Function at 0x4a1f40
Capabilities:
Enumerate pe sections
Get common file path
Get file size
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
lea ebx, [ebp - 0x110]
mov edi, dword fs:[0x18]
sub esp, 0x134
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x120], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5d3758
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0xd9
mov eax, dword [edi + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp + 4], str.failed_to_create__s_err__lu_n
mov dword [esp], eax
call fcn.0049fda0
cmp ebx, 0xffffffff
je 0x4a23f8
lea esi, [ebp - 0x114]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov ecx, dword [ebp - 0x120]
mov dword [esp + 4], 0x79e760
mov dword [esp + 8], ecx
mov ecx, dword [sym.imp.kernel32.dll_WriteFile]
mov dword [esp], ebx
mov dword [ebp - 0x11c], ecx
call ecx
sub esp, 0x14
mov dword [ebp - 0x124], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0xde
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x124]
mov dword [esp], edx
call fcn.0049fda0
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x18
mov eax, dword [ebp - 0x118]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x11c]
call ecx
sub esp, 0x14
mov dword [ebp - 0x124], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0xe2
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x124]
mov dword [esp], edx
call fcn.0049fda0
mov eax, dword [ebp - 0x118]
cmp word [eax + 0x14], 0
jne 0x4a2170
mov eax, dword [ebp - 0x118]
movzx eax, word [eax + 6]
cmp ax, 1
ja 0x4a241b
test ax, ax
jne 0x4a22c0
mov dword [esp + 4], 0
mov edi, dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [esp], ebx
call edi
sub esp, 8
cmp eax, 0x10b
jbe 0x4a2250
mov dword [esp], ebx
mov dword [esp + 4], 0
call edi
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, 0x18
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xe0
mov dword [esp + 4], eax
mov dword [esp], ebx
mov ecx, dword [ebp - 0x11c]
call ecx
sub esp, 0x14
mov dword [ebp - 0x124], eax
mov eax, 0xea
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x124]
mov dword [esp], edx
call fcn.0049fda0
mov eax, dword [ebp - 0x118]
movzx eax, word [eax + 0x14]
cmp ax, 0xe0
jbe 0x4a2100
sub eax, 0xe0
cmp eax, 0xfff
ja 0x4a2438
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5d7340
mov eax, dword [ebp - 0x11c]
call eax
sub esp, 0x14
mov dword [ebp - 0x124], eax
mov eax, 0xf1
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x124]
mov dword [esp], edx
call fcn.0049fda0
jmp 0x4a2100
mov ecx, 0x10c
sub ecx, eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x118], edx
mov dword [edx + 0x34], 0xdeadbeef
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0x5d7340
mov eax, dword [ebp - 0x11c]
call eax
sub esp, 0x14
mov esi, eax
mov eax, 0x11a
call fcn.0049f440
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0049fda0
jmp 0x4a213e
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edi, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x120]
movzx eax, word [edi + 0x14]
mov dword [esp], ebx
lea eax, [ecx + eax + 0x18]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [edi + 0x38]
mov edx, 0x64
mov dword [0x57f2d0], 0xa
sub esp, 0x10
cmp eax, dword [0x79ea48]
jb 0x4a2408
mov edi, dword [ebp - 0x120]
mov dword [0x57f2c8], edx
mov dword [0x57f2cc], eax
mov dword [0x57f2d4], edi
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0x57f2c0
mov eax, dword [ebp - 0x11c]
call eax
sub esp, 0x14
mov dword [ebp - 0x118], eax
mov eax, 0x10b
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x118]
mov dword [esp], edx
call fcn.0049fda0
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], str.section_data
mov eax, dword [ebp - 0x11c]
call eax
sub esp, 0x14
mov dword [ebp - 0x118], eax
mov eax, 0x110
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x118]
mov dword [esp], edx
call fcn.0049fda0
jmp 0x4a211d
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x54]
mov edx, 5
mov dword [ebp - 0x120], eax
jmp 0x4a2312
mov dword [esp + 8], 0xf5
mov dword [esp + 4], str..._dlls_kernel32_tests_loader.c
mov dword [esp], str.nt_header__FileHeader.NumberOfSections___1
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0xee
mov dword [esp + 4], str..._dlls_kernel32_tests_loader.c
mov dword [esp], str.file_align___sizeof_filler_
call dword [sym.imp.msvcrt.dll__assert]
lea esi, [esi]
lea esi, [esi]
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xb0
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x8c], eax
mov eax, 0xba7
call fcn.0049f440
mov dword [esp + 4], str.inside_loader_lock_should_not_be_set_n
xor eax, eax
mov edx, dword [0x79e064]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xba8
call fcn.0049f440
mov dword [esp + 4], str.inside_peb_lock_should_not_be_set_n
xor eax, eax
mov ecx, dword [0x79e060]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.0049fda0
cmp edi, 2
je 0x4a33c0
ja 0x4a26c0
test edi, edi
je 0x4a2870
mov eax, 0xbad
call fcn.0049f440
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8c]
mov dword [esp], str.dll:__p__DLL_PROCESS_ATTACH___p_n
mov dword [esp + 4], eax
call fcn.0049f7c0
call dword [