Function at 0x414ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dd659
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x18], ebx
call fcn.00441f30
xor ebp, ebp
mov edi, 0xa
mov dword [esp + 0x24], ebp
mov dword [ebx + 0x1c], 0x4e468c
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], ebp
mov dword [ebx + 0x24], ebp
mov dword [ebx + 0x20], ebp
mov dword [ebx + 0x30], ebp
mov dword [ebx + 0x34], edi
lea ecx, [ebx + 0x3c]
mov byte [esp + 0x24], 1
call fcn.004600e0
lea esi, [ebx + 0x74]
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 4], ebp
mov dword [esi + 8], 0x11
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], edi
mov dword [ebx], 0x4e4670
xor eax, eax
cmp word [0x50eb68], bp
mov byte [esp + 0x24], 3
je 0x414c40
mov ecx, 0x50eb68
add ecx, 8
inc eax
cmp word [ecx], bp
jne 0x414c32
cmp eax, 0x11
jge 0x414c77
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x414c53
push eax
call fcn.004c4c89
add esp, 4
mov dword [esi + 4], ebp
push 0x44
call fcn.004c4c60
add esp, 4
mov edi, eax
mov ecx, 0x11
xor eax, eax
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov dword [esi + 8], 0x11
jmp 0x414d25
cmp eax, 0x1f3
jge 0x414cb5
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x414c91
push eax
call fcn.004c4c89
add esp, 4
mov dword [esi + 4], ebp
push 0x7cc
call fcn.004c4c60
add esp, 4
mov edi, eax
mov ecx, 0x1f3
xor eax, eax
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov dword [esi + 8], 0x1f3
jmp 0x414d25
cmp eax, 0x1387
mov eax, dword [esi + 4]
jge 0x414cf3
cmp eax, ebp
je 0x414ccf
push eax
call fcn.004c4c89
add esp, 4
mov dword [esi + 4], ebp
push 0x4e1c
call fcn.004c4c60
add esp, 4
mov edi, eax
mov ecx, 0x1387
xor eax, eax
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov dword [esi + 8], 0x1387
jmp 0x414d25
cmp eax, ebp
je 0x414d03
push eax
call fcn.004c4c89
add esp, 4
mov dword [esi + 4], ebp
push 0x40004
call fcn.004c4c60
add esp, 4
mov edi, eax
mov ecx, 0x10001
xor eax, eax
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov dword [esi + 8], 0x10001
cmp word [0x50eb68], bp
mov dword [esp + 0x10], ebp
mov eax, 0x50eb68
je 0x414dc1
mov dword [esp + 0x14], eax
mov di, word [eax]
mov ecx, dword [esi + 8]
mov eax, edi
xor edx, edx
and eax, 0xffff
shr eax, 4
div ecx
mov ecx, dword [esi + 4]
test ecx, ecx
mov ebp, edx
je 0x414d79
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x414d75
cmp word [eax + 8], di
je 0x414d71
mov eax, dword [eax]
test eax, eax
jne 0x414d63
jmp 0x414d75
test eax, eax
jne 0x414da2
test ecx, ecx
jne 0x414d86
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, esi
call fcn.00415900
mov ecx, esi
call fcn.00415cd0
mov dword [eax + 4], ebp
mov word [eax + 8], di
mov ecx, dword [esi + 4]
mov edx, dword [ecx + ebp*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov dword [ecx + ebp*4], eax
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x14]
add eax, 8
inc ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp word [eax], 0
jne 0x414d3f
xor ebp, ebp
push ebp
push accept
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ecx, ebx
mov dword [ebx + 0x38], eax
call fcn.00442080
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret