Function at 0x467c90
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c0
call fcn.00492790
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
push 0x4af9b8
push esi
push eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x106c], ecx
call fcn.004911bd
mov eax, dword [ebp - 0x106c]
add esp, 0xc
test eax, eax
je 0x467ce4
mov dword [eax], 0
cmp word [edi], 0
je 0x467d24
mov ecx, 0x4c0924
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x467d17
test dx, dx
je 0x467d13
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x467d17
add eax, 4
add ecx, 4
test dx, dx
jne 0x467cf1
xor eax, eax
jmp 0x467d1c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x467e4f
push 0
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0046d6f0
add esp, 0xc
mov dword [ebp - 0x1064], eax
test eax, eax
jne 0x467dd7
cmp dword [0x4db648], 0xffffffff
je 0x467dc7
lea esi, [esi*2 + 8]
push esi
call fcn.0048fb2f
mov ecx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x107c], ecx
mov ecx, dword [ebx]
mov dword [ebp - 0x1078], ecx
mov ecx, dword [ebx + 8]
push 0
mov dword [ebp - 0x1070], ecx
lea ecx, [ebp - 0x1058]
push ecx
push esi
push eax
push 0x10
mov dword [ebp - 0x1064], eax
lea eax, [ebp - 0x107c]
push eax
push 0x8335004c
push dword [0x4db648]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [ebp - 0x1064]
test eax, eax
je 0x467db9
lea eax, [esi + 4]
push eax
push 0x40
push edi
call fcn.004911bd
add esp, 0xc
push esi
call fcn.0048faf7
add esp, 4
jmp 0x467e4c
push 0x4c0924
push edi
call fcn.004652f0
add esp, 8
jmp 0x467e4f
lea ecx, [ebp - 0x1060]
push ecx
push 0
push 0
push 2
push eax
call dword [0x4ea044]
mov esi, dword [ebp - 0x1060]
push esi
call fcn.0048fb2f
add esp, 4
push 0
push esi
mov esi, eax
push esi
push 2
push dword [ebp - 0x1064]
call dword [0x4ea044]
test eax, eax
jne 0x467e28
movzx eax, word [esi]
shr eax, 1
push eax
push dword [esi + 4]
push 0x40
push edi
call fcn.0049124f
add esp, 0x10
jmp 0x467e37
push eax
push 0x4c0944
push edi
call fcn.004652f0
add esp, 0xc
push esi
call fcn.0048faf7
add esp, 4
push dword [ebp - 0x1064]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 0x14]
push 0x4c096c
push edi
call fcn.00491646
add esp, 8
test eax, eax
je 0x4681ec
push 0x4c097c
push edi
call fcn.00491646
add esp, 8
test eax, eax
je 0x4681ec
push 0x4c09d0
push edi
call fcn.00491646
add esp, 8
test eax, eax
jne 0x467fab
push 8
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0046d6f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x468346
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1068]
push eax
push 0x38
lea eax, [ebp - 0x1054]
mov dword [ebp - 0x1048], 0
push eax
push 0xa
push edi
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1068], 0x38
call esi
mov eax, dword [ebp - 0x1048]
mov ebx, dword [ebp - 0x104c]
mov dword [ebp - 0x1058], eax
lea eax, [ebp - 0x1068]
push eax
push 0x800
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x1068], 0x800
push eax
push 1
push edi
call esi
test eax, eax
je 0x467f93
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x1080], 0x104
push eax
lea eax, [ebp - 0x1084]
mov dword [ebp - 0x1084], 0x104
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x101c]
push 0x4af9b8
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x467f93
push dword [ebp - 0x1058]
lea eax, [ebp - 0x81c]
push ebx
push eax
lea eax, [ebp - 0x614]
push eax
push 0x4c09dc
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.00492202
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c09f0
push edi
call fcn.00491646
add esp, 8
test eax, eax
jne 0x467ff5
push eax
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0046d6f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x468346
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
cmp dword [0x4db648], 0xffffffff
je 0x4680a2
lea esi, [esi*2 + 8]
push esi
call fcn.0048fb2f
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x107c], ecx
mov ecx, dword [ebx]
push 0x4c0a10
push edi
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x1078], ecx
call fcn.00491646
test eax, eax
mov eax, dword [ebx + 8]
mov ebx, dword [ebp - 0x1058]
push esi
push ebx
mov dword [ebp - 0x1070], eax
sete byte [ebp - 0x1074]
push 0x10
lea eax, [ebp - 0x107c]
push eax
push 0x83350048
call fcn.00480cc0
add esp, 0x20
test eax, eax
je 0x468088
lea eax, [ebx + 4]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.004911bd
mov ecx, dword [ebp - 0x106c]
add esp, 0xc
test ecx, ecx
je 0x468088
mov eax, dword [ebx]
mov dword [ecx], eax
push ebx
call fcn.0048faf7
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0046d6f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x468346
push 0x400
mov dword [ebp - 0x1060], 0x400
call fcn.0048fb2f
mov edi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [edi], xmm0
mov ecx, dword [ebp - 0x1060]
add ecx, 0xfffffff8
mov word [edi], cx
cmp dword [0x4f68a0], 0
jne 0x468112
lea eax, [ebp - 0x1088]
push eax
push 0
push 0
push 0x467560
push 0
push 0
call fcn.004929fc
add esp, 0x18
mov dword [0x4f68a0], eax
mov eax, dword [0x4f68a4]
test eax, eax
jne 0x468140
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
push eax
push eax
push eax
call esi
push 0
push 0
push 0
push 0
mov dword [0x4f68a4], eax
call esi
mov dword [0x4f68a8], eax
mov eax, dword [0x4f68a4]
push eax
mov dword [0x4f68b0], edi
mov dword [0x4f68ac], ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
push dword [0x4f68a8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4681b0
push 1
push dword [0x4f68a0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x4f68a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [0x4f68a0], 0
call fcn.0048faf7
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
cmp dword [0x4f68b4], 0
jne 0x4681cb
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.004803b0
add esp, 0xc
push edi
call fcn.0048faf7
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c096c
push edi
call fcn.00491646
neg eax
sbb eax, eax
and eax, 0xfffffc40
add eax, 0x400
push eax
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0046d6f0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x468311
push 0x4c098c
push edi
call fcn.00491646
add esp, 8
test eax, eax
lea eax, [ebp - 0x1060]
push eax
jne 0x4682a3
push 0x18
lea eax, [ebp - 0x10c0]
push eax
push 0
push ebx
call dword [0x4ea064]
test eax, eax
jne 0x4682f9
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x10b0]
call fcn.00483520
push dword [ebp - 0x10b0]
lea eax, [ebp - 0x204]
push eax
push 0x4c099c
push esi
push dword [ebp - 0x105c]
call fcn.00492202
add esp, 0x24
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x10a8]
push eax
push 0
push ebx
call dword [0x4ea068]
test eax, eax
jne 0x4682f9
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x10a0]
call fcn.00483520
push dword [ebp - 0x109c]
lea eax, [ebp - 0x204]
push dword [ebp - 0x10a0]
push eax
push 0x4c09ac
push esi
push dword [ebp - 0x105c]
call fcn.00492202
add esp, 0x28
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
cmp dword [0x4db648], 0xffffffff
je 0x468346
lea eax, [ebp - 0x40c]
push 0x104
push eax
call fcn.004673a0
lea eax, [ebp - 0x40c]
push eax
push 0x4c09c4
push esi
push dword [ebp - 0x105c]
call fcn.00492202
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret