Function at 0x485df0
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create thread
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4eb8a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push edi
push 0x51d5c4
mov dword [esp + 0x24], 0x51d5c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [esp + 0x68]
mov edx, dword [esp + 0x60]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x5c]
push 0x51d598
mov cl, al
push 0x10000
and cl, 0xc0
mov dword [esp + 0x38], edx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x1b], cl
mov ecx, dword [esp + 0x64]
push 0x485c60
xor ebx, ebx
and al, 0xf
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x74]
push 0x20000
push ebx
mov dword [esp + 0x64], ebx
mov byte [esp + 0x80], al
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x50], al
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x485eb9
push 0x51d5c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
push esi
mov esi, 0x270f
nop
cmp dword [esp + 0x40], ebx
je 0x485ee4
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jns 0x485ec0
cmp dword [esp + 0x40], ebx
je 0x485ee4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x40], ebx
jne 0x485ed6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x5c], ebp
mov ebx, str.32770
xor esi, esi
xor ebp, ebp
cmp edi, 2
mov dword [esp + 0x64], ebx
jne 0x485f15
mov dword [esp + 0x64], ebp
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x5c], 0x4fad0c
mov ebp, 0x4fad00
mov al, byte [0x51d638]
test al, 4
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
jne 0x485f46
or al, 4
push 2
push str.SeDebugPrivilege
mov byte [esp + 0x20], 1
mov byte [0x51d638], al
call fcn.004226a0
add esp, 8
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov byte [esp + 0x50], 1
mov dword [esp + 0x1c], 0xa
lea esp, [esp]
dec dword [esp + 0x1c]
js 0x485f8e
mov eax, dword [esp + 0x5c]
push eax
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x485f8e
test ebp, ebp
je 0x485f82
push ebp
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x485f8e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x485f60
test esi, esi
mov dword [esp + 0x1c], 0xa
jne 0x485fea
lea ebx, [ebx]
dec dword [esp + 0x1c]
js 0x485fd1
mov ecx, dword [esp + 0x5c]
push ecx
push 0
call edi
mov esi, eax
test esi, esi
jne 0x485fea
test ebp, ebp
je 0x485fc3
push ebp
push eax
call edi
mov esi, eax
test esi, esi
jne 0x485fea
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x485fa0
jmp 0x485fea
test esi, esi
jne 0x485fea
mov edx, dword [esp + 0x5c]
push esi
push esi
push esi
push esi
push esi
push esi
push edx
call fcn.004a2670
add esp, 0x1c
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], 0x5a
jne 0x486024
dec dword [esp + 0x1c]
js 0x486024
mov eax, dword [esp + 0x5c]
push eax
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x486024
test ebp, ebp
je 0x486018
push ebp
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x486024
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x485ff6
test esi, esi
mov ebx, 0x5a
jne 0x48605c
lea ecx, [ecx]
dec ebx
js 0x48605c
mov ecx, dword [esp + 0x5c]
push ecx
push 0
call edi
mov esi, eax
test esi, esi
jne 0x48605c
test ebp, ebp
je 0x486050
push ebp
push eax
call edi
mov esi, eax
test esi, esi
jne 0x48605c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x486030
mov ebx, dword [esp + 0x58]
cmp ebx, 2
jne 0x486075
test esi, esi
je 0x486075
mov edx, dword [esp + 0x60]
push edx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, 1
mov ebp, eax
jne 0x486091
test esi, esi
je 0x486091
mov eax, dword [0x51c770]
test eax, eax
je 0x486091
mov dword [eax], esi
cmp byte [esp + 0x13], 0x80
je 0x48617f
cmp ebx, 1
jne 0x4860f9
test esi, esi
je 0x48617f
mov al, byte [0x519300]
test al, al
jle 0x4860ed
mov ebx, dword [esp + 0x68]
test ebx, ebx
jle 0x4860ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, ebx
jge 0x48615f
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
push eax
push ecx
call edi
mov esi, eax
test esi, esi
je 0x4860ed
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x519300]
test al, al
jg 0x4860b2
mov eax, dword [esp + 0x44]
test eax, eax
je 0x48616a
mov eax, dword [eax]
jmp 0x48616c
cmp ebx, 2
jne 0x4860a9
mov edi, dword [esp + 0x68]
test edi, edi
jg 0x486134
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], 0
call fcn.004438b0
push 0x51d5c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
mov al, byte [0x519300]
test al, al
jle 0x486155
lea ecx, [ecx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, edi
jge 0x486155
mov al, byte [0x519300]
test al, al
jg 0x486140
push 0
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
jmp 0x48617f
movzx edx, byte [esp + 0x6c]
mov dword [esp + 0x14], edx
jmp 0x486170
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [0x51c770]
test eax, eax
je 0x48617f
mov dword [eax], 0
mov eax, dword [esp + 0x44]
test eax, eax
je 0x48618d
mov dword [eax], 0xffffffff
test esi, esi
je 0x4861c3
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x111
push esi
call edi
push 0
push 7
push 0x111
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [esp + 0x20]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x18]
test al, al
mov esi, dword [esp + 0x14]
mov byte [esp + 0x50], 0
je 0x486206
mov bl, byte [0x51d638]
push 4
and bl, 0xfb
push str.SeDebugPrivilege
mov byte [0x51d638], bl
call fcn.004226a0
add esp, 8
push 0x51d5c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x48]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret