Function at 0x490a60
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c0
call fcn.004c39f0
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push 0x4f9d20
push esi
push eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1068], ecx
call fcn.004c913a
mov eax, dword [ebp - 0x1068]
add esp, 0xc
test eax, eax
je 0x490ab4
mov dword [eax], 0
cmp word [ebx], 0
je 0x490af4
mov ecx, str._Unknown_type_
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x490ae7
test dx, dx
je 0x490ae3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x490ae7
add eax, 4
add ecx, 4
test dx, dx
jne 0x490ac1
xor eax, eax
jmp 0x490aec
sbb eax, eax
or eax, 1
test eax, eax
jne 0x490c33
push 0
push dword [edi + 8]
push dword [edi + 4]
call fcn.00495900
add esp, 0xc
mov dword [ebp - 0x1064], eax
test eax, eax
jne 0x490bad
cmp dword [0x5355f4], 0xffffffff
je 0x490b9a
lea esi, [esi*2 + 8]
push esi
call fcn.004c8d7a
mov ecx, dword [edi + 4]
add esp, 4
mov dword [ebp - 0x107c], ecx
mov ecx, dword [edi]
mov dword [ebp - 0x1078], ecx
mov ecx, dword [edi + 8]
push 0
mov dword [ebp - 0x1070], ecx
lea ecx, [ebp - 0x1064]
push ecx
push esi
push eax
push 0x10
mov dword [ebp - 0x1060], eax
lea eax, [ebp - 0x107c]
push eax
push 0x8335004c
push dword [0x5355f4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [ebp - 0x1060]
test eax, eax
je 0x490b89
lea eax, [esi + 4]
push eax
push 0x40
push ebx
call fcn.004c913a
add esp, 0xc
push esi
call fcn.004c8d5f
mov esi, dword [ebp + 0x14]
add esp, 4
jmp 0x490c33
push str._Unknown_type_
push ebx
call fcn.0048d7b0
add esp, 8
jmp 0x490c33
lea ecx, [ebp - 0x1058]
push ecx
push 0
push 0
push 2
push eax
call sub.ntdll.dll_NtQueryObject
push dword [ebp - 0x1058]
call fcn.004c8d7a
add esp, 4
mov dword [ebp - 0x1060], eax
push 0
push dword [ebp - 0x1058]
push eax
push 2
push dword [ebp - 0x1064]
call sub.ntdll.dll_NtQueryObject
test eax, eax
jne 0x490c0a
mov ecx, dword [ebp - 0x1060]
movzx eax, word [ecx]
shr eax, 1
push eax
push dword [ecx + 4]
push 0x40
push ebx
call fcn.004c935f
add esp, 0x10
jmp 0x490c19
push eax
push str._Unknown_type:__X_
push ebx
call fcn.0048d7b0
add esp, 0xc
push dword [ebp - 0x1060]
call fcn.004c8d5f
add esp, 4
push dword [ebp - 0x1064]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.process
push ebx
call fcn.004c9460
add esp, 8
test eax, eax
je 0x490fd1
push str.thread
push ebx
call fcn.004c9460
add esp, 8
test eax, eax
je 0x490fd1
push str.token
push ebx
call fcn.004c9460
add esp, 8
test eax, eax
jne 0x490d8f
push 8
push dword [edi + 8]
push dword [edi + 4]
call fcn.00495900
mov edi, eax
add esp, 0xc
test edi, edi
je 0x49112a
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x106c]
push eax
push 0x38
lea eax, [ebp - 0x1054]
mov dword [ebp - 0x1048], 0
push eax
push 0xa
push edi
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x106c], 0x38
call esi
mov eax, dword [ebp - 0x1048]
mov ebx, dword [ebp - 0x104c]
mov dword [ebp - 0x1068], eax
lea eax, [ebp - 0x106c]
push eax
push 0x800
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x106c], 0x800
push eax
push 1
push edi
call esi
test eax, eax
je 0x490d77
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x1084], 0x104
push eax
lea eax, [ebp - 0x1080]
mov dword [ebp - 0x1080], 0x104
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x101c]
push 0x4f9d20
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x490d77
push dword [ebp - 0x1068]
lea eax, [ebp - 0x40c]
push ebx
push eax
lea eax, [ebp - 0x614]
push eax
push str._s_s:_llx
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push str.EtwRegistration
push ebx
call fcn.004c9460
add esp, 8
test eax, eax
jne 0x490dd9
