Function at 0x449bfc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x10]
mov esi, ecx
push eax
mov dword [ebp - 4], esi
call fcn.004400a5
movsx eax, al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dx, word [eax]
cmp dx, 0x2a
pop ecx
pop ecx
je 0x449c4c
cmp dx, 0x2d
je 0x449c4c
cmp dx, 0x2b
jne 0x449c50
add dword [ebp + 0x10], 2
lea eax, [ebp + 0x10]
push eax
call fcn.0042ebab
lea eax, [ebp + 8]
push eax
call fcn.0042ebab
xor edi, edi
cmp dword [ebp - 0x24], ebx
pop ecx
pop ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], ebx
je 0x449c87
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x449c87
cmp byte [eax + 0x71], bl
jne 0x449c87
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
mov edi, eax
jmp 0x449c8a
mov dword [ebp - 0x24], ebx
test byte [ebp - 0x24], 2
je 0x449c93
mov dword [ebp - 0x10], edi
cmp dx, 0x2a
mov dword [ebp - 0x14], ebx
jne 0x449e81
push 0x8d4
call fcn.0047b518
mov esi, eax
cmp esi, ebx
pop ecx
je 0x449ccd
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.0043fd92
mov esi, eax
jmp 0x449ccf
xor esi, esi
push 0xa0
call fcn.0047b518
cmp eax, ebx
pop ecx
je 0x449cf0
push esi
push dword [ebp - 4]
mov ecx, eax
call fcn.0041fe8f
mov edi, eax
mov dword [ebp - 0xc], edi
jmp 0x449cf5
mov dword [ebp - 0xc], ebx
mov edi, ebx
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x18], edi
mov byte [edi + 0x95], 3
mov dword [edi + 0x1c], eax
call fcn.004411c1
mov eax, dword [ebp - 8]
mov dword [esi + 0x90], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, esi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x154], eax
call fcn.0044900b
mov edi, dword [ebp + 0x10]
push edi
lea ecx, [ebp + 0x10]
call fcn.0043ddc9
lea eax, [ebp + 0x10]
push eax
push edi
call fcn.004416c8
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x74]
call fcn.0043de31
lea ecx, [ebp + 0x10]
call fcn.0042eb98
cmp edi, ebx
je 0x449d6f
cmp byte [esi + 0x71], bl
je 0x449d6f
push edi
lea ecx, [esi + 0x98]
call fcn.0043de31
cmp byte [esi + 0x71], bl
mov dword [ebp + 0x10], 0x271b
jne 0x449d94
cmp byte [esi + 0x95], bl
jne 0x449d94
cmp byte [esi + 0x96], bl
je 0x449d9b
mov dword [ebp + 0x10], 0x271d
jmp 0x449d9b
mov dword [ebp + 0x10], 0x271c
push esi
call fcn.0047080c
cmp dword [ebp + 0xc], ebx
pop ecx
mov edi, 0x4a7658
je 0x449dc3
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
inc dword [eax + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push esi
call fcn.00430c5b
push str.0x_X
push str.__LastWinID
push dword [esi + 0x18]
push dword [ebp - 4]
call fcn.00435e8d
add esp, 0x20
push ebx
mov ecx, esi
call fcn.00473898
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0xc]
push edi
mov dword [eax + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
call fcn.0043dc89
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x44a0d4
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xd0]
dec eax
cmp eax, ebx
jle 0x449e4a
cmp byte [esi + 0x71], bl
je 0x449e4a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x18], 2
mov byte [ebp + 0x13], 1
jle 0x449e4d
mov byte [ebp + 0x13], bl
cmp byte [esi + 0x71], 0x81
mov dword [esi + 0xd0], eax
je 0x449e69
push ebx
push ebx
push 0x43d
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp byte [ebp + 0x13], bl
je 0x449e75
mov byte [0x4a5290], 0xff
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x44a0d4
cmp dx, 0x2d
jne 0x44a00c
push 0x8d4
call fcn.0047b518
mov esi, eax
cmp esi, ebx
pop ecx
je 0x449eb8
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.0043fd92
mov esi, eax
jmp 0x449eba
xor esi, esi
push 0xa0
call fcn.0047b518
cmp eax, ebx
pop ecx
je 0x449ed8
push esi
push dword [ebp - 4]
mov ecx, eax
call fcn.0041fe8f
mov edi, eax
jmp 0x449eda
xor edi, edi
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
mov ecx, edi
mov byte [edi + 0x95], 3
mov dword [edi + 0x1c], eax
call fcn.004411c1
mov eax, dword [ebp - 8]
mov dword [esi + 0x90], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, esi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x154], eax
call fcn.0044900b
mov eax, dword [esi + 0x14c]
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov dword [esi + 0x148], eax
call fcn.0043ddc9
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
lea edi, [esi + 0x74]
call fcn.004416c8
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.0043de31
lea ecx, [ebp + 8]
call fcn.0042eb98
cmp dword [ebp - 0x1c], ebx
je 0x449f5a
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.0043de8d
cmp dword [ebp + 0x10], ebx
je 0x449f72
cmp byte [esi + 0x71], bl
je 0x449f72
push dword [ebp + 0x10]
lea ecx, [esi + 0x98]
call fcn.0043de31
cmp byte [esi + 0x71], bl
mov dword [ebp + 0x10], 0x271b
jne 0x449f97
cmp byte [esi + 0x95], bl
jne 0x449f97
cmp byte [esi + 0x96], bl
je 0x449f9e
mov dword [ebp + 0x10], 0x271d
jmp 0x449f9e
mov dword [ebp + 0x10], 0x271c
push esi
call fcn.0047080c
mov eax, dword [ebp + 0xc]
cmp eax, ebx
pop ecx
mov byte [esi + 0x70], 1
mov dword [esi + 0x4c], eax
je 0x449fcf
mov edi, 0x4a7658
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
inc dword [eax + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push esi
call fcn.00430c5b
push str.0x_X
push str.__LastWinID
push dword [esi + 0x18]
push dword [ebp - 4]
call fcn.00435e8d
add esp, 0x20
push ebx
push ebx
push 0x110
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44a0d4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov esi, 0x4a7630
mov dword [ebp - 0x3c], edi
push esi
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x44]
push eax
push 0x10000
lea eax, [ebp - 0x60]
push eax
push 0x4498c4
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x44a093
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 0x10], 0x270f
cmp dword [ebp - 0x54], ebx
je 0x44a093
push ebx
call edi
dec dword [ebp + 0x10]
jns 0x44a07b
jmp 0x44a08e
push 1
call edi
cmp dword [ebp - 0x54], ebx
jne 0x44a08a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0xc], ebx
je 0x44a0a8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.__LastTID
push dword [ebp - 0x44]
push dword [ebp - 4]
call fcn.00435eb7
mov eax, dword [ebp - 0x48]
push str.0x_X
push str.__LastWinID
push eax
push dword [ebp - 4]
call fcn.00435e8d
add esp, 0x1c
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10