Function at 0x4071ab
Capabilities:
Create thread

Disassembly:
push 0x310
mov eax, 0x47eb5d
call fcn.004657df
mov edi, ecx
mov dword [ebp - 0x2b8], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2cc], eax
mov eax, ebx
mov dword [ebp - 0x2c0], eax
lea eax, [edi + 0x770]
push eax
mov dword [ebp - 0x2f0], edi
call dword [0x489350]
mov dword [ebp - 0x308], ebx
mov dword [ebp - 0x304], ebx
mov dword [ebp - 0x300], ebx
mov dword [ebp - 4], ebx
mov eax, dword [edi + 0x6b0]
cmp eax, dword [edi + 0x6b4]
je 0x407666
mov esi, ebx
mov dword [ebp - 0x2e8], ebx
mov eax, ebx
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], esi
mov dword [ebp - 0x2f4], ebx
lea eax, [ebp - 0x20c]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00421552
mov byte [ebp - 4], 2
mov eax, ebx
mov dword [ebp - 0x2b4], 0xd8
movzx ecx, ax
mov dword [ebp - 0x2d4], eax
mov eax, dword [edi + 0x6b4]
sub eax, dword [edi + 0x6b0]
cdq
idiv dword [ebp - 0x2b4]
cmp ecx, eax
jae 0x407627
imul esi, ecx, 0xd8
lea eax, [ebp - 0x2a8]
push eax
mov ecx, edi
add esi, dword [edi + 0x6b0]
mov dword [ebp - 0x2d8], esi
call fcn.00421552
push eax
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 3
call fcn.0040a9e7
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 5
call fcn.00403a08
mov eax, dword [ebp - 0x2e0]
mov ecx, 0x114
sub eax, dword [ebp - 0x2e4]
cdq
idiv ecx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2c4], eax
test eax, eax
je 0x40737a
mov ebx, dword [ebp - 0x2e4]
lea ecx, [esi + 0x48]
add ebx, 0xc
mov dword [ebp - 0x2ec], ebx
mov edx, ecx
lea ecx, [ebp - 0x44]
call fcn.0042741d
mov edx, eax
mov ecx, ebx
call fcn.0040319e
push 0
push 1
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.00402e0b
test bl, bl
jne 0x407341
mov eax, dword [ebp - 0x2ac]
lea ecx, [esi + 0x48]
mov ebx, dword [ebp - 0x2ec]
inc eax
add ebx, 0x114
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2ec], ebx
cmp eax, dword [ebp - 0x2c4]
jb 0x4072f0
jmp 0x407378
imul ebx, dword [ebp - 0x2ac], 0x114
add ebx, dword [ebp - 0x2e4]
cmp dword [ebx + 0xdc], 0
jne 0x407378
sub esp, 0xc
lea eax, [edi + 0x64c]
mov ecx, esp
push eax
call fcn.0040abcb
mov ecx, ebx
call fcn.00429543
add esp, 0xc
mov byte [esi + 0x7c], al
xor ebx, ebx
cmp byte [esi + 0x7c], 0
jne 0x40739a
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 2
call fcn.0040439b
mov esi, dword [ebp - 0x2b0]
jmp 0x40761b
lea ecx, [esi + 0x18]
call fcn.00424c00
test al, al
je 0x407380
push ebx
push 1
mov byte [ebp - 4], 6
mov ecx, edi
movzx eax, byte [esi + 0x7e]
push eax
lea eax, [esi + 0x18]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.00409982
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.00402e4f
cmp dword [ebp - 0x2e8], 0
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x314], esi
mov dword [ebp - 0x318], edi
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], ebx
jne 0x407429
push 0x498118
call fcn.004032a2
pop ecx
push eax
push ebx
push 0x498118
lea ecx, [esi + 0x18]
call fcn.00404290
cmp eax, 0xffffffff
je 0x407429
call fcn.0040a238
mov dword [ebp - 0x2e8], 1
push 0x3e8
push ebx
push ebx
lea eax, [ebp - 0x318]
push eax
push 0x409294
push ebx
push ebx
call fcn.00461699
add esp, 0x18
push eax
call dword [0x489348]
cmp byte [esi + 0x7d], 0
je 0x407380
lea ecx, [esi + 0x60]
mov edx, 0x498144
call fcn.0040ba08
test al, al
je 0x407494
cmp dword [ebp - 0x30c], 0
je 0x407494
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0040ad3a
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2b0], eax
jmp 0x407380
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x308]
call fcn.0040ad3a
jmp 0x407380
mov eax, dword [ebp - 0x2d4]
inc eax
jmp 0x407253
mov eax, dword [ebp - 0x2fc]
cmp eax, esi
je 0x407645
push 0x927c0
push 1
sub esi, eax
push eax
sar esi, 2
push esi
call dword [0x489320]
lea ecx, [ebp - 0x20c]
call fcn.00403a08
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2fc]
test eax, eax
je 0x407670
push eax
call fcn.00432286
pop ecx
jmp 0x407670
mov dword [ebp - 0x2b4], 0xd8
mov ecx, edi
call fcn.00406540
mov eax, dword [edi + 0x6b4]
mov ecx, ebx
sub eax, dword [edi + 0x6b0]
mov esi, ebx
cdq
idiv dword [ebp - 0x2b4]
mov dword [ebp - 0x2ac], ecx
test eax, eax
je 0x407713
mov eax, ebx
mov dword [ebp - 0x2b0], ebx
mov edx, dword [edi + 0x6b0]
cmp byte [edx + eax + 0x7f], 0
je 0x4076e4
lea ecx, [edx + 0x60]
mov edx, 0x498154
add ecx, eax
call fcn.0040ba08
test al, al
je 0x4076d8
mov eax, dword [edi + 0x6b0]
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [eax + ecx + 0x80]
cmp eax, esi
cmovg esi, eax
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2b0]
add eax, 0xd8
inc ecx
mov dword [ebp - 0x2b0], eax
mov eax, dword [edi + 0x6b4]
sub eax, dword [edi + 0x6b0]
cdq
idiv dword [ebp - 0x2b4]
mov dword [ebp - 0x2ac], ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2b0]
jb 0x4076a0
mov eax, dword [ebp - 0x304]
mov ecx, dword [ebp - 0x308]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x407733
push esi
push 1
push ecx
push eax
call dword [0x489320]
push ebx
push ebx
mov dword [ebp - 0x2cc], ebx
call fcn.0040b833
mov esi, eax
mov dword [ebp - 0x2d0], esi
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x17
push eax
mov ecx, edi
mov dword [ebp - 0x2b4], ebx
call fcn.00421552
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, ecx
mov ecx, 0x114
cdq
idiv ecx
lea ecx, [ebp - 0x80]
test eax, eax
setne bl
call fcn.00403a08
test bl, bl
je 0x407867
and dword [ebp - 0x2ac], 0
xor ebx, ebx
mov eax, dword [edi + 0x6b0]
cmp byte [eax + ebx + 0x7f], 0
je 0x40780b
lea ecx, [ebx + 0x60]
mov edx, 0x498154
add ecx, eax
call fcn.0040ba08
test al, al
je 0x40780b
mov eax, dword [edi + 0x6b0]
cmp byte [eax + ebx + 0x7c], 0
je 0x40780b
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00421552
mov byte [ebp - 4], 0x18
mov eax, dword [eax]
add eax, dword [ebp - 0x2ac]
push eax
push dword [esi + 4]
push esi
call fcn.0040be88
mov edx, dword [ebp - 0x2cc]
mov ecx, 0xe6c2b3
sub ecx, edx
cmp ecx, 1
jb 0x40785d
mov dword [esi + 4], eax
inc edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x2cc], edx
mov byte [ebp - 4], 0x17
mov dword [ecx], eax
lea ecx, [ebp - 0x20c]
call fcn.00403a08
inc dword [ebp - 0x2b4]
lea eax, [ebp - 0x80]
add ebx, 0xd8
mov ecx, edi
mov dword [ebp - 0x2d8], ebx
mov ebx, 0x114
add dword [ebp - 0x2ac], ebx
push eax
call fcn.00421552
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, ecx
lea ecx, [ebp - 0x80]
cdq
idiv ebx
cmp dword [ebp - 0x2b4], eax
setb bl
call fcn.00403a08
test bl, bl
je 0x407867
mov ebx, dword [ebp - 0x2d8]
jmp 0x40778a
push 0x498290
call fcn.0047dbe9
xor ebx, ebx
mov dword [ebp - 0x2b0], ebx
push ebx
push ebx
mov dword [ebp - 0x2c4], ebx
call fcn.0040b86a
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 0x19
mov esi, dword [esi]
mov dword [ebp - 0x2d4], esi
cmp esi, dword [ebp - 0x2d0]
je 0x407c37
mov ecx, 0xd8
mov eax, dword [edi + 0x6b4]
sub eax, dword [edi + 0x6b0]
cdq
idiv ecx
mov dword [ebp - 0x2ac], ebx
test eax, eax
je 0x407c23
lea eax, [esi + 8]
mov dword [ebp - 0x2b4], ebx
lea edx, [eax + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.004274c7
mov ecx, dword [edi + 0x6b0]
mov edx, eax
add ecx, 0x48
add ecx, dword [ebp - 0x2b4]
call fcn.004031ba
push 0
push 1
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.00402e4f
test bl, bl
je 0x407bf2
sub esp, 0x114
lea eax, [esi + 8]
mov ecx, esp
push eax
call fcn.00407ed2
call fcn.004070e2
add esp, 0x114
test al, al
je 0x407bf2
lea ecx, [ebp - 0x158]
call fcn.00407fe0
lea eax, [esi + 0xbc]
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x158]
xor ebx, ebx
cmp ecx, eax
je 0x40794a
push 0xffffffffffffffff
push ebx
push eax
call fcn.00402d27
mov edi, dword [esi + 0x110]
mov al, bl
mov byte [ebp - 0x2b9], al
cmp edi, dword [esi + 0x114]
je 0x4079bf
mov edx, 0x27af
lea ecx, [ebp - 0x2c]
call fcn.00427723
lea ecx, [edi + 0x18]
mov edx, eax
call fcn.0040319e
push 0
push 1
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.00402e0b
test bl, bl
je 0x4079a9
mov eax, dword [ebp - 0x2b8]
mov ebx, dword [ebp - 0x2b4]
mov eax, dword [eax + 0x6b0]
cmp dword [eax + ebx + 0xc8], 0
jne 0x407b24
add edi, 0x60
lea eax, [esi + 8]
cmp edi, dword [eax + 0x10c]
jne 0x407960
mov al, byte [ebp - 0x2b9]
xor ebx, ebx
mov edi, dword [ebp - 0x2b8]
test al, al
jne 0x4079ed
mov edx, 0x27a0
lea ecx, [ebp - 0x2c]
call fcn.00427723
push eax
lea ecx, [ebp - 0x128]
call fcn.00403f33
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402e0b
mov edx, dword [ebp - 0x2b0]
lea ecx, [ebp - 0x2c]
call fcn.00405363
push eax
lea ecx, [ebp - 0x140]
call fcn.00403f33
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402e0b
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
call fcn.0042151b
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x1d
cmp ecx, eax
je 0x407a37
push 0xffffffffffffffff
push ebx
push eax
call fcn.00402d27
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x1a
call fcn.00406510
lea ecx, [ebp - 0x2c]
call fcn.00425049
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x1e
cmp ecx, eax
je 0x407a65
push 0xffffffffffffffff
push ebx
push eax
call fcn.00402d27
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1a
call fcn.00402e0b
lea eax, [ebp - 0x158]
mov ecx, edi
push eax
call fcn.004217cb
push 0xf
pop eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ebx
mov byte [ebp - 0xb0], bl
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0xb0]
mov ecx, edi
push eax
call fcn.0040957d
lea eax, [ebp - 0x2d4]
push eax
mov eax, dword [ebp - 0x2c8]
push dword [eax + 4]
push eax
call fcn.0040bede
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebp - 0x2c4]
sub ecx, eax
cmp ecx, 1
jb 0x40785d
inc eax
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c8]
mov dword [eax + 4], edx
mov ecx, dword [edx + 4]
mov dword [ecx], edx
lea ecx, [ebp - 0xb0]
call fcn.00408053
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x19
call fcn.00408014
jmp 0x407bf4
lea edx, [edi + 0x48]
lea ecx, [ebp - 0xc8]
call fcn.004274c7
mov edi, dword [ebp - 0x2b8]
mov edx, eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [edi + 0x6b0]
add ecx, 0xb8
add ecx, ebx
call fcn.004031ba
test al, al
je 0x407b6d
mov edx, 0x27a0
lea ecx, [ebp - 0x5c]
call fcn.00427723
mov ebx, dword [ebp - 0x2c0]
or ebx, 1
jmp 0x407b83
mov edx, 0x27a1
lea ecx, [ebp - 0x2c]
call fcn.00427723
mov ebx, dword [ebp - 0x2c0]
or ebx, 2
push eax
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x2c0], ebx
call fcn.00403f33
test bl, 2
je 0x407bb2
and ebx, 0xfffffffd
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c0], ebx
xor ebx, ebx
push ebx
push 1
call fcn.00402e0b
jmp 0x407bb4
xor ebx, ebx
mov dword [ebp - 4], 0x1b
mov eax, dword [ebp - 0x2c0]
test al, 1
je 0x407bd9
push ebx
and eax, 0xfffffffe
lea ecx, [ebp - 0x5c]
push 1
mov dword [ebp - 0x2c0], eax
call fcn.00402e0b
push ebx
push 1
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1a
call fcn.00402e4f
mov al, 1
jmp 0x4079c5
xor ebx, ebx
mov eax, dword [edi + 0x6b4]
mov ecx, 0xd8
sub eax, dword [edi + 0x6b0]
cdq
idiv ecx
inc dword [ebp - 0x2ac]
add dword [ebp - 0x2b4], ecx
cmp dword [ebp - 0x2ac], eax
lea eax, [esi + 8]
jb 0x4078c5
mov esi, dword [esi]
mov dword [ebp - 0x2d4], esi
cmp esi, dword [ebp - 0x2d0]
jne 0x40789f
mov esi, dword [ebp - 0x2c8]
mov eax, esi
cmp esi, dword [esi]
je 0x407c81
dec dword [ebp - 0x2cc]
lea edi, [eax + 4]
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.00404fcc
push esi
call fcn.00432286
mov esi, dword [ebp - 0x2c8]
mov eax, dword [edi]
pop ecx
cmp eax, dword [esi]
jne 0x407c43
mov edi, dword [ebp - 0x2b8]
cmp dword [ebp - 0x2cc], 0
je 0x407cef
push 0xea60
call dword [0x489364]
mov byte [ebp - 4], 0x17
mov eax, dword [esi]
mov dword [esi], esi
mov dword [esi + 4], esi
mov dword [ebp - 0x2c4], ebx
cmp eax, esi
je 0x407ccb
mov edi, dword [ebp - 0x2c8]
mov esi, dword [eax]
push eax
call fcn.00432286
mov eax, esi
pop ecx
cmp esi, edi
jne 0x407cb0
mov edi, dword [ebp - 0x2b8]
mov esi, dword [ebp - 0x2c8]
push esi
call fcn.00432286
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
pop ecx
cmp eax, 0x3c
jae 0x407d26
mov esi, dword [ebp - 0x2d0]
jmp 0x40786f
mov byte [ebp - 4], 0x17
mov eax, dword [esi]
mov dword [esi], esi
mov dword [esi + 4], esi
cmp eax, esi
je 0x407d1f
mov edi, dword [ebp - 0x2c8]
mov esi, dword [eax]
push eax
call fcn.00432286
mov eax, esi
pop ecx
cmp esi, edi
jne 0x407d04
mov edi, dword [ebp - 0x2b8]
mov esi, dword [ebp - 0x2c8]
push esi
call fcn.00432286
pop ecx
mov eax, dword [ebp - 0x2d0]
mov esi, dword [eax]
cmp esi, eax
je 0x407e64
lea ecx, [ebp - 0x1d0]
call fcn.00407fe0
lea eax, [esi + 0xbc]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1d0]
cmp ecx, eax
je 0x407d5e
push 0xffffffffffffffff
push ebx
push eax
call fcn.00402d27
mov edx, 0x27a1
lea ecx, [ebp - 0x2c]
call fcn.00427723
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00403f33
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402e0b
push 0x3c
pop edx
lea ecx, [ebp - 0x2c]
call fcn.0040531c
push eax
lea ecx, [ebp - 0x1b8]
call fcn.00403f33
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402e0b
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
call fcn.0042151b
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0x21
cmp ecx, eax
je 0x407dc9
push 0xffffffffffffffff
push ebx
push eax
call fcn.00402d27
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x20
call fcn.00406510
lea ecx, [ebp - 0x2c]
call fcn.00425049
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x22
cmp ecx, eax
je 0x407df7
push 0xffffffffffffffff
push ebx
push eax
call fcn.00402d27
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x20
call fcn.00402e0b
lea eax, [ebp - 0x1d0]
mov ecx, edi
push eax
call fcn.004217cb
push 0xf
pop eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ebx
mov byte [ebp - 0x74], bl
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x1d0]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x74]
mov ecx, edi
push eax
call fcn.0040957d
lea ecx, [ebp - 0x74]
call fcn.00408053
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x17
call fcn.00408014
mov esi, dword [esi]
cmp esi, dword [ebp - 0x2d0]
jne 0x407d36
lea esi, [edi + 0x770]
push esi
call dword [0x48934c]
cmp byte [edi + 0x70a], 0
je 0x407e8a
cmp dword [esi], ebx
jne 0x407e8a
call fcn.00425065
push ebx
call dword [0x48935c]
mov ebx, dword [ebp - 0x2d0]
mov edi, dword [ebx]
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
cmp edi, ebx
je 0x407eb2
mov esi, dword [edi]
lea ecx, [edi + 8]
call fcn.00404fcc
push edi
call fcn.00432286
mov edi, esi
pop ecx
cmp esi, ebx
jne 0x407e9b
push ebx
call fcn.00432286
mov eax, dword [ebp - 0x308]
pop ecx
test eax, eax
je 0x407eca
push eax
call fcn.00432286
pop ecx
call fcn.00465731
ret 4