Function at 0x420e00
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x451518
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4650c0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
mov eax, dword [0x4650c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x420e4e
mov eax, dword [eax + 4]
test eax, eax
je 0x420e4e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call fcn.0043af06
push eax
call fcn.0043a044
add esp, 8
cmp dword [edi + 0x1e0], 0
jne 0x420fb5
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x1ec], 0
je 0x420f40
push 0x468a8c
call ebx
call fcn.0043a056
cdq
mov ecx, 0x32
idiv ecx
mov esi, edx
call fcn.0043a056
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x32
jle 0x420ec7
mov eax, dword [0x4689c0]
add eax, esi
mov dword [0x4689c0], eax
cmp eax, dword [edi + 0x1f0]
jle 0x420edd
neg esi
lea edx, [eax + esi*2]
mov dword [0x4689c0], edx
jmp 0x420edd
sub dword [0x4689c0], esi
jns 0x420edd
mov eax, dword [0x4689c0]
lea ecx, [eax + esi*2]
mov dword [0x4689c0], ecx
call fcn.0043a056
cdq
mov ecx, 0x64
idiv ecx
mov esi, edx
call fcn.0043a056
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x32
jle 0x420f1f
mov eax, dword [0x4689c4]
add eax, esi
mov dword [0x4689c4], eax
cmp eax, dword [edi + 0x1f4]
jle 0x420f35
neg esi
lea edx, [eax + esi*2]
mov dword [0x4689c4], edx
jmp 0x420f35
sub dword [0x4689c4], esi
jns 0x420f35
mov eax, dword [0x4689c4]
lea ecx, [eax + esi*2]
mov dword [0x4689c4], ecx
push 0x468a8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
call fcn.0043aefb
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
add esp, 4
push 0
push 0x3e8
push eax
push ecx
call fcn.00446060
mov ecx, eax
movzx eax, word [esp + 0x64]
mov esi, edx
cdq
add ecx, eax
adc esi, edx
sub ecx, dword [edi + 0xa0]
sbb esi, dword [edi + 0xa4]
test esi, esi
jg 0x420fd2
jl 0x420f9d
cmp ecx, 0x493e0
ja 0x420fd2
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x1e0], 0
je 0x420e71
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004397ee
mov esp, ebp
pop ebp
ret
push str.ClientClientProcess_e61cb8cd_5c3f_4a47_b775_25bf9735b36b
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x421016
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x4689c8]
dec ecx
mov dword [0x4689c8], ecx
push eax
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4589e4
call fcn.00401e30
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x42105b
mov eax, 0x104
lea ecx, [esp + 0x10]
call fcn.00402000
mov eax, dword [esp + 0x10]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00439f8d
add esp, 8
test eax, eax
js 0x4210d5
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx - 8]
jg 0x4210d5
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x45a73c
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.00402060
int3