Function at 0x1040a120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
imul eax, edi, 0x7d0
cmp byte [eax + esi + 0x656], 0
lea ebx, [eax + esi]
mov dword [ebp - 0x1c], ebx
jne 0x1040a5dd
mov edx, dword [ebx + 0x54]
xor ecx, ecx
mov dword [edx], 0x61040001
cmp dword [ebx + 0xa8], ecx
jbe 0x1040a173
lea eax, [edx + 0x618]
mov dword [eax], 0x61050001
inc ecx
add eax, 0x78
cmp ecx, dword [ebx + 0xa8]
jb 0x1040a161
xor ecx, ecx
cmp dword [ebx + 0xac], ecx
jbe 0x1040a197
lea eax, [edx + 0xf78]
mov dword [eax], 0x61060001
inc ecx
add eax, 0x1108
cmp ecx, dword [ebx + 0xac]
jb 0x1040a183
cmp dword [esi + 0x1b14], 0
jne 0x1040a1c6
push 0xc000
call fcn.10434352
add esp, 4
mov dword [esi + 0x1b14], eax
test eax, eax
je 0x1040a50e
add eax, 0x4000
mov dword [esi + 0x1b18], eax
cmp dword [esi + 0x1b1c], 0
jne 0x1040a23f
push 4
push 0x3000
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x1b20], eax
test eax, eax
je 0x1040a22d
mov ecx, dword [esi + 0xfd4]
lea edi, [ebp - 8]
push edi
push 0
push 0
push 0
push eax
push 1
push 1
push 4
mov dword [ebp - 8], 0
mov edx, dword [ecx]
push 0x1000
push 0x3e
call dword [edx + 4]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov dword [esi + 0x1b1c], eax
mov dword [esi + 0x1b24], ecx
test eax, eax
jne 0x1040a23f
mov ecx, esi
call fcn.1040b590
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x3890], 0
jne 0x1040a2e7
push 0
push 0x10468dc0
call fcn.1003fa20
mov dword [esi + 0x3890], eax
test eax, eax
jne 0x1040a27a
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x3894], eax
mov eax, dword [sym.imp.GDI32.dll_GetObjectA]
mov dword [esi + 0x3898], eax
jmp 0x1040a2dc
push 0x1046cb60
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x3894], eax
test eax, eax
jne 0x1040a29b
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x3894], eax
push 0x10468630
push dword [esi + 0x3890]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x3898], eax
test eax, eax
jne 0x1040a2c1
mov eax, dword [sym.imp.GDI32.dll_GetObjectA]
mov dword [esi + 0x3898], eax
push 0x1046cb50
push dword [esi + 0x3890]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x389c], eax
test eax, eax
jne 0x1040a2e7
mov eax, dword [sym.imp.GDI32.dll_GetBitmapBits]
mov dword [esi + 0x389c], eax
cmp dword [ebx + 0x464], 0
jne 0x1040a34a
cmp byte [ebx + 0xd7], 0
lea edi, [ebp - 0x14]
mov ecx, dword [esi + 0xfd4]
mov eax, 0x18
push edi
push 0
push 0
push 0
push 0
push 0
mov edx, 0x57
mov dword [ebp - 0x14], 0
cmovne edx, eax
push 1
mov dword [esi + 0x1af0], edx
push dword [ebx + 0xa4]
mov eax, dword [ecx]
push dword [ebx + 0xa0]
push edx
call dword [eax + 4]
mov edi, dword [ebp + 8]
mov dword [ebx + 0x464], eax
test eax, eax
je 0x1040a506
push edi
mov ecx, esi
call fcn.10409d10
test al, al
je 0x1040a506
cmp dword [ebx + 0x9c], 2
jne 0x1040a498
push dword [ebx + 0x2a4]
mov ecx, esi
push 2
push edi
call fcn.10408610
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1040a506
push dword [ebx + 0x2ac]
mov ecx, esi
push 3
push edi
call fcn.10408610
mov edx, eax
mov dword [ebp - 0x24], edx
test edx, edx
je 0x1040a51c
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebx + 0xac], eax
jbe 0x1040a494
lea ecx, [esi + 0xfb0]
lea ecx, [ecx + edi*4]
mov dword [ebp - 0x20], ecx
lea ecx, [ebx + 0x52c]
mov dword [ebp - 0x14], ecx
nop word [eax + eax]
mov edi, dword [ebx + 0x2a0]
mov ebx, dword [ebx + 0x2a8]
mov ecx, dword [esi + 0xfd4]
imul ebx, eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, edi
mov dword [ebp - 0x10], 0
imul eax, dword [ebp - 8]
add ebx, edx
push 0
shr edi, 0xc
mov dword [ebp - 0xc], 0
mov edx, dword [ecx]
add eax, dword [ebp - 0x18]
push eax
push 1
push 1
push edi
push 0x1000
push 0x3e
call dword [edx + 4]
mov edi, dword [ebp - 0x14]
mov dword [edi - 0x14], eax
lea eax, [ebp - 0xc]
mov ecx, dword [esi + 0xfd4]
push eax
push 0
push 0
mov edx, dword [ecx]
push 0
push ebx
mov ebx, dword [ebp - 0x1c]
push 1
push 1
mov eax, dword [ebx + 0x2a8]
shr eax, 0xc
push eax
push 0x1000
push 0x3e
call dword [edx + 4]
push 0
push dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 0x20]
push 0
push dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.104105d0
test eax, eax
je 0x1040a519
mov edx, dword [ebp - 0x24]
mov dword [edi - 0xf0], eax
add edi, 4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0xac]
jb 0x1040a3d0
mov edi, dword [ebp + 8]
mov byte [ebx + 0x5c], 1
push edi
mov ecx, esi
call fcn.104090d0
test al, al
je 0x1040a506
cmp byte [ebx + 0xd9], 0
je 0x1040a4ec
cmp dword [esi + 0x3888], 0
jne 0x1040a4ec
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x3888], eax
test eax, eax
je 0x1040a506
push 0
push 0
push esi
push 0x1040a5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x388c], eax
test eax, eax
je 0x1040a4ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push edi
mov ecx, esi
call fcn.10408450
test al, al
jne 0x1040a537
mov ecx, esi
call fcn.1040b730
push edi
mov ecx, esi
call fcn.1040b4f0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.1040b660
push edi
mov ecx, esi
call fcn.1040b4f0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x18
push 0xffffffffffffffff
lea eax, [ebx + 8]
mov dword [ebx + 0x20], esi
push eax
push 0x1040a850
push dword [ebx + 0x30]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x1040a567
mov eax, dword [ebp - 4]
mov dword [ebx + 0x44], eax
jmp 0x1040a57b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1040a57b
mov dword [ebx + 0x44], 0
push 0x18
push 0xffffffffffffffff
lea eax, [ebx + 8]
mov dword [ebp - 4], 0
push eax
push 0x1040a850
push dword [ebx + 0x63c]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x1040a5ab
mov eax, dword [ebp - 4]
mov dword [ebx + 0x48], eax
jmp 0x1040a5bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1040a5bf
mov dword [ebx + 0x48], 0
push edi
mov ecx, esi
call fcn.10408f70
mov eax, dword [esi + 0x1a94]
bts eax, edi
mov dword [esi + 0x1a94], eax
mov byte [ebx + 0x656], 1
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4