Function at 0x41c604
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x441ff0]
push ebx
push esi
xor esi, esi
cmp dword [eax], esi
push edi
je 0x41c669
push dword [0x441fec]
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x41c669
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll__mbslwr]
push dword [0x441fec]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0x14
test eax, eax
je 0x41c862
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov edi, eax
pop ecx
lea eax, [edi + 1]
push eax
push esi
push dword [0x441fd0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
xor ebx, ebx
cmp edi, esi
pop ecx
jle 0x41c6b8
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax + ebx]
push eax
call dword [sym.imp.MSVCRT.dll__ismbcspace]
test eax, eax
pop ecx
je 0x41c6b3
mov eax, dword [ebp - 0xc]
mov byte [eax + ebx], 0x2a
inc ebx
cmp ebx, edi
jl 0x41c699
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.GlobalLOG_BUFFER_READY_0D38375B_DD21_4562_9ED0_C1B93680E653
mov ebx, 0x1f0003
push esi
push ebx
call edi
cmp eax, esi
mov dword [ebp + 8], eax
je 0x41c862
push str.GlobalLOG_DATA_READY_0D38375B_DD21_4562_9ED0_C1B93680E653
push esi
push ebx
call edi
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x41c6f5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41c862
mov edi, str.GlobalLOG_BUFFER_0D38375B_DD21_4562_9ED0_C1B93680E653
push edi
push esi
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp eax, esi
mov dword [ebp - 8], eax
mov ebx, 0x1000
jne 0x41c743
push str.SeCreateGlobalPrivilege
call fcn.0041d1f0
pop ecx
push edi
push ebx
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x41c743
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 8]
jmp 0x41c860
push esi
push esi
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x41c84d
push ebx
push 8
push dword [0x441fd0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
je 0x41c846
mov eax, dword [0x441fe0]
cmp dword [eax], esi
je 0x41c7c8
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0041d1c3
pop ecx
lea eax, [ebp - 0x114]
pop ecx
push dword [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push str.:::LOGGER:::
push str._s__d__d__s__d__u___s___s
push 0xffb
push ebx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x2c
jmp 0x41c7f7
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push str.:::LOGGER:::
push str._s__d__d__s__d__u__s
push 0xffb
push ebx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x28
push dword [ebp - 0xc]
and byte [ebx + 0xffa], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [0x441fd0]
call esi
push 0x4e20
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi], eax
lea eax, [edi + 4]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push ebx
push 0
push dword [0x441fd0]
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 8]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
pop ebx
leave
ret