Function at 0x41a2a0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4704fc
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4926cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x68], edi
mov eax, dword [0x495f74]
mov dword [ebp - 0x54], 1
test eax, eax
jne 0x41a31f
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x495f74], eax
test eax, eax
jne 0x41a31f
push str.cant_LoadLibrary_ntdll.dll
push str.FileOccupy
push 0x12d
push str.utilsFileOccupy.cpp
push 4
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
xor eax, eax
jmp 0x41a995
push str.NtQuerySystemInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x41a342
push str.cant_GetProcAddress_QuerySystemInfo
push str.FileOccupy
push 0x136
jmp 0x41a303
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x41a3c2
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0
call fcn.00403fa0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.004145d0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41a3ab
push eax
call fcn.004547da
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41a3bb
push eax
call fcn.004547da
add esp, 4
add esi, 0x14
cmp esi, edi
jne 0x41a370
mov esi, 0x1000
push esi
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
push esi
push eax
push 0x10
mov dword [ebp - 0x30], eax
call ebx
cmp eax, 0xc0000004
jne 0x41a42c
push dword [ebp - 0x30]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
push esi
push eax
push 0x10
mov dword [ebp - 0x30], eax
call ebx
cmp eax, 0xc0000004
je 0x41a3f4
mov edi, dword [ebp - 0x30]
xor eax, eax
mov ecx, dword [edi]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], eax
test ecx, ecx
je 0x41a76c
xor edx, edx
lea ebx, [edi + 4]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x4c], ebx
mov eax, edx
xor edx, edx
div ecx
mov esi, eax
cmp esi, dword [ebp - 0x5c]
je 0x41a4e5
mov eax, dword [0x4969d4]
mov dword [ebp - 0x5c], esi
test al, 1
jne 0x41a4d1
or eax, 1
mov dword [0x4969d4], eax
mov byte [ebp - 4], 2
mov dword [0x496a2c], 0
mov dword [0x496a34], 0
mov dword [0x496a40], 0
mov dword [0x496a4c], 0
mov dword [0x496a50], 0
mov dword [0x496a58], 0
call fcn.00410ba0
push 0x471f60
call fcn.00453882
add esp, 4
mov byte [ebp - 4], 0
push esi
push 0
push 0x466
push dword [0x496a2c]
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, byte [ebx + 4]
cmp al, byte [0x4965e9]
jne 0x41a74c
mov eax, dword [ebx]
cmp eax, 4
je 0x41a74c
mov edx, dword [ebp - 0x60]
inc dword [ebp - 0x48]
test edx, edx
je 0x41a511
cmp eax, edx
je 0x41a74c
push eax
push 0
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
jne 0x41a5b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x4969d0]
test al, 1
jne 0x41a580
or eax, 1
mov dword [0x4969d0], eax
mov byte [ebp - 4], 3
sub esp, 8
mov dword [0x4969ac], 0
mov dword [0x4969b0], 0
mov dword [0x4969b4], 0
call fcn.00401b40
push 0x471ef0
call fcn.00453882
add esp, 4
mov byte [ebp - 4], 0
push dword [ebx]
push esi
push str.open_process_err_errcode:__d__processid:_d
push str.FileOccupy
push 0x169
push str.utilsFileOccupy.cpp
push 0
push 0x496990
call fcn.00402130
mov eax, dword [ebx]
add esp, 0x20
mov dword [ebp - 0x60], eax
jmp 0x41a74c
push 0
push 0
push 0x2000000
push 0x496364
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, word [ebx + 6]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x41a5e1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41a74c
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x41a030
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41a618
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x496158
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x41a713
mov eax, dword [ebp - 0x44]
mov esi, eax
cmp eax, dword [ebp - 0x40]
je 0x41a713
mov eax, dword [esi]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x41a64f
cmp word [eax], 0
jne 0x41a657
mov eax, 0x481274
mov dword [ebp - 0x50], eax
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
test eax, eax
je 0x41a6b2
cmp word [eax], bx
je 0x41a6b2
mov ebx, eax
lea ecx, [ebx + 2]
jmp 0x41a680
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x41a680
sub ebx, ecx
sar ebx, 1
push ebx
lea ecx, [ebp - 0x24]
call fcn.004045c0
mov edi, dword [ebp - 0x24]
push ebx
push dword [ebp - 0x50]
push eax
push edi
call fcn.00454b08
add esp, 0x10
xor eax, eax
mov word [edi + ebx*2], ax
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 4
test edi, edi
je 0x41a6c2
cmp word [edi], 0
mov eax, edi
jne 0x41a6c7
mov eax, 0x481274
push ebx
push eax
push 0x496158
call fcn.0045552b
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x41a9b1
add esi, 0x14
mov byte [ebp - 4], al
test edi, edi
je 0x41a6f4
push edi
call fcn.004547da
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41a704
push eax
call fcn.004547da
add esp, 4
cmp esi, dword [ebp - 0x40]
jne 0x41a640
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
push dword [0x496364]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [0x496364], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x44]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x41a76c
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x58]
mov ecx, dword [edi]
inc eax
add edx, 0x64
add ebx, 0x10
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x4c], ebx
cmp eax, ecx
jb 0x41a456
mov eax, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x40]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov esi, edx
mov ecx, ebx
sub ecx, dword [ebp - 0x44]
shr esi, 0x1f
add esi, edx
mov eax, 0x66666667
imul ecx
mov eax, dword [0x4969d4]
sar edx, 3
mov edi, edx
shr edi, 0x1f
add edi, edx
test al, 1
jne 0x41a80a
or eax, 1
mov dword [0x4969d4], eax
mov byte [ebp - 4], 5
mov dword [0x496a2c], 0
mov dword [0x496a34], 0
mov dword [0x496a40], 0
mov dword [0x496a4c], 0
mov dword [0x496a50], 0
mov dword [0x496a58], 0
call fcn.00410ba0
push 0x471f60
call fcn.00453882
mov byte [ebp - 4], 0
mov eax, dword [0x4969d4]
add esp, 4
sub esi, edi
mov dword [0x4969e4], esi
test al, 1
jne 0x41a874
or eax, 1
mov dword [0x4969d4], eax
mov byte [ebp - 4], 6
mov dword [0x496a2c], 0
mov dword [0x496a34], 0
mov dword [0x496a40], 0
mov dword [0x496a4c], 0
mov dword [0x496a50], 0
mov dword [0x496a58], 0
call fcn.00410ba0
push 0x471f60
call fcn.00453882
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x4969d0]
test al, 1
jne 0x41a8c0
or eax, 1
mov dword [0x4969d0], eax
mov byte [ebp - 4], 7
sub esp, 8
mov dword [0x4969ac], 0
mov dword [0x4969b0], 0
mov dword [0x4969b4], 0
call fcn.00401b40
push 0x471ef0
call fcn.00453882
add esp, 4
mov byte [ebp - 4], 0
push dword [0x4969e4]
push dword [ebp - 0x48]
push str.has__d_file_handles__success__d
push str.FileOccupy
push 0x1b3
push str.utilsFileOccupy.cpp
push 0
push 0x496990
call fcn.00402130
add esp, 0x20
push dword [ebp - 0x30]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4969d4]
mov esi, eax
sub esi, dword [ebp - 0x38]
test cl, 1
jne 0x41a96f
or ecx, 1
mov dword [0x4969d4], ecx
mov byte [ebp - 4], 8
mov dword [0x496a2c], 0
mov dword [0x496a34], 0
mov dword [0x496a40], 0
mov dword [0x496a4c], 0
mov dword [0x496a50], 0
mov dword [0x496a58], 0
call fcn.00410ba0
push 0x471f60
call fcn.00453882
add esp, 4
mov dword [0x4969e8], esi
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x41a992
push dword [ebp - 0x38]
mov edx, ebx
push ecx
mov ecx, esi
call fcn.00410a00
push esi
call fcn.00452ca1
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x38]
mov ebx, dword [ebp - 0x40]
push esi
lea ecx, [esi + 0x14]
mov edx, ebx
call fcn.0041aad0
add esp, 8
lea esi, [ebx - 0x14]
push dword [ebp - 0x38]
mov edx, ebx
push ecx
mov ecx, esi
call fcn.00410a00
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
mov dword [ebp - 0x40], esi
push dword [0x496364]
call ebx
mov esi, dword [ebp - 0x34]
push esi
mov dword [0x496364], 0
call ebx
mov ebx, dword [ebp - 0x4c]
push dword [ebx]
push 0
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x41aa38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x41aa20
cmp word [edi], si
jne 0x41aa25
mov edi, 0x481274
push edi
push eax
push str.unlock_failed_open_process_err_errcode:__d__file_:_s
push str.FileOccupy
push 0x194
jmp 0x41aa83
push 1
push 0
push 0x2000000
push 0x496364
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, word [ebx + 6]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x41aab3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x41aa6d
cmp word [edi], 0
jne 0x41aa72
mov edi, 0x481274
push edi
push eax
push str.unlock_failed_duplicate_handle_err_errcode:__d__file:__s
push str.FileOccupy
push 0x19e
push str.utilsFileOccupy.cpp
push 4
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x20
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00404110
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x54], 0
jmp 0x41a716
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00404110
mov edi, dword [ebp - 0x30]
jmp 0x41a716