Function at 0x100492a7
Capabilities:
Create thread

Disassembly:
mov eax, 0x10082210
call fcn.10080918
sub esp, 0x4c
push ebx
push edi
mov edi, ecx
xor ecx, ecx
inc ecx
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
push 2
mov dword [ebp - 0x2c], ecx
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], ebx
jmp 0x100492d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100492ce
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100492f6
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor ecx, ecx
inc ecx
inc dword [ebp - 0x24]
push esi
push edi
push 0x4729
push ecx
push 0x4da4
call fcn.10044fc4
mov dword [ebp - 0x14], 0x477862f
add esp, 0x10
mov dword [ebp - 0x14], ebx
jmp 0x1004939d
mov dword [ebp - 0x20], 0x24c00011
mov dword [ebp - 0x1c], 0x509cb0be
mov dword [ebp - 0x24], 0xc3d6
cmp dword [ebp - 0x14], ebx
jne 0x100493a7
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 1
setle cl
cmp ecx, dword [ebp - 0x24]
jl 0x10049350
cmp dword [ebp - 0x14], ebx
jne 0x10049350
mov esi, ebx
jmp 0x10049353
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, 0xc39ba095
setle dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
cmp esi, eax
setl cl
sub ecx, 0xe649
add ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x20], ecx
jg 0x10049394
cmp dword [ebp - 0x24], ebx
jne 0x10049394
mov eax, ebx
jmp 0x10049397
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
jle 0x1004931d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100493c3
push ebx
push 0x1082
push ebx
push ebx
push 0x1abb
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
call fcn.1002d91e
mov dword [ebp - 0x1c], 0x1928c176
mov ebx, eax
mov dword [ebp - 0x24], 0x281c1d99
xor eax, eax
mov dword [ebp - 0x28], 0xb87c2657
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
pop ecx
mov dword [ebp - 0x2c], ebx
jg 0x10049604
xor edi, edi
xor ebx, ebx
inc edi
push edi
lea ecx, [ebp - 0x40]
call fcn.100173c8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10049419
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1004940c
mov esi, dword [ebp - 0x40]
cmp dword [esi], ebx
je 0x1004958c
push edi
lea ecx, [ebp - 0x4c]
call fcn.100173c8
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
jmp 0x1004944b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1004943b
mov eax, dword [ebp - 0x4c]
mov dword [eax], ebx
mov dword [ebp - 0x20], 0x3b7beded
lea ecx, [ebp - 0x58]
push 2
call fcn.100173c8
mov dword [ebp - 0x14], ebx
jmp 0x1004947c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1004946c
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x1004956c
mov dword [ebp - 0x14], ebx
jmp 0x1004949d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10049493
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1004955c
mov dword [ebp - 0x14], 0x66a92721
mov dword [ebp - 0x14], ebx
jmp 0x100494cb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100494bb
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10049553
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x24], 0x5f7626a9
mov dword [ebp - 0x24], 0x422d5fba
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
push 0xfffffffffffffffe
mov esi, dword [ecx + eax*4]
add esi, dword [ecx + edx*4]
mov edx, dword [ebp - 0x18]
neg esi
mov ecx, dword [ebp - 0x40]
neg esi
mov eax, dword [ebp - 0x14]
sbb esi, esi
xor ebx, ebx
neg esi
cmp eax, dword [ecx + edx*4]
mov eax, dword [ebp - 0x1c]
setl bl
xor ecx, ecx
cmp ebx, eax
pop eax
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x40]
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [edi + 4], edx
cmp edx, dword [eax]
setle cl
cmp ecx, 0xfffc
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp esi, eax
setne cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x14]
jns 0x100494dc
xor ebx, ebx
dec dword [ebp - 0x18]
jns 0x100494af
mov dword [ebp - 0x24], 0xf7c2f5a2
dec dword [ebp - 0x20]
jns 0x1004948e
lea ecx, [ebp - 0x58]
call fcn.10017c88
mov eax, dword [ebp - 0x4c]
dec dword [eax]
jns 0x10049456
lea ecx, [ebp - 0x4c]
call fcn.10017c88
xor edi, edi
inc edi
jmp 0x100495e6
mov esi, dword [esi]
xor edx, edx
mov dword [ebp - 0x20], 0xf0d4a7c7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
sub edx, 0xd1cc
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, esi
setne cl
xor eax, eax
cmp ecx, 0xc359
setge al
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, esi
setg al
sub eax, 0xbc35
je 0x100495da
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10017c88
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
jle 0x100493f8
mov ebx, dword [ebp - 0x2c]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
pop esi
je 0x10049617
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret