Function at 0x1017fbf
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1036a44]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x30]
push eax
mov edi, ecx
mov dword [ebp - 0x40], esi
call fcn.01016817
test al, al
jne 0x1018002
mov eax, 0x80070057
jmp 0x1018214
call fcn.010043e4
test al, al
jne 0x1018015
mov eax, 0xc10003f3
jmp 0x1018214
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jle 0x1018032
mov ecx, edi
call fcn.01015dfc
test al, al
jne 0x1018032
mov esi, 0x80004005
jmp 0x10181e6
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x8c], eax
jne 0x101805b
mov esi, 0x80070057
jmp 0x10181e6
push dword [ebp - 0x38]
call esi
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0x88], esi
jne 0x1018085
push dword [ebp - 0x8c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x10180a9
push 0x10
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x84], eax
jne 0x10180ac
push dword [ebp - 0x8c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
jmp 0x1018051
lea eax, [ebp - 0x3c]
push eax
push 4
push ebx
push 0x1017e10
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp - 0x34], eax
jne 0x10180eb
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x8c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x84]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
jmp 0x1018028
cmp dword [ebp + 0xc], ebx
jle 0x101810f
cmp dword [ebp + 0xc], 2
jne 0x10180fd
mov eax, 0x100225c
jmp 0x1018112
cmp dword [ebp + 0xc], 3
mov eax, 0x1002250
je 0x1018112
mov eax, 0x1001fe8
jmp 0x1018112
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
push eax
push dword [ebp - 0x84]
call esi
pop ecx
pop ecx
push dword [ebp - 0x40]
push dword [ebp - 0x8c]
call esi
pop ecx
pop ecx
call fcn.01018efd
push dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x88]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
call esi
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x14]
pop ecx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x20]
push ebx
mov dword [ebp - 0x78], eax
mov al, byte [ebp + 0x18]
push ebx
mov byte [ebp - 0x70], al
mov al, byte [ebp + 0x1c]
push ebx
push ebx
mov byte [ebp - 0x6f], al
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x74], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp + 0x28]
mov dword [ebp - 0x6c], ebx
push dword [ebp + 0x24]
mov byte [ebp - 0x6e], bl
call fcn.010176f3
test eax, eax
jne 0x10181ef
push dword [ebp - 0x88]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x8c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x84]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, 0x8007000e
call fcn.01015971
mov eax, esi
jmp 0x1018213
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 1
push dword [ebp - 0x44]
call fcn.0101f97b
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0102e95a
leave
ret 0x28