Function at 0x2e03538c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x228], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24c], ebx
lea edi, [ebp - 0x248]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x21c
stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push ebx
push eax
mov dword [ebp - 0x224], ebx
call fcn.2e06e640
add esp, 0xc
cmp dword [0x2e0d16d8], 5
mov dword [ebp - 0x22c], ebx
je 0x2e0353f1
mov dword [0x2e090780], ebx
xor eax, eax
lea edi, [ebp - 0x238]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.2e0300e2
mov edi, dword [ebp - 0x228]
lea eax, [edi + 0x44]
push eax
lea eax, [edi + 0x40]
push eax
call fcn.2e0300b4
cmp dword [0x2e0d16d8], 5
mov dword [0x2e0d75a8], ebx
mov dword [0x2e0d75ac], ebx
je 0x2e03543d
mov dword [0x2e0d75c8], ebx
lea eax, [esi + 0x1144]
mov dword [0x2e0d75d0], eax
lea eax, [esi + 0x1160]
mov dword [0x2e0d75d4], eax
lea eax, [esi + 0x116c]
mov dword [0x2e0d75d8], eax
lea eax, [ebp - 0x238]
mov dword [0x2e0d75dc], eax
mov eax, dword [esi + 0x111c]
mov dword [0x2e0d75e0], eax
mov dword [0x2e0d75e4], ebx
mov eax, dword [esi + 0x1110]
mov dword [0x2e0d75f0], eax
mov eax, dword [esi + 0x1138]
mov dword [0x2e0d75f4], eax
mov eax, dword [esi + 0x113c]
mov dword [0x2e0d75f8], eax
lea eax, [esi + 0x1120]
mov dword [0x2e0d75fc], edi
mov dword [0x2e0d7600], eax
mov ecx, dword [esi + 0x1180]
mov dword [eax + 0x14], ecx
mov dword [0x2e0d7604], ebx
test dword [esi + 0x1140], 0x10000000
mov dword [ebp - 0x23c], eax
je 0x2e035589
cmp dword [0x2e0d16d8], ebx
jne 0x2e03553e
call fcn.2e030096
test eax, eax
je 0x2e03552b
test byte [0x2e0c5b10], 0x20
jne 0x2e03552b
push 0x2e0cfc48
push 0x104
push 0x2e0cfc58
call fcn.2e04338f
test byte [0x2e0c5b1c], 0x20
mov eax, 0x2e004998
jne 0x2e035512
mov eax, 0x2e004980
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [esi + 0x113c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp 0x2e03553e
call fcn.2e03e006
test eax, eax
je 0x2e03553e
push 0x2e001748
call fcn.2e03fc59
lea eax, [ebp - 0x224]
push eax
call fcn.2e02d2ab
push 1
lea eax, [ebp - 0x224]
push eax
call fcn.2e02e91f
test eax, eax
je 0x2e035578
lea eax, [ebp - 0x224]
push eax
push esi
push edi
call fcn.2e02fc46
test eax, eax
je 0x2e035578
mov dword [0x2e0d75a0], 1
lea eax, [ebp - 0x224]
push eax
call fcn.2e02dbaf
jmp 0x2e035795
call fcn.2e030ca7
test eax, eax
je 0x2e03562f
mov eax, dword [esi + 0x1104]
cmp eax, ebx
je 0x2e03561f
cmp word [eax], bx
je 0x2e03561f
mov dword [0x2e0c2de0], eax
mov dword [0x2e0d7604], 1
push ebx
cmp dword [esi + 0x111c], ebx
je 0x2e0355c7
call fcn.2e034dee
jmp 0x2e035795
push 0x2e03c4ef
push dword [0x2e0d1390]
push 0x67
push dword [0x2e090488]
call fcn.2e035c93
mov eax, dword [0x2e0d75c8]
cmp eax, ebx
je 0x2e035795
push 0x4e20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x2e035608
push dword [0x2e0d75c8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [0x2e0d75c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x2e0d75c8], ebx
jmp 0x2e035795
push ebx
push 0x30303030
call fcn.2e0448b0
jmp 0x2e035795
push 0x1000
push ebx
push 0x2e0c38b8
mov dword [0x2e0c2e0c], ebx
mov dword [0x2e0c2e30], ebx
mov dword [0x2e0c2e34], ebx
mov dword [0x2e0c2e38], ebx
mov dword [0x2e0c2e3c], ebx
mov dword [0x2e0c2e40], ebx
mov byte [0x2e0c3768], bl
mov dword [0x2e0c386c], ebx
mov dword [0x2e0c387c], ebx
mov dword [0x2e0c3880], ebx
mov dword [0x2e0c38b4], ebx
call fcn.2e06e640
push 0x800
push ebx
push 0x2e0c48c0
mov dword [0x2e0c48b8], ebx
mov dword [0x2e0c48bc], ebx
call fcn.2e06e640
mov edi, 0x104
push edi
push ebx
push 0x2e0c50c0
call fcn.2e06e640
push 0x800
push ebx
push 0x2e0c51c4
call fcn.2e06e640
push edi
push ebx
push 0x2e0c59c4
call fcn.2e06e640
add esp, 0x3c
lea eax, [esi + 0x800]
push edi
mov dword [0x2e0c2e60], eax
push 0x2e0c2e64
lea eax, [esi + 0x1000]
push eax
mov dword [0x2e0c5ac8], ebx
mov dword [0x2e0c5ad0], ebx
mov dword [0x2e0c2e5c], esi
call fcn.2e025e30
cmp dword [0x2e0d16d8], 5
mov eax, dword [esi + 0x1108]
mov dword [0x2e0c3884], eax
mov eax, dword [esi + 0x110c]
mov dword [0x2e0c3888], eax
mov eax, dword [esi + 0x1114]
mov dword [0x2e0c5ad4], eax
jne 0x2e035730
mov eax, dword [0x2e0d75e8]
mov dword [0x2e0d75ac], eax
push ebx
cmp dword [esi + 0x111c], ebx
je 0x2e035740
call fcn.2e034c95
jmp 0x2e03578f
push 0x2e03c4ef
push dword [0x2e0d1390]
push 0x67
push dword [0x2e090488]
call fcn.2e035c93
mov eax, dword [0x2e0d75c8]
cmp eax, ebx
je 0x2e03578f
push 0x4e20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x2e03577d
push dword [0x2e0d75c8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [0x2e0d75c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x2e0d75c8], ebx
mov edi, dword [ebp - 0x228]
xor eax, eax
inc eax
cmp dword [ebp - 0x230], ebx
je 0x2e0357ab
mov dword [esi + 0x1118], eax
mov dword [0x2e0d75a0], eax
mov ecx, dword [esi + 0x1110]
cmp ecx, ebx
je 0x2e0357d0
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
push 0x10
lea eax, [ebp - 0x24c]
push eax
push ecx
call fcn.2e0412a1
call fcn.2e030ce9
push ebx
push ebx
call dword [0x2e0c2b3c]
test eax, eax
jl 0x2e0357eb
mov dword [ebp - 0x22c], 1
cmp dword [0x2e0d16d8], 5
je 0x2e035800
cmp dword [esi + 0x111c], ebx
jne 0x2e035800
xor eax, eax
jmp 0x2e035803
xor eax, eax
inc eax
push eax
push ebx
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.2e03a73b
cmp dword [ebp - 0x22c], ebx
je 0x2e035825
call dword [0x2e0c2b38]
mov eax, dword [edi + 0x20]
cmp eax, ebx
je 0x2e035832
push eax
call fcn.2e0441d7
mov eax, dword [edi]
cmp eax, ebx
je 0x2e03583e
push eax
call fcn.2e0441d7
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x2e03584b
push eax
call fcn.2e0441d7
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x2e035858
push eax
call fcn.2e0441d7
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x2e035865
push eax
call fcn.2e0441d7
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x2e035872
push eax
call fcn.2e0441d7
mov edi, dword [edi + 0x38]
cmp edi, ebx
je 0x2e03587f
push edi
call fcn.2e0441d7
mov eax, dword [ebp - 0x234]
cmp eax, dword [0x2e0905bc]
je 0x2e035897
cmp eax, ebx
je 0x2e035897
push eax
call fcn.2e0441d7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e06e7f2
leave
ret 8