Function at 0x41fce0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x290
push ebx
push ebp
push esi
mov esi, dword [0x492438]
push edi
mov edi, dword [0x49243c]
xor ecx, ecx
mov byte [eax + 0x16c028], 1
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0xc8
mov ecx, 0x32
mov esi, 0x174a840
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00409f50
add esp, 0xd8
call fcn.0041c670
mov edi, dword [0x47f0d4]
mov ebx, dword [0x47f0d8]
mov ebp, dword [0x47f084]
mov esi, 9
test esi, esi
je 0x41fd9a
mov ecx, dword [esi*4 + 0x103f93c]
push 0
push ecx
call edi
test eax, eax
jne 0x41fd92
mov edx, dword [esi*4 + 0x103f93c]
push edx
call ebx
mov eax, dword [esi*4 + 0x11adaf0]
push 0x2710
push eax
call edi
mov ecx, dword [esi*4 + 0x11adaf0]
push ecx
call ebp
mov dword [esi*4 + 0x11adaf0], 0
push 0xa
call dword [0x47f0b8]
sub esi, 1
test esi, esi
jg 0x41fd54
cmp dword [0x4adc10], 0
mov dword [esp + 0x10], 0
jle 0x41fe81
mov ebp, dword [esp + 0x2a8]
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x2a8]
add ebp, 0x798ac
sub eax, ecx
lea ebx, [ecx + 0x79808]
mov dword [esp + 0x14], eax
lea ecx, [ecx]
push ebx
call fcn.00408eb0
mov edx, dword [0x17447b8]
mov eax, dword [ebp + 4]
add esp, 4
push edx
mov edx, dword [ebp - 4]
sub esp, 0x1b0
mov edi, esp
push eax
mov ecx, 0x6c
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp]
push ecx
mov ecx, dword [ebp - 0x7c]
push edx
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x9c]
push edx
mov edx, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x94]
push ecx
push edx
push eax
lea ecx, [esp + 0x2cc]
push ecx
call fcn.0040dad0
mov edx, dword [esp + 0x1f4]
mov esi, eax
mov eax, dword [esp + 0x1f0]
lea edi, [edx + ebx]
mov ecx, 0x6c
add eax, 1
add esp, 0x1e0
rep movsd dword es:[edi], dword [esi]
add ebx, 0x1b0
add ebp, 0x1b0
cmp eax, dword [0x4adc10]
mov dword [esp + 0x10], eax
jl 0x41fde0
mov eax, dword [esp + 0x2a8]
mov edi, dword [esp + 0x2a4]
push 0x16c160
push eax
push edi
call fcn.004014b0
push 1
call fcn.0042ef80
mov ecx, dword [0x492448]
mov edx, dword [0x49244c]
mov eax, dword [0x49243c]
add edx, ecx
mov ecx, dword [0x492438]
add esp, 0x10
cmp edx, 1
mov dword [esp + 0x10], 1
jle 0x41ff9a
mov ebp, 0x1744878
lea ebx, [edi + 0xa71c4]
lea ebx, [ebx]
imul eax, ecx
cmp dword [0xff4b0c], 1
push eax
jne 0x41fefb
mov eax, dword [ebp + 0x88]
push eax
call fcn.004015e0
jmp 0x41ff07
mov ecx, dword [ebp + 0x88]
push ecx
call fcn.004015a0
add esp, 8
cmp byte [ebx], 0
je 0x41ff4c
sub esp, 0xc8
mov edi, esp
lea edx, [esp + 0xf0]
push ebx
mov ecx, 0x32
mov esi, ebp
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0044f260
mov esi, eax
mov eax, dword [0x49243c]
mov ecx, 0x32
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x492438]
add esp, 0xd0
jmp 0x41ff69
mov ecx, dword [0x492438]
mov eax, dword [0x49243c]
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x90], ecx
mov dword [ebp + 0x94], eax
mov edx, dword [esp + 0x10]
mov esi, dword [0x492448]
mov edi, dword [0x49244c]
add edx, 1
add edi, esi
add ebx, 0x40
add ebp, 0xc8
cmp edx, edi
mov dword [esp + 0x10], edx
jl 0x41fee0
mov edi, dword [esp + 0x2a4]
mov esi, 0x174a730
jmp 0x41ffac
mov ecx, dword [0x492438]
mov eax, dword [0x49243c]
imul eax, ecx
cmp dword [0xff4b0c], 1
push eax
jne 0x41ffc3
mov eax, dword [esi]
push eax
call fcn.004015e0
jmp 0x41ffcb
mov ecx, dword [esi]
push ecx
call fcn.004015a0
add esi, 0xc8
add esp, 8
cmp esi, 0x174a8c0
jl 0x41ffa1
xor ebx, ebx
cmp dword [0x6999d0], ebx
jle 0x4200cd
lea ebp, [edi + 0xa8b26]
cmp byte [ebp - 0x1e], 1
jne 0x4200b1
mov esi, dword [0x492438]
mov edi, dword [0x49243c]
xor ecx, ecx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
movzx esi, word [ebp - 0x46]
imul esi, esi, 0xc8
mov dword [eax + 0xc], edi
sub esp, 0xc8
add esi, 0x17447b0
mov ecx, 0x32
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00409f50
movzx edx, byte [ebp]
add esp, 0xd8
push edx
lea eax, [ebp + 1]
push eax
call fcn.0042f270
movzx ecx, word [ebp - 2]
mov edx, dword [ebp - 6]
movzx esi, word [ebp - 0x46]
add esp, 4
imul esi, esi, 0xc8
push eax
mov eax, dword [ebp - 0xa]
push ecx
mov ecx, dword [ebp - 0x1a]
push edx
mov edx, dword [ebp - 0x16]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x12]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xe]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
sub esp, 0xc8
lea eax, [esp + 0x104]
mov edi, esp
add esi, 0x17447b0
mov ecx, 0x32
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040c950
add esp, 0xf0
add ebx, 1
add ebp, 0x14c
cmp ebx, dword [0x6999d0]
jl 0x41fff0
mov edi, dword [esp + 0x2a4]
mov ebp, 0x174aa50
lea ebx, [edi + 0x1609ad]
jmp 0x4200e0
cmp dword [0xff4b0c], 1
jne 0x420105
mov ecx, dword [0x49243c]
imul ecx, dword [0x492438]
mov edx, dword [ebp + 0x88]
push ecx
push edx
call fcn.004015e0
jmp 0x42011e
mov eax, dword [0x49243c]
imul eax, dword [0x492438]
mov ecx, dword [ebp + 0x88]
push eax
push ecx
call fcn.004015a0
add esp, 8
cmp byte [ebx], 0
je 0x420156
sub esp, 0xc8
mov edi, esp
lea edx, [esp + 0xf0]
push ebx
mov ecx, 0x32
mov esi, ebp
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0044f260
mov ecx, 0x32
mov esi, eax
mov edi, ebp
add esp, 0xd0
rep movsd dword es:[edi], dword [esi]
add ebp, 0xc8
add ebx, 0x20
cmp ebp, 0x174b090
jl 0x4200e0
mov esi, 2
mov eax, dword [0xff4af4]
push eax
push 0
push 0
push esi
push 4
push 0x480868
call fcn.0044cd10
add esi, 1
add esp, 0x18
cmp esi, 7
jl 0x420170
cmp dword [0xff4af0], 1
jne 0x42026d
mov edi, dword [esp + 0x2a4]
xor esi, esi
lea ebp, [edi + 0x160734]
add edi, 0x16095c
jmp 0x4201c0
mov ebx, dword [esp + 0x2a4]
mov al, byte [ebx + esi + 0x160934]
cmp al, 2
je 0x4201ec
cmp al, 7
je 0x4201ec
mov ecx, dword [0xff4af4]
mov edx, dword [edi]
push ecx
push 0
push edx
push esi
push 4
push 0x480868
jmp 0x4201fb
mov eax, dword [0xff4af4]
mov ecx, dword [edi]
push eax
push 0
push ecx
push esi
push 2
push ebp
call fcn.0044cd10
add esi, 1
add esp, 0x18
add edi, 4
add ebp, 0x40
cmp esi, 2
jl 0x4201c0
mov esi, 2
lea ebp, [ebx + 0x1607b4]
lea edi, [ebx + 0x160964]
mov al, byte [ebx + esi + 0x160934]
cmp al, 2
je 0x420247
cmp al, 7
je 0x420247
mov edx, dword [0xff4af4]
mov eax, dword [edi]
push edx
push 0
push eax
push esi
push 4
push 0x480868
jmp 0x420257
mov ecx, dword [0xff4af8]
mov edx, dword [edi]
push ecx
push 0
push edx
push esi
push 2
push ebp
call fcn.0044cd10
add esi, 1
add esp, 0x18
add edi, 4
add ebp, 0x40
cmp esi, 6
jl 0x420222
push 1
sub esp, 0xc8
mov ecx, 0x32
mov esi, 0x1744878
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004414b0
mov esi, dword [esp + 0x370]
mov ebx, dword [0x47f0e4]
add esp, 0xcc
xor edi, edi
mov ebp, 0xa6fda0
add esi, 0x130578
jmp 0x4202b0
cmp byte [esi - 0x100c], 1
jne 0x420375
push edi
push ebp
push esi
call fcn.00420b70
mov eax, dword [esi - 4]
xor ecx, ecx
add esp, 0xc
cmp edi, ecx
mov dword [esi - 0x1008], eax
je 0x420375
or eax, 0xffffffff
mov dword [esi + 0x40], ecx
mov dword [esi + 0xc4], ecx
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
lea edx, [edi*4 + 0x86a5e8]
push edx
mov dword [esi + 0xac], eax
push ecx
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
push edi
mov dword [esi + 0xb8], eax
push 0x421620
mov dword [esi + 0xbc], eax
push ecx
mov dword [esi + 0xc0], eax
push ecx
mov dword [esi - 0x1008], ecx
mov dword [esi - 4], ecx
call fcn.0045e213
add esp, 0x18
push 0
push eax
mov dword [edi*4 + 0x11adaf0], eax
call ebx
add ebp, 0x7a120
add edi, 1
add esi, 0x4e94
cmp ebp, 0xf348e0
jl 0x4202b0
call fcn.00438ac0
mov eax, dword [esp + 0x2a4]
xor ecx, ecx
mov dword [eax + 0x16c054], ecx
mov dword [eax + 0x16c058], 1
mov dword [eax + 0x16c05c], ecx
call fcn.0041c670
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x290
ret