Function at 0x44379c
Capabilities:
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x28], 0
je 0x4437b8
mov eax, 1
jmp 0x443a3d
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x48], edx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x48], 0
je 0x4438b7
push 1
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc]
push ecx
push 0xa
push 0
push 0
push 2
push 0
push 0x40000003
push 0x4a8d40
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x3c], 0xffffffff
jne 0x44383a
mov ecx, dword [ebp - 0x24]
call fcn.00443e49
xor eax, eax
jmp 0x443a3d
lea ecx, [ebp - 0xc]
push ecx
push 0xa
push 0
push 0
push 2
push 0
push 0x40000003
push 0x4a8d54
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x40], 0xffffffff
jne 0x443876
mov ecx, dword [ebp - 0x24]
call fcn.00443e49
xor eax, eax
jmp 0x443a3d
lea ecx, [ebp - 0xc]
push ecx
push 0xa
push 0
push 0
push 1
push 0
push 0x40000003
push 0x4a8d68
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0xffffffff
jne 0x4438b2
mov ecx, dword [ebp - 0x24]
call fcn.00443e49
xor eax, eax
jmp 0x443a3d
jmp 0x4439a5
call fcn.00410807
test eax, eax
je 0x44391e
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x4a8d80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x44], 0xffffffff
jne 0x4438fb
mov ecx, dword [ebp - 0x24]
call fcn.00443e49
xor eax, eax
jmp 0x443a3d
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00410807
test eax, eax
je 0x44391e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x443908
call fcn.004108a4
push 1
mov ecx, 0x4b0248
call fcn.0044379c
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x4a8d98
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x3c], 0xffffffff
jne 0x44396a
mov ecx, dword [ebp - 0x24]
call fcn.00443e49
xor eax, eax
jmp 0x443a3d
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x4a8dac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0xffffffff
jne 0x4439a5
mov ecx, dword [ebp - 0x24]
call fcn.00443e49
xor eax, eax
jmp 0x443a3d
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x28], 1
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x2c], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], eax
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0x443a76
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, 1
mov esp, ebp
pop ebp
ret 4