Function at 0x41e030
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c766b
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
call fcn.00443cd0
push str.success
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 0
call fcn.00443c90
lea eax, [ebp - 0x6c]
push eax
push 0x4da4ec
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.00444170
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0
call fcn.00443ee0
push str.callbackId
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004452a0
test al, al
jne 0x41e15b
push str.writeFile_callbackId_not_exist
lea ecx, [ebp - 0x50]
call fcn.00401ff0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 3
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.00444170
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.00443ee0
cmp dword [ebp - 0x18], 0x10
jb 0x41e12f
push dword [ebp - 0x2c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41e152
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41e372
push 0x10
call fcn.004a6c5d
mov esi, eax
add esp, 4
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 6
test esi, esi
je 0x41e17d
push 0
mov ecx, esi
call fcn.00443cd0
jmp 0x41e17f
xor esi, esi
mov edi, dword [0x521340]
mov eax, edi
imul eax, edi
imul eax, edi
cdq
mov ecx, 0x15
idiv ecx
mov byte [ebp - 4], 2
cmp edx, 2
jne 0x41e1dc
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub edi, ecx
xor ecx, ecx
lea eax, [edi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
add esp, 4
push eax
call fcn.004a8200
add esp, 4
push ebx
mov ecx, esi
call fcn.00443f80
lea eax, [ebp - 0x70]
push eax
push 0
push esi
push 0x41e550
push 0
push 0
mov dword [ebp - 0x70], 0
call fcn.004a8e8c
add esp, 0x18
test eax, eax
jne 0x41e2ed
test esi, esi
je 0x41e21f
mov ecx, esi
call fcn.00443ee0
push esi
call fcn.004a6c2e
add esp, 4
call fcn.004a86d6
push dword [eax]
lea eax, [ebp - 0x5c]
push eax
call fcn.0043f5e0
add esp, 8
push eax
lea eax, [ebp - 0x50]
push str.writeFile_beginthreadex_
push eax
mov byte [ebp - 4], 7
call fcn.0040b870
add esp, 0xc
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 9
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41e26b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xb
call fcn.00444170
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call fcn.00443ee0
cmp dword [ebp - 0x18], 0x10
jb 0x41e2c1
push dword [ebp - 0x2c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41e2e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x58]
mov byte [ebp - 4], 0
jmp 0x41e372
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x58]
jmp 0x41e368
or ebx, 0xffffffff
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00445f40
mov byte [ebp - 4], 0x10
call fcn.004179f0
test al, al
jne 0x41e398
push 0x14
push 0x13
push str._d__d_n
call fcn.004a90ce
add esp, 0xc
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x11
call fcn.00448e50
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x12
jb 0x41e3cd
mov edx, dword [edx]
sub esp, 0x18
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x41e3ec
xor ecx, ecx
jmp 0x41e3fe
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x54], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e3f4
sub ecx, dword [ebp - 0x54]
push ecx
push edx
mov ecx, esi
call fcn.00401460
lea eax, [ebp - 0x5c]
push eax
call fcn.0044ff60
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x13
call fcn.00402b30
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41e440
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0x11
jb 0x41e455
push dword [ebp - 0x2c]
call fcn.004a6c2e
add esp, 4
mov eax, 8
mov word [edi], ax
call fcn.004178a0
test al, al
jne 0x41e47a
mov eax, dword [0x521340]
mov ecx, 1
test eax, eax
cmove eax, ecx
mov dword [0x521340], eax
mov esi, dword [ebp - 0x50]
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41e490
call fcn.0040c350
mov dword [edi + 8], eax
mov edi, dword [0x521340]
mov eax, edi
imul eax, edi
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 0xd
jne 0x41e4d3
xor eax, eax
test edi, edi
je 0x41e4ce
xor esi, esi
mov eax, edi
mov ecx, edi
cdq
sub eax, edx
and ecx, 1
mov edi, eax
add esi, ecx
sar edi, 1
jne 0x41e4b3
mov dword [ebp - 0x54], esi
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov dword [0x521340], eax
add esi, 0xfffffff0
mov byte [ebp - 4], 0x10
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x41e4ee
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x4c], 0x4da4e4
jb 0x41e50a
push dword [ebp - 0x48]
call fcn.004a6c2e
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call fcn.00446040
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 0xffffffff
call fcn.00443ee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret