Function at 0x401a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4972cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c4014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4c8c88]
test eax, eax
jne 0x401a9a
push 0x84
call fcn.004699a8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 0
call fcn.0046bb80
add esp, 0xc
mov ecx, esi
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c8c88], eax
mov ecx, dword [eax + 4]
add eax, 4
push str.SvcInit:_Started_New
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 8
call fcn.0040b160
mov dword [0x4c8c80], eax
test eax, eax
jne 0x401aed
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 1
call fcn.00401770
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
push 2
push 1
lea ecx, [edx + 4]
call fcn.00401770
add esp, 8
push 0
push 0
push 0
push 0x401520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov eax, dword [0x4c8c88]
jne 0x401b63
test eax, eax
jne 0x401b5c
push 0x84
call fcn.004699a8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 1
call fcn.0046bb80
add esp, 0xc
mov ecx, esi
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c8c88], eax
push str.SvcInit:_Creat_thread_failed
jmp 0x401ba8
test eax, eax
jne 0x401ba3
push 0x84
call fcn.004699a8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 2
call fcn.0046bb80
add esp, 0xc
mov ecx, esi
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c8c88], eax
push str.SvcInit:_Create_thread_successful
mov ecx, dword [eax + 4]
add eax, 4
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x49e2d4]
call esi
mov eax, dword [0x4c8c88]
add esp, 8
test eax, eax
jne 0x401c04
push 0x84
call fcn.004699a8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 3
call fcn.0046bb80
add esp, 0xc
mov ecx, esi
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c8c88], eax
mov ecx, dword [eax + 4]
add eax, 4
push str.SvcInit:_Now_wating_for_the_close_signal
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x49e2d4]
call esi
mov esi, dword [0x4c8c80]
add esp, 8
test esi, esi
jne 0x401c8d
mov esi, dword [0x4c8c94]
test esi, esi
je 0x401c5e
push str.NULL_OOBE_Event_t_object_passed_in_WaitforEvent
push 0x4aea60
push 0x4aea60
push str.OOBEEvents
push str.OOBEUtils
push 0x32
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
jmp 0x401c9f
mov eax, dword [0x4c8c98]
test eax, eax
je 0x401caa
mov esi, dword [eax]
push str.NULL_OOBE_Event_t_object_passed_in_WaitforEvent
push str.OOBEEvents
push 0x4aea60
mov esi, dword [esi + 0x34]
mov ecx, esi
push 0x32
push eax
call dword [0x49e2d4]
call esi
add esp, 0x14
jmp 0x401c9f
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [0x4c8c94]
mov eax, dword [0x4c8c98]
mov edi, dword [0x4c8c80]
test edi, edi
jne 0x401d0c
test esi, esi
je 0x401ce2
push str.NULL_OOBE_Event_t_object_passed_in_DestroyEvent
push 0x4aea60
push 0x4aea60
push str.OOBEEvents
push str.OOBEUtils
push 0x32
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
jmp 0x401d2a
test eax, eax
je 0x401d2a
mov esi, dword [eax]
push str.NULL_OOBE_Event_t_object_passed_in_DestroyEvent
push str.OOBEEvents
push 0x4aea60
mov esi, dword [esi + 0x34]
mov ecx, esi
push 0x32
push eax
call dword [0x49e2d4]
call esi
add esp, 0x14
jmp 0x401d2a
mov eax, dword [edi]
test eax, eax
je 0x401d1f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push 4
push edi
call fcn.004699d8
add esp, 8
xor edx, edx
push 3
push 0
lea ecx, [edx + 1]
call fcn.00401770
mov eax, dword [0x4c8c88]
add esp, 8
test eax, eax
jne 0x401d80
push 0x84
call fcn.004699a8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 4
call fcn.0046bb80
add esp, 0xc
mov ecx, esi
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c8c88], eax
mov ecx, dword [eax + 4]
add eax, 4
push str.SvcInit:_Finished
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret