Function at 0x4c47f0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1f0
mov esi, esp
mov dword [esi + 0x1d8], ebp
mov dword [esi + 0x1dc], esp
mov dword [esi + 0x1e8], 0xffffffff
mov dword [esi + 0x1e4], 0x4c5cb0
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x2c]
lea eax, [esi + 0x1e0]
mov edx, dword fs:[0]
cmp ecx, 3
mov dword [esi + 0x1e0], edx
mov dword fs:[0], eax
mov eax, 5
mov dword [edi], 0xffffffff
jne 0x4c53cf
mov dword [esi + 0x84], 7
mov dword [esi + 0x80], 0
mov word [esi + 0x70], 0
sub esp, 0xc
mov al, byte [esi + 0xd0]
lea ecx, [esi + 0x70]
mov byte [esp + 4], al
mov dword [esp + 8], 0x6603a8
mov dword [esp], 0x13
mov dword [esi + 4], ecx
call fcn.00405590
mov eax, dword [0x6603d0]
mov dword [esi + 0xac], 7
mov dword [esi + 0xa8], 3
xorps xmm0, xmm0
mov dword [esi + 0xc4], 7
mov dword [esi + 0xc0], 4
mov dword [esi + 0xb4], 0x540055
mov dword [esi + 0xb0], 0x4f005f
mov word [esi + 0xb8], 0
mov dword [esi + 0x1e8], 0xe
movaps xmmword [esi + 0x1c0], xmm0
movaps xmmword [esi + 0x1b0], xmm0
movaps xmmword [esi + 0x1a0], xmm0
movaps xmmword [esi + 0x190], xmm0
mov dword [esi + 0x98], eax
movzx eax, word [0x6603d4]
mov word [esi + 0x9c], ax
mov eax, dword [0x6d1ebc]
mov word [esi + 0x9e], 0
mov dword [esi + 8], eax
add eax, 8
mov dword [esi], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x70]
mov dword [esi + 0x1e8], 0
mov dword [esi + 8], eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi + 0x1e8], 0xe
lea eax, [esi + 0x190]
push 0xa
push 0x20
push eax
push dword [esi + 8]
call fcn.00628435
add esp, 0x10
mov ebx, dword [esi + 0x80]
cmp dword [esi + 0x84], 7
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
jbe 0x4c4997
mov eax, dword [esi + 0x70]
mov dword [esi + 4], eax
cmp ebx, 7
lea edi, [esi + 0x190]
ja 0x4c49bf
mov eax, dword [esi + 4]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, 7
movsd qword [esi + 0x30], xmm1
movsd qword [esi + 0x28], xmm0
jmp 0x4c4a32
mov edx, ebx
mov ecx, 0x7ffffffe
mov dword [esi], ebx
or edx, 7
cmp edx, 0x7ffffffe
mov dword [esi + 8], edx
cmovb ecx, edx
lea eax, [ecx + ecx]
cmp ecx, 0x7ff
jb 0x4c4a07
cmp ecx, 0x7fffffee
jae 0x4c569d
add eax, 0x25
push eax
call fcn.005d0220
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4c4a13
add eax, 2
push eax
call fcn.005d0220
add esp, 4
mov ebx, dword [esi]
mov dword [esi + 0x28], eax
lea ecx, [ebx + ebx + 2]
push ecx
push dword [esi + 4]
push eax
call fcn.0061e340
add esp, 0xc
mov eax, dword [esi + 8]
lea edi, [esi + 0x190]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
push edi
mov edi, eax
call fcn.005d3244
add esp, 4
mov ecx, edi
sub ecx, ebx
cmp ecx, eax
jae 0x4c4a7d
mov dword [esi + 0x1e8], 0xf
sub esp, 0x10
mov cl, byte [esi + 0xd0]
mov byte [esp + 4], cl
lea ecx, [esi + 0x190]
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], ecx
lea ecx, [esi + 0x28]
call fcn.0040b010
jmp 0x4c4ab0
mov edx, edi
lea edi, [eax + ebx]
mov ecx, ebx
cmp edx, 7
mov dword [esi + 0x38], edi
je 0x4c4a91
mov ebx, dword [esi + 0x28]
jmp 0x4c4a94
lea ebx, [esi + 0x28]
add eax, eax
lea ecx, [ebx + ecx*2]
push eax
lea eax, [esi + 0x190]
push eax
push ecx
call fcn.0061e340
add esp, 0xc
mov word [ebx + edi*2], 0
mov eax, dword [esi + 0xc0]
cmp dword [esi + 0xc4], 7
jbe 0x4c4ac7
mov ecx, dword [esi + 0xb0]
jmp 0x4c4acd
lea ecx, [esi + 0xb0]
mov ebx, dword [esi + 0x3c]
mov edx, dword [esi + 0x38]
mov edi, ebx
sub edi, edx
cmp edi, eax
jae 0x4c4b07
mov dword [esi + 0x1e8], 0xf
sub esp, 0x10
mov dl, byte [esi + 0xd0]
mov byte [esp + 4], dl
mov dword [esp + 8], ecx
lea ecx, [esi + 0x28]
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.0040b010
jmp 0x4c4b30
lea edi, [edx + eax]
cmp ebx, 7
mov dword [esi + 0x38], edi
jbe 0x4c4b17
mov ebx, dword [esi + 0x28]
jmp 0x4c4b1a
lea ebx, [esi + 0x28]
add eax, eax
lea edx, [ebx + edx*2]
push eax
push ecx
push edx
call fcn.0061e340
add esp, 0xc
mov word [ebx + edi*2], 0
mov ebx, dword [esi + 0x80]
cmp dword [esi + 0x84], 7
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
jbe 0x4c4b52
mov eax, dword [esi + 0x70]
jmp 0x4c4b55
lea eax, [esi + 0x70]
lea edi, [esi + 0x190]
cmp ebx, 7
ja 0x4c4b7d
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, 7
movsd qword [esi + 0x18], xmm1
movsd qword [esi + 0x10], xmm0
jmp 0x4c4c07
mov edx, ebx
mov ecx, 0x7ffffffe
mov dword [esi + 8], eax
mov dword [esi + 4], ebx
or edx, 7
cmp edx, 0x7ffffffe
mov dword [esi], edx
cmovb ecx, edx
lea eax, [ecx + ecx]
cmp ecx, 0x7ff
jb 0x4c4bd2
cmp ecx, 0x7fffffee
mov dword [esi + 0x1e8], 0xf
jae 0x4c56a2
add eax, 0x25
push eax
call fcn.005d0220
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4c4be8
add eax, 2
mov dword [esi + 0x1e8], 0xf
push eax
call fcn.005d0220
add esp, 4
mov ebx, dword [esi + 4]
mov dword [esi + 0x10], eax
lea ecx, [ebx + ebx + 2]
push ecx
push dword [esi + 8]
push eax
call fcn.0061e340
add esp, 0xc
mov eax, dword [esi]
lea edi, [esi + 0x190]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
push edi
mov edi, eax
call fcn.005d3244
add esp, 4
mov ecx, edi
sub ecx, ebx
cmp ecx, eax
jae 0x4c4c52
mov dword [esi + 0x1e8], 0x10
sub esp, 0x10
mov cl, byte [esi + 0xd0]
mov byte [esp + 4], cl
lea ecx, [esi + 0x190]
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], ecx
lea ecx, [esi + 0x10]
call fcn.0040b010
jmp 0x4c4c85
mov edx, edi
lea edi, [eax + ebx]
mov ecx, ebx
cmp edx, 7
mov dword [esi + 0x20], edi
je 0x4c4c66
mov ebx, dword [esi + 0x10]
jmp 0x4c4c69
lea ebx, [esi + 0x10]
add eax, eax
lea ecx, [ebx + ecx*2]
push eax
lea eax, [esi + 0x190]
push eax
push ecx
call fcn.0061e340
add esp, 0xc
mov word [ebx + edi*2], 0
mov eax, dword [esi + 0xa8]
cmp dword [esi + 0xac], 7
jbe 0x4c4c9c
mov ecx, dword [esi + 0x98]
jmp 0x4c4ca2
lea ecx, [esi + 0x98]
mov ebx, dword [esi + 0x24]
mov edx, dword [esi + 0x20]
mov edi, ebx
sub edi, edx
cmp edi, eax
jae 0x4c4cdc
mov dword [esi + 0x1e8], 0x10
sub esp, 0x10
mov dl, byte [esi + 0xd0]
mov byte [esp + 4], dl
mov dword [esp + 8], ecx
lea ecx, [esi + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.0040b010
jmp 0x4c4d05
lea edi, [edx + eax]
cmp ebx, 7
mov dword [esi + 0x20], edi
jbe 0x4c4cec
mov ebx, dword [esi + 0x10]
jmp 0x4c4cef
lea ebx, [esi + 0x10]
add eax, eax
lea edx, [ebx + edx*2]
push eax
push ecx
push edx
call fcn.0061e340
add esp, 0xc
mov word [ebx + edi*2], 0
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x90], 0
mov edx, dword [eax + 0x14]
mov ecx, dword [eax]
mov ebx, dword [eax + 0x10]
mov edi, eax
cmp edx, 7
mov dword [esi + 8], edx
mov edx, dword [esi + 0x38]
mov dword [esi + 4], ebx
mov dword [esi], ecx
cmova edi, ecx
cmp edx, ebx
mov dword [esi + 0xc], edx
cmovb ebx, edx
test ebx, ebx
je 0x4c4d6f
cmp dword [esi + 0x3c], 7
jbe 0x4c4d58
mov edx, dword [esi + 0x28]
jmp 0x4c4d5b
lea edx, [esi + 0x28]
xor ecx, ecx
nop dword [eax]
movzx eax, word [edi + ecx*2]
cmp ax, word [edx + ecx*2]
jne 0x4c4d77
inc ecx
cmp ebx, ecx
jne 0x4c4d60
mov eax, dword [esi + 0xc]
cmp dword [esi + 4], eax
je 0x4c4dc1
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 4]
cmp eax, edx
mov dword [esi + 0xc], eax
cmovb edx, eax
test edx, edx
je 0x4c4db3
cmp dword [esi + 0x24], 7
jbe 0x4c4d94
mov ebx, dword [esi + 0x10]
jmp 0x4c4d97
lea ebx, [esi + 0x10]
xor ecx, ecx
nop dword [eax]
movzx eax, word [edi + ecx*2]
cmp ax, word [ebx + ecx*2]
jne 0x4c4ee5
inc ecx
cmp edx, ecx
jne 0x4c4da0
mov ecx, dword [esi + 0xc]
xor eax, eax
cmp dword [esi + 4], ecx
jne 0x4c504e
mov dword [esi + 0x58], 0
mov dword [esi + 0xe4], 7
mov dword [esi + 0xe0], 0
mov word [esi + 0xd0], 0
mov dword [esi + 0x1e8], 0x15
sub esp, 0xc
mov al, byte [esi + 0x40]
lea ecx, [esi + 0xd0]
mov byte [esp + 4], al
mov dword [esp + 8], str.S:_ML__NW___LW_
mov dword [esp], 0xf
call fcn.00405590
mov ecx, dword [esi + 0xe4]
mov eax, dword [esi + 0xe0]
mov edx, ecx
sub edx, eax
cmp edx, 3
jae 0x4c4e56
sub esp, 0x10
mov al, byte [esi + 0x40]
lea ecx, [esi + 0xd0]
mov byte [esp + 4], al
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x6603f8
mov dword [esp], 3
call fcn.0040b010
jmp 0x4c4e8c
lea edx, [eax + 3]
cmp ecx, 7
mov dword [esi + 0xe0], edx
lea edx, [esi + 0xd0]
jbe 0x4c4e70
mov edx, dword [esi + 0xd0]
movzx ecx, word [0x6603fc]
mov edi, dword [0x6603f8]
mov word [edx + eax*2 + 4], cx
mov dword [edx + eax*2], edi
mov word [edx + eax*2 + 6], 0
mov ecx, dword [esi + 0xe4]
mov eax, dword [esi + 0xe0]
mov edx, ecx
sub edx, eax
cmp edx, 0xc
jae 0x4c4ecf
sub esp, 0x10
mov al, byte [esi + 0x40]
lea ecx, [esi + 0xd0]
mov byte [esp + 4], al
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], str._A__GA___OW_
mov dword [esp], 0xc
call fcn.0040b010
jmp 0x4c4f22
lea edx, [eax + 0xc]
cmp ecx, 7
mov dword [esi + 0xe0], edx
jbe 0x4c4eec
mov ecx, dword [esi + 0xd0]
jmp 0x4c4ef2
xor eax, eax
jmp 0x4c504e
lea ecx, [esi + 0xd0]
movsd xmm0, qword [0x660410]
movsd xmm2, qword [0x660408]
movsd xmm1, qword [str._A__GA___OW_]
movsd qword [ecx + eax*2 + 0x10], xmm0
movsd qword [ecx + eax*2 + 8], xmm2
movsd qword [ecx + eax*2], xmm1
mov word [ecx + eax*2 + 0x18], 0
mov ecx, dword [esi + 0xe4]
mov eax, dword [esi + 0xe0]
mov edx, ecx
sub edx, eax
cmp edx, 0xc
jae 0x4c4f74
sub esp, 0x10
mov al, byte [esi + 0x40]
lea ecx, [esi + 0xd0]
mov byte [esp + 4], al
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], str._A__GA___AC_
mov dword [esp], 0xc
call fcn.0040b010
cmp dword [esi + 0xe4], 7
jbe 0x4c4fc9
mov eax, dword [esi + 0xd0]
jmp 0x4c4fcf
lea edx, [eax + 0xc]
cmp ecx, 7
mov dword [esi + 0xe0], edx
jbe 0x4c4f8a
mov ecx, dword [esi + 0xd0]
jmp 0x4c4f90
lea ecx, [esi + 0xd0]
movsd xmm0, qword [0x66042a]
movsd xmm2, qword [0x660422]
movsd xmm1, qword [str._A__GA___AC_]
movsd qword [ecx + eax*2 + 0x10], xmm0
movsd qword [ecx + eax*2 + 8], xmm2
movsd qword [ecx + eax*2], xmm1
mov word [ecx + eax*2 + 0x18], 0
cmp dword [esi + 0xe4], 7
ja 0x4c4f6c
lea eax, [esi + 0xd0]
lea ecx, [esi + 0x58]
push 0
push ecx
push 1
push eax
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov ecx, dword [esi + 0xe4]
mov eax, dword [esi + 0x58]
mov dword [esi + 0x88], 0xc
cmp ecx, 8
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], 0
jb 0x4c503b
mov eax, dword [esi + 0xd0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5031
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5701
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [esi + 8], eax
lea eax, [esi + 0x88]
mov dword [esi], ecx
mov edi, dword [ebp + 0x10]
mov ecx, eax
cmp dword [esi + 8], 7
mov edx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x18]
mov eax, edi
mov edi, dword [ebp + 0xc]
cmova eax, dword [esi]
mov edi, dword [edi]
mov dword [esi + 0x1e8], 0x10
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x1c]
push ecx
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push edx
push edi
push ebx
push dword [ebp + 0x14]
mov dword [esi], eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 4], eax
cmp dword [esi + 4], 0xffffffff
je 0x4c517a
mov dword [esi + 0x6c], 7
mov dword [esi + 0x68], 0
mov word [esi + 0x58], 0
sub esp, 0xc
mov al, byte [esi + 0xd0]
lea ecx, [esi + 0x58]
mov byte [esp + 4], al
mov dword [esp + 8], str._pipe_
mov dword [esp], 9
call fcn.00405590
mov eax, dword [esi + 0x68]
cmp dword [esi + 0x6c], 7
lea ecx, [esi + 0x58]
jbe 0x4c50e1
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x1e8], 0x11
push eax
push ecx
push dword [esi]
call fcn.005dcc34
add esp, 0xc
test eax, eax
je 0x4c5187
mov dword [esi + 0x1e8], 0x11
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x4c522d
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x4c5223
lea ecx, [esi + 0xd0]
push 0
push 0x3b
push str.win_src_named_pipe_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0xe0]
mov dword [esi + 0x1e8], 0x12
push str.SameObject_check_failed:
push eax
call fcn.005df800
add esp, 8
push dword [esi]
push eax
call fcn.00424400
add esp, 8
lea ecx, [esi + 0xd0]
call fcn.00424810
jmp 0x4c522d
mov edi, dword [ebp + 0x2c]
mov eax, 0xffffffff
jmp 0x4c5286
mov dword [esi + 0xe4], 7
mov dword [esi + 0xe0], 0
mov word [esi + 0xd0], 0
sub esp, 0xc
mov al, byte [esi + 0x40]
lea ecx, [esi + 0xd0]
mov byte [esp + 4], al
mov dword [esp + 8], str.DeviceNamedPipe_
mov dword [esp], 0x12
mov dword [esi + 0xc], ecx
call fcn.00405590
mov eax, dword [esi + 0x68]
mov ecx, dword [esi]
lea edi, [ecx + eax*2]
push edi
call fcn.005d3244
add esp, 4
mov edx, dword [esi + 0xe4]
mov ecx, dword [esi + 0xe0]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jae 0x4c53e4
mov dword [esi + 0x1e8], 0x13
sub esp, 0x10
mov cl, byte [esi + 0x40]
mov byte [esp + 4], cl
lea ecx, [esi + 0xd0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.0040b010
jmp 0x4c542d
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x1e8], 0x11
mov dword [esi], 0xffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x6c]
mov edi, dword [ebp + 0x2c]
cmp ecx, 8
jb 0x4c5284
mov eax, dword [esi + 0x58]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c527a
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c56f2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov eax, dword [esi]
mov dword [edi], eax
xor ebx, ebx
cmp eax, 0xffffffff
mov ecx, dword [esi + 0x24]
sete byte [esi + 4]
cmp ecx, 8
jb 0x4c52cc
mov eax, dword [esi + 0x10]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c52c2
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c56a7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x4c5307
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c52fd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c56b6
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0xac]
cmp ecx, 8
jb 0x4c5348
mov eax, dword [esi + 0x98]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c533e
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c56c5
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0xc4]
cmp ecx, 8
jb 0x4c5389
mov eax, dword [esi + 0xb0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c537f
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c56d4
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0x84]
cmp ecx, 8
jb 0x4c53c7
mov eax, dword [esi + 0x70]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c53bd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c56e3
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov al, byte [esi + 4]
mov bl, al
lea eax, [ebx + ebx*4]
mov ecx, dword [esi + 0x1e0]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0xc8], edi
lea edi, [ecx + eax]
cmp edx, 7
mov ebx, edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xe0], edi
jbe 0x4c5409
mov edx, dword [esi + 0xd0]
mov dword [esi + 0xc], edx
mov ebx, dword [esi + 0xc]
add eax, eax
lea ecx, [ebx + ecx*2]
push eax
push dword [esi + 0xc8]
push ecx
call fcn.0061e340
add esp, 0xc
mov eax, dword [esi + 0xcc]
mov word [ebx + eax*2], 0
lea eax, [esi + 0x40]
mov dword [esi + 0x54], 7
mov dword [esi + 0x50], 0
mov word [esi + 0x40], 0
mov dword [esi + 0x1e8], 0x14
push eax
push dword [esi + 4]
call fcn.0042e9e0
add esp, 8
test al, al
je 0x4c5480
cmp dword [esi + 0x50], 0
je 0x4c54fe
cmp dword [esi + 0xe4], 7
jbe 0x4c5583
mov eax, dword [esi + 0xd0]
jmp 0x4c5589
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x4c54bb
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c54b1
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5710
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0xe4]
cmp ecx, 8
jb 0x4c50ff
mov eax, dword [esi + 0xd0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5574
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jb 0x4c556d
mov dword [esi + 0x1e8], 7
call fcn.006207e0
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x4c5539
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c552f
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c573d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0xe4]
cmp ecx, 8
jb 0x4c50ff
mov eax, dword [esi + 0xd0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5574
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c574c
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
jmp 0x4c50ff
lea eax, [esi + 0xd0]
cmp dword [esi + 0x54], 7
lea ecx, [esi + 0x40]
jbe 0x4c5595
mov ecx, dword [esi + 0x40]
push eax
push ecx
call fcn.005d3f0e
add esp, 8
mov ecx, dword [esi + 0x54]
mov edi, eax
cmp ecx, 8
jb 0x4c55dc
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c55d2
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c571f
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0xe4]
cmp ecx, 8
jb 0x4c561d
mov eax, dword [esi + 0xd0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5613
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c572e
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
test edi, edi
jne 0x4c50ff
mov eax, dword [ebp + 0x14]
mov ecx, 0x100089
mov dword [esi + 0xd0], 0xffffffff
mov dword [esi + 0x1e8], 0x11
test al, 1
mov eax, 0x100000
cmove ecx, eax
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp + 0x14]
mov edi, dword [esi]
mov ecx, edx
and ecx, 0x80000
or edi, ecx
mov ecx, edi
or ecx, 0x112
test dl, 2
lea edx, [esi + 0xd0]
cmove ecx, edi
push 1
push 0
push ecx
push edx
push dword [esi + 8]
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [esi + 0xd0]
mov dword [esi], ecx
jmp 0x4c5246
call fcn.005e8c60
call fcn.005e8c60
mov dword [esi + 0x1e8], 9
call fcn.006207e0
mov dword [esi + 0x1e8], 0xa
call fcn.006207e0
mov dword [esi + 0x1e8], 0xb
call fcn.006207e0
mov dword [esi + 0x1e8], 0xc
call fcn.006207e0
mov dword [esi + 0x1e8], 0xd
call fcn.006207e0
mov dword [esi + 0x1e8], 8
call fcn.006207e0
mov dword [esi + 0x1e8], 1
call fcn.006207e0
mov dword [esi + 0x1e8], 6
call fcn.006207e0
mov dword [esi + 0x1e8], 2
call fcn.006207e0
mov dword [esi + 0x1e8], 3
call fcn.006207e0
mov dword [esi + 0x1e8], 4
call fcn.006207e0
mov dword [esi + 0x1e8], 5
call fcn.006207e0
nop dword [eax + eax]
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0xe4]
cmp ecx, 8
jb 0x4c57cd
mov eax, dword [esi + 0xd0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c57c3
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c57d2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word [eax + eax]
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x4c5867
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c585d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c586c
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0xe4]
cmp ecx, 8
jb 0x4c58cd
mov eax, dword [esi + 0xd0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c58c3
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c58ef
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 7
mov word [esi + 0xd0], 0
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x6c]
cmp ecx, 8
jb 0x4c59e7
mov eax, dword [esi + 0x58]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c59dd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c59ec
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x24]
cmp ecx, 8
jb 0x4c5ae7
mov eax, dword [esi + 0x10]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5add
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5b00
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 7
mov word [esi + 0x10], 0
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x4c5b57
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5b4d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5b70
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 7
mov word [esi + 0x28], 0
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0xac]
cmp ecx, 8
jb 0x4c5bd1
mov eax, dword [esi + 0x98]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5bc7
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5c4d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0xc4]
cmp ecx, 8
jb 0x4c5c0e
mov eax, dword [esi + 0xb0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5c04
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5c4d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0x84]
cmp ecx, 8
jb 0x4c5c48
mov eax, dword [esi + 0x70]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4c5c3e
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4c5c4d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x20
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x20
lea esi, [ebp - 0x1ec]
mov ebp, dword [esi + 0x1d8]
lea ecx, [esi + 0xd0]
call fcn.00424810
add esp, 0x20
pop ebp
ret