Function at 0x77ca0ffa
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, 0x77d26420
push esi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword [0x77d2a680]
xor ebx, ebx
cmp eax, ebx
jne 0x77ca101f
cmp dword [0x77d2a654], 0xffffffff
je 0x77ca1038
cmp byte [0x77d2a641], bl
je 0x77ca49be
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
ret
push ebx
push 0x40000080
push 3
push ebx
push ebx
push 0xc0000000
push 0x77cac9f4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [0x77d2a654], eax
je 0x77ce1e23
mov esi, dword [sym.imp.ntdll.dll_NtCreateEvent]
push ebx
push 1
push ebx
mov edi, 0x1f0003
push edi
push 0x77d2a790
call esi
cmp eax, ebx
jl 0x77ca49d5
push 2
push ebx
push ebx
push 0x77d2a794
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
cmp eax, ebx
jl 0x77ca49d5
push ebx
push 1
push ebx
push edi
push 0x77d2a810
call esi
cmp eax, ebx
jl 0x77ca49d5
push ebx
push 1
push ebx
push edi
push 0x77d2a7f0
call esi
cmp eax, ebx
jl 0x77ca49d5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, 0x1000
push esi
push 8
push dword [eax + 0x18]
call edi
cmp eax, ebx
mov dword [0x77d2a6f0], eax
je 0x77ce1e2d
mov eax, dword fs:[0x18]
push esi
mov dword [0x77d2a6f8], esi
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call edi
cmp eax, ebx
mov dword [0x77d2a6fc], eax
je 0x77ce1e2d
mov eax, dword [0x77d2b284]
push 0xffffffffffffffff
cdq
push 0xffffd8f0
push edx
push eax
mov dword [0x77d2a6f4], esi
call fcn.77cb0191
push ebx
push ebx
push ebx
push fcn.77ca8fb5
push ebx
push ebx
mov dword [0x77d2a728], eax
mov dword [0x77d2a72c], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x77d2a67c], eax
je 0x77ce1ed8
mov byte [0x77d2a641], 1
push 0x77d26420
jmp 0x77ca102c
cmp eax, 3
je 0x77ce1efc
cmp eax, 1
jne 0x77ca102b
jmp 0x77ce1efc
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x77ce1e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77ce1e30
push 8
pop edi
mov eax, dword [0x77d2a654]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.ntdll.dll_NtClose]
je 0x77ce1e4a
push eax
call esi
or dword [0x77d2a654], 0xffffffff
mov eax, dword [0x77d2a790]
cmp eax, ebx
je 0x77ce1e5c
push eax
call esi
mov dword [0x77d2a790], ebx
mov eax, dword [0x77d2a794]
cmp eax, ebx
je 0x77ce1e6e
push eax
call esi
mov dword [0x77d2a794], ebx
mov eax, dword [0x77d2a810]
cmp eax, ebx
je 0x77ce1e80
push eax
call esi
mov dword [0x77d2a810], ebx
mov eax, dword [0x77d2a7f0]
cmp eax, ebx
je 0x77ce1e92
push eax
call esi
mov dword [0x77d2a7f0], ebx
mov eax, dword [0x77d2a6f0]
cmp eax, ebx
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x77ce1eb7
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
mov dword [0x77d2a6f0], ebx
mov eax, dword [0x77d2a6fc]
cmp eax, ebx
je 0x77ce1eea
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
mov dword [0x77d2a6fc], ebx
jmp 0x77ce1eea
mov dword [0x77d2a680], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0x77d26420
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov eax, edi
jmp 0x77ca1034
mov eax, dword [0x77d2a67c]
cmp eax, ebx
je 0x77ce1f0c
push eax
call dword [sym.imp.ntdll.dll_NtClose]
push ebx
push ebx
push ebx
push fcn.77ca8fb5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x77d2a67c], eax
je 0x77ce1ee2
mov byte [0x77d2a641], 1
jmp 0x77ca102b