Function at 0x406bc5
Capabilities:
Create thread

Disassembly:
mov eax, 0x4538b4
call fcn.0044ca14
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea esi, [edi + 0x10]
mov dword [ebp - 4], ebx
call fcn.00406b11
push 0xa
pop eax
lea ecx, [edi + 0x1658]
mov dword [edi + 0xe0], eax
mov dword [edi + 0xe4], eax
mov dword [edi + 0xe8], eax
mov dword [edi + 0xec], 5
mov byte [edi + 0xf0], 1
mov dword [edi + 0xf4], ebx
call fcn.004030d8
lea ecx, [edi + 0x1674]
call fcn.0040a144
lea ecx, [edi + 0x16a0]
mov dword [edi + 0x1690], ebx
mov dword [edi + 0x1694], ebx
call fcn.004030d8
lea ecx, [edi + 0x16bc]
call fcn.004030d8
mov byte [ebp - 4], 5
lea eax, [edi + 0x16e8]
push eax
mov dword [edi + 0x16d8], 0x1000
mov dword [edi + 0x16dc], ebx
mov dword [edi + 0x16e0], ebx
mov dword [edi + 0x16e4], ebx
call fcn.0040a39c
lea eax, [edi + 0x1708]
mov byte [ebp - 4], 6
push eax
mov dword [edi + 0x1700], ebx
call fcn.0040a39c
lea eax, [edi + 0x1720]
push eax
mov byte [ebp - 4], 7
call fcn.0040a39c
mov byte [ebp - 4], 8
push ebx
lea esi, [edi + 0x174c]
push 1
mov dword [edi + 0x1738], ebx
mov dword [edi + 0x173c], ebx
mov dword [edi + 0x1740], ebx
mov byte [edi + 0x1744], bl
mov dword [edi + 0x1748], 0x1f
mov dword [ebp - 0x10], esi
call fcn.00405331
pop ecx
pop ecx
cmp eax, ebx
je 0x406ce2
mov dword [eax], esi
jmp 0x406ce4
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 4], 9
call fcn.00406a33
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x2d], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
lea ecx, [edi + 0x1798]
mov dword [edi + 0x176c], ebx
mov dword [edi + 0x1770], ebx
mov byte [edi + 0x1774], bl
mov dword [edi + 0x1778], ebx
mov byte [edi + 0x1794], 1
call fcn.004030d8
lea ecx, [edi + 0x17b4]
call fcn.004030d8
lea ecx, [edi + 0x17d0]
call fcn.004030d8
lea ecx, [edi + 0x17ec]
call fcn.004030d8
lea ecx, [edi + 0x180c]
mov dword [edi + 0x1808], ebx
call fcn.004030d8
lea ecx, [edi + 0x1828]
call fcn.004030d8
push 5
pop eax
lea ecx, [edi + 0x1854]
mov dword [edi + 0x1844], ebx
mov word [edi + 0x1848], ax
mov dword [edi + 0x184c], ebx
mov dword [edi + 0x1850], ebx
call fcn.004030d8
mov byte [ebp - 4], 0x11
push 0x54
mov dword [edi + 0x1870], ebx
call fcn.0043a403
pop ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x12
cmp eax, ebx
je 0x406dbf
push edi
push eax
call fcn.0040f48f
mov esi, eax
jmp 0x406dc1
xor esi, esi
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x1704], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push ebx
push esi
push 0x40a6af
push ebx
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 8]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1540
lea eax, [edi + 0x100]
push ebx
push eax
call fcn.0043ae00
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
lea eax, [edi + 0x1640]
push eax
call esi
lea eax, [edi + 0x177c]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4