Function at 0x41e490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push pe_nt_image_headers32
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call fcn.0043dfd1
push eax
call fcn.0043bed7
mov edi, dword [ebp + 8]
mov ebx, esi
add esp, 8
xor edx, edx
sub ebx, edi
movzx eax, byte [edx + edi]
lea ecx, [edx + edi]
mov byte [ebx + ecx], al
mov al, byte [ecx]
cmp al, 7
jne 0x41e4e2
mov dword [esi + 0x110], edx
mov dword [esi + 0x114], edx
jmp 0x41e4f2
cmp al, 0x17
jne 0x41e4f2
mov dword [esi + 0x210], edx
mov dword [esi + 0x214], edx
inc edx
cmp edx, 0x100
jl 0x41e4c4
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ebx]
mov byte [esi + 0x100], al
movzx eax, byte [ecx]
mov byte [esi + 0x108], al
movzx eax, byte [ebx + 1]
mov byte [esi + 0x101], al
movzx eax, byte [ecx + 1]
mov byte [esi + 0x109], al
movzx eax, byte [ebx + 2]
mov byte [esi + 0x102], al
movzx eax, byte [ecx + 2]
mov byte [esi + 0x10a], al
movzx eax, byte [ebx + 3]
mov byte [esi + 0x103], al
movzx eax, byte [ecx + 3]
mov byte [esi + 0x10b], al
movzx eax, byte [ebx + 4]
mov byte [esi + 0x104], al
movzx eax, byte [ecx + 4]
mov byte [esi + 0x10c], al
movzx eax, byte [ebx + 5]
mov byte [esi + 0x105], al
movzx eax, byte [ecx + 5]
mov byte [esi + 0x10d], al
movzx eax, byte [ebx + 6]
mov byte [esi + 0x106], al
movzx eax, byte [ecx + 6]
mov byte [esi + 0x10e], al
movzx eax, byte [ebx + 7]
mov byte [esi + 0x107], al
movzx eax, byte [ecx + 7]
mov byte [esi + 0x10f], al
mov eax, dword [esi + 0x318]
mov dword [esi + 0x31c], eax
mov eax, dword [esi + 0x580]
mov dword [esi + 0x5e0], eax
mov eax, dword [esi + 0x584]
mov dword [esi + 0x5e4], eax
mov eax, dword [esi + 0x588]
mov dword [esi + 0x5e8], eax
mov eax, dword [esi + 0x58c]
mov dword [esi + 0x5ec], eax
mov eax, dword [esi + 0x590]
mov dword [esi + 0x5f0], eax
mov eax, dword [esi + 0x594]
mov dword [esi + 0x5f4], eax
mov eax, dword [esi + 0x598]
mov dword [esi + 0x5f8], eax
mov eax, dword [esi + 0x59c]
mov dword [esi + 0x5fc], eax
mov eax, dword [esi + 0x5a0]
mov dword [esi + 0x600], eax
mov eax, dword [esi + 0x5a4]
mov dword [esi + 0x604], eax
mov eax, dword [esi + 0x5a8]
mov dword [esi + 0x608], eax
mov eax, dword [esi + 0x5ac]
mov dword [esi + 0x60c], eax
mov eax, dword [esi + 0x5b0]
mov dword [esi + 0x610], eax
mov eax, dword [esi + 0x5b4]
mov dword [esi + 0x614], eax
mov eax, dword [esi + 0x5b8]
mov dword [esi + 0x618], eax
mov eax, dword [esi + 0x5bc]
mov dword [esi + 0x61c], eax
mov eax, dword [esi + 0x5c0]
mov dword [esi + 0x620], eax
mov eax, dword [esi + 0x5c4]
mov dword [esi + 0x624], eax
mov eax, dword [esi + 0x5c8]
mov dword [esi + 0x628], eax
mov eax, dword [esi + 0x5cc]
mov dword [esi + 0x62c], eax
mov eax, dword [esi + 0x5d0]
mov dword [esi + 0x630], eax
mov eax, dword [esi + 0x5d4]
mov dword [esi + 0x634], eax
mov eax, dword [esi + 0x5d8]
mov dword [esi + 0x638], eax
lea edx, [esi + 0x2b554]
mov eax, dword [esi + 0x5dc]
xor ecx, ecx
mov dword [esi + 0x63c], eax
mov al, byte [ecx + edi]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x100
jl 0x41e6d3
movzx eax, byte [ebx]
mov ecx, dword [ebp + 0x10]
mov byte [esi + 0x2b754], al
movzx eax, byte [ecx]
mov byte [esi + 0x2b75c], al
movzx eax, byte [ebx + 1]
mov byte [esi + 0x2b755], al
movzx eax, byte [ecx + 1]
mov byte [esi + 0x2b75d], al
movzx eax, byte [ebx + 2]
mov byte [esi + 0x2b756], al
movzx eax, byte [ecx + 2]
mov byte [esi + 0x2b75e], al
movzx eax, byte [ebx + 3]
mov byte [esi + 0x2b757], al
movzx eax, byte [ecx + 3]
mov byte [esi + 0x2b75f], al
movzx eax, byte [ebx + 4]
mov byte [esi + 0x2b758], al
movzx eax, byte [ecx + 4]
mov byte [esi + 0x2b760], al
movzx eax, byte [ebx + 5]
mov byte [esi + 0x2b759], al
movzx eax, byte [ecx + 5]
mov byte [esi + 0x2b761], al
movzx eax, byte [ebx + 6]
mov byte [esi + 0x2b75a], al
movzx eax, byte [ecx + 6]
mov byte [esi + 0x2b762], al
movzx eax, byte [ebx + 7]
mov byte [esi + 0x2b75b], al
movzx eax, byte [ecx + 7]
mov byte [esi + 0x2b763], al
lea eax, [ebp - 4]
push eax
push 0
push edx
push 0x41d4f0
push 0
push 0
mov word [esi + 0x4ce7c], 0
mov byte [esi + 0x4ca90], 0
mov dword [esi + 0x2ba80], 0xc
mov dword [esi + 0x2ba84], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
lea ecx, [esi + 0x6c0]
call fcn.0042d5b0
inc dword [esi + 0x82764]
lea edx, [esi + 0x70f44]
mov dword [esi + 0x310], 0
mov edi, 0x28
mov dword [esi + 0x82768], 0
mov dword [esi + 0x420], 0x927c0
nop dword [eax + eax]
xor ecx, ecx
cmp dword [esi + 0x314], ecx
jle 0x41e868
mov eax, edx
nop dword [eax]
mov dword [eax - 0x2800], 0
inc ecx
mov dword [eax], 0
mov dword [eax + 0x2800], 0
mov dword [eax + 0x5000], 0
mov dword [eax + 0x7800], 0
mov dword [eax + 0xa000], 0
mov dword [eax + 0xc800], 0
mov dword [eax + 0xf000], 0
add eax, 4
cmp ecx, dword [esi + 0x314]
jl 0x41e810
add edx, 0x100
sub edi, 1
jne 0x41e800
mov ecx, esi
call fcn.0041eda0
cmp byte [esi + 0x4ce7d], 0
jne 0x41e893
cmp dword [esi + 0x420], 0x1f40
jl 0x41e893
mov al, 1
jmp 0x41e895
xor al, al
mov byte [esi + 0x6e594], al
cmp byte [esi + 0x4ce7d], 1
mov dword [esi + 0x2ba80], 0
mov dword [esi + 0x2ba84], 0
mov byte [esi + 0x4ce7d], 0
jne 0x41e924
mov eax, dword [esi + 0x4ce60]
mov dword [esi + 0x6e728], eax
mov eax, dword [esi + 0x4ce64]
mov dword [esi + 0x6e72c], eax
mov eax, dword [esi + 0x4ce6c]
mov dword [esi + 0x6e734], eax
mov eax, dword [esi + 0x4ce70]
mov dword [esi + 0x6e738], eax
mov eax, dword [esi + 0x4ce68]
mov dword [esi + 0x6e730], eax
mov eax, dword [esi + 0x4ce74]
mov dword [esi + 0x6e73c], eax
mov eax, dword [esi + 0x4ce78]
mov dword [esi + 0x6e740], eax
mov eax, dword [esi + 0x4cad0]
sub eax, 0x186a0
mov dword [esi + 0x420], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc