Function at 0x427c90
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x484b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
push ebp
push ebp
mov ebx, ecx
push ebx
push 0x41a060
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 5
push 0x43c
mov ecx, ebx
call fcn.00476dee
mov ecx, eax
call fcn.00476fb8
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [0x4ac1d8], ecx
mov dword [0x4ac1dc], ecx
mov dword [0x4ac1e0], ecx
mov dword [0x4ac1e4], ecx
mov dword [0x4ac1e8], ecx
mov dword [0x4ac1ec], ecx
mov dword [0x4ac1f0], ecx
mov dword [0x4ac1f4], ecx
mov dword [0x4ac1f8], ecx
push ebp
mov dword [0x4ac1fc], ecx
push 4
mov ecx, ebx
mov dword [0x4ac2b0], eax
mov dword [0x4ac2ac], ebp
call fcn.00476dee
mov ecx, eax
call fcn.00476ff4
push ebp
push 5
mov ecx, ebx
call fcn.00476dee
mov ecx, eax
call fcn.00476ff4
lea edx, [ebx + 0xc98]
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebp
call fcn.00402080
push 0xa
push str.NLSet.dat
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebp
call fcn.00401db0
mov eax, dword [esp + 0xc]
push 0x48ab04
push eax
call fcn.004606c3
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x427d9b
push esi
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.004602e5
push esi
call fcn.0046013a
add esp, 0x14
mov eax, dword [0x4aca10]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca10]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca10]
push edi
mov dword [0x4aca14], ebp
je 0x427e10
jmp 0x427dc0
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427ddf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427dfc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca10]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x427dc0
mov eax, dword [0x4aca1c]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca1c]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca1c]
mov dword [0x4aca20], ebp
je 0x427e80
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427e4f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427e6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca1c]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x427e30
mov eax, dword [0x4aca28]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca28]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca28]
mov dword [0x4aca2c], ebp
je 0x427ef0
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427ebf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427edc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca28]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x427ea0
mov eax, dword [0x4aca34]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca34]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca34]
mov dword [0x4aca38], ebp
je 0x427f60
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f2f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca34]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x427f10
mov eax, dword [0x4aca40]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca40]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca40]
mov dword [0x4aca44], ebp
je 0x427fd0
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427fbc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca40]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x427f80
mov eax, dword [0x4aca4c]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca4c]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca4c]
mov dword [0x4aca50], ebp
je 0x428040
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42800f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42802c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca4c]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x427ff0
mov eax, dword [0x4aca58]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca58]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca58]
mov dword [0x4aca5c], ebp
je 0x4280b0
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42807f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42809c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca58]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x428060
mov eax, dword [0x4aca64]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca64]
mov dword [eax + 4], eax
mov eax, dword [0x4aca64]
cmp esi, eax
mov dword [0x4aca68], ebp
je 0x428120
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4280ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42810c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca64]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x4280d0
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca64]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca64]
mov dword [0x4aca68], ebp
je 0x428190
lea ebx, [ebx]
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42815f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42817c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca64]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x428140
mov eax, dword [0x4aca70]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca70]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca70]
mov dword [0x4aca74], ebp
je 0x428200
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca70]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x4281b0
mov eax, dword [0x4aca7c]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca7c]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca7c]
mov dword [0x4aca80], ebp
je 0x428270
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42823f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42825c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca7c]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x428220
mov esi, dword [0x4ac284]
mov edx, dword [0x4ac294]
mov eax, dword [ebx + 0xc90]
xor ecx, ecx
cmp esi, ebp
sete cl
cmp edx, ebp
mov dword [0x4ac2a8], eax
pop edi
je 0x4282b8
cmp ecx, ebp
je 0x4282b2
add eax, eax
push eax
lea esi, [ebx + 0x294]
push ebp
mov ecx, esi
call fcn.0042fc80
push ebp
mov ecx, esi
call fcn.0042fcc0
jmp 0x4282e4
lea ecx, [eax + eax]
push ecx
jmp 0x4282c5
cmp ecx, ebp
jne 0x4282c2
lea edx, [eax + eax]
push edx
jmp 0x42829a
add eax, eax
push eax
lea esi, [ebx + 0xb1c]
mov ecx, esi
push ebp
call fcn.0042fc80
mov ecx, esi
push ebp
call fcn.0042fcc0
mov ecx, esi
push 5
call fcn.00476fb8
push ebp
push ebp
push ebx
push 0x426c50
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebx + 0x1c]
push ebp
push 0x3e8
push 4
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x1c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop esi
pop ebp
pop ebx
jg 0x42832f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4