Function at 0x300347a7
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x228], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24c], ebx
lea edi, [ebp - 0x248]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x21c
stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push ebx
push eax
mov dword [ebp - 0x224], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [0x300cb85c], 5
mov dword [ebp - 0x22c], ebx
je 0x3003480c
mov dword [0x3008b748], ebx
xor eax, eax
lea edi, [ebp - 0x238]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.3002fa6c
mov edi, dword [ebp - 0x228]
lea eax, [edi + 0x44]
push eax
lea eax, [edi + 0x40]
push eax
call fcn.3002fa3e
cmp dword [0x300cb85c], 5
mov dword [0x300d1730], ebx
mov dword [0x300d1734], ebx
je 0x30034858
mov dword [0x300d1750], ebx
lea eax, [esi + 0x1144]
mov dword [0x300d1758], eax
lea eax, [esi + 0x1160]
mov dword [0x300d175c], eax
lea eax, [esi + 0x116c]
mov dword [0x300d1760], eax
lea eax, [ebp - 0x238]
mov dword [0x300d1764], eax
mov eax, dword [esi + 0x111c]
mov dword [0x300d1768], eax
mov dword [0x300d176c], ebx
mov eax, dword [esi + 0x1110]
mov dword [0x300d1778], eax
mov eax, dword [esi + 0x1138]
mov dword [0x300d177c], eax
mov eax, dword [esi + 0x113c]
mov dword [0x300d1780], eax
lea eax, [esi + 0x1120]
mov dword [0x300d1784], edi
mov dword [0x300d1788], eax
mov ecx, dword [esi + 0x1180]
mov dword [eax + 0x14], ecx
mov dword [0x300d178c], ebx
test dword [esi + 0x1140], 0x10000000
mov dword [ebp - 0x23c], eax
je 0x300349a4
cmp dword [0x300cb85c], ebx
jne 0x30034959
call fcn.3002fa20
test eax, eax
je 0x30034946
test byte [0x300bfc90], 0x20
jne 0x30034946
push 0x300c9dc8
push 0x104
push 0x300c9dd8
call fcn.30042635
test byte [0x300bfc9c], 0x20
mov eax, 0x300049c8
jne 0x3003492d
mov eax, 0x300049b0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [esi + 0x113c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp 0x30034959
call fcn.3003db37
test eax, eax
je 0x30034959
push 0x30001790
call fcn.3003dbd1
lea eax, [ebp - 0x224]
push eax
call fcn.3002d844
push 1
lea eax, [ebp - 0x224]
push eax
call fcn.3002ebf6
test eax, eax
je 0x30034993
lea eax, [ebp - 0x224]
push eax
push esi
push edi
call fcn.3002f5d5
test eax, eax
je 0x30034993
mov dword [0x300d1724], 1
lea eax, [ebp - 0x224]
push eax
call fcn.3002e959
jmp 0x30034bb0
call fcn.30032137
test eax, eax
je 0x30034a4a
mov eax, dword [esi + 0x1104]
cmp eax, ebx
je 0x30034a3a
cmp word [eax], bx
je 0x30034a3a
mov dword [0x300bcf38], eax
mov dword [0x300d178c], 1
cmp dword [esi + 0x111c], ebx
push ebx
je 0x300349e2
call fcn.3003420a
jmp 0x30034bb0
push 0x3003b892
push dword [0x300cb514]
push 0x67
push dword [0x3008b480]
call fcn.300352ee
mov eax, dword [0x300d1750]
cmp eax, ebx
je 0x30034bb0
push 0x4e20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x30034a23
push dword [0x300d1750]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [0x300d1750]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x300d1750], ebx
jmp 0x30034bb0
push ebx
push 0x30303030
call fcn.300435b4
jmp 0x30034bb0
push 0x1000
push ebx
push 0x300bda38
mov dword [0x300bcf8c], ebx
mov dword [0x300bcfb0], ebx
mov dword [0x300bcfb4], ebx
mov dword [0x300bcfb8], ebx
mov dword [0x300bcfbc], ebx
mov dword [0x300bcfc0], ebx
mov byte [0x300bd8e8], bl
mov dword [0x300bd9ec], ebx
mov dword [0x300bd9fc], ebx
mov dword [0x300bda00], ebx
mov dword [0x300bda34], ebx
call sub.MSVCR80.dll_memset
push 0x800
push ebx
push 0x300bea40
mov dword [0x300bea38], ebx
mov dword [0x300bea3c], ebx
call sub.MSVCR80.dll_memset
mov edi, 0x104
push edi
push ebx
push 0x300bf240
call sub.MSVCR80.dll_memset
push 0x800
push ebx
push 0x300bf344
call sub.MSVCR80.dll_memset
push edi
push ebx
push 0x300bfb44
call sub.MSVCR80.dll_memset
add esp, 0x3c
lea eax, [esi + 0x800]
push edi
mov dword [0x300bcfe0], eax
push 0x300bcfe4
lea eax, [esi + 0x1000]
push eax
mov dword [0x300bfc48], ebx
mov dword [0x300bfc50], ebx
mov dword [0x300bcfdc], esi
call fcn.3005b426
cmp dword [0x300cb85c], 5
mov eax, dword [esi + 0x1108]
mov dword [0x300bda04], eax
mov eax, dword [esi + 0x110c]
mov dword [0x300bda08], eax
mov eax, dword [esi + 0x1114]
mov dword [0x300bfc54], eax
jne 0x30034b4b
mov eax, dword [0x300d1770]
mov dword [0x300d1734], eax
cmp dword [esi + 0x111c], ebx
push ebx
je 0x30034b5b
call fcn.300340b4
jmp 0x30034baa
push 0x3003b892
push dword [0x300cb514]
push 0x67
push dword [0x3008b480]
call fcn.300352ee
mov eax, dword [0x300d1750]
cmp eax, ebx
je 0x30034baa
push 0x4e20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x30034b98
push dword [0x300d1750]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [0x300d1750]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x300d1750], ebx
mov edi, dword [ebp - 0x228]
xor eax, eax
inc eax
cmp dword [ebp - 0x230], ebx
je 0x30034bc6
mov dword [esi + 0x1118], eax
mov dword [0x300d1724], eax
mov ecx, dword [esi + 0x1110]
cmp ecx, ebx
je 0x30034beb
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
push 0x10
lea eax, [ebp - 0x24c]
push eax
push ecx
call fcn.30041785
call fcn.3003225d
push ebx
push ebx
call dword [0x300bccc0]
test eax, eax
jl 0x30034c06
mov dword [ebp - 0x22c], 1
cmp dword [0x300cb85c], 5
je 0x30034c1b
cmp dword [esi + 0x111c], ebx
jne 0x30034c1b
xor eax, eax
jmp 0x30034c1e
xor eax, eax
inc eax
push eax
push ebx
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.30039ab5
cmp dword [ebp - 0x22c], ebx
je 0x30034c40
call dword [0x300bccbc]
mov eax, dword [edi + 0x20]
cmp eax, ebx
je 0x30034c4d
push eax
call fcn.3004315f
mov eax, dword [edi]
cmp eax, ebx
je 0x30034c59
push eax
call fcn.3004315f
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x30034c66
push eax
call fcn.3004315f
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x30034c73
push eax
call fcn.3004315f
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x30034c80
push eax
call fcn.3004315f
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x30034c8d
push eax
call fcn.3004315f
mov edi, dword [edi + 0x38]
cmp edi, ebx
je 0x30034c9a
push edi
call fcn.3004315f
mov eax, dword [ebp - 0x234]
cmp eax, dword [0x3008b5b4]
je 0x30034cb2
cmp eax, ebx
je 0x30034cb2
push eax
call fcn.3004315f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30069776
leave
ret 8