Function at 0x10004a86
Capabilities:
Enumerate threads
Hide thread from debugger

Disassembly:
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0xffffffff
je 0x10005073
mov dword [ebp - 0x65c], 0x1c
mov dword [ebp - 0x61c], 0xffffffff
mov dword [ebp - 0x618], 0x7fffffff
mov dword [ebp - 0x668], 0
lea ecx, [ebp - 0x65c]
push ecx
mov edx, dword [ebp - 0x6c0]
push edx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10005066
cmp dword [ebp - 0x65c], 0x10
jb 0x10004bcf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x650], eax
jne 0x10004bcf
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x654], eax
je 0x10004bcf
mov eax, dword [ebp - 0x654]
push eax
push 0
push 0x58
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0
je 0x10004bcf
lea ecx, [ebp - 0x640]
push ecx
lea edx, [ebp - 0x630]
push edx
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x628]
push ecx
mov edx, dword [ebp - 0x694]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
test eax, eax
je 0x10004bc2
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x10004bb3
mov edx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x61c], edx
mov dword [ebp - 0x618], eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov dword [ebp - 0x668], edx
jmp 0x10004bc0
mov eax, dword [ebp - 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004bcf
mov ecx, dword [ebp - 0x694]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x65c], 0x1c
lea edx, [ebp - 0x65c]
push edx
mov eax, dword [ebp - 0x6c0]
push eax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10004ae5
push 0x10003810
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
cmp dword [ebp - 0x668], 0
je 0x10005066
mov dword [ebp - 0x614], 1
mov dword [ebp - 0x620], 0
push 4
lea ecx, [ebp - 0x614]
push ecx
push 0x11
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
lea eax, [ebp - 0x620]
push eax
push 4
lea ecx, [ebp - 0x614]
push ecx
push 0x11
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov dword [ebp - 0xa80], 0x10010
push 0x2c8
push 0
lea eax, [ebp - 0xa7c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0xb3
lea esi, [ebp - 0xa80]
mov edi, 0x1000d1f0
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov byte [ebp - 0x661], cl
lea edx, [ebp - 0x75c]
push edx
lea ecx, [ebp - 0x661]
call fcn.10003170
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x690], 0
jmp 0x10004cc6
mov eax, dword [ebp - 0x690]
add eax, 1
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 6
jae 0x10004d13
mov ecx, dword [ebp - 0x690]
push ecx
mov ecx, dword [ebp - 0x68c]
add ecx, 2
call fcn.10002f60
mov dx, word [eax]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x68c]
call fcn.10005910
mov si, ax
mov ecx, dword [ebp - 0x690]
push ecx
mov ecx, dword [ebp - 0x68c]
add ecx, 2
call fcn.10002f60
mov word [eax], si
jmp 0x10004cb7
push 6
mov ecx, dword [ebp - 0x68c]
add ecx, 2
call fcn.10002f60
xor edx, edx
mov word [eax], dx
mov ecx, dword [ebp - 0x68c]
add ecx, 2
call fcn.10003660
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x6e4]
push eax
call fcn.10005250
add esp, 4
neg eax
sbb eax, eax
neg eax
mov byte [0x1000d1ec], al
xor ecx, ecx
mov byte [ebp - 0x669], cl
lea edx, [ebp - 0x76c]
push edx
lea ecx, [ebp - 0x669]
call fcn.100031a0
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x69c], 0
jmp 0x10004d91
mov eax, dword [ebp - 0x69c]
add eax, 1
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 6
jae 0x10004dde
mov ecx, dword [ebp - 0x69c]
push ecx
mov ecx, dword [ebp - 0x67c]
add ecx, 2
call fcn.10002f60
mov dx, word [eax]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x67c]
call fcn.10005910
mov si, ax
mov ecx, dword [ebp - 0x69c]
push ecx
mov ecx, dword [ebp - 0x67c]
add ecx, 2
call fcn.10002f60
mov word [eax], si
jmp 0x10004d82
push 6
mov ecx, dword [ebp - 0x67c]
add ecx, 2
call fcn.10002f60
xor edx, edx
mov word [eax], dx
mov ecx, dword [ebp - 0x67c]
add ecx, 2
call fcn.10003660
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
push eax
call fcn.10005250
add esp, 4
neg eax
sbb eax, eax
neg eax
mov byte [0x1000d1ed], al
xor ecx, ecx
mov byte [ebp - 0x662], cl
lea edx, [ebp - 0x77c]
push edx
lea ecx, [ebp - 0x662]
call fcn.100031d0
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x680], 0
jmp 0x10004e5c
mov eax, dword [ebp - 0x680]
add eax, 1
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 6
jae 0x10004ea9
mov ecx, dword [ebp - 0x680]
push ecx
mov ecx, dword [ebp - 0x684]
add ecx, 2
call fcn.10002f60
mov dx, word [eax]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x684]
call fcn.10005910
mov si, ax
mov ecx, dword [ebp - 0x680]
push ecx
mov ecx, dword [ebp - 0x684]
add ecx, 2
call fcn.10002f60
mov word [eax], si
jmp 0x10004e4d
push 6
mov ecx, dword [ebp - 0x684]
add ecx, 2
call fcn.10002f60
xor edx, edx
mov word [eax], dx
mov ecx, dword [ebp - 0x684]
add ecx, 2
call fcn.10003660
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebp - 0x6ec]
push eax
call fcn.10005250
add esp, 4
neg eax
sbb eax, eax
neg eax
mov byte [0x1000d1ee], al
xor ecx, ecx
mov byte [ebp - 0x663], cl
lea edx, [ebp - 0x78c]
push edx
lea ecx, [ebp - 0x663]
call fcn.10003200
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x688], 0
jmp 0x10004f27
mov eax, dword [ebp - 0x688]
add eax, 1
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 6
jae 0x10004f74
mov ecx, dword [ebp - 0x688]
push ecx
mov ecx, dword [ebp - 0x6a0]
add ecx, 2
call fcn.10002f60
mov dx, word [eax]
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x6a0]
call fcn.10005910
mov si, ax
mov ecx, dword [ebp - 0x688]
push ecx
mov ecx, dword [ebp - 0x6a0]
add ecx, 2
call fcn.10002f60
mov word [eax], si
jmp 0x10004f18
push 6
mov ecx, dword [ebp - 0x6a0]
add ecx, 2
call fcn.10002f60
xor edx, edx
mov word [eax], dx
mov ecx, dword [ebp - 0x6a0]
add ecx, 2
call fcn.10003660
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f0]
push eax
call fcn.10005250
add esp, 4
neg eax
sbb eax, eax
neg eax
mov byte [0x1000d1ef], al
movzx ecx, byte [0x1000d1ec]
test ecx, ecx
je 0x10004fdb
mov edx, dword [0x1000d1cc]
mov dword [0x1000d1f4], edx
mov eax, dword [0x1000d208]
or eax, 1
mov dword [0x1000d208], eax
movzx ecx, byte [0x1000d1ed]
test ecx, ecx
je 0x10004fff
mov edx, dword [0x1000d1b8]
mov dword [0x1000d1f8], edx
mov eax, dword [0x1000d208]
or eax, 4
mov dword [0x1000d208], eax
movzx ecx, byte [0x1000d1ee]
test ecx, ecx
je 0x10005023
mov edx, dword [0x1000d1c0]
mov dword [0x1000d1fc], edx
mov eax, dword [0x1000d208]
or eax, 0x10
mov dword [0x1000d208], eax
movzx ecx, byte [0x1000d1ef]
test ecx, ecx
je 0x10005047
mov edx, dword [0x1000d1dc]
mov dword [0x1000d200], edx
mov eax, dword [0x1000d208]
or eax, 0x40
mov dword [0x1000d208], eax
push 0x1000d1f0
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ntdll.dll_NtSetContextThread]
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000509a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007490
mov esp, ebp
pop ebp
ret