Function at 0x45cf89
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
xor eax, eax
push esi
push edi
xor esi, esi
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x10]
mov ebx, ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0045bd66
movsx eax, al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dx, word [eax]
cmp dx, si
pop ecx
pop ecx
je 0x45cfd2
mov di, word [eax + 2]
jmp 0x45cfd4
xor edi, edi
cmp dx, 0x2a
je 0x45cfe6
cmp dx, 0x2d
je 0x45cfe6
cmp dx, 0x2b
jne 0x45cfeb
inc eax
inc eax
mov dword [ebp + 0x10], eax
cmp dx, word [eax]
jne 0x45cffa
inc eax
inc eax
cmp dx, word [eax]
je 0x45cff0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
call fcn.0043fe57
lea eax, [ebp + 8]
push eax
call fcn.0043fe57
cmp dword [ebp - 0x30], esi
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
je 0x45d031
cmp eax, esi
je 0x45d031
cmp byte [eax + 0xc1], 0
jne 0x45d031
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
jmp 0x45d034
mov dword [ebp - 0x30], esi
test byte [ebp - 0x30], 2
je 0x45d040
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
cmp dx, 0x2a
mov dword [ebp - 0x18], esi
jne 0x45d20e
mov dword [ebp - 0x10], esi
push 0x950
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
call fcn.004b4768
mov edi, eax
cmp edi, esi
pop ecx
je 0x45d083
push esi
push esi
push esi
push esi
push esi
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, edi
call fcn.00452ad7
mov edi, eax
jmp 0x45d085
xor edi, edi
push 0x9c
call fcn.004b4768
cmp eax, esi
pop ecx
je 0x45d0a1
push edi
push ebx
mov ecx, eax
call fcn.004152c6
mov ebx, eax
jmp 0x45d0a3
xor ebx, ebx
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebx + 0x91], 3
mov dword [ebx + 0x18], eax
call fcn.00453603
mov eax, dword [ebp - 8]
mov dword [edi + 0xe0], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, edi
mov dword [edi + 0x1a4], ebx
mov dword [edi + 0x1ac], eax
call fcn.0045be2f
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
call fcn.004505eb
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
call fcn.00453b0a
pop ecx
pop ecx
push eax
lea ecx, [edi + 0xc4]
call fcn.0045066c
lea ecx, [ebp + 8]
call fcn.0043fe25
cmp dword [ebp + 0x10], esi
je 0x45d128
cmp byte [edi + 0xc1], 0
je 0x45d128
push dword [ebp + 0x10]
lea ecx, [edi + 0xe8]
call fcn.0045066c
cmp byte [edi + 0xc1], 0
mov dword [ebp + 0x10], 0x271b
jne 0x45d153
cmp byte [edi + 0xe6], 0
je 0x45d14a
mov dword [ebp + 0x10], 0x271d
jmp 0x45d15a
cmp byte [edi + 0xe5], 0
je 0x45d15a
mov dword [ebp + 0x10], 0x271c
push edi
call fcn.00406378
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.004406ae
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
pop ecx
pop ecx
je 0x45d192
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xc1], 0
je 0x45d192
mov ecx, dword [ebp - 4]
push 2
pop eax
cmp dword [ecx + 0x14], eax
jg 0x45d192
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push edi
call fcn.004428a4
push str.__LastWinID
push dword [edi + 0x18]
push dword [ebp - 4]
call fcn.004a8333
add esp, 0x1c
push esi
mov ecx, edi
call fcn.004a45e3
mov esi, 0x4e3d84
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebx + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x20]
call fcn.00450442
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0xc]
cmp dword [ebp - 0xc], 0
je 0x45d547
mov eax, dword [ebp - 0x1c]
push 0
or eax, 1
push eax
push 0x451
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45d547
cmp dx, 0x2d
jne 0x45d39d
push 0x950
call fcn.004b4768
mov edi, eax
cmp edi, esi
pop ecx
je 0x45d245
push esi
push esi
push esi
push esi
push esi
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, edi
call fcn.00452ad7
mov edi, eax
jmp 0x45d247
xor edi, edi
push 0x9c
call fcn.004b4768
cmp eax, esi
pop ecx
je 0x45d261
push edi
push ebx
mov ecx, eax
call fcn.004152c6
mov esi, eax
mov eax, dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
mov ecx, esi
mov byte [esi + 0x91], 3
mov dword [esi + 0x18], eax
call fcn.00453603
mov eax, dword [ebp - 8]
mov dword [edi + 0xe0], eax
mov eax, dword [ebp + 8]
lea ebx, [edi + 0x1a4]
push 1
mov ecx, edi
mov dword [ebx], esi
mov dword [edi + 0x1ac], eax
call fcn.0045be2f
mov eax, dword [ebx]
mov ebx, dword [ebp + 0x10]
push ebx
lea ecx, [ebp + 0x10]
mov dword [edi + 0x1a0], eax
call fcn.004505eb
lea eax, [ebp + 0x10]
push eax
push ebx
lea esi, [edi + 0xc4]
call fcn.00453b0a
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.0045066c
lea ecx, [ebp + 0x10]
call fcn.0043fe25
cmp dword [ebp - 0x28], 0
je 0x45d2e3
push dword [ebp - 0x28]
mov ecx, esi
call fcn.004506c8
test ebx, ebx
je 0x45d2fc
cmp byte [edi + 0xc1], 0
je 0x45d2fc
push ebx
lea ecx, [edi + 0xe8]
call fcn.0045066c
cmp byte [edi + 0xc1], 0
mov dword [ebp + 0x10], 0x271b
jne 0x45d327
cmp byte [edi + 0xe5], 0
jne 0x45d327
cmp byte [edi + 0xe6], 0
je 0x45d32e
mov dword [ebp + 0x10], 0x271d
jmp 0x45d32e
mov dword [ebp + 0x10], 0x271c
push edi
call fcn.00406378
mov ebx, dword [ebp + 0xc]
test ebx, ebx
pop ecx
mov dword [edi + 0x94], ebx
mov byte [edi + 0xc0], 1
je 0x45d369
mov esi, 0x4e3d84
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [ebx + 0x124]
push esi
mov byte [edi + 0xc0], 9
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push edi
call fcn.004428a4
push str.__LastWinID
push dword [edi + 0x18]
push dword [ebp - 4]
call fcn.004a8333
add esp, 0x1c
push 0
push 0
push 0x110
push dword [edi + 0x18]
jmp 0x45d203
mov ecx, dword [ebp + 0x10]
cmp word [ecx - 2], 0x2b
sete byte [ebp + 0xf]
xor ecx, ecx
cmp di, dx
sete cl
mov dword [ebp - 0xc], ecx
mov cl, byte [ebp + 0xf]
neg cl
sbb ecx, ecx
not ecx
and ecx, eax
cmp byte [ebp + 0xf], 0
mov dword [ebp - 0x1c], ecx
jne 0x45d3e4
cmp eax, esi
jne 0x45d3e4
push esi
push ebx
call fcn.00412e85
cmp dword [ebx + 0x28], esi
pop ecx
pop ecx
jne 0x45d3e4
mov eax, 0x80070057
jmp 0x45d54a
push 0x60
lea ecx, [ebp - 0x14]
call fcn.00446437
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0043fdd1
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0x10004
push ebx
push 0x45c947
push 0x100000
lea edi, [ebx + 0x3c]
push esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x45d551
mov eax, dword [ebp - 4]
push 7
mov dword [ebp - 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
or eax, 4
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x2c], eax
push dword [ebp - 0x1c]
call fcn.004406ae
cmp byte [ebp + 0xf], 0
pop ecx
mov dword [ebx + 0x28], eax
jne 0x45d49e
mov esi, 0x4e3d84
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x4e34c8], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp + 0x10], edi
jne 0x45d4b9
push edi
push edi
push 1
push edi
call esi
mov dword [ebp + 0x10], eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 0xc], edi
mov dword [ebp + 0xc], edi
jne 0x45d4ce
push edi
push edi
push 1
push edi
call esi
mov dword [ebp + 0xc], eax
mov dword [ebx + 0x34], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0xc], edi
jne 0x45d517
cmp dword [ebp + 0x10], edi
je 0x45d4fc
push 0xffffffffffffffff
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
call esi
cmp dword [ebp + 0xc], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebx + 0x38], 1
je 0x45d517
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor esi, esi
push str.__LastTID
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.00448c53
push str.__LastWinID
push dword [ebp - 0x20]
push dword [ebp - 4]
call fcn.004a8333
add esp, 0x18
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], esi
call fcn.0043fe25
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov dword [ebp - 0x10], esi
jmp 0x45d519