Function at 0x548670
Capabilities:
Create thread
Resume thread
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x14]
sub esp, 0x44
call fcn.005452a0
mov edi, eax
mov dword [ebp - 0x24], eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x150
xor eax, eax
test edi, edi
setne al
mov dword [esp + 4], 0x5f9850
mov dword [esp], eax
call fcn.00543700
mov eax, ebx
call fcn.00542b70
mov dword [esp + 0xc], 0x1388
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub esp, 0x10
cmp eax, 0x102
je 0x548ca0
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x15b
mov eax, 1
test ebx, ebx
jne 0x548c50
mov dword [esp + 8], ebx
mov dword [esp + 4], str.WaitForAllObjects_2_events__ld_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.00543700
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov esi, eax
mov dword [ebp - 0x28], eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x15e
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Cant_create_event__err_lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00543700
lea eax, [ebp - 0x20]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x161
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.DuplicateHandle_failed__err_lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.00543700
lea ecx, [ebp - 0x1c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 4
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], 0x542a90
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_CreateRemoteThread]
mov dword [ebp - 0x30], eax
call eax
sub esp, 0x1c
cmp dword [edi + 0x34], 0x78
mov ebx, eax
je 0x548cc0
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x16c
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed__err_lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.00543700
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x16d
xor eax, eax
mov dword [esp + 4], str.null_tid_n
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.00543700
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SuspendThread]
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x16f
mov eax, dword [edi + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
xor eax, eax
cmp esi, 1
sete al
mov dword [esp + 4], str.ret_lu__err_lu_n
mov dword [esp], eax
call fcn.00543700
mov edx, dword [sym.imp.kernel32.dll_ResumeThread]
mov dword [esp], ebx
mov dword [ebp - 0x34], edx
call edx
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x171
mov eax, dword [edi + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
xor eax, eax
cmp esi, 2
sete al
mov dword [esp + 4], str.ret_lu__err_lu_n
mov dword [esp], eax
call fcn.00543700
mov dword [esp + 4], 0x3e8
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x2c], eax
call eax
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x175
xor eax, eax
cmp esi, 0x102
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.wait_did_not_time_out__ret_lu_n
mov dword [esp], eax
call fcn.00543700
mov dword [esp], ebx
mov edx, dword [ebp - 0x34]
call edx
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x178
mov eax, dword [edi + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
xor eax, eax
cmp esi, 1
sete al
mov dword [esp + 4], str.ret_lu__err_lu_n
mov dword [esp], eax
call fcn.00543700
mov dword [esp + 4], 0x3e8
mov ecx, dword [ebp - 0x28]
mov dword [esp], ecx
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x17c
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.object_not_signaled__ret_lu_n
call fcn.00543700
mov dword [esp], ebx
mov dword [esp + 4], 0x3e8
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x180
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.waiting_for_thread_failed__ret_lu_n
mov dword [esp], eax
call fcn.00543700
mov dword [esp], ebx
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], 0x542b20
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x24]
mov dword [esp], edx
mov esi, dword [ebp - 0x30]
call esi
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x187
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed__err_lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00543700
mov dword [esp], esi
mov dword [esp + 4], 0x3e8
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 8
mov dword [ebp - 0x34], eax
call fcn.0057d110
mov edx, dword [ebp - 0x34]
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x189
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.waiting_for_thread_failed__ret_lu_n
mov dword [esp], eax
call fcn.00543700
mov dword [esp], esi
call ebx
lea ecx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], 0x542a90
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x24]
mov dword [esp], edx
mov esi, dword [ebp - 0x30]
call esi
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x190
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed__err_lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00543700
mov dword [esp + 4], 0x3e8
mov ecx, dword [ebp - 0x28]
mov dword [esp], ecx
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 8
mov dword [ebp - 0x2c], eax
call fcn.0057d110
mov edx, dword [ebp - 0x2c]
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x194
xor eax, eax
cmp edx, 0x102
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.wait_did_not_time_out__ret_lu_n
call fcn.00543700
lea eax, [ebp - 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetExitCodeThread]
sub esp, 8
mov dword [ebp - 0x2c], eax
call fcn.0057d110
mov dword [eax], 0x5f810b
mov dword [eax + 4], 0x198
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GetExitCodeThread_failed__err_lu_n
mov dword [esp + 8], eax
mov edi, dword [ebp - 0x2c]
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.00543700
test edi, edi
jne 0x548c70
mov dword [esp], esi
call ebx
sub esp, 4
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, dword [ebp - 0x28]
sub esp, 8
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], edi
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x8f0770]
test esi, esi
sete dl
xor eax, eax
cmp ebx, 1
sete al
and eax, edx
jmp 0x548706
mov eax, 0x199
call fcn.00542db0
mov dword [esp + 4], str.SetEvent_succeeded__expected_to_fail_n
mov edx, dword [ebp - 0x18]
xor eax, eax
test edx, edx
sete al
mov dword [esp], eax
call fcn.00543700
jmp 0x548c0e
mov eax, 0x158
call fcn.00542db0
mov dword [esp], str.child_process_wasnt_mapped_at_same_address__so_cant_do_CreateRemoteThread_tests._n
call fcn.00543150
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x169
call fcn.00542db0
mov dword [esp], str.CreateRemoteThread_is_not_implemented_n
call fcn.005436d0
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x548c16