Function at 0x451a90
Capabilities:
Access peb ldr_data
Create thread
Read pipe
Write pipe

Disassembly:
push 0xffffffffffffffff
push 0x4b3fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
push esi
push esi
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x451e39
cmp dword [esp + 0x58], esi
jne 0x451e39
mov dword [esp + 0x20], 0x4d606c
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], esi
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
push ecx
push 0x4f7d98
mov byte [esp + 0x40], 1
call fcn.004238a0
test al, al
je 0x451b12
mov dword [esp + 0x24], 0x4f7d98
mov dword [esp + 0x14], 3
lea ebx, [ebx]
or edi, 0xffffffff
mov dword [esp + 0x1c], edi
mov byte [esp + 0x58], 0
call fcn.00419890
mov esi, eax
cmp word [esi + 0x17f0], 0
lea ebp, [esi + 0x17f0]
jne 0x451b7f
push str.Local_sogoutool_pipe_multithreading_eventnew2
push 0x104
push ebp
call fcn.0047149d
add esp, 0xc
call fcn.00423000
push eax
push 0x104
push ebp
call fcn.00471f8e
add esp, 0xc
add esi, 0x49c
push esi
push 0x104
push ebp
call fcn.00471f8e
add esp, 0xc
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x20]
push eax
push ebp
push ecx
lea esi, [ebx + 0x20]
call fcn.00452910
test al, al
je 0x451d40
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jl 0x451bbd
cmp ebp, dword [esi]
jge 0x451bbd
mov eax, dword [esi + 0xc]
mov edx, ebp
shl edx, 5
mov ecx, dword [eax + edx + 0x14]
mov dword [esp + 0x18], ecx
jmp 0x451bc1
mov dword [esp + 0x18], edi
cmp byte [esp + 0x58], 0
je 0x451c2c
mov edx, dword [ebx + 8]
mov eax, dword [esp + 0x18]
push 0
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x451dbf
mov eax, dword [ebx]
cmp eax, 1
jge 0x451c2c
cmp dword [ebx + eax*4 + 4], edi
je 0x451c00
mov ecx, dword [ebx + eax*4 + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebx]
mov dword [ebx + edx*4 + 4], edi
push 0
push 0
push ebx
push 0x451e60
push 0
push 0
call fcn.00470bba
mov ecx, dword [ebx]
mov dword [ebx + ecx*4 + 4], eax
mov eax, dword [ebx]
add esp, 0x18
cmp dword [ebx + eax*4 + 4], 0
je 0x451d25
inc eax
mov dword [ebx], eax
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [ebx + 0x1c]
push edx
call esi
lea edx, [ebp + ebp*2]
lea edi, [ebx + edx*8]
mov edx, dword [esp + 0x4c]
lea ecx, [ebp + ebp*2 + 6]
mov dword [ebx + ecx*8], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x54]
mov dword [edi + 0x34], eax
add edx, 4
mov dword [edi + 0x3c], 0
push edx
mov dword [edi + 0x40], ecx
call esi
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x48]
mov dword [edi + 0x38], eax
push esi
mov dword [edi + 0x44], ecx
call fcn.00470104
mov edi, eax
add esp, 4
test edi, edi
je 0x451cfc
push esi
push 0
push edi
call fcn.00476c30
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push edx
push esi
push edi
call fcn.004703a4
add esp, 0x10
test ebp, ebp
jl 0x451cb5
cmp ebp, dword [ebx + 0x20]
jge 0x451cb5
mov eax, ebp
shl eax, 5
add eax, dword [ebx + 0x2c]
jmp 0x451cb7
xor eax, eax
test ebp, ebp
jl 0x451cce
cmp ebp, dword [ebx + 0x20]
jge 0x451cce
mov edx, dword [ebx + 0x2c]
mov ecx, ebp
shl ecx, 5
mov ecx, dword [edx + ecx + 0x1c]
jmp 0x451cd0
xor ecx, ecx
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x20
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x451dd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x451dd4
push ebx
mov eax, ebp
call fcn.00452350
dec dword [esp + 0x14]
test edi, edi
je 0x451d15
push edi
call fcn.00470027
add esp, 4
cmp dword [esp + 0x14], 0
jg 0x451b20
jmp 0x451de7
mov ecx, eax
mov dword [ebx + ecx*4 + 4], edi
lea ecx, [esp + 0x20]
call fcn.004235c0
mov edi, str._client__t_toolStuAsync::RequestToolStart__beginthreadex_Fail
call fcn.0044f610
jmp 0x451da0
mov edi, str._client__t_toolStuAsync::RequestToolStart_m_pipes.PickUpAnIdlePipe_Fail
call fcn.0044f610
xor eax, eax
cmp dword [ebx + 0x20], eax
jle 0x451d68
xor ecx, ecx
mov edx, dword [ebx + 0x2c]
mov edx, dword [ecx + edx + 0x18]
cmp edx, 5
jne 0x451d97
inc eax
add ecx, 0x20
cmp eax, dword [ebx + 0x20]
jl 0x451d53
mov edi, str._client__t_toolStuAsync::RequestToolStart_m_pipes.BeAllAbandoned__________________________
call fcn.0044f610
mov esi, ebx
call fcn.00451990
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebx + 0x18]
push eax
call esi
push 0
lea ecx, [ebx + 0x10]
push ecx
call esi
push 0
add ebx, 0x14
push ebx
call esi
lea ecx, [esp + 0x20]
call fcn.004235c0
lea ecx, [esp + 0x28]
call fcn.0041a420
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.00423570
jmp 0x451e43
lea ecx, [esp + 0x20]
call fcn.004235c0
mov edi, str._client__t_toolStuAsync::RequestToolStart_CreateIoCompletionPort_Fail
call fcn.0044f610
jmp 0x451da0
push edi
call fcn.00470027
add esp, 4
mov edi, str._client__t_toolStuAsync::RequestToolStart_Send_OK
call fcn.0044f610
mov eax, dword [esp + 0x24]
xor esi, esi
cmp dword [esp + 0x14], esi
jne 0x451e0d
cmp eax, esi
je 0x451e01
push eax
call fcn.004239c0
mov dword [esp + 0x24], esi
mov edi, str._client__t_toolStuAsync::RequestToolStart_nTry0_Fail
call fcn.0044f610
jmp 0x451da0
cmp eax, esi
je 0x451e1b
push eax
call fcn.004239c0
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x28]
call fcn.0041a420
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.00423570
mov al, 1
jmp 0x451e45
mov edi, str._client__t_toolStuAsync::RequestToolStart_m_bEverInit__false_p_eTaskType___e_agentProcessTypeTool
call fcn.0044f610
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x20