Function at 0x40f994
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi + 0xb8], ebp
je 0x40f9ab
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret 0x10
mov eax, dword [esi + 0xb0]
push ebx
dec eax
mov ecx, esi
neg eax
sbb al, al
and al, 0xfb
add al, 0x30
push eax
call fcn.00412e20
test al, al
je 0x40fc66
push 0x46c328
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, esi
call fcn.00414650
mov ebx, 1
cmp eax, ebx
jne 0x40fc03
mov eax, dword [esi + 0x50]
push edi
cmp eax, ebp
je 0x40fa1a
lea edi, [esi + 0x24]
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 0x2c]
add edx, 8
dec ecx
mov dword [edi + 0xc], edx
mov eax, edx
mov dword [edi + 0x2c], ecx
je 0x40fa0e
cmp eax, dword [edi + 8]
jne 0x40fa15
mov ecx, edi
call fcn.00417920
cmp dword [esi + 0x50], ebp
jne 0x40f9f5
push 0x4568e8
call fcn.0041dc80
lea ecx, [esp + 0x14]
mov dword [0x46c324], eax
push ecx
push 0xc
push eax
mov dword [esp + 0x20], ebx
call fcn.0041dd70
mov eax, dword [0x46c324]
lea edx, [esp + 0x24]
push edx
push 0xe
push eax
mov dword [esp + 0x30], 0x40a00000
mov dword [esp + 0x34], 5
call fcn.0041dd70
mov edx, dword [0x46c324]
lea ecx, [esp + 0x34]
push ecx
push 4
push edx
call fcn.0041dd70
mov eax, dword [0x46c324]
push 0x46c340
push 3
push eax
call fcn.0041dd70
push 0x46c300
call fcn.0041d960
mov ecx, dword [esi + 0xb0]
mov edx, dword [0x46c340]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffffc180
add ecx, 0x7d00
push ecx
push edx
call fcn.00418c80
add esp, 0x40
lea ecx, [esp + 0x1c]
mov dword [0x46c2f8], eax
mov dword [esp + 0x1c], ebx
push ecx
push 4
push eax
mov dword [esp + 0x2c], 0x50
mov dword [esp + 0x30], 0x41
call fcn.0041a210
mov eax, dword [0x46c2f8]
lea edx, [esp + 0x2c]
push edx
push 0xe
push eax
call fcn.0041a210
mov edx, dword [0x46c2f8]
lea ecx, [esp + 0x3c]
push ecx
push 0x10
push edx
call fcn.0041a210
add esp, 0x24
lea edi, [esi + 0x194]
mov dword [esi + 0x21c], ebp
mov ecx, edi
push 0x3c
mov dword [0x46c2f0], ebp
mov dword [0x46c2f4], ebp
mov dword [0x46c2e8], ebp
mov dword [0x46c2ec], ebp
call fcn.00418c70
mov eax, dword [0x46c340]
mov ecx, edi
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00418c50
mov word [esi + 0x1e8], 0x10
mov ecx, dword [esi + 0xb0]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffffc180
add ecx, 0x7d00
mov dword [esi + 0x1e4], ecx
mov word [edi + 0x4c], bx
mov edx, dword [esi + 4]
mov ecx, edi
mov dword [esi + 0x1dc], edx
call fcn.00418be0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esi + 0xb8], eax
mov eax, dword [esi + 4]
push 0x3eb
push eax
call edi
mov edx, dword [esi + 0xb8]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
cmp edx, ebp
sete cl
push ecx
push eax
call ebx
mov edx, dword [esi + 4]
push 0x3ec
push edx
call edi
mov ecx, dword [esi + 0xb8]
push ecx
push eax
call ebx
mov eax, dword [esi + 0xb0]
pop edi
cmp eax, 1
mov eax, 0x4666e0
je 0x40fbd3
mov eax, 0x4666c0
mov edx, dword [esi + 0x68]
push eax
push ebp
push 0x181
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x24]
push eax
push ebp
push esi
push 0x40f830
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret 0x10
cmp eax, ebp
jne 0x40fc27
mov ecx, dword [esi + 0x68]
push 0x46669c
push ebp
push 0x181
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret 0x10
cmp eax, 0xffffffff
jne 0x40fc4c
mov edx, dword [esi + 0x68]
push 0x466674
push ebp
push 0x181
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret 0x10
cmp eax, 0xfffffffd
jne 0x40fc66
mov eax, dword [esi + 0x68]
push 0x46665c
push ebp
push 0x181
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret 0x10