Function at 0x1005d66
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x100a068]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], eax
mov edi, ecx
lea eax, [ebp - 0x150]
push 0x185
push 0x1001968
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x124], 0x1001930
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x140], 0x10016dc
mov dword [ebp - 0x13c], 0x10016c4
mov dword [ebp - 0x138], 0x100168c
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x150], 0x1001848
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov byte [ebp - 0x144], 1
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.WLDAP32.dll_Ordinal_145]
cmp eax, ebx
pop ecx
pop ecx
mov dword [edi + 0x3c], eax
jne 0x1005e09
mov dword [ebp - 0x50], 0x51
lea ecx, [ebp - 0x128]
push ecx
xor esi, esi
push 0x98
inc esi
push eax
mov dword [ebp - 0x128], esi
call dword [sym.imp.WLDAP32.dll_Ordinal_14]
add esp, 0xc
cmp dword [ebp - 0x50], ebx
jne 0x100631b
mov eax, dword [edi + 0x3c]
push 0x1086
push ebx
mov dword [eax + 0x50], 3
push ebx
push dword [edi + 0x3c]
call dword [sym.imp.WLDAP32.dll_Ordinal_73]
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 0x50], eax
je 0x1005f48
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_18]
mov edi, eax
mov eax, dword [0x100a1e4]
cmp eax, ebx
pop ecx
je 0x100631b
cmp dword [eax + 0xe4], ebx
jge 0x1005e99
cmp dword [eax + 4], ebx
je 0x100631b
push ebx
push 0x1100
call sym.ISMSERV.EXE_DoLogOverride
test eax, eax
je 0x100631b
mov eax, dword [0x100a1e4]
mov dword [ebp - 0x11c], ebx
mov eax, dword [eax + 0xe0]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x118], 0xc0000720
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0xdc], 0xa
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xcc], 5
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0x11c], 2
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], 0x1100
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
call sym.ISMSERV.EXE_DoLogEventAndTrace
jmp 0x100631b
lea eax, [ebp - 0x58]
push eax
push ebx
lea eax, [ebp - 0x124]
push eax
push 0x1001828
push ebx
push ebx
push dword [edi + 0x3c]
mov dword [ebp - 0x58], ebx
call dword [sym.imp.WLDAP32.dll_Ordinal_208]
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x50], eax
je 0x1006089
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_18]
mov edi, eax
mov eax, dword [0x100a1e4]
cmp eax, ebx
pop ecx
je 0x1006071
cmp dword [eax + 0xe4], ebx
jge 0x1005fb5
cmp dword [eax + 4], ebx
je 0x1006071
push ebx
push 0x1100
call sym.ISMSERV.EXE_DoLogOverride
test eax, eax
je 0x1006071
mov eax, dword [0x100a1e4]
mov dword [ebp - 0x11c], ebx
mov eax, dword [eax + 0xe0]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x118], 0x80000558
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xcc], 0xa
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xbc], 5
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0x11c], 3
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], 0x1100
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
call sym.ISMSERV.EXE_DoLogEventAndTrace
cmp dword [ebp - 0x58], ebx
je 0x100631b
push dword [ebp - 0x58]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
pop ecx
jmp 0x100631b
push 5
pop ecx
push 0xd
mov esi, 0x100191c
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
pop ecx
push dword [ebp - 0x58]
mov esi, 0x10018e8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x54]
push dword [esi + 0x3c]
call dword [sym.imp.WLDAP32.dll_Ordinal_26]
push 0x1001930
push eax
push dword [esi + 0x3c]
call dword [sym.imp.WLDAP32.dll_Ordinal_140]
mov edi, eax
push dword [edi]
call dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x5c], eax
lea eax, [eax + eax + 0x14]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x1c
cmp eax, ebx
mov dword [esi + 0x54], eax
je 0x10060fd
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [edi]
push dword [esi + 0x54]
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
jmp 0x1006104
mov dword [ebp - 0x50], 0x5a
cmp dword [ebp - 0x50], ebx
jne 0x100614d
mov eax, dword [ebp - 0x5c]
lea eax, [eax + eax + 0x46]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [esi + 0x50], eax
je 0x1006146
lea ecx, [ebp - 0x4c]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x50]
call dword [sym.imp.msvcrt.dll_wcscat]
push dword [edi]
push dword [esi + 0x50]
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x18
jmp 0x100614d
mov dword [ebp - 0x50], 0x5a
push edi
call dword [sym.imp.WLDAP32.dll_Ordinal_224]
push dword [ebp - 0x58]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
cmp dword [ebp - 0x50], ebx
pop ecx
pop ecx
jne 0x1006318
mov esi, dword [ebp - 0x54]
mov edi, dword [sym.imp.WLDAP32.dll_Ordinal_194]
lea eax, [esi + 0x4c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x130]
push eax
push ebx
lea eax, [ebp - 0x140]
push eax
push 0x1001828
push 1
push dword [esi + 0x54]
push dword [esi + 0x3c]
call edi
add esp, 0x2c
cmp eax, ebx
mov dword [ebp - 0x50], eax
je 0x10061e8
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_18]
mov esi, eax
mov eax, dword [0x100a1e4]
cmp eax, ebx
pop ecx
je 0x1006318
cmp dword [eax + 0xe4], ebx
jge 0x10061e0
cmp dword [eax + 4], ebx
je 0x1006318
push ebx
push 0x1100
call sym.ISMSERV.EXE_DoLogOverride
test eax, eax
je 0x1006318
mov eax, dword [0x100a1e4]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x54]
jmp 0x100625f
lea eax, [esi + 0x48]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x130]
push eax
push ebx
push 0x100a050
push 0x1001828
push 1
push dword [esi + 0x50]
push dword [esi + 0x3c]
call edi
add esp, 0x2c
cmp eax, ebx
mov dword [ebp - 0x50], eax
je 0x100641e
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_18]
mov esi, eax
mov eax, dword [0x100a1e4]
cmp eax, ebx
pop ecx
je 0x1006318
cmp dword [eax + 0xe4], ebx
jge 0x1006259
cmp dword [eax + 4], ebx
je 0x1006318
push ebx
push 0x1100
call sym.ISMSERV.EXE_DoLogOverride
test eax, eax
je 0x1006318
mov eax, dword [0x100a1e4]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x50]
mov dword [ebp - 0x11c], ebx
mov eax, dword [eax + 0xe0]
mov dword [ebp - 0x114], eax
xor eax, eax
inc eax
mov dword [ebp - 0xd8], ecx
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xc8], ecx
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0xb0]
push eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x118], 0x80000559
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0xcc], 0xa
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xbc], 5
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0x11c], 3
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], 0x1100
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
call sym.ISMSERV.EXE_DoLogEventAndTrace
xor esi, esi
inc esi
push dword [ebp - 0x50]
call dword [sym.imp.WLDAP32.dll_Ordinal_18]
pop ecx
cmp eax, ebx
mov dword [ebp - 0x50], eax
jne 0x100640e
mov edi, dword [sym.imp.msvcrt.dll__beginthreadex]
lea eax, [ebp - 0x5c]
push eax
push ebx
push dword [ebp - 0x54]
push 0x1004b59
push ebx
push ebx
call edi
mov ecx, dword [ebp - 0x54]
add esp, 0x18
cmp eax, ebx
mov dword [ecx + 0x44], eax
je 0x1006374
lea eax, [ebp - 0x5c]
push eax
push ebx
push ecx
push 0x100590f
push ebx
push ebx
call edi
mov ecx, dword [ebp - 0x54]
add esp, 0x18
cmp eax, ebx
mov dword [ecx + 0x40], eax
jne 0x100640e
mov eax, dword [0x100a1e4]
or dword [ebp - 0x50], 0xffffffff
cmp eax, ebx
je 0x100640e
cmp dword [eax + 0xe4], ebx
jge 0x10063a6
cmp dword [eax + 4], ebx
je 0x100640e
push ebx
push 0x1100
call sym.ISMSERV.EXE_DoLogOverride
test eax, eax
je 0x100640e
mov eax, dword [0x100a1e4]
mov dword [ebp - 0x11c], ebx
mov eax, dword [eax + 0xe0]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf8], 0x1100
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x118], 0xc0000721
mov dword [ebp - 0x110], ebx
call sym.ISMSERV.EXE_DoLogEventAndTrace
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x50]
pop edi
pop esi
pop ebx
call fcn.01006e5a
leave
ret
mov ecx, esi
call fcn.010057b8
xor esi, esi
inc esi
jmp 0x1006325