Function at 0x10004e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x10004e5a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
add edx, 7
cmp dword [ebp - 0xc], edx
jae 0x10004ffd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x184
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0xa
ja case.0x10004e88.3
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x10005220]
call fcn.10006510
push eax
mov eax, dword [0x1001c640]
mov edx, ebp
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp case.0x10004e88.3
cmp dword [ebp - 0x14], 0
je 0x10004efc
cmp dword [ebp - 0x30], 0xb7
je 0x10004efc
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
push 0
push 0x9f
push 0
call fcn.1000a670
add esp, 0x18
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x10004ef2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x10004e88.3
cmp dword [ebp - 0x14], 0
jne 0x10004f0f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x16a
call fcn.10005d80
add esp, 4
mov dword [ebp - 0x4c], eax
jmp case.0x10004e88.3
push edi
mov ebx, ecx
mov eax, dword [0x1001c640]
mov edi, dword [0x1001c640]
mov ebp, case.0x10005177.4
cmp eax, edi
je case.0x100050bb.2
jmp case.0x10004e88.3
mov edi, edi
and esp, 0xfffffff8
push ebx
push ebp
push esi
jmp case.0x10004e88.3
test byte [eax + 0x1c], 1
je case.0x10005034.2
cmp byte [eax + 0x19], 5
jb case.0x100050bb.1
jmp case.0x10004e88.3
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
push 0
push 0x11f
call fcn.10009d40
add esp, 8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x14], 0
je case.0x10004e88.3
cmp dword [ebp - 0x30], 0xb7
je case.0x10004e88.3
push 0
push 0x1e5
push 0
push 0
call fcn.10004c60
add esp, 0x10
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne case.0x10004e88.3
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10004e51
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x1000500e
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0xc]
add eax, 5
cmp dword [ebp - 0x18], eax
jae 0x10005080
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x18b
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 4
ja case.default.0x10005034
mov eax, dword [ebp - 0x1c]
jmp dword [eax*4 + 0x1000524c]
je case.0x10004e88.8
cmp byte [eax + 0x19], 2
jb case.0x100050bb.3
jmp case.default.0x10005034
jns case.0x100050bb.4
mov eax, dword [0x1001c640]
cmp eax, edi
je case.0x10004e88.10
test byte [eax + 0x1c], 8
jmp case.default.0x10005034
call fcn.100065f0
jmp case.default.0x10005034
push 0xa
pop ecx
jmp case.default.0x10005034
mov ecx, dword [ebx + 0x44]
lea eax, [ebx + 0x34]
mov edx, dword [ecx]
push eax
call dword [edx + 0x20]
mov esi, eax
test esi, esi
jmp 0x10005005
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
jmp 0x10005091
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0xc]
sub eax, 5
cmp dword [ebp - 0x20], eax
jbe 0x10005138
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x187
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 4
ja case.default.0x100050bb
mov eax, dword [ebp - 0x24]
jmp dword [eax*4 + 0x10005260]
mov ecx, dword [ebx + 0x44]
lea eax, [ebx + 0x38]
mov edx, dword [ecx]
push eax
call dword [edx + 0xf4]
jmp case.default.0x100050bb
mov esi, eax
test esi, esi
jns case.0x100050bb.3
jmp case.default.0x100050bb
push esi
push 0x100051b0
call fcn.100091c0
push eax
mov eax, dword [0x1001c640]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
jmp case.0x100050bb.3
mov eax, dword [0x1001c640]
cmp eax, edi
je case.0x100050bb.2
test byte [eax + 0x1c], 8
je case.0x10004e88.2
cmp byte [eax + 0x19], 2
jmp case.default.0x100050bb
jb case.0x10004e88.8
push esi
push 0x100051cc
call int.100094f0
push eax
mov eax, dword [0x1001c640]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
mov edx, ebp
pop ecx
jmp 0x10005088
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
jmp 0x10005149
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0xc]
add eax, 5
cmp dword [ebp - 0x28], eax
jae 0x10005218
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x18b
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 4
ja case.default.0x10005177
mov eax, dword [ebp - 0x2c]
jmp dword [eax*4 + 0x10005274]
push 8
xor esi, esi
xor eax, eax
pop ecx
lea edi, [ebx + 0x14]
jmp case.default.0x10005177
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x14]
push eax
lea ecx, [ebx + 0x40]
call fcn.10008020
jmp case.default.0x10005177
sal byte [ebp + 0x5f], cl
inc edx
aaa
xchg ebx, eax
iretd
call fcn.10008e00
jmp case.0x10005177.0
rep stosd dword es:[edi], eax
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x28], esi
or dword [ebx + 8], 2
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x10005140
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret