Function at 0x48838c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x488394
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x488721
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4886e5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4a4ccc]
cmp dword [eax], 1
je 0x4883d6
push 0
call sub.kernel32.dll_ExitThread
lea eax, [ebp - 8]
call fcn.00487fd8
mov eax, dword [ebp - 8]
mov edx, dword [0x4a4ae4]
call fcn.00405894
je 0x4886bd
lea eax, [ebp - 0x48]
call fcn.00488118
push dword [ebp - 0x48]
push 0x488738
lea eax, [ebp - 0x4c]
call fcn.00487d38
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x44]
call fcn.0040a168
test al, al
je 0x488437
mov eax, 0x4ad284
call fcn.004034fc
call fcn.0040304c
jmp 0x488446
mov eax, 0x4ad284
call fcn.004034f0
call fcn.0040304c
mov edx, dword [0x4a4af8]
mov eax, 0x4ad284
call fcn.00405bf0
call fcn.0040409c
call fcn.0040304c
call fcn.0040bbc0
fstp qword [ebp - 0x28]
wait
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov edx, dword [0x4a4ee8]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
call fcn.0040c7f4
call fcn.0040bb94
fstp qword [ebp - 0x30]
wait
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov edx, dword [0x4a4d44]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
call fcn.0040c7f4
push 0x488748
push dword [0x4a4ae4]
push 0x488760
push 0x48876c
push 0x488778
push dword [ebp - 0x10]
push 0x488788
push dword [ebp - 0x14]
push 0x48876c
push dword [0x4a4aec]
push 0x48876c
push dword [0x4a4af8]
push 0x48876c
lea eax, [ebp - 0x50]
mov edx, 0xd
call fcn.00405800
mov edx, dword [ebp - 0x50]
mov eax, 0x4ad284
call fcn.00405bf0
call fcn.0040409c
call fcn.0040304c
lea eax, [ebp - 0xc]
call fcn.00488158
mov eax, dword [ebp - 0xc]
mov edx, dword [0x4a4af4]
call fcn.00405894
je 0x4886a4
mov edx, dword [0x4a4af8]
mov eax, 0x4ad284
call fcn.00405bf0
call fcn.0040409c
call fcn.0040304c
mov eax, dword [0x4a4af4]
mov dword [ebp - 0x54], eax
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x48854c
sub ebx, 4
mov ebx, dword [ebx]
call fcn.0040bbc0
fstp qword [ebp - 0x38]
wait
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov edx, dword [0x4a4ee8]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
call fcn.0040c7f4
call fcn.0040bb94
fstp qword [ebp - 0x40]
wait
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov edx, dword [0x4a4d44]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
call fcn.0040c7f4
push 0x488798
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00409c6c
push dword [ebp - 0x5c]
push 0x4887c0
push 0x48876c
push 0x488778
push dword [ebp - 0x18]
push 0x488788
push dword [ebp - 0x1c]
push 0x48876c
push dword [0x4a4af4]
push 0x48876c
push dword [0x4a4af8]
push 0x48876c
lea eax, [ebp - 0x58]
mov edx, 0xd
call fcn.00405800
mov edx, dword [ebp - 0x58]
mov eax, 0x4ad284
call fcn.00405bf0
call fcn.0040409c
call fcn.0040304c
mov eax, 0x4a4af4
mov edx, dword [ebp - 0xc]
call fcn.004054c0
xor eax, eax
push ebp
push 0x48869a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a4b6c]
mov eax, dword [eax]
mov edx, 0x4887d0
call fcn.00405894
jne 0x488690
lea eax, [ebp - 0x64]
call fcn.00488118
push dword [ebp - 0x64]
push 0x488738
lea eax, [ebp - 0x68]
call fcn.00487d38
push dword [ebp - 0x68]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x60]
call fcn.00488054
push edx
push eax
mov eax, dword [0x4a4b4c]
mov eax, dword [eax]
call fcn.00409dd8
shl eax, 0xa
cdq
cmp edx, dword [esp + 4]
jne 0x488674
cmp eax, dword [esp]
pop edx
pop eax
jae 0x488690
jmp 0x488678
pop edx
pop eax
jge 0x488690
mov eax, dword [0x4a5094]
push eax
push 0
push 0
push 0x48817c
push 0
push 0
call sub.kernel32.dll_CreateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4886a4
mov eax, 0x4ad284
call fcn.00403908
call fcn.0040304c
mov eax, 0x4a4aec
call fcn.0040546c
mov eax, 0x4a4aec
mov edx, dword [ebp - 4]
call fcn.00405738
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4886ec
mov eax, 0x4a4ae4
mov edx, dword [ebp - 8]
call fcn.004054c0
ret