Function at 0x49e428
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], edx
mov dword [ebp - 0x40], eax
mov eax, 0x4d20b0
call fcn.004afb5c
mov dword [ebp - 0x20], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.004b9bd8
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 8
mov edx, dword [ebp - 0x40]
mov ecx, dword [edx + 0x2e0]
mov edx, dword [ecx + 0x60]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0x2e4]
call fcn.0044c138
mov edx, dword [ebp - 0x40]
xor ecx, ecx
mov dword [edx + 0x3c4], ecx
mov eax, dword [ebp - 0x40]
mov byte [eax + 0x3bc], 0
mov edx, dword [ebp - 0x40]
mov byte [edx + 0x3fc], 1
mov ecx, dword [ebp - 0x40]
cmp byte [ecx + 0x375], 0
je 0x49e4de
mov word [ebp - 0x2c], 0x14
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040aae8
mov dl, byte [eax]
lea eax, [ebp - 8]
call fcn.004b9c70
inc dword [ebp - 0x20]
call fcn.004ba208
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x3b0], eax
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b9d00
jmp 0x49e51c
mov word [ebp - 0x2c], 0x20
lea eax, [ebp - 4]
mov edx, 2
call fcn.0040aae8
mov dl, byte [eax]
lea eax, [ebp - 0xc]
call fcn.004b9c70
inc dword [ebp - 0x20]
call fcn.004ba208
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x3b0], eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004b9d00
mov word [ebp - 0x2c], 0x2c
mov edx, 0x4cc184
lea eax, [ebp - 0x10]
call fcn.004b9bd8
inc dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [ebp - 0x40]
call fcn.0049645c
xor ecx, ecx
mov cl, al
cmp ecx, 1
sbb eax, eax
neg eax
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004b9d00
pop ecx
test cl, cl
je 0x49e56d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
call fcn.00487ae8
jmp 0x49e755
mov eax, dword [ebp - 0x40]
call fcn.00490734
test al, al
jne 0x49e5a5
mov edx, dword [0x4db5ac]
mov eax, dword [edx]
call fcn.00442728
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b9d00
mov ecx, dword [ebp - 0x3c]
mov dword fs:[0], ecx
jmp 0x49e76f
mov eax, dword [ebp - 0x40]
call fcn.00490d40
mov eax, dword [ebp - 0x40]
call fcn.00490ec8
xor edx, edx
mov dword [ebp - 0x44], edx
mov word [ebp - 0x2c], 8
jmp 0x49e6ea
mov word [ebp - 0x2c], 0x38
mov edx, 0x4cbb31
lea eax, [ebp - 0x14]
call fcn.004b9ba0
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
add eax, 0x38c
push eax
call fcn.00488308
add esp, 8
mov eax, dword [eax]
add eax, 0x50
pop edx
call fcn.004b9de4
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004b9d00
pop ecx
test cl, cl
je 0x49e657
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x2e4]
mov eax, dword [edx + 0x20c]
mov edx, dword [ebp - 0x44]
call fcn.0045d9f8
xor edx, edx
call fcn.0045d400
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x2e4]
mov eax, dword [ecx + 0x20c]
mov edx, dword [ebp - 0x44]
call fcn.0045d9f8
xor ecx, ecx
xor edx, edx
call fcn.0045d600
jmp 0x49e6e7
mov word [ebp - 0x2c], 0x44
mov edx, 0x4cbb33
lea eax, [ebp - 0x18]
call fcn.004b9ba0
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
add eax, 0x38c
push eax
call fcn.00488308
add esp, 8
mov eax, dword [eax]
add eax, 0x50
pop edx
call fcn.004b9de4
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004b9d00
pop ecx
test cl, cl
je 0x49e6e7
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x2e4]
mov eax, dword [edx + 0x20c]
mov edx, dword [ebp - 0x44]
call fcn.0045d9f8
mov dl, 1
call fcn.0045d400
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x2e4]
mov eax, dword [ecx + 0x20c]
mov edx, dword [ebp - 0x44]
call fcn.0045d9f8
mov ecx, 1
xor edx, edx
call fcn.0045d600
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
add eax, 0x38c
push eax
call fcn.004882e0
pop ecx
cmp eax, dword [ebp - 0x44]
ja 0x49e5c5
mov eax, dword [ebp - 0x40]
call fcn.0043f590
mov edx, dword [ebp - 0x40]
mov dword [edx + 0x3c4], 1
mov eax, dword [ebp - 0x40]
call fcn.0048fcf8
mov eax, dword [ebp - 0x40]
call fcn.00492ddc
mov edx, dword [ebp - 0x40]
add edx, 0x3cc
push edx
push 0
push dword [ebp - 0x40]
push 0x494f38
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x3d0], eax
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
call dword [edx + 0x78]
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b9d00
mov ecx, dword [ebp - 0x3c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret