Function at 0x10013280
Capabilities:
Enumerate threads
Get system information on windows
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push edi
push 4
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x84], 0x1c
call fcn.10015200
lea ecx, [ebp - 0x68]
push 0x100c9f28
push ecx
call fcn.10048790
add esp, 8
test eax, eax
je 0x100132ef
mov dword [0x100de550], 0x13c
mov dword [0x100de554], 0x87
jmp 0x100132f9
mov dword [0x100de554], 0x55
lea edx, [ebp - 0x84]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov esi, 0x10010
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x78], eax
jne 0x1001357b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x7c]
cmp ecx, eax
je 0x1001357b
push ecx
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push 0x2cc
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x38c]
push edi
push eax
mov dword [ebp - 0x658], esi
call fcn.1004c8a0
add esp, 0xc
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xc0], 9
mov dword [ebp - 0x88], edi
jne 0x100133de
lea edx, [ebp - 0x658]
mov dword [ebp - 0x8c], edx
pushal
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
call fcn.10013260
mov dword [ebp - 0x88], eax
popal
mov edx, dword [ebp - 0x654]
mov esi, dword [ebp - 0x650]
mov edi, dword [ebp - 0x64c]
mov ebx, dword [ebp - 0x648]
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x388], edx
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x380], edi
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x374], eax
jmp 0x10013427
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x38c], esi
mov dword [ebp - 0x8c], eax
pushal
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
call fcn.10013230
mov dword [ebp - 0x88], eax
popal
mov eax, dword [ebp - 0x374]
mov ebx, dword [ebp - 0x37c]
mov edi, dword [ebp - 0x380]
mov esi, dword [ebp - 0x384]
mov edx, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x9c]
cmp edx, ecx
je 0x100134aa
test edx, edx
je 0x100134aa
cmp esi, ecx
je 0x1001348f
test esi, esi
je 0x1001348f
cmp edi, ecx
je 0x10013474
test edi, edi
je 0x10013474
cmp ebx, ecx
je 0x10013459
test ebx, ebx
je 0x10013459
mov dword [ebp - 0x88], 0xffffffff
jmp 0x100134cf
mov dword [ebp - 0x37c], ecx
or eax, 0x40
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x88], 3
jmp 0x100134c3
mov dword [ebp - 0x380], ecx
or eax, 0x10
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x88], 2
jmp 0x100134c3
mov dword [ebp - 0x384], ecx
or eax, 4
mov dword [ebp - 0x650], ecx
mov dword [ebp - 0x88], 1
jmp 0x100134c3
mov dword [ebp - 0x388], ecx
or eax, 1
mov dword [ebp - 0x654], ecx
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x90]
mov eax, 0x10010
push ecx
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x658], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xc0], 9
mov dword [ebp - 0x8c], 0
jne 0x10013535
lea eax, [ebp - 0x658]
mov dword [ebp - 0x94], eax
pushal
push dword [ebp - 0x94]
push dword [ebp - 0x90]
call fcn.10013240
mov dword [ebp - 0x8c], eax
popal
jmp 0x1001355a
lea ecx, [ebp - 0x38c]
mov dword [ebp - 0x94], ecx
pushal
push dword [ebp - 0x94]
push dword [ebp - 0x90]
call fcn.10013220
mov dword [ebp - 0x8c], eax
popal
mov esi, dword [ebp - 0x90]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x98]
mov esi, 0x10010
xor edi, edi
lea edx, [ebp - 0x84]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10013310
mov ecx, dword [ebp - 4]
inc dword [0x100e213c]
mov eax, dword [ebp - 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047d85
mov esp, ebp
pop ebp
ret