Function at 0x40f8c0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ebx
push ebp
lea ebp, [eax + 0x80b]
add edx, 0x71c
lea ebx, [eax + 0x1c6]
lea eax, [ecx - 0x414]
add ecx, 0xfffff99e
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, ebp
push edi
mov edi, dword [esp + 0x28]
xor eax, 0x14f
add edi, 0xffffcecb
mov dword [esp + 0x28], ebp
cmp ecx, eax
je 0x40fa62
lea eax, [edx - 0xf27]
cmp edi, eax
jg 0x40f96f
mov eax, dword [0x70c18c]
mov ecx, dword [esi + 0x70]
cmp dword [eax + 0xb4], ecx
jb 0x40f946
mov eax, dword [esi + 0x7c]
sub eax, dword [0x72a1dc]
add eax, 0x40f3301d
mov dword [esi + 0x90], eax
mov eax, dword [0x70c18c]
mov eax, dword [eax + 0x128]
xor eax, ecx
mov ecx, dword [esi + 0x74]
add eax, 0xe85df
xor dword [esi + 4], eax
sub ecx, 0x15e816
mov eax, dword [0x70c18c]
mov dword [eax + 0x104], ecx
jmp 0x40fa62
mov eax, dword [esi + 0xd8]
mov ebp, edi
or eax, dword [esi + 0x40]
cmp edi, eax
je 0x40fa62
or edx, ebx
lea eax, [edx - 0x32fb]
mov dword [esp + 0x1c], eax
cmp edi, eax
jne 0x40fa22
mov edx, dword [0x70c18c]
mov eax, dword [edx + 0x110]
xor eax, dword [0x72a264]
cmp edi, eax
je 0x40fa0f
mov eax, dword [edx + 0x34]
and eax, dword [esi + 0x54]
sub eax, dword [esp + 0x28]
push eax
mov eax, dword [esi + 0x74]
sub eax, dword [edx + 0x74]
add eax, dword [0x72a2b8]
push eax
mov eax, dword [esi + 0x110]
add eax, dword [0x72a2b8]
push eax
mov eax, dword [esi + 0x68]
and eax, dword [esp + 0x2c]
push eax
mov eax, dword [edx + 0xf8]
imul eax, dword [esp + 0x30]
sub eax, 0x3270
push eax
mov eax, dword [edx + 0x20]
and eax, 0x3226
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x70c18c]
mov eax, dword [eax + 0x9c]
and eax, dword [0x72a214]
xor dword [esi + 0x20], eax
jmp 0x40fa4a
mov eax, dword [esi + 0x48]
or eax, ebx
sub eax, dword [esi + 0xc0]
add dword [esi + 0x84], eax
jmp 0x40fa4a
mov eax, dword [0x70c18c]
mov eax, dword [eax + 0x34]
imul eax, edi
push eax
mov eax, dword [esi + 0x10c]
and eax, dword [esi + 0x6c]
imul eax, dword [esi + 0x38]
push eax
mov eax, dword [esp + 0x30]
sub eax, dword [esi + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov eax, dword [esi + 0xd8]
add ebp, 2
or eax, dword [esi + 0x40]
cmp ebp, eax
mov eax, dword [esp + 0x1c]
jne 0x40f98e
xor ebx, 0x5b7
cmp edi, ebx
jge 0x40fa84
mov eax, dword [esi + 0x120]
cmp eax, dword [esi + 0x94]
jae 0x40fa84
add dword [esi + 0x104], 0xfffffaff
mov ebx, dword [esi + 0x78]
jmp 0x40fad1
mov eax, dword [0x70c18c]
mov edx, dword [esi + 0xf8]
mov ecx, dword [eax + 0xfc]
mov eax, 0xfff54e18
xor ecx, edx
sub eax, ecx
add dword [esi + 0xfc], eax
mov eax, dword [0x70c18c]
mov ecx, dword [eax + 0x110]
sub ecx, dword [eax + 0x38]
lea eax, [edx - 0x1755fc]
add eax, ecx
mov dword [esi + 0xf8], eax
mov eax, ebx
imul eax, ebx
add dword [0x72a2d4], eax
inc ebx
cmp ebx, dword [esi + 0x90]
jbe 0x40fa89
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x70]
xor ecx, 0x151e3e
imul ecx, dword [esi + 0x104]
mov dword [esi + 0x104], ecx
cmp eax, dword [0x72a2b8]
je 0x40fb05
mov eax, dword [0x70c18c]
mov dword [eax + 0xc8], ecx
lea eax, [edi + 0x387f]
pop edi
pop esi
pop ebp
pop ebx
ret