Function at 0x77c9dc52
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, 0x77d1a420
push esi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword [0x77d1e63c]
xor ebx, ebx
cmp eax, ebx
jne 0x77c9dc77
cmp dword [0x77d1e60c], 0xffffffff
je 0x77c9dc97
cmp byte [0x77d1e601], bl
je 0x77c9de20
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
ret
push ebx
push 0x40000080
push 3
push ebx
push ebx
push 0xc0000000
push 0x77c9d438
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [0x77d1e60c], eax
je 0x77cd343d
mov esi, dword [sym.imp.ntdll.dll_NtCreateEvent]
push ebx
push 1
push ebx
mov edi, 0x1f0003
push edi
push 0x77d1e790
call esi
cmp eax, ebx
jl 0x77c9de37
push 2
push ebx
push ebx
push 0x77d1e794
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
cmp eax, ebx
jl 0x77c9de37
push ebx
push 1
push ebx
push edi
push 0x77d1e750
call esi
cmp eax, ebx
jl 0x77c9de37
push ebx
push 1
push ebx
push edi
push 0x77d1e730
call esi
cmp eax, ebx
jl 0x77c9de37
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, 0x1000
push esi
push 8
push dword [eax + 0x18]
call edi
cmp eax, ebx
mov dword [0x77d1e6ac], eax
je 0x77cd3447
mov eax, dword fs:[0x18]
push esi
mov dword [0x77d1e6b4], esi
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call edi
cmp eax, ebx
mov dword [0x77d1e6b8], eax
je 0x77cd3447
mov eax, dword [0x77d1f244]
push 0xffffffffffffffff
cdq
push 0xffffd8f0
push edx
push eax
mov dword [0x77d1e6b0], esi
call fcn.77c9e322
push ebx
push ebx
push ebx
push fcn.77c9d5ec
push ebx
push ebx
mov dword [0x77d1e6e0], eax
mov dword [0x77d1e6e4], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x77d1e638], eax
je 0x77cd34f2
mov byte [0x77d1e601], 1
push 0x77d1a420
jmp 0x77c9dc84
cmp eax, 3
je 0x77cd3516
cmp eax, 1
jne 0x77c9dc83
jmp 0x77cd3516
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x77cd3443
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77cd344a
push 8
pop edi
mov eax, dword [0x77d1e60c]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.ntdll.dll_NtClose]
je 0x77cd3464
push eax
call esi
or dword [0x77d1e60c], 0xffffffff
mov eax, dword [0x77d1e790]
cmp eax, ebx
je 0x77cd3476
push eax
call esi
mov dword [0x77d1e790], ebx
mov eax, dword [0x77d1e794]
cmp eax, ebx
je 0x77cd3488
push eax
call esi
mov dword [0x77d1e794], ebx
mov eax, dword [0x77d1e750]
cmp eax, ebx
je 0x77cd349a
push eax
call esi
mov dword [0x77d1e750], ebx
mov eax, dword [0x77d1e730]
cmp eax, ebx
je 0x77cd34ac
push eax
call esi
mov dword [0x77d1e730], ebx
mov eax, dword [0x77d1e6ac]
cmp eax, ebx
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x77cd34d1
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
mov dword [0x77d1e6ac], ebx
mov eax, dword [0x77d1e6b8]
cmp eax, ebx
je 0x77cd3504
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
mov dword [0x77d1e6b8], ebx
jmp 0x77cd3504
mov dword [0x77d1e63c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0x77d1a420
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov eax, edi
jmp 0x77c9dc8c
mov eax, dword [0x77d1e638]
cmp eax, ebx
je 0x77cd3526
push eax
call dword [sym.imp.ntdll.dll_NtClose]
push ebx
push ebx
push ebx
push fcn.77c9d5ec
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x77d1e638], eax
je 0x77cd34fc
mov byte [0x77d1e601], 1
jmp 0x77c9dc83