Function at 0x41e540
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp + 0x14]
xor esi, esi
push ebx
sub esp, 0x7c
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x5c], eax
add eax, 8
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
nop
mov esi, 0x44b020
lea edi, [ebp - 0x51]
mov ecx, 0x2d
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476b30]
test al, al
jne 0x41e5d4
mov dword [esp], 0x476b30
call fcn.00446df0
test eax, eax
je 0x41e5d4
lea eax, [ebp - 0x51]
mov ecx, 0x479260
mov dword [esp], eax
call fcn.004311c8
push ebx
mov dword [esp], 0x447720
call fcn.00401400
mov dword [esp], 0x476b30
call fcn.00446ec0
mov ecx, 0x479260
call fcn.00431188
mov dword [esp + 0x10], 0x1ad8b78
mov dword [esp + 0x14], 0xef791
mov dword [esp + 8], 0xb8457bbc
mov dword [esp + 0xc], 0x14f63e
mov dword [esp + 4], 0x8d456c68
mov dword [esp], 0x479260
call fcn.0042dc44
nop
mov esi, 0x44b060
lea edi, [ebp - 0x51]
lea ebx, [ebp - 0x51]
mov ecx, 0x39
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476aa8]
test al, al
jne 0x41e665
mov dword [esp], 0x476aa8
call fcn.00446df0
test eax, eax
je 0x41e665
mov dword [esp], ebx
mov ecx, 0x478f00
call fcn.004312a0
push ecx
mov dword [esp], 0x447724
call fcn.00401400
mov dword [esp], 0x476aa8
call fcn.00446ec0
mov ecx, 0x478f00
call fcn.00431260
mov dword [esp + 0x14], 0xce61ba7
mov dword [esp + 0x18], 0x154e428
mov dword [esp + 0xc], 0x292bd01b
mov dword [esp + 0x10], 0x29c6
mov dword [esp + 4], 0x850e6aec
mov dword [esp + 8], 0xe57
mov dword [esp], 0x478f00
call fcn.0042dc44
mov word [ebp - 0x51], 0x31af
mov al, byte [0x476ae8]
test al, al
jne 0x41e6f0
mov dword [esp], 0x476ae8
call fcn.00446df0
test eax, eax
je 0x41e6f0
mov dword [esp], ebx
mov ecx, 0x479084
call fcn.00431170
push edx
mov dword [esp], 0x447728
call fcn.00401400
mov dword [esp], 0x476ae8
call fcn.00446ec0
mov ecx, 0x479084
call fcn.00431130
mov dword [esp], 0x479084
call sub.msvcrt.dll_atoi
cmp eax, dword [0x4819b8]
jne 0x41e717
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x28]
add eax, dword [ebp + 0x14]
mov dword [edx + 0xb0], eax
nop
mov esi, 0x44b020
mov ecx, 0x2d
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476af0]
test al, al
jne 0x41e777
mov dword [esp], 0x476af0
call fcn.00446df0
test eax, eax
je 0x41e777
mov dword [esp], ebx
mov ecx, 0x4790a0
call fcn.004311c8
push eax
mov dword [esp], 0x44772c
call fcn.00401400
mov dword [esp], 0x476af0
call fcn.00446ec0
mov ecx, 0x4790a0
call fcn.00431188
mov dword [esp + 0x10], 0x1ad8b7a
mov dword [esp + 0x14], 0xef791
mov dword [esp + 8], 0x8599b4a4
mov dword [esp + 0xc], 0x1606fe
mov dword [esp + 4], 0xa1b6ec10
mov dword [esp], 0x4790a0
call fcn.0042dc44
nop
mov esi, 0x44b060
mov ecx, 0x39
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476af8]
test al, al
jne 0x41e804
mov dword [esp], 0x476af8
call fcn.00446df0
test eax, eax
je 0x41e804
mov dword [esp], ebx
mov ecx, 0x4790e0
call fcn.004312a0
push eax
mov dword [esp], 0x447730
call fcn.00401400
mov dword [esp], 0x476af8
call fcn.00446ec0
mov ecx, 0x4790e0
call fcn.00431260
mov dword [esp + 0x14], 0xce61ba9
mov dword [esp + 0x18], 0x154e428
mov dword [esp + 0xc], 0xa725336
mov dword [esp + 0x10], 0x2be4
mov dword [esp + 4], 0x5f4cffb4
mov dword [esp + 8], 0xe97
mov dword [esp], 0x4790e0
call fcn.0042dc44
mov word [ebp - 0x51], 0x31af
mov al, byte [0x476b00]
test al, al
jne 0x41e88f
mov dword [esp], 0x476b00
call fcn.00446df0
test eax, eax
je 0x41e88f
mov dword [esp], ebx
mov ecx, 0x479120
call fcn.00431170
push eax
mov dword [esp], 0x447734
call fcn.00401400
mov dword [esp], 0x476b00
call fcn.00446ec0
mov ecx, 0x479120
call fcn.00431130
mov dword [esp], 0x479120
call sub.msvcrt.dll_atoi
cmp eax, dword [0x4819b8]
jne 0x41e8b6
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push eax
push eax
nop
mov esi, 0x44b020
mov ecx, 0x2d
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476b08]
test al, al
jne 0x41e91c
mov dword [esp], 0x476b08
call fcn.00446df0
test eax, eax
je 0x41e91c
mov dword [esp], ebx
mov ecx, 0x479140
call fcn.004311c8
push eax
mov dword [esp], 0x44773c
call fcn.00401400
mov dword [esp], 0x476b08
call fcn.00446ec0
mov ecx, 0x479140
call fcn.00431188
mov dword [esp + 0x10], 0x1ad8b7c
mov dword [esp + 0x14], 0xef791
mov dword [esp + 8], 0xd16d4d4c
mov dword [esp + 0xc], 0x171de3
mov dword [esp + 4], 0xb6286bb8
mov dword [esp], 0x479140
call fcn.0042dc44
nop
mov esi, 0x44b060
mov ecx, 0x39
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476b10]
test al, al
jne 0x41e9a9
mov dword [esp], 0x476b10
call fcn.00446df0
test eax, eax
je 0x41e9a9
mov dword [esp], ebx
mov ecx, 0x479180
call fcn.004312a0
push edi
mov dword [esp], 0x447740
call fcn.00401400
mov dword [esp], 0x476b10
call fcn.00446ec0
mov ecx, 0x479180
call fcn.00431260
mov dword [esp + 0x14], 0xce61bab
mov dword [esp + 0x18], 0x154e428
mov dword [esp + 0xc], 0x1052708f
mov dword [esp + 0x10], 0x2e0e
mov dword [esp + 4], 0x398b947c
mov dword [esp + 8], 0xed7
mov dword [esp], 0x479180
call fcn.0042dc44
mov word [ebp - 0x51], 0x31af
mov al, byte [0x476b18]
test al, al
jne 0x41ea34
mov dword [esp], 0x476b18
call fcn.00446df0
test eax, eax
je 0x41ea34
mov dword [esp], ebx
mov ecx, 0x4791c0
call fcn.00431170
push esi
mov dword [esp], 0x447744
call fcn.00401400
mov dword [esp], 0x476b18
call fcn.00446ec0
mov ecx, 0x4791c0
call fcn.00431130
mov dword [esp], 0x4791c0
call sub.msvcrt.dll_atoi
cmp eax, dword [0x4819b8]
jne 0x41ea5b
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ecx
nop
mov esi, 0x44b020
mov ecx, 0x2d
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476b20]
test al, al
jne 0x41eab9
mov dword [esp], 0x476b20
call fcn.00446df0
test eax, eax
je 0x41eab9
mov dword [esp], ebx
mov ecx, 0x4791e0
call fcn.004311c8
push edx
mov dword [esp], 0x447748
call fcn.00401400
mov dword [esp], 0x476b20
call fcn.00446ec0
mov ecx, 0x4791e0
call fcn.00431188
mov dword [esp + 0x10], 0x1ad8b7e
mov dword [esp + 0x14], 0xef791
mov dword [esp + 8], 0x9bc045b4
mov dword [esp + 0xc], 0x183aee
mov dword [esp + 4], 0xca99eb60
mov dword [esp], 0x4791e0
call fcn.0042dc44
nop
mov esi, 0x44b060
mov ecx, 0x39
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476b28]
test al, al
jne 0x41eb46
mov dword [esp], 0x476b28
call fcn.00446df0
test eax, eax
je 0x41eb46
mov dword [esp], ebx
mov ecx, 0x479220
call fcn.004312a0
push eax
mov dword [esp], 0x44774c
call fcn.00401400
mov dword [esp], 0x476b28
call fcn.00446ec0
mov ecx, 0x479220
call fcn.00431260
mov dword [esp + 0x14], 0xce61bad
mov dword [esp + 0x18], 0x154e428
mov dword [esp + 0xc], 0x3acc2827
mov dword [esp + 0x10], 0x3044
mov dword [esp + 4], 0x13ca2944
mov dword [esp + 8], 0xf17
mov dword [esp], 0x479220
call fcn.0042dc44
mov word [ebp - 0x51], 0x31af
mov al, byte [0x476ab0]
test al, al
jne 0x41ebd1
mov dword [esp], 0x476ab0
call fcn.00446df0
test eax, eax
je 0x41ebd1
mov dword [esp], ebx
mov ecx, 0x478f40
call fcn.00431170
push eax
mov dword [esp], 0x447750
call fcn.00401400
mov dword [esp], 0x476ab0
call fcn.00446ec0
mov ecx, 0x478f40
call fcn.00431130
mov dword [esp], 0x478f40
call sub.msvcrt.dll_atoi
cmp eax, dword [0x4819b8]
jne 0x41ebf8
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], eax
call eax
push eax
nop
mov esi, 0x44b020
mov ecx, 0x2d
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476ab8]
test al, al
jne 0x41ec5a
mov dword [esp], 0x476ab8
call fcn.00446df0
test eax, eax
je 0x41ec5a
mov dword [esp], ebx
mov ecx, 0x478f60
call fcn.004311c8
push eax
mov dword [esp], 0x447754
call fcn.00401400
mov dword [esp], 0x476ab8
call fcn.00446ec0
mov ecx, 0x478f60
call fcn.00431188
mov dword [esp + 0x10], 0x1ad8b80
mov dword [esp + 0x14], 0xef791
mov dword [esp + 8], 0xe4929ddc
mov dword [esp + 0xc], 0x195e1e
mov dword [esp + 4], 0xdf0b6b08
mov dword [esp], 0x478f60
call fcn.0042dc44
nop
mov esi, 0x44b060
mov ecx, 0x39
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476ac0]
test al, al
jne 0x41ece7
mov dword [esp], 0x476ac0
call fcn.00446df0
test eax, eax
je 0x41ece7
mov dword [esp], ebx
mov ecx, 0x478fa0
call fcn.004312a0
push eax
mov dword [esp], 0x447758
call fcn.00401400
mov dword [esp], 0x476ac0
call fcn.00446ec0
mov ecx, 0x478fa0
call fcn.00431260
mov dword [esp + 0x14], 0xce61baf
mov dword [esp + 0x18], 0x154e428
mov dword [esp + 0xc], 0x89df79fc
mov dword [esp + 0x10], 0x3286
mov dword [esp + 4], 0xee08be0c
mov dword [esp + 8], 0xf56
mov dword [esp], 0x478fa0
call fcn.0042dc44
mov word [ebp - 0x51], 0x31af
mov al, byte [0x476ac8]
test al, al
jne 0x41ed72
mov dword [esp], 0x476ac8
call fcn.00446df0
test eax, eax
je 0x41ed72
mov dword [esp], ebx
mov ecx, 0x478fe0
call fcn.00431170
push edi
mov dword [esp], 0x44775c
call fcn.00401400
mov dword [esp], 0x476ac8
call fcn.00446ec0
mov ecx, 0x478fe0
call fcn.00431130
mov dword [esp], 0x478fe0
call sub.msvcrt.dll_atoi
cmp eax, dword [0x4819b8]
jne 0x41ed99
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
push esi
nop
mov esi, 0x44b020
mov ecx, 0x2d
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476ad0]
test al, al
jne 0x41edf5
mov dword [esp], 0x476ad0
call fcn.00446df0
test eax, eax
je 0x41edf5
mov dword [esp], ebx
mov ecx, 0x479000
call fcn.004311c8
push ecx
mov dword [esp], 0x447760
call fcn.00401400
mov dword [esp], 0x476ad0
call fcn.00446ec0
mov ecx, 0x479000
call fcn.00431188
mov dword [esp + 0x10], 0x1ad8b82
mov dword [esp + 0x14], 0xef791
mov dword [esp + 8], 0xabe455c4
mov dword [esp + 0xc], 0x1a8774
mov dword [esp + 4], 0xf37ceab0
mov dword [esp], 0x479000
call fcn.0042dc44
nop
mov esi, 0x44b060
mov ecx, 0x39
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x476ad8]
test al, al
jne 0x41ee82
mov dword [esp], 0x476ad8
call fcn.00446df0
test eax, eax
je 0x41ee82
mov dword [esp], ebx
mov ecx, 0x479040
call fcn.004312a0
push edx
mov dword [esp], 0x447768
call fcn.00401400
mov dword [esp], 0x476ad8
call fcn.00446ec0
mov ecx, 0x479040
call fcn.00431260
mov dword [esp + 0x14], 0xce61bb1
mov dword [esp + 0x18], 0x154e428
mov dword [esp + 0xc], 0xfd8c6610
mov dword [esp + 0x10], 0x34d4
mov dword [esp + 4], 0xc84752d4
mov dword [esp + 8], 0xf96
mov dword [esp], 0x479040
call fcn.0042dc44
mov word [ebp - 0x51], 0x31af
mov al, byte [0x476ae0]
test al, al
jne 0x41ef0d
mov dword [esp], 0x476ae0
call fcn.00446df0
test eax, eax
je 0x41ef0d
mov dword [esp], ebx
mov ecx, 0x479080
call fcn.00431170
push eax
mov dword [esp], 0x44776c
call fcn.00401400
mov dword [esp], 0x476ae0
call fcn.00446ec0
mov ecx, 0x479080
call fcn.00431130
mov dword [esp], 0x479080
call sub.msvcrt.dll_atoi
cmp eax, dword [0x4819b8]
jne 0x41ef34
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret