Function at 0x435bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aed29
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x628960]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 0x18
mov dword [ebp - 0x44], 0
mov ecx, esp
xor eax, eax
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x60b914
mov word [ecx], ax
call fcn.004383d0
call fcn.004479e0
add esp, 0x18
test al, al
jne 0x435c1a
mov al, 1
jmp 0x435dd1
push 0x60b914
lea ecx, [ebp - 0x40]
call fcn.004384d0
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push 0x60b558
call fcn.004384d0
call fcn.00448570
add esp, 0x18
test al, al
jne 0x435dbc
sub esp, 0x18
mov ecx, esp
push 0x60b560
call fcn.004384d0
call fcn.00448570
add esp, 0x18
test al, al
je 0x435c6b
mov byte [edi], 1
sub esp, 0x18
mov ecx, esp
push 0x60b568
call fcn.004384d0
call fcn.00448570
add esp, 0x18
test al, al
je 0x435c8a
mov byte [edi + 1], 1
sub esp, 0x18
mov ecx, esp
push 0x60b570
call fcn.004384d0
call fcn.00448570
add esp, 0x18
test al, al
je 0x435e0b
sub esp, 0x18
mov ecx, esp
push 0x60b570
call fcn.004384d0
lea ecx, [ebp - 0x28]
call fcn.00448420
add esp, 0x18
lea ecx, [ebp - 0x40]
push eax
call fcn.00436ca0
cmp dword [ebp - 0x14], 8
jb 0x435cdd
push dword [ebp - 0x28]
call fcn.0048b2ba
add esp, 4
cmp dword [ebp - 0x30], 0
je 0x435d5b
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
mov cx, word [eax]
call fcn.00446b70
test al, al
je 0x435d5b
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00437e70
lea ecx, [ebp - 0x28]
call fcn.004450d0
add esp, 0x18
lea esi, [edi + 4]
mov ecx, esi
push eax
call fcn.00436ca0
lea ecx, [ebp - 0x28]
call fcn.00437ea0
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x4c]
mov ecx, esi
push eax
call fcn.00436e90
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00437e70
lea ecx, [ebp - 0x28]
call fcn.004450d0
add esp, 0x18
mov ecx, esi
push eax
call fcn.00436ca0
lea ecx, [ebp - 0x28]
call fcn.00437ea0
sub esp, 0x18
lea esi, [edi + 4]
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push esi
mov word [ecx], ax
call fcn.00437fd0
call fcn.00444210
add esp, 0x18
test al, al
jne 0x435ded
mov edx, 0x60b580
push esi
lea ecx, [ebp - 0x28]
call fcn.004370b0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x435da4
mov eax, dword [eax]
push 0x10
push 0x60b578
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x28]
call fcn.00437ea0
xor bl, bl
cmp dword [ebp - 0x2c], 8
jb 0x435dcf
push dword [ebp - 0x40]
call fcn.0048b2ba
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a0676
mov esp, ebp
pop ebp
ret
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00437e70
call fcn.004488b0
add esp, 0x18
test al, al
je 0x435e0b
mov edx, 0x60b598
jmp 0x435d90
sub esp, 0x18
mov ecx, esp
push str.defwlp
call fcn.004384d0
call fcn.00448570
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esp, 0x18
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test al, al
je 0x435e96
sub esp, 0x18
mov ecx, esp
push str.defwlp
call fcn.004384d0
lea ecx, [ebp - 0x28]
call fcn.00448420
mov dword [ebp - 0x44], vtable.CDefender.0
mov dword [ebp - 0x50], vtable.CDefenderExc.0
add esp, 0x10
mov byte [ebp - 4], 3
call fcn.00448c70
test al, al
je 0x435e83
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00437e70
push 0x1f4
push 3
push 0
call fcn.0044a7e0
push 0
call ebx
push eax
call edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00437ea0
sub esp, 0x18
mov ecx, esp
push str.defwlg
call fcn.004384d0
call fcn.00448570
add esp, 0x18
test al, al
je 0x435f8e
sub esp, 0x18
mov ecx, esp
push str.defwlg
call fcn.004384d0
lea ecx, [ebp - 0x28]
call fcn.00448420
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x435ed7
mov eax, dword [eax]
push eax
call fcn.004a0cd4
add esp, 4
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00437ea0
test esi, esi
je 0x435f10
mov dword [ebp - 0x4c], vtable.CDefender.0
sub esp, 8
mov byte [ebp - 4], 4
mov dword [ebp - 0x44], 1
call fcn.00448c70
test al, al
je 0x435f10
mov al, 1
jmp 0x435f12
xor al, al
mov dword [ebp - 4], 0
test al, al
je 0x435f87
sub esp, 0x18
mov ecx, esp
call fcn.0044ab90
mov dword [ebp - 0x4c], vtable.CDefenderExc.0
push 0x1f4
push 3
push 1
mov byte [ebp - 4], 5
call fcn.0044a7e0
push esi
mov byte [ebp - 0x45], al
mov byte [ebp - 4], 0
call fcn.00437bf0
mov esi, eax
add esp, 4
test esi, esi
je 0x435f66
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x45], 0
je 0x435f87
sub esp, 0x18
mov ecx, esp
call fcn.0044ab90
mov dword [ebp - 0x4c], vtable.CDefenderExc.0
push ecx
mov byte [ebp - 4], 6
call fcn.0044a160
push 0
call ebx
push eax
call edi
mov bl, 1
jmp 0x435dbe