Function at 0x403010
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd2b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x958
mov eax, dword [0x689140]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x8c0], ecx
mov dword [ebp - 0x424], 0
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x8c4], ecx
movups xmmword [ebp - 0x4a8], xmm0
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x494], 7
mov word [ebp - 0x4a8], ax
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ecx]
mov dword [ebp - 0x8a4], edi
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4048ff
xor ecx, ecx
mov dword [ebp - 0x8ac], edi
push eax
push ecx
movups xmmword [ebp - 0x8bc], xmm0
push 0x2000000
mov dword [ebp - 0x8a8], 7
mov word [ebp - 0x8bc], cx
mov dword [ebp - 0x424], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x42c], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x4031a6
mov ecx, dword [ebp - 0x8ac]
cmp ecx, 0x104
jb 0x40312c
cmp dword [ebp - 0x8a8], 7
lea eax, [ebp - 0x8bc]
mov dword [ebp - 0x8ac], 0x104
cmova eax, dword [ebp - 0x8bc]
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x403141
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp - 0x8bc]
push 0
push eax
call fcn.00428730
cmp dword [ebp - 0x8a8], 7
lea eax, [ebp - 0x8bc]
push dword [ebp - 0x8ac]
cmova eax, dword [ebp - 0x8bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov ecx, dword [ebp - 0x8ac]
cmp eax, ecx
ja 0x40318f
cmp dword [ebp - 0x8a8], 7
lea ecx, [ebp - 0x8bc]
mov dword [ebp - 0x8ac], eax
cmova ecx, dword [ebp - 0x8bc]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x40319f
sub eax, ecx
lea ecx, [ebp - 0x8bc]
push 0
push eax
call fcn.00428730
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x4a8]
call fcn.00428f60
movups xmm0, xmmword [ebp - 0x8bc]
xor eax, eax
lea ecx, [ebp - 0x8bc]
mov word [ebp - 0x8bc], ax
movups xmmword [ebp - 0x4a8], xmm0
movq xmm0, qword [ebp - 0x8ac]
movq qword [ebp - 0x498], xmm0
mov dword [ebp - 0x8ac], 0
mov dword [ebp - 0x8a8], 7
mov byte [ebp - 4], al
call fcn.00428f60
mov esi, dword [ebp - 0x8c0]
mov eax, dword [esi]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
je 0x4049b2
mov eax, dword [0x628468]
mov edx, 2
movq xmm0, qword [str.dump]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x478], 0x44313537
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x474], 0x34353337
mov ecx, dword [ebp - 0x474]
mov dword [ebp - 0x45c], ecx
lea ecx, [ebp - 0x5e8]
push eax
movq qword [ebp - 0x46c], xmm0
mov dword [ebp - 0x458], 0x168
call fcn.00425500
mov eax, 8
add esp, 4
mov dword [ebp - 0x870], eax
push str.Debugger_attached_to_process:
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 3
call fcn.00426ca0
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, eax
call fcn.00428480
push str._PID:
mov ecx, eax
call fcn.00426ca0
mov ecx, dword [esi]
add ecx, 0x1c
push ecx
mov ecx, eax
call fcn.004089a0
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0
call fcn.00426780
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
test eax, eax
je 0x4049f3
mov byte [ebp - 0x871], 0
mov byte [ebp - 0x87e], 1
mov byte [ebp - 0x87d], 0
mov byte [ebp - 0x86a], 0
mov dword [ebp - 0x884], 0xffffffff
nop dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x87c], 0x10002
movups xmmword [ebp - 0x4e8], xmm0
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0xf
mov byte [ebp - 0x4e8], 0
xor al, al
mov byte [ebp - 4], 5
mov byte [ebp - 0x869], al
mov byte [ebp - 0x86b], al
lea eax, [ebp - 0x860]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x404a0e
mov eax, dword [0x628468]
lea edx, [ebp - 0x860]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x8d0], 0x44313537
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x8cc], 0x34353337
mov ecx, dword [ebp - 0x8cc]
push eax
mov dword [ebp - 0x45c], ecx
lea ecx, [ebp - 0x46c]
push 0x1d
push str.Event:_Process:_Thread:
movq qword [ebp - 0x46c], xmm0
mov dword [ebp - 0x458], 0x182
call fcn.00408a20
add esp, 0x10
cmp byte [ebp - 0x87e], 0
je 0x4034c1
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
test eax, eax
je 0x4033ff
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [ebp - 0x85c]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [0x6ecec8]
call fcn.00422c90
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403438
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403478
push 0
lea eax, [ebp - 0x480]
mov dword [ebp - 0x488], edi
push eax
push 0
push 0
push 5
lea eax, [ebp - 0x488]
mov byte [ebp - 0x484], 1
push eax
push 0xb2d601c4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x403471
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6ee08c
mov byte [ebp - 0x87e], 0
mov dword [ebp - 0x42c], 0x6ee08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x4a8]
mov byte [ebp - 4], 6
push eax
call fcn.00405a50
mov edi, eax
mov byte [ebp - 4], 5
push 0x6ee08c
mov dword [ebp - 0x8a4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x8c0]
mov ecx, dword [ebp - 0x860]
dec ecx
cmp ecx, 8
ja case.0x4034d1.2
jmp dword [ecx*4 + 0x404a5c]
mov eax, dword [0x628468]
lea edx, [ebp - 0x85c]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x8dc], 0x44313537
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x8d8], 0x34353337
mov ecx, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x854]
mov dword [ebp - 0x444], ecx
push eax
lea eax, [ebp - 0x858]
movq qword [ebp - 0x454], xmm0
push eax
push 0x64
push str.EXCEPTION_DEBUG_EVENT_Process:_Thread:_Exception:0x:08X_FirstChance:_ExceptionFlags:0x:08X
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x440], 0x195
call fcn.00408a50
movaps xmm0, xmmword [0x649690]
xor eax, eax
movups xmmword [ebp - 0x800], xmm0
mov dword [ebp - 0x878], 0
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x7f0], 0
movups xmmword [ebp - 0x7ec], xmm0
mov dword [ebp - 0x7dc], 0
movups xmmword [ebp - 0x7d4], xmm0
mov dword [ebp - 0x7d8], 7
mov word [ebp - 0x7ec], ax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x7c0], 7
mov word [ebp - 0x7d4], ax
mov word [ebp - 0x7bc], ax
mov eax, dword [esi]
push eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x928], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x924], 1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7ec]
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x800], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x7fc], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x7f8], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x7f4], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x7f0], eax
lea eax, [esi + 0x2c]
cmp ecx, eax
je 0x403642
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x403635
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x7ec]
call fcn.004287b0
lea eax, [esi + 0x44]
lea ecx, [ebp - 0x7d4]
cmp ecx, eax
je 0x403667
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x40365a
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x7d4]
call fcn.004287b0
movzx eax, byte [esi + 0x5c]
mov byte [ebp - 0x7bc], al
movzx eax, byte [esi + 0x5d]
mov byte [ebp - 4], 7
push dword [ebp - 0x434]
mov byte [ebp - 0x7bb], al
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x804], 0
mov ecx, dword [ebp - 0x854]
sete byte [ebp - 0x425]
mov byte [ebp - 0x924], 0
mov dword [ebp - 0x434], ecx
cmp ecx, 0x60aa0003
jne 0x403746
push dword [ebp - 0x85c]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4036f6
push esi
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
movzx ecx, byte [ebp - 0x871]
test eax, eax
mov eax, 1
cmovne ecx, eax
push esi
mov byte [ebp - 0x871], cl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x7d4]
call fcn.00428f60
lea ecx, [ebp - 0x7ec]
call fcn.00428f60
push dword [ebp - 0x87c]
push dword [ebp - 0x858]
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
cmp byte [ebp - 0x869], 0
mov esi, dword [ebp - 0x8c0]
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x8a4]
je 0x403310
jmp 0x404989
cmp ecx, 0x80000003
jne 0x403868
cmp byte [ebp - 0x871], 0
je 0x403781
lea ecx, [ebp - 0x7d4]
mov byte [ebp - 0x869], 1
mov byte [ebp - 4], 5
call fcn.00428f60
lea ecx, [ebp - 0x7ec]
call fcn.00428f60
jmp 0x404866
cmp byte [ebp - 0x87d], 0
jne 0x403868
push dword [ebp - 0x85c]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40383b
lea eax, [ebp - 0x47c]
push eax
push 0x400
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x403834
mov eax, dword [ebp - 0x47c]
cmp eax, 0x400
jbe 0x4037e1
mov eax, 0x400
mov dword [ebp - 0x47c], eax
xor edi, edi
test eax, 0xfffffffc
jbe 0x403834
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x6f8]
push eax
push dword [ebp + edi*4 - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x403826
lea eax, [ebp - 0x6f8]
push str.verifier.dll
push eax
call fcn.005a3f2a
add esp, 8
test eax, eax
je 0x40384e
mov eax, dword [ebp - 0x47c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x4037f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x86a], 0
mov byte [ebp - 0x87d], 1
jmp 0x4036f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x86a], 1
mov byte [ebp - 0x87d], 1
jmp 0x4036f6
mov eax, 0x80010001
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x888], eax
cmp ecx, 0xc0000008
ja 0x403950
je 0x403920
cmp ecx, 0x80000001
je 0x403910
cmp ecx, 0x80000003
je 0x4038c5
cmp ecx, 0x80000004
jne 0x4039cc
mov eax, 0x10002
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x888], eax
mov eax, 1
lock xadd dword [edi + 8], eax
inc eax
jmp 0x4038ee
cmp byte [ebp - 0x86a], 0
je 0x403d2e
mov eax, 0x10002
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x888], eax
mov eax, 1
lock xadd dword [edi + 4], eax
inc eax
cmp eax, 0x1e
jae 0x403d2e
cmp dword [edi + 0x10], 0x5000
jae 0x403d2e
mov byte [ebp - 0x425], 1
jmp 0x403d2e
mov eax, 1
lock xadd dword [edi + 0xc], eax
inc eax
cmp eax, 0xa
jmp 0x4038fe
mov eax, 0x10002
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x888], eax
mov eax, 1
lock xadd dword [edi], eax
inc eax
cmp eax, 0xa
jae 0x403d2e
mov byte [ebp - 0x425], 1
jmp 0x403d2e
cmp ecx, 0xc000070a
je 0x403d16
cmp ecx, 0xc0000710
jne 0x4039cc
push dword [ebp - 0x858]
mov dword [ebp - 0x424], 0
push 0
push 0x80
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x4039a0
push 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, dword [ebp - 0x424]
mov byte [ebp - 0x425], 0
mov ecx, 0x10002
mov dword [ebp - 0x87c], ecx
mov dword [ebp - 0x888], ecx
test eax, eax
je 0x403d2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403d2e
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0xcede0000
jne 0x403d2e
mov eax, dword [ebp - 0x800]
cmp cl, 4
mov ecx, 2
mov dword [ebp - 0x444], 0
cmove eax, ecx
mov dword [ebp - 0x440], 0
push 0x1f
xorps xmm0, xmm0
mov dword [ebp - 0x800], eax
push str.Cause:_VectoredExceptionHandler
lea ecx, [ebp - 0x454]
movups xmmword [ebp - 0x454], xmm0
call fcn.00428c10
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 9
push eax
mov edx, 0x623450
lea ecx, [ebp - 0x4c4]
call fcn.00408b60
add esp, 4
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x403a52
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x7d4]
call fcn.00422380
lea ecx, [ebp - 0x4c4]
call fcn.00428f60
lea ecx, [ebp - 0x454]
call fcn.00428f60
mov eax, dword [ebp - 0x434]
shr eax, 8
test al, 1
je 0x403ce0
cmp dword [ebp - 0x844], 2
jb 0x403ce0
cmp dword [ebp - 0x840], 0
je 0x403ce0
cmp dword [ebp - 0x83c], 0
je 0x403ce0
push dword [ebp - 0x85c]
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x42c], esi
test esi, esi
je 0x403ce0
xorps xmm0, xmm0
mov dword [ebp - 0x444], 0
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x440], 0xf
mov byte [ebp - 0x454], 0
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x424], eax
cmp eax, 0x104
jbe 0x403b91
mov dword [ebp - 0x424], 0x104
mov eax, 0x104
push 0
push eax
lea ecx, [ebp - 0x454]
call fcn.00427f70
cmp dword [ebp - 0x440], 0xf
lea ecx, [ebp - 0x424]
push ecx
push dword [ebp - 0x424]
lea eax, [ebp - 0x454]
cmova eax, dword [ebp - 0x454]
push eax
push dword [ebp - 0x83c]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x403c9b
mov ecx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x444]
cmp ecx, eax
ja 0x403ba4
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
mov dword [ebp - 0x444], ecx
cmova eax, dword [ebp - 0x454]
mov byte [eax + ecx], 0
jmp 0x403bb4
test eax, eax
jne 0x403b1c
mov dword [ebp - 0x444], eax
mov byte [ebp + eax - 0x454], al
jmp 0x403b2a
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x454]
call fcn.00427f70
cmp dword [ebp - 0x440], 0xf
lea edx, [ebp - 0x454]
push 0xfde9
push dword [ebp - 0x444]
cmova edx, dword [ebp - 0x454]
lea ecx, [ebp - 0x4c4]
call fcn.004219b0
mov edi, dword [ebp - 0x870]
add esp, 8
or edi, 0x400
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8a0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x890], 0
push str.___Cause:
movups xmmword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0
call fcn.00428c10
lea eax, [ebp - 0x4c4]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x8a0]
push eax
push dword [ebp - 0x480]
lea ecx, [ebp - 0x944]
call fcn.0040a010
or edi, 0x800
mov dword [ebp - 0x870], edi
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x944]
cmp dword [ebp - 0x930], 7
lea ecx, [ebp - 0x7d4]
push dword [ebp - 0x934]
cmova eax, dword [ebp - 0x944]
push eax
call fcn.00422380
lea ecx, [ebp - 0x944]
call fcn.00428f60
lea ecx, [ebp - 0x8a0]
call fcn.00428f60
lea ecx, [ebp - 0x4c4]
call fcn.00428f60
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x440]
cmp ecx, 0xf
jbe 0x403cd9
mov edx, dword [ebp - 0x454]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403ccf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a4f
push ecx
push edx
call fcn.0059886a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
shr eax, 0xa
test al, 1
je 0x403d0d
cmp dword [ebp - 0x844], 3
jb 0x403d0d
mov eax, dword [ebp - 0x838]
test eax, eax
mov ecx, dword [ebp - 0x878]
cmovne ecx, eax
mov dword [ebp - 0x878], ecx
mov byte [ebp - 0x425], 1
jmp 0x403d1d
mov byte [ebp - 0x425], 0
mov eax, 0x10002
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x87c], eax
push dword [ebp - 0x858]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
mov dword [ebp - 0x434], esi
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [ebp - 0x43c], xmm0
xor edi, edi
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], edi
cmp dword [ebp - 0x804], edi
jne 0x403eae
cmp dword [ebp - 0x87c], 0x10002
je 0x403eae
mov byte [ebp - 4], 0x12
xor edx, edx
mov edi, dword [ebp - 0x870]
xor eax, eax
or edi, 0x40
movlpd qword [ebp - 0x430], xmm0
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x870], edi
mov dword [ebp - 0x424], edi
test esi, esi
je 0x403e4b
push 0x2c8
push eax
lea eax, [ebp - 0x7b4]
push eax
call fcn.0059a470
add esp, 0xc
mov dword [ebp - 0x7b8], 0x1003f
lea eax, [ebp - 0x7b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x403e3f
push 0x2d8
call fcn.005988b3
mov dword [ebp - 0x42c], eax
lea esi, [ebp - 0x7b8]
xorps xmm0, xmm0
mov ecx, 0xb3
add esp, 4
movq qword [eax], xmm0
lea edx, [eax + 0xc]
mov dword [eax + 8], 0
mov edi, edx
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_struct__CONTEXT_.0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x870]
or edi, 0x80
jmp 0x403e4b
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x438], eax
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], edx
push eax
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 0x11
and edi, 0xffffffbf
lea edx, [ebp - 0x860]
push eax
mov dword [ebp - 0x870], edi
call fcn.004029e0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
mov ecx, dword [ebp - 0x43c]
mov al, 1
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x438]
mov byte [ebp - 0x869], al
mov byte [ebp - 0x86b], al
cmp byte [ebp - 0x425], 0
jne 0x403f12
test edi, edi
je 0x403f04
mov eax, dword [ebp - 0x884]
lock xadd dword [edi + 4], eax
jne 0x403f04
mov eax, dword [edi]
mov edi, dword [eax]
mov ecx, edi
call dword [0x5f2510]
mov ecx, dword [ebp - 0x438]
call edi
mov eax, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x438]
lock xadd dword [ecx + 8], eax
jne 0x403f04
mov eax, dword [ecx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x5f2510]
mov ecx, dword [ebp - 0x438]
call edi
test esi, esi
je 0x404731
push esi
jmp 0x40472b
test ecx, ecx
jne 0x404079
mov byte [ebp - 4], 0x13
xorps xmm0, xmm0
mov eax, dword [ebp - 0x870]
xor edx, edx
or eax, 0x100
movlpd qword [ebp - 0x430], xmm0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x424], eax
test esi, esi
je 0x403ff2
push 0x2c8
push edx
lea eax, [ebp - 0x7b4]
push eax
call fcn.0059a470
add esp, 0xc
mov dword [ebp - 0x7b8], 0x1003f
lea eax, [ebp - 0x7b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x403fe6
push 0x2d8
call fcn.005988b3
mov edx, eax
lea esi, [ebp - 0x7b8]
mov dword [ebp - 0x42c], edx
xorps xmm0, xmm0
mov ecx, 0xb3
add esp, 4
or dword [ebp - 0x870], 0x200
movq qword [edx], xmm0
lea edi, [edx + 0xc]
mov dword [edx + 8], 0
mov dword [edx + 4], 1
mov dword [edx + 8], 1
mov dword [edx], vtable.std::_Ref_count_obj2_struct__CONTEXT_.0
mov dword [ebp - 0x428], edi
rep movsd dword es:[edi], dword [esi]
jmp 0x403fec
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x438]
mov edi, edx
mov dword [ebp - 0x43c], ecx
mov esi, eax
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x438], edi
test eax, eax
je 0x40406b
mov eax, dword [ebp - 0x884]
mov edx, esi
lock xadd dword [edx + 4], eax
jne 0x40406b
mov eax, dword [esi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f2510]
mov ecx, dword [ebp - 0x424]
call esi
mov eax, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x42c]
lock xadd dword [ecx + 8], eax
jne 0x404065
mov eax, ecx
mov eax, dword [eax]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f2510]
mov ecx, dword [ebp - 0x424]
call esi
mov ecx, dword [ebp - 0x428]
mov esi, dword [ebp - 0x870]
and esi, 0xfffffeff
jmp 0x40407f
mov esi, dword [ebp - 0x870]
lea eax, [ebp - 0x854]
mov dword [ebp - 0x864], ecx
mov ecx, dword [ebp - 0x878]
xorps xmm0, xmm0
mov dword [ebp - 0x868], eax
test ecx, ecx
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x7fc], eax
sete byte [ebp - 0x7bc]
mov eax, dword [ebp - 0x858]
test ecx, ecx
mov dword [ebp - 0x7f8], eax
lea eax, [ebp - 0x868]
cmovne eax, ecx
mov dword [ebp - 0x45c], 0
cmp byte [ebp - 0x86a], 0
mov ecx, 2
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x800]
cmovne eax, ecx
mov dword [ebp - 0x458], 7
mov dword [ebp - 0x800], eax
xor eax, eax
movups xmmword [ebp - 0x46c], xmm0
mov word [ebp - 0x46c], ax
push eax
push 0x104
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0x14
call fcn.00428730
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [ebp - 0x458], 7
lea ecx, [ebp - 0x46c]
push dword [ebp - 0x474]
cmova ecx, dword [ebp - 0x46c]
mov edx, str.unp_u_ux_manual.mdmp
push dword [ebp - 0x470]
cmp dword [ebp - 0x804], 0
mov eax, str.unp_u_ux_unhandled.mdmp
cmovne eax, edx
push eax
push dword [ebp - 0x45c]
push ecx
call fcn.00422c70
mov ecx, dword [ebp - 0x45c]
add esp, 0x14
cmp eax, ecx
ja 0x40419d
cmp dword [ebp - 0x458], 7
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x45c], eax
cmova ecx, dword [ebp - 0x46c]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x4041ad
sub eax, ecx
lea ecx, [ebp - 0x46c]
push 0
push eax
call fcn.00428730
mov ecx, dword [ebp - 0x45c]
mov eax, 0x5c
mov word [ebp - 0x428], ax
cmp ecx, 0x7ffffffe
je 0x404a54
cmp dword [ebp - 0x458], 7
lea eax, [ebp - 0x46c]
push ecx
cmova eax, dword [ebp - 0x46c]
push eax
push 1
lea eax, [ebp - 0x428]
push eax
push ecx
push dword [ebp - 0x480]
lea ecx, [ebp - 0x8a0]
call fcn.004218f0
or esi, 0x20
mov dword [ebp - 0x870], esi
mov dword [ebp - 0x424], esi
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x8a0]
cmp dword [ebp - 0x88c], 7
lea ecx, [ebp - 0x7ec]
push dword [ebp - 0x890]
cmova eax, dword [ebp - 0x8a0]
push eax
call fcn.00422380
lea ecx, [ebp - 0x8a0]
call fcn.00428f60
mov byte [ebp - 4], 0x16
sub esp, 0x48
mov esi, esp
mov dword [ebp - 0x92c], esi
mov eax, dword [ebp - 0x800]
mov dword [esi], eax
lea ecx, [esi + 0x14]
mov eax, dword [ebp - 0x7fc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x7f8]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x7f4]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x7f0]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x7ec]
push eax
call fcn.00422b70
lea eax, [ebp - 0x7d4]
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x2c]
push eax
call fcn.00422b70
movzx eax, byte [ebp - 0x7bc]
mov byte [esi + 0x44], al
movzx eax, byte [ebp - 0x7bb]
mov byte [esi + 0x45], al
mov byte [ebp - 4], 0x16
call fcn.0045dde0
mov eax, dword [ebp - 0x800]
lea edx, [ebp - 0x854]
movq xmm0, qword [str.dump]
add esp, 0x48
mov dword [ebp - 0x42c], eax
mov eax, dword [0x628468]
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x8e8], 0x44313537
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x894], eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x7ec]
mov dword [ebp - 0x8e4], 0x34353337
mov ecx, dword [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x890], ecx
push eax
push 0x58
push str.Debugger_exception_0x:08X_successfully_dumped_process__into___dump_level:_:x_
lea ecx, [ebp - 0x8a0]
movq qword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0x258
call fcn.00408bd0
add esp, 0x14
lea ecx, [ebp - 0x4d0]
cmp dword [ebp - 0x7d8], 7
lea eax, [ebp - 0x7ec]
cmova eax, dword [ebp - 0x7ec]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x40438f
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0x4b0]
shrd ecx, eax, 0x14
mov eax, dword [ebp - 0x8a4]
add eax, 0x10
lock xadd dword [eax], ecx
mov esi, dword [ebp - 0x884]
mov dword [ebp - 4], 0x14
jmp 0x4046da
lea ecx, [ebp - 0x46c]
call fcn.00428f60
test edi, edi
je 0x404720
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x404720
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x884]
lock xadd dword [edi + 8], eax
jne 0x404720
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x404731
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x7d4]
mov byte [ebp - 4], 5
lea esi, [ebp - 0x7ec]
call fcn.00428f60
mov ecx, esi
call fcn.00428f60
cmp byte [ebp - 0x869], 0
je case.0x4034d1.2
jmp 0x404866
push dword [ebp - 0x854]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4034d1.2
mov eax, dword [0x628468]
lea edx, [ebp - 0x4a8]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x918], 0x44313537
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x894], eax
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x914], 0x34353337
mov ecx, dword [ebp - 0x914]
push eax
mov dword [ebp - 0x890], ecx
lea ecx, [ebp - 0x8a0]
push 0x2a
push str.Process_exited:___PID:___Exit_Code:_
movq qword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0x282
call fcn.00408ce0
add esp, 0x10
jmp 0x40485f
mov eax, dword [0x628468]
lea edx, [ebp - 0x854]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x8b0], 0x44313537
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x894], eax
lea eax, [ebp - 0x850]
push eax
mov dword [ebp - 0x8ac], 0x34353337
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp - 0x890], ecx
lea ecx, [ebp - 0x8a0]
push 0x19
push str.RIP_EVENT_occurred_:_
movq qword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0x295
call fcn.00408de0
add esp, 0xc
mov byte [ebp - 0x869], 1
mov edi, dword [ebp - 0x85c]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [0x6ecec8]
call fcn.00422c90
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4048ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
jmp 0x403724
push 0
lea eax, [ebp - 0x4ac]
mov dword [ebp - 0x490], edi
push eax
push 0
push 0
push 5
lea eax, [ebp - 0x490]
mov byte [ebp - 0x48c], 0
push eax
push 0xb2d601c4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4048e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
jmp 0x403724
mov eax, dword [0x628468]
mov edx, 7
movq xmm0, qword [str.dump]
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x8b0], 0x44313537
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x894], eax
lea eax, [ebp - 0x8a0]
mov dword [ebp - 0x8ac], 0x34353337
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp - 0x890], ecx
lea ecx, [ebp - 0x5e8]
push eax
movq qword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0x16c
call fcn.00425500
add esp, 4
push str.Debugging_of_own_process_is_not_supported
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 4
call fcn.00426ca0
lea ecx, [ebp - 0x5e8]
call fcn.00426780
lea ecx, [ebp - 0x4a8]
call fcn.00428f60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0059860b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8a4], eax
mov ecx, esi
lea eax, [ebp - 0x8a4]
push eax
call fcn.00407c10
add eax, 0x1c
lea ecx, [ebp - 0x96c]
push eax
push 0x3f
push str.Unable_to_start_debugging_of_process_with_id___error_code:_
call fcn.004088a0
push 0x68501c
lea eax, [ebp - 0x96c]
push eax
call fcn.00599dcb
push 0x684ffc
lea eax, [ebp - 0x920]
mov dword [ebp - 0x920], str.Unable_to_disable_kill_on_exit
push eax
call fcn.00599dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8a4], eax
mov ecx, esi
lea eax, [ebp - 0x8a4]
push eax
call fcn.00407c10
add eax, 0x1c
lea ecx, [ebp - 0x95c]
push eax
push 0x48
push str.Unable_to_wait_for_debugging_event_of_process_with_id___error_code:_
call fcn.004088a0
push 0x68501c
lea eax, [ebp - 0x95c]
push eax
call fcn.00599dcb
call fcn.005a3d9f
call fcn.00428ba0
nop dword [eax]
fdiv dword [eax + eax*2]
add byte [edi + esi], cl
inc eax
add byte [edi + 0x47], bl
inc eax
add byte [edi + esi], cl
inc eax
add byte [eax + 0x47], dh
inc eax
add byte [edi + 0x47], bl
inc eax
add byte [edi + esi], cl
inc eax
add byte [edi + esi], cl
inc eax
add ah, ch
inc edi
inc eax
invalid