Function at 0x41ca32
Capabilities:
Create thread

Disassembly:
mov eax, 0x4e49ca
call fcn.004afe60
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
xor ebx, ebx
push ebx
call esi
or eax, 0x8001
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff4
mov byte [ebp - 0xd], bl
call esi
push 0xfffffffffffffff5
mov dword [0x51533c], eax
call esi
cmp dword [ebp + 8], ebx
mov dword [0x515338], eax
jne 0x41ca7f
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp + 8], eax
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004209e3
mov edi, dword [ebp + 0x10]
cmp edi, ebx
pop ecx
pop ecx
je 0x41ccd6
mov esi, 0x518e74
lea ecx, [ebp - 0x18]
call fcn.00446250
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.00429be5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043f2e0
mov edi, dword [ebp - 0x14]
push 4
push edi
push 0x4efd5c
call fcn.00440450
add esp, 0x18
test al, al
je 0x41cae4
mov ax, word [edi + 8]
call fcn.0041d35d
test al, al
jne 0x41cb05
push 5
push edi
push str._EXEC
call fcn.00440450
add esp, 0xc
test al, al
je 0x41cb75
mov ax, word [edi + 0xa]
call fcn.0041d35d
test al, al
je 0x41cb75
push 0x6592
mov ecx, esi
call fcn.004462b0
mov eax, dword [0x518e74]
push 0x6590
mov word [eax], bx
push dword [0x518e74]
push 0x2713
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [0x518e74]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
inc eax
push eax
mov ecx, esi
call fcn.004462b0
push edi
lea ecx, [ebp - 0x1c]
call fcn.00457400
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00416bbb
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0043f290
mov ecx, esi
mov byte [0x51e003], bl
call fcn.0043f290
push 4
push dword [ebp - 0x14]
push str.MAIN
call fcn.00440450
add esp, 0xc
test al, al
je 0x41cbe8
mov ecx, dword [ebp - 0x14]
add ecx, 8
xor edx, edx
mov dx, word [ecx]
mov eax, edx
call fcn.0041d35d
test al, al
jne 0x41cba7
cmp dx, 0x2a
jne 0x41cbe8
mov ax, word [ecx]
call fcn.0041d35d
mov byte [ebp + 0x13], al
lea eax, [ebp - 0x20]
push eax
mov byte [0x518de2], bl
mov dword [ebp - 0x20], ecx
call fcn.0043f2e0
cmp byte [ebp + 0x13], bl
pop ecx
je 0x41ccdb
push 3
push dword [ebp - 0x20]
push 0x4efd48
call fcn.004403f0
add esp, 0xc
test al, al
je 0x41ccdb
cmp byte [ebp - 0xd], 2
jge 0x41cc25
push 0x518dcc
mov eax, 0x10000
push eax
push 0x518e9c
push 0x41565b
push eax
push ebx
mov byte [0x518e9c], 0x11
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x41cc1f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41cc25
mov byte [0x518e9c], bl
mov al, byte [0x519154]
mov byte [0x518de0], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x415796
push 0x1000000
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateFiber]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push edi
mov dword [0x518de4], eax
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push ebx
mov ecx, 0x519150
call fcn.00430871
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4ec037
mov ecx, 0x51918c
call fcn.00446330
mov eax, dword [0x518e7c]
cmp eax, ebx
mov dword [0x519184], ebx
mov dword [0x519188], ebx
mov byte [0x51e003], bl
mov byte [0x518e9d], 0x20
je 0x41cd06
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov byte [0x5152e8], 1
mov edi, eax
mov byte [ebp - 0xd], 2
call fcn.0043f290
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004209e3
cmp edi, ebx
pop ecx
pop ecx
jne 0x41ca9c
or eax, 0xffffffff
jmp 0x41cd28
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
lea ecx, [ebp - 0x24]
call fcn.00457400
push dword [ebp - 0x24]
mov ecx, 0x519150
mov byte [ebp - 4], 2
call fcn.00437dbc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0043f290
cmp byte [0x518ff2], bl
je 0x41cd13
call fcn.0041f2d6
call fcn.0043f780
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0043f290
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10