Function at 0x4288e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x47afd0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
jbe 0x428919
call dword [0x47c2fc]
mov ebp, dword [edi]
mov ebx, esi
lea ecx, [ecx]
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x42892e
call dword [0x47c2fc]
mov eax, dword [edi]
test ebp, ebp
je 0x428938
cmp ebp, eax
je 0x42893e
call dword [0x47c2fc]
cmp ebx, esi
je 0x428a0e
test ebp, ebp
jne 0x4289ef
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x428961
call dword [0x47c2fc]
cmp dword [ebx + 4], 0
je 0x4289d0
test ebp, ebp
jne 0x4289f7
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x428982
call dword [0x47c2fc]
mov eax, dword [ebx + 4]
cmp dword [eax + 0x90], 0
je 0x4289d0
test ebp, ebp
jne 0x4289ff
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4289a5
call dword [0x47c2fc]
mov edi, dword [ebx + 4]
call fcn.00455e40
test ebp, ebp
jne 0x428a04
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4289c4
call dword [0x47c2fc]
mov esi, dword [ebx + 4]
call fcn.0045b410
mov edi, dword [esp + 0x5c]
test ebp, ebp
jne 0x428a09
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4289e7
call dword [0x47c2fc]
add ebx, 0xc
jmp 0x428920
mov eax, dword [ebp]
jmp 0x428956
mov eax, dword [ebp]
jmp 0x428977
mov eax, dword [ebp]
jmp 0x42899a
mov eax, dword [ebp]
jmp 0x4289b9
mov eax, dword [ebp]
jmp 0x4289dc
push 4
call fcn.0047286a
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x428a26
lea edx, [esp + 0x30]
mov dword [eax], edx
jmp 0x428a28
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x54], 1
mov esi, dword [edi + 0xc]
mov dword [esp + 0x18], ecx
cmp esi, dword [edi + 0x10]
jbe 0x428a52
call dword [0x47c2fc]
mov ebp, dword [edi]
mov dword [esp + 0x20], ebp
mov ebx, esi
lea ebx, [ebx]
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x428a6e
call dword [0x47c2fc]
mov eax, dword [edi]
test ebp, ebp
je 0x428a78
cmp ebp, eax
je 0x428a7e
call dword [0x47c2fc]
cmp ebx, esi
je 0x428c15
test ebp, ebp
jne 0x428b7d
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x428aa1
call dword [0x47c2fc]
cmp dword [ebx + 4], 0
je 0x428bf1
test ebp, ebp
jne 0x428b85
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x428ac6
call dword [0x47c2fc]
mov eax, dword [ebx + 4]
cmp dword [eax + 0x90], 0
je 0x428bf1
cmp dword [esp + 0x18], 0
jne 0x428b39
cmp dword [edi + 0x38], 0
je 0x428b31
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
jbe 0x428af1
call dword [0x47c2fc]
mov eax, dword [edi]
test ebp, ebp
je 0x428afb
cmp ebp, eax
je 0x428b01
call dword [0x47c2fc]
mov ecx, dword [edi + 0x3c]
push ecx
mov ecx, ebx
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [edi + 0x38]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push 0xa
call ecx
cmp eax, 0xffffffff
jne 0x428b31
mov edx, dword [edi + 0x48]
cmp edx, eax
je 0x428c15
mov dword [esp + 0x18], 1
test ebp, ebp
jne 0x428b8d
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x428b50
call dword [0x47c2fc]
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx*4 + 0x482578]
push 0
push 0
push eax
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x428b92
xor edx, edx
jmp 0x428b9b
mov eax, dword [ebp]
jmp 0x428a96
mov eax, dword [ebp]
jmp 0x428abb
mov eax, dword [ebp]
jmp 0x428b45
mov edx, dword [esp + 0x44]
sub edx, esi
sar edx, 2
mov ecx, dword [esp + 0x40]
mov ebp, ecx
sub ebp, esi
sar ebp, 2
cmp ebp, edx
jae 0x428bc4
mov dword [ecx], eax
add ecx, 4
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x40], ecx
jmp 0x428bed
mov edi, ecx
cmp esi, ecx
jbe 0x428bd0
call dword [0x47c2fc]
mov eax, dword [esp + 0x30]
push edi
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
push ecx
lea eax, [esp + 0x40]
call fcn.0042d580
mov edi, dword [esp + 0x5c]
mov ebp, dword [esp + 0x20]
test ebp, ebp
jne 0x428c10
call dword [0x47c2fc]
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x428c08
call dword [0x47c2fc]
add ebx, 0xc
jmp 0x428a60
mov eax, dword [ebp]
jmp 0x428bfd
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
test eax, eax
jbe 0x428cb3
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
push 0xffffffffffffffff
push 1
sub eax, ecx
push ecx
sar eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
cmp esi, eax
jbe 0x428c57
call dword [0x47c2fc]
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x30]
mov ebx, dword [0x47c2fc]
mov ebp, eax
cmp dword [esp + 0x3c], eax
jbe 0x428c6b
call ebx
test edi, edi
je 0x428c75
cmp edi, dword [esp + 0x30]
je 0x428c77
call ebx
cmp esi, ebp
je 0x428cb3
test edi, edi
jne 0x428cab
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x428c8a
call ebx
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x428caf
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x428ca2
call ebx
mov eax, dword [esp + 0x40]
add esi, 4
jmp 0x428c61
mov eax, dword [edi]
jmp 0x428c83
mov eax, dword [edi]
jmp 0x428c9b
mov edi, dword [esp + 0x5c]
lea esi, [edi + 0x18]
push esi
call fcn.00426dc0
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
mov dword [edi + 0x40], 0xffffffff
call edx
mov eax, dword [esp + 0x3c]
xor esi, esi
cmp eax, esi
je 0x428ce3
push eax
call fcn.0047284c
add esp, 4
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call fcn.0047284c
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 4