Function at 0x4a8a66
Capabilities:
Create thread

Disassembly:
push 0x38
mov eax, 0x525935
call fcn.004d8abf
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [0x57d608]
xor ebx, ebx
test eax, eax
je 0x4a8a89
mov byte [eax + 0xc], 1
push ecx
mov ecx, esp
push str.Slave
call fcn.00406fea
call fcn.00436a6a
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0044eb46
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ebx
push 0x100040
mov byte [0x57d391], bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x577bd0], eax
test eax, eax
jne 0x4a8b26
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x575f
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x4a8cbd
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push 2
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x577bd4
push eax
push dword [ebp + 0x10]
push dword [0x577bd0]
call ebx
test eax, eax
jne 0x4a8b87
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x5761
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 2
jmp 0x4a8b0b
call esi
push 2
push 0
push 0
push 0x577bd8
push eax
push dword [ebp + 0x14]
push dword [0x577bd0]
call ebx
test eax, eax
jne 0x4a8be1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x5763
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 3
jmp 0x4a8b0b
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x4a3e5f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x4a8c39
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x5766
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 4
jmp 0x4a8b0b
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x2c], 0x80004005
mov dword [ebp - 0x28], ebx
call fcn.0040687a
lea eax, [ebp + 8]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.004b4dec
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004032ed
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp byte [0x577bdc], 0
mov byte [0x57d391], 1
jne 0x4a8c9e
push dword [0x577bd8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0040687a
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.004d8a8d
ret