Function at 0x48fefa
Capabilities:
Terminate process

Disassembly:
push 0x59c
mov eax, 0x510b26
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x588], esi
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x5a4]
call fcn.004404f9
and dword [ebp - 4], 0
lea eax, [esi + 0x42b8]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x5a4]
call fcn.004e6dba
xor edi, edi
mov dword [ebp - 0x598], edi
call fcn.004e3cd3
xor ecx, ecx
mov byte [ebp - 0x57e], al
xor eax, eax
inc ecx
cmp dword [esi + 0x4aac], eax
je 0x48ff68
cmp dword [esi + 0x4370], eax
cmove edi, ecx
mov dword [ebp - 0x598], edi
push 0xa0
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.004f5a90
add esp, 0xc
push 0x28
pop edi
cmp dword [ebp + 0xc], edi
cmovbe edi, dword [ebp + 0xc]
xor eax, eax
cmp dword [esi + 0x5fc], eax
je 0x48ffaa
cmp dword [esi + 0x5f4], eax
jne 0x48ffaa
inc eax
mov ecx, esi
cmp edi, eax
seta al
movzx eax, al
push eax
call fcn.00484069
mov edx, dword [esi + 0x5f4]
test edx, edx
je 0x490000
mov eax, dword [ebx]
mov dword [ebp - 0xb0], eax
xor eax, eax
push 2
inc eax
mov dword [ebp - 0xac], edx
pop ecx
mov dword [ebp - 0x57c], ecx
cmp edi, eax
jbe 0x49001e
mov esi, ecx
mov ecx, dword [ebx + eax*4]
test ecx, ecx
je 0x48ffe7
cmp ecx, edx
je 0x48ffe7
mov dword [ebp + esi*4 - 0xb0], ecx
inc esi
inc eax
cmp eax, edi
jb 0x48ffd4
mov dword [ebp - 0x57c], esi
mov esi, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x57c]
jmp 0x49001e
mov eax, edi
shl eax, 2
push eax
lea eax, [ebp - 0xb0]
push ebx
push eax
call fcn.004f5d30
mov ecx, edi
add esp, 0xc
mov dword [ebp - 0x57c], ecx
xor ebx, ebx
mov byte [ebp - 0x582], bl
mov eax, ebx
mov byte [ebp - 0x575], bl
mov byte [ebp - 0x57d], bl
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x594], eax
test ecx, ecx
je 0x490082
lea ebx, [esi + 0x4580]
mov esi, dword [ebp - 0x57c]
mov edi, dword [ebp + eax*4 - 0xb0]
xor edx, edx
mov ecx, ebx
cmp dword [ecx], edi
je 0x49006d
inc edx
add ecx, 4
cmp edx, 0x80
jb 0x49005b
jmp 0x490075
and dword [ebp + eax*4 - 0xb0], 0
inc eax
cmp eax, esi
jb 0x490050
mov esi, dword [ebp - 0x588]
xor ebx, ebx
mov edx, ebx
cmp dword [esi + 0x4578], ebx
jbe 0x4900ce
lea ebx, [esi + 0x4378]
xor eax, eax
mov ecx, ebx
cmp dword [ecx], eax
je 0x4900c0
cmp dword [ebp - 0x57c], 0
jbe 0x4900b8
mov edi, dword [ebx + edx*4]
cmp dword [ebp + eax*4 - 0xb0], edi
je 0x4900be
inc eax
cmp eax, dword [ebp - 0x57c]
jb 0x4900a6
xor eax, eax
mov dword [ecx], eax
jmp 0x4900c0
xor eax, eax
inc edx
add ecx, 4
cmp edx, dword [esi + 0x4578]
jb 0x490096
xor ebx, ebx
mov eax, dword [esi + 0x4360]
mov edx, ebx
mov edi, 0x98
test eax, eax
jle 0x490159
mov ecx, ebx
mov eax, dword [esi + 0x436c]
inc edx
mov byte [eax + ecx + 0x13], bl
add ecx, edi
mov eax, dword [esi + 0x4360]
cmp edx, eax
jl 0x4900e1
test eax, eax
jle 0x490159
mov edx, dword [ebp - 0x57c]
xor eax, eax
mov edi, eax
mov ecx, dword [esi + 0x436c]
test edx, edx
je 0x490142
mov edx, dword [ebp + eax*4 - 0xb0]
test edx, edx
je 0x490120
cmp edx, dword [ecx + edi]
je 0x49012d
mov edx, dword [ebp - 0x57c]
inc eax
cmp eax, edx
jb 0x490110
jmp 0x490142
xor edx, edx
inc edx
and dword [ebp + eax*4 - 0xb0], 0
mov byte [ecx + edi + 0x13], dl
mov edx, dword [ebp - 0x57c]
inc ebx
add edi, 0x98
push 0
pop eax
cmp ebx, dword [esi + 0x4360]
jl 0x490106
mov edi, 0x98
mov ecx, dword [ebp - 0x57c]
xor edx, edx
mov eax, edx
test ecx, ecx
je 0x490186
cmp dword [ebp + eax*4 - 0xb0], edx
jne 0x490179
inc eax
cmp eax, ecx
jb 0x490167
mov bl, dl
jmp 0x490188
xor eax, eax
inc eax
mov bl, al
mov byte [ebp - 0x575], bl
jmp 0x490188
mov bl, al
mov ecx, edx
mov edx, dword [esi + 0x4360]
test edx, edx
jle 0x4901b6
mov eax, dword [esi + 0x436c]
add eax, 0x13
cmp byte [eax], 0
je 0x4901b1
inc ecx
add eax, edi
cmp ecx, edx
jl 0x49019d
mov al, byte [ebp - 0x57d]
jmp 0x4901b8
xor eax, eax
inc eax
jmp 0x4901b8
mov al, cl
test bl, bl
jne 0x4901c4
test al, al
je 0x4904e5
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x588], ebx
cmp ebx, 0xffffffff
jne 0x49020b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2b0]
push str.Cant_create_process_snapshot__ErrCode0x_08X
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebp, ebp
push edi
push ebp
call esi
push dword [0x582ee4]
mov ebx, eax
call esi
push dword [0x582ee0]
mov esi, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [0x582ee0]
pop eax
add byte [ebx + 0x15ff55f0], cl
sbb al, 0x43
push ecx
add bh, bh
xor eax, 0x582ee0
mov dword [esp + 0x14], ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, ebp
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x88
jl 0x490230
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4902ca
mov esi, dword [0x582eac]
lea eax, [esp + 0x10]
push eax
push dword [0x582ed0]
push 0x6000
push esi
call edi
mov edx, dword [0x582edc]
lea ecx, [esi + 8]
add edx, ebx
mov ebx, 0x17fe
mov eax, dword [edx + 4]
sub edx, esi
mov dword [esp + 0x14], eax
mov eax, dword [edx + ecx]
add eax, dword [esp + 0x14]
mov dword [ecx], eax
lea ecx, [ecx + 4]
sub ebx, 1
jne 0x490287
mov eax, dword [0x582ed8]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6000
push esi
call edi
mov eax, dword [0x582ee8]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x582ee8]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov edi, eax
cmp dword [esi + 0x4360], eax
jle 0x49054b
mov ebx, eax
mov eax, dword [esi + 0x436c]
cmp byte [eax + ebx + 0x12], 0
je 0x490510
cmp byte [eax + ebx + 0x13], 0
je 0x490510
inc edi
add ebx, 0x98
jmp 0x490543
mov cl, byte [ebp - 0x582]
movzx eax, cl
test cl, cl
push 1
pop ecx
cmove eax, ecx
lea ecx, [ebp - 0x5a4]
push 0x12c
mov byte [ebp - 0x582], al
call fcn.004e6f5a
push edi
lea ecx, [esi + 0x435c]
call fcn.00496dd7
cmp edi, dword [esi + 0x4360]
jl 0x4904f3
xor eax, eax
lea ecx, [ebp - 0x5a4]
inc eax
push eax
call fcn.004e7049
test eax, eax
je 0x49057f
lea ecx, [ebp - 0x5a4]
call fcn.004e6fd1
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x42b8]
push eax
lea ecx, [ebp - 0x5a4]
call fcn.004e6dba
lea eax, [ebp - 0x594]
push eax
call fcn.0048203b
pop ecx
push dword [ebp - 0x582]
mov ecx, esi
call fcn.004905c9
xor ecx, ecx
test al, al
push 1
movzx ebx, cl
pop eax
cmovne ebx, eax
cmp dword [ebp - 0x598], ecx
je 0x4905b4
mov dword [esi + 0x4aac], ecx
lea ecx, [ebp - 0x5a4]
call fcn.004e6c72
mov al, bl
call fcn.004f418c
ret 8