Function at 0x408c60
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4bc
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov byte [esp + 0xc8], bl
mov ecx, 0x3f
lea edi, [esp + 0xc9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2c8], bl
mov ecx, 0x7f
lea edi, [esp + 0x2c9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1c8], bl
mov ecx, 0x3f
lea edi, [esp + 0x1c9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
je 0x408fbe
cmp dword [ebp + 0xc], ebx
je 0x408fbe
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ecx, ecx
mov dword [esp + 0x21], ecx
mov dword [esp + 0x25], ecx
mov dword [esp + 0x29], ecx
mov dword [esp + 0x2d], ecx
mov dword [esp + 0x31], ecx
push eax
lea edx, [esp + 0x2cc]
mov word [esp + 0x39], cx
push edx
mov word [esp + 0x14], 0x20
mov byte [esp + 0x28], bl
mov byte [esp + 0x3f], cl
call esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2cc]
push ecx
call fcn.00424036
add esp, 8
push eax
lea edx, [esp + 0x1cc]
push edx
call esi
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.00424036
add esp, 8
push eax
lea ecx, [esp + 0x24]
push ecx
call esi
lea edx, [esp + 0x20]
push edx
call fcn.004083f9
add esp, 4
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xc4], eax
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x3c]
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
lea edx, [esp + 0x38]
push edx
push ebx
push 0x1f0003
call esi
mov dword [esp + 0xb0], eax
push str.StartEvnt
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xd0]
push str._s_s
push ecx
call fcn.00423fde
add esp, 0x10
lea edx, [esp + 0xc8]
push edx
push ebx
push 0x1f0003
call esi
mov dword [esp + 0xb4], eax
push str.EndEvnt
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xd0]
push str._s_s
push ecx
call fcn.00423fde
add esp, 0x10
lea edx, [esp + 0xc8]
push edx
push ebx
push 0x1f0003
call esi
cmp dword [esp + 0xb0], ebx
mov dword [esp + 0xb8], eax
je 0x408f20
cmp dword [esp + 0xb4], ebx
je 0x408f20
cmp eax, ebx
je 0x408f20
push str.FileMapName
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xd0]
push str._s_s
push ecx
call fcn.00423fde
add esp, 0x10
lea edx, [esp + 0xc8]
push edx
push ebx
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x408f20
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esp + 0xc0], eax
je 0x408f20
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x40]
push edx
push 0x408af0
push ebx
push ebx
mov dword [esp + 0xd4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push str.ServerEvnt
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xd0]
push str._s_s
push ecx
call fcn.00423fde
add esp, 0x10
lea edx, [esp + 0xc8]
push edx
push ebx
push 0x1f0003
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esp + 0xc4]
cmp eax, ebx
push 0xffffffffffffffff
jne 0x408f03
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x408f20
mov ecx, dword [esp + 0xb4]
push ebx
lea edx, [esp + 0x1c]
push edx
push 2
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esp + 0xb4]
push eax
mov dword [esp + 0xc0], ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408f51
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov eax, dword [esp + 0xb0]
cmp eax, ebx
je 0x408f68
push eax
call esi
mov eax, dword [esp + 0xb4]
cmp eax, ebx
je 0x408f76
push eax
call esi
mov eax, dword [esp + 0xb8]
cmp eax, ebx
je 0x408f84
push eax
call esi
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x408f9d
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0xc0], ebx
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x408fb2
push eax
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret