Function at 0x1001cb40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push 0
push 0
push 0
push 0x1001ce10
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
mov ecx, dword [0x10086198]
call fcn.1002f130
mov ecx, dword [0x1008820c]
call fcn.1002fbd0
push 0
push 0
push 0
push 0x1001d620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x1001d840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1001ce80
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
push 0
push 0
push 0
push 0x1001ce20
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
mov dword [0x10086460], eax
push 0
push 0
push 0
push 0x1001ce30
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
mov dword [0x100870f8], eax
push 0
push 0
push 0
push 0x1001ce40
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
mov dword [0x10086458], eax
push 0
push 0
push 0
push 0x1001ce50
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
push 0
push 0
push 0
push 0x1001ce60
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
push 0
push 0
push 0
push 0x1001c880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1001ce70
push 0
push 0
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
call fcn.10003b70
movzx eax, al
test eax, eax
je 0x1001cc9f
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call sub.xHunterShield.dll_StartingProtection
add esp, 8
mov ecx, dword [0x10086240]
call fcn.1000ff80
push 0x1b1ca9dd
lea ecx, [ebp - 0x13]
call fcn.10029ac0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x40]
push edx
call fcn.1001bf30
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13]
call fcn.10039e10
mov eax, 0xfd9a4aa7
push eax
lea ecx, [ebp - 0x20]
call fcn.10029b40
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x48]
push edx
call fcn.1001bf30
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10039b90
push 0x4a4e3dca
lea ecx, [ebp - 0x2b]
call fcn.10029bc0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.1001bf30
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b]
call fcn.10039bf0
push 0x2c904374
lea ecx, [ebp - 0x35]
call fcn.10029c40
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x58]
push eax
call fcn.1001bf30
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x35]
call fcn.10039c20
mov ecx, dword [0x10085f40]
call fcn.10008ce0
movzx ecx, al
test ecx, ecx
jne 0x1001cdba
mov ecx, dword [0x1008820c]
call fcn.10032cc0
cmp eax, 1
jle 0x1001cdba
push 0
mov ecx, dword [0x1008820c]
call fcn.10032480
mov ecx, dword [0x10088244]
call fcn.1002b830
mov ecx, dword [0x1008820c]
call fcn.1002fb90
mov ecx, dword [0x1008820c]
call fcn.1002fb10
mov ecx, dword [0x1008820c]
call fcn.1002fad0
mov ecx, dword [0x1008820c]
call fcn.1002fa90
mov ecx, dword [0x1008820c]
call fcn.1002fb50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret