Function at 0x43d0d6
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create process on windows
Create process suspended
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4441a8
push 0x43f3d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffac0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x230], 0x94
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x220], 2
jne 0x43d126
mov byte [0x4482d8], 1
xor ecx, ecx
mov cl, byte [0x4482d8]
test ecx, ecx
jne 0x43d138
cli
not esp
not esp
sti
mov edx, dword [0x445048]
xor edx, dword [0x445038]
xor edx, dword [0x44506c]
and edx, 4
test edx, edx
je 0x43d158
mov byte [0x4482ae], 1
mov eax, dword [0x445048]
xor eax, dword [0x445038]
xor eax, dword [0x44506c]
and eax, 8
test eax, eax
je 0x43d177
mov byte [0x4482af], 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x44505c]
xor ecx, dword [0x445038]
xor ecx, dword [0x44504c]
add eax, ecx
mov dword [0x4482bc], eax
mov edx, dword [0x445040]
xor edx, dword [0x445058]
xor edx, dword [0x44506c]
add edx, 0xfff
shr edx, 0xc
mov dword [0x4482c4], edx
mov eax, dword [0x4482c4]
shl eax, 2
push eax
call fcn.0043e747
add esp, 4
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
mov dword [0x4482cc], ecx
mov edx, dword [0x4482c4]
shl edx, 2
push edx
call fcn.0043e747
add esp, 4
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [0x4482b4], eax
mov ecx, dword [0x4482c4]
shl ecx, 2
push ecx
call fcn.0043e747
add esp, 4
mov dword [ebp - 0x4d4], eax
mov edx, dword [ebp - 0x4d4]
mov dword [0x4482d0], edx
push 0x1000
call fcn.0043e747
add esp, 4
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [0x4482d4], eax
mov ecx, dword [0x4482c4]
shl ecx, 2
push ecx
call fcn.0043e747
add esp, 4
mov dword [ebp - 0x4dc], eax
mov edx, dword [ebp - 0x4dc]
mov dword [0x4482b0], edx
mov eax, dword [0x445060]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x19c], 0
jmp 0x43d28b
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x19c]
cmp edx, dword [0x4482c4]
jge 0x43d67a
mov eax, dword [ebp - 0x19c]
mov ecx, dword [0x4482cc]
mov dword [ecx + eax*4], 0xffffffff
mov dword [ebp - 0x50c], 0x100
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x4fc], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x508], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x504], edx
mov ecx, dword [ebp - 0x4fc]
imul ecx, dword [ebp - 0x504]
mov edx, dword [ebp - 0x500]
imul edx, dword [ebp - 0x504]
mov eax, dword [ebp - 0x4fc]
imul eax, dword [ebp - 0x508]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x50c]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x520], 0x100
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x510], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x51c], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x518], edx
mov ecx, dword [ebp - 0x510]
imul ecx, dword [ebp - 0x518]
mov edx, dword [ebp - 0x514]
imul edx, dword [ebp - 0x518]
mov eax, dword [ebp - 0x510]
imul eax, dword [ebp - 0x51c]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x520]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x534], 0x100
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x524], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x530], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x52c], edx
mov ecx, dword [ebp - 0x524]
imul ecx, dword [ebp - 0x52c]
mov edx, dword [ebp - 0x528]
imul edx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x524]
imul eax, dword [ebp - 0x530]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x534]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x548], 0x100
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x188]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x538], edx
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x544], eax
mov eax, 0x1df5e0d
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x540], edx
mov ecx, dword [ebp - 0x538]
imul ecx, dword [ebp - 0x540]
mov edx, dword [ebp - 0x53c]
imul edx, dword [ebp - 0x540]
mov eax, dword [ebp - 0x538]
imul eax, dword [ebp - 0x544]
add eax, edx
xor edx, edx
mov esi, 0x2710
div esi
mov eax, edx
imul eax, eax, 0x2710
add eax, ecx
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
add eax, 1
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
xor edx, edx
mov ecx, 0x2710
div ecx
imul eax, dword [ebp - 0x548]
xor edx, edx
mov ecx, 0x2710
div ecx
and eax, 0xff
mov dword [ebp - 0x4f4], eax
mov edx, dword [ebp - 0x4f0]
shl edx, 8
mov eax, dword [ebp - 0x4ec]
shl eax, 0x10
mov ecx, dword [ebp - 0x4f8]
shl ecx, 0x18
or ecx, eax
or ecx, edx
or ecx, dword [ebp - 0x4f4]
mov edx, dword [ebp - 0x19c]
mov eax, dword [0x4482b4]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 0x19c]
mov edx, dword [0x4482d0]
mov dword [edx + ecx*4], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [0x4482b0]
mov dword [ecx + eax*4], 0
jmp 0x43d27c
mov edx, dword [0x4482c4]
sar edx, 1
add edx, 1
mov dword [0x44542c], edx
xor eax, eax
mov al, byte [0x4482af]
test eax, eax
jne 0x43d6ab
cmp dword [0x44542c], 6
jae 0x43d6a9
mov dword [0x44542c], 6
jmp 0x43d6be
cmp dword [0x44542c], 0x12
jae 0x43d6be
mov dword [0x44542c], 0x12
push 0x445434
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x190], eax
push 0x445440
mov ecx, dword [ebp - 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x198], eax
push 0x445454
mov edx, dword [ebp - 0x190]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x288]
mov dword [0x4482b8], eax
lea ecx, [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dl, byte [0x4482dc]
mov byte [ebp - 0x498], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x497]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x4482e0]
mov byte [ebp - 0x124], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x43d789
cmp dword [ebp - 0x26c], 0
jne 0x43d789
lea edx, [ebp - 0x498]
push edx
call fcn.0043d047
add esp, 4
and eax, 0xff
test eax, eax
je 0x43d789
lea eax, [ebp - 0x498]
mov dword [ebp - 0x26c], eax
push 0x104
lea ecx, [ebp - 0x124]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43d7a8
xor al, al
jmp 0x43ded0
mov edx, dword [0x4482b8]
push edx
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x43d7e1
xor al, al
jmp 0x43ded0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x234], eax
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x234]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x394], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x394]
add eax, dword [ecx + 0x28]
mov dword [ebp - 0x194], eax
mov edx, dword [ebp - 0x194]
push edx
push 1
mov eax, dword [0x4482b8]
push eax
call fcn.0043e380
add esp, 0xc
mov ecx, dword [ebp - 0x194]
push ecx
mov edx, dword [0x4482b8]
push edx
call fcn.0043e466
add esp, 8
mov eax, dword [0x4482b8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x4482b8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
mov ecx, dword [0x4482b8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x194]
push eax
push 0
mov ecx, dword [0x4482b8]
push ecx
call fcn.0043e380
add esp, 0xc
lea edx, [ebp - 0x184]
mov dword [ebp - 0x18c], edx
mov byte [ebp - 0x1c], 1
mov eax, dword [0x4482b8]
mov ecx, dword [eax]
push ecx
call fcn.0043e444
add esp, 4
and eax, 0xff
test eax, eax
je 0x43dece
push 0x3e8
mov edx, dword [ebp - 0x18c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x43dec9
mov dword [ebp - 0x28c], 0x445468
mov eax, dword [ebp - 0x1c]
and eax, 0xff
test eax, eax
je 0x43d944
mov byte [ebp - 0x1c], 0
mov dword [ebp - 4], 0
pushf
pop ax
add ax, 0x62
add ax, 0x9e
push ax
popf
add ax, 1
mov dword [ebp - 4], 0xffffffff
jmp 0x43d944
mov ecx, dword [ebp - 0x18c]
mov edx, dword [0x4482b8]
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 8]
jne 0x43deaa
mov dword [ebp - 0x49c], 0x80010001
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx], 1
jne 0x43dc79
mov dword [ebp - 0x28c], 0x445470
xor edx, edx
mov dl, byte [0x4482ae]
test edx, edx
je 0x43da6f
mov eax, dword [ebp - 0x18c]
cmp dword [eax + 0xc], 0x80000001
jne 0x43da6f
mov dword [ebp - 0x28c], 0x445488
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x4a4], edx
mov eax, dword [ebp - 0x4a4]
sub eax, dword [0x4482bc]
shr eax, 0xc
mov dword [ebp - 0x4a0], eax
xor ecx, ecx
mov cl, byte [0x4482af]
test ecx, ecx
je 0x43da22
mov edx, dword [ebp - 0x4a0]
sub edx, 1
test edx, edx
jl 0x43d9fd
push 1
mov eax, dword [ebp - 0x4a0]
sub eax, 1
push eax
call fcn.0043dee1
add esp, 8
mov ecx, dword [ebp - 0x4a0]
add ecx, 1
cmp ecx, dword [0x4482c4]
jge 0x43da22
push 1
mov edx, dword [ebp - 0x4a0]
add edx, 1
push edx
call fcn.0043dee1
add esp, 8
cmp dword [ebp - 0x4a0], 0
jl 0x43da6a
mov eax, dword [ebp - 0x4a0]
cmp eax, dword [0x4482c4]
jge 0x43da6a
mov ecx, dword [ebp - 0x1c]
and ecx, 0xff
test ecx, ecx
je 0x43da60
push 0
mov edx, dword [ebp - 0x4a0]
push edx
call fcn.0043dee1
add esp, 8
and eax, 0xff
test eax, eax
je 0x43da6a
mov dword [ebp - 0x49c], 0x10002
jmp 0x43dc74
mov eax, dword [ebp - 0x18c]
cmp dword [eax + 0xc], 0xc0000005
jne 0x43dc2b
mov dword [ebp - 0x28c], 0x4454c0
mov byte [ebp - 0x4a8], 0
xor ecx, ecx
mov cl, byte [0x4482d8]
test ecx, ecx
jne 0x43db8b
xor edx, edx
mov dl, byte [0x4482ae]
test edx, edx
je 0x43db8b
mov eax, dword [ebp - 0x1c]
and eax, 0xff
test eax, eax
je 0x43db8b
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x4b0], edx
mov eax, dword [ebp - 0x4b0]
sub eax, dword [0x4482bc]
shr eax, 0xc
mov dword [ebp - 0x4ac], eax
xor ecx, ecx
mov cl, byte [0x4482af]
test ecx, ecx
je 0x43db39
mov edx, dword [ebp - 0x4ac]
sub edx, 1
test edx, edx
jl 0x43db14
push 1
mov eax, dword [ebp - 0x4ac]
sub eax, 1
push eax
call fcn.0043dee1
add esp, 8
mov ecx, dword [ebp - 0x4ac]
add ecx, 1
cmp ecx, dword [0x4482c4]
jge 0x43db39
push 1
mov edx, dword [ebp - 0x4ac]
add edx, 1
push edx
call fcn.0043dee1
add esp, 8
cmp dword [ebp - 0x4ac], 0
jl 0x43db76
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [0x4482c4]
jge 0x43db76
push 0
mov ecx, dword [ebp - 0x4ac]
push ecx
call fcn.0043dee1
add esp, 8
and eax, 0xff
test eax, eax
je 0x43db76
mov dword [ebp - 0x49c], 0x10002
jmp 0x43db89
mov edx, dword [ebp - 0x18c]
cmp dword [edx + 0x5c], 0
jne 0x43db89
mov byte [ebp - 0x4a8], 1
jmp 0x43db9e
mov eax, dword [ebp - 0x18c]
cmp dword [eax + 0x5c], 0
jne 0x43db9e
mov byte [ebp - 0x4a8], 1
mov ecx, dword [ebp - 0x4a8]
and ecx, 0xff
test ecx, ecx
je 0x43dc29
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x4bc], eax
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x4b4], edx
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
cmp dword [eax + 0x20], 0
setne cl
mov byte [ebp - 0x4b8], cl
mov edx, dword [ebp - 0x4b8]
and edx, 0xff
test edx, edx
je 0x43dbfd
mov dword [ebp - 0x54c], 0x4454d4
jmp 0x43dc07
mov dword [ebp - 0x54c], 0x4454e0
mov eax, dword [ebp - 0x4b4]
push eax
mov ecx, dword [ebp - 0x54c]
push ecx
mov edx, dword [ebp - 0x4bc]
push edx
push 0x4454ec
call fcn.0043e621
add esp, 0x10
jmp 0x43dc74
mov dword [ebp - 0x28c], 0x445538
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x4c0], ecx
mov edx, dword [ebp - 0x4c0]
mov dword [ebp - 0x550], edx
cmp dword [ebp - 0x550], 0x80000003
je 0x43dc6a
cmp dword [ebp - 0x550], 0xc0000008
je 0x43dc6a
jmp 0x43dc74
mov dword [ebp - 0x49c], 0x10002
jmp 0x43de87
mov eax, dword [ebp - 0x18c]
cmp dword [eax], 2
jne 0x43dcac
mov dword [ebp - 0x28c], 0x445564
mov ecx, dword [0x445428]
add ecx, 1
mov dword [0x445428], ecx
mov dword [ebp - 0x49c], 0x10002
jmp 0x43de87
mov edx, dword [ebp - 0x18c]
cmp dword [edx], 4
jne 0x43dcdd
mov dword [ebp - 0x28c], 0x44558c
mov eax, dword [0x445428]
sub eax, 1
mov dword [0x445428], eax
mov dword [ebp - 0x49c], 0x10002
jmp 0x43de87
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx], 5
jne 0x43dd01
mov dword [ebp - 0x28c], 0x4455b0
mov dword [ebp - 0x49c], 0x10002
jmp 0x43de87
mov edx, dword [ebp - 0x18c]
cmp dword [edx], 8
jne 0x43ddde
mov dword [ebp - 0x28c], 0x4455cc
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
mov cx, word [eax + 0x12]
mov dword [ebp - 0x4c8], ecx
mov edx, dword [ebp - 0x4c8]
add edx, 2
push edx
call fcn.0043e747
add esp, 4
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x4c4], eax
push 0
mov ecx, dword [ebp - 0x4c8]
add ecx, 2
push ecx
mov edx, dword [ebp - 0x4c4]
push edx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [0x4482b8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x18c]
xor edx, edx
mov dx, word [ecx + 0x10]
test edx, edx
je 0x43dd9e
cmp dword [ebp - 0x20], 0
je 0x43dd9c
mov eax, dword [ebp - 0x4c4]
push eax
call dword [ebp - 0x20]
jmp 0x43ddb4
cmp dword [ebp - 0x198], 0
je 0x43ddb4
mov ecx, dword [ebp - 0x4c4]
push ecx
call dword [ebp - 0x198]
mov edx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4e4], edx
mov eax, dword [ebp - 0x4e4]
push eax
call fcn.0043e73c
add esp, 4
mov dword [ebp - 0x49c], 0x10002
jmp 0x43de87
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx], 9
jne 0x43ddf8
mov dword [ebp - 0x28c], 0x4455dc
jmp 0x43de87
mov edx, dword [ebp - 0x18c]
cmp dword [edx], 3
jne 0x43de7d
xor eax, eax
mov al, byte [0x445430]
test eax, eax
je 0x43de7b
mov byte [0x445430], 0
mov ecx, dword [0x445044]
xor ecx, dword [0x44504c]
push ecx
mov edx, dword [0x4482b8]
mov eax, dword [edx + 8]
push eax
push 0x4455f4
lea ecx, [ebp - 0x390]
push ecx
call fcn.0043ef1f
add esp, 0x10
lea edx, [ebp - 0x390]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43de62
xor al, al
jmp 0x43ded0
mov dword [ebp - 0x49c], 0x10002
mov eax, dword [0x4482b8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x43de87
mov dword [ebp - 0x49c], 0x10002
mov edx, dword [ebp - 0x49c]
push edx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x43dec9
push 0x10002
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x43d89f
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret