Function at 0x1004ac10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, eax
mov ebx, dword [esi + 0x250]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0x14]
mov dword [ebp - 0x14], 0
add eax, eax
add eax, eax
add eax, eax
sub eax, dword [edi + 0x1c]
add eax, dword [edi + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x240]
mov ecx, eax
cmp eax, ebx
jl 0x1004ac4e
mov ecx, ebx
cmp ecx, 1
jge 0x1004ac5c
mov dword [ebp - 0xc], 1
jmp 0x1004ac66
mov dword [ebp - 0xc], eax
cmp eax, ebx
jl 0x1004ac66
mov dword [ebp - 0xc], ebx
mov eax, ebx
shl eax, 0xa
cdq
idiv dword [ebp - 0xc]
mov ecx, dword [esi + 0xa0]
push 0
push 0x10
push 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x18], eax
mov eax, 1
mov dword [esi + 0x64], eax
mov dword [ecx + 0x1c], eax
mov edx, dword [esi + 0xa0]
mov dword [edx + 0x14], 0
mov eax, dword [esi + 0xa0]
push eax
push esi
xor edx, edx
xor ecx, ecx
call fcn.10049e50
mov edx, dword [esi + 0xa0]
call fcn.1004a6f0
mov ecx, dword [esi + 0xa0]
push ebx
push ecx
push esi
push edi
call fcn.10057c20
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0xa4]
mov eax, dword [ecx + 0x30]
mov edi, dword [esi + 0x20]
mov dword [ebp - 8], edx
cdq
idiv edi
add esp, 0x24
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 0x2c], edx
mov eax, dword [eax + 0x30]
cdq
idiv edi
mov edx, dword [ebp - 4]
sub edx, eax
mov dword [ecx + 0x28], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
and ecx, 7
mov eax, 8
sub eax, ecx
cmp eax, 8
jge 0x1004ad21
mov ecx, dword [eax*4 + 0x1007522c]
push ecx
call fcn.10048b90
add esp, 4
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax + 0x44]
mov ecx, dword [ecx + 0xf0]
push ecx
push 1
push eax
push esi
push edx
call fcn.10057740
mov edi, dword [ebp - 0xc]
mov edx, dword [esi + 0xa0]
xor eax, eax
add esp, 0x14
mov dword [edx + 0x124], eax
mov dword [ebp - 4], eax
cmp edi, eax
jle 0x1004ae50
xor edi, edi
lea esp, [esp]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
add eax, 0x200
sar eax, 0xa
mov ecx, eax
lea edi, [edi + edi*8]
shl ecx, 0xa
sub edx, ecx
add dword [ebp - 0x10], edx
mov ecx, dword [esi + 0x244]
mov edx, dword [ebp - 0x14]
add edi, edi
add edi, edi
add edi, edi
mov dword [ecx + edi + 0x44], esi
lea ecx, [eax + edx]
mov eax, ecx
imul eax, dword [ebp - 0x18]
lea eax, [eax + ebx - 1]
cdq
idiv ebx
mov edx, dword [esi + 0x244]
mov dword [edx + edi + 0x18], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
lea eax, [eax + ebx - 1]
cdq
idiv ebx
cmp word [ebp - 4], 0
mov edx, dword [esi + 0x244]
mov dword [ebp - 0x14], ecx
mov dword [edx + edi + 0x14], eax
jbe 0x1004ae3a
mov eax, dword [esi + 0x244]
mov edx, dword [eax + edi + 0x3c]
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], eax
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
bswap eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [edx + 0x14]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
bswap eax
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
test eax, eax
je 0x1004ae1d
mov ecx, 0x20
sub ecx, eax
or eax, 0xffffffff
shl eax, cl
and eax, dword [edx]
mov dword [edx + 8], eax
jmp 0x1004ae24
mov dword [edx + 8], 0
mov eax, dword [edx + 0x1c]
mov dword [edx + 0xc], eax
mov ecx, dword [esi + 0x244]
mov edx, dword [ecx + edi + 0x40]
mov dword [edx], 0
mov eax, dword [ebp - 4]
inc eax
movzx edi, ax
mov dword [ebp - 4], eax
cmp edi, dword [ebp - 0xc]
jl 0x1004ad60
mov edi, dword [ebp - 0xc]
mov eax, dword [esi + 0x244]
mov ebx, dword [ebp + 8]
mov dword [eax + 0x3c], ebx
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x244]
mov eax, 1
add ecx, 0x124
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], eax
cmp edi, eax
jle 0x1004aebf
lea ecx, [ecx]
lea ebx, [eax + eax*8]
mov eax, dword [esi + 0x244]
add ebx, ebx
push 0
add ebx, ebx
push 0
add ebx, ebx
add eax, ebx
push eax
push fcn.1004a770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0x244]
mov dword [ebx + ecx], eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
movzx eax, ax
cmp eax, edi
jl 0x1004ae80
mov ebx, dword [ebp + 8]
mov edx, dword [esi + 0x244]
push edx
call fcn.1004a770
mov eax, 1
add esp, 4
mov dword [ebp - 4], eax
cmp edi, eax
jle 0x1004af1c
lea ebx, [ebx]
lea ebx, [eax + eax*8]
mov eax, dword [esi + 0x244]
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov ecx, dword [eax + ebx]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x244]
mov eax, dword [edx + ebx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
movzx eax, ax
cmp eax, edi
jl 0x1004aee0
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0x14]
cmp dword [ebx + 0xc], 0
je 0x1004af49
mov edx, dword [ebx + 8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
bswap eax
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebx + 0xc]
add eax, 7
shr eax, 3
add ecx, eax
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x1004af55
shr eax, 3
sub ecx, eax
mov eax, dword [ebp - 0x20]
cdq
and edx, 7
add eax, edx
mov edx, dword [esi + 0xa0]
sar eax, 3
sub ecx, eax
push edi
mov dword [edx + 0x120], ecx
mov eax, dword [esi + 0xa0]
push ebx
push esi
call fcn.1004aa50
mov ecx, dword [esi + 0xa0]
fld dword [0x10075258]
xor eax, eax
mov dword [ecx + 0x140], eax
mov edx, dword [esi + 0xa0]
mov dword [edx + 0x138], eax
mov ecx, dword [esi + 0xa0]
mov dword [ecx + 0x134], eax
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xa0]
add esp, 0xc
imul edx, dword [esi + 0x14]
mov dword [ecx + 0x130], edx
mov edx, dword [esi + 0xa0]
fstp dword [esi + 0x24c]
mov dword [esi + 0x68], 2
mov dword [edx + 0x144], eax
mov eax, dword [esi + 0xa0]
pop edi
pop esi
mov dword [eax + 0x148], 0xffffffff
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret