Function at 0x434ea0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3ef0
mov eax, dword fs:[0]
push eax
mov eax, 0x20ac
call fcn.004a7970
mov eax, dword [0x517b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push 0
mov eax, dword [ebx + 0xc]
and eax, 1
mov dword [ebp - 0x20a4], esi
push 0x1042
push esi
mov dword [ebp - 0x20ac], ebx
lea eax, [eax*2 - 1]
mov dword [ebp - 0x2098], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x434f2a
cmp dword [ebp - 0x2098], 0
jle 0x434f1b
xor edi, edi
jmp 0x434f30
mov ecx, 0x52da90
call fcn.00427ae0
lea edi, [eax - 1]
jmp 0x434f30
add edi, dword [ebp - 0x2098]
test byte [ebx + 0xc], 4
mov ecx, fcn.004bad40
mov eax, fcn.004ba850
mov dword [ebp - 0x2094], edi
cmovne eax, ecx
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x20a8], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434f53
push 0x30
sub ecx, edx
lea eax, [ebp - 0x2040]
sar ecx, 1
push 0
push eax
mov dword [ebp - 0x20a0], ecx
call fcn.004aa220
add esp, 0xc
cmp dword [ebp - 0x2098], 0
jle 0x434f92
mov ecx, 0x52da90
call fcn.00427ae0
sub eax, edi
jmp 0x434f94
mov eax, edi
mov dword [ebp - 0x2040], eax
mov dword [ebp - 0x203c], 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount64]
push 0x4e6ea0
mov dword [ebp - 0x2038], eax
mov dword [ebp - 0x2034], edx
call fcn.004a27e0
push eax
push 0x4e6ea0
call fcn.004a29e0
add esp, 0xc
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2040], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x202c], eax
mov dword [ebp - 0x2028], 0
mov dword [ebp - 0x2018], 0
je 0x4350c2
test esi, esi
je 0x435035
lea eax, [ebp - 0x2050]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x2048]
add eax, dword [ebp - 0x2050]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2024], eax
mov eax, dword [ebp - 0x2044]
add eax, dword [ebp - 0x204c]
jmp 0x435050
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
push 1
mov dword [ebp - 0x2024], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
push 2
sar eax, 1
push esi
mov dword [ebp - 0x2020], eax
call dword [sym.imp.USER32.dll_GetAncestor]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
mov dword [ebp - 0x2018], esi
test esi, esi
je 0x435097
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x435097
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x435077
lea eax, [ebp - 0x2054]
push eax
push 0
lea eax, [ebp - 0x2040]
push eax
push 0x419a50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, dword [ebp - 0x20a4]
mov dword [ebp - 0x201c], eax
push esi
mov dword [ebp - 4], 0
call fcn.004525f0
add esp, 4
mov ebx, eax
mov ecx, 0x52da90
mov dword [ebp - 0x20b8], ebx
call fcn.00427ae0
cmp edi, eax
jae 0x43528a
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x20b0], eax
test ebx, ebx
jle 0x43524a
lfence
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0x2088], eax
xor ecx, ecx
lea eax, [ebp - 0x2010]
mov word [ebp - 0x2010], cx
mov dword [ebp - 0x207c], eax
lea eax, [ebp - 0x2090]
push eax
push edi
push 0x1073
push esi
mov dword [ebp - 0x2078], 0x1000
call dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [ebp - 0x2010]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x435152
sub edi, ecx
xor esi, esi
mov ecx, dword [ebp - 0x20a0]
sar edi, 1
mov eax, edi
sub eax, ecx
inc eax
mov dword [ebp - 0x20b4], eax
test eax, eax
jle 0x435229
lea ebx, [ebp - 0x2010]
mov eax, ebx
lfence
lea eax, [eax + ecx*2]
mov dword [ebp - 0x209c], eax
mov eax, dword [ebp - 0x20ac]
push ecx
mov ecx, dword [ebp - 0x20a8]
push dword [eax + 0x10]
push ebx
call dword [0x4dc8a4]
call dword [ebp - 0x20a8]
add esp, 0xc
test eax, eax
jne 0x435206
mov eax, dword [ebp - 0x20ac]
test byte [eax + 0xc], 2
je 0x43533a
test esi, esi
jle 0x4351d9
movzx eax, word [ebx - 2]
push eax
call fcn.004ba274
add esp, 4
test eax, eax
jne 0x435206
mov eax, dword [ebp - 0x20a0]
add eax, esi
cmp eax, edi
jae 0x43533a
mov eax, dword [ebp - 0x209c]
lfence
movzx eax, word [eax]
push eax
call fcn.004ba274
add esp, 4
test eax, eax
je 0x43533a
add dword [ebp - 0x209c], 2
inc esi
mov ecx, dword [ebp - 0x20a0]
add ebx, 2
cmp esi, dword [ebp - 0x20b4]
jl 0x435190
mov ebx, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x20b0]
mov edi, dword [ebp - 0x2094]
inc eax
mov esi, dword [ebp - 0x20a4]
mov dword [ebp - 0x20b0], eax
cmp eax, ebx
jl 0x435110
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
jne 0x4353ed
mov ecx, 0x52da90
call fcn.00427ae0
add edi, dword [ebp - 0x2098]
mov ecx, 0x52da90
inc dword [ebp - 0x203c]
mov dword [ebp - 0x2040], eax
mov dword [ebp - 0x2094], edi
call fcn.00427ae0
cmp edi, eax
jb 0x4350f0
cmp dword [ebp - 0x2040], 0
je 0x435306
mov eax, dword [ebp - 0x2028]
test eax, eax
jne 0x4352b2
nop dword [eax]
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0x2028]
test eax, eax
je 0x4352a0
push 0
push 1
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x2018]
test esi, esi
je 0x435306
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x435306
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x4352e6
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2030]
test ecx, ecx
je 0x43531c
call fcn.004a2a20
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a71aa
mov esp, ebp
pop ebp
ret
push 1
push dword [ebp - 0x2094]
lfence
push dword [ebp - 0x20a4]
call fcn.00469d00
add esp, 0xc
cmp dword [ebp - 0x2040], 0
je 0x4353d0
mov eax, dword [ebp - 0x2028]
test eax, eax
jne 0x435378
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0x2028]
test eax, eax
je 0x435366
push 0
push 1
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x2018]
test esi, esi
je 0x4353d0
nop dword [eax]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x4353d0
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x4353b0
mov ecx, dword [ebp - 0x2030]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4353e6
call fcn.004a2a20
mov al, 1
jmp 0x43531e
cmp dword [ebp - 0x2040], 0
je 0x435466
mov eax, dword [ebp - 0x2028]
test eax, eax
jne 0x435412
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0x2028]
test eax, eax
je 0x435400
push 0
push 1
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x2018]
test esi, esi
je 0x435466
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x435466
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x435446
mov dword [ebp - 4], 2
jmp 0x43530d