Function at 0x4379c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
or dword [esp + 0x20], 0xffffffff
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [esp + 0x40], esi
lea edi, [esp + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push 1
stosd dword es:[edi], eax
push 1
xor eax, eax
mov dword [esp + 0x3c], esi
lea edi, [esp + 0x40]
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
stosd dword es:[edi], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], eax
mov eax, dword [0x52241c]
shl eax, 2
push eax
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
cmp eax, esi
mov dword [esp + 0x1c], eax
je 0x437d83
mov eax, dword [0x52241c]
shl eax, 2
push eax
push 8
call ebx
push eax
call edi
cmp eax, esi
mov dword [esp + 0x18], eax
je 0x437d83
mov ecx, dword [0x52241c]
cmp ecx, esi
jbe 0x437a6f
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x40], eax
mov eax, dword [0x522420]
mov dword [esp + 0x44], eax
mov eax, dword [0x522424]
push esi
mov dword [esp + 0x4c], eax
mov eax, dword [0x522428]
push esi
push esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
or dword [esp + 0x3c], 0xffffffff
push esi
push esi
push 0x43753c
push 0x3e8
lea ecx, [esp + 0x48]
push ecx
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], 0xff676980
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 1
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x4c]
push eax
push 4
call edi
cmp eax, esi
je 0x437d83
jmp 0x437af1
mov ebx, dword [esp + 0x14]
cmp eax, 1
je 0x437c3d
cmp eax, 2
je 0x437bc1
cmp eax, 3
je 0x437b2c
cmp eax, 0xc0
je 0x437d37
cmp eax, 0xffffffff
jne 0x437d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1ab
jmp 0x437d6d
cmp dword [esp + 0x10], esi
je 0x437b53
push 0x1f4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x437b53
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], esi
mov edi, 0x52251c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x522518]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, esi
jbe 0x437d37
cmp dword [esp + 0x10], esi
jne 0x437d37
push str.Starting_ProcessStationRequestThread
call fcn.0048bf80
pop ecx
push esi
push esi
push dword [ebp + 8]
push 0x4379af
push esi
push esi
call fcn.00443185
add esp, 0x18
cmp eax, esi
mov dword [esp + 0x10], eax
jne 0x437d37
call fcn.00445f58
push dword [eax]
push str.Failed_to_create_stations_requests_process_thread___d_
call fcn.0048bf00
pop ecx
pop ecx
jmp 0x437d37
push 1
push 0x3e8
push esi
lea eax, [esp + 0x3c]
push eax
push 2
call edi
cmp eax, 0xc0
je 0x437d37
cmp eax, 0x102
je 0x437d37
cmp eax, 0xffffffff
je 0x437d55
cmp eax, 2
jae 0x437d37
lea edi, [esp + eax*4 + 0x30]
mov eax, dword [edi]
cmp eax, ebx
je 0x437c0d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
push esi
push esi
push esi
push 0x435a8b
push esi
push esi
call fcn.00443185
add esp, 0x18
cmp eax, esi
mov dword [edi], eax
jne 0x437c2c
mov dword [edi], ebx
jmp 0x437d37
push dword [0x522424]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x437d37
push 1
push 0x1f4
push esi
push dword [esp + 0x28]
push dword [0x52241c]
call edi
cmp eax, 0xc0
je 0x437d37
cmp eax, 0x102
je 0x437d37
cmp eax, 0xffffffff
je 0x437d62
cmp eax, dword [0x52241c]
jae 0x437d37
mov ebx, eax
mov eax, dword [esp + 0x1c]
shl ebx, 2
lea edi, [ebx + eax]
mov eax, dword [edi]
cmp eax, dword [esp + 0x14]
je 0x437cf1
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x28], esi
je 0x437ce3
push dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push dword [ebx + eax]
push dword [edi]
push str.ScannerThread__08x__for_computer__d_exited_with_code__08x
call fcn.0048bf00
mov eax, dword [esp + 0x28]
push dword [ebx + eax]
call fcn.00438722
add esp, 0x14
test eax, eax
je 0x437ce3
mov eax, dword [esp + 0x18]
push dword [ebx + eax]
push str.Computer__d_removed_from_in_progress_set_by_thread_dispatcher
call fcn.0048c080
pop ecx
pop ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
mov dword [edi], eax
lea eax, [esp + 0x2c]
push eax
call fcn.0043879d
test eax, eax
pop ecx
jne 0x437d0b
push dword [0x522420]
jmp 0x437c32
mov eax, dword [esp + 0x18]
push esi
add ebx, eax
mov eax, dword [esp + 0x30]
push esi
push ebx
push 0x438488
push esi
push esi
mov dword [ebx], eax
call fcn.00443185
add esp, 0x18
cmp eax, esi
mov dword [edi], eax
jne 0x437d37
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov dword [ebx], esi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 1
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x4c]
push eax
push 4
call edi
cmp eax, esi
jne 0x437aed
jmp 0x437d83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1f1
jmp 0x437d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1bb
push 5
push 0xffffffffffffffff
push eax
mov ecx, 0x4fe040
mov dword [esp + 0x34], eax
call fcn.0042cdde
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0xffffffffffffffff
push 1
push dword [esp + 0x24]
push dword [0x52241c]
call edi
push 0xffffffffffffffff
push 1
lea eax, [esp + 0x38]
push eax
push 2
call edi
cmp dword [esp + 0x10], esi
je 0x437dc6
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
jmp 0x437dcc
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, dword [esp + edi*4 + 0x30]
cmp eax, dword [esp + 0x14]
je 0x437ddb
push eax
call ebx
inc edi
cmp edi, 2
jb 0x437dce
cmp dword [esp + 0x20], esi
je 0x437df7
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push dword [esp + 0x20]
call ebx
cmp dword [esp + 0x1c], esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x437e11
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
cmp dword [esp + 0x18], esi
je 0x437e25
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
cmp dword [esp + 0x14], esi
je 0x437e31
push dword [esp + 0x14]
call ebx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret