Function at 0x4086b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xc54]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x6c]
push eax
call edx
mov dword [esi + 0xcec], 0
test eax, eax
jne 0x401474
mov esi, dword [esi + 0xc5c]
mov eax, dword [esi]
mov ecx, dword [eax + 0x6c]
push esi
call ecx
neg eax
sbb eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
push ecx
push ebx
push ebp
mov ebp, dword [0x4600c4]
push esi
push edi
call fcn.00401480
test eax, eax
je 0x408964
cmp byte [ebp + 0x2a], 0
je 0x408a4c
movzx eax, word [ebp + 0x26]
cmp ax, 5
jge 0x40896a
mov ebx, 2
cmp ax, 1
jne 0x4087ff
mov eax, ebx
mov word [ebp + 0x26], ax
mov eax, dword [0x460010]
mov ecx, dword [eax + 0x330]
lea edi, [eax + 0x3b8]
mov byte [eax + 0x33c], 1
mov esi, eax
mov eax, dword [edi]
cmp dword [eax + 4], ebx
jle 0x408742
mov edx, dword [eax + 0xc]
cmp dword [edx + 8], 0
je 0x408742
test ecx, ecx
jl 0x408727
xor ecx, ecx
jmp 0x408734
cmp ecx, 0xffffd8f0
jg 0x408734
mov ecx, 0xffffd8f0
mov eax, edx
mov eax, dword [eax + 8]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x3c]
call eax
mov eax, dword [esi + 0x32c]
test eax, eax
jle 0x408769
mov ecx, dword [edi]
cmp eax, dword [ecx + 4]
jge 0x408769
mov edx, dword [ecx + 0xc]
cmp dword [edx + eax*4], 0
je 0x408769
mov ecx, edx
mov eax, dword [ecx + eax*4]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x48]
call eax
cmp byte [esi + 0x324], 0
mov dword [esi + 0x32c], 0
mov dword [esi + 0x338], ebx
mov dword [esi + 0x334], 0x1b206
jne 0x408908
mov eax, dword [edi]
cmp dword [eax + 4], ebx
jle 0x4087bf
mov ecx, dword [eax + 0xc]
cmp dword [ecx + 8], 0
je 0x4087bf
mov edx, ecx
mov eax, dword [edx + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0x10]
and eax, 4
jne 0x408908
mov esi, dword [edi]
cmp dword [esi + 4], ebx
jle 0x408908
mov ecx, dword [esi + 0xc]
cmp dword [ecx + 8], 0
je 0x408908
mov edx, ecx
mov eax, dword [edx + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x34]
push 0
push eax
call edx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push 1
push 0
push 0
push eax
call edx
jmp 0x408908
cmp ax, bx
jne 0x40880f
xor eax, eax
mov word [ebp + 0x26], ax
jmp 0x408908
test ax, ax
jne 0x4088a8
mov eax, dword [0x46003c]
mov ecx, dword [eax + 0xcdc]
mov esi, dword [eax + 0xce0]
mov edx, dword [ebp + 0x30]
mov dword [edx + 0x3d0], esi
sar ecx, 1
mov dword [edx + 0x3d4], ecx
mov ecx, dword [eax + 0xcdc]
mov esi, dword [eax + 0xce0]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x3d0], esi
sar ecx, 1
mov dword [edx + 0x3d4], ecx
mov ecx, dword [eax + 0xcdc]
mov edx, dword [ebp + 0x38]
mov esi, dword [eax + 0xce0]
mov dword [edx + 0x3d0], esi
sar ecx, 1
mov dword [edx + 0x3d4], ecx
mov ecx, dword [eax + 0xcdc]
mov edx, dword [ebp + 0x3c]
mov eax, dword [eax + 0xce0]
push ebp
sar ecx, 1
push 0
push 0x4091c0
mov dword [edx + 0x3d0], eax
mov dword [edx + 0x3d4], ecx
call fcn.0043bee2
add esp, 0xc
mov ecx, 3
jmp 0x408904
cmp ax, 3
jne 0x4088f9
mov ecx, ebp
call fcn.00407f20
mov eax, ebx
call fcn.004317d0
mov eax, dword [0x460010]
mov edx, 5
mov word [ebp + 0x26], dx
mov dword [eax + 0x32c], ebx
cmp dword [eax + 0x328], ebx
jne 0x4088e2
mov dword [eax + 0x328], 0
mov eax, dword [0x460ab0]
push 0
push 0
push 0x404
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x408908
cmp ax, 4
jne 0x408908
mov ecx, 5
mov word [ebp + 0x26], cx
mov edx, dword [0x46003c]
mov eax, dword [edx + 0xc5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push 0
push eax
call edx
cmp word [ebp + 0x26], bx
je 0x408964
mov ecx, dword [0x46003c]
mov eax, dword [ecx + 0xc58]
mov ecx, dword [ecx + 0xc5c]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
push 0
push 0x45e8b8
push ecx
push 0
push 0
push eax
call edx
mov eax, dword [0x46003c]
mov eax, dword [eax + 0xc54]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0
push 0
push eax
call edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [0x46003c]
mov eax, dword [esi + 0xcdc]
mov ecx, dword [esi + 0xce0]
call fcn.0040aa80
mov eax, dword [esi + 0xcdc]
mov edx, dword [esi + 0xce0]
call fcn.00431cd0
mov eax, dword [esi + 0xcdc]
mov ecx, dword [esi + 0xce0]
call fcn.0042a2b0
mov eax, dword [esi + 0xcdc]
mov ecx, dword [esi + 0xce0]
call fcn.00422530
mov eax, dword [esi + 0xcdc]
mov edx, dword [esi + 0xce0]
call fcn.0041f470
mov eax, dword [esi + 0xcdc]
mov edx, dword [esi + 0xce0]
mov ecx, dword [ebp + 0x10]
sar eax, 1
mov dword [ecx + 0x3d0], edx
mov dword [ecx + 0x3d4], eax
mov eax, dword [esi + 0xcdc]
mov edx, dword [esi + 0xce0]
call fcn.00427930
mov ecx, dword [esi + 0xcdc]
mov edx, dword [esi + 0xce0]
call fcn.0040de80
mov eax, dword [esi + 0xcdc]
mov ecx, dword [esi + 0xce0]
call fcn.0041cad0
mov eax, dword [esi + 0xcdc]
mov ecx, dword [esi + 0xce0]
call fcn.00419d40
mov eax, dword [esi + 0xcdc]
mov edx, dword [esi + 0xce0]
call fcn.004292f0
mov eax, dword [esi + 0xcdc]
mov ecx, dword [esi + 0xce0]
call fcn.0041fbf0
mov byte [ebp + 0x2a], 0
mov eax, dword [0x460024]
cmp byte [eax + 0x350], 0
je 0x408a63
cmp dword [eax + 0x354], 0
jg 0x408acc
mov eax, dword [0x460008]
cmp byte [eax + 0x680], 0
je 0x408a81
mov eax, dword [eax + 0x688]
cmp eax, 2
jl 0x408a81
cmp eax, 0x11
jl 0x408acc
call fcn.00424c20
test al, al
jne 0x408acc
call fcn.0040d750
call fcn.0040dcb0
call fcn.0041f760
call fcn.00430bf0
call fcn.0040ffe0
call fcn.00433370
mov eax, dword [0x46000c]
mov eax, dword [eax + 0x458]
cmp eax, 0x1b
je 0x408abd
cmp eax, 0x12
jne 0x408ac2
call fcn.00430b80
call fcn.00430e70
call fcn.00433440
call fcn.00421b80
call fcn.0041f800
call fcn.0041c6a0
call fcn.0041f1d0
call fcn.0041f050
call fcn.00426fe0
call fcn.00429540
call fcn.00430800
mov ecx, dword [0x460024]
mov ebx, 1
cmp dword [ecx + 0x354], ebx
jne 0x408b0c
call fcn.00430b80
mov eax, dword [0x462ae8]
xor edi, edi
cmp eax, edi
jle 0x408b44
push eax
lea esi, [edi + 5]
call fcn.004317f0
add esp, 4
test eax, eax
je 0x408b2f
mov dword [0x462ae8], edi
jmp 0x408b44
cmp dword [0x463334], edi
jne 0x408b3e
call fcn.00409150
jmp 0x408b44
mov dword [0x463334], edi
cmp byte [0x462769], 0
jne 0x408c86
mov eax, dword [0x46000c]
cmp byte [eax + 0x3d4], 0
jne case.0x408ca2.2
cmp dword [0x462ac0], edi
jne 0x408c45
cmp dword [0x462acc], edi
jne 0x408c45
mov edx, dword [0x45fff8]
cmp byte [edx + 0x338], 0
jne 0x408c45
mov edi, dword [ebp + 0x10]
cmp word [edi + 0x40a], 0
jne 0x408bfa
cmp dword [edi + 0x3e0], 0
jg 0x408bab
mov ecx, 0xffffffce
jmp 0x408bb7
mov eax, dword [edi + 0x3e4]
mov ecx, dword [eax]
movzx ecx, word [ecx + 4]
mov eax, 0x300
sub eax, ecx
cdq
push 0
push ebx
sub eax, edx
sar eax, 1
push 0x3b6
push eax
xor ebx, ebx
mov eax, edi
call fcn.00405740
mov edi, dword [ebp + 0x10]
push 0x7d0
lea esi, [ebx + 4]
call fcn.00401cb0
test eax, eax
je 0x408c19
mov edx, dword [ebp + 0x10]
mov eax, 1
mov word [edx + 0x40a], ax
jmp 0x408c19
push 0x1f4
mov esi, 4
call fcn.00401cb0
test eax, eax
je 0x408c19
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov word [ecx + 0x40a], dx
mov edi, dword [ebp + 0x10]
push 0x7530
mov esi, 2
call fcn.00401cb0
test eax, eax
je case.0x408ca2.2
mov eax, dword [0x46000c]
push 1
push eax
call fcn.00415d90
jmp case.0x408ca2.2
cmp dword [eax + 0x458], ebx
ja case.0x408ca2.2
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x3e0], ebx
jg 0x408c6d
push edi
push ebx
mov edx, 0xffffffce
push 0x3bb
jmp 0x408dfd
mov edx, dword [ecx + 0x3e4]
mov eax, dword [edx + 4]
movzx edx, word [eax + 4]
push edi
push ebx
push 0x3bb
jmp 0x408dfd
mov ecx, dword [0x46000c]
mov eax, dword [ecx + 0x458]
cmp eax, 0x31
ja case.0x408ca2.2
movzx edx, byte [eax + 0x408f7c]
jmp dword [edx*4 + 0x408f68]
cmp byte [ecx + 0x3d4], 0
jne case.0x408ca2.2
mov eax, dword [0x46002c]
cmp byte [eax + 0x334], 0
jne case.0x408ca2.2
mov ecx, dword [0x45fff8]
mov al, byte [ecx + 0x338]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x3e0], ebx
jg 0x408ce6
mov edx, 0xffffffce
jmp 0x408cf3
mov edx, dword [ecx + 0x3e4]
mov edx, dword [edx + 4]
movzx edx, word [edx + 4]
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x22b
add eax, 0x190
push edi
push ebx
push eax
mov eax, 0x300
sub eax, edx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, ecx
call fcn.00405740
mov edi, dword [ebp + 0x10]
push 0x12c
mov esi, ebx
call fcn.00401cb0
test eax, eax
je case.0x408ca2.2
mov eax, dword [ebp + 0x10]
inc word [eax + 0x40c]
mov eax, dword [ebp + 0x10]
cmp word [eax + 0x40c], 3
jle case.0x408ca2.2
mov ecx, ebx
mov word [eax + 0x40c], cx
jmp case.0x408ca2.2
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x3e0], 2
jg 0x408d6e
mov edx, 0xffffffce
jmp 0x408d7b
mov edx, dword [ecx + 0x3e4]
mov eax, dword [edx + 8]
movzx edx, word [eax + 4]
mov eax, 0x300
sub eax, edx
cdq
push edi
push ebx
sub eax, edx
sar eax, 1
push 0x41a
push eax
mov ebx, 2
mov eax, ecx
call fcn.00405740
mov edi, dword [ebp + 0x10]
push 0x12c
lea esi, [ebx - 1]
call fcn.00401cb0
test eax, eax
je case.0x408ca2.2
mov eax, dword [ebp + 0x10]
inc word [eax + 0x40c]
mov eax, dword [ebp + 0x10]
cmp word [eax + 0x40c], 3
jle case.0x408ca2.2
mov ecx, esi
mov word [eax + 0x40c], cx
jmp case.0x408ca2.2
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x3e0], 2
jg 0x408de4
mov edx, 0xffffffce
jmp 0x408df1
mov edx, dword [ecx + 0x3e4]
mov eax, dword [edx + 8]
movzx edx, word [eax + 4]
push edi
push ebx
push 0x41a
mov ebx, 3
mov eax, 0x300
sub eax, edx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, ecx
call fcn.00405740
cmp byte [0x462744], 0
je 0x408e39
mov eax, dword [ebp + 0x14]
mov edx, 0xa
call fcn.00407830
mov eax, dword [ebp + 0x14]
push 0
push 1
push 0
push 0
xor ebx, ebx
call fcn.00405740
cmp byte [0x460cdf], 0
je 0x408e81
mov edi, dword [ebp + 0x14]
push 0x3e8
xor esi, esi
call fcn.00401cb0
test eax, eax
je 0x408e5b
inc dword [0x463330]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [0x463330]
cmp ecx, eax
jl 0x408e81
add eax, 0xa
cmp ecx, eax
mov dword [0x460f10], 0xe
jl 0x408e81
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [0x462ae0], 0
jle 0x408e9c
mov eax, dword [ebp + 0x14]
mov edx, 0xa
call fcn.00407830
call fcn.00428be0
cmp word [ebp + 0x26], 5
jne 0x408eed
mov eax, dword [ebp + 0x30]
movzx ecx, word [eax + 0x408]
push ecx
push 0
push 0
xor ebx, ebx
call fcn.00404f70
mov edx, dword [ebp + 0x30]
movsx eax, word [edx + 0x408]
mov esi, dword [ebp + 0x3c]
push eax
push ebx
call fcn.004051c0
mov eax, dword [ebp + 0x30]
inc word [eax + 0x408]
mov ecx, dword [ebp + 0x30]
cmp word [ecx + 0x408], 0x26
jl 0x408eed
mov edx, 6
mov word [ebp + 0x26], dx
mov eax, dword [0x46003c]
mov eax, dword [eax + 0xc5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push 0
push eax
call edx
mov ecx, dword [0x46003c]
mov eax, dword [ecx + 0xc58]
mov ecx, dword [ecx + 0xc5c]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
push 0
push 0x45e8b8
push ecx
push 0
push 0
push eax
call edx
mov esi, eax
mov eax, dword [0x46003c]
mov eax, dword [eax + 0xc54]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0
push 0
push eax
call edx
cmp esi, 0x887601c2
jne 0x408964
mov eax, dword [0x46003c]
pop edi
pop esi
mov byte [ebp + 0x2a], 1
pop ebp
pop ebx
add esp, 4
jmp 0x401440