Function at 0x44183d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x10]
mov esi, ecx
push eax
mov dword [ebp - 4], esi
call fcn.004389d3
movsx eax, al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dx, word [eax]
cmp dx, 0x2a
pop ecx
pop ecx
je 0x44188d
cmp dx, 0x2d
je 0x44188d
cmp dx, 0x2b
jne 0x441891
add dword [ebp + 0x10], 2
lea eax, [ebp + 0x10]
push eax
call fcn.00427312
lea eax, [ebp + 8]
push eax
call fcn.00427312
xor edi, edi
cmp dword [ebp - 0x24], ebx
pop ecx
pop ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], ebx
je 0x4418c8
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4418c8
cmp byte [eax + 0x69], bl
jne 0x4418c8
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
mov edi, eax
jmp 0x4418cb
mov dword [ebp - 0x24], ebx
test byte [ebp - 0x24], 2
je 0x4418d4
mov dword [ebp - 0x10], edi
cmp dx, 0x2a
mov dword [ebp - 0x14], ebx
jne 0x441ac5
push 0x8d4
call fcn.0046cbd8
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44190e
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.004386cc
mov esi, eax
jmp 0x441910
xor esi, esi
push 0x94
call fcn.0046cbd8
cmp eax, ebx
pop ecx
je 0x441931
push esi
push dword [ebp - 4]
mov ecx, eax
call fcn.0041cc20
mov edi, eax
mov dword [ebp - 0xc], edi
jmp 0x441936
mov dword [ebp - 0xc], ebx
mov edi, ebx
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x18], edi
mov byte [edi + 0x89], 3
mov dword [edi + 0x1c], eax
call fcn.00439a97
mov eax, dword [ebp - 8]
mov dword [esi + 0x88], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, esi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x154], eax
call fcn.00440ad3
mov edi, dword [ebp + 0x10]
push edi
lea ecx, [ebp + 0x10]
call fcn.004365ba
lea eax, [ebp + 0x10]
push eax
push edi
call fcn.00439f9e
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x6c]
call fcn.00436622
lea ecx, [ebp + 0x10]
call fcn.00427365
cmp edi, ebx
je 0x4419b0
cmp byte [esi + 0x69], bl
je 0x4419b0
push edi
lea ecx, [esi + 0x90]
call fcn.00436622
cmp byte [esi + 0x69], bl
mov dword [ebp + 0x10], 0x271b
jne 0x4419d5
cmp byte [esi + 0x8d], bl
jne 0x4419d5
cmp byte [esi + 0x8e], bl
je 0x4419dc
mov dword [ebp + 0x10], 0x271d
jmp 0x4419dc
mov dword [ebp + 0x10], 0x271c
push esi
call fcn.0042a3da
cmp dword [ebp + 0xc], ebx
pop ecx
mov edi, 0x4975e4
je 0x441a04
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
inc dword [eax + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push esi
call fcn.00429292
mov eax, dword [esi + 0x18]
push str.0x_I64X
cdq
push str.__LastWinID
push edx
push eax
push dword [ebp - 4]
call fcn.00438e64
add esp, 0x24
push ebx
mov ecx, esi
call fcn.00435f5e
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0xc]
push edi
mov dword [eax + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
call fcn.004366a8
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x441d1d
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xd0]
dec eax
cmp eax, ebx
jle 0x441a8e
cmp byte [esi + 0x69], bl
je 0x441a8e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x18], 2
mov byte [ebp + 0x13], 1
jle 0x441a91
mov byte [ebp + 0x13], bl
cmp byte [esi + 0x69], 0x81
mov dword [esi + 0xd0], eax
je 0x441aad
push ebx
push ebx
push 0x43d
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp byte [ebp + 0x13], bl
je 0x441ab9
mov byte [0x495280], 0xff
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x441d1d
cmp dx, 0x2d
jne 0x441c53
push 0x8d4
call fcn.0046cbd8
mov esi, eax
cmp esi, ebx
pop ecx
je 0x441afc
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x271b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.004386cc
mov esi, eax
jmp 0x441afe
xor esi, esi
push 0x94
call fcn.0046cbd8
cmp eax, ebx
pop ecx
je 0x441b1c
push esi
push dword [ebp - 4]
mov ecx, eax
call fcn.0041cc20
mov edi, eax
jmp 0x441b1e
xor edi, edi
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
mov ecx, edi
mov byte [edi + 0x89], 3
mov dword [edi + 0x1c], eax
call fcn.00439a97
mov eax, dword [ebp - 8]
mov dword [esi + 0x88], eax
mov eax, dword [ebp + 8]
push 1
mov ecx, esi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x154], eax
call fcn.00440ad3
mov eax, dword [esi + 0x14c]
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov dword [esi + 0x148], eax
call fcn.004365ba
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
lea edi, [esi + 0x6c]
call fcn.00439f9e
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.00436622
lea ecx, [ebp + 8]
call fcn.00427365
cmp dword [ebp - 0x1c], ebx
je 0x441b9e
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.0043667e
cmp dword [ebp + 0x10], ebx
je 0x441bb6
cmp byte [esi + 0x69], bl
je 0x441bb6
push dword [ebp + 0x10]
lea ecx, [esi + 0x90]
call fcn.00436622
cmp byte [esi + 0x69], bl
mov dword [ebp + 0x10], 0x271b
jne 0x441bdb
cmp byte [esi + 0x8d], bl
jne 0x441bdb
cmp byte [esi + 0x8e], bl
je 0x441be2
mov dword [ebp + 0x10], 0x271d
jmp 0x441be2
mov dword [ebp + 0x10], 0x271c
push esi
call fcn.0042a3da
mov eax, dword [ebp + 0xc]
cmp eax, ebx
pop ecx
mov byte [esi + 0x68], 1
mov dword [esi + 0x4c], eax
je 0x441c13
mov edi, 0x4975e4
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
inc dword [eax + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push esi
call fcn.00429292
mov eax, dword [esi + 0x18]
push str.0x_I64X
cdq
push str.__LastWinID
push edx
push eax
push dword [ebp - 4]
call fcn.00438e64
add esp, 0x24
push ebx
push ebx
push 0x110
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x441d1d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov esi, 0x4975bc
mov dword [ebp - 0x3c], edi
push esi
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x44]
push eax
push 0x10000
lea eax, [ebp - 0x60]
push eax
push 0x4412ce
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x441cda
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 0x10], 0x270f
cmp dword [ebp - 0x54], ebx
je 0x441cda
push ebx
call edi
dec dword [ebp + 0x10]
jns 0x441cc2
jmp 0x441cd5
push 1
call edi
cmp dword [ebp - 0x54], ebx
jne 0x441cd1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0xc], ebx
je 0x441cef
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.__LastTID
push dword [ebp - 0x44]
push dword [ebp - 4]
call fcn.0042e722
mov eax, dword [ebp - 0x48]
push str.0x_I64X
cdq
push str.__LastWinID
push edx
push eax
push dword [ebp - 4]
call fcn.00438e64
add esp, 0x20
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10