Function at 0x40a900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446c70
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x80], ebx
mov edi, 7
mov eax, str.2345Safe.exe
lea esi, [esp + 0x58]
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
call fcn.00401625
mov eax, esi
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x84], 1
call fcn.0040f9b0
add esp, 4
mov byte [esp + 0x80], bl
cmp dword [esp + 0x70], 8
jb 0x40a994
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x80], 2
mov ebp, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
cmp ebp, eax
jbe 0x40a9ca
call fcn.00430697
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x48]
mov edi, ecx
mov dword [esp + 0x24], edi
cmp dword [esp + 0x4c], eax
mov esi, eax
jbe 0x40a9e1
call fcn.00430697
cmp edi, ebx
je 0x40a9ed
lea edx, [esp + 0x48]
cmp edi, edx
je 0x40a9f2
call fcn.00430697
cmp ebp, esi
je 0x40aa9b
cmp edi, ebx
jne 0x40aa03
call fcn.00430697
cmp ebp, dword [edi + 8]
jb 0x40aa0d
call fcn.00430697
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp], eax
je 0x40aa85
cmp ebp, dword [edi + 8]
jb 0x40aa22
call fcn.00430697
mov eax, dword [ebp]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [esp + 0x30]
cmp esi, ebx
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], eax
je 0x40aa63
mov edx, dword [esp + 0x38]
mov ecx, edi
sub ecx, esi
sub edx, esi
sar ecx, 2
sar edx, 2
cmp ecx, edx
jae 0x40aa63
mov ecx, edi
add ecx, 4
mov dword [edi], eax
mov dword [esp + 0x34], ecx
jmp 0x40aa81
cmp esi, edi
jbe 0x40aa6c
call fcn.00430697
push edi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.0040b330
mov edi, dword [esp + 0x24]
cmp ebp, dword [edi + 8]
jb 0x40aa8f
call fcn.00430697
mov eax, dword [esp + 0x50]
add ebp, 4
jmp 0x40a9d4
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x40ac12
mov ecx, dword [esp + 0x34]
sub ecx, eax
sar ecx, 2
je 0x40ac12
cmp ecx, ebx
ja 0x40aac3
call fcn.00430697
mov eax, dword [esp + 0x30]
cmp eax, ebx
jne 0x40aacb
xor ecx, ecx
jmp 0x40aad4
mov ecx, dword [esp + 0x34]
sub ecx, eax
sar ecx, 2
push 0xea60
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
je 0x40aaef
cmp eax, 0xffffffff
jne 0x40ab50
call fcn.0040c1f0
mov edi, 7
mov eax, str.2345Safe.exe
lea esi, [esp + 0x58]
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
call fcn.00401625
mov eax, esi
push eax
mov byte [esp + 0x84], 3
call fcn.0040c2d0
add esp, 4
mov byte [esp + 0x80], 2
cmp dword [esp + 0x70], 8
jb 0x40ab43
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp esi, eax
jbe 0x40ab65
call fcn.00430697
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x2c]
lea esp, [esp]
cmp dword [esp + 0x30], eax
mov ebp, eax
jbe 0x40ab81
call fcn.00430697
mov eax, dword [esp + 0x34]
cmp edi, ebx
je 0x40ab8d
lea edx, [esp + 0x2c]
cmp edi, edx
je 0x40ab96
call fcn.00430697
mov eax, dword [esp + 0x34]
cmp esi, ebp
je 0x40abc9
cmp edi, ebx
jne 0x40aba3
call fcn.00430697
cmp esi, dword [edi + 8]
jb 0x40abad
call fcn.00430697
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, dword [edi + 8]
jb 0x40abc0
call fcn.00430697
mov eax, dword [esp + 0x34]
add esi, 4
jmp 0x40ab70
cmp dword [esp + 0x30], eax
mov edi, eax
jbe 0x40abda
call fcn.00430697
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
cmp esi, eax
jbe 0x40abeb
call fcn.00430697
mov eax, dword [esp + 0x34]
cmp esi, edi
je 0x40ac12
sub eax, edi
sar eax, 2
cmp eax, ebx
lea ecx, [eax*4]
lea ebp, [ecx + esi]
jle 0x40ac0e
push ecx
push edi
push ecx
push esi
call fcn.0042fe1d
add esp, 0x10
mov dword [esp + 0x34], ebp
mov byte [esp + 0x80], 0
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x40ac2b
push eax
call fcn.0043004e
add esp, 4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x40ac53
push eax
call fcn.0043004e
add esp, 4
push ebx
push 0x12
lea ecx, [esp + 0x34]
mov edi, 7
push ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
call fcn.0040189a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
mov esi, 8
cmp eax, esi
jae 0x40ac93
lea ecx, [esp + 0x30]
push 0x24
push str.2345SafeNotify.exe
lea edx, [eax + eax]
push edx
push ecx
call fcn.0042fd93
mov eax, dword [esp + 0x40]
add esp, 0x10
cmp dword [esp + 0x44], esi
mov dword [esp + 0x40], 0x12
jae 0x40acbd
lea eax, [esp + 0x30]
mov word [eax + 0x24], bx
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x84], 4
call fcn.0040c2d0
add esp, 4
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x44], esi
jb 0x40acf7
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push ebx
mov dword [esp + 0x84], 5
push 0x11
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], bx
call fcn.0040189a
mov eax, dword [esp + 0x70]
cmp eax, esi
mov ecx, dword [esp + 0x5c]
jae 0x40ad45
lea ecx, [esp + 0x5c]
push 0x22
push str.2345SafeGuard.exe
add eax, eax
push eax
push ecx
call fcn.0042fd93
mov eax, dword [esp + 0x6c]
add esp, 0x10
cmp dword [esp + 0x70], esi
mov dword [esp + 0x6c], 0x11
jae 0x40ad6e
lea eax, [esp + 0x5c]
mov word [eax + 0x22], bx
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x84], 6
call fcn.0040f9b0
add esp, 4
mov byte [esp + 0x80], 5
cmp dword [esp + 0x70], esi
jb 0x40ada6
mov edx, dword [esp + 0x5c]
push edx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x80], 7
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
cmp esi, eax
jbe 0x40addc
call fcn.00430697
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x48]
mov ebx, ecx
mov dword [esp + 0x24], ebx
mov ebp, esi
cmp dword [esp + 0x4c], eax
mov dword [esp + 0x28], ebp
mov esi, eax
jbe 0x40adf9
call fcn.00430697
test ebx, ebx
je 0x40ae05
lea eax, [esp + 0x48]
cmp ebx, eax
je 0x40ae0a
call fcn.00430697
cmp ebp, esi
je 0x40aef1
test ebx, ebx
jne 0x40ae1b
call fcn.00430697
cmp ebp, dword [ebx + 8]
jb 0x40ae25
call fcn.00430697
mov ecx, dword [ebp]
push ecx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x18], eax
je 0x40ae67
mov edi, dword [esp + 0x38]
mov esi, edx
sub esi, ecx
sub edi, ecx
sar esi, 2
sar edi, 2
cmp esi, edi
jae 0x40ae67
mov ecx, edx
add ecx, 4
mov dword [edx], eax
mov dword [esp + 0x34], ecx
jmp 0x40aedb
cmp ecx, edx
mov ebp, edx
jbe 0x40ae7a
call fcn.00430697
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
test ecx, ecx
lea ebx, [esp + 0x2c]
je 0x40ae8b
mov eax, edx
sub eax, ecx
sar eax, 2
jne 0x40ae8f
xor esi, esi
jmp 0x40aea1
cmp ecx, edx
mov edi, ecx
jbe 0x40ae9a
call fcn.00430697
mov esi, ebp
sub esi, edi
sar esi, 2
push ebp
push ebx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
call fcn.0040b3f0
mov edi, dword [esp + 0x30]
cmp edi, dword [esp + 0x34]
jbe 0x40aebf
call fcn.00430697
lea eax, [edi + esi*4]
cmp eax, dword [esp + 0x34]
ja 0x40aece
cmp eax, dword [esp + 0x30]
jae 0x40aed3
call fcn.00430697
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
cmp ebp, dword [ebx + 8]
jb 0x40aee5
call fcn.00430697
mov eax, dword [esp + 0x50]
add ebp, 4
jmp 0x40ade8
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x40aff3
mov eax, dword [esp + 0x34]
sub eax, ecx
sar eax, 2
je 0x40aff3
test eax, eax
ja 0x40af15
call fcn.00430697
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x40af21
xor eax, eax
jmp 0x40af2a
mov eax, dword [esp + 0x34]
sub eax, ecx
sar eax, 2
push 0xffffffffffffffff
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp esi, eax
jbe 0x40af4b
call fcn.00430697
mov eax, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x2c]
cmp dword [esp + 0x30], eax
mov ebp, eax
jbe 0x40af66
call fcn.00430697
mov eax, dword [esp + 0x34]
test edi, edi
je 0x40af72
lea ecx, [esp + 0x2c]
cmp edi, ecx
je 0x40af7b
call fcn.00430697
mov eax, dword [esp + 0x34]
cmp esi, ebp
je 0x40afaa
test edi, edi
jne 0x40af88
call fcn.00430697
cmp esi, dword [edi + 8]
jb 0x40af92
call fcn.00430697
mov edx, dword [esi]
push edx
call ebx
cmp esi, dword [edi + 8]
jb 0x40afa1
call fcn.00430697
mov eax, dword [esp + 0x34]
add esi, 4
jmp 0x40af55
cmp dword [esp + 0x30], eax
mov edi, eax
jbe 0x40afbb
call fcn.00430697
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
cmp esi, eax
jbe 0x40afcc
call fcn.00430697
mov eax, dword [esp + 0x34]
cmp esi, edi
je 0x40aff3
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebp, [esi + ecx]
jle 0x40afef
push ecx
push edi
push ecx
push esi
call fcn.0042fe1d
add esp, 0x10
mov dword [esp + 0x34], ebp
mov byte [esp + 0x80], 5
mov eax, dword [esp + 0x30]
xor esi, esi
cmp eax, esi
je 0x40b00e
push eax
call fcn.0043004e
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x4c]
cmp eax, esi
je 0x40b036
push eax
call fcn.0043004e
add esp, 4
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret