Function at 0x49c0da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5760c2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5c31c8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x328], 0
je 0x49c462
xor ebx, ebx
cmp dword [edi + 0x32c], 4
je 0x49c23b
mov dword [edi + 0x32c], 4
cmp dword [edi + 0x594], ebx
je 0x49c195
push dword [edi + 0x244]
push dword [edi + 0x240]
call fcn.0049dfd4
lea esi, [edi + 0x570]
mov ecx, esi
call fcn.005383c0
mov ecx, dword [edi + 0x5f8]
mov eax, dword [edi + 0x240]
mov dword [edi + 0x488], eax
mov eax, dword [edi + 0x244]
mov dword [edi + 0x4d0], ebx
mov dword [edi + 0x4d4], ebx
mov dword [edi + 0x48c], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 8], eax
or dword [ecx + 0x18], 0xffffffff
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
mov ecx, esi
call fcn.005383d0
mov ecx, edi
call fcn.0049af80
mov ecx, dword [edi + 0x58c]
push edi
call fcn.00483540
push 8
mov byte [edi + 0x59c], bl
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x49c1c2
mov dword [eax], edi
mov dword [eax + 4], ebx
jmp 0x49c1c4
mov eax, ebx
push ebx
push ebx
mov dword [edi + 0x598], eax
mov esi, dword [edi + 0x598]
push esi
push 0x4a7dce
push ebx
push ebx
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x49c1ec
mov dword [esi + 4], eax
jmp 0x49c22e
mov eax, dword [edi + 0x598]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
je 0x49c20e
push ecx
mov ecx, dword [esp + 0x14]
call fcn.0049c475
push str.Hashhashhash
mov dword [edi + 0x598], ebx
push edi
mov byte [edi + 0x59c], bl
call fcn.0049acc8
pop ecx
pop ecx
mov ecx, edi
call fcn.0049e371
cmp dword [edi + 0x32c], 4
jne 0x49c462
cmp dword [edi + 0x598], ebx
jne 0x49c462
cmp dword [edi + 0x594], ebx
je 0x49c264
mov ecx, dword [edi + 0x594]
mov dword [edi + 0x594], ebx
test ecx, ecx
je 0x49c264
call fcn.004a148a
mov ecx, edi
call fcn.0049f48c
cmp byte [edi + 0x59c], bl
je 0x49c37f
mov dword [edi + 0x330], ebx
xor eax, eax
xor ebx, ebx
mov dword [edi + 0x32c], 6
inc ebx
mov byte [edi + 0x381], al
mov byte [edi + 0x380], bl
cmp dword [edi + 0x5c8], eax
je 0x49c34d
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
lea esi, [edi + 0x5ac]
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.004a8404
mov ecx, esi
call fcn.0045a206
mov dword [edi + 0x5a8], 0x32
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
cmove eax, ebx
mov dword [edi + 0x5a4], eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
and dword [edi + 0x5ec], 0
sar eax, 4
test eax, eax
je 0x49c33d
sub esp, 0xc
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0043251f
sub esp, 0x18
mov byte [esp + 0x54], bl
lea eax, [edi + 0x258]
mov ecx, esp
push eax
lea eax, [edi + 0x248]
push eax
call fcn.0042e705
lea ecx, [edi + 0x5b8]
mov byte [esp + 0x54], 0
call fcn.004a1227
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00408f76
xor eax, eax
push eax
mov ecx, edi
call fcn.0049ed36
mov ecx, edi
call fcn.0049e302
push ecx
mov ecx, edi
call fcn.0049edef
push 0x593614
push edi
call fcn.0049acc8
pop ecx
pop ecx
mov ecx, dword [edi + 0x58c]
push edi
call fcn.00483540
jmp 0x49c3f5
push ebx
push ebx
mov ecx, edi
mov dword [edi + 0x330], 4
call fcn.0049edbc
mov ecx, edi
call fcn.0049f48c
mov byte [edi + 0x328], bl
xor ebx, ebx
inc ebx
cmp dword [edi + 0x3c8], 0xff
mov byte [edi + 0x5f6], bl
je 0x49c3bb
and dword [edi + 0x3c8], 0
dec dword [edi + 0x698]
cmp dword [edi + 0x698], 0
jg 0x49c3fe
mov ecx, edi
mov dword [edi + 0x32c], 5
mov byte [edi + 0x380], bl
mov byte [edi + 0x381], 0
call fcn.0049e302
push 0x593588
push edi
call fcn.0049acc8
pop ecx
pop ecx
mov ecx, edi
call fcn.0049e550
jmp 0x49c462
push 0x5935ac
push edi
call fcn.0049acc8
push dword [edi + 0x2c0]
xor ebx, ebx
mov dword [edi + 0x32c], 2
push ebx
push dword [edi + 0x2b8]
call sub.MSVCR120.dll_memset
or dword [edi + 0x2c8], 0xffffffff
add esp, 0x14
or dword [edi + 0x2cc], 0xffffffff
mov dword [edi + 0x488], ebx
mov dword [edi + 0x48c], ebx
mov dword [edi + 0x490], ebx
mov dword [edi + 0x494], ebx
mov dword [edi + 0x15c], ebx
mov dword [edi + 0x174], ebx
mov dword [edi + 0x170], ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret