Function at 0x406e2c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x727ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x50], ecx
push 0
mov ecx, dword [ebp - 0x50]
call fcn.0072185a
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
add ecx, 0x5ac
call fcn.006e0630
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x50]
mov dword [eax], 0x739a00
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x558], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0xc0], 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00408055
add esp, 8
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x18]
and edx, 0x800000
test edx, edx
je 0x406ebd
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xc0], 1
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0xe0], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0xc4], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xe8], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0xec], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0xf0], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xf4], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x5a8], 1
mov edx, dword [ebp - 0x50]
mov dword [edx + 0xa7c], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x55c], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x580], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x100], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x104], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x108], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x544], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x554], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x548], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x54c], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x550], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x560], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x564], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x61c], 0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 0xfc]
and edx, 0xfffffff0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xfc], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 0xfc]
or edx, 0x10
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xfc], edx
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x620], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x624], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x648], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x64c], 0
mov edx, dword [ebp - 0x50]
mov dword [edx + 0xa64], 0x3e8
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xa68], 0x3e8
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0xa6c], 8
mov edx, dword [ebp - 0x50]
mov dword [edx + 0xa70], 0x12c
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x407084
push 0
push 0
push 0x77f57c
call fcn.00710f30
push 0xffffffffffffffff
call fcn.006edd91
push 0x430101
mov ecx, 0x79f438
call fcn.00652349
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4070b7
cmp dword [ebp - 0x14], 0
je 0x4070b7
push 0
push 0
push 0x77f590
call fcn.00710f30
push 0xffffffffffffffff
call fcn.006edd91
mov ecx, dword [ebp - 0x50]
call fcn.00408945
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x5a8], eax
mov edx, dword [ebp - 0x50]
cmp dword [edx + 0x5a8], 0
jne 0x4070e1
mov eax, dword [ebp - 0x50]
mov dword [eax + 0xe8], 1
mov ecx, dword [ebp - 0x50]
call fcn.00406a2a
test eax, eax
je 0x407294
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0xeb0], 0x31fb
mov edx, dword [ebp - 0x50]
mov word [edx + 0xeb2], 0
mov eax, dword [ebp - 0x50]
mov word [eax + 0xeb4], 0xda92
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0xeb6], 0
mov edx, dword [ebp - 0x50]
mov byte [edx + 0xeb8], 0xff
mov eax, dword [ebp - 0x50]
mov word [eax + 0xeba], 0xffff
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0xea4], 0x1a01
mov edx, dword [ebp - 0x50]
mov word [edx + 0xea6], 0x5a4b
mov eax, dword [ebp - 0x50]
mov word [eax + 0xebc], 0
mov ecx, dword [ebp - 0x50]
mov byte [ecx + 0xebe], 0
mov edx, dword [ebp - 0x50]
mov byte [edx + 0xf67], 0
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x1010], 0
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0x1014], 0xffff
mov edx, dword [ebp - 0x50]
mov word [edx + 0x1016], 0xffff
mov eax, dword [ebp - 0x50]
mov word [eax + 0x1018], 0xffff
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0x101a], 0xffff
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x101c], 0xff
mov eax, dword [ebp - 0x50]
mov word [eax + 0x101e], 0xffff
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0x1020], 0xffff
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x1022], 0xff
mov eax, dword [ebp - 0x50]
add eax, 0xa80
push eax
call fcn.006ebfc0
and eax, 0xffff
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x407225
cmp dword [ebp - 0x40], 0xc
jne 0x40720c
push 0xffffffffffffffff
push 0
push 0x63
call fcn.00710f68
push 0xffffffffffffffff
call fcn.006edd91
mov ecx, dword [ebp - 0x50]
add ecx, 0xa80
push ecx
call fcn.006ec860
and eax, 0xffff
mov dword [ebp - 0x48], eax
jmp 0x407255
mov edx, dword [ebp - 0x50]
mov ax, word [edx + 0xea4]
add ax, 0x54a1
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0xea4], ax
mov edx, dword [ebp - 0x50]
mov ax, word [edx + 0xea6]
add ax, 0x6504
mov ecx, dword [ebp - 0x50]
mov word [ecx + 0xea6], ax
mov edx, dword [ebp - 0x50]
mov ax, word [edx + 0xea4]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0xa80
push ecx
call fcn.006ec1a0
and eax, 0xffff
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x407294
mov edx, dword [ebp - 0x50]
add edx, 0xa80
push edx
call fcn.006ec860
and eax, 0xffff
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x584], 0
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x588], 0xffffff
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x58c], 0xff
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x590], 0xff00
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x594], 0xff0000
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x598], 0xffff00
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x59c], 0xff00ff
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x5a0], 0xffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret