Function at 0x406e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x27c
mov eax, dword [0x445654]
xor eax, esp
mov dword [esp + 0x278], eax
mov eax, dword [esp + 0x288]
mov ecx, dword [esp + 0x28c]
push ebp
mov ebp, dword [esp + 0x288]
push esi
mov esi, dword [esp + 0x288]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0xf], 0
test esi, esi
jne 0x406edc
or edi, 0xffffffff
cmp dword [0x445144], edi
je 0x406ec2
mov edx, dword [0x446a14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x445144], edi
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00411a73
add esp, 0x27c
ret
movzx ecx, word [esi]
mov eax, dword [0x445144]
cmp eax, ecx
je 0x406f22
or edi, 0xffffffff
cmp eax, edi
je 0x406f02
mov edx, dword [0x446a14]
push edx
mov dword [0x445144], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [esi]
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x446a14], eax
test eax, eax
je 0x406ec2
movzx ecx, word [esi]
mov dword [0x445144], ecx
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [0x446a14]
push eax
movzx eax, word [esi + 6]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x406ec2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
add esi, 8
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [0x446a00]
push 0x208
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x88]
push edx
push 0x10
mov dword [esp + 0x58], eax
lea eax, [esp + 0x4c]
push eax
push 0x83350000
push ecx
call edi
test eax, eax
je 0x4070ac
lea edx, [esp + 0x7c]
push str.DeviceTcp
push edx
call fcn.00413334
add esp, 8
test eax, eax
je 0x406fd1
lea eax, [esp + 0x7c]
push str.DeviceUdp
push eax
call fcn.00413334
add esp, 8
test eax, eax
jne 0x4070ac
cmp byte [0x446a04], 5
jae 0x407013
mov eax, dword [0x446a00]
push 0
lea ecx, [esp + 0x20]
push ecx
push 4
lea edx, [esp + 0x2c]
push edx
push 4
push esi
push 0x83350020
push eax
call edi
cmp byte [0x446a04], 5
jae 0x407013
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x407013
cmp eax, 2
jne 0x4070ac
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
push 0
push 0x1a
lea edx, [esp + 0x6c]
push edx
push 0x18
mov dword [esp + 0x48], eax
lea eax, [esp + 0x5c]
push eax
push 0x210012
push ecx
mov dword [esp + 0x78], 3
call edi
test eax, eax
je 0x40709c
lea edx, [esp + 0x7c]
push str.DeviceTcp
push edx
call fcn.00413334
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x76]
add esp, 8
neg eax
sbb eax, eax
and eax, 2
mov dword [ebp], eax
movzx eax, word [esp + 0x6c]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov dword [eax], edx
mov byte [esp + 0xf], 1
jmp 0x4070a1
mov byte [esp + 0xf], 0
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x284]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00411a73
add esp, 0x27c
ret