Function at 0x4728ec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
mov byte [ebp - 9], 0
cmp dword [0x56514c], 0
je 0x472c08
mov eax, dword [0x56514c]
cmp byte [eax + 5], 0
jne 0x472c08
xor edx, edx
push ebp
push 0x472c01
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x56514c]
mov dword [0x565178], eax
xor edx, edx
push ebp
push 0x472b8f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x56514c]
mov byte [eax + 5], 1
mov eax, dword [0x56514c]
movzx edx, byte [ebp - 1]
mov byte [eax + 0x20], dl
mov edx, dword [0x565154]
mov eax, dword [0x56514c]
call fcn.00471758
cmp byte [0x565168], 2
jne 0x47298f
mov eax, dword [0x56514c]
mov edx, dword [0x466df8]
call fcn.00405144
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
cmp dword [ebx + 0x14], 0
sete al
mov byte [ebx + 0x74], al
mov eax, dword [0x56514c]
cmp dword [eax + 0x14], 0
je 0x4729c4
mov eax, dword [0x56514c]
mov eax, dword [eax + 0x14]
mov edx, dword [0x46a6c0]
call fcn.00405120
test al, al
je 0x4729c4
mov eax, dword [0x56514c]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x10], edx
jmp 0x4729d5
mov eax, dword [0x56514c]
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edx
push ebp
call fcn.00472878
pop ecx
test al, al
je 0x472a09
cmp byte [0x565168], 2
jne 0x4729ef
cmp byte [ebx + 0x74], 0
jne 0x472a03
cmp byte [0x565168], 0
je 0x472a09
mov al, 1
call fcn.0047218c
test al, al
je 0x472a09
cmp byte [ebp - 1], 0
jne 0x472a0d
xor eax, eax
jmp 0x472a0f
mov al, 1
mov byte [ebp - 9], al
cmp byte [0x565168], 2
jne 0x472a60
cmp byte [ebp - 9], 0
je 0x472a80
cmp byte [ebx + 0x74], 0
je 0x472a80
mov eax, dword [ebx + 0x40]
mov dl, 1
call fcn.004b4f70
test eax, eax
je 0x472a47
mov edx, dword [eax + 0x290]
cmp edx, dword [ebx + 0x40]
jne 0x472a47
xor edx, edx
call fcn.004b9f64
mov eax, dword [0x56514c]
push eax
xor ecx, ecx
mov edx, 0xb03a
mov eax, dword [0x565148]
call fcn.00475e18
jmp 0x472a80
cmp dword [0x56516c], 0
je 0x472a75
mov eax, dword [0x56516c]
call fcn.00480394
jmp 0x472a80
mov eax, dword [0x565160]
push eax
call sub.KERNEL32.DLL_CreateThread
xor eax, eax
mov dword [0x565148], eax
xor eax, eax
mov dword [0x56514c], eax
cmp dword [0x565178], 0
je 0x472b3a
mov eax, dword [0x565178]
cmp dword [eax + 0x14], 0
je 0x472b3a
mov al, 3
cmp byte [ebp - 9], 0
jne 0x472ad4
mov al, 4
mov edx, dword [0x565178]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov edx, dword [0x565178]
xor ecx, ecx
mov dword [edx + 0x10], ecx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
mov dword [ebp - 0x10], edx
mov edx, dword [0x565178]
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x472b33
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [0x565178]
mov edx, dword [edx + 0x14]
push edx
mov edx, dword [0x565178]
add edx, 0xc
push edx
mov edx, dword [0x565178]
mov edx, dword [edx + 8]
mov ecx, dword [0x565178]
xchg edx, eax
call fcn.00472058
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472b3a
cmp dword [0x565178], 0
jne 0x472b32
mov eax, dword [ebp - 8]
mov dword [0x565178], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472b96
mov eax, dword [0x565174]
call fcn.00404f08
xor eax, eax
mov dword [0x565174], eax
cmp dword [0x565178], 0
je 0x472b87
mov eax, dword [0x565178]
mov byte [eax + 5], 0
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebp - 9]
push eax
mov eax, dword [0x565178]
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [0x565178]
mov ebx, dword [eax]
call dword [ebx]
xor eax, eax
mov dword [0x56514c], eax
ret
pop ebx
mov esp, ebp
pop ebp
ret