Function at 0x449a40
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create process on windows
Create thread
Execute shellcode via indirect call
Get process heap flags
Get process heap force flags
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1420
call fcn.0057e5f0
mov ecx, 0x22
mov ebx, dword fs:[0x18]
sub esp, eax
lea edi, [ebp - 0x1360]
mov eax, dword [esp + eax]
mov dword [ebp - 0x13c0], 0xc
mov dword [ebp - 0x13bc], 0
mov esi, eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x13c0]
mov dword [ebp - 0x13b8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov edi, eax
mov dword [ebp - 0x13f0], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x654
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateEvent_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp + 4], 0
add eax, 0x1f
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [esp + 0x10], edi
mov dword [esp + 8], esi
lea esi, [ebp - 0x13a0]
mov dword [esp + 0x14], 3
mov edi, esi
mov dword [esp + 0xc], str._debugger_wait
mov dword [esp + 4], str._s_s_lx__u_n
mov dword [ebp - 0x13c8], eax
mov dword [esp], eax
call fcn.00443b30
xor eax, eax
mov ecx, 0x10
lea edx, [ebp - 0x13a4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x13b4]
mov dword [ebp - 0x13a4], 0x44
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edi, dword [ebp - 0x13c8]
mov dword [esp], 0
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x65c
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateProcess_failed__last_error__lx._n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00444b30
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x65f
sub esp, 0xc
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x660
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 3
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp + 8], 0x40010001
mov eax, dword [ebp - 0x1354]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1358]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_ContinueDebugEvent]
mov dword [ebp - 0x13c8], eax
call eax
mov dword [ebp - 0x13d8], eax
sub esp, 0xc
test eax, eax
jne 0x44b871
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x663
mov dword [esp], str.Skipping_unsupported_DBG_REPLY_LATER_tests_n
call fcn.00444ad0
mov eax, dword [sym.imp.kernel32.dll_WaitForDebugEvent]
mov dword [ebp - 0x13dc], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x13cc], eax
lea edx, [ebp - 0x1360]
mov eax, 0x699
call fcn.004468e0
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x69a
call fcn.00446690
cmp dword [ebp - 0x135c], 0xffffffff
jne 0x449ccf
mov dword [esp + 0x10], 0x40
mov esi, 0xcccccccc
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov ebx, dword fs:[0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x69e
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.VirtualAllocEx_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.00444b30
mov edx, edi
lea edi, [edi + 0x400]
mov eax, esi
mov dword [ebp - 0x13d4], edi
mov ecx, 0x400
lea edi, [ebp - 0x100c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0xc0c], 0xe9909090
mov dword [ebp - 0xc08], 0xfffffff8
mov byte [ebp - 0xc0c], 0xcc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [ebp - 0x13ec], edx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WriteProcessMemory]
mov dword [ebp - 0x13e8], eax
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6a9
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
mov dword [esp + 0x18], 0
mov ecx, dword [sym.imp.kernel32.dll_CreateRemoteThread]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov edi, dword [ebp - 0x13d4]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov dword [ebp - 0x13d0], ecx
call ecx
sub esp, 0x1c
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6ac
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
lea edi, [ebp - 0x1360]
setne al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 2
mov edx, edi
mov eax, 0x6ae
call fcn.00446880
mov edx, dword [ebp - 0x1354]
mov eax, edi
call fcn.00444bd0
mov edi, eax
lea eax, [ebp - 0x1360]
mov edx, eax
mov eax, 0x6b1
call fcn.004468e0
mov edx, edi
mov eax, 0x6b2
call fcn.004455a0
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6b3
mov eax, dword [ebp - 0x1344]
mov dword [esp + 4], str.ExceptionAddress___p_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x13d4]
cmp eax, ecx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov edx, dword [ebp - 0x13ec]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6b5
mov eax, dword [edi + 0xc4]
add edx, 0x401
mov dword [ebp - 0x13e0], edx
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.unexpected_instruction_pointer__p_n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov edx, dword [ebp - 0x13ec]
mov ecx, edi
lea eax, [edx + 0x402]
mov dword [ebp - 0x13e4], eax
mov dword [esp], eax
lea eax, [ebp - 0x1360]
mov edx, eax
mov eax, 0x6b8
call fcn.00446990
mov edx, dword [ebp - 0x13ec]
mov ecx, edi
lea eax, [edx + 0x403]
mov dword [esp], eax
lea eax, [ebp - 0x1360]
mov edx, eax
mov eax, 0x6b9
call fcn.00446990
mov ecx, dword [ebp - 0x13d4]
mov eax, 0x6ba
mov dword [esp], ecx
mov ecx, edi
lea edi, [ebp - 0x1360]
mov edx, edi
lea edi, [ebp - 0x13c2]
call fcn.00446990
mov byte [ebp - 0x13c2], 0xc3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov edi, dword [ebp - 0x13d4]
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13e8]
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6be
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
lea edi, [ebp - 0x1360]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
mov edx, edi
mov ecx, 4
mov eax, 0x6c0
call fcn.00446880
lea edi, [ebp - 0x100c]
mov eax, esi
mov ecx, 0x400
rep stosd dword es:[edi], eax
lea esi, [ebp - 0x100c]
mov dword [ebp - 0xbe0], 0x40c03190
mov dword [ebp - 0xc0c], 0x448b5753
mov dword [ebp - 0xc08], 0x11b90c24
mov dword [ebp - 0xc04], 0xba111111
mov dword [ebp - 0xc00], 0x22222222
mov dword [ebp - 0xbfc], 0x333333bb
mov dword [ebp - 0xbf8], 0x4444bf33
mov dword [ebp - 0xbf4], 0x2dcd4444
mov dword [ebp - 0xbf0], 0x1f0feb
mov dword [ebp - 0xbec], 0xcebc031
mov dword [ebp - 0xbe8], 0x90909090
mov dword [ebp - 0xbe4], 0x90909090
mov dword [ebp - 0xbdd], 0xc35b5f40
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1000
mov edx, dword [ebp - 0x13ec]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13e8]
call eax
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6ca
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov edi, dword [ebp - 0x13d4]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov ecx, dword [ebp - 0x13d0]
call ecx
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6ce
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 2
lea edx, [ebp - 0x1360]
mov eax, 0x6cf
call fcn.00446880
mov ecx, 1
lea edx, [ebp - 0x1360]
mov eax, 0x6d0
call fcn.00446880
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6d0
mov eax, dword [ebp - 0x1350]
mov dword [esp + 0xc], 0x80000003
cmp eax, 0x80000003
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.ExceptionCode___lx_expected__lx_n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
lea edx, [ebp - 0x1360]
mov ecx, 4
mov eax, 0x6d1
call fcn.00446880
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov ecx, dword [ebp - 0x13d0]
call ecx
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6d5
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 2
lea edx, [ebp - 0x1360]
mov eax, 0x6d6
call fcn.00446880
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x6d7
call fcn.00446690
cmp dword [ebp - 0x135c], 1
je 0x44c212
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6da
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.unexpected_debug_event__lu_n
cmp eax, 4
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov edi, dword [ebp - 0x13d8]
test edi, edi
jne 0x44b274
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6df
mov dword [esp], str.Skipping_unsupported_DBG_REPLY_LATER_tests_n
call fcn.00444ad0
mov eax, 0xcccccccc
mov ecx, 0x400
lea edi, [ebp - 0x100c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0xc0c], 0xe9909090
mov dword [ebp - 0xc08], 0xfffffff8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x13ec]
mov edi, dword fs:[0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13e8]
call eax
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7a2
mov eax, dword [edi + 0x34]
mov dword [esp], ebx
mov ebx, 0x14
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
lea eax, [ebp - 0x12d8]
mov dword [ebp - 0x12f0], 1
mov dword [ebp - 0x13c8], eax
mov dword [ebp - 0x13d8], ebx
mov ebx, dword [ebp - 0x13d4]
lea esi, [esi]
mov eax, dword [ebp - 0x13c8]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13d0]
call eax
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7ab
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00444b30
jmp 0x44a45e
mov eax, dword [ebp - 0x12d8]
cmp dword [ebp - 0x1354], eax
je 0x44a4b1
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x7af
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7b0
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
cmp dword [ebp - 0x135c], 2
je 0x44a450
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7b2
xor eax, eax
mov dword [esp + 4], str.Unexpected_threads_start_address_n
cmp dword [ebp - 0x1348], ebx
sete al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], esi
mov eax, dword [ebp - 0x13cc]
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7b5
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00444b30
sub dword [ebp - 0x13d8], 1
jne 0x44a3d8
lea eax, [ebp - 0x13c2]
mov byte [ebp - 0x13c2], 0xcc
mov ebx, dword [ebp - 0x13d8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov esi, dword [ebp - 0x13e0]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13e8]
call eax
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7ba
mov eax, dword [edi + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
lea edx, [ebp - 0x1360]
mov eax, 0x7bc
call fcn.004468e0
mov ecx, 1
lea edx, [ebp - 0x1360]
mov eax, 0x7bd
call fcn.00446880
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7bd
mov eax, dword [ebp - 0x1350]
mov dword [esp + 0xc], 0x80000003
cmp eax, 0x80000003
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.ExceptionCode___lx_expected__lx_n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov esi, dword [ebp - 0x13e0]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7bd
mov eax, dword [ebp - 0x1344]
mov dword [esp + 0xc], esi
cmp esi, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.ExceptionAddress___p_expected__p_n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
lea ecx, [ebp - 0x1360]
mov edx, dword [ebp - 0x1354]
mov eax, ecx
call fcn.00444bd0
mov edx, eax
mov esi, eax
mov eax, 0x5eb
call fcn.004455a0
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7bd
mov eax, dword [esi + 0xc4]
mov esi, dword [ebp - 0x13e0]
mov dword [esp + 4], str.unexpected_instruction_pointer__p_expected__p_n
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
cmp dword [ebp - 0x13e4], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
lea ecx, [ebp - 0x13c2]
mov byte [ebp - 0x13c2], 0xc3
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13e8]
call eax
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7c2
mov eax, dword [edi + 0x34]
mov dword [esp], esi
mov esi, 0x14
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
mov edi, dword fs:[0x18]
call fcn.00444b30
mov dword [ebp - 0x13d8], 1
mov edx, dword [ebp - 0x12e0]
mov eax, 0x7cd
call fcn.004455a0
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7ce
mov eax, dword [ebp - 0x12e0]
mov edx, dword [eax + 0xc4]
mov eax, 1
cmp dword [ebp - 0x13e4], edx
je 0x44a765
mov eax, dword [0x8f0770]
test eax, eax
sete cl
xor eax, eax
cmp dword [ebp - 0x13d4], edx
sete al
and eax, ecx
mov ecx, dword [ebp - 0x13d4]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 4], str.unexpected_instruction_pointer2__p___p__n
call fcn.00444b30
mov dword [esp + 4], 0xa
mov eax, dword [ebp - 0x13c8]
mov dword [esp], eax
mov eax, dword [ebp - 0x13dc]
call eax
sub esp, 8
mov dword [ebp - 0x13d0], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7d3
mov eax, dword [edi + 0x34]
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x13d0]
xor eax, eax
mov dword [esp + 4], str.WaitForDebugEvent_returned__x__lu__n
mov dword [esp + 8], edx
cmp dword [edi + 0x34], 0x79
sete al
mov dword [esp], eax
call fcn.00444b30
lea esi, [esi]
mov eax, 0x7d7
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
call fcn.00446690
mov eax, dword [ebp - 0x135c]
cmp eax, 2
je 0x44a7e8
cmp eax, 1
je 0x44a82c
cmp eax, 4
jne 0x44a7e8
test ebx, ebx
mov eax, 1
cmovne eax, ebx
cmp esi, 1
je 0x44a919
sub esi, 1
mov ebx, eax
jmp 0x44a7e8
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7e1
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7e2
mov eax, dword [ebp - 0x1354]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1344]
mov dword [esp], str.exception_at__p_in_thread__04lx_n
mov dword [esp + 4], eax
call fcn.00444260
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7e3
mov eax, dword [ebp - 0x1350]
mov dword [esp + 4], str.ExceptionCode___lx_n
cmp eax, 0x80000003
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7e5
mov eax, dword [ebp - 0x1344]
mov dword [esp + 4], str.ExceptionAddress___p_n
mov dword [esp + 8], eax
cmp dword [ebp - 0x13e0], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
add dword [ebp - 0x13d8], 1
mov eax, 2
cmp ebx, 1
cmove ebx, eax
jmp 0x44a713
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7eb
mov eax, dword [ebp - 0x13d8]
mov dword [esp], str.received__u_exceptions_n
mov dword [esp + 4], eax
call fcn.00444260
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7ec
mov dword [esp + 8], 0
mov dword [esp + 4], str.Missing__u_exit_thread_events_n
mov dword [esp], 1
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7ed
mov eax, 1
cmp ebx, 1
jbe 0x44a9a0
mov ecx, dword [0x8f0770]
test ecx, ecx
sete dl
xor eax, eax
cmp ebx, 2
sete al
and eax, edx
mov dword [esp], eax
mov dword [esp + 4], str.Intertwined_exit_thread__exception_debug_events_n
call fcn.00444b30
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SuspendThread]
mov edx, dword [ebp - 0x12dc]
mov eax, 0x7f9
sub esp, 4
call fcn.004455a0
lea eax, [ebp - 0x13c1]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xc4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x7fb
mov eax, dword fs:[0x18]
mov dword [ebp - 0x13d0], eax
mov eax, dword [eax + 0x34]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.ReadProcessMemory_failed:__lu_n
call fcn.00444b30
mov edx, dword [ebp - 0x12dc]
mov edi, dword [ebp - 0x13c8]
mov ecx, 0xb3
mov eax, 0x817
lea esi, [edx + 0xc]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x13c2]
mov dword [edx + 0xbc], 0x65
mov dword [edx + 0xb0], 0x66
mov dword [edx + 0xb8], 0x67
mov ebx, dword [edx + 0xc4]
mov dword [edx + 0xb4], 0x68
mov dword [edx + 0xac], 0x69
mov dword [edx + 0xa8], 0x6a
call fcn.00445690
mov edx, dword [ebp - 0x12dc]
mov eax, 0x819
call fcn.004455a0
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x81c
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xb0]
mov dword [esp + 4], str.Ebx___lx_n
cmp eax, 0x66
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x81d
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xac]
mov dword [esp + 4], str.Esi___lx_n
cmp eax, 0x69
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x81e
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xa8]
mov dword [esp + 4], str.Edi___lx_n
cmp eax, 0x6a
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov byte [ebp - 0x13c2], 0xcc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov edi, dword [ebp - 0x13e8]
call edi
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x832
mov eax, dword [ebp - 0x13d0]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00444b30
mov eax, dword [ebp - 0x13f0]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_SetEvent]
mov dword [ebp - 0x13d0], eax
call eax
mov eax, dword [ebp - 0x12dc]
sub esp, 4
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
mov ecx, 0x7d0
lea edx, [ebp - 0x1360]
mov eax, 0x837
call fcn.00446690
cmp dword [ebp - 0x135c], 2
je 0x44ac03
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x838
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x839
mov eax, dword [ebp - 0x1350]
mov dword [esp + 4], str.ExceptionCode___lx_n
cmp eax, 0x80000003
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x83b
mov eax, dword [ebp - 0x1344]
mov dword [esp + 4], str.ExceptionAddress___p_n
cmp eax, ebx
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov edx, dword [ebp - 0x12dc]
mov eax, 0x83e
call fcn.004455a0
call fcn.0057d110
lea edx, [ebx + 1]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x83f
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xc4]
mov dword [esp + 4], str.unexpected_instruction_pointer__p_n
cmp eax, edx
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x842
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xbc]
mov dword [esp + 4], str.Eax___lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x843
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xb0]
mov dword [esp + 4], str.Ebx___lx_n
cmp eax, 0x66
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x844
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xb8]
mov dword [esp + 4], str.Ecx___lx_n
cmp eax, 0x67
mov dword [esp + 8], eax
setne al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x845
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xb4]
mov dword [esp + 4], str.Edx___lx_n
cmp eax, 0x68
mov dword [esp + 8], eax
setne al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x846
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xac]
mov dword [esp + 4], str.Esi___lx_n
cmp eax, 0x69
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x847
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xa8]
mov dword [esp + 4], str.Edi___lx_n
cmp eax, 0x6a
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov edx, dword [ebp - 0x12dc]
mov esi, dword [ebp - 0x13c8]
mov ecx, 0xb3
mov eax, 0x85b
lea edi, [edx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov dword [edx + 0xc4], ebx
mov edi, dword fs:[0x18]
call fcn.00445690
lea eax, [ebp - 0x13c1]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov esi, dword [ebp - 0x13e8]
call esi
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x85e
mov eax, dword [edi + 0x34]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
mov ebx, dword [ebp - 0x13ec]
mov edx, 0xffff9090
lea eax, [ebp - 0x1002]
mov word [ebp - 0xffa], dx
mov dword [ebp - 0x1002], 0x90909090
add ebx, 0xa
mov dword [ebp - 0xffe], 0x90909090
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xa
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
call esi
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x862
mov eax, dword [edi + 0x34]
lea edi, [ebp - 0x12d8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x864
call fcn.00446690
mov edx, dword [ebp - 0x12dc]
mov eax, 0x867
call fcn.004455a0
mov edx, dword [ebp - 0x12dc]
mov dword [ebp - 0x13c8], edi
mov ecx, 0xb3
mov eax, 0x872
lea esi, [edx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov dword [edx + 0xc4], ebx
or dword [edx + 0xcc], 0x100
call fcn.00445690
mov edi, dword [ebp - 0x13f0]
mov dword [esp], edi
mov edi, dword [ebp - 0x13d0]
call edi
