Function at 0x40b480
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x34], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], eax
call fcn.0040b400
mov edi, eax
push edi
call dword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
mov esi, eax
test esi, esi
je 0x40b4d3
lock dec dword [edi + 0xc]
mov ecx, dword [edi + 8]
lea eax, [esi + 8]
test ecx, ecx
je 0x40b4ea
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x40b4c6
jmp 0x40b4ea
mov esi, dword [edi + 8]
add esi, 8
call fcn.00407de0
push esi
push 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov eax, dword [ebp - 0x30]
lea ecx, [esi + 8]
push 0
mov dword [ecx], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
push 0x40b3a0
push 0
push 0
push 0
push 1
push 0
push 0xffffffffffffffff
mov dword [ecx + 4], ebx
call dword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov ebx, eax
mov dword [ebp - 0x30], ebx
test ebx, ebx
js 0x40b6aa
cmp dword [ebp - 0xc], 0
je 0x40b649
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push 0
push 4
push eax
push 3
push ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x40b56f
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
and esi, 0x3f
and eax, 0xffffffc0
or esi, eax
jmp 0x40b575
mov esi, dword [ebp - 0x30]
and esi, 0xffffffc0
push 0
push 4
lea eax, [ebp - 0x18]
and esi, 0xfffffe3f
push eax
push 0x16
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x40b59d
mov edi, dword [ebp - 0x18]
and edi, 7
shl edi, 6
or edi, esi
jmp 0x40b59f
mov edi, esi
push 0
push 4
lea eax, [ebp - 0x1c]
and edi, 0xfffff1ff
push eax
push 0x18
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x40b5c7
mov esi, dword [ebp - 0x1c]
and esi, 7
shl esi, 9
or esi, edi
jmp 0x40b5c9
mov esi, edi
mov edi, dword ds:[ebp - 0xc]
mov eax, esi
shl eax, 0x1a
sar eax, 0x1a
mov ecx, dword [edi]
shl ecx, 0x1a
sar ecx, 0x1a
cmp eax, ecx
je 0x40b5f6
push 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
push eax
push 3
push ebx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
mov ecx, dword [edi]
mov eax, esi
shr ecx, 6
shr eax, 6
and ecx, 7
and eax, 7
cmp eax, ecx
je 0x40b61c
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push 0x16
push ebx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
mov eax, dword [edi]
shr eax, 9
shr esi, 9
and eax, 7
and esi, 7
cmp esi, eax
je 0x40b646
push 4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0x18
push ebx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
mov ebx, dword [ebp - 0x30]
call fcn.0040ac00
cmp eax, 0xa02
jb 0x40b686
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
push str.UpdateThread
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 8
lea eax, [ebp - 0x10]
push eax
push 0x26
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x40b694
mov eax, dword [ebp - 0x2c]
mov dword [ecx], eax
jmp 0x40b6d1
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_NtResumeThread]
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x40b6d1
mov eax, dword [edi + 0x10]
cmp dword [edi + 0xc], eax
jae 0x40b6c2
push esi
push edi
call dword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lea eax, [edi + 0xc]
lock inc dword [eax]
jmp 0x40b6d1
call fcn.00407de0
push esi
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword ds:[ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414c55
mov esp, ebp
pop ebp
ret 0xc