Function at 0x4471d5
Capabilities:
Create thread

Disassembly:
push 0x44
mov eax, 0x475ff0
call fcn.00474165
mov esi, ecx
mov dword [ebp - 0x18], esi
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x1c0]
call fcn.00432701
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x44723e
lea ebx, [esi + 0x60]
mov edx, dword [ebx]
push 0xc77
mov esi, dword [edx + 4]
push 0x41240c
mov ecx, esi
call dword [0x47d4cc]
mov ecx, ebx
call esi
mov ebx, dword [ebp - 0x1c]
mov ecx, eax
mov edx, ebx
call fcn.0044dc99
jmp 0x4479d3
mov eax, dword [esi + 0xc0]
lea ecx, [esi + 0x1e8]
mov dword [ebp - 0x30], eax
call fcn.004323c3
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x44726a
push 0xc7c
lea ebx, [esi + 0x60]
mov eax, dword [ebx]
mov esi, dword [eax + 4]
jmp 0x44721c
and dword [esi + 0x308], 0
lea eax, [ebp - 0x38]
and dword [esi + 0x30c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esi + 0x298]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, dword [ecx + eax*4]
call fcn.0043289b
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x4472a9
push 0xc83
jmp 0x447260
xor ebx, ebx
push ebx
push ebx
push esi
push 0x4404e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041f2f4
mov edi, dword [ebp - 0x3c]
test edi, edi
jne 0x4472e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push 0xc8d
jmp 0x447260
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x310], ebx
mov dword [esi + 0x314], ebx
mov dword [esi + 0x318], ebx
mov dword [esi + 0x31c], ebx
lea ebx, [esi + 0x60]
mov dword [esi + 0x304], eax
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, ebx
call esi
test eax, eax
je 0x44735d
mov eax, dword [ebp - 0x18]
push dword [eax + 0x300]
mov eax, dword [ebx]
push 0x412448
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, ebx
call esi
push eax
call fcn.0044dce2
add esp, 0x10
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x447378
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x47d4cc]
call esi
and dword [ebp - 0x24], 0
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x20]
mov eax, dword [ebx]
mov esi, dword [eax + 0x50]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, ebx
call esi
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x4473ac
mov eax, dword [ebp - 0x18]
push 0xca0
mov eax, dword [eax + 0x60]
jmp 0x44791d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
test eax, eax
je 0x4473ec
push dword [ebp - 0x20]
mov eax, dword [ebx + 0x60]
push 0x4124b0
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0x10
push 1
push dword [ebp - 0x20]
mov esi, ebx
push dword [ebp - 0x24]
mov ecx, esi
call fcn.004480d4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x447413
push 0xca2
mov eax, dword [esi + 0x60]
jmp 0x44791d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4478dd
push dword [esi + 0x300]
lea eax, [ebp - 0x50]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x44744d
cmp eax, 1
je 0x447665
cmp eax, 0x102
jne 0x447741
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x20], ecx
jae 0x4476e4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x447477
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x47d4cc]
call esi
and dword [ebp - 0x24], 0
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x20]
mov esi, dword [eax + 0x50]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
call esi
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477f1
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push ecx
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [0x47d4cc]
mov ecx, esi
call ebx
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477e7
cmp dword [ebp - 0x2c], 9
jne 0x4476a0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
test eax, eax
je 0x44750c
push dword [ebp - 0x20]
mov eax, dword [ebx + 0x60]
push 0x412520
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0x10
push 2
push dword [ebp - 0x20]
mov esi, ebx
push dword [ebp - 0x24]
mov ecx, esi
call fcn.004480d4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477dd
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x20]
xor edx, edx
push eax
inc edx
call fcn.004274d1
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477d3
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x20], eax
jae 0x447731
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x447570
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x47d4cc]
call esi
and dword [ebp - 0x24], 0
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x20]
mov esi, dword [eax + 0x50]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
call esi
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477c9
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
test eax, eax
je 0x4475d6
push dword [ebp - 0x20]
mov eax, dword [ebx + 0x60]
push 0x4124b0
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0x10
push 1
push dword [ebp - 0x20]
mov esi, ebx
push dword [ebp - 0x24]
mov ecx, esi
call fcn.004480d4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477bf
lea ecx, [esi + 0x1e8]
call fcn.004323c3
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477b5
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esi + 0x298]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, dword [ecx + eax*4]
call fcn.0043289b
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4477ab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x304], eax
xor eax, eax
mov dword [esi + 0x308], eax
mov dword [esi + 0x30c], eax
mov dword [esi + 0x318], eax
mov dword [esi + 0x31c], eax
jmp 0x447731
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x44778f
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jle 0x447690
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x447785
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x447734
cmp dword [ebp - 0x2c], 0xb
mov esi, dword [ebp - 0x18]
je 0x447731
cmp dword [ebp - 0x40], 0
je 0x4476c0
test byte [esi + 0x2ec], 1
jne 0x4476c0
xor eax, eax
jmp 0x4476c3
push 4
pop eax
push eax
push dword [ebp - 0x20]
mov ecx, esi
push dword [ebp - 0x24]
call fcn.004480d4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x447731
push 0xcf4
jmp 0x44740b
cmp eax, 0x102
jne 0x447731
mov eax, dword [esi + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
test eax, eax
je 0x44772e
mov ecx, dword [ebp - 0x18]
push 0x412588
push 3
mov eax, dword [ecx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0xc
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
test ebx, ebx
jns 0x447416
jmp 0x4478dd
cmp eax, 0xffffffff
je 0x447758
mov ebx, 0x8000ffff
mov dword [ebp - 0x1c], ebx
push 0xd09
jmp 0x44740b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jle 0x447775
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jns 0x44793e
push 0xd04
jmp 0x44740b
push 0xcff
jmp 0x44740b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push 0xcfe
jmp 0x44740b
push 0xcda
jmp 0x44740b
push 0xcd1
jmp 0x44740b
push 0xccd
jmp 0x44740b
push 0xccb
jmp 0x447917
push 0xcc2
jmp 0x44740b
push 0xcbe
jmp 0x44740b
push 0xcb7
jmp 0x447917
push 0xcb6
jmp 0x447917
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x447816
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x47d4cc]
call esi
and dword [ebp - 0x24], 0
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x20]
mov eax, dword [ebx]
mov esi, dword [eax + 0x50]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, ebx
call esi
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x447912
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
test eax, eax
je 0x44787e
push dword [ebp - 0x20]
mov eax, dword [ebx + 0x60]
push 0x412618
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
lea ecx, [ebx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0x10
push 2
push dword [ebp - 0x20]
mov esi, ebx
push dword [ebp - 0x24]
mov ecx, esi
call fcn.004480d4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x447908
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push ecx
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [0x47d4cc]
mov ecx, esi
call ebx
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x447901
cmp dword [ebp - 0x2c], 9
je 0x4478c5
cmp dword [ebp - 0x2c], 8
jne 0x4478eb
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x20]
xor edx, edx
push eax
inc edx
call fcn.004274d1
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
js 0x4478fa
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x20], eax
jb 0x4477fb
jmp 0x44793e
mov ebx, 0x8007139f
mov dword [ebp - 0x1c], ebx
push 0xd19
jmp 0x447917
push 0xd1b
jmp 0x447917
push 0xd17
jmp 0x447917
push 0xd15
jmp 0x44740b
push 0xd13
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
push 0x41240c
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
mov edx, ebx
mov ecx, eax
call fcn.0044dc99
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
test eax, eax
je 0x447984
mov ecx, dword [ebp - 0x18]
push 0x412688
push 2
mov eax, dword [ecx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0xc
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
test eax, eax
je 0x4479d3
mov ecx, dword [ebp - 0x18]
push 0x4126d8
push 2
mov eax, dword [ecx + 0x60]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d4cc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + 0x60]
call esi
push eax
call fcn.0044dce2
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x48], ebx
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x48]
push ecx
push ecx
push eax
mov esi, dword [ebx + 8]
push ecx
push 0x2004
mov ecx, dword [esi]
call dword [0x47d4cc]
lea ecx, [ebx + 8]
call dword [esi]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.004298d9
test edi, edi
je 0x447a0c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x447a27
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x47d4cc]
call esi
mov eax, ebx
call fcn.00474119
ret