Function at 0x100f40b0
Capabilities:
Resume thread

Disassembly:
sub esp, 0x2dc
mov eax, dword [0x101ce00c]
xor eax, esp
mov dword [esp + 0x2d8], eax
mov eax, dword [esp + 0x2e0]
push ebp
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0xc], eax
je 0x100f40e0
mov ecx, dword [0x101e5efc]
mov dword [eax], ecx
mov ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101e5ef4], eax
je 0x100f410b
mov eax, 0x10dd
pop ebp
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.101180ca
add esp, 0x2dc
ret 4
cmp dword [0x101e5ef8], ebp
je 0x100f4121
push eax
pop eax
call fcn.100f3fb0
test esi, esi
jmp 0x100f442b
push ebx
push esi
push edi
test ebx, ebx
mov edx, edx
test bl, bl
mov esi, dword [0x101e5f04]
cmp esi, ebp
je 0x100f4215
mov ebx, 0xd
lea ecx, [ecx]
cmp dword [esi + 4], ebp
je 0x100f41be
mov eax, dword [esi + 0x10]
mov eax, eax
mov edx, dword [esi + 0x10]
mov edi, dword [edx + 0x20]
push ecx
pop ecx
mov ecx, dword [esi + 0x10]
movzx edx, byte [ecx + 0x17]
cmp edi, edx
jge 0x100f4192
lea ecx, [ecx]
mov dword [esp + 0x10], ebp
test cl, cl
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x10]
push ecx
push ebp
push eax
add edx, edi
push edx
call fcn.100f4bc0
push ecx
pop ecx
cmp dword [esp + 0x10], ebp
jne 0x100f4192
mov edi, eax
sub edi, dword [esi + 0x10]
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esi + 0x10]
movzx edx, byte [ecx + 0x17]
cmp edi, edx
jl 0x100f4160
mov eax, dword [esi + 0x10]
movzx ecx, byte [eax + 0x17]
cmp edi, ecx
je 0x100f41b2
mov dword [0x101e5ef8], ebx
mov ah, ah
mov edx, dword [esi + 8]
mov dword [0x101e5efc], edx
xchg ebx, eax
xchg ebx, eax
mov eax, eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
push ebx
pop ebx
jmp 0x100f420b
mov bh, bh
xchg ebx, eax
xchg ebx, eax
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
add eax, dword [esi + 0xc]
lea edx, [eax + 5]
mov ebx, ebx
mov byte [eax], 0xe9
add eax, 1
sub ecx, edx
mov dword [eax], ecx
test edx, edx
mov ch, ch
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x18]
add eax, 4
cmp eax, ecx
jae 0x100f41fb
mov edi, edi
mov byte [eax], 0xcc
add eax, 1
nop
cmp eax, ecx
jb 0x100f41f0
mov edx, edx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
mov bh, bh
mov al, al
test cl, cl
mov esi, dword [esi]
cmp esi, ebp
jne 0x100f4140
mov edi, dword [0x101e5f00]
cmp edi, ebp
je 0x100f42ee
mov ebp, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadContext]
nop
nop
mov dword [esp + 0x1c], 0x10001
mov ecx, ecx
mov eax, dword [edi + 4]
lea edx, [esp + 0x1c]
push edx
push eax
call ebp
test eax, eax
je 0x100f42e2
mov esi, dword [0x101e5f04]
test esi, esi
je 0x100f42e2
mov eax, dword [esp + 0xd4]
cmp dword [esi + 4], 0
je 0x100f429d
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jb 0x100f42dc
lea edx, [ecx + 4]
cmp eax, edx
jae 0x100f42dc
sub eax, ecx
mov dword [esp + 0xd4], eax
push ebx
pop ebx
mov eax, dword [esi + 0xc]
add dword [esp + 0xd4], eax
test ch, ch
mov edx, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
push edx
call ebx
test bl, bl
jmp 0x100f42d5
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jb 0x100f42dc
mov edx, dword [esi + 0x10]
movzx edx, byte [edx + 0x17]
add edx, ecx
cmp eax, edx
jae 0x100f42dc
sub eax, ecx
mov dword [esp + 0xd4], eax
mov edi, edi
mov eax, dword [esi + 0x10]
add dword [esp + 0xd4], eax
mov cl, cl
mov edx, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
push edx
call ebx
test al, al
mov eax, dword [esp + 0xd4]
mov esi, dword [esi]
test esi, esi
jne 0x100f4263
mov edi, dword [edi]
test edi, edi
jne 0x100f4230
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov bh, bh
mov esi, dword [0x101e5f04]
cmp esi, ebp
je 0x100f43a6
mov ebp, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea esp, [esp]
mov eax, eax
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.100c6030
test dh, dh
mov edx, dword [esi + 0x10]
movzx eax, byte [edx + 0x17]
mov ecx, dword [esi + 0xc]
push eax
push ecx
push ebx
call ebp
test ch, ch
xor ecx, ecx
cmp dword [esi + 4], ecx
je 0x100f4389
mov eax, dword [esi + 0x10]
cmp eax, ecx
je 0x100f4389
mov edx, eax
and edx, 0xffff0000
mov bh, bh
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov eax, eax
mov edi, dword [edx + 8]
mov dword [eax + 0x18], edi
push ecx
pop ecx
mov dword [edx + 8], eax
test esi, esi
test eax, eax
mov dword [esi + 0x10], ecx
mov dh, dh
test ebx, ebx
mov edi, dword [esi]
test esi, esi
push esi
call fcn.10106b00
add esp, 4
test edx, edx
mov esi, edi
test edx, edx
test edi, edi
jne 0x100f4310
xor ebp, ebp
mov dword [0x101e5f04], ebp
mov bl, bl
mov esi, dword [0x101e5ee8]
cmp esi, ebp
je 0x100f43d5
xchg ebx, eax
xchg ebx, eax
lea edx, [esp + 0x14]
push edx
push 0x20
push 0x10000
push esi
call fcn.100c6030
test ecx, ecx
mov esi, dword [esi + 4]
cmp esi, ebp
jne 0x100f43b8
mov ch, ch
mov esi, dword [0x101e5f00]
cmp esi, ebp
je 0x100f4406
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 4]
push eax
call ebx
mov ebp, ebp
mov edi, dword [esi]
test ecx, ecx
push esi
call fcn.10106b00
add esp, 4
mov bl, bl
mov esi, edi
test bh, bh
cmp edi, ebp
jne 0x100f43e7
mov dword [0x101e5f00], ebp
test ah, ah
mov dword [0x101e5ef4], ebp
push ecx
pop ecx
mov eax, dword [esp + 0x18]
cmp eax, ebp
pop edi
pop esi
pop ebx
je 0x100f442b
mov ecx, dword [0x101e5efc]
mov dword [eax], ecx
test dl, dl
mov ecx, dword [esp + 0x2dc]
mov eax, dword [0x101e5ef8]
pop ebp
xor ecx, esp
call fcn.101180ca
add esp, 0x2dc
ret 4