Function at 0x409980
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x6cc
push 0x416fd0
call fcn.00409e13
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x20], eax
mov esi, 0x32e
push esi
push edi
lea eax, [ebp - 0x3ac]
push eax
call fcn.0040c8cd
lea eax, [esi - 4]
mov word [ebp - 0x3a4], ax
push esi
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.0040c8b4
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x6d4]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c8e4
mov eax, dword [0x418074]
cmp dword [eax + 0x88], edi
je 0x409a38
mov edi, 0x604
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x28], esi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x2c], eax
lea ecx, [esi + 8]
lea edx, [edi - 4]
mov word [ecx], dx
add eax, 8
mov word [eax], dx
push ecx
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c8e4
xor edi, edi
mov dword [ebp - 0x48], 0x40c792
mov dword [ebp - 0x44], 0x40c82e
mov dword [ebp - 0x40], 0x4089d0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], esi
mov dword [esi], 0x237
mov dword [esi + 4], 6
mov eax, dword [0x418074]
cmp dword [eax + 0x88], edi
je 0x409a7a
mov dword [esi], 0xd77
mov dword [esi + 4], 1
cmp dword [ebp - 0x20], 0
je 0x409ae5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp dword [ebp - 0x20], eax
jne 0x409ae5
mov dword [ebp - 0x24], 1
or byte [esi + 0x1bbc], 4
cmp dword [0x41806c], 3
jne 0x409aba
lea eax, [ebp - 0x30]
push eax
push 4
push esi
push 0x4096c0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x409ad7
push 0x4096c0
call fcn.004068ca
lea ecx, [ebp - 0x30]
push ecx
push 4
push esi
push eax
push edi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x409ae5
and byte [esi + 0x1bbc], 0xfb
mov ebx, 0x406a60
mov ecx, 0x406960
mov eax, dword [esi + 0x6c]
sub eax, 3
je 0x409afe
sub eax, 1
jne 0x409b00
mov ebx, edi
mov ecx, edi
lea edi, [esi + 0x1bc8]
push 2
push ecx
push edi
push esi
call fcn.00407377
test eax, eax
je 0x409b79
push 1
push ebx
lea eax, [esi + 0x78]
push eax
push esi
call fcn.00407377
test eax, eax
je 0x409b79
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], esi
jne 0x409b36
push esi
push edi
call fcn.00406395
cmp dword [ebp - 0x1c], 0
je 0x409b5f
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x20]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409b75
lea eax, [ebp - 0x7c]
push eax
call fcn.00408618
test eax, eax
jne 0x409b5f
jmp 0x409b75
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c96f
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x409b90
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x409b9e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4