Function at 0x4385f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4385fc
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x438a65
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call fcn.00434b54
xor eax, eax
mov dword [0x446134], eax
call fcn.00402a28
mov edi, 3
mov eax, edi
call fcn.00403134
mov edi, eax
sub edi, 1
jb 0x438647
je 0x438661
dec edi
je 0x43867b
dec edi
je 0x438695
jmp 0x4386ad
lea eax, [ebp - 0x20]
mov edx, 0x443df1
call fcn.00404d9c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00434ad4
jmp 0x4386ad
lea eax, [ebp - 0x24]
mov edx, 0x443e46
call fcn.00404d9c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 8]
call fcn.00434ad4
jmp 0x4386ad
lea eax, [ebp - 0x28]
mov edx, 0x443e9b
call fcn.00404d9c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 8]
call fcn.00434ad4
jmp 0x4386ad
lea eax, [ebp - 0x2c]
mov edx, 0x443df1
call fcn.00404d9c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 8]
call fcn.00434ad4
xor ebx, ebx
mov esi, 4
mov edi, 3
mov eax, edi
call fcn.00403134
push 2
call sub.kernel32.dll_Sleep
mov edi, 3
mov eax, edi
call fcn.00403134
mov edi, eax
mov eax, edi
sub eax, 1
jb 0x4386f5
je 0x438780
dec eax
je 0x4387b6
dec eax
je 0x438810
jmp 0x438841
test bl, bl
jne 0x438723
mov bl, 1
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
jmp 0x438841
mov eax, edi
call fcn.00403134
mov edi, eax
lea eax, [ebp - 0x134]
mov edx, edi
shl edx, 4
add edx, edi
add edx, 0x443d9c
call fcn.00404d9c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00434ad4
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
jmp 0x438841
lea eax, [ebp - 0x138]
call fcn.004384c8
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x12c]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
jmp 0x438841
mov eax, edi
call fcn.00403134
mov edi, eax
lea eax, [ebp - 0x140]
mov edx, edi
shl edx, 4
add edx, edi
add edx, 0x443d9c
call fcn.00404d9c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00434ad4
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x12c]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
jmp 0x438841
lea eax, [ebp - 0x144]
call fcn.004384c8
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x12c]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
push 0x541
call sub.kernel32.dll_Sleep
mov eax, 0x446138
lea edx, [ebp - 0x1a]
call fcn.00404d9c
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x436918
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push 0xfa
call sub.kernel32.dll_Sleep
dec esi
test esi, esi
jne 0x4386b4
test bl, bl
jne 0x4388aa
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
jmp 0x4388db
lea eax, [ebp - 0x148]
call fcn.004384c8
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x12c]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
mov eax, 0x446138
lea edx, [ebp - 0x1a]
call fcn.00404d9c
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x436918
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push 0x251c
call sub.kernel32.dll_Sleep
cmp byte [ebp - 9], 0
je 0x438981
lea eax, [ebp - 0x14c]
mov edx, 0x443f67
call fcn.00404d9c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 8]
call fcn.00434ad4
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404dd4
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x1a]
mov cl, 0x10
call fcn.00402f98
mov eax, 0x446138
lea edx, [ebp - 0x1a]
call fcn.00404d9c
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x436918
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x438a32
cmp dword [0x446134], 0
jne 0x438a32
mov edi, 3
mov eax, edi
call fcn.00403134
mov edi, eax
sub edi, 1
jb 0x4389ab
je 0x4389cb
dec edi
je 0x4389eb
dec edi
je 0x438a0b
jmp 0x438a29
lea eax, [ebp - 0x150]
mov edx, 0x443f45
call fcn.00404d9c
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 8]
call fcn.00434ad4
jmp 0x438a29
lea eax, [ebp - 0x154]
mov edx, 0x443f45
call fcn.00404d9c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00434ad4
jmp 0x438a29
lea eax, [ebp - 0x158]
mov edx, 0x443f56
call fcn.00404d9c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 8]
call fcn.00434ad4
jmp 0x438a29
lea eax, [ebp - 0x15c]
mov edx, 0x443f56
call fcn.00404d9c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00434ad4
mov byte [ebp - 9], 1
jmp 0x4386ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438a6c
lea eax, [ebp - 0x15c]
mov edx, 0xc
call fcn.00404b64
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00404b64
lea eax, [ebp - 8]
call fcn.00404b40
ret