Function at 0x10007990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x25d
mov edi, ebx
lea edx, [ebx + 0x196]
mov dword [0x10001008], 1
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ax, word [edx]
mov dword [0x1000100c], eax
mov ax, word [ebx + 0x192]
cmp ax, 0x64
je 0x100079f8
cmp ax, 0x65
je 0x100079f8
cmp ax, 2
je 0x100079f8
lea edi, [ebx + 0x198]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 0x970], 0x64
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov word [ebx + 0x968], cx
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edx
push 0x100077f0
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
xor eax, eax
mov ax, word [ebx + 0x192]
cmp eax, 0x65
ja case.0x10007a31.10
xor ecx, ecx
mov cl, byte [eax + 0x10007f18]
jmp dword [ecx*4 + 0x10007eec]
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10007f80
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10007a4d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10008360
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007a9d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x100080c0
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10007aed
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10008660
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007b3d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebx + 0x198]
mov word [ebx + 0x968], 0xa
rep stosd dword es:[edi], eax
xor edi, edi
cmp word [ebx + 0x968], di
jbe 0x10007bd4
push 0xc8
push 1
call fcn.10007740
xor edx, edx
add esp, 8
mov byte [ebx + edi + 0x198], al
mov dx, word [ebx + 0x968]
inc edi
cmp edi, edx
jl 0x10007bb0
push 0
push 0
push ebx
push 0x10008460
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007b8d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebx + 0x198]
mov word [ebx + 0x968], 0x14
rep stosd dword es:[edi], eax
xor edi, edi
cmp word [ebx + 0x968], di
jbe 0x10007c84
push 0xc8
push 1
call fcn.10007740
xor edx, edx
add esp, 8
mov byte [ebx + edi + 0x198], al
mov dx, word [ebx + 0x968]
inc edi
cmp edi, edx
jl 0x10007c60
push 0
push 0
push ebx
push 0x10007f80
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007c28
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10008800
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10007cdc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10007f80
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007d2c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10008460
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10007d7c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
call fcn.10007870
test eax, eax
mov dword [ebp + 8], 0
je 0x10007e25
cmp word [ebx + 0x194], 0
jbe case.0x10007a31.10
push 0
push 0
push ebx
push 0x10008660
push 0
push 0
call esi
push eax
call edi
push 0
push 0
push ebx
push 0x10008800
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
add eax, 2
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007dd5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
cmp word [ebx + 0x194], 0
jbe case.0x10007a31.10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebx + 0x198]
mov word [ebx + 0x968], 0x14
rep stosd dword es:[edi], eax
xor edi, edi
cmp word [ebx + 0x968], di
jbe 0x10007e8f
push 0xc8
push 1
call fcn.10007740
xor edx, edx
add esp, 8
mov byte [ebx + edi + 0x198], al
mov dx, word [ebx + 0x968]
inc edi
cmp edi, edx
jl 0x10007e6b
push 0
push 0
push ebx
push 0x10007f80
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0
push 0
push ebx
push 0x10008460
push 0
push 0
call esi
push eax
call edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
add eax, 2
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10007e33
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4