Function at 0x5cdd50
Capabilities:
Create thread
Enumerate pe sections
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov dword [esi + 0x138], ebp
lea eax, [esi + 0x140]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5ce680
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [0x7c06e0]
test eax, eax
jne 0x5cddae
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x7c06e0], eax
test eax, eax
je 0x5ce535
push str.NtQuerySystemInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
je 0x5ce467
mov eax, dword [ebp + 8]
xor ecx, ecx
lea edx, [esi + 0x28]
mov dword [edx - 0xc], ecx
mov dword [edx - 8], ecx
mov dword [edx - 4], ecx
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
cmp edi, dword [esi + 0x14]
je 0x5cdf25
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x50], xmm0
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x148], 0
lea ecx, [esi + 0x50]
mov dword [esi + 0x2c], edi
push edi
call fcn.004aeac0
mov ecx, dword [esi + 0x20]
cmp ecx, dword [esi + 0x24]
je 0x5cde39
mov dword [esi + 0x148], 4
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x50]
push eax
call fcn.004aeac0
mov eax, dword [esi + 0xc]
add eax, 0x14
mov dword [esi + 0x20], eax
jmp 0x5cdf12
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0xffffffff
sub ecx, dword [esi + 0x1c]
sar ecx, 2
imul eax, ecx, 0xcccccccd
lea ecx, [eax + 1]
cmp ecx, 0xccccccd
jae 0x5ce5b2
lea edx, [eax + eax]
cmp edx, ecx
cmovb edx, ecx
cmp eax, 0x6666666
mov ecx, 0xccccccc
cmovae edx, ecx
mov dword [esi + 0x148], 2
lea ecx, [esi + 0x30]
lea edi, [esi + 0x28]
push edi
push eax
push edx
call fcn.00501b5e
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x148], 3
lea eax, [esi + 0x50]
push eax
call fcn.004aeac0
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x38]
add eax, 0x14
mov dword [esi + 0x38], eax
mov edx, dword [esi + 0x1c]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x18], edx
cmp edi, edx
je 0x5cdeed
add edi, 0xffffffec
mov dword [esi + 0xc], edi
add ecx, 0xffffffec
push edi
call fcn.004aeac0
mov ecx, dword [esi + 0x34]
add ecx, 0xffffffec
mov dword [esi + 0x34], ecx
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x18]
mov edi, eax
jne 0x5cdec0
mov edx, dword [esi + 0x1c]
mov edi, dword [esi + 0x20]
mov eax, dword [esi + 0x38]
jmp 0x5cdeef
mov edx, edi
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x34], edx
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x30], edx
lea ecx, [esi + 0x30]
call fcn.00501c2a
mov edi, dword [esi + 0x2c]
lea ecx, [esi + 0x50]
call fcn.004aeec0
add edi, 0x14
jmp 0x5cddde
mov dword [esi + 0x50], 0
mov dword [esi + 0x148], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x1000
call ebx
push edi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [esi + 0x148], 0xffffffff
mov ecx, dword [esi + 0x10]
call dword [section..00cfg]
xor eax, eax
mov dword [esi + 0x148], eax
lea eax, [esi + 0x50]
push eax
push edi
mov dword [esi + 0xc], ebx
push ebx
push 0x10
call ecx
cmp eax, 0xc0000004
jne 0x5cdf9f
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push dword [esi + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esi + 0x50]
mov eax, 0x1000
add edi, eax
jmp 0x5cdf41
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x5ce4bb
mov ecx, ebx
add ecx, 4
xor eax, eax
inc eax
mov dword [esi + 0x48], eax
xor edx, edx
xor edi, edi
mov dword [esi + 0x10], ecx
cmp edi, dword [ebx]
jae 0x5ce452
mov ebx, edi
shl ebx, 4
mov al, byte [ecx + ebx + 4]
cmp al, byte [0x7c06e8]
jne 0x5ce14f
mov eax, dword [ecx + ebx]
cmp eax, 4
je 0x5ce14f
test edx, edx
je 0x5cdff1
cmp eax, edx
je 0x5ce14f
mov dword [esi + 0x14], edx
mov dword [esi + 0x28], edi
lea edx, [ecx + ebx]
mov dword [esi + 0x4c], edx
push eax
push 0
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x5ce12c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esi + 0x10]
movzx ecx, word [ecx + ebx + 6]
xor edx, edx
push edx
push edx
push 0x2000000
push 0x7c04d4
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x5ce13f
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x4c]
mov eax, dword [eax]
mov dword [esi + 0x6c], eax
xor ecx, ecx
push ecx
push ecx
lea eax, [esi + 0x6c]
push eax
push 0x5cdbf0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x5ce07d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7c04d8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x5ce158
mov ecx, dword [esi + 0x10]
lea eax, [ecx + ebx]
add eax, 6
mov dword [esi + 0x64], eax
mov ebx, dword [esi + 0x1c]
mov edi, dword [esi + 0x28]
mov edx, dword [esi + 0x14]
cmp ebx, dword [esi + 0x20]
je 0x5ce161
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x148], 0
mov dword [esi + 0x18], ebx
mov ecx, ebx
call fcn.004af144
lea ecx, [esi + 0x30]
push 0xffffffffffffffff
push eax
call fcn.004aea40
lea ecx, [esi + 0x30]
mov dword [esi + 0x148], 1
call fcn.004aef30
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
call fcn.004af144
push dword [esi + 0x2c]
push eax
push 0x7c04d8
call fcn.006e71e3
add esp, 0xc
test eax, eax
je 0x5ce169
mov ebx, dword [esi + 0x18]
add ebx, 0x14
lea ecx, [esi + 0x30]
call fcn.004aeec0
mov ecx, dword [esi + 0x10]
jmp 0x5ce0a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 0x4c]
mov edx, dword [eax]
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x28]
jmp 0x5ce14f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x28]
mov edx, dword [esi + 0x14]
mov ebx, dword [esi + 0xc]
inc edi
jmp 0x5cdfbc
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x28]
mov edx, dword [esi + 0x14]
mov ebx, dword [esi + 0x44]
jmp 0x5ce412
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x18]
mov eax, ebx
add eax, 0x14
cmp eax, edi
je 0x5ce1ab
mov dword [esi + 0x68], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x18], ebx
mov ecx, ebx
push eax
call fcn.004af61c
mov eax, dword [esi + 0x2c]
add eax, 0x14
mov ebx, dword [esi + 0x18]
add ebx, 0x14
mov edi, dword [esi + 0x68]
cmp eax, edi
jne 0x5ce17b
mov edi, dword [esi + 0x20]
jmp 0x5ce1ab
add edi, 0xffffffec
mov ecx, edi
call fcn.004aeec0
cmp edi, ebx
jne 0x5ce1a1
mov dword [esi + 0x20], ebx
push dword [0x7c04d4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
xor edi, edi
mov dword [0x7c04d4], edi
push dword [esi + 0x44]
call ebx
mov eax, dword [esi + 0x4c]
push dword [eax]
push edi
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x5ce21c
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esi + 0x64]
movzx ecx, word [ecx]
push 1
push 0
push 0x2000000
push 0x7c04d4
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x5ce30f
lea ecx, [esi + 0x30]
call fcn.004aeec0
jmp 0x5ce409
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
movdqu xmm0, xmmword [0x7a9568]
movdqa xmmword [esi + 0x120], xmm0
movdqa xmmword [esi + 0x110], xmm0
movdqa xmmword [esi + 0x100], xmm0
movdqa xmmword [esi + 0xf0], xmm0
mov dword [esi + 0x148], 1
lea ecx, [esi + 0x30]
call fcn.004af144
mov byte [esi + 0xa0], 3
mov dword [esi + 0xa8], eax
mov byte [esi + 0x80], 0
mov eax, dword [esi + 0x18]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0
sub esp, 0x78
movaps xmm0, xmmword [esi + 0x120]
movups xmmword [esp + 0x68], xmm0
movaps xmm0, xmmword [esi + 0x110]
movups xmmword [esp + 0x58], xmm0
movaps xmm0, xmmword [esi + 0x100]
movups xmmword [esp + 0x48], xmm0
movaps xmm0, xmmword [esi + 0xf0]
movups xmmword [esp + 0x38], xmm0
movups xmm0, xmmword [esi + 0xa0]
movups xmmword [esp + 0x28], xmm0
movdqu xmm0, xmmword [esi + 0x80]
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.unlock_failed_open_process_err_errcode:__d__file_:_s
mov dword [esp + 0x10], str.FileOccupy
mov dword [esp + 0xc], str.unlockProcessFileHandle
mov dword [esp + 8], 0x196
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileOccupy.cpp
mov dword [esp], 4
call fcn.004ee380
add esp, 0x78
jmp 0x5ce3f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movdqu xmm0, xmmword [0x7a9568]
movdqa xmmword [esi + 0xe0], xmm0
movdqa xmmword [esi + 0xd0], xmm0
movdqa xmmword [esi + 0xc0], xmm0
movdqa xmmword [esi + 0xb0], xmm0
mov dword [esi + 0x148], 1
lea ecx, [esi + 0x30]
call fcn.004af144
mov byte [esi + 0x90], 3
mov dword [esi + 0x98], eax
mov byte [esi + 0x70], 0
mov eax, dword [esi + 0x18]
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], 0
sub esp, 0x78
movaps xmm0, xmmword [esi + 0xe0]
movups xmmword [esp + 0x68], xmm0
movaps xmm0, xmmword [esi + 0xd0]
movups xmmword [esp + 0x58], xmm0
movaps xmm0, xmmword [esi + 0xc0]
movups xmmword [esp + 0x48], xmm0
movaps xmm0, xmmword [esi + 0xb0]
movups xmmword [esp + 0x38], xmm0
movups xmm0, xmmword [esi + 0x90]
movups xmmword [esp + 0x28], xmm0
movdqu xmm0, xmmword [esi + 0x70]
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.unlock_failed_duplicate_handle_err_errcode:__d__file:__s
mov dword [esp + 0x10], str.FileOccupy
mov dword [esp + 0xc], str.unlockProcessFileHandle
mov dword [esp + 8], 0x1a2
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileOccupy.cpp
mov dword [esp], 4
call fcn.004ee380
add esp, 0x78
lea ecx, [esi + 0x30]
call fcn.004aeec0
xor ebx, ebx
mov dword [esi + 0x48], 0
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x28]
mov edx, dword [esi + 0x14]
mov eax, dword [0x7c04d4]
test eax, eax
je 0x5ce432
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov dword [0x7c04d4], 0
test ebx, ebx
je 0x5ce443
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x1c]
mov ebx, dword [esi + 0xc]
jne 0x5ce152
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x5ce528
sub esp, 0x78
movdqu xmm0, xmmword [0x7a9568]
movdqu xmmword [esp + 0x68], xmm0
movdqu xmmword [esp + 0x58], xmm0
movdqu xmmword [esp + 0x48], xmm0
movdqu xmmword [esp + 0x38], xmm0
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.cant_GetProcAddress_QuerySystemInfo
mov dword [esp + 0x10], str.FileOccupy
mov dword [esp + 0xc], str.unlockProcessFileHandle
mov dword [esp + 8], 0x13f
jmp 0x5ce584
mov dword [esi + 0x48], 0
sub esp, 0x78
movdqu xmm0, xmmword [0x7a9568]
movdqu xmmword [esp + 0x68], xmm0
movdqu xmmword [esp + 0x58], xmm0
movdqu xmmword [esp + 0x48], xmm0
movdqu xmmword [esp + 0x38], xmm0
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.pHandleInfo_is_null
mov dword [esp + 0x10], str.FileOccupy
mov dword [esp + 0xc], str.unlockProcessFileHandle
mov dword [esp + 8], 0x155
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileOccupy.cpp
mov dword [esp], 2
call fcn.004ee380
add esp, 0x78
lea ecx, [esi + 0x1c]
call fcn.004a80fe
mov eax, dword [esi + 0x48]
jmp 0x5ce59d
sub esp, 0x78
movdqu xmm0, xmmword [0x7a9568]
movdqu xmmword [esp + 0x68], xmm0
movdqu xmmword [esp + 0x58], xmm0
movdqu xmmword [esp + 0x48], xmm0
movdqu xmmword [esp + 0x38], xmm0
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x14], str.cant_LoadLibrary_ntdll.dll
mov dword [esp + 0x10], str.FileOccupy
mov dword [esp + 0xc], str.unlockProcessFileHandle
mov dword [esp + 8], 0x137
mov dword [esp + 4], str..._.._applet_third_party_xplugin_src_base_FileOccupy.cpp
mov dword [esp], 4
call fcn.004ee380
add esp, 0x78
xor eax, eax
mov ecx, dword [esi + 0x140]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x148], 2
lea ecx, [esi + 0x1c]
call fcn.00456e1c
push ebp
sub esp, 0x78
lea esi, [ebp - 0x14c]
mov ebp, dword [esi + 0x138]
lea ecx, [esi + 0x50]
call fcn.004aeec0
add esp, 0x78
pop ebp
ret