Function at 0x41d710
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x447ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4590c0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
mov eax, dword [0x4590c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x41d75e
mov eax, dword [eax + 4]
test eax, eax
je 0x41d75e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call fcn.004325fa
push eax
call fcn.00431794
add esp, 8
cmp dword [edi + 0x1e0], 0
jne 0x41d8c5
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x1ec], 0
je 0x41d850
push 0x45c99c
call ebx
call fcn.004317a6
cdq
mov ecx, 0x32
idiv ecx
mov esi, edx
call fcn.004317a6
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x32
jle 0x41d7d7
mov eax, dword [0x45c8d4]
add eax, esi
mov dword [0x45c8d4], eax
cmp eax, dword [edi + 0x1f0]
jle 0x41d7ed
neg esi
lea edx, [eax + esi*2]
mov dword [0x45c8d4], edx
jmp 0x41d7ed
sub dword [0x45c8d4], esi
jns 0x41d7ed
mov eax, dword [0x45c8d4]
lea ecx, [eax + esi*2]
mov dword [0x45c8d4], ecx
call fcn.004317a6
cdq
mov ecx, 0x64
idiv ecx
mov esi, edx
call fcn.004317a6
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x32
jle 0x41d82f
mov eax, dword [0x45c8e0]
add eax, esi
mov dword [0x45c8e0], eax
cmp eax, dword [edi + 0x1f4]
jle 0x41d845
neg esi
lea edx, [eax + esi*2]
mov dword [0x45c8e0], edx
jmp 0x41d845
sub dword [0x45c8e0], esi
jns 0x41d845
mov eax, dword [0x45c8e0]
lea ecx, [eax + esi*2]
mov dword [0x45c8e0], ecx
push 0x45c99c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
call fcn.004325ef
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
add esp, 4
push 0
push 0x3e8
push eax
push ecx
call fcn.0043ced0
mov ecx, eax
movzx eax, word [esp + 0x64]
mov esi, edx
cdq
add ecx, eax
adc esi, edx
sub ecx, dword [edi + 0xa0]
sbb esi, dword [edi + 0xa4]
test esi, esi
jg 0x41d8e2
jl 0x41d8ad
cmp ecx, 0x493e0
ja 0x41d8e2
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x1e0], 0
je 0x41d781
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00430f3e
mov esp, ebp
pop ebp
ret
push str.ClientClientProcess_e61cb8cd_5c3f_4a47_b775_25bf9735b36b
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x41d926
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x45c8e4]
dec ecx
mov dword [0x45c8e4], ecx
push eax
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
mov ecx, 0x44e978
call fcn.00401e30
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x41d96b
mov eax, 0x104
lea ecx, [esp + 0x10]
call fcn.00402000
mov eax, dword [esp + 0x10]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.004316dd
add esp, 8
test eax, eax
js 0x41d9e5
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx - 8]
jg 0x41d9e5
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x45045c
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.00402060
int3