Function at 0x10013f90
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push edi
lea eax, [ebp - 0x30]
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
add eax, eax
xor ecx, ecx
mov dword [edi + 0x40], eax
mov edx, 0x30
mul edx
seto cl
mov byte [edi + 0x48], 0
neg ecx
or ecx, eax
push ecx
call fcn.1001b722
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10013fdd
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x40]
push esi
lea eax, [eax + eax*2]
shl eax, 4
push eax
xor esi, esi
push esi
push ebx
call sub.MSVCR110.dll_memset
mov ecx, dword [sym.imp.MSVCR110.dll__beginthreadex]
xor eax, eax
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [edi + 0x40], eax
jbe 0x10014062
add ebx, 0x18
lea eax, [ebx - 0x14]
push eax
push 4
push edi
push 0x10014940
push 0
push 0
call ecx
add esp, 0x18
mov dword [ebx - 0x18], eax
test eax, eax
je 0x10014041
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 8]
mov ecx, dword [sym.imp.MSVCR110.dll__beginthreadex]
inc eax
add ebx, 0x30
mov dword [ebp - 8], eax
cmp eax, dword [edi + 0x40]
jb 0x10014007
jmp 0x10014059
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 8]
test esi, esi
jle 0x10014059
movzx esi, si
or esi, 0x80070000
mov ebx, dword [ebp - 4]
mov ecx, dword [sym.imp.MSVCR110.dll__beginthreadex]
cmp eax, dword [edi + 0x40]
jne 0x10014099
push 0
push 4
push edi
push 0x10014910
push 0
push 0
mov dword [edi + 0x44], ebx
call ecx
add esp, 0x18
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100140a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10014099
movzx esi, si
or esi, 0x80070000
mov ecx, edi
call fcn.10014680
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [edi + 0x50]
push ebx
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0
push str.iSafeFsFltInquirePort
mov dword [ebp - 0xc], 2
call dword [sym.imp.FLTLIB.DLL_FilterConnectCommunicationPort]
mov esi, eax
test esi, esi
jns 0x100140e9
cmp esi, 0x80070002
jne 0x10014099
mov ecx, edi
xor esi, esi
call fcn.10014680
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0x40]
push 0
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 0x54], eax
test eax, eax
je 0x10014084
mov ecx, dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ebx, ebx
cmp dword [edi + 0x40], ebx
jbe 0x1001414b
mov eax, dword [ebp - 4]
nop
push dword [eax]
call ecx
cmp eax, 0xffffffff
je 0x10014130
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_ResumeThread]
inc ebx
add eax, 0x30
mov dword [ebp - 4], eax
cmp ebx, dword [edi + 0x40]
jb 0x10014110
jmp 0x10014145
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10014145
movzx esi, si
or esi, 0x80070000
mov ecx, dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, dword [edi + 0x40]
jne 0x10014099
push dword [edi + 0x4c]
call ecx
cmp eax, 0xffffffff
je 0x10014084
xor ebx, ebx
cmp ebx, dword [edi + 0x40]
jae 0x100141cd
lea esp, [esp]
push 0x40
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x100141c5
lea ecx, [eax + 0x28]
push ecx
xorps xmm0, xmm0
movq qword [ecx], xmm0
push 0x28
movq qword [ecx + 8], xmm0
push eax
mov dword [ecx + 0x10], 0
push dword [edi + 0x50]
call dword [sym.imp.FLTLIB.DLL_FilterGetMessage]
mov esi, eax
cmp esi, 0x800703e5
jne 0x100141b7
inc ebx
cmp ebx, dword [edi + 0x40]
jb 0x10014170
jmp 0x100141ca
push dword [ebp - 8]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x100141ca
mov esi, 0x8007000e
cmp ebx, dword [edi + 0x40]
jne 0x10014099
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret