Function at 0x41d770
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x447ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4590c0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
mov eax, dword [0x4590c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x41d7be
mov eax, dword [eax + 4]
test eax, eax
je 0x41d7be
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call fcn.004325ba
push eax
call fcn.00431754
add esp, 8
cmp dword [edi + 0x1e0], 0
jne 0x41d925
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x1ec], 0
je 0x41d8b0
push 0x45c99c
call ebx
call fcn.00431766
cdq
mov ecx, 0x32
idiv ecx
mov esi, edx
call fcn.00431766
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x32
jle 0x41d837
mov eax, dword [0x45c8d4]
add eax, esi
mov dword [0x45c8d4], eax
cmp eax, dword [edi + 0x1f0]
jle 0x41d84d
neg esi
lea edx, [eax + esi*2]
mov dword [0x45c8d4], edx
jmp 0x41d84d
sub dword [0x45c8d4], esi
jns 0x41d84d
mov eax, dword [0x45c8d4]
lea ecx, [eax + esi*2]
mov dword [0x45c8d4], ecx
call fcn.00431766
cdq
mov ecx, 0x64
idiv ecx
mov esi, edx
call fcn.00431766
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x32
jle 0x41d88f
mov eax, dword [0x45c8e0]
add eax, esi
mov dword [0x45c8e0], eax
cmp eax, dword [edi + 0x1f4]
jle 0x41d8a5
neg esi
lea edx, [eax + esi*2]
mov dword [0x45c8e0], edx
jmp 0x41d8a5
sub dword [0x45c8e0], esi
jns 0x41d8a5
mov eax, dword [0x45c8e0]
lea ecx, [eax + esi*2]
mov dword [0x45c8e0], ecx
push 0x45c99c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
call fcn.004325af
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
add esp, 4
push 0
push 0x3e8
push eax
push ecx
call fcn.0043cea0
mov ecx, eax
movzx eax, word [esp + 0x64]
mov esi, edx
cdq
add ecx, eax
adc esi, edx
sub ecx, dword [edi + 0xa0]
sbb esi, dword [edi + 0xa4]
test esi, esi
jg 0x41d942
jl 0x41d90d
cmp ecx, 0x493e0
ja 0x41d942
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x1e0], 0
je 0x41d7e1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00430efe
mov esp, ebp
pop ebp
ret
push str.ClientClientProcess_e61cb8cd_5c3f_4a47_b775_25bf9735b36b
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x41d986
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x45c8e4]
dec ecx
mov dword [0x45c8e4], ecx
push eax
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
mov ecx, 0x44e978
call fcn.00401e30
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x41d9cb
mov eax, 0x104
lea ecx, [esp + 0x10]
call fcn.00402000
mov eax, dword [esp + 0x10]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0043169d
add esp, 8
test eax, eax
js 0x41da45
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx - 8]
jg 0x41da45
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x45045c
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.00402060
int3