Function at 0x4755b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6504a4
mov eax, dword fs:[0]
push eax
mov eax, 0x132c
call fcn.005468f0
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c4], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ecx + 0x74]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x12c0], eax
imul eax, dword [ecx + 0xc], 0x168
mov dword [ebp - 0x12dc], 0
mov dword [ebp - 0x12d8], 0
mov dword [ebp - 0x12d4], 0
add edi, eax
lea eax, [ebp - 0x12dc]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00481830
mov ebx, dword [ebp - 0x12d8]
test esi, esi
jne 0x475679
test ebx, ebx
je 0x475c06
push str.FSFolder
mov ecx, edi
call fcn.00470330
test al, al
jne 0x475679
push str.FSDrives
mov ecx, edi
call fcn.00470330
test al, al
jne 0x475679
push str.AltStreamsFolder
mov ecx, edi
call fcn.00470330
test al, al
je 0x475c06
call fcn.00408660
test esi, esi
jne 0x475996
lea ecx, [ebp - 0x12b4]
mov dword [ebp - 0x12b8], esi
call fcn.00472d70
push 0xe68
lea eax, [ebp - 0x1270]
push esi
push eax
call fcn.005e0dd0
add esp, 0xc
lea ecx, [ebp - 0x12b8]
call fcn.00473460
lea ecx, [ebp - 0x408]
mov byte [ebp - 4], 1
call fcn.004d3140
mov byte [ebp - 4], 2
lea eax, [ebp - 0x408]
mov dword [ebp - 0x12b8], eax
test ebx, ebx
je 0x47571e
nop word [eax + eax]
mov eax, dword [ebp - 0x12dc]
mov ecx, edi
push dword [eax + esi*4]
lea eax, [ebp - 0x12e8]
push eax
call fcn.004820a0
push eax
lea ecx, [ebp - 0x1298]
mov byte [ebp - 4], 3
call fcn.00406580
mov byte [ebp - 4], 2
push dword [ebp - 0x12e8]
call fcn.00545b61
inc esi
add esp, 4
cmp esi, ebx
jb 0x4756e0
lea eax, [ebp - 0x1310]
mov ecx, edi
push eax
call fcn.00470380
mov byte [ebp - 4], 4
xor ecx, ecx
mov ebx, dword [ebp - 0x130c]
mov edx, 2
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
add esp, 4
mov dword [ebp - 0x12fc], ebx
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0x1300], ecx
lea ecx, [ebx*2 + 2]
mov dword [ebp - 0x1304], esi
push ecx
push dword [ebp - 0x1310]
push esi
call fcn.005e0850
add esp, 0xc
lea eax, [ebx + ebx]
mov byte [ebp - 4], 5
mov dword [ebp - 0x12c0], eax
add eax, 0xfffffffe
add eax, esi
cmp word [eax], 0x3a
jne 0x4757df
test ebx, ebx
je 0x47582b
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x4757bd
cmp cx, 0x2f
je 0x4757bd
cmp eax, esi
je 0x4757df
movzx ecx, word [eax - 2]
sub eax, 2
cmp ecx, 0x5c
jne 0x4757a7
sub eax, esi
sar eax, 1
js 0x4757df
inc eax
cmp eax, ebx
jae 0x4757df
mov ecx, eax
mov dword [ebp - 0x1300], ecx
lea ecx, [eax + eax]
xor eax, eax
mov dword [ebp - 0x12c0], ecx
mov word [ecx + esi], ax
cmp ebx, dword [ebp - 0x12a8]
jbe 0x47582b
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
add esp, 4
mov dword [ebp - 0x12bc], eax
push dword [ebp - 0x12b0]
call fcn.00545b61
mov ecx, dword [ebp - 0x12bc]
add esp, 4
mov dword [ebp - 0x12b0], ecx
mov dword [ebp - 0x12a8], ebx
jmp 0x475839
mov eax, dword [ebp - 0x12b0]
mov ecx, eax
mov dword [ebp - 0x12bc], eax
lea eax, [ebx*2 + 2]
mov dword [ebp - 0x12ac], ebx
push eax
push dword [ebp - 0x1310]
push ecx
call fcn.005e0850
mov ebx, dword [ebp - 0x1300]
add esp, 0xc
cmp ebx, dword [ebp - 0x129c]
jbe 0x4758a8
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
add esp, 4
mov dword [ebp - 0x12bc], eax
push dword [ebp - 0x12a4]
call fcn.00545b61
mov ecx, dword [ebp - 0x12bc]
add esp, 4
mov dword [ebp - 0x12a4], ecx
mov dword [ebp - 0x129c], ebx
jmp 0x4758b6
mov eax, dword [ebp - 0x12a4]
mov ecx, eax
mov dword [ebp - 0x12bc], eax
mov eax, dword [ebp - 0x12c0]
add eax, 2
mov dword [ebp - 0x12a0], ebx
push eax
push esi
push ecx
call fcn.005e0850
mov ecx, dword [ebp - 0x12c4]
add esp, 0xc
imul eax, dword [ecx + 0xc], 0x168
cmp byte [eax + ecx + 0x130], 0
lea eax, [ebp - 0x12ec]
push eax
push 0
lea eax, [ebp - 0x12b8]
sete byte [ebp - 0x12b4]
push eax
push 0x4742a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [edi + 4]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x47591d
mov eax, dword [edi + 0x38]
mov ecx, dword [ebp - 0x12b8]
push eax
push ebx
call fcn.004d3e80
push esi
call fcn.00545b61
add esp, 4
push dword [ebp - 0x1310]
call fcn.00545b61
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.00406650
lea ecx, [ebp - 0x408]
call fcn.0054e428
lea ecx, [ebp - 0x1280]
call fcn.00406650
lea ecx, [ebp - 0x128c]
call fcn.00475cc0
lea ecx, [ebp - 0x1298]
call fcn.00406650
push dword [ebp - 0x12a4]
call fcn.00545b61
add esp, 4
push dword [ebp - 0x12b0]
call fcn.00545b61
add esp, 4
jmp 0x475c06
mov ecx, 0x6f4298
call fcn.00473460
mov eax, dword [ebp - 0x12c0]
lea ecx, [ebp - 0x12e8]
push esi
mov dword [0x6f4298], eax
call fcn.0040e210
push 8
mov byte [ebp - 4], 6
call fcn.00545b74
mov esi, eax
mov dword [ebp - 0x12cc], 0
xor eax, eax
mov dword [ebp - 0x12d0], esi
add esp, 4
mov dword [ebp - 0x12c8], 3
mov word [esi], ax
xor ecx, ecx
mov byte [ebp - 4], 7
mov dword [ebp - 0x12c0], ecx
cmp dword [ebp - 0x12e4], ecx
jbe 0x475bb9
lea edx, [eax + 2]
mov eax, dword [ebp - 0x12e8]
mov esi, dword [eax + ecx*4]
xor ecx, ecx
mov edi, dword [esi + 4]
mov dword [ebp - 0x12bc], edi
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov ecx, dword [esi + 4]
add esp, 4
mov ebx, eax
mov dword [ebp - 0x1318], edi
mov dword [ebp - 0x131c], ebx
mov dword [ebp - 0x1314], edi
lea ecx, [ecx*2 + 2]
push ecx
push dword [esi]
push ebx
call fcn.005e0850
add esp, 0xc
push 8
mov byte [ebp - 4], 8
call fcn.00545b74
mov ecx, eax
mov dword [ebp - 0x12f4], 0
xor eax, eax
mov dword [ebp - 0x12f8], ecx
add esp, 4
mov dword [ebp - 0x12f0], 3
mov word [ecx], ax
mov byte [ebp - 4], 9
test edi, edi
je 0x475b54
lea esi, [edi - 1]
movzx eax, word [ebx + esi*2]
lea esi, [ebx + esi*2]
cmp eax, 0x5c
je 0x475aba
nop
cmp ax, 0x2f
je 0x475aba
cmp esi, ebx
je 0x475b54
movzx eax, word [esi - 2]
sub esi, 2
cmp eax, 0x5c
jne 0x475aa0
sub esi, ebx
sar esi, 1
test esi, esi
jle 0x475b54
lea edi, [esi + 1]
push edi
lea eax, [ebp - 0x1328]
push eax
lea ecx, [ebp - 0x131c]
call fcn.00426300
push eax
lea ecx, [ebp - 0x12d0]
mov byte [ebp - 4], 0xa
call fcn.0049f5a0
mov byte [ebp - 4], 9
push dword [ebp - 0x1328]
call fcn.00545b61
mov eax, dword [ebp - 0x12bc]
lea ecx, [ebp - 0x131c]
add esp, 4
sub eax, esi
dec eax
push eax
push edi
lea eax, [ebp - 0x1334]
push eax
call fcn.00416c00
push eax
lea ecx, [ebp - 0x12f8]
mov byte [ebp - 4], 0xb
call fcn.0049f5a0
mov byte [ebp - 4], 9
push dword [ebp - 0x1334]
call fcn.00545b61
add esp, 4
lea eax, [ebp - 0x12f8]
mov ecx, 0x6f42b8
push eax
call fcn.00406580
mov ecx, dword [ebp - 0x12f8]
push ecx
call fcn.00545b61
add esp, 4
mov byte [ebp - 4], 7
push ebx
call fcn.00545b61
mov ecx, dword [ebp - 0x12c0]
add esp, 4
inc ecx
mov edx, 2
mov dword [ebp - 0x12c0], ecx
cmp ecx, dword [ebp - 0x12e4]
jb 0x475a01
cmp dword [ebp - 0x12cc], 0
je 0x475bb3
lea eax, [ebp - 0x12d0]
mov ecx, 0x6f42a0
push eax
call fcn.0049f5a0
lea eax, [ebp - 0x12d0]
mov ecx, 0x6f42ac
push eax
call fcn.0049f5a0
mov esi, dword [ebp - 0x12d0]
mov ecx, dword [ebp - 0x12c4]
imul eax, dword [ecx + 0xc], 0x168
cmp byte [eax + ecx + 0x130], 0
lea eax, [ebp - 0x12ec]
push eax
push 0
push 0x6f4298
push 0x4742a0
push 0
push 0
sete byte [0x6f429c]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
call fcn.00545b61
add esp, 4
lea ecx, [ebp - 0x12e8]
call fcn.00406650
push dword [ebp - 0x12dc]
call fcn.00545b61
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8