Function at 0x40abf0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0x358]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x5c]
cmp dword [eax], 0
je 0x40b191
mov eax, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push edi
lea edi, [esi + 0x2e8]
mov dword [esp + 0x10], eax
nop dword [eax]
push 0x1f4
push edi
call ebp
test eax, eax
je 0x40b09d
mov eax, dword [edi]
dec eax
cmp eax, 8
ja case.default.0x40ac4c
jmp dword [eax*4 + 0x40b198]
cmp dword [esi + 0x344], 0
je 0x40b0b1
mov ecx, dword [esi + 0x2f4]
mov eax, 0x80010001
cmp ecx, 0x80000003
mov edx, 0x10002
cmove eax, edx
mov dword [esi + 0x360], eax
cmp ecx, 0xc0000409
je 0x40ac9b
cmp ecx, 0xc0000374
je 0x40ac9b
cmp ecx, 0xc000041d
jne case.default.0x40ac4c
mov ecx, esi
call fcn.00414e00
jmp case.default.0x40ac4c
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x40ac4c
cmp byte [0x4e01d8], 0
je case.default.0x40ac4c
cmp byte [0x4e0220], 0
je case.default.0x40ac4c
push dword [esi + 0x2f8]
push dword [esi + 0x2fc]
push dword [esi + 0x2f4]
push dword [esi + 0x2f0]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_CreateThread_TID1:__08p__TID2:__08p__Base:_0x_p__TLB:_0x_p__n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x28
jmp case.default.0x40ac4c
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x40ad79
cmp byte [0x4e01d8], 0
je 0x40ad79
cmp byte [0x4e0220], 0
je 0x40ad43
push dword [esi + 0x2f8]
push str.Debugger:_CreateProcess_hProcess:_0x_08I32X__n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x14
cmp byte [0x4e01d8], 0
je 0x40ad79
cmp byte [0x4e0220], 0
je 0x40ad79
push dword [esi + 0x300]
movzx eax, word [esi + 0x318]
push eax
push str.Debugger:_CreateProcess_Unicode:__d__Base:_0x_p__n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x18
mov eax, dword [esi + 0x2f8]
mov dword [esi + 0x348], eax
mov eax, dword [esi + 0x2f4]
test eax, eax
je case.default.0x40ac4c
cmp eax, 0xffffffff
je case.default.0x40ac4c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x40ac4c
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x40ac4c
cmp byte [0x4e01d8], 0
je case.default.0x40ac4c
cmp byte [0x4e0220], 0
je case.default.0x40ac4c
push dword [esi + 0x2f4]
push dword [esi + 0x2f0]
push str.Debugger:_ExitThread_TID:_0x_08X__ExitCode:_0x_X__n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x18
jmp case.default.0x40ac4c
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x40af27
mov eax, dword [esi + 0x304]
test eax, eax
je 0x40aef0
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push ecx
push 8
lea ecx, [esp + 0x20]
movlpd qword [esp + 0x20], xmm0
push ecx
push eax
push dword [esi + 0x348]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x40aef0
cmp dword [esp + 0x14], 0
je 0x40aef0
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.00412610
test eax, eax
je 0x40aef0
cmp word [esi + 0x308], 0
je 0x40aec2
cmp byte [0x4e01d8], 0
je 0x40af27
cmp byte [0x4e0220], 0
je 0x40af27
push dword [esi + 0x2f8]
push dword [esi + 0x37c]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__s___0x_p_n
push 0
push 8
push 0x460180
call fcn.004173d0
mov eax, dword [esi + 0x2f4]
add esp, 0x20
jmp 0x40ad93
cmp byte [0x4e01d8], 0
je 0x40af27
cmp byte [0x4e0220], 0
je 0x40af27
push dword [esi + 0x2f8]
push dword [esi + 0x37c]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__S___0x_p_n
jmp 0x40aea6
cmp byte [0x4e01d8], 0
je 0x40af27
cmp byte [0x4e0220], 0
je 0x40af27
push dword [esi + 0x2f8]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll____p_n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x1c
mov eax, dword [esi + 0x2f4]
jmp 0x40ad93
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x40ac4c
cmp byte [0x4e01d8], 0
je case.default.0x40ac4c
cmp byte [0x4e0220], 0
je case.default.0x40ac4c
push dword [esi + 0x2f4]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_UnloadDll___0x_p_n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x1c
jmp case.default.0x40ac4c
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x40ac4c
movzx eax, word [esi + 0x2fa]
test ax, ax
je case.default.0x40ac4c
cmp dword [esi + 0x2f4], 0
je case.default.0x40ac4c
push eax
lea ecx, [esi + 0x36c]
call fcn.00410790
test al, al
je case.default.0x40ac4c
push dword [esi + 0x2f4]
mov ecx, esi
call fcn.00412610
test eax, eax
je case.default.0x40ac4c
cmp word [esi + 0x2f8], 0
je 0x40b015
cmp byte [0x4e01d8], 0
je case.default.0x40ac4c
cmp byte [0x4e0220], 0
je case.default.0x40ac4c
push dword [esi + 0x37c]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__s_n
jmp 0x40af6e
cmp byte [0x4e01d8], 0
je case.default.0x40ac4c
cmp byte [0x4e0220], 0
je case.default.0x40ac4c
push dword [esi + 0x37c]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__S_n
jmp 0x40af6e
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x40ac4c
cmp byte [0x4e01d8], 0
je case.default.0x40ac4c
cmp byte [0x4e0220], 0
je case.default.0x40ac4c
push dword [esi + 0x2f8]
push dword [esi + 0x2f4]
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_Rip:_Error:_0x_X__Type:_0x_X__n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x20
push dword [esi + 0x360]
push dword [esi + 0x2f0]
push dword [esi + 0x2ec]
call dword [esp + 0x1c]
mov eax, dword [esi + 0x5c]
cmp dword [eax], 0
jne 0x40ac30
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x40b0ec
cmp byte [0x4e01d8], 0
je 0x40b0ec
cmp byte [0x4e0220], 0
je 0x40b0ec
push dword [esi + 0x364]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_EXCEPTION_DEBUG_EVENT__FirstChance_Exception___Crash._n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x18
mov ecx, esi
call fcn.00409e10
push 1
push dword [esi + 0x348]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop ebp
pop ebx
mov dword [esi + 0x348], 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x40b151
cmp byte [0x4e01d8], 0
je 0x40b151
cmp byte [0x4e0220], 0
je 0x40b151
push dword [esi + 0x2f4]
push dword [esi + 0x2f0]
push str.Debugger:_ExitProcess_TID:_0x_08X__ExitCode:_0x_x__n
push 0
push 8
push 0x460180
call fcn.004173d0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, 0x10002
shr eax, 0x19
not al
test al, 1
mov eax, 0x40010004
cmove eax, ecx
mov ecx, esi
mov dword [esi + 0x360], eax
mov eax, dword [esi]
call dword [eax + 0x88]
push dword [esi + 0x360]
push dword [esi + 0x2f0]
push dword [esi + 0x2ec]
call dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret