Function at 0x44ff00
Capabilities:
Access peb ldr_data
Create thread
Read pipe
Write pipe

Disassembly:
push 0xffffffffffffffff
push 0x4cabc0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
push esi
push esi
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4502a9
cmp dword [esp + 0x58], esi
jne 0x4502a9
mov dword [esp + 0x20], vtable.t_mutex::t_locker.0
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], esi
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
push ecx
push 0x50d850
mov byte [esp + 0x40], 1
call fcn.00435ff0
test al, al
je 0x44ff82
mov dword [esp + 0x24], vtable.t_criticalSection.0
mov dword [esp + 0x14], 3
lea ebx, [ebx]
or edi, 0xffffffff
mov dword [esp + 0x1c], edi
mov byte [esp + 0x58], 0
call fcn.00428f90
mov esi, eax
cmp word [esi + 0x17f0], 0
lea ebp, [esi + 0x17f0]
jne 0x44ffef
push str.Local_sogoutool_pipe_multithreading_eventnew2
push 0x104
push ebp
call fcn.004a575e
add esp, 0xc
call fcn.00430640
push eax
push 0x104
push ebp
call fcn.004a58e6
add esp, 0xc
add esi, 0x49c
push esi
push 0x104
push ebp
call fcn.004a58e6
add esp, 0xc
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x20]
push eax
push ebp
push ecx
lea esi, [ebx + 0x20]
call fcn.00450d90
test al, al
je 0x4501b0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jl 0x45002d
cmp ebp, dword [esi]
jge 0x45002d
mov eax, dword [esi + 0xc]
mov edx, ebp
shl edx, 5
mov ecx, dword [eax + edx + 0x14]
mov dword [esp + 0x18], ecx
jmp 0x450031
mov dword [esp + 0x18], edi
cmp byte [esp + 0x58], 0
je 0x45009c
mov edx, dword [ebx + 8]
mov eax, dword [esp + 0x18]
push 0
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x45022f
mov eax, dword [ebx]
cmp eax, 1
jge 0x45009c
cmp dword [ebx + eax*4 + 4], edi
je 0x450070
mov ecx, dword [ebx + eax*4 + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebx]
mov dword [ebx + edx*4 + 4], edi
push 0
push 0
push ebx
push 0x4502d0
push 0
push 0
call fcn.004a5022
mov ecx, dword [ebx]
mov dword [ebx + ecx*4 + 4], eax
mov eax, dword [ebx]
add esp, 0x18
cmp dword [ebx + eax*4 + 4], 0
je 0x450195
inc eax
mov dword [ebx], eax
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [ebx + 0x1c]
push edx
call esi
lea edx, [ebp + ebp*2]
lea edi, [ebx + edx*8]
mov edx, dword [esp + 0x4c]
lea ecx, [ebp + ebp*2 + 6]
mov dword [ebx + ecx*8], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x54]
mov dword [edi + 0x34], eax
add edx, 4
mov dword [edi + 0x3c], 0
push edx
mov dword [edi + 0x40], ecx
call esi
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x48]
mov dword [edi + 0x38], eax
push esi
mov dword [edi + 0x44], ecx
call fcn.004a4b5c
mov edi, eax
add esp, 4
test edi, edi
je 0x45016c
push esi
push 0
push edi
call fcn.004a7380
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push edx
push esi
push edi
call fcn.004a5651
add esp, 0x10
test ebp, ebp
jl 0x450125
cmp ebp, dword [ebx + 0x20]
jge 0x450125
mov eax, ebp
shl eax, 5
add eax, dword [ebx + 0x2c]
jmp 0x450127
xor eax, eax
test ebp, ebp
jl 0x45013e
cmp ebp, dword [ebx + 0x20]
jge 0x45013e
mov edx, dword [ebx + 0x2c]
mov ecx, ebp
shl ecx, 5
mov ecx, dword [edx + ecx + 0x1c]
jmp 0x450140
xor ecx, ecx
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x20
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x450244
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x450244
push ebx
mov eax, ebp
call fcn.004507c0
dec dword [esp + 0x14]
test edi, edi
je 0x450185
push edi
call fcn.004a4a7f
add esp, 4
cmp dword [esp + 0x14], 0
jg 0x44ff90
jmp 0x450257
mov ecx, eax
mov dword [ebx + ecx*4 + 4], edi
lea ecx, [esp + 0x20]
call fcn.00435d10
mov edi, str._client__t_toolStuAsync::RequestToolStart__beginthreadex_Fail
call fcn.0044eb20
jmp 0x450210
mov edi, str._client__t_toolStuAsync::RequestToolStart_m_pipes.PickUpAnIdlePipe_Fail
call fcn.0044eb20
xor eax, eax
cmp dword [ebx + 0x20], eax
jle 0x4501d8
xor ecx, ecx
mov edx, dword [ebx + 0x2c]
mov edx, dword [ecx + edx + 0x18]
cmp edx, 5
jne 0x450207
inc eax
add ecx, 0x20
cmp eax, dword [ebx + 0x20]
jl 0x4501c3
mov edi, str._client__t_toolStuAsync::RequestToolStart_m_pipes.BeAllAbandoned__________________________
call fcn.0044eb20
mov esi, ebx
call fcn.0044fe00
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea eax, [ebx + 0x18]
push eax
call esi
push 0
lea ecx, [ebx + 0x10]
push ecx
call esi
push 0
add ebx, 0x14
push ebx
call esi
lea ecx, [esp + 0x20]
call fcn.00435d10
lea ecx, [esp + 0x28]
call fcn.0042c930
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.00435cc0
jmp 0x4502b3
lea ecx, [esp + 0x20]
call fcn.00435d10
mov edi, str._client__t_toolStuAsync::RequestToolStart_CreateIoCompletionPort_Fail
call fcn.0044eb20
jmp 0x450210
push edi
call fcn.004a4a7f
add esp, 4
mov edi, str._client__t_toolStuAsync::RequestToolStart_Send_OK
call fcn.0044eb20
mov eax, dword [esp + 0x24]
xor esi, esi
cmp dword [esp + 0x14], esi
jne 0x45027d
cmp eax, esi
je 0x450271
push eax
call fcn.00436110
mov dword [esp + 0x24], esi
mov edi, str._client__t_toolStuAsync::RequestToolStart_nTry0_Fail
call fcn.0044eb20
jmp 0x450210
cmp eax, esi
je 0x45028b
push eax
call fcn.00436110
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x28]
call fcn.0042c930
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.00435cc0
mov al, 1
jmp 0x4502b5
mov edi, str._client__t_toolStuAsync::RequestToolStart_m_bEverInit__false_p_eTaskType___e_agentProcessTypeTool
call fcn.0044eb20
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x20