Function at 0x422186
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e062
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x486ba4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x3c0]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.004021fc
add eax, 0x10
mov dword [esi], eax
push dword [edi + 0x3bc]
call fcn.0041deea
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
mov eax, 0x479c8c
jne 0x4221eb
mov eax, 0x479c90
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004070e1
sub esp, 0x1c
mov dword [esp + 0xa0], ebx
mov esi, esp
mov dword [esp + 0x50], esp
push 0x47b490
call fcn.004070e1
or dword [esp + 0xa0], 0xffffffff
call fcn.00413cd2
mov ecx, dword [edi + 0x29c]
mov eax, dword [ecx]
push 1
call dword [eax + 0xcc]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x422245
cmp dword [edi + 0x394], ebx
jne 0x422413
push 0xa
push dword [edi + 0x39c]
call esi
test eax, eax
jne 0x422239
push dword [edi + 0x39c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x39c], ebx
lea ebx, [edi + 0x384]
mov eax, dword [ebx]
lea esi, [esp + 0x1c]
call fcn.0041f1b1
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x6c], 1
push eax
mov eax, dword [ebx]
call fcn.0040dd65
sub esp, 0x1c
mov byte [esp + 0x84], 2
mov eax, dword [eax]
mov esi, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004070e1
mov ecx, dword [edi + 0x380]
call fcn.0041b56d
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004026f8
or dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004026f8
mov eax, dword [edi + 0x380]
xor ebx, ebx
push ebx
call fcn.004188f2
mov eax, dword [edi + 0x380]
push 1
call fcn.004188f2
mov eax, dword [edi + 0x380]
push 2
call fcn.004188f2
mov esi, dword [edi + 0x380]
call fcn.0041ac18
push 0x3e8
push 0x7be
push dword [edi + 0x2d0]
lea ecx, [edi + 0x2c]
call fcn.00423cf3
cmp dword [edi + 0x3a4], ebx
jne 0x422337
push ebx
push ebx
push edi
push 0x4225ae
push ebx
push ebx
call fcn.0045087e
add esp, 0x18
mov dword [edi + 0x3a4], eax
mov eax, dword [edi + 0x380]
lea ecx, [esp + 0x24]
call fcn.0041f151
cmp dword [eax + 0x14], ebx
push ebx
push 1
lea esi, [esp + 0x2c]
setne byte [esp + 0x1f]
call fcn.00401e7e
cmp byte [esp + 0x17], bl
je 0x4223bc
mov eax, dword [edi + 0x380]
lea ecx, [esp + 0x40]
mov byte [edi + 0x300], bl
mov byte [edi + 0x398], bl
call fcn.0041f151
mov dword [esp + 0x68], 3
cmp dword [eax + 0x18], 8
jb 0x42238e
mov eax, dword [eax + 4]
jmp 0x422391
add eax, 4
lea ebx, [edi + 0x298]
mov ecx, dword [ebx]
push eax
call fcn.0042962c
or dword [esp + 0x68], 0xffffffff
push 0
push 1
lea esi, [esp + 0x48]
call fcn.00401e7e
mov ecx, dword [ebx]
call fcn.004297e7
xor ebx, ebx
jmp 0x4223ca
mov byte [edi + 0x300], 1
mov byte [edi + 0x398], 1
lea esi, [edi + 0x394]
jmp 0x4223e3
cmp byte [edi + 0x398], 0
jne 0x4223e9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi], ebx
je 0x4223d2
jmp 0x422413
cmp byte [edi + 0x300], 0
push 1
jne 0x422403
mov ecx, dword [edi + 0x298]
mov eax, dword [ecx]
call dword [eax + 0xcc]
push ebx
mov edi, dword [edi + 0x29c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret