Function at 0x1005cb57
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
xor eax, eax
push esi
push edi
xor esi, esi
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x10]
mov ebx, ecx
push eax
mov dword [ebp - 4], ebx
call fcn.1005b934
movsx eax, al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dx, word [eax]
cmp dx, si
pop ecx
pop ecx
je 0x1005cba0
mov di, word [eax + 2]
jmp 0x1005cba2
xor edi, edi
cmp dx, 0x2a
je 0x1005cbb4
cmp dx, 0x2d
je 0x1005cbb4
cmp dx, 0x2b
jne 0x1005cbb9
inc eax
inc eax
mov dword [ebp + 0x10], eax
cmp dx, word [eax]
jne 0x1005cbc8
inc eax
inc eax
cmp dx, word [eax]
je 0x1005cbbe
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
call fcn.1003f9c4
lea eax, [ebp + 8]
push eax
call fcn.1003f9c4
cmp dword [ebp - 0x30], esi
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
je 0x1005cbff
cmp eax, esi
je 0x1005cbff
cmp byte [eax + 0xc1], 0
jne 0x1005cbff
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
jmp 0x1005cc02
mov dword [ebp - 0x30], esi
test byte [ebp - 0x30], 2
je 0x1005cc0e
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
cmp dx, 0x2a
mov dword [ebp - 0x18], esi
jne 0x1005cddc
mov dword [ebp - 0x10], esi
push 0x950
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
call fcn.100b4338
mov edi, eax
cmp edi, esi
pop ecx
je 0x1005cc51
push esi
push esi
push esi
push esi
push esi
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, edi
call fcn.100526d7
mov edi, eax
jmp 0x1005cc53
xor edi, edi
push 0x9c
call fcn.100b4338
cmp eax, esi
pop ecx
je 0x1005cc6f
push edi
push ebx
mov ecx, eax
call fcn.10014f6a
mov ebx, eax
jmp 0x1005cc71
xor ebx, ebx
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebx + 0x91], 3
mov dword [ebx + 0x18], eax
call fcn.10053203
mov eax, dword [ebp - 8]
mov dword [edi + 0xe0], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, edi
mov dword [edi + 0x1a4], ebx
mov dword [edi + 0x1ac], eax
call fcn.1005b9fd
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
call fcn.100501eb
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
call fcn.1005370a
pop ecx
pop ecx
push eax
lea ecx, [edi + 0xc4]
call fcn.1005026c
lea ecx, [ebp + 8]
call fcn.1003f96c
cmp dword [ebp + 0x10], esi
je 0x1005ccf6
cmp byte [edi + 0xc1], 0
je 0x1005ccf6
push dword [ebp + 0x10]
lea ecx, [edi + 0xe8]
call fcn.1005026c
cmp byte [edi + 0xc1], 0
mov dword [ebp + 0x10], 0x271b
jne 0x1005cd21
cmp byte [edi + 0xe6], 0
je 0x1005cd18
mov dword [ebp + 0x10], 0x271d
jmp 0x1005cd28
cmp byte [edi + 0xe5], 0
je 0x1005cd28
mov dword [ebp + 0x10], 0x271c
push edi
call fcn.1003a4c6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.1004022c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
pop ecx
pop ecx
je 0x1005cd60
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xc1], 0
je 0x1005cd60
mov ecx, dword [ebp - 4]
push 2
pop eax
cmp dword [ecx + 0x14], eax
jg 0x1005cd60
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push edi
call fcn.10042422
push str.__LastWinID
push dword [edi + 0x18]
push dword [ebp - 4]
call fcn.100104aa
add esp, 0x1c
push esi
mov ecx, edi
call fcn.100a41a9
mov esi, 0x100e3d7c
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebx + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x20]
call fcn.10050042
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0xc]
cmp dword [ebp - 0xc], 0
je 0x1005d115
mov eax, dword [ebp - 0x1c]
push 0
or eax, 1
push eax
push 0x451
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1005d115
cmp dx, 0x2d
jne 0x1005cf6b
push 0x950
call fcn.100b4338
mov edi, eax
cmp edi, esi
pop ecx
je 0x1005ce13
push esi
push esi
push esi
push esi
push esi
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, edi
call fcn.100526d7
mov edi, eax
jmp 0x1005ce15
xor edi, edi
push 0x9c
call fcn.100b4338
cmp eax, esi
pop ecx
je 0x1005ce2f
push edi
push ebx
mov ecx, eax
call fcn.10014f6a
mov esi, eax
mov eax, dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
mov ecx, esi
mov byte [esi + 0x91], 3
mov dword [esi + 0x18], eax
call fcn.10053203
mov eax, dword [ebp - 8]
mov dword [edi + 0xe0], eax
mov eax, dword [ebp + 8]
lea ebx, [edi + 0x1a4]
push 1
mov ecx, edi
mov dword [ebx], esi
mov dword [edi + 0x1ac], eax
call fcn.1005b9fd
mov eax, dword [ebx]
mov ebx, dword [ebp + 0x10]
push ebx
lea ecx, [ebp + 0x10]
mov dword [edi + 0x1a0], eax
call fcn.100501eb
lea eax, [ebp + 0x10]
push eax
push ebx
lea esi, [edi + 0xc4]
call fcn.1005370a
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.1005026c
lea ecx, [ebp + 0x10]
call fcn.1003f96c
cmp dword [ebp - 0x28], 0
je 0x1005ceb1
push dword [ebp - 0x28]
mov ecx, esi
call fcn.100502c8
test ebx, ebx
je 0x1005ceca
cmp byte [edi + 0xc1], 0
je 0x1005ceca
push ebx
lea ecx, [edi + 0xe8]
call fcn.1005026c
cmp byte [edi + 0xc1], 0
mov dword [ebp + 0x10], 0x271b
jne 0x1005cef5
cmp byte [edi + 0xe5], 0
jne 0x1005cef5
cmp byte [edi + 0xe6], 0
je 0x1005cefc
mov dword [ebp + 0x10], 0x271d
jmp 0x1005cefc
mov dword [ebp + 0x10], 0x271c
push edi
call fcn.1003a4c6
mov ebx, dword [ebp + 0xc]
test ebx, ebx
pop ecx
mov dword [edi + 0x94], ebx
mov byte [edi + 0xc0], 1
je 0x1005cf37
mov esi, 0x100e3d7c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [ebx + 0x124]
push esi
mov byte [edi + 0xc0], 9
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push edi
call fcn.10042422
push str.__LastWinID
push dword [edi + 0x18]
push dword [ebp - 4]
call fcn.100104aa
add esp, 0x1c
push 0
push 0
push 0x110
push dword [edi + 0x18]
jmp 0x1005cdd1
mov ecx, dword [ebp + 0x10]
cmp word [ecx - 2], 0x2b
sete byte [ebp + 0xf]
xor ecx, ecx
cmp di, dx
sete cl
mov dword [ebp - 0xc], ecx
mov cl, byte [ebp + 0xf]
neg cl
sbb ecx, ecx
not ecx
and ecx, eax
cmp byte [ebp + 0xf], 0
mov dword [ebp - 0x1c], ecx
jne 0x1005cfb2
cmp eax, esi
jne 0x1005cfb2
push esi
push ebx
call fcn.10012b49
cmp dword [ebx + 0x28], esi
pop ecx
pop ecx
jne 0x1005cfb2
mov eax, 0x80070057
jmp 0x1005d118
push 0x60
lea ecx, [ebp - 0x14]
call fcn.10045fcc
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.1003f93e
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0x10004
push ebx
push 0x1005c515
push 0x100000
lea edi, [ebx + 0x3c]
push esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x1005d11f
mov eax, dword [ebp - 4]
push 7
mov dword [ebp - 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
or eax, 4
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x2c], eax
push dword [ebp - 0x1c]
call fcn.1004022c
cmp byte [ebp + 0xf], 0
pop ecx
mov dword [ebx + 0x28], eax
jne 0x1005d06c
mov esi, 0x100e3d7c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x100e34c0], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp + 0x10], edi
jne 0x1005d087
push edi
push edi
push 1
push edi
call esi
mov dword [ebp + 0x10], eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 0xc], edi
mov dword [ebp + 0xc], edi
jne 0x1005d09c
push edi
push edi
push 1
push edi
call esi
mov dword [ebp + 0xc], eax
mov dword [ebx + 0x34], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0xc], edi
jne 0x1005d0e5
cmp dword [ebp + 0x10], edi
je 0x1005d0ca
push 0xffffffffffffffff
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
call esi
cmp dword [ebp + 0xc], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebx + 0x38], 1
je 0x1005d0e5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor esi, esi
push str.__LastTID
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.10048821
push str.__LastWinID
push dword [ebp - 0x20]
push dword [ebp - 4]
call fcn.100104aa
add esp, 0x18
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], esi
call fcn.1003f96c
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov dword [ebp - 0x10], esi
jmp 0x1005d0e7