Function at 0x408b0f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c78cc
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4f7f44]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
cmp dword [ebp + 8], 0
je 0x408ea1
cmp dword [ebp + 0xc], 0
je 0x408ea1
mov ebx, dword [ebp + 0x18]
cmp ebx, 0x18
je 0x408b69
cmp ebx, 8
je 0x408b69
cmp ebx, 0x20
jne 0x408ea1
cmp dword [ecx + 0x18], 0
jl 0x408ea1
cmp dword [ecx + 0x28], 0
je 0x408ea1
mov eax, dword [ebp + 0x14]
cdq
mov edi, eax
mov eax, dword [ebp + 0x10]
imul eax, ebx
xor edi, edx
add eax, 0x1f
sub edi, edx
cdq
and edx, 0x1f
lea esi, [edx + eax]
mov eax, ebx
cdq
sar esi, 5
and edx, 7
lea ebx, [edx + eax]
shl esi, 2
mov eax, esi
imul eax, edi
sar ebx, 3
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
call fcn.004a8561
pop ecx
mov dword [esp + 0x20], eax
test eax, eax
je 0x408ea1
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 4], 0
je 0x408dfd
mov edx, dword [ecx + 8]
cmp edx, 1
jle 0x408dfd
mov ebx, edx
cmp edx, edi
jl 0x408beb
mov ebx, edi
xor ecx, ecx
push 0x2c
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.004a6b98
pop ecx
mov dword [esp + 0x28], eax
and dword [esp + 0x70], 0
test eax, eax
je 0x408c39
push fcn.00453f14
push 0x408fb4
push ebx
lea esi, [eax + 4]
push 0x2c
push esi
mov dword [eax], ebx
call fcn.004a85f5
mov dword [esp + 0x1c], esi
jmp 0x408c3e
and dword [esp + 0x1c], 0
or dword [esp + 0x70], 0xffffffff
xor ecx, ecx
push 4
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a6b98
and dword [esp + 0x14], 0
pop ecx
mov dword [esp + 0x14], eax
test ebx, ebx
jle 0x408d1f
mov eax, edi
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
and dword [esp + 0x24], 0
add esi, 0xc
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esi - 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x18], eax
mov dword [esi + 8], edi
mov edx, dword [ecx + 0x18]
lea eax, [esi - 0xc]
mov dword [eax], edx
mov ecx, dword [ecx + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esi - 8], ecx
lea ecx, [ebx - 1]
mov dword [esi + 0xc], edx
cmp dword [esp + 0x10], ecx
jne 0x408cca
mov dword [esi + 0x10], edi
jmp 0x408cd1
add edx, dword [esp + 0x28]
mov dword [esi + 0x10], edx
cmp dword [ebp + 0x18], 8
mov byte [esi + 0x1c], 1
mov ecx, fcn.004092ce
je 0x408ce5
mov ecx, fcn.004093e1
lea edx, [esp + 0x34]
push edx
push 0
push eax
push ecx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc dword [esp + 0x10]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x28]
add dword [esp + 0x24], eax
add esi, 0x2c
cmp dword [esp + 0x10], ebx
jl 0x408c80
push 0xffffffffffffffff
push 1
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test ebx, ebx
jle 0x408d46
mov eax, dword [esp + 0x14]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x408d34
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
push 0x32
push 0x64
call dword [eax + 0xc]
xor edi, edi
test ebx, ebx
jle 0x408da8
mov esi, dword [esp + 0x1c]
add esi, 0xc
cmp dword [ebp + 0x18], 8
mov eax, dword [esp + 0x20]
mov dword [esi - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov byte [esi + 0x1c], 0
mov eax, fcn.004092ce
je 0x408d80
mov eax, fcn.004093e1
lea ecx, [esp + 0x34]
push ecx
push 0
lea ecx, [esi - 0xc]
push ecx
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x14]
mov dword [ecx + edi*4], eax
inc edi
add esi, 0x2c
cmp edi, ebx
jl 0x408d60
mov edi, dword [esp + 0x14]
push 0xffffffffffffffff
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test ebx, ebx
jle 0x408dcc
push dword [edi + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x408dbe
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x408ded
push fcn.00453f14
lea esi, [eax - 4]
push dword [esi]
push 0x2c
push eax
call fcn.004a83d9
push esi
call fcn.004a8370
pop ecx
push edi
call fcn.004a8370
mov esi, dword [esp + 0x1c]
pop ecx
jmp 0x408e88
mov edx, dword [ebp + 8]
and dword [esp + 0x50], 0
cmp dword [ebp + 0x18], 8
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x54], edi
mov byte [esp + 0x60], 1
push eax
jne 0x408e49
call fcn.004092ce
jmp 0x408e4e
call fcn.004093e1
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push 0x32
push 0x64
mov ecx, esi
call dword [eax + 0xc]
cmp dword [ebp + 0x18], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x38]
mov byte [esp + 0x60], 0
push eax
jne 0x408e83
call fcn.004092ce
jmp 0x408e88
call fcn.004093e1
push dword [esp + 0x20]
call fcn.004a843c
mov eax, dword [esi]
pop ecx
push 0x64
push 0x64
mov ecx, esi
call dword [eax + 0xc]
mov al, 1
jmp 0x408ea3
xor al, al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14