Function at 0x1005be80
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x9c
cmp dword [ebp + 0x74], 0
jl 0x1005c344
call fcn.10059ea3
test al, al
jne 0x1005c344
push ebx
xor ebx, ebx
mov edx, 0x100d3430
push esi
inc ebx
xor eax, eax
push edi
mov ecx, ebx
lock cmpxchg dword [edx], ecx
xor ecx, ecx
test eax, eax
jne 0x1005bed2
lea eax, [ebp + 0x68]
push eax
push ecx
push ecx
push 0x1005a393
push ecx
push ecx
call fcn.10085aee
add esp, 0x18
xor ecx, ecx
mov edi, dword [ebp + 0x7c]
movzx eax, word [edi + 8]
cmp eax, 0x18
ja 0x1005c13f
je 0x1005c21d
sub eax, 1
je 0x1005c020
sub eax, 5
je 0x1005bf11
sub eax, 1
je 0x1005c21d
sub eax, 1
je 0x1005c21d
sub eax, 8
jne 0x1005c330
movzx eax, word [edi + 4]
sub eax, ecx
je 0x1005bfab
sub eax, 1
je 0x1005bf2b
sub eax, 1
jne 0x1005c330
cmp byte [0x100d2fdc], 0
je 0x1005bf6a
cmp dword [0x100d3464], 0
jne 0x1005c330
mov eax, dword [0x100d3468]
test eax, eax
je 0x1005c330
push eax
call fcn.100483a1
mov eax, dword [0x100d3468]
and dword [0x100d3468], 0
mov dword [0x100d3464], eax
jmp 0x1005c32f
mov eax, dword [0x100d3464]
test eax, eax
jne 0x1005bf86
mov eax, dword [edi + 0xc]
mov dword [0x100d3464], eax
push eax
call fcn.100483a1
jmp 0x1005c32f
mov ecx, dword [edi + 0xc]
cmp ecx, eax
je 0x1005c330
push eax
mov dword [0x100d3464], ecx
call fcn.100495c5
push dword [edi + 0xc]
call fcn.100483a1
pop ecx
jmp 0x1005c32f
cmp byte [0x100d2fdc], 0
je 0x1005bfeb
mov eax, dword [0x100d346c]
cmp dword [edi], eax
jne 0x1005c330
test eax, eax
je 0x1005c330
mov eax, dword [0x100d3464]
test eax, eax
je 0x1005c330
push eax
call fcn.100495c5
mov eax, dword [0x100d3464]
mov dword [0x100d3468], eax
jmp 0x1005c328
mov eax, dword [0x100d3464]
cmp dword [edi + 0xc], eax
jne 0x1005bff9
test eax, eax
jne 0x1005c00d
test eax, eax
jne 0x1005c330
cmp dword [0x100d163c], eax
je 0x1005c330
push dword [edi + 0xc]
mov dword [0x100d3464], ecx
call fcn.100495c5
jmp 0x1005c32f
call fcn.10049e5d
test al, al
je 0x1005c330
mov esi, 0x96
lea eax, [ebp - 0x30]
push esi
push 0
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x30]
push esi
push eax
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x30]
push str.Internet_Explorer_Server
push eax
call fcn.10085427
pop ecx
pop ecx
test eax, eax
jne 0x1005c0c0
cmp dword [0x100d300c], eax
je 0x1005c330
cmp byte [0x100d2da8], al
je 0x1005c0aa
lea ecx, [ebp + 0x7f]
call fcn.10057913
mov esi, eax
mov ecx, esi
call fcn.1005a910
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor ecx, ecx
lea eax, [ebp - 0x30]
cmp dword [0x100d2fd8], ecx
push eax
setne cl
push ecx
push esi
push 4
call fcn.100546cc
add esp, 0x14
mov ecx, 0x100d2fe4
xor eax, eax
lock cmpxchg dword [ecx], ebx
test eax, eax
jne 0x1005c12e
call fcn.1005a22b
jmp 0x1005c12e
lea eax, [ebp - 0x30]
push str.Frame_Tab
push eax
call fcn.10085427
pop ecx
pop ecx
test eax, eax
je 0x1005c0ec
lea eax, [ebp - 0x30]
push str.IEFrame
push eax
call fcn.10085427
pop ecx
pop ecx
test eax, eax
jne 0x1005c330
cmp byte [0x100d2da8], 0
je 0x1005c128
lea ecx, [ebp + 0x7f]
call fcn.10057bfe
mov esi, eax
mov ecx, esi
call fcn.1005a8ea
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor ecx, ecx
lea eax, [ebp - 0x30]
cmp dword [0x100d2fd8], ecx
push eax
setne cl
push ecx
push esi
push 4
call fcn.100546cc
add esp, 0x14
mov dword [0x100d2fd8], ebx
push dword [0x100d300c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1005c330
sub eax, 0x1c
je 0x1005c301
sub eax, 0x65
je 0x1005c286
sub eax, 5
je 0x1005c1e8
sub eax, 0x19b
je 0x1005c1bf
sub eax, 1
jne 0x1005c330
call fcn.1003b56b
test al, al
je 0x1005c330
cmp dword [0x100d346c], 0
jne 0x1005c190
push 2
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetAncestor]
mov dword [0x100d346c], eax
mov eax, dword [edi]
mov ecx, dword [0x100d3464]
cmp eax, ecx
je 0x1005c330
test ecx, ecx
je 0x1005c1ad
push ecx
call fcn.100495c5
mov eax, dword [edi]
pop ecx
mov dword [0x100d3464], eax
test eax, eax
je 0x1005c330
jmp 0x1005bf7b
call fcn.1003b56b
test al, al
je 0x1005c330
mov eax, dword [0x100d3464]
cmp dword [edi + 4], eax
jne 0x1005c330
test eax, eax
je 0x1005c330
push eax
jmp 0x1005c323
call fcn.1003b56b
test al, al
je 0x1005c21d
cmp dword [edi + 4], 0
je 0x1005c20a
mov eax, dword [0x100d3468]
cmp dword [edi + 0xc], eax
jne 0x1005c330
jmp 0x1005bf4e
mov eax, dword [0x100d3464]
cmp dword [edi + 0xc], eax
jne 0x1005c330
jmp 0x1005bfd6
call fcn.1003b643
test al, al
jne 0x1005c233
call fcn.1003b493
test al, al
je 0x1005c330
push dword [edi + 0xc]
call fcn.1003b40b
mov esi, eax
pop ecx
test esi, esi
je 0x1005c266
mov eax, dword [0x100d3464]
cmp esi, eax
je 0x1005c330
test eax, eax
je 0x1005c25a
push eax
call fcn.100495c5
pop ecx
mov dword [0x100d3464], esi
push esi
jmp 0x1005bf7c
push dword [0x100d3464]
call fcn.1003b40b
pop ecx
mov ecx, dword [0x100d3464]
cmp eax, ecx
je 0x1005c330
push ecx
jmp 0x1005c323
call fcn.1003b493
test al, al
je 0x1005c330
mov esi, 0x96
lea eax, [ebp - 0x30]
push esi
push 0
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x30]
push esi
push eax
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp byte [0x100d2da8], 0
je 0x1005c2de
lea ecx, [ebp + 0x7f]
call fcn.100572d1
mov esi, eax
mov ecx, esi
call fcn.10019df0
lea eax, [ebp - 0x30]
push eax
push esi
push 3
call fcn.100546cc
add esp, 0xc
lea edx, [ebp - 0x30]
mov esi, str.Shell_Embedding
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x1005c330
inc ecx
cmp ecx, 0x10
jne 0x1005c2e8
push dword [edi + 0xc]
call fcn.100542f4
jmp 0x1005c330
cmp byte [0x100d2fdc], 0
je 0x1005c330
mov esi, dword [edi + 4]
push esi
call fcn.1003b786
pop ecx
test esi, esi
jne 0x1005c330
cmp dword [0x100d3464], esi
je 0x1005c330
push dword [edi + 0xc]
call fcn.100495c5
and dword [0x100d3464], 0
pop ecx
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
pop edi
pop esi
pop ebx
jmp 0x1005c355
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
add ebp, 0x6c
leave
ret 0xc