Function at 0x405df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 1
call fcn.004064d0
mov dword [ebp - 0x28], eax
cmp dword [ebp + 0x1c], 1
jne 0x405e34
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0x47a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x405e32
xor eax, eax
jmp 0x40600c
jmp 0x405e4a
lea edx, [ebp - 0x24]
push edx
push 4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406290
add esp, 0x10
mov edx, dword [ebp + 0x18]
and edx, 1
je 0x405e80
push 2
push 1
push 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [0x411e94]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x411e94]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x38]
mov dword [0x411e94], ecx
mov edx, dword [ebp + 0x18]
and edx, 2
je 0x405eed
cmp dword [0x4148f4], 0
je 0x405ebf
push 2
push 1
push 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [0x4148f4]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x4148f4]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
mov dword [0x4148f4], ecx
push 2
push 1
push 0
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [0x414954]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [0x414954]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x38]
mov dword [0x414954], eax
mov ecx, dword [ebp + 0x18]
and ecx, 4
je 0x405f51
push 2
push 1
push 0
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [0x414948]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [0x414948]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x38]
mov dword [0x414948], eax
push 2
push 1
push 0
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [0x414950]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [0x414950]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x38]
mov dword [0x414950], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00406300
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x405f71
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0x18]
and edx, 1
je 0x405f81
mov eax, dword [ebp - 0x14]
mov dword [0x411e94], eax
mov ecx, dword [ebp + 0x18]
and ecx, 2
je 0x405f9a
mov edx, dword [ebp - 0x34]
mov dword [0x4148f4], edx
mov eax, dword [ebp - 0x2c]
mov dword [0x414954], eax
mov ecx, dword [ebp + 0x18]
and ecx, 4
je 0x405fb3
mov edx, dword [ebp - 4]
mov dword [0x414948], edx
mov eax, dword [ebp - 0xc]
mov dword [0x414950], eax
cmp dword [ebp - 0x10], 0
jne 0x405fbd
xor eax, eax
jmp 0x40600c
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 0x10], 0x406b30
jne 0x405ff1
push 0
push 0
mov edx, dword [0x411e7c]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
jmp 0x406009
push 0
push 0
push 0
mov edx, dword [ebp - 0x30]
push edx
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret