Function at 0x4c7aa520
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4c7aa53c
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [edi + 0x88e0]
test esi, esi
je 0x4c7aa575
cmp dword [esi + 8], 0
jne 0x4c7aa55a
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
mov ecx, dword [eax]
cmp dword [ecx + 0xc], 0
jne 0x4c7aa57f
test byte [edi + 8], 0x20
je 0x4c7aa57f
push edi
call fcn.4c7ab330
test eax, eax
jne 0x4c7aa57f
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [eax]
cmp ebx, eax
mov dword [ebp - 4], ebx
je 0x4c7aa64f
push 0x206
lea edx, [ebp - 0x20e]
push 0
push edx
mov word [ebp - 0x210], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 1
lea eax, [ebp + 0xb]
push eax
push edi
mov byte [ebp + 0xb], 1
call fcn.4c7a4c10
test eax, eax
je 0x4c7aa6a4
cmp dword [ebx + 0x28], 8
jb 0x4c7aa5d4
mov ebx, dword [ebx + 0x14]
jmp 0x4c7aa5d7
add ebx, 0x14
push 0
push ebx
lea ecx, [ebp - 0x210]
push ecx
call fcn.4c7a3750
test eax, eax
jne 0x4c7aa608
push 0xe7a
push 0x4c782b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x210]
push ecx
push edi
call fcn.4c7a4c10
test eax, eax
je 0x4c7aa6ab
push edi
call fcn.4c7a5660
test eax, eax
je 0x4c7aa714
lea ecx, [ebp - 4]
call fcn.4c7a5500
mov ebx, dword [ebp - 4]
cmp ebx, dword [esi + 4]
jne 0x4c7aa590
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
push eax
mov ecx, esi
call fcn.4c7a6b50
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
cmp dword [edi + 0x3ef0], ebx
lea esi, [edi + 0x3ef0]
mov dword [ebp - 8], ebx
jne 0x4c7aa7d1
push edi
call fcn.4c7a56c0
test eax, eax
jne 0x4c7aa6b2
push 0x36b2
push edi
call fcn.4c7a38a0
push 0xe8e
jmp 0x4c7aa6fb
push 0xe74
jmp 0x4c7aa6fb
push 0xe7e
jmp 0x4c7aa6fb
push edi
call fcn.4c7a3510
test eax, eax
jne 0x4c7aa6ce
push 0x36b2
push edi
call fcn.4c7a38a0
push 0xe94
jmp 0x4c7aa6fb
lea ecx, [ebp - 8]
push ecx
push 4
push edi
push 0x4c7a9aa0
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi], eax
jne 0x4c7aa71f
push 0x36b2
push edi
call fcn.4c7a38a0
push 0xe9b
push 0x4c782b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp eax, ebx
jne 0x4c7aa730
push 0xea4
jmp 0x4c7aa78c
lea edx, [ebp + 8]
push edx
push ebx
push 4
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4c7aa74c
push 0xea9
jmp 0x4c7aa78c
mov eax, dword [ebp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x4c7aa779
push 0xead
push 0x4c782b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4c7aa7a5
push 0xeb2
push 0x4c782b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
je 0x4c7aa7d1
push 0xebb
push 0x4c782b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
pop ebx
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4