Function at 0x490820
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c0
call fcn.004c38f0
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push 0x4fbd20
push esi
push eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1068], ecx
call fcn.004c905a
mov eax, dword [ebp - 0x1068]
add esp, 0xc
test eax, eax
je 0x490874
mov dword [eax], 0
cmp word [ebx], 0
je 0x4908b4
mov ecx, 0x5134d0
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4908a7
test dx, dx
je 0x4908a3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4908a7
add eax, 4
add ecx, 4
test dx, dx
jne 0x490881
xor eax, eax
jmp 0x4908ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4909f3
push 0
push dword [edi + 8]
push dword [edi + 4]
call fcn.004956f0
add esp, 0xc
mov dword [ebp - 0x1064], eax
test eax, eax
jne 0x49096d
cmp dword [0x53b5e4], 0xffffffff
je 0x49095a
lea esi, [esi*2 + 8]
push esi
call fcn.004c8c9a
mov ecx, dword [edi + 4]
add esp, 4
mov dword [ebp - 0x107c], ecx
mov ecx, dword [edi]
mov dword [ebp - 0x1078], ecx
mov ecx, dword [edi + 8]
push 0
mov dword [ebp - 0x1070], ecx
lea ecx, [ebp - 0x1064]
push ecx
push esi
push eax
push 0x10
mov dword [ebp - 0x1060], eax
lea eax, [ebp - 0x107c]
push eax
push 0x8335004c
push dword [0x53b5e4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [ebp - 0x1060]
test eax, eax
je 0x490949
lea eax, [esi + 4]
push eax
push 0x40
push ebx
call fcn.004c905a
add esp, 0xc
push esi
call fcn.004c8c7f
mov esi, dword [ebp + 0x14]
add esp, 4
jmp 0x4909f3
push 0x5134d0
push ebx
call fcn.0048d560
add esp, 8
jmp 0x4909f3
lea ecx, [ebp - 0x1058]
push ecx
push 0
push 0
push 2
push eax
call sub.ntdll.dll_NtQueryObject
push dword [ebp - 0x1058]
call fcn.004c8c9a
add esp, 4
mov dword [ebp - 0x1060], eax
push 0
push dword [ebp - 0x1058]
push eax
push 2
push dword [ebp - 0x1064]
call sub.ntdll.dll_NtQueryObject
test eax, eax
jne 0x4909ca
mov ecx, dword [ebp - 0x1060]
movzx eax, word [ecx]
shr eax, 1
push eax
push dword [ecx + 4]
push 0x40
push ebx
call fcn.004c927f
add esp, 0x10
jmp 0x4909d9
push eax
push 0x5134f0
push ebx
call fcn.0048d560
add esp, 0xc
push dword [ebp - 0x1060]
call fcn.004c8c7f
add esp, 4
push dword [ebp - 0x1064]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x513518
push ebx
call fcn.004c9380
add esp, 8
test eax, eax
je 0x490d91
push 0x513528
push ebx
call fcn.004c9380
add esp, 8
test eax, eax
je 0x490d91
push 0x51356c
push ebx
call fcn.004c9380
add esp, 8
test eax, eax
jne 0x490b4f
push 8
push dword [edi + 8]
push dword [edi + 4]
call fcn.004956f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x490eea
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x106c]
push eax
push 0x38
lea eax, [ebp - 0x1054]
mov dword [ebp - 0x1048], 0
push eax
push 0xa
push edi
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x106c], 0x38
call esi
mov eax, dword [ebp - 0x1048]
mov ebx, dword [ebp - 0x104c]
mov dword [ebp - 0x1068], eax
lea eax, [ebp - 0x106c]
push eax
push 0x800
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x106c], 0x800
push eax
push 1
push edi
call esi
test eax, eax
je 0x490b37
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x1084], 0x104
push eax
lea eax, [ebp - 0x1080]
mov dword [ebp - 0x1080], 0x104
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x101c]
push 0x4fbd20
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x490b37
push dword [ebp - 0x1068]
lea eax, [ebp - 0x40c]
push ebx
push eax
lea eax, [ebp - 0x614]
push eax
push 0x513578
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x513590
push ebx
call fcn.004c9380
add esp, 8
test eax, eax
jne 0x490b99
push eax
push dword [edi + 8]
push dword [edi + 4]
call fcn.004956f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x490eea
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
cmp dword [0x53b5e4], 0xffffffff
je 0x490c46
lea esi, [esi*2 + 8]
push esi
call fcn.004c8c9a
mov ecx, dword [edi + 4]
mov dword [ebp - 0x107c], ecx
mov ecx, dword [edi]
push 0x5135b0
push ebx
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1078], ecx
call fcn.004c9380
mov ebx, dword [ebp - 0x1064]
test eax, eax
mov eax, dword [edi + 8]
push esi
push ebx
mov dword [ebp - 0x1070], eax
sete byte [ebp - 0x1074]
push 0x10
lea eax, [ebp - 0x107c]
push eax
push 0x83350048
call fcn.004a7890
add esp, 0x20
test eax, eax
je 0x490c2c
lea eax, [ebx + 4]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.004c905a
mov ecx, dword [ebp - 0x1068]
add esp, 0xc
test ecx, ecx
je 0x490c2c
mov eax, dword [ebx]
mov dword [ecx], eax
push ebx
call fcn.004c8c7f
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0
push dword [edi + 8]
push dword [edi + 4]
call fcn.004956f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x490eea
push 0x400
mov dword [ebp - 0x1058], 0x400
call fcn.004c8c9a
mov ecx, dword [ebp - 0x1058]
mov ebx, eax
add esp, 4
xorps xmm0, xmm0
add ecx, 0xfffffff8
movq qword [ebx], xmm0
push 0x556b10
mov word [ebx], cx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x567888], 0
jne 0x490cc4
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x567888], eax
call esi
mov dword [0x56788c], eax
cmp dword [0x567884], 0
jne 0x490cee
lea eax, [ebp - 0x108c]
push eax
push 0
push 0
push 0x490430
push 0
push 0
call fcn.004d6048
add esp, 0x18
mov dword [0x567884], eax
push dword [0x567888]
mov dword [0x567894], ebx
mov dword [0x567890], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
push dword [0x56788c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x490d44
push 1
push dword [0x567884]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x567884]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x567884], 0
jmp 0x490d65
cmp dword [0x567898], 0
jne 0x490d65
cmp dword [ebx + 4], 0
je 0x490d65
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.004a7440
add esp, 0xc
push ebx
call fcn.004c8c7f
add esp, 4
push 0x556b10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x513518
push ebx
call fcn.004c9380
neg eax
sbb eax, eax
and eax, 0xfffffc40
add eax, 0x400
push eax
push dword [edi + 8]
push dword [edi + 4]
call fcn.004956f0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x490eb5
push 0x50c2f0
push ebx
call fcn.004c9380
add esp, 8
test eax, eax
lea eax, [ebp - 0x1058]
push eax
jne 0x490e47
push 0x18
lea eax, [ebp - 0x10c0]
push eax
push 0
push edi
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x490e9d
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x10b0]
call fcn.004aa530
push dword [ebp - 0x10b0]
lea eax, [ebp - 0x204]
push eax
push 0x513538
push esi
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x10a8]
push eax
push 0
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
jne 0x490e9d
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x10a0]
call fcn.004aa530
push dword [ebp - 0x109c]
lea eax, [ebp - 0x204]
push dword [ebp - 0x10a0]
push eax
push 0x513548
push esi
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x28
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
cmp dword [0x53b5e4], 0xffffffff
je 0x490eea
lea eax, [ebp - 0x81c]
push 0x104
push eax
call fcn.00490260
lea eax, [ebp - 0x81c]
push eax
push 0x513560
push esi
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret