Function at 0x41bb36
Capabilities:
Create thread
Get system information on windows

Disassembly:
push 0x50
mov eax, 0x46826c
call fcn.0045259a
xor esi, esi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
mov dword [0x49e488], esi
mov dword [0x49e48c], esi
mov dword [0x49e490], esi
mov dword [0x4d659c], esi
call fcn.0043dd77
mov eax, dword [0x4cd2ac]
xor edi, edi
inc edi
mov dword [0x4ce4ec], edi
cmp eax, edi
jl 0x41bb88
mov dword [0x4ce4ec], eax
cmp eax, esi
jne 0x41bba2
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemInfo]
mov eax, dword [ebp - 0x48]
cmp eax, edi
jbe 0x41bba2
mov dword [0x4ce4ec], eax
mov eax, dword [0x4ce4ec]
cmp eax, 8
jle 0x41bbb4
push 8
pop eax
mov dword [0x4ce4ec], eax
add dword [0x4cd288], eax
push 0x30
call fcn.004520a2
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x41bbe0
push str.snapshotreaderQ
push dword [0x4cd288]
mov ecx, eax
call fcn.004287d3
jmp 0x41bbe2
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x30
mov dword [0x4ce4d8], eax
call fcn.004520a2
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edi
cmp eax, esi
je 0x41bc11
push str.snapshotwriterQ
push dword [0x4cd288]
mov ecx, eax
call fcn.004287d3
jmp 0x41bc13
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x30
mov dword [0x4ce0dc], eax
call fcn.004520a2
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 2
cmp eax, esi
je 0x41bc46
push str.snapshotfreeMemQ
push dword [0x4cd288]
mov ecx, eax
call fcn.004287d3
jmp 0x41bc48
xor eax, eax
mov esi, dword [0x4cd288]
or dword [ebp - 4], 0xffffffff
mov dword [0x4ce4d4], eax
mov eax, esi
shl eax, 2
push eax
call fcn.00452122
mov ebx, eax
xor edi, edi
pop ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jle 0x41bc91
lea eax, [ebp - 0x18]
push eax
call fcn.0043de8f
push dword [ebp - 0x18]
mov ecx, dword [0x4ce4d4]
mov dword [ebx + edi*4], eax
call fcn.0042888a
inc edi
cmp edi, dword [0x4cd288]
jl 0x41bc6e
xor esi, esi
cmp dword [0x4ce4ec], esi
jle 0x41bcb5
mov ecx, dword [0x4ce4d4]
push 0xffffffffffffffff
call fcn.004288ce
mov dword [ebp + esi*4 - 0x38], eax
inc esi
cmp esi, dword [0x4ce4ec]
jl 0x41bc9b
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
mov edi, dword [ebp + 8]
mov dword [edi + 0x3c8], eax
cmp byte [0x4cd33c], 0
je 0x41bce3
push 0x4cd33c
call fcn.0041fe68
cmp eax, 5
jne 0x41bce3
mov byte [0x4cd33c], 0
xor esi, esi
cmp dword [0x4cd314], esi
je 0x41bd06
push edi
call fcn.00418984
test eax, eax
jns 0x41bd06
mov dword [0x4d659c], 1
jmp 0x41bf63
mov eax, dword [edi + 0x19c]
inc eax
push eax
mov eax, dword [edi + 0x198]
inc eax
push eax
push str.Copying_data_for_Drive_HD_u:_u
push 0x3f6
call fcn.00447f71
push edi
push esi
push 0x41ace4
call fcn.0045552f
push edi
push esi
push 0x42dc70
mov dword [0x4ce4d0], eax
call fcn.0045552f
mov esi, dword [sym.imp.___total_physical_size__lu_MB_SetThreadPriority]
add esp, 0x28
push 2
push dword [0x4ce4d0]
mov dword [0x4ce0d8], eax
call esi
push 2
push dword [0x4ce0d8]
call esi
call dword [sym.imp.___total_physical_size__lu_MB_GetCurrentThread]
push 0xfffffffffffffffe
push eax
mov dword [ebp - 0x58], eax
call esi
xor ebx, ebx
inc ebx
cmp ebx, dword [0x4ce4ec]
jge 0x41bdb9
push dword [ebp + ebx*4 - 0x38]
push 0
push fcn.0042d7b3
call fcn.0045552f
add esp, 0xc
mov dword [ebp + ebx*4 - 0x58], eax
cmp eax, 0xffffffff
jne 0x41bdae
push ebx
push str.Thread_start__d_failed_n
call fcn.00450f5c
dec dword [0x4ce4ec]
pop ecx
pop ecx
jmp 0x41bdb3
push 0xfffffffffffffffe
push eax
call esi
inc ebx
cmp ebx, 8
jl 0x41bd75
push dword [ebp - 0x38]
call fcn.0042d7b3
pop ecx
xor ebx, ebx
push ebx
push dword [ebp - 0x58]
call esi
cmp dword [0x49e488], ebx
jne 0x41bde3
push 0x1388
push dword [0x4ce4d0]
call dword [sym.imp.___total_physical_size__lu_MB_WaitForSingleObject]
xor esi, esi
cmp dword [0x4ce4ec], ebx
mov ebx, dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
je 0x41be39
inc esi
cmp esi, 0x78
jg 0x41be0f
push 0x1f4
call dword [sym.imp.___total_physical_size__lu_MB_Sleep]
cmp dword [0x4ce4ec], 0
jne 0x41bdf3
jmp 0x41be39
push dword [0x4ce4ec]
push str._d_thread_s__seems_to_be_dead._nOperation_aborted
call ebx
push eax
push 0x36f
push str.LINUXCPPART2FILE
call fcn.0044dc85
add esp, 0x14
mov dword [0x4d659c], 1
mov ecx, dword [0x4ce0dc]
push 0
call fcn.0042888a
jmp 0x41be7a
mov esi, dword [edi + 0x3a4]
push 0x7530
push dword [0x4ce0d8]
call dword [sym.imp.___total_physical_size__lu_MB_WaitForSingleObject]
test eax, eax
je 0x41bea9
cmp esi, dword [edi + 0x3a4]
jne 0x41be70
inc dword [ebp - 0x10]
jmp 0x41be74
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 4
je 0x41be85
cmp dword [0x4ce0d8], 0xffffffff
jne 0x41be48
jmp 0x41bea9
push str.The_writer_thread_seems_to_be_dead._nNo_data_was_written_within_the_last_2_minutes_nOperation_aborted
call ebx
push eax
push 0x388
push str.LINUXCPPART2FILE
call fcn.0044dc85
add esp, 0x10
mov dword [0x4d659c], 1
xor esi, esi
cmp dword [0x4d659c], esi
jne 0x41beb9
push edi
call fcn.0042b855
push edi
call fcn.0042b53c
call fcn.00417370
cmp dword [0x4cd288], esi
jle 0x41bee1
mov eax, dword [ebp - 0x14]
push dword [eax + esi*4]
call fcn.0045038b
inc esi
pop ecx
cmp esi, dword [0x4cd288]
jl 0x41becc
push dword [ebp - 0x14]
call fcn.0045038b
mov eax, dword [edi + 0x248]
pop ecx
test eax, eax
je 0x41bf02
push 0x8000
push 0
push eax
call dword [sym.imp.___total_physical_size__lu_MB_VirtualFree]
mov eax, dword [edi + 0x194]
cmp eax, 0xffffffff
je 0x41bf1b
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
or dword [edi + 0x194], 0xffffffff
mov ecx, dword [0x4ce4d8]
mov esi, ecx
test ecx, ecx
je 0x41bf33
call fcn.0042886a
push esi
call fcn.00452048
pop ecx
mov ecx, dword [0x4ce0dc]
mov esi, ecx
test ecx, ecx
je 0x41bf4b
call fcn.0042886a
push esi
call fcn.00452048
pop ecx
mov ecx, dword [0x4ce4d4]
mov esi, ecx
test ecx, ecx
je 0x41bf63
call fcn.0042886a
push esi
call fcn.00452048
pop ecx
call fcn.00452639
ret 4