Function at 0x41e4c1
Capabilities:
Create thread

Disassembly:
mov eax, 0x4e8c53
call fcn.004b48a0
sub esp, 0x20
push ebx
xor ebx, ebx
cmp byte [0x51c758], bl
push esi
push edi
mov byte [ebp - 0xd], bl
mov esi, 0x51cfc0
jne 0x41e4f1
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push eax
call fcn.00416ba9
jmp 0x41e4fc
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0042241d
cmp dword [ebp + 0x10], ebx
pop ecx
pop ecx
je 0x41e734
lea ecx, [ebp - 0x18]
call fcn.00449480
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
call fcn.0042b07f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00443850
mov edi, dword [ebp - 0x14]
push 4
push edi
push 0x4f4418
call fcn.004449d0
add esp, 0x18
test al, al
je 0x41e551
mov ax, word [edi + 8]
call fcn.0041ed7f
test al, al
jne 0x41e572
push 5
push edi
push str._EXEC
call fcn.004449d0
add esp, 0xc
test al, al
je 0x41e5e2
mov ax, word [edi + 0xa]
call fcn.0041ed7f
test al, al
je 0x41e5e2
push 0x6592
mov ecx, esi
call fcn.004494e0
mov eax, dword [0x51cfc0]
push 0x6590
mov word [eax], bx
push dword [0x51cfc0]
push 0x2713
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [0x51cfc0]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
inc eax
push eax
mov ecx, esi
call fcn.004494e0
push edi
lea ecx, [ebp - 0x1c]
call fcn.00456550
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00418254
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00443880
mov ecx, esi
mov byte [0x522003], bl
call fcn.00443880
push 4
push dword [ebp - 0x14]
push str.MAIN
call fcn.004449d0
add esp, 0xc
test al, al
je 0x41e655
mov ecx, dword [ebp - 0x14]
add ecx, 8
xor edx, edx
mov dx, word [ecx]
mov eax, edx
call fcn.0041ed7f
test al, al
jne 0x41e614
cmp dx, 0x2a
jne 0x41e655
mov ax, word [ecx]
call fcn.0041ed7f
mov byte [ebp + 0x13], al
lea eax, [ebp - 0x20]
push eax
mov byte [0x51c752], bl
mov dword [ebp - 0x20], ecx
call fcn.00443850
cmp byte [ebp + 0x13], bl
pop ecx
je 0x41e739
push 3
push dword [ebp - 0x20]
push 0x4f4404
call fcn.00444970
add esp, 0xc
test al, al
je 0x41e739
cmp byte [ebp - 0xd], 2
jge 0x41e692
push 0x51c73c
mov eax, 0x10000
push eax
push 0x51cfe8
push 0x416a4e
push eax
push ebx
mov byte [0x51cfe8], 0x11
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x41e68c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41e692
mov byte [0x51cfe8], bl
mov al, byte [0x51d2a4]
mov byte [0x51c750], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x416b89
push 0x1000000
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateFiber]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push edi
mov dword [0x51c754], eax
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push ebx
mov ecx, 0x51d2a0
call fcn.00432a2c
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4f004f
mov ecx, 0x51d2dc
call fcn.00449560
mov eax, dword [0x51cfc8]
cmp eax, ebx
mov dword [0x51d2d4], ebx
mov dword [0x51d2d8], ebx
mov byte [0x522003], bl
mov byte [0x51cfe9], 0x20
je 0x41e764
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov byte [0x519300], 1
mov dword [ebp + 0x10], eax
mov byte [ebp - 0xd], 2
call fcn.00443880
jmp 0x41e4f1
or eax, 0xffffffff
jmp 0x41e786
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
lea ecx, [ebp - 0x24]
call fcn.00456550
push dword [ebp - 0x24]
mov ecx, 0x51d2a0
mov byte [ebp - 4], 2
call fcn.00439fba
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00443880
cmp byte [0x51d142], bl
je 0x41e771
call fcn.00420d10
call fcn.00443d00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00443880
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10