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x876
sub esp, 4
call fcn.00446690
cmp dword [ebp - 0x1350], 0x80000003
je 0x44c18a
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x879
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x87a
mov eax, dword [ebp - 0x1350]
mov dword [esp + 4], str.ExceptionCode___lx_n
cmp eax, 0x80000004
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x87c
mov edx, dword [ebp - 0x1344]
mov eax, 1
cmp ebx, edx
je 0x44b0ab
mov eax, dword [ebp - 0x13ec]
add eax, 0xb
cmp edx, eax
sete al
movzx eax, al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.ExceptionAddress___p_expected__p_n
call fcn.00444b30
mov edx, dword [ebp - 0x12dc]
mov eax, 0x880
call fcn.004455a0
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x881
mov eax, dword [ebp - 0x12dc]
mov eax, dword [eax + 0xc4]
mov dword [esp + 4], str.ip___p_n
mov dword [esp + 8], eax
cmp dword [ebp - 0x1344], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov edx, dword [ebp - 0x12dc]
mov esi, dword [ebp - 0x13c8]
mov ecx, 0xb3
mov eax, 0x888
lea edi, [edx + 0xc]
rep movsd dword es:[edi], dword [esi]
call fcn.00445690
mov eax, dword [ebp - 0x13f0]
mov dword [esp], eax
mov eax, dword [ebp - 0x13d0]
call eax
sub esp, 4
jmp 0x44b14c
cmp eax, 5
je 0x44b1b4
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x88f
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x890
xor eax, eax
mov dword [esp + 4], str.got_exception_n
cmp dword [ebp - 0x135c], 1
setne al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x135c]
cmp eax, 1
jne 0x44b147
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
mov eax, dword [ebp - 0x13f0]
mov ebx, dword fs:[0x18]
mov dword [esp], eax
mov edi, dword [ebp - 0x13cc]
call edi
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x897
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
call fcn.00444b30
mov eax, dword [ebp - 0x13b0]
mov dword [esp], eax
call edi
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x899
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
call fcn.00444b30
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
call edi
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x89b
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
call fcn.00444b30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xcccccccc
mov ecx, 0x400
lea edi, [ebp - 0x100c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0xc0c], 0xe9909090
mov dword [ebp - 0xc08], 0xfffffff8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x13ec]
mov ebx, dword fs:[0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov edi, dword [ebp - 0x13e8]
call edi
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6e8
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
lea eax, [ebp - 0x13c2]
mov byte [ebp - 0x13c2], 0xcc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x13e0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
call edi
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6ec
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov edi, dword [ebp - 0x13d4]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13d0]
call eax
sub esp, 0x1c
mov esi, eax
mov dword [ebp - 0x1400], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6ef
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00444b30
lea edx, [ebp - 0x1360]
mov ecx, 0x4e20
mov eax, 0x6f0
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6f1
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov ecx, dword [ebp - 0x1354]
mov esi, dword [ebp - 0x1358]
mov dword [ebp - 0x13d8], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13d0]
call eax
sub esp, 0x1c
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6f5
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateRemoteThread_failed:__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x6f6
call fcn.00446690
cmp dword [ebp - 0x135c], 2
jne 0x44b4b4
mov eax, dword [ebp - 0x1358]
mov ebx, dword fs:[0x18]
mov dword [ebp - 0x13fc], eax
mov eax, dword [ebp - 0x1354]
mov dword [ebp - 0x13f8], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.ntdll.dll_NtSuspendThread]
sub esp, 8
mov dword [ebp - 0x13f4], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6fb
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.NtSuspendThread_failed__last_error:_lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x13f4]
xor eax, eax
test edx, edx
sete al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp + 8], 0x40010001
mov eax, dword [ebp - 0x1354]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1358]
mov dword [esp], eax
mov eax, dword [ebp - 0x13c8]
call eax
sub esp, 0xc
mov dword [ebp - 0x13f4], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x6fd
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.ContinueDebugEvent_failed__last_error:_lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x13f4]
mov dword [esp], edx
call fcn.00444b30
lea edx, [ebp - 0x1360]
mov ecx, 0x4e20
mov eax, 0x700
mov dword [ebp - 0x135c], 0xffffffff
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x701
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x703
mov eax, dword [ebp - 0x1358]
mov dword [esp + 0xc], esi
cmp eax, esi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov esi, dword [ebp - 0x13d8]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x705
mov eax, dword [ebp - 0x1354]
mov dword [esp + 0xc], esi
cmp eax, esi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x135c]
mov byte [ebp - 0x13c2], 0xc3
mov dword [ebp - 0x1404], eax
mov eax, dword [ebp - 0x1358]
mov dword [ebp - 0x13d8], eax
mov eax, dword [ebp - 0x1354]
mov dword [ebp - 0x13f4], eax
lea eax, [ebp - 0x13c2]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x13e0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x13e8]
call eax
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x70b
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteProcessMemory_failed:__lu_n
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x70d
xor eax, eax
mov dword [esp + 4], str.NtSuspendProcess_not_found_n
mov ecx, dword [0x717c48]
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x70e
xor eax, eax
mov dword [esp + 4], str.pNtResumeProcess_not_found_n
mov esi, dword [0x717c44]
test esi, esi
setne al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [0x717c48]
test eax, eax
je 0x44bd16
mov edx, dword [0x717c44]
test edx, edx
je 0x44bd16
mov edx, dword [ebp - 0x13b4]
mov dword [esp], edx
call eax
sub esp, 4
mov esi, eax
mov eax, 0x713
call fcn.00443e00
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.NtSuspendProcess_failed__last_error:_lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
lea esi, [ebp - 0x135c]
sete al
mov dword [esp], eax
call fcn.00444b30
mov dword [ebp - 0x1408], edi
mov eax, 0x40010001
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1354]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1358]
mov dword [esp], eax
mov eax, dword [ebp - 0x13c8]
call eax
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x717
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.ContinueDebugEvent_failed__last_error:_lu_n
call fcn.00444b30
mov dword [esp + 4], 0xc8
mov dword [esp], esi
mov eax, dword [ebp - 0x13dc]
call eax
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x719
test edi, edi
je 0x44c062
cmp dword [ebp - 0x135c], 2
mov dword [esp + 4], str.WaitForDebugEvent_succeeded._n
je 0x44c179
mov dword [esp], 0
call fcn.00444b30
mov edx, dword [ebp - 0x1354]
lea eax, [ebp - 0x1360]
call fcn.004443c0
mov eax, 0x10002
jmp 0x44b7b6
mov eax, dword [ebp - 0x135c]
lea edx, [ebp - 0x1360]
mov ecx, 0x4e20
mov esi, dword [ebp - 0x1358]
mov dword [ebp - 0x135c], 0xffffffff
mov edi, dword [ebp - 0x1354]
mov dword [ebp - 0x13d0], eax
mov eax, 0x66a
call fcn.00446690
call fcn.0057d110
mov ecx, dword [ebp - 0x13d0]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x66b
mov eax, dword [ebp - 0x135c]
mov dword [esp + 0xc], ecx
cmp eax, ecx
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x66d
mov eax, dword [ebp - 0x1358]
mov dword [esp + 0xc], esi
cmp eax, esi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x66f
mov eax, dword [ebp - 0x1354]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x1354]
mov dword [esp + 4], 0
mov dword [esp], 2
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenThread]
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x675
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.OpenThread_failed__last_error:_lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], edi
mov dword [esp + 4], 0
call dword [sym.imp.ntdll.dll_NtSuspendThread]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x678
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.NtSuspendThread_failed__last_error:_lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
sete al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp + 8], 0x40010001
mov eax, dword [ebp - 0x1354]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1358]
mov dword [esp], eax
mov esi, dword [ebp - 0x13c8]
call esi
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x67b
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
lea esi, [ebp - 0x135c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ContinueDebugEvent_failed__last_error:_lu_n
call fcn.00444b30
call fcn.0057d110
mov edx, dword [sym.imp.kernel32.dll_WaitForDebugEvent]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x67c
mov dword [esp], esi
mov dword [esp + 4], 0xc8
mov dword [ebp - 0x13dc], edx
call edx
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.WaitForDebugEvent_succeeded._n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], edi
mov dword [esp + 4], 0
call dword [sym.imp.ntdll.dll_NtResumeThread]
sub esp, 8
mov dword [ebp - 0x13cc], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x67f
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.NtResumeThread_failed__last_error:_lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x13cc]
xor eax, eax
test edx, edx
sete al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x13cc], edi
call edi
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x682
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x684
mov dword [esp], esi
mov dword [esp + 4], 0xc8
mov edx, dword [ebp - 0x13dc]
call edx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], str.WaitForDebugEvent_failed._n
call fcn.00444b30
call fcn.0057d110
mov ecx, dword [ebp - 0x13d0]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x685
mov eax, dword [ebp - 0x135c]
mov dword [esp + 0xc], ecx
cmp eax, ecx
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
lea edx, [ebp - 0x1360]
mov ecx, 0x4e20
mov eax, 0x688
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x689
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 6
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov esi, dword [ebp - 0x1354]
mov eax, dword [ebp - 0x1358]
mov edi, dword [ebp - 0x135c]
mov dword [esp + 8], 0x40010001
mov dword [esp + 4], esi
mov dword [ebp - 0x13d0], eax
mov dword [esp], eax
mov ecx, dword [ebp - 0x13c8]
call ecx
sub esp, 0xc
mov dword [ebp - 0x13d4], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x68d
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.ContinueDebugEvent_failed__last_error:_lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x13d4]
mov dword [esp], edx
call fcn.00444b30
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x690
mov dword [ebp - 0x135c], 0xffffffff
call fcn.00446690
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x691
mov eax, dword [ebp - 0x135c]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov edi, dword [ebp - 0x13d0]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x693
mov eax, dword [ebp - 0x1358]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x695
mov eax, dword [ebp - 0x1354]
mov dword [esp + 0xc], esi
cmp eax, esi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
jmp 0x449cbf
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.ntdll.dll_NtResumeThread]
sub esp, 8
mov ebx, eax
mov eax, 0x731
call fcn.00443e00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.NtResumeThread_failed__last_error:_lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
sete al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x732
call fcn.00443e00
lea eax, [ebp - 0x135c]
mov dword [esp + 4], 0xc8
mov dword [esp], eax
mov eax, dword [ebp - 0x13dc]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.WaitForDebugEvent_succeeded._n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x744
mov dword [ebp - 0x135c], 0xffffffff
call fcn.00446690
cmp dword [ebp - 0x135c], 1
je 0x44c22c
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x767
mov eax, dword [ebp - 0x135c]
mov dword [esp + 0xc], 2
cmp eax, 2
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov esi, dword [ebp - 0x13fc]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x769
mov eax, dword [ebp - 0x1358]
mov dword [esp + 0xc], esi
cmp esi, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov ebx, dword [ebp - 0x13f8]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x76b
mov eax, dword [ebp - 0x1354]
mov dword [esp + 0xc], ebx
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x76e
call fcn.00446690
cmp dword [ebp - 0x135c], 4
je 0x44c396
call fcn.0057d110
mov esi, dword [ebp - 0x1404]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x77d
mov eax, dword [ebp - 0x135c]
mov dword [esp + 0xc], esi
cmp eax, esi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov ebx, dword [ebp - 0x13d8]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x77f
mov eax, dword [ebp - 0x1358]
mov dword [esp + 0xc], ebx
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov esi, dword [ebp - 0x13f4]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x781
mov eax, dword [ebp - 0x1354]
mov dword [esp + 0xc], esi
cmp esi, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov ebx, dword [ebp - 0x1400]
test ebx, ebx
je 0x44bfdc
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x787
call fcn.00446690
mov eax, 0x788
call fcn.00443e00
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 4
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], ebx
mov eax, dword [ebp - 0x13cc]
call eax
sub esp, 4
mov ebx, eax
mov eax, 0x78c
call fcn.00443e00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00444b30
test edi, edi
je 0x44a31d
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x792
call fcn.00446690
mov eax, 0x793
call fcn.00443e00
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.dwDebugEventCode___ld_n
cmp eax, 4
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], edi
mov eax, dword [ebp - 0x13cc]
call eax
sub esp, 4
mov ebx, eax
mov eax, 0x797
call fcn.00443e00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00444b30
jmp 0x44a31d
mov edi, dword [ebp - 0x1408]
mov dword [esp + 4], str.WaitForDebugEvent_succeeded._n
mov dword [esp], 1
call fcn.00444b30
mov dword [esp], edi
mov dword [esp + 4], 0
call dword [sym.imp.ntdll.dll_NtResumeThread]
sub esp, 8
mov dword [ebp - 0x1408], eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x71f
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.NtResumeThread_failed__last_error:_lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x1408]
xor eax, eax
test edx, edx
sete al
mov dword [esp], eax
call fcn.00444b30
jmp 0x44c110
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x722
mov eax, dword [ebp - 0x135c]
mov dword [esp + 4], str.Unexpected_debug_event__lx_n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
cmp dword [ebp - 0x135c], 2
je 0x44c1ad
mov dword [esp + 4], 0xc8
mov dword [esp], esi
mov eax, dword [ebp - 0x13dc]
call eax
sub esp, 8
test eax, eax
jne 0x44c0ce
mov eax, dword [ebp - 0x13b4]
mov dword [esp], eax
call dword [0x717c44]
sub esp, 4
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x72c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.pNtResumeProcess_failed__last_error:_lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
sete al
mov dword [esp], eax
call fcn.00444b30
jmp 0x44bd98
mov dword [esp], 1
call fcn.00444b30
jmp 0x44b856
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x885
mov dword [esp], str.got_breakpoint_instead_of_single_step_exception_n
call fcn.00444ad0
jmp 0x44b111
mov edx, dword [ebp - 0x1354]
lea eax, [ebp - 0x1360]
call fcn.004443c0
mov dword [esp + 8], 0x10002
mov eax, dword [ebp - 0x1354]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1358]
mov dword [esp], eax
mov eax, dword [ebp - 0x13c8]
call eax
sub esp, 0xc
mov ebx, eax
mov eax, 0x727
call fcn.00443e00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.ContinueDebugEvent_failed__last_error:_lu_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00444b30
jmp 0x44c110
mov ecx, 0x4e20
lea edx, [ebp - 0x1360]
mov eax, 0x6d9
call fcn.00446690
jmp 0x44a2bc
mov eax, 0x748
call fcn.00443e00
mov eax, dword [ebp - 0x135c]
mov ebx, dword [ebp - 0x1404]
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
cmp eax, ebx
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x74a
call fcn.00443e00
mov eax, dword [ebp - 0x1358]
mov ebx, dword [ebp - 0x13d8]
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x74c
call fcn.00443e00
mov eax, dword [ebp - 0x1354]
mov ebx, dword [ebp - 0x13f4]
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x74f
call fcn.00446690
cmp dword [ebp - 0x135c], 4
je 0x44c455
mov eax, 0x75e
call fcn.00443e00
mov eax, dword [ebp - 0x135c]
mov dword [esp + 0xc], 2
mov dword [esp + 4], str.dwDebugEventCode_differs:__lx__was__lx__n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x760
call fcn.00443e00
mov eax, dword [ebp - 0x1358]
mov esi, dword [ebp - 0x13fc]
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
cmp esi, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], esi
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x762
call fcn.00443e00
mov eax, dword [ebp - 0x1354]
mov ebx, dword [ebp - 0x13f8]
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
jmp 0x44bf59
mov eax, 0x771
call fcn.00443e00
mov eax, dword [ebp - 0x1358]
mov esi, dword [ebp - 0x13fc]
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
cmp esi, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], esi
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x773
call fcn.00443e00
mov eax, dword [ebp - 0x1354]
mov ebx, dword [ebp - 0x13f8]
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], edi
mov eax, dword [ebp - 0x13cc]
xor edi, edi
call eax
sub esp, 4
mov ebx, eax
mov eax, 0x777
call fcn.00443e00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x77a
call fcn.00446690
jmp 0x44be9f
mov eax, 0x752
call fcn.00443e00
mov eax, dword [ebp - 0x1358]
mov ebx, dword [ebp - 0x13d8]
mov dword [esp + 4], str.dwProcessId_differs:__lx__was__lx__n
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, 0x754
call fcn.00443e00
mov eax, dword [ebp - 0x1354]
mov ebx, dword [ebp - 0x13f4]
mov dword [esp + 4], str.dwThreadId_differs:__lx__was__lx__n
cmp ebx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x1400]
mov dword [esp], eax
mov eax, dword [ebp - 0x13cc]
call eax
sub esp, 4
mov ebx, eax
mov eax, 0x758
call fcn.00443e00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CloseHandle_failed__last_error__ld._n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00444b30
mov ecx, 0xc8
lea edx, [ebp - 0x1360]
mov eax, 0x75b
call fcn.00446690
mov dword [ebp - 0x1400], 0
jmp 0x44c2f0