Function at 0x40bfd0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x2c
push esi
mov esi, ecx
cmp dword [esi + 0x900], 0
jne 0x40c480
mov eax, dword [esi + 0xdb0]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1032
push eax
mov dword [esi + 0x904], 0
call ebp
mov ebx, dword [esi + 0x7c4]
mov dword [esp + 0x14], eax
test eax, eax
jle 0x40c47e
mov ecx, dword [esi + 0xdb0]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebp
add eax, 1
je 0x40c47e
mov edx, dword [esi + 0xdb0]
push edi
push 2
lea edi, [eax - 1]
push edi
push 0x100c
push edx
call ebp
push 0
push 0
mov dword [esi + 0x904], edi
mov eax, dword [esi + 0x438]
push 0x1004
push eax
call ebp
cmp dword [esi + 0x1c8], 0
mov dword [esp + 0x2c], eax
jle 0x40c47d
test eax, eax
jle 0x40c47d
mov ecx, esi
call fcn.00408700
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x14], eax
jle 0x40c091
mov dword [esp + 0x14], ebx
push 0
mov ecx, 0x466abc
call fcn.00415360
mov ebx, dword [esp + 0x14]
xor ebp, ebp
xor edi, edi
cmp ebx, ebp
jle 0x40c0e5
lea esp, [esp]
cmp dword [edi*4 + 0x466888], ebp
jne 0x40c0e0
push 0x118
call fcn.00418d8b
add esp, 4
cmp eax, ebp
je 0x40c0d3
mov ecx, eax
call fcn.00416500
jmp 0x40c0d5
xor eax, eax
mov dword [edi*4 + 0x466888], eax
cmp eax, ebp
je 0x40c0f8
inc edi
cmp edi, ebx
jl 0x40c0b0
call fcn.00418feb
cmp eax, ebp
jne 0x40c118
push 0x80004005
call fcn.004010d0
push ebp
push 0x451c6c
push 0x451c54
mov ecx, esi
call fcn.0041db01
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x2c
jmp fcn.00409e50
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
call fcn.00418feb
cmp eax, ebp
jne 0x40c13b
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
call fcn.00418feb
cmp eax, ebp
jne 0x40c15e
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
call fcn.00418feb
cmp eax, ebp
jne 0x40c181
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
push 8
mov dword [esp + 0x20], eax
call fcn.0041aab7
cmp eax, ebp
je 0x40c1a8
push 8
push eax
lea ecx, [esp + 0x24]
call fcn.00401e90
cmp ebx, ebp
mov dword [esp + 0x10], ebp
jle 0x40c3a9
mov ebp, 0x466888
lea esp, [esp]
mov eax, dword [esi + 0x904]
mov ecx, dword [esi + 0xdb0]
push 2
push eax
push 0x102c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x40c1ea
inc dword [esi + 0x904]
jmp 0x40c340
mov edx, dword [esi + 0x904]
push 1
push 0
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.0040b1f0
push eax
lea ecx, [esp + 0x2c]
call fcn.00402870
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c22b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x904]
mov edx, dword [esp + 0x10]
push ecx
push edx
push 0x13ab
push 0x13aa
mov ecx, esi
call fcn.00401290
mov ecx, dword [ebp]
push eax
call fcn.004162d0
mov eax, dword [esp + 0x28]
inc dword [esi + 0x904]
mov ecx, dword [ebp]
push eax
call fcn.004170e0
test eax, eax
je 0x40c340
mov ecx, dword [ebp]
call fcn.004162c0
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x2c], edi
jle 0x40c32e
push edi
lea ecx, [esi + 0x418]
call fcn.00424f12
test eax, eax
je 0x40c323
push 1
push edi
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esi + 0x418]
call fcn.00425f1f
push eax
lea ecx, [esp + 0x28]
call fcn.00402870
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c2d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 2
push edi
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esi + 0x418]
call fcn.00425f1f
push eax
lea ecx, [esp + 0x24]
call fcn.00402870
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c310
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [ebp]
push edx
call fcn.00416cc0
inc ebx
inc edi
cmp edi, dword [esp + 0x2c]
jl 0x40c282
mov ecx, dword [ebp]
push 0
push 0
push 0
call fcn.00424d90
test eax, eax
jne 0x40c352
mov eax, dword [esp + 0x18]
cmp dword [esi + 0x904], eax
jl 0x40c1c0
jmp 0x40c391
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x904]
push ecx
push 4
dec edx
push edx
lea ecx, [esi + 0xd90]
call fcn.00425b2d
imul ebx, ebx, 0x1d4c0
mov eax, dword [esi + 0x900]
mov ecx, dword [esi + 0x20]
push 0
push ebx
add eax, 0x44c
push eax
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [esi + 0x900]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 4
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x40c1c0
xor ebp, ebp
xor edi, edi
cmp dword [esi + 0x900], ebp
mov dword [esi + 0x908], ebp
jle 0x40c3dd
mov ebx, dword [sym.imp.USER32.dll_PostThreadMessageW]
nop
mov edx, dword [edi*4 + 0x466888]
mov eax, dword [edx + 0x30]
push ebp
push ebp
push 0xfcd
push eax
call ebx
inc edi
cmp edi, dword [esi + 0x900]
jl 0x40c3c0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esi + 0x910], ecx
mov dword [esi + 0x90c], ebp
mov dword [esi + 0x914], ebp
mov dword [0x46419c], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c41d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c43d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c45d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c47d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2c
ret