Function at 0x44c852
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x10]
push eax
mov dword [ebp - 4], ecx
call fcn.00442685
movsx eax, al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dx, word [eax]
cmp dx, 0x2a
pop ecx
pop ecx
je 0x44c8a0
cmp dx, 0x2d
je 0x44c8a0
cmp dx, 0x2b
jne 0x44c8a4
add dword [ebp + 0x10], 2
lea eax, [ebp + 0x10]
push eax
call fcn.00430961
lea eax, [ebp + 8]
push eax
call fcn.00430961
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp dword [ebp - 0x28], ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], ebx
je 0x44c8db
cmp eax, ebx
je 0x44c8db
cmp byte [eax + 0x75], bl
jne 0x44c8db
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0xc], ecx
mov esi, ecx
jmp 0x44c8de
mov dword [ebp - 0x28], ebx
test byte [ebp - 0x28], 2
je 0x44c8e7
mov dword [ebp - 0x14], esi
cmp dx, 0x2a
mov dword [ebp - 0x10], ebx
jne 0x44caab
mov dword [ebp - 0x10], ebx
push 0x8d8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
call fcn.00480078
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44c92a
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.00442373
mov esi, eax
jmp 0x44c92c
xor esi, esi
push 0x9c
call fcn.00480078
cmp eax, ebx
pop ecx
je 0x44c94a
push esi
push dword [ebp - 4]
mov ecx, eax
call fcn.00428357
mov edi, eax
jmp 0x44c94c
xor edi, edi
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x1c], edi
mov byte [edi + 0x91], 3
mov dword [edi + 0x18], eax
call fcn.00443839
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x94], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, esi
mov dword [esi + 0x150], edi
mov dword [esi + 0x158], eax
call fcn.0044bc74
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
call fcn.004403c3
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
call fcn.00443d40
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x78]
call fcn.0044042b
lea ecx, [ebp + 8]
call fcn.0043092f
cmp dword [ebp + 0x10], ebx
je 0x44c9ca
cmp byte [esi + 0x75], bl
je 0x44c9ca
push dword [ebp + 0x10]
lea ecx, [esi + 0x9c]
call fcn.0044042b
cmp byte [esi + 0x75], bl
mov dword [ebp + 0x10], 0x271b
jne 0x44c9ef
cmp byte [esi + 0x99], bl
jne 0x44c9ef
cmp byte [esi + 0x9a], bl
je 0x44c9f6
mov dword [ebp + 0x10], 0x271d
jmp 0x44c9f6
mov dword [ebp + 0x10], 0x271c
push esi
call fcn.0042c298
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00430e0c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
pop ecx
pop ecx
je 0x44ca2a
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x75], bl
je 0x44ca2a
mov ecx, dword [ebp - 4]
push 2
pop eax
cmp dword [ecx + 0x14], eax
jg 0x44ca2a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push esi
call fcn.00432d82
push str.0x_X
push str.__LastWinID
push dword [esi + 0x18]
push dword [ebp - 4]
call fcn.0043807b
add esp, 0x20
push ebx
mov ecx, esi
call fcn.00478358
push 0x4ad684
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0x4ad684
mov dword [edi + 0x28], ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp - 0x1c]
call fcn.0044024a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
cmp dword [ebp - 8], ebx
je 0x44cd43
mov eax, dword [ebp - 0x18]
push ebx
or eax, 1
push eax
push 0x451
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44cd43
cmp dx, 0x2d
jne 0x44cc30
push 0x8d8
call fcn.00480078
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44cae2
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.00442373
mov esi, eax
jmp 0x44cae4
xor esi, esi
push 0x9c
call fcn.00480078
cmp eax, ebx
pop ecx
je 0x44cb02
push esi
push dword [ebp - 4]
mov ecx, eax
call fcn.00428357
mov edi, eax
jmp 0x44cb04
xor edi, edi
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
mov ecx, edi
mov byte [edi + 0x91], 3
mov dword [edi + 0x18], eax
call fcn.00443839
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x94], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, esi
mov dword [esi + 0x150], edi
mov dword [esi + 0x158], eax
call fcn.0044bc74
mov eax, dword [esi + 0x150]
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov dword [esi + 0x14c], eax
call fcn.004403c3
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
lea edi, [esi + 0x78]
call fcn.00443d40
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.0044042b
lea ecx, [ebp + 8]
call fcn.0043092f
cmp dword [ebp - 0x20], ebx
je 0x44cb84
push dword [ebp - 0x20]
mov ecx, edi
call fcn.00440487
cmp dword [ebp + 0x10], ebx
je 0x44cb9c
cmp byte [esi + 0x75], bl
je 0x44cb9c
push dword [ebp + 0x10]
lea ecx, [esi + 0x9c]
call fcn.0044042b
cmp byte [esi + 0x75], bl
mov dword [ebp + 0x10], 0x271b
jne 0x44cbc1
cmp byte [esi + 0x99], bl
jne 0x44cbc1
cmp byte [esi + 0x9a], bl
je 0x44cbc8
mov dword [ebp + 0x10], 0x271d
jmp 0x44cbc8
mov dword [ebp + 0x10], 0x271c
push esi
call fcn.0042c298
mov edi, dword [ebp + 0xc]
cmp edi, ebx
pop ecx
mov byte [esi + 0x74], 1
mov dword [esi + 0x4c], edi
je 0x44cbf9
push 0x4ad684
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
inc dword [edi + 0xd4]
push 0x4ad684
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push esi
call fcn.00432d82
push str.0x_X
push str.__LastWinID
push dword [esi + 0x18]
push dword [ebp - 4]
call fcn.0043807b
add esp, 0x20
push ebx
push ebx
push pe_nt_image_headers32
push dword [esi + 0x18]
jmp 0x44caa0
mov edi, dword [ebp + 0x10]
mov cx, word [edi - 2]
sub cx, 0x2b
neg cx
sbb ecx, ecx
and ecx, eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], ebx
push dword [ebp + 0xc]
call fcn.00430e0c
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
pop ecx
mov edi, 0x4ad69c
mov dword [ebp - 0x40], eax
push edi
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [ebp - 0x50]
push eax
push 0x10000
lea eax, [ebp - 0x6c]
push eax
push 0x44c53a
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x44cce7
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp + 0xc], 0x270f
cmp dword [ebp - 0x60], ebx
je 0x44cce7
push ebx
call esi
dec dword [ebp + 0xc]
jns 0x44cccf
jmp 0x44cce2
push 1
call esi
cmp dword [ebp - 0x60], ebx
jne 0x44ccde
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [ebp + 8], ebx
je 0x44ccfc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp + 0x10], ebx
je 0x44cd17
cmp dword [ebp - 0x44], ebx
je 0x44cd17
push ebx
push 1
push 0x451
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
push str.__LastTID
push dword [ebp - 0x50]
push dword [ebp - 4]
call fcn.004380a5
mov eax, dword [ebp - 0x54]
push str.0x_X
push str.__LastWinID
push eax
push dword [ebp - 4]
call fcn.0043807b
add esp, 0x1c
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10