Function at 0x1000af20
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100c85f9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100ef07c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, 1
push ebx
push esi
call fcn.10007750
cmp esi, 0x64
ja 0x10005cdf
je 0x10005c77
cmp esi, 8
ja case.0x10005b4a.2
jmp dword [esi*4 + 0x10005d9c]
mov eax, dword [0x100f2db4]
test eax, eax
je case.0x10005b4a.2
mov esi, 0x100f2d78
call fcn.1009ca80
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [0x100f2f84]
test ecx, ecx
je 0x10005b9b
mov edi, 0x100f2e3c
mov esi, 0x100f2f48
call fcn.1009d900
call fcn.1009ca80
xor eax, eax
lea ecx, [eax + 4]
mov esi, 0x100f2e3c
call fcn.1009d4a0
mov dword [0x100f33fc], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, 2
xor eax, eax
mov esi, 0x100f2e3c
call fcn.1009d4a0
mov dword [0x100f337c], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, ebx
jmp 0x10005bca
mov dword [0x100f35dc], ebx
mov dword [0x100f347c], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push ebx
push 0
call sub.MHFilterDll.dll_Ordinal_5
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov edx, dword [0x100f3158]
mov eax, dword [edx + 0x10]
push ebx
mov ecx, 0x100f3158
mov dword [0x100f35dc], ebx
call eax
mov ecx, dword [0x100f3194]
test ecx, ecx
je case.0x10005b4a.2
mov esi, 0x100f3158
call fcn.1009ca80
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x100cb2fc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x10]
push edx
mov edi, 0x100f3368
call fcn.100ae520
mov eax, dword [esp + 0x10]
push eax
mov edi, 0x100f33e8
call fcn.100ae520
mov ecx, dword [esp + 0x10]
push ecx
mov edi, 0x100f3468
call fcn.100ae520
call sub.MHFilterDll.dll__UpdateFileLastOpenMask_0
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
cmp esi, 0xffffffff
jne case.0x10005b4a.2
xor edi, edi
cmp dword [0x100f3658], edi
jne 0x10005d14
push edi
push edi
push 0x100f364c
push 0x1000b7e0
push edi
push edi
mov dword [0x100f3654], edi
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x100f3658], eax
call fcn.10005700
mov edx, dword [0x100f2e78]
test edx, edx
je 0x10005d51
mov esi, 0x100f2e3c
call fcn.1009ca80
mov eax, dword [0x100f2f44]
mov dword [0x100f2f44], eax
and dword [0x100f2f44], 0xfffffff8
mov eax, dword [0x100f2f44]
push eax
push 2
call sub.MHFilterDll.dll_Ordinal_5
mov ecx, dword [0x100f2f44]
mov eax, dword [0x100f30ec]
cmp eax, edi
je 0x10005d61
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edi
push 0x100f30b4
push 0x1009cac0
push edi
push edi
mov dword [0x100f30f0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100f30ec], eax
mov dword [0x100f34fc], ebx
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 4]
jmp 0x10005b00