Function at 0x4227ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e7d0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x487ba4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x3cc]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.004021f2
add eax, 0x10
mov dword [esi], eax
push dword [edi + 0x3c8]
call fcn.0041e1c6
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
mov eax, 0x47ac8c
jne 0x422864
mov eax, 0x47ac90
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004070da
sub esp, 0x1c
mov dword [esp + 0xa0], ebx
mov esi, esp
mov dword [esp + 0x50], esp
push 0x47c560
call fcn.004070da
or dword [esp + 0xa0], 0xffffffff
call fcn.00413ca3
mov ecx, dword [edi + 0x2a0]
mov eax, dword [ecx]
push 1
call dword [eax + 0xcc]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4228be
cmp dword [edi + 0x3a0], ebx
jne 0x422a8c
push 0xa
push dword [edi + 0x3a8]
call esi
test eax, eax
jne 0x4228b2
push dword [edi + 0x3a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x3a8], ebx
lea ebx, [edi + 0x390]
mov eax, dword [ebx]
lea esi, [esp + 0x1c]
call fcn.0041f5fc
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x6c], 1
push eax
mov eax, dword [ebx]
call fcn.0040dd1c
sub esp, 0x1c
mov byte [esp + 0x84], 2
mov eax, dword [eax]
mov esi, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004070da
mov ecx, dword [edi + 0x38c]
call fcn.0041b751
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004026ee
or dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004026ee
mov eax, dword [edi + 0x38c]
xor ebx, ebx
push ebx
call fcn.0041891e
mov eax, dword [edi + 0x38c]
push 1
call fcn.0041891e
mov eax, dword [edi + 0x38c]
push 2
call fcn.0041891e
mov esi, dword [edi + 0x38c]
call fcn.0041adb5
push 0x3e8
push 0x7be
push dword [edi + 0x2d8]
lea ecx, [edi + 0x2c]
call fcn.00424385
cmp dword [edi + 0x3b0], ebx
jne 0x4229b0
push ebx
push ebx
push edi
push 0x422c27
push ebx
push ebx
call fcn.00450f0e
add esp, 0x18
mov dword [edi + 0x3b0], eax
mov eax, dword [edi + 0x38c]
lea ecx, [esp + 0x24]
call fcn.0041f59c
cmp dword [eax + 0x14], ebx
push ebx
push 1
lea esi, [esp + 0x2c]
setne byte [esp + 0x1f]
call fcn.00401e74
cmp byte [esp + 0x17], bl
je 0x422a35
mov eax, dword [edi + 0x38c]
lea ecx, [esp + 0x40]
mov byte [edi + 0x308], bl
mov byte [edi + 0x3a4], bl
call fcn.0041f59c
mov dword [esp + 0x68], 3
cmp dword [eax + 0x18], 8
jb 0x422a07
mov eax, dword [eax + 4]
jmp 0x422a0a
add eax, 4
lea ebx, [edi + 0x29c]
mov ecx, dword [ebx]
push eax
call fcn.00429cb5
or dword [esp + 0x68], 0xffffffff
push 0
push 1
lea esi, [esp + 0x48]
call fcn.00401e74
mov ecx, dword [ebx]
call fcn.00429e70
xor ebx, ebx
jmp 0x422a43
mov byte [edi + 0x308], 1
mov byte [edi + 0x3a4], 1
lea esi, [edi + 0x3a0]
jmp 0x422a5c
cmp byte [edi + 0x3a4], 0
jne 0x422a62
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi], ebx
je 0x422a4b
jmp 0x422a8c
cmp byte [edi + 0x308], 0
push 1
jne 0x422a7c
mov ecx, dword [edi + 0x29c]
mov eax, dword [ecx]
call dword [eax + 0xcc]
push ebx
mov edi, dword [edi + 0x2a0]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret