Function at 0x5b81ed9d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
push edi
mov dword [ebp - 0xc], ebx
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81edd3
test byte [eax + 0x1c], 4
je 0x5b81edd3
push dword [eax + 0x14]
mov edx, 0x5b80b610
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.5b81ae17
push ecx
xor edi, edi
lea edx, [ebp - 4]
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.5b81c1d7
mov esi, eax
test esi, esi
jns 0x5b81ee1a
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81ee12
test byte [eax + 0x1c], 1
je 0x5b81ee12
push esi
lfence
push dword [eax + 0x14]
mov edx, 0x5b80b610
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.5b81ae33
mov ecx, dword [ebp - 4]
jmp 0x5b81f10a
push 0x38
call sym.mpclient.dll_MpAllocMemory
mov ebx, eax
test ebx, ebx
jne 0x5b81ee53
mov esi, 0x8007000e
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81ee12
test byte [eax + 0x1c], 1
je 0x5b81ee12
push dword [eax + 0x14]
mov edx, 0x5b80b610
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.5b81ae17
jmp 0x5b81ee12
push 0x38
push edi
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [ebp - 8]
lea eax, [ebx + 0x1c]
mov dword [eax + 4], eax
add esp, 0xc
mov dword [eax], eax
lea eax, [ebx + 0x24]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [ebx], 1
mov eax, dword [ecx]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
mov dword [ebx + 0xc], eax
lock inc dword [ecx]
lea edx, [ecx + 0x18]
mov eax, dword [edx + 4]
lea esi, [ebx + 4]
mov dword [esi], edx
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [edx + 4], esi
call fcn.5b81c23d
push 0xc
call sym.mpclient.dll_MpAllocMemory
mov edi, eax
mov dword [ebx + 0x14], edi
test edi, edi
jne 0x5b81eeea
mov esi, 0x8007000e
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x33
mov edx, 0x5b80b610
pop ecx
call fcn.5b81ae17
jmp 0x5b81f0fd
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebx + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x14]
cmp dword [eax + 8], edi
jne 0x5b81ef44
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x34
mov edx, 0x5b80b610
pop ecx
call fcn.5b81ae33
jmp 0x5b81f0fd
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0x2c]
call fcn.5b8281d8
mov esi, eax
test esi, esi
jns 0x5b81ef7d
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x35
jmp 0x5b81ef34
push ebx
lea ecx, [ebx + 0x30]
mov edx, 0x5b81ed80
lfence
call fcn.5b827f43
mov esi, eax
test esi, esi
jns 0x5b81efbf
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x36
jmp 0x5b81ef34
cmp dword [ebp + 0x10], edi
je 0x5b81f01c
push 8
call sym.mpclient.dll_MpAllocMemory
mov dword [ebx + 0x18], eax
test eax, eax
jne 0x5b81effe
mov esi, 0x8007000e
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x37
jmp 0x5b81eeda
mov edx, dword [ebp + 0x10]
lfence
mov eax, dword [ebx + 0x18]
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [ebx + 0x18]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebx + 0x18]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
lfence
cmp dword [ebp + 0xc], edi
je 0x5b81f079
mov eax, dword [ebx + 0x14]
add eax, 4
push eax
push edi
push ebx
push fcn.5b81f280
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebx + 0x14]
mov dword [ecx], eax
mov eax, dword [ebx + 0x14]
cmp dword [eax], edi
jne 0x5b81f0f6
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x38
jmp 0x5b81ef34
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f09e
test byte [eax + 0x1c], 4
je 0x5b81f09e
push dword [eax + 0x14]
mov edx, 0x5b80b610
push dword [eax + 0x10]
push 0x39
pop ecx
call fcn.5b81ae17
push ebx
call fcn.5b81f280
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b81f0d4
test byte [eax + 0x1c], 4
je 0x5b81f0d4
push esi
lfence
push dword [eax + 0x14]
mov edx, 0x5b80b610
push dword [eax + 0x10]
push 0x3a
pop ecx
call fcn.5b81ae33
mov eax, dword [0x5b89602c]
test esi, esi
jns 0x5b81f0f6
cmp eax, 0x5b89602c
je 0x5b81f0fd
test byte [eax + 0x1c], 1
je 0x5b81f0fd
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x3b
jmp 0x5b81ef34
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov ebx, edi
test ebx, ebx
je 0x5b81f113
mov ecx, ebx
call fcn.5b81f11c
xor ecx, ecx
test ecx, ecx
je 0x5b81f113
call fcn.5b81c23d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10