push eax
push dword [edi + 8]
push dword [edi + 4]
call fcn.00495900
mov edi, eax
add esp, 0xc
test edi, edi
je 0x49112a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
cmp dword [0x5355f4], 0xffffffff
je 0x490e86
lea esi, [esi*2 + 8]
push esi
call fcn.004c8d7a
mov ecx, dword [edi + 4]
mov dword [ebp - 0x107c], ecx
mov ecx, dword [edi]
push str.file
push ebx
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1078], ecx
call fcn.004c9460
mov ebx, dword [ebp - 0x1064]
test eax, eax
mov eax, dword [edi + 8]
push esi
push ebx
mov dword [ebp - 0x1070], eax
sete byte [ebp - 0x1074]
push 0x10
lea eax, [ebp - 0x107c]
push eax
push 0x83350048
call fcn.004a79c0
add esp, 0x20
test eax, eax
je 0x490e6c
lea eax, [ebx + 4]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.004c913a
mov ecx, dword [ebp - 0x1068]
add esp, 0xc
test ecx, ecx
je 0x490e6c
mov eax, dword [ebx]
mov dword [ecx], eax
push ebx
call fcn.004c8d5f
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0
push dword [edi + 8]
push dword [edi + 4]
call fcn.00495900
mov edi, eax
add esp, 0xc
test edi, edi
je 0x49112a
push 0x400
mov dword [ebp - 0x1058], 0x400
call fcn.004c8d7a
mov ecx, dword [ebp - 0x1058]
mov ebx, eax
add esp, 4
xorps xmm0, xmm0
add ecx, 0xfffffff8
movq qword [ebx], xmm0
push 0x550af8
mov word [ebx], cx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x550a6c], 0
jne 0x490f04
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x550a6c], eax
call esi
mov dword [0x550a70], eax
cmp dword [0x550a68], 0
jne 0x490f2e
lea eax, [ebp - 0x108c]
push eax
push 0
push 0
push 0x490670
push 0
push 0
call fcn.004d6126
add esp, 0x18
mov dword [0x550a68], eax
push dword [0x550a6c]
mov dword [0x550a78], ebx
mov dword [0x550a74], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
push dword [0x550a70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x490f84
push 1
push dword [0x550a68]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x550a68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x550a68], 0
jmp 0x490fa5
cmp dword [0x550a7c], 0
jne 0x490fa5
cmp dword [ebx + 4], 0
je 0x490fa5
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0x105c]
call fcn.004a7570
add esp, 0xc
push ebx
call fcn.004c8d5f
add esp, 4
push 0x550af8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push str.process
push ebx
call fcn.004c9460
neg eax
sbb eax, eax
and eax, 0xfffffc40
add eax, 0x400
push eax
push dword [edi + 8]
push dword [edi + 4]
call fcn.00495900
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4910f5
push str.Process
push ebx
call fcn.004c9460
add esp, 8
test eax, eax
lea eax, [ebp - 0x1058]
push eax
jne 0x491087
push 0x18
lea eax, [ebp - 0x10c0]
push eax
push 0
push edi
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x4910dd
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x10b0]
call fcn.004aa690
push dword [ebp - 0x10b0]
lea eax, [ebp - 0x204]
push eax
push str._s__d_
push esi
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x10a8]
push eax
push 0
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
jne 0x4910dd
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x10a0]
call fcn.004aa690
push dword [ebp - 0x109c]
lea eax, [ebp - 0x204]
push dword [ebp - 0x10a0]
push eax
push str._s__d_:__d
push esi
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x28
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
cmp dword [0x5355f4], 0xffffffff
je 0x49112a
lea eax, [ebp - 0x81c]
push 0x104
push eax
call fcn.004904a0
lea eax, [ebp - 0x81c]
push eax
push 0x511550
push esi
push dword [ebp - 0x105c]
call fcn.00415290
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret