Function at 0x442937
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [eax - 8], edi
jne 0x442979
push edi
push edi
push 0x30
mov dword [0x47d9e8], edi
push dword [esi + 0x15c]
push dword [esi + 0x160]
push edi
call fcn.00411930
lea ecx, [esi + 0x40]
call fcn.004445c0
xor eax, eax
jmp 0x442d6d
mov eax, dword [0x47d024]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
call fcn.00449dd8
mov ecx, eax
call fcn.0044ab14
mov ebx, 0x475f7c
push ebx
lea ecx, [ebp - 4]
call fcn.0040b6b5
lea ecx, [esi + 0x40]
mov dword [ebp - 0xc], ecx
call fcn.004441e1
test al, al
jne 0x442a85
mov eax, dword [ebp - 8]
cmp dword [eax - 8], edi
jne 0x4429e3
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x4429e3
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.0040ad14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043f0e5
mov ecx, eax
call fcn.0043a6b2
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.004447d3
push dword [eax]
push dword [ebp - 0x14]
call fcn.00451160
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x20]
inc bl
call fcn.00408318
test bl, bl
je 0x442a29
lea eax, [ebp - 8]
push eax
jmp 0x442a75
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.004447d3
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043f0e5
mov ecx, eax
call fcn.0043a602
push eax
lea ecx, [ebp - 4]
call fcn.0040ad14
lea ecx, [ebp - 0x20]
call fcn.00408318
lea ecx, [ebp - 0x24]
call fcn.00408318
push 0x475f7c
push dword [ebp - 4]
call fcn.0044fac5
pop ecx
pop ecx
test eax, eax
jne 0x442a7d
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
call fcn.0040ad14
lea ecx, [ebp - 0x14]
jmp 0x442b67
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.0043f0e5
mov ecx, eax
call fcn.0043a602
push eax
lea ecx, [ebp - 4]
call fcn.0040ad14
lea ecx, [ebp - 0x24]
call fcn.00408318
push str.S_MRI
push dword [ebp - 4]
call fcn.0044fac5
pop ecx
pop ecx
test eax, eax
je 0x442b51
mov eax, dword [ebp - 4]
cmp dword [eax - 8], edi
jne 0x442ad9
push str.S_MRI
push dword [ebp + 0x10]
call fcn.0040e003
test al, al
jne 0x442b51
push ebx
push dword [ebp - 4]
call fcn.0044fac5
pop ecx
pop ecx
test eax, eax
jne 0x442b6c
push dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
call fcn.0040b682
lea ecx, [ebp - 0x14]
call fcn.00409822
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0043f0e5
mov ecx, eax
call fcn.0043a6b2
push eax
lea ecx, [ebp - 4]
call fcn.0040ad14
lea ecx, [ebp - 0x24]
call fcn.00408318
push ebx
lea eax, [ebp - 4]
push eax
call fcn.0040e01d
test al, al
je 0x442a72
mov ecx, dword [ebp - 0xc]
push edi
lea eax, [ebp - 4]
push eax
call fcn.00445520
jmp 0x442a72
lea eax, [ebp - 0x24]
push eax
call fcn.00414a65
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.0040ad14
lea ecx, [ebp - 0x24]
call fcn.00408318
mov eax, dword [ebp - 4]
cmp dword [eax - 8], edi
je 0x442bc4
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.00441e48
test eax, eax
jne 0x442bc4
push edi
push edi
push 0x30
mov dword [0x47d9e8], edi
push dword [esi + 0x15c]
push dword [esi + 0x160]
push edi
call fcn.00411930
mov ecx, dword [ebp - 0xc]
call fcn.004445c0
lea ecx, [ebp - 4]
call fcn.00408318
lea ecx, [ebp - 0x10]
call fcn.00408318
lea ecx, [ebp - 8]
call fcn.00408318
jmp 0x442972
mov ebx, dword [ebp + 0x14]
mov eax, ebx
dec eax
je 0x442c1d
sub eax, 0xf
je 0x442c0e
dec eax
jne 0x442c37
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
jne 0x442bf0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0043815e
test al, al
je 0x442bf0
push 0x10
pop ebx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jne 0x442c37
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0043815e
test al, al
je 0x442c37
and ebx, 0xffffffef
jmp 0x442c37
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
jmp 0x442c2a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0043817b
test al, al
je 0x442c37
push 0x11
pop ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00449dd8
mov ecx, eax
call fcn.0044ab60
cmp dword [ebp + 8], edi
jne 0x442c58
cmp dword [ebp + 0xc], edi
je 0x442cae
mov eax, dword [esi + 0x238]
cmp eax, edi
je 0x442c69
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov eax, dword [eax - 8]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044b582
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push ebx
call fcn.0044fc24
add esp, 0x10
push edi
push edi
push ebx
push 0x437223
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x238], eax
mov ecx, dword [ebp - 0xc]
push edi
call fcn.00444217
push ecx
lea eax, [esi + 0x148]
mov ecx, esp
push eax
call fcn.0040e0a0
mov ecx, dword [ebp - 0xc]
push edi
call fcn.0044468c
add esi, 0x12c
cmp dword [esi], edi
je 0x442d27
mov ecx, dword [ebp - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.004447d3
mov ebx, dword [esi]
mov eax, dword [eax]
cmp ebx, edi
jne 0x442cf7
push 0x80004003
call fcn.0044c560
push ecx
mov ecx, esp
push eax
call fcn.0040e06c
mov ecx, ebx
call fcn.0040e64c
lea ecx, [ebp + 8]
call fcn.00408318
mov ebx, dword [esi]
cmp ebx, edi
je 0x442ced
push ecx
mov ecx, esp
push dword [ebp - 4]
call fcn.0040e06c
mov ecx, ebx
call fcn.00422e97
xor edi, edi
inc edi
push edi
push ecx
mov ecx, esp
push esi
call fcn.004211fd
call fcn.00412674
pop ecx
pop ecx
call fcn.0043f0e5
push dword [ebp + 0x10]
lea ecx, [eax + 0x40]
call fcn.0040ad14
call fcn.0043f0e5
lea ecx, [ebp - 4]
mov dword [eax + 0x44], edi
call fcn.00408318
lea ecx, [ebp - 0x10]
call fcn.00408318
lea ecx, [ebp - 8]
call fcn.00408318
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10