Function at 0x494c80
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x58a7cb
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, edx
xor esi, esi
cmp ebx, esi
je 0x494d89
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, ebx
call fcn.00445d30
mov eax, dword [ebx + 0x18]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], esi
mov dword [eax], eax
mov eax, dword [ebx + 0x18]
push 0x48
mov dword [eax + 8], eax
mov dword [esp + 0x20], esi
call fcn.004a3245
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], esi
cmp eax, esi
je 0x494cfb
push eax
call fcn.00494820
mov ebp, eax
jmp 0x494cfd
xor ebp, ebp
mov dword [esp + 0x40], 0xffffffff
mov ecx, ebp
call fcn.00494930
cmp edi, esi
jne 0x494d14
xor eax, eax
jmp 0x494d29
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x494d20
sub eax, edx
push edi
mov edi, eax
mov eax, ebp
call fcn.004033b0
movzx edx, word [esp + 0x48]
push edx
push 0x5d2c34
lea edi, [ebp + 4]
call fcn.00402e20
add esp, 8
push esi
push 0x10004
push ebp
push 0x494c40
push 0x6000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov dword [esp + 0x20], edi
mov ecx, ebp
cmp edi, esi
jne 0x494d9f
call fcn.004949b0
test eax, eax
jne 0x494d89
cmp ebp, esi
je 0x494d89
push ebp
call fcn.004948b0
push ebp
call fcn.004a3142
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
call fcn.00494930
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x494e54
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x18], esi
jbe 0x494e45
mov ecx, dword [ebp + 0x20]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], esi
lea ecx, [ecx]
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
test esi, esi
je 0x494dfe
cmp esi, eax
je 0x494e03
call fcn.004a35f3
cmp dword [esp + 0x28], edi
je 0x494e64
test esi, esi
jne 0x494e41
call fcn.004a35f3
mov eax, dword [esp + 0x28]
cmp eax, dword [esi + 0x18]
jne 0x494e20
call fcn.004a35f3
mov ecx, dword [esp + 0x28]
add ecx, 0xc
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00498ef0
lea esi, [esp + 0x24]
call fcn.00422dc0
mov esi, dword [esp + 0x24]
jmp 0x494df0
mov esi, dword [esi]
jmp 0x494e12
mov eax, dword [esp + 0x4c]
cmp eax, esi
je 0x494e6a
mov ecx, dword [ebp + 0x28]
mov dword [eax], ecx
jmp 0x494e6a
mov eax, dword [esp + 0x4c]
cmp eax, esi
je 0x494e6a
mov dword [eax], 0x102
jmp 0x494e6a
mov edi, dword [esp + 0x20]
xor esi, esi
mov ecx, ebp
call fcn.004949b0
test eax, eax
jne 0x494e88
cmp ebp, esi
je 0x494e88
push ebp
call fcn.004948b0
push ebp
call fcn.004a3142
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x1c], esi
je 0x494d89
cmp dword [ebx + 0x1c], esi
je 0x494d89
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret