Function at 0x40f058
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x38c
mov edi, dword [eax + 0x40]
mov dword [eax + 0x98], 0x40010001
movd xmm0, edi
punpckldq xmm0, xmm0
movq qword [eax + 0x28], xmm0
mov eax, dword [eax + 0x38]
cmp eax, 9
ja case.0x40eb94.0
jmp dword [eax*4 + 0x435bf8]
mov edx, dword [ebx + 0x48]
mov esi, dword [ebx + 0x44]
mov ebx, dword [ebx + 0x3c]
mov dword [ebp - 0x34c], edx
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, dword [ebp - 0x34c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str._08lx:_08lx:_rip_error_lu_type_lu_n
mov dword [esp + 0x14], edx
mov dword [esp], eax
call fcn.0040b7a0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x42c7b0], 8
jne 0x40f3f0
mov eax, dword [ebx + 0x44]
cmp eax, 0x406d1388
je 0x40f340
cmp eax, 0xc0000008
je 0x40ebe2
mov eax, dword [ebx + 0x9c]
mov esi, dword [eax + 0x1c]
add eax, 0x1c
mov edi, dword [sym.imp.kernel32.dll_SuspendThread]
cmp esi, eax
jne 0x40ec4d
jmp 0x40ef6b
mov dword [esi + 0xc8], 1
mov eax, dword [ebx + 0x9c]
mov esi, dword [esi]
add eax, 0x1c
cmp esi, eax
je 0x40ef6b
mov eax, dword [esi + 0xc8]
test eax, eax
jne 0x40ec30
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x40ec30
mov edx, dword [ebx + 0x4c]
mov esi, dword [ebx + 0x3c]
mov dword [ebp - 0x34c], edx
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, dword [ebp - 0x34c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str._08lx:_08lx:_create_thread_D___p_n
mov dword [esp], eax
mov dword [esp + 0x10], edx
call fcn.0040b7a0
mov eax, dword [ebx + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x9c]
mov dword [esp], eax
call fcn.00424a90
jmp 0x40ebe2
mov eax, dword [ebx + 0x48]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp], 0x42c7a0
mov dword [esp + 4], eax
call fcn.00424600
mov dword [ebx + 0x9c], eax
test eax, eax
je 0x40ebe2
mov dword [ebp - 0x344], 0x100
lea edx, [ebp - 0x344]
lea esi, [ebp - 0x218]
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_QueryFullProcessImageNameW]
sub esp, 0x10
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x9c]
mov dword [esp], eax
call fcn.00424770
mov eax, dword [ebx + 0x58]
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x60]
mov edi, dword [ebx + 0x54]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x350], edx
mov edx, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x354], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x358], eax
mov dword [esp], 2
mov dword [ebp - 0x35c], edx
call edx
mov ecx, dword [ebp - 0x34c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x360]
mov dword [esp + 0x18], ecx
mov edx, dword [ebp - 0x350]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0x354]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x358]
mov dword [esp + 4], str._04lx:_04lx:_create_process__ls__p___p___lu__lu___n
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.0040b7a0
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x9c]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.00424820
mov edx, dword [ebp - 0x35c]
test eax, eax
jne 0x40ee30
test byte [0x42c7b0], 2
je 0x40ee30
mov dword [ebp - 0x34c], edx
mov dword [esp + 0xc], 0x435a25
mov dword [esp + 8], str.handle_debug_event
mov dword [esp + 4], 0x42c7b0
mov dword [esp], 1
call fcn.0040baa0
mov edx, dword [ebp - 0x34c]
nop
mov ecx, dword [ebx + 0x60]
mov eax, dword [ebx + 0x40]
mov edi, dword [ebx + 0x3c]
mov dword [ebp - 0x350], ecx
mov dword [ebp - 0x34c], eax
mov dword [esp], 2
call edx
mov ecx, dword [ebp - 0x350]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp - 0x34c]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x435a40
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call fcn.0040b7a0
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 0x50]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x9c]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.00424990
mov eax, dword [ebx + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x4c]
jmp 0x40ecad
mov edx, dword [ebx + 0x44]
mov esi, dword [ebx + 0x3c]
mov dword [ebp - 0x34c], edx
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, dword [ebp - 0x34c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str._08lx:_08lx:_exit_thread___lu__n
mov dword [esp], eax
mov dword [esp + 0x10], edx
call fcn.0040b7a0
mov eax, dword [ebx + 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x9c]
mov dword [esp], eax
call fcn.00424a50
test eax, eax
je 0x40ebe2
mov dword [esp], eax
call fcn.00424b70
jmp 0x40ebe2
mov edx, dword [ebx + 0x44]
mov esi, dword [ebx + 0x3c]
mov dword [ebp - 0x34c], edx
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, dword [ebp - 0x34c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str._08lx:_08lx:_exit_process___lu__n
mov dword [esp], eax
mov dword [esp + 0x10], edx
call fcn.0040b7a0
mov eax, dword [ebx + 0x9c]
mov dword [esp], eax
call fcn.00424c00
mov dword [ebx + 0x9c], 0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x218]
mov dword [ebp - 0x35c], edx
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], edi
mov eax, dword [ebx + 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x54]
mov dword [esp], eax
call fcn.0041d9f0
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x48]
mov esi, dword [ebx + 0x40]
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0x350], edx
mov dword [ebp - 0x354], esi
mov esi, dword [ebx + 0x3c]
mov dword [ebp - 0x34c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, dword [ebp - 0x358]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x34c]
mov dword [esp + 0x18], ecx
mov edx, dword [ebp - 0x350]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0x354]
mov dword [esp + 8], esi
mov dword [esp + 4], str._04lx:_04lx:_loads_DLL__ls___p___lu__lu___n
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call fcn.0040b7a0
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 0x48]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x9c]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.00424990
mov edx, dword [ebp - 0x35c]
test edx, edx
je 0x40ebe2
jmp 0x40ec12
mov ecx, dword [ebx + 0x44]
mov dword [ebp - 0x350], edx
mov esi, dword [ebx + 0x3c]
mov dword [ebp - 0x34c], ecx
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, dword [ebp - 0x34c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str._08lx:_08lx:_unload_DLL___p_n
mov dword [esp], eax
mov dword [esp + 0x10], ecx
call fcn.0040b7a0
mov eax, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x9c]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.dbghelp.dll_SymUnloadModule
mov edx, dword [ebp - 0x350]
sub esp, 8
test edx, edx
je 0x40ebe2
jmp 0x40ec12
lea esi, [ebp - 0x218]
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], esi
movzx eax, word [ebx + 0x48]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x9c]
mov dword [esp], eax
call fcn.00416d30
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x40f320
mov dword [esp + 4], 0xffffffff
mov edi, 0x4359e3
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
test eax, eax
jne 0x40f21a
cmp byte [ebp - 0x218], 0
je 0x40f493
lea eax, [ebp - 0x217]
mov edi, esi
mov esi, ebx
mov dword [esp], eax
call sub.ucrtbase.dll_strlen
mov byte [ebp - 0x344], 0x22
lea edx, [ebp - 0x343]
mov dword [ebp - 0x34c], eax
jmp 0x40f1b3
cmp al, 9
je 0x40f308
cmp al, 0xa
jne 0x40f2b7
movzx eax, word [0x43670a]
add edx, 2
mov word [edx - 2], ax
nop
mov eax, dword [ebp - 0x34c]
mov ecx, dword [ebp - 0x34c]
sub eax, 1
test ecx, ecx
jle 0x40f1e8
lea ecx, [ebp - 0x221]
cmp ecx, edx
jb 0x40f1e8
mov dword [ebp - 0x34c], eax
movzx eax, byte [edi]
add edi, 1
cmp al, 0xd
je 0x40f298
jle 0x40f170
cmp al, 0x22
je 0x40f2f0
cmp al, 0x5c
jne 0x40f2ab
movzx eax, word [0x436712]
add edx, 2
mov word [edx - 2], ax
jmp 0x40f190
test eax, eax
mov ebx, esi
mov byte [edx], 0x22
jle 0x40f43a
movzx eax, word [0x436716]
mov byte [edx + 3], 0x2e
mov word [edx + 1], ax
lea eax, [edx + 4]
mov byte [eax], 0
lea eax, [ebp - 0x344]
mov dword [esp], eax
call fcn.0042a760
mov edi, eax
mov esi, dword [ebx + 0x40]
mov ebx, dword [ebx + 0x3c]
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 0x10], edi
mov dword [esp + 4], str._08lx:_08lx:_output_debug_string___s__n
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp], eax
call fcn.0040b7a0
jmp 0x40ebe2
test byte [0x42c7b0], 1
je 0x40ec12
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0xc], str._08lx:_08lx:_unknown_event___lu__n
mov dword [esp + 8], str.handle_debug_event
mov dword [esp + 4], 0x42c7b0
mov dword [esp + 0x10], eax
mov dword [esp], 0
call fcn.0040baa0
jmp 0x40ec12
movzx eax, word [0x43670c]
add edx, 2
mov word [edx - 2], ax
jmp 0x40f190
lea ebx, [eax - 0x20]
cmp bl, 0x5e
jbe 0x40f430
movzx ebx, word [0x436714]
xor ecx, ecx
add edx, 4
mov word [edx - 4], bx
mov ebx, eax
and eax, 0xf
shr bl, 4
movzx ebx, bl
mov cl, byte [ebx + str.0123456789abcdefhandle_exception]
mov ebx, ecx
mov bh, byte [eax + str.0123456789abcdefhandle_exception]
mov word [edx - 2], bx
jmp 0x40f190
movzx eax, word [0x436710]
add edx, 2
mov word [edx - 2], ax
jmp 0x40f190
movzx eax, word [0x43670e]
add edx, 2
mov word [edx - 2], ax
jmp 0x40f190
movzx esi, si
mov dword [esp], 0x434e2a
mov dword [esp + 4], esi
call fcn.0040c7c0
mov edi, eax
jmp 0x40f21a
cmp dword [ebx + 0x58], 0x1000
mov eax, dword [ebx + 0x9c]
jne 0x40ec18
mov edx, dword [ebx + 0x60]
cmp edx, 0xffffffff
je 0x40f442
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00424a50
test eax, eax
je 0x40f456
mov eax, dword [ebx + 0x9c]
lea ecx, [ebp - 0x344]
lea esi, [ebp - 0x218]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 9
mov dword [esp + 8], esi
mov ecx, dword [ebx + 0x5c]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
je 0x40ebe2
cmp dword [ebp - 0x344], 9
jne 0x40ebe2
mov ebx, dword [ebx + 0x60]
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.Thread_ID_04lx_renamed_to___.9s__n
mov dword [esp], eax
mov dword [esp + 8], ebx
call fcn.0040b7a0
jmp 0x40ebe2
mov eax, dword [ebx + 0x44]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0xc], str._08lx:_08lx:_exception_code0x_08lx_n
mov dword [esp + 8], str.handle_debug_event
mov dword [esp + 4], 0x42c7b0
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.0040baa0
jmp 0x40ebfd
mov byte [edx], al
add edx, 1
jmp 0x40f190
lea eax, [edx + 1]
jmp 0x40f207
mov edx, dword [ebx + 0x40]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00424a50
jmp 0x40f36b
test byte [0x42c7b0], 2
je 0x40ebe2
mov eax, dword [ebx + 0x60]
mov dword [esp + 0xc], str.Cannot_set_name_of_thread__04lx_n
mov dword [esp + 8], 0x4365d8
mov dword [esp + 4], 0x42c7b0
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.0040baa0
jmp 0x40ebe2
movzx eax, word [str.___n_r_t_x..41]
mov word [ebp - 0x344], ax
lea eax, [ebp - 0x342]
jmp 0x40f207