Function at 0x407fa0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esi + 0x3b4]
push ebx
push ebp
mov ebp, dword [ecx + 0x164]
xor ebx, ebx
mov eax, 1
cmp ebp, ebx
je 0x4081e8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push eax
push ebx
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3d0], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3c8], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3cc], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3dc], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3d4], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3e0], eax
call edi
push ebx
push 1
push ebx
mov dword [esi + 0x4f4], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3d8], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x40c], eax
call edi
mov dword [esi + 0x410], eax
mov byte [esi + 0x4fd], bl
mov byte [esi + 0x518], bl
mov byte [esi + 0x50c], bl
mov edx, dword [ebp]
mov eax, dword [edx + 0x24]
push esi
push 0x4057d0
mov ecx, ebp
call eax
mov edx, dword [ebp]
mov eax, dword [edx + 0xc]
mov ecx, ebp
call eax
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
mov ecx, ebp
call eax
mov edi, eax
cmp edi, ebx
je 0x408116
lea eax, [edi - 8]
cmp eax, 6
ja case.default.0x408091
jmp dword [eax*4 + 0x4081ec]
mov eax, 0x3d
jmp 0x4080ce
mov eax, 0x3e
jmp 0x4080ce
mov eax, 0x3f
jmp 0x4080ce
mov eax, 0x40
jmp 0x4080ce
mov eax, 0x41
jmp 0x4080ce
mov eax, 0x42
jmp 0x4080ce
mov eax, 0x43
jmp 0x4080ce
mov eax, 0x1c
mov ecx, dword [0x59d5d4]
mov edx, dword [ecx*4 + 0x596fe8]
push 0x30
lea eax, [ecx + eax*2]
mov ecx, dword [eax*4 + 0x596f10]
push edx
push ecx
mov ecx, esi
call fcn.0041bd88
mov edx, dword [ebp]
mov eax, dword [edx + 0x30]
mov ecx, ebp
call eax
test eax, eax
je 0x408105
mov eax, esi
call fcn.00408210
mov edx, dword [ebp]
mov eax, dword [edx + 0x10]
mov ecx, ebp
call eax
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov ebp, 0xc00
push ebp
call fcn.00417344
mov dword [esi + 0x424], ebp
mov dword [esi + 0x420], eax
mov dword [esi + 0x42c], ebp
mov dword [esi + 0x430], ebx
mov dword [esi + 0x4b0], ebx
mov dword [esi + 0x4b4], ebx
mov ecx, dword [esi + 0x424]
mov dword [esi + 0x450], ecx
mov dword [esi + 0x454], ebx
mov dword [esi + 0x4b8], ebx
mov dword [esi + 0x4bc], ebx
mov edx, dword [esi + 0x424]
mov dword [esi + 0x474], edx
add esp, 4
mov dword [esi + 0x478], ebx
lea ebp, [esi + 0x4dc]
push ebp
mov dword [esi + 0x4c0], ebx
mov dword [esi + 0x4c4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x4c8]
call fcn.00421929
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0xc]
push eax
push ebx
push esi
push 0x4059f0
push ebx
push ebx
call ebp
lea ecx, [esp + 0xc]
push ecx
push ebx
push esi
push 0x405800
push ebx
push ebx
mov dword [esi + 0x3c4], eax
call ebp
mov dword [esi + 0x408], eax
mov eax, edi
mov dword [esi + 0x500], ebx
mov byte [esi + 0x4fc], 1
pop edi
pop ebp
pop ebx
pop ecx
ret