Function at 0x10033126
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create process on windows
Create process suspended
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
push ebx
push esi
push edi
mov dword [ebp - 0x218], 0x94
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x208], 2
jne 0x10033159
mov byte [0x1003e598], 1
xor ecx, ecx
mov cl, byte [0x1003e598]
test ecx, ecx
jne 0x1003316b
cli
not esp
not esp
sti
mov edx, dword [0x1003b044]
xor edx, dword [0x1003b04c]
xor edx, dword [0x1003b06c]
and edx, 4
test edx, edx
je 0x1003318b
mov byte [0x1003e56e], 1
mov eax, dword [0x1003b044]
xor eax, dword [0x1003b04c]
xor eax, dword [0x1003b06c]
and eax, 8
test eax, eax
je 0x100331aa
mov byte [0x1003e56f], 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x1003b050]
xor ecx, dword [0x1003b04c]
xor ecx, dword [0x1003b048]
add eax, ecx
mov dword [0x1003e57c], eax
mov edx, dword [0x1003b060]
xor edx, dword [0x1003b064]
xor edx, dword [0x1003b06c]
add edx, 0xfff
shr edx, 0xc
mov dword [0x1003e584], edx
mov eax, dword [0x1003e584]
shl eax, 2
push eax
call fcn.100347cd
add esp, 4
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
mov dword [0x1003e58c], ecx
mov edx, dword [0x1003e584]
shl edx, 2
push edx
call fcn.100347cd
add esp, 4
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [0x1003e574], eax
mov ecx, dword [0x1003e584]
shl ecx, 2
push ecx
call fcn.100347cd
add esp, 4
mov dword [ebp - 0x4bc], eax
mov edx, dword [ebp - 0x4bc]
mov dword [0x1003e590], edx
push 0x1000
call fcn.100347cd
add esp, 4
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [0x1003e594], eax
mov ecx, dword [0x1003e584]
shl ecx, 2
push ecx
call fcn.100347cd
add esp, 4
mov dword [ebp - 0x4c4], eax
mov edx, dword [ebp - 0x4c4]
mov dword [0x1003e570], edx
mov eax, dword [0x1003b074]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x184], 0
jmp 0x100332be
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x184]
cmp edx, dword [0x1003e584]
jge 0x100336ad
mov eax, dword [ebp - 0x184]
mov ecx, dword [0x1003e58c]
mov dword [ecx + eax*4], 0xffffffff
mov dword [ebp - 0x4f0], pe_nt_image_headers32
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4e0], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4ec], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4e8], edx
mov ecx, dword [ebp - 0x4e0]
imul ecx, dword [ebp - 0x4e8]
mov edx, dword [ebp - 0x4e4]
imul edx, dword [ebp - 0x4e8]
mov eax, dword [ebp - 0x4e0]
imul eax, dword [ebp - 0x4ec]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x170]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x4f0]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x504], pe_nt_image_headers32
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4f4], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x500], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4fc], edx
mov ecx, dword [ebp - 0x4f4]
imul ecx, dword [ebp - 0x4fc]
mov edx, dword [ebp - 0x4f8]
imul edx, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x4f4]
imul eax, dword [ebp - 0x500]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x170]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x504]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x518], pe_nt_image_headers32
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x508], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x514], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x510], edx
mov ecx, dword [ebp - 0x508]
imul ecx, dword [ebp - 0x510]
mov edx, dword [ebp - 0x50c]
imul edx, dword [ebp - 0x510]
mov eax, dword [ebp - 0x508]
imul eax, dword [ebp - 0x514]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x170]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x518]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x52c], pe_nt_image_headers32
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x170]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x51c], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x528], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x524], edx
mov ecx, dword [ebp - 0x51c]
imul ecx, dword [ebp - 0x524]
mov edx, dword [ebp - 0x520]
imul edx, dword [ebp - 0x524]
mov eax, dword [ebp - 0x51c]
imul eax, dword [ebp - 0x528]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x170]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x52c]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4d8], eax
mov edx, dword [ebp - 0x4d4]
shl edx, 8
mov eax, dword [ebp - 0x4d0]
shl eax, 0x10
mov ecx, dword [ebp - 0x4dc]
shl ecx, 0x18
or ecx, eax
or ecx, edx
or ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x184]
mov eax, dword [0x1003e574]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 0x184]
mov edx, dword [0x1003e590]
mov dword [edx + ecx*4], 0
mov eax, dword [ebp - 0x184]
mov ecx, dword [0x1003e570]
mov dword [ecx + eax*4], 0
jmp 0x100332af
mov edx, dword [0x1003e584]
sar edx, 1
add edx, 1
mov dword [0x1003b42c], edx
xor eax, eax
mov al, byte [0x1003e56f]
test eax, eax
jne 0x100336de
cmp dword [0x1003b42c], 6
jae 0x100336dc
mov dword [0x1003b42c], 6
jmp 0x100336f1
cmp dword [0x1003b42c], 0x12
jae 0x100336f1
mov dword [0x1003b42c], 0x12
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x178], eax
push str.OutputDebugStringA
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x180], eax
push str.OutputDebugStringW
mov edx, dword [ebp - 0x178]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x270]
mov dword [0x1003e578], eax
lea ecx, [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dl, byte [0x1003e59c]
mov byte [ebp - 0x480], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x47f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x1003e5a0]
mov byte [ebp - 0x10c], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x100337bc
cmp dword [ebp - 0x254], 0
jne 0x100337bc
lea edx, [ebp - 0x480]
push edx
call fcn.10033097
add esp, 4
and eax, 0xff
test eax, eax
je 0x100337bc
lea eax, [ebp - 0x480]
mov dword [ebp - 0x254], eax
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100337db
xor al, al
jmp 0x10033eb5
mov edx, dword [0x1003e578]
push edx
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10033814
xor al, al
jmp 0x10033eb5
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x21c], eax
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x37c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x37c]
add eax, dword [ecx + 0x28]
mov dword [ebp - 0x17c], eax
mov edx, dword [ebp - 0x17c]
push edx
push 1
mov eax, dword [0x1003e578]
push eax
call fcn.100343f5
add esp, 0xc
mov ecx, dword [ebp - 0x17c]
push ecx
mov edx, dword [0x1003e578]
push edx
call fcn.100344db
add esp, 8
mov eax, dword [0x1003e578]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x1003e578]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
mov ecx, dword [0x1003e578]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x17c]
push eax
push 0
mov ecx, dword [0x1003e578]
push ecx
call fcn.100343f5
add esp, 0xc
lea edx, [ebp - 0x16c]
mov dword [ebp - 0x174], edx
mov byte [ebp - 4], 1
mov eax, dword [0x1003e578]
mov ecx, dword [eax]
push ecx
call fcn.100344b9
add esp, 4
and eax, 0xff
test eax, eax
je 0x10033eb3
push 0x3e8
mov edx, dword [ebp - 0x174]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x10033eae
mov dword [ebp - 0x274], str.None
mov eax, dword [ebp - 0x174]
mov ecx, dword [0x1003e578]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x10033e8f
mov dword [ebp - 0x484], 0x80010001
mov eax, dword [ebp - 0x174]
cmp dword [eax], 1
jne 0x10033c5e
mov dword [ebp - 0x274], str.Exception_Debug_Event
xor ecx, ecx
mov cl, byte [0x1003e56e]
test ecx, ecx
je 0x10033a3c
mov edx, dword [ebp - 0x174]
cmp dword [edx + 0xc], 0x80000001
jne 0x10033a3c
mov dword [ebp - 0x274], str.Guard_Page
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x48c], ecx
mov edx, dword [ebp - 0x48c]
sub edx, dword [0x1003e57c]
shr edx, 0xc
mov dword [ebp - 0x488], edx
xor eax, eax
mov al, byte [0x1003e56f]
test eax, eax
je 0x100339f0
mov ecx, dword [ebp - 0x488]
sub ecx, 1
test ecx, ecx
jl 0x100339cb
push 1
mov edx, dword [ebp - 0x488]
sub edx, 1
push edx
call fcn.10033ebc
add esp, 8
mov eax, dword [ebp - 0x488]
add eax, 1
cmp eax, dword [0x1003e584]
jge 0x100339f0
push 1
mov ecx, dword [ebp - 0x488]
add ecx, 1
push ecx
call fcn.10033ebc
add esp, 8
cmp dword [ebp - 0x488], 0
jl 0x10033a37
mov edx, dword [ebp - 0x488]
cmp edx, dword [0x1003e584]
jge 0x10033a37
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
je 0x10033a2d
push 0
mov ecx, dword [ebp - 0x488]
push ecx
call fcn.10033ebc
add esp, 8
and eax, 0xff
test eax, eax
je 0x10033a37
mov dword [ebp - 0x484], 0x10002
jmp 0x10033c59
mov edx, dword [ebp - 0x174]
cmp dword [edx + 0xc], 0xc0000005
jne 0x10033c10
mov eax, dword [ebp - 0x174]
cmp dword [eax + 0x5c], 0
je 0x10033a67
mov dword [ebp - 0x274], str.Access_Violation__first_chance
jmp 0x10033a71
mov dword [ebp - 0x274], str.Access_Violation__last_chance
mov byte [ebp - 0x490], 0
xor ecx, ecx
mov cl, byte [0x1003e598]
test ecx, ecx
jne 0x10033b70
xor edx, edx
mov dl, byte [0x1003e56e]
test edx, edx
je 0x10033b70
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
je 0x10033b70
mov ecx, dword [ebp - 0x174]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x498], edx
mov eax, dword [ebp - 0x498]
sub eax, dword [0x1003e57c]
shr eax, 0xc
mov dword [ebp - 0x494], eax
xor ecx, ecx
mov cl, byte [0x1003e56f]
test ecx, ecx
je 0x10033b1e
mov edx, dword [ebp - 0x494]
sub edx, 1
test edx, edx
jl 0x10033af9
push 1
mov eax, dword [ebp - 0x494]
sub eax, 1
push eax
call fcn.10033ebc
add esp, 8
mov ecx, dword [ebp - 0x494]
add ecx, 1
cmp ecx, dword [0x1003e584]
jge 0x10033b1e
push 1
mov edx, dword [ebp - 0x494]
add edx, 1
push edx
call fcn.10033ebc
add esp, 8
cmp dword [ebp - 0x494], 0
jl 0x10033b5b
mov eax, dword [ebp - 0x494]
cmp eax, dword [0x1003e584]
jge 0x10033b5b
push 0
mov ecx, dword [ebp - 0x494]
push ecx
call fcn.10033ebc
add esp, 8
and eax, 0xff
test eax, eax
je 0x10033b5b
mov dword [ebp - 0x484], 0x10002
jmp 0x10033b6e
mov edx, dword [ebp - 0x174]
cmp dword [edx + 0x5c], 0
jne 0x10033b6e
mov byte [ebp - 0x490], 1
jmp 0x10033b83
mov eax, dword [ebp - 0x174]
cmp dword [eax + 0x5c], 0
jne 0x10033b83
mov byte [ebp - 0x490], 1
mov ecx, dword [ebp - 0x490]
and ecx, 0xff
test ecx, ecx
je 0x10033c0e
mov edx, dword [ebp - 0x174]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x4a4], eax
mov ecx, dword [ebp - 0x174]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x49c], edx
mov eax, dword [ebp - 0x174]
xor ecx, ecx
cmp dword [eax + 0x20], 0
setne cl
mov byte [ebp - 0x4a0], cl
mov edx, dword [ebp - 0x4a0]
and edx, 0xff
test edx, edx
je 0x10033be2
mov dword [ebp - 0x530], str.write_to
jmp 0x10033bec
mov dword [ebp - 0x530], str.read_from
mov eax, dword [ebp - 0x49c]
push eax
mov ecx, dword [ebp - 0x530]
push ecx
mov edx, dword [ebp - 0x4a4]
push edx
push str.Error:_Access_violation_at_0x_08X__tried_to__s_0x_08X___program_terminated.
call fcn.1003469d
add esp, 0x10
jmp 0x10033c59
mov dword [ebp - 0x274], str.Other_Debug_Event
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x4a8], ecx
mov edx, dword [ebp - 0x4a8]
mov dword [ebp - 0x534], edx
cmp dword [ebp - 0x534], 0x80000003
je 0x10033c4f
cmp dword [ebp - 0x534], 0xc0000008
je 0x10033c4f
jmp 0x10033c59
mov dword [ebp - 0x484], 0x10002
jmp 0x10033e6c
mov eax, dword [ebp - 0x174]
cmp dword [eax], 2
jne 0x10033c91
mov dword [ebp - 0x274], str.CreateThread
mov ecx, dword [0x1003b428]
add ecx, 1
mov dword [0x1003b428], ecx
mov dword [ebp - 0x484], 0x10002
jmp 0x10033e6c
mov edx, dword [ebp - 0x174]
cmp dword [edx], 4
jne 0x10033cc2
mov dword [ebp - 0x274], str.ExitThread
mov eax, dword [0x1003b428]
sub eax, 1
mov dword [0x1003b428], eax
mov dword [ebp - 0x484], 0x10002
jmp 0x10033e6c
mov ecx, dword [ebp - 0x174]
cmp dword [ecx], 5
jne 0x10033ce6
mov dword [ebp - 0x274], str.ExitProcess
mov dword [ebp - 0x484], 0x10002
jmp 0x10033e6c
mov edx, dword [ebp - 0x174]
cmp dword [edx], 8
jne 0x10033dc3
mov dword [ebp - 0x274], str.Debug_String
mov eax, dword [ebp - 0x174]
xor ecx, ecx
mov cx, word [eax + 0x12]
mov dword [ebp - 0x4b0], ecx
mov edx, dword [ebp - 0x4b0]
add edx, 2
push edx
call fcn.100347cd
add esp, 4
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4ac], eax
push 0
mov ecx, dword [ebp - 0x4b0]
add ecx, 2
push ecx
mov edx, dword [ebp - 0x4ac]
push edx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [0x1003e578]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x174]
xor edx, edx
mov dx, word [ecx + 0x10]
test edx, edx
je 0x10033d83
cmp dword [ebp - 8], 0
je 0x10033d81
mov eax, dword [ebp - 0x4ac]
push eax
call dword [ebp - 8]
jmp 0x10033d99
cmp dword [ebp - 0x180], 0
je 0x10033d99
mov ecx, dword [ebp - 0x4ac]
push ecx
call dword [ebp - 0x180]
mov edx, dword [ebp - 0x4ac]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
push eax
call fcn.100347c2
add esp, 4
mov dword [ebp - 0x484], 0x10002
jmp 0x10033e6c
mov ecx, dword [ebp - 0x174]
cmp dword [ecx], 9
jne 0x10033ddd
mov dword [ebp - 0x274], str.RIP_Event
jmp 0x10033e6c
mov edx, dword [ebp - 0x174]
cmp dword [edx], 3
jne 0x10033e62
xor eax, eax
mov al, byte [0x1003b430]
test eax, eax
je 0x10033e60
mov byte [0x1003b430], 0
mov ecx, dword [0x1003b05c]
xor ecx, dword [0x1003b048]
push ecx
mov edx, dword [0x1003e578]
mov eax, dword [edx + 8]
push eax
push str._X::DA_08X
lea ecx, [ebp - 0x378]
push ecx
call fcn.10034f9f
add esp, 0x10
lea edx, [ebp - 0x378]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10033e47
xor al, al
jmp 0x10033eb5
mov dword [ebp - 0x484], 0x10002
mov eax, dword [0x1003e578]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10033e6c
mov dword [ebp - 0x484], 0x10002
mov edx, dword [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x174]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x10033eae
push 0x10002
mov ecx, dword [ebp - 0x174]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x100338d2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret