Function at 0x43e764
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov al, byte [ebp + 0x20]
and byte [ebp + 0x20], 0xf
push ebx
push esi
push edi
push dword [ebp + 0x14]
and al, 0xf0
mov byte [ebp - 1], al
call fcn.0046176a
mov ebx, eax
mov eax, 0xb4
cmp ebx, eax
pop ecx
jle 0x43e792
mov ebx, eax
test byte [ebp - 1], 0x80
je 0x43e893
mov esi, 0x48b1a4
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
and dword [ebp - 0x2a0], 0
xor eax, eax
mov ecx, 0xa5
lea edi, [ebp - 0x29c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0xa8], eax
mov al, byte [ebp + 0x20]
mov byte [ebp - 0xb4], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xb0], eax
lea eax, [ebx + ebx]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x250]
push eax
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x254], edi
call fcn.00461a50
and word [ebp + ebx*2 - 0x250], 0
add esp, 0xc
push 0x48b14c
push 0x10000
lea eax, [ebp - 0x2a0]
push eax
push 0x43e1b8
push 0x20000
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
mov dword [ebp - 8], eax
je 0x43e86f
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp + 0x20], 0x270f
cmp dword [ebp - 0x254], edi
jne 0x43e866
push 0
call ebx
dec dword [ebp + 0x20]
jns 0x43e847
jmp 0x43e85e
push 1
call ebx
cmp dword [ebp - 0x254], edi
je 0x43e85a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push str.__LastTID
push dword [0x48b14c]
push dword [ebp + 8]
call fcn.0042d501
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor eax, eax
jmp 0x43e9c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
mov al, byte [ebp - 1]
and al, 0x40
mov byte [ebp - 1], al
jne 0x43e8af
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43e8af
mov esi, dword [eax + 0x18]
push 0x290
call fcn.00461a38
test eax, eax
pop ecx
je 0x43e8cf
push 0x2720
push esi
mov ecx, eax
call fcn.0040107f
mov esi, eax
jmp 0x43e8d1
xor esi, esi
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
lea edi, [esi + 0x1e4]
mov ecx, edi
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1f8], eax
call fcn.0042a1b7
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x4c], eax
mov al, byte [ebp + 0x20]
mov byte [esi + 0x1ec], al
mov eax, dword [edi]
mov dword [esi + 0x1e8], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x1f0], eax
lea eax, [ebx + ebx]
push eax
push dword [ebp + 0x14]
lea eax, [esi + 0x50]
push eax
call fcn.00461a50
and word [esi + ebx*2 + 0x50], 0
mov ebx, dword [ebp + 0xc]
add esp, 0xc
test ebx, ebx
mov edi, 0x48b5d4
je 0x43e946
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
inc dword [ebx + 0x6c]
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push esi
call fcn.0042158d
test ebx, ebx
pop ecx
je 0x43e95a
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 1], 0
mov byte [esi + 0x49], 0
mov byte [esi + 0x48], 0
mov ecx, esi
je 0x43e982
mov eax, dword [esi]
push 0
push 0
mov byte [esi + 0x48], 0x10
call dword [eax + 8]
push 0
mov ecx, esi
call fcn.00433e4b
jmp 0x43e987
call fcn.00433f87
test ebx, ebx
mov eax, dword [esi + 0x1fc]
mov dword [ebp + 0x20], eax
je 0x43e9bd
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
dec dword [ebx + 0x6c]
cmp byte [ebx + 0x49], 0x81
je 0x43e9b6
push 0
push 0
push 0x43d
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [ebp + 0x20]
pop edi
pop esi
pop ebx
leave
ret