea ecx, [esp + 0x9c]
call fcn.100ca150
mov eax, dword [esp + 0x54]
or eax, 1
mov byte [esp + 0x628], 0x15
push eax
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x58]
mov ecx, dword [esp + 0x50]
push ecx
push dword [esp + 0x48]
push dword [esp + 0x7c]
push dword [esp + 0x4c]
push dword [esp + 0x70]
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x4c]
push ecx
push dword [esp + 0x50]
mov ecx, dword [esp + 0xa4]
sub esp, 0xc
add ecx, 0xfffffff0
mov dword [esp + 0x50], esp
mov ebx, esp
call fcn.10024750
add eax, 0x10
mov dword [ebx], eax
push ecx
mov byte [esp + 0x664], 0x16
mov ebx, esp
mov dword [esp + 0x5c], esp
mov edx, 0x1017507c
push ecx
mov ecx, esp
push str..exe
call fcn.10026820
add esp, 4
xor edx, edx
mov ecx, ebx
call fcn.1003d710
mov byte [esp + 0x668], 0x17
mov ebx, esp
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
mov dword [esp + 0x5c], esp
call fcn.10024750
add eax, 0x10
mov dword [ebx], eax
push ecx
mov byte [esp + 0x66c], 0x18
mov ebx, esp
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
mov dword [esp + 0x70], esp
call fcn.10024750
add eax, 0x10
mov dword [ebx], eax
push ecx
lea ecx, [esi - 0x10]
mov byte [esp + 0x670], 0x19
mov ebx, esp
call fcn.10024750
add eax, 0x10
lea ecx, [esp + 0xe4]
mov dword [ebx], eax
mov byte [esp + 0x670], 0x15
call fcn.100ca640
push dword [esp + 0x54]
mov ebx, eax
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
jne 0x100f070d
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 1
push str.CreateProcessW:_ImaginaryExec.Perform_success
push eax
call fcn.10044f30
add esp, 8
mov byte [esp + 0x628], 0x1a
jmp 0x100f07f5
cmp ebx, 0x14
jne 0x100f07c4
lea ecx, [esp + 0x9c]
mov byte [esp + 0x628], 0x12
call fcn.100f1110
mov eax, dword [esp + 0x514]
or ebx, 0xffffffff
test al, al
js 0x100f07a8
push esi
lea eax, [esp + 0x20]
push str.CreateProcessW:_deploying_streamed_file:__s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x628], 0x1c
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 0x12
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0784
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [esp + 0x38]
lea edi, [esp + 0x518]
mov esi, esp
call fcn.10024750
add eax, 0x10
xor edx, edx
mov ecx, edi
mov dword [esi], eax
call fcn.100fd6a0
add esp, 4
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f0822
push 0x80004005
call fcn.100223c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x28], 0
call ebx
mov dword [esp + 0x60], eax
call ebx
push eax
lea eax, [esp + 0x14]
push str.CreateProcessW:_ImaginaryExec.Perform_failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x628], 0x1b
mov edx, dword [eax]
mov ecx, 0x101578c8
call fcn.10043b30
lea ecx, [esp + 0x10]
call fcn.10024080
lea ecx, [esp + 0x9c]
call fcn.100f1110
mov ebx, dword [esp + 0x80]
jmp 0x100f0fbe
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x40]
mov byte [esp + 0x628], 0x1d
test eax, eax
je 0x100f0850
push eax
lea ecx, [esp + 0x20]
call fcn.100240c0
mov esi, dword [esp + 0x1c]
jmp 0x100f088c
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x100f0876
push 0x514
lea ecx, [esp + 0x20]
call fcn.100249c0
mov esi, dword [esp + 0x1c]
push esi
push 0x514
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ecx
lea ecx, [esp + 0x20]
call fcn.10024210
push 0x1012ec60
lea ecx, [esp + 0x24]
call fcn.10023fc0
push 0xa4
lea eax, [esp + 0x51c]
mov byte [esp + 0x62c], 0x1e
push 0
push eax
mov dword [esp + 0x520], 0
call fcn.101078f0
add esp, 8
lea eax, [esi - 0x10]
mov ecx, eax
mov dword [esp + 0x1c], eax
mov edi, esp
call fcn.10024750
add eax, 0x10
lea edx, [esp + 0x518]
lea ecx, [esp + 0x24]
mov dword [edi], eax
call fcn.1002af10
add esp, 4
test eax, eax
je 0x100f095a
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x30]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov edx, dword [esp + 0x588]
lea ecx, [esp + 0x44]
add eax, 0x10
mov dword [esi], eax
call fcn.1003d3b0
add esp, 0x10
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x62c], 0x1f
call fcn.100244b0
mov byte [esp + 0x628], 0x1e
mov ecx, ebx
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0954
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x38]
jmp 0x100f09b8
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
call fcn.100244b0
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x34]
push edi
push str.CreateProcessW:_Setting_NewCurrentDirectory__s___1_
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x628], 0x20
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 0x1e
mov ecx, ebx
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f09b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
test ebx, ebx
je 0x100f0a1b
test eax, 0x400
jne 0x100f0a1b
xor eax, eax
lea ecx, [ecx]
cmp byte [ebx + eax], 0
jne 0x100f09dd
cmp byte [ebx + eax + 1], 0
je 0x100f09e0
inc eax
jmp 0x100f09d0
lea eax, [eax*2 + 4]
push eax
call fcn.10104809
add esp, 4
mov esi, eax
xor ecx, ecx
mov dl, byte [ebx + ecx]
test dl, dl
jne 0x100f0a01
cmp byte [ebx + ecx + 1], dl
je 0x100f0a0c
movsx ax, dl
mov word [esi + ecx*2], ax
inc ecx
jmp 0x100f09f4
xor eax, eax
mov ebx, esi
mov dword [esi + ecx*2], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], ebx
or eax, 0x400
mov dword [esp + 0x3c], eax
test ebx, ebx
je 0x100f0a2c
mov eax, ebx
jmp 0x100f0a32
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push dword [esp + 0x74]
mov ebx, dword [esp + 0x84]
lea edx, [esp + 0x80]
push ebx
mov ecx, eax
call fcn.100eec40
add esp, 8
cmp dword [edi - 0xc], 0
jne 0x100f0b06
push ecx
lea ecx, [ebx - 0x10]
mov edi, 0x5c
mov esi, esp
call fcn.10024750
add eax, 0x10
lea ecx, [esp + 0x38]
mov edx, edi
mov dword [esi], eax
call fcn.100452e0
add esp, 4
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x62c], 0x21
call fcn.100244b0
mov byte [esp + 0x628], 0x1e
or esi, 0xffffffff
mov edx, dword [esp + 0x34]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0ab6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x34]
push edi
push str.CreateProcessW:_Setting_NewCurrentDirectory__s___2_
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x628], 0x22
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 0x1e
mov ecx, esi
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0b06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f0b22
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x628], 0x23
mov edx, 0x1012ecf8
mov eax, dword [esp + 0x14]
mov ecx, 0x1012ec60
push eax
cmp dword [eax - 0xc], 0
lea eax, [esp + 0x30]
cmovne ecx, edx
push ecx
push ebx
push 0x1012ecfc
push eax
call fcn.10036910
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x48]
add esp, 0x14
push dword [esp + 0x3c]
push dword [esp + 0x6c]
push esi
push edi
push dword [esp + 0x24]
push ebx
push str.CreateProcessW:_Executing_a_virtual_executable._n__VirtFileName__s__n__Arguments__s__n__NewCurrentDirectory__s__n__CmdLine__s__n__SecurityAttributes_x_n__dwCreationFlags0x_x
push eax
call fcn.10044f30
add esp, 0x20
mov byte [esp + 0x628], 0x24
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 0x23
or ecx, 0xffffffff
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0bc1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
movzx eax, byte [0x10174f38]
push dword [esp + 0x60]
mov dword [esp + 0x78], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [0x10174f38], 0
call eax
push dword [esp + 0x48]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [edi - 0xc], 0
jne 0x100f0c36
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f0c10
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x48]
call fcn.10024960
mov byte [esp + 0x628], 0x26
or dword [esp + 0x24], 4
jmp 0x100f0c55
lea ecx, [edi - 0x10]
call fcn.10024750
add eax, 0x10
mov dword [esp + 0x48], eax
mov dword [esp + 0x628], 0x27
or dword [esp + 0x24], 8
cmp dword [esi - 4], 1
lea eax, [esp + 0x48]
mov eax, dword [eax]
mov dword [esp + 0x34], eax
jle 0x100f0c79
push dword [esi - 0xc]
lea ecx, [esp + 0x30]
call fcn.10024570
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
push dword [esp + 0x58]
mov ecx, dword [esp + 0x2c]
mov edx, ebx
push dword [esp + 0x50]
push eax
push dword [esp + 0x88]
mov eax, dword [esp + 0x4c]
or eax, 4
push eax
push dword [esp + 0x70]
push dword [esp + 0x84]
push dword [esp + 0x84]
push esi
call fcn.100ef6d0
mov dword [esp + 0x628], 0x26
mov edx, dword [esp + 0x24]
mov dword [esp + 0x28], eax
test dl, 8
je 0x100f0cf8
mov eax, dword [esp + 0x48]
and edx, 0xfffffff7
add eax, 0xfffffff0
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], eax
or ecx, 0xffffffff
add eax, 0xc
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0cf8
mov edx, dword [esp + 0x34]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x628], 0x23
test dl, 4
je 0x100f0d26
mov edx, dword [esp + 0x48]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0d26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x54]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x28], 0
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x74]
mov byte [0x10174f38], al
jne 0x100f0d6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x100f0d6c
mov edx, str.ERROR_ELEVATION_REQUIRED__virtual_
mov ecx, 0x101578c8
call fcn.10043b30
push dword [esi - 8]
push esi
call fcn.1010374b
add esp, 8
test eax, eax
js 0x100f10fc
cmp eax, dword [esi - 8]
jg 0x100f10fc
push dword [esp + 0x7c]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.10103713
lea edx, [esi - 0x10]
mov byte [esp + 0x62c], 0x1e
or esi, 0xffffffff
lea eax, [edx + 0xc]
add esp, 4
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0dc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x628], 0x1d
mov ecx, esi
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0de7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x628], 0x12
mov ecx, esi
mov edx, dword [esp + 0x18]
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0e09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x70]
mov ecx, dword [esp + 0x44]
mov eax, str.empty
test ecx, ecx
cmovne eax, ecx
push eax
mov eax, dword [esp + 0x60]
push ecx
push dword [eax + 8]
lea eax, [esp + 0x28]
push dword [esp + 0x70]
push dword [esp + 0x3c]
push str.RetVal_d__le_d__PID_d__lpCurrentDirectory_p_s__lpEnvironment_s
push eax
call fcn.10044f30
add esp, 0x20
mov byte [esp + 0x628], 0x28
mov ecx, 0x101578c8
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x628], 0x12
mov ecx, esi
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0e77
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x28], 0
je 0x100f0fba
mov eax, dword [esp + 0x58]
cmp dword [eax], 0
je 0x100f0fba
cmp byte [0x1017045c], 0
je 0x100f0fba
push ecx
mov ecx, dword [esp + 0x18]
mov esi, esp
add ecx, 0xfffffff0
mov dword [esp + 0x68], esp
call fcn.10024750
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [esp + 0x630], 0x2d
mov esi, esp
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.10024750
mov ecx, dword [esp + 0x18]
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x630], 0x12
call fcn.100fa0f0
add esp, 8
test eax, eax
jne 0x100f0fba
push ecx
mov eax, esp
push str.Injecting_child
push eax
call fcn.10044f30
add esp, 8
call fcn.100ee5f0
mov ecx, dword [esp + 0x7c]
xor eax, eax
add esp, 4
cmp dword [0x101750c4], eax
setne al
push eax
mov eax, dword [esp + 0x5c]
push dword [eax + 8]
mov edx, dword [eax]
call fcn.10059b40
add esp, 4
mov esi, eax
mov ecx, esp
push esi
push dword [esp + 0x80]
push str.MyInjectLibrary__s__d
push ecx
call fcn.10044f30
add esp, 0x10
call fcn.100ee5f0
add esp, 4
test esi, esi
jne 0x100f0fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov ecx, dword [esp + 0x38]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.10024750
add eax, 0x10
lea ecx, [esp + 0x20]
mov dword [esi], eax
mov eax, 0x5c
movzx edx, ax
call fcn.10045200
add esp, 4
push dword [eax]
mov eax, dword [esp + 0x60]
push dword [eax + 8]
lea eax, [esp + 0x520]
push str.Could_not_inject_process__d___s___LE_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [esp + 0x18]
call fcn.10024080
push 0
push str.InjectLibrary_Error
lea eax, [esp + 0x51c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [esp + 0x50]
push dword [esp + 0x84]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebx - 0x10]
mov byte [esp + 0x628], 0x11
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f0fff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [esp + 0x628], 7
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f1020
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x628], 6
mov ecx, ebx
mov edx, dword [esp + 0x88]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f1048
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x628], 5
mov ecx, ebx
mov edx, dword [esp + 0x78]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f106d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x628], 4
mov ecx, ebx
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f1092
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [esp + 0x628], 3
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f10b3
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x628], 0xffffffff
mov edx, dword [esp + 0x30]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x100f10d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x100f10f5
test byte [esp + 0x3c], 4
jne 0x100f10f5
mov eax, dword [esp + 0x58]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
jmp 0x100efadd
push 0x80070057
call fcn.100223c0
int3