Function at 0x10044180
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f89c8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10126008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x100441bb
xor al, al
jmp 0x10044242
push ecx
lea ecx, [ebp - 0x14]
call fcn.10006de0
add eax, 0x20
push eax
call fcn.10027740
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x1004422f
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10043d60
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x1004425e
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x10044227
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10043ef0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10027770
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f13e3
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10044276
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10044216
mov bl, 1
jmp 0x10044231

Function at 0x100464a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x10126008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10046522
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10046522
test ecx, ecx
je 0x1004651e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x100464e0
xor eax, eax
jmp 0x10046527
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10046531
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100f13e3
add esp, 0xc
ret 0xc

Function at 0x10046a60
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x10046a98
mov edx, dword [esp + 4]
test edx, edx
je 0x10046a98
cmp dword [eax], 0xffffffff
je 0x10046a98
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10046a98
mov al, 1
ret 0xc
xor al, al
ret 0xc