Function at 0x544860
Capabilities:
Create thread
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x2f4
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x8903d8], eax
sub esp, 0x10
lea eax, [ebp - 0x2dc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x542ae0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x467
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateThread_failed_:___ld__n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.00543700
test ebx, ebx
je 0x544c20
mov dword [esp + 4], 0xffffffff
mov eax, dword [0x8903d8]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x2e4], eax
call eax
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SuspendThread]
mov eax, dword [0x8903d8]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x2e8], eax
call eax
lea eax, [ebp - 0x2d8]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [ebp - 0x2d8], 0x10007
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_GetThreadContext]
mov dword [esp], ebx
mov dword [ebp - 0x2e0], eax
call eax
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x474
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.GetThreadContext_failed_:___lu__n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00543700
test edi, edi
jne 0x544bb0
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x485
mov eax, dword [esi + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
xor eax, eax
cmp edi, 1
sete al
mov dword [esp + 4], str.Previous_suspend_count___ld__instead_of_1__last_error_:___ld__n
mov dword [esp], eax
call fcn.00543700
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
mov eax, dword [ebp - 0x2e4]
call eax
sub esp, 8
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x489
mov eax, dword [0x8903dc]
mov dword [esp + 4], str.test_value__d_n
cmp eax, 0xa
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00543700
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10007
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [ebp - 0x2e0]
call eax
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x48e
mov edx, dword [esi + 0x34]
test edi, edi
je 0x544b60
mov ecx, dword [0x8f0770]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.got__d_with__lu__expected_FALSE_with_ERROR_GEN_FAILURE_or_ERROR_ACCESS_DENIED__n
mov edi, dword fs:[0x18]
call fcn.00543700
lea eax, [ebp - 0x2d8]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetThreadContext]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x496
mov edx, dword [edi + 0x34]
test esi, esi
jne 0x544b98
mov eax, 1
cmp edx, 0x1f
je 0x544b2f
cmp edx, 5
je 0x544b2f
mov edi, dword [0x8f0770]
cmp edx, 6
sete cl
xor eax, eax
test edi, edi
sete al
and eax, ecx
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.got__d_with__lu__expected_FALSE_with_ERROR_GEN_FAILURE_or_ERROR_ACCESS_DENIED__n
call fcn.00543700
mov dword [esp], ebx
mov eax, dword [ebp - 0x2e8]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esi + 0x34], 0x1f
mov eax, 1
je 0x544ab0
cmp dword [esi + 0x34], 5
je 0x544ab0
cmp dword [esi + 0x34], 6
mov esi, dword [0x8f0770]
sete al
xor ecx, ecx
test esi, esi
sete cl
and eax, ecx
jmp 0x544ab0
mov ecx, dword [0x8f0770]
xor eax, eax
test ecx, ecx
sete al
jmp 0x544b2f
mov eax, dword [ebp - 0x214]
mov dword [eax - 4], 0xa
mov edx, dword [ebp - 0x220]
mov dword [eax - 8], edx
lea eax, [ebp - 0x2d8]
sub dword [ebp - 0x214], 8
mov dword [ebp - 0x220], 0x542cf0
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetThreadContext]
sub esp, 8
mov edi, eax
mov eax, 0x480
call fcn.00542db0
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.SetThreadContext_failed_:___ld__n
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00543700
jmp 0x5449c0
mov eax, 0x46a
call fcn.00542db0
mov dword [esp], str.Thread_creation_failed__skipping_rest_of_test_n
call fcn.00543170
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret