Function at 0x429c20
Capabilities:
Create thread

Disassembly:
push rdi
push rbx
sub rsp, 0x48
cmp byte [0x00501ec0], 0
jne 0x429c39
cmp qword [0x00501e80], 0
je 0x429c40
add rsp, 0x48
pop rbx
pop rdi
ret
cmp qword [0x00501e68], 0
jne 0x429c39
mov rdx, rcx
lea rcx, [0x00501f40]
mov ebx, r8d
mov r8d, 0x63
call sub.msvcrt.dll_strncpy
call sub.msvcrt.dll__getpid
lea r8, [0x004da3c0]
test eax, eax
mov r9d, eax
lea rax, str.0x_X
lea rcx, [0x00501e70]
mov edx, 0xf
cmovs r8, rax
call fcn.0045e850
test eax, eax
js 0x429dd9
cmp ebx, 0x80
je 0x429dea
cmp ebx, 0x88
je 0x429e41
cmp ebx, 0x90
je 0x429e57
lea eax, [rbx - 0x91]
cmp eax, 0x27
jbe 0x429d7e
xor ecx, ecx
lea rdx, [0x00501f40]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
mov qword [0x00501e68], rax
je 0x429e6d
xor r9d, r9d
xor ecx, ecx
mov dword [0x00501618], 1
mov r8d, 0xa
mov edx, 0xa
mov rbx, qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call rbx
test rax, rax
mov qword [0x00501608], rax
je 0x429db3
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xa
call rbx
test rax, rax
mov qword [0x00501600], rax
je 0x429db3
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [0x00429910]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x00501e60], rax
je 0x429edc
lea rcx, [0x004298d0]
call fcn.0044dcc0
jmp 0x429c39
mov eax, ebx
lea r9, [0x00501f40]
lea r8, str._s_d.log
and eax, 0x3f8
lea rcx, [0x00501ec0]
mov edx, 0x68
sar eax, 3
sub eax, 0x12
mov dword [rsp + 0x20], eax
call fcn.0045e850
jmp 0x429c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str.CreateSemaphore_failed__Error_ld_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.0045e7f0
jmp 0x429c39
mov eax, 0x3f
mov word [0x00501e70], ax
jmp 0x429c97
lea rdx, [0x00501f40]
lea rcx, [0x00501ec0]
call sub.msvcrt.dll_strcpy
mov rdx, rax
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x429e00
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
cmove rdx, rcx
add al, al
sbb rdx, 3
mov dword [rdx], 0x676f6c2e
mov byte [rdx + 4], 0
jmp 0x429c39
call qword [sym.imp.msvcrt.dll___iob_func]
add rax, 0x30
mov qword [0x00501e80], rax
jmp 0x429c39
call qword [sym.imp.msvcrt.dll___iob_func]
add rax, 0x60
mov qword [0x00501e80], rax
jmp 0x429c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00501f40]
lea rcx, [0x00501ec0]
mov ebx, eax
call sub.msvcrt.dll_strcpy
mov r8, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasb al, byte [rdi]
mov rdx, rcx
not rdx
lea rdx, [r8 + rdx - 1]
mov dword [rdx], 0x676f6c2e
mov byte [rdx + 4], 0
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
lea rax, [0x00501ec0]
lea r8, [0x00501f40]
lea rdx, str._s:_Cannot_register_event_source__Error_ld___writing_to__s_n
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.0045e7f0
jmp 0x429c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str.CreateThread_failed__Error_ld_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.0045e7f0
jmp 0x429c39