Function at 0x49ebd0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x14f0
call fcn.00424620
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0x14ec], eax
mov eax, dword [esp + 0x14f8]
push ebx
mov ebx, dword [esp + 0x14f8]
push ebp
push esi
mov esi, dword [esp + 0x1514]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x150c]
push ebp
push 0x56b664
push esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x34], 0
call fcn.00414c70
add esp, 0xc
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x1c], eax
test ebx, ebx
jne 0x49ec6b
push 1
push ebp
push ebp
push 0x56b6af
push dword [esp + 0x28]
push ebp
call fcn.0049be70
mov ebx, eax
add esp, 0x18
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x49f1ed
mov esi, dword [esp + 0x1c]
nop
mov eax, dword [0x59c53c]
mov dword [esp + 0x20], 0
test eax, eax
je 0x49ecab
push 0
push 0xff
push 0
push 0
push 0x158
mov dword [eax + 0x80], 0
push 0
push dword [0x59c53c]
call fcn.004bbb10
add esp, 0x1c
test esi, esi
je 0x49ecc6
push 0
lea eax, [ebx + 0x48]
push esi
push eax
call fcn.00414c70
add esp, 0xc
test eax, eax
jne 0x49f159
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x49f155
mov eax, dword [ebx]
xor ebp, ebp
mov ecx, dword [ebx + 4]
and eax, 0xfffffff7
push 1
push eax
push edi
push ebx
mov dword [esp + 0x40], ecx
call fcn.0049fa00
add esp, 0x10
test eax, eax
je 0x49f137
cmp dword [esp + 0x1520], ebp
jne 0x49ed3d
mov esi, dword [0x59e578]
sub esi, dword [ebx + 0x1480]
mov ecx, dword [0x59e57c]
mov eax, dword [0x58f018]
sbb ecx, dword [ebx + 0x1484]
cdq
cmp ecx, edx
jg 0x49ed3d
jl 0x49ed25
cmp esi, eax
jae 0x49ed3d
mov esi, dword [esp + 0x1514]
test esi, esi
jne 0x49ed3d
mov dword [esp + 0x14], 0xffffffff
jmp 0x49f137
cmp dword [edi + 0x18], 0x80000001
mov esi, ebx
jne 0x49ed9f
push 1
push 0x4000
push edi
push esi
call fcn.0049fa00
add esp, 0x10
test eax, eax
je 0x49ed71
cmp dword [esp + 0x1514], ebp
je 0x49ed7d
mov eax, dword [esi + 0x149c]
cmp eax, dword [edi + 0x18]
je 0x49ed7d
mov esi, dword [esi + 8]
test esi, esi
jne 0x49ed48
jmp 0x49f137
test esi, esi
je 0x49f137
mov eax, dword [esi + 0x149c]
cmp eax, 0x80000001
je 0x49eda5
push eax
call fcn.00547e10
add esp, 4
mov ebp, eax
jmp 0x49eda1
mov ebp, edi
test ebp, ebp
jne 0x49edd5
cmp dword [edi + 0x18], 0x80000001
je 0x49edc4
test byte [ebx + 0x14a4], 4
jne 0x49edc4
mov dword [esp + 0x14], 0xfffffffe
jmp 0x49f137
push 1
push dword [esp + 0x14]
push esi
call fcn.0049fc50
add esp, 0xc
mov ebp, eax
xor eax, eax
mov word [ebp + 0x1426], ax
cmp dword [esp + 0x28], eax
jne 0x49ee2e
push eax
push 1
mov dword [esp + 0x1c], 1
mov dword [esp + 0x30], 1
call fcn.0053dde0
mov ecx, dword [esp + 0x24]
mov eax, 0x56b6af
test ecx, ecx
cmovne eax, ecx
push eax
push dword [esp + 0x24]
lea eax, [edi + 0x81e]
push eax
lea eax, [edi + 0x41d]
push eax
lea eax, [edi + 0x1c]
push eax
push str.REMOVING__s__s:_s_from__s:_s_by_administrator_request._n
call fcn.0053d620
add esp, 0x20
push 0
push 0x14c8
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 1
push 0
push eax
call fcn.00414af0
push 0
push 0x14c8
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.00414a10
add esp, 0x20
cmp dword [esp + 0x1514], 0
je 0x49ee9a
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xd0]
test eax, eax
je 0x49ee9a
add eax, 0x220
push 0x1fd
push eax
call fcn.004e0b80
add esp, 4
push eax
call fcn.004c0ae0
add esp, 8
test eax, eax
je 0x49f20a
push 0
push 0x3c
lea esi, [edi + 0x1515]
push 0
push esi
call fcn.00414af0
dec dword [ebx + 0x14bc83]
add byte [ebx - 0x3f7aef3c], al
je 0x49eee0
mov ecx, dword [ebx + 0x14b8]
test ecx, ecx
je 0x49eedc
push 0
push 0x3c
lea eax, [ecx + 0x1515]
push eax
push esi
call fcn.00415110
mov eax, dword [ebx + 0x14b8]
jmp 0x49ef00
test eax, eax
jne 0x49ef0f
mov eax, dword [ebx + 0x14b4]
test eax, eax
je 0x49ef0f
push 0
push 0x3c
add eax, 0x1515
push eax
push esi
call fcn.00415110
mov eax, dword [ebx + 0x14b4]
mov eax, dword [eax + 0x1450]
add esp, 0x10
mov dword [edi + 0x1450], eax
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x1514]
push ebx
push esi
push 5
push dword [esp + 0x151c]
push ebp
call fcn.0049e520
add esp, 0x14
mov dword [esp + 0x24], eax
cmp eax, 0xffffff85
jne 0x49ef44
mov dword [esp + 0x14], 0xfffffffd
jmp 0x49f0b1
test eax, eax
jne 0x49f0b1
mov eax, dword [esp + 0x14d8]
test al, 1
je 0x49effb
test esi, esi
je 0x49effb
cmp dword [0x58f040], 0
je 0x49ef87
push edi
push 1
push dword [esp + 0x20]
lea eax, [esp + 0x40]
push eax
call fcn.004a0230
mov eax, dword [esp + 0x14e8]
add esp, 0x10
push dword [esp + 0x1498]
push eax
push dword [esp + 0x14dc]
mov eax, dword [esp + 0x14a0]
push edi
push dword [esp + 0x14c8]
push dword [esp + 0x14c8]
push eax
push eax
lea eax, [esp + 0x1494]
push eax
push 0
lea eax, [esp + 0x14a7]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0xca2]
push eax
lea eax, [esp + 0x886]
push eax
lea eax, [esp + 0x489]
push eax
lea eax, [esp + 0x8c]
push eax
push 7
push 2
push 0
push dword [esp + 0x98]
push 2
call fcn.0053e070
add esp, 0x54
cmp dword [esp + 0x14], 1
jne 0x49f0b1
test dword [ebx + 0xc0], 0x4100
je 0x49f0b1
mov eax, dword [ebx + 8]
test eax, eax
je 0x49f0b1
cmp dword [eax + 0x44], 0
je 0x49f0b1
cmp byte [ebp + 0xc1f], 0
lea eax, [ebp + 0xc1f]
je 0x49f05a
push 0
push 0x400
push eax
lea eax, [edi + 0xc1f]
push eax
call fcn.00415110
add esp, 0x10
xor eax, eax
mov word [edi + 0x1426], ax
cmp byte [ebp + 0x1020], 0
lea eax, [ebp + 0x1020]
je 0x49f08c
push 0
push 0x400
push eax
lea eax, [edi + 0x1020]
push eax
call fcn.00415110
mov eax, 1
add esp, 0x10
mov word [edi + 0x1426], ax
mov eax, dword [ebp + 0x18]
push edi
push dword [esp + 0x20]
mov dword [edi + 0x18], eax
lea eax, [esp + 0x3c]
push dword [esp + 0x1518]
push esi
push eax
push dword [esp + 0x2c]
push ebx
call fcn.0049e130
add esp, 0x1c
test esi, esi
jne 0x49f116
cmp dword [esp + 0x151c], esi
je 0x49f116
mov eax, dword [ebp + 0x18]
xor ebx, ebx
test eax, eax
push eax
setle bl
call fcn.00547dd0
mov esi, eax
add esp, 4
test esi, esi
je 0x49f10b
cmp dword [esi + 0x10], 0
je 0x49f0f9
mov ecx, dword [esi]
mov dword [esp + 0x2c], ecx
test ebx, ebx
jne 0x49f0f9
lea eax, [esp + 0x2c]
push str.removing_user
push eax
call fcn.0053eab0
add esp, 8
call fcn.00496a50
test ebx, ebx
jne 0x49f10b
push esi
call fcn.00541620
add esp, 4
mov ebx, dword [esp + 0x10]
mov dword [edi + 0x18], 0x80000001
cmp dword [ebp + 0x18], 0x80000001
je 0x49f129
cmp dword [esp + 0x1520], 0
je 0x49f137
cmp dword [esp + 0x24], 0
jne 0x49f137
cmp dword [esp + 0x14], 1
je 0x49f17d
mov eax, dword [esp + 0x30]
mov ebx, eax
test eax, eax
jne 0x49ecd1
mov ebx, dword [esp + 0x10]
cmp dword [esp + 0x20], eax
jne 0x49f17d
mov esi, dword [esp + 0x1c]
jmp 0x49f159
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x49f1ed
mov eax, dword [eax + 0x44]
test eax, eax
je 0x49f17d
push 0
push dword [esp + 0x1c]
push eax
call fcn.00414c70
add esp, 0xc
test eax, eax
je 0x49f1df
mov eax, dword [ebx]
test eax, eax
je 0x49f1ed
mov eax, dword [eax + 0x44]
test eax, eax
je 0x49f1ed
push 0
push dword [esp + 0x1c]
push eax
call fcn.00414c70
add esp, 0xc
test eax, eax
jne 0x49f1ed
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x49f1b9
push eax
mov eax, dword [ebx]
add eax, 0x48
push esi
push eax
call fcn.00414c70
add esp, 0xc
test eax, eax
jne 0x49f1ed
cmp dword [esp + 0x20], 0
je 0x49f1ed
cmp dword [esp + 0x24], 0
jne 0x49f1ed
cmp dword [esp + 0x14], 1
jne 0x49f1ed
test ebp, ebp
je 0x49f1df
cmp dword [ebp + 0x18], 0x80000001
jne 0x49f1df
test esi, esi
jne 0x49f1ed
mov ebx, dword [ebx]
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x49ec70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14fc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00424604
add esp, 0x14f0
ret
mov eax, 0xfffffffd
jmp 0x49f1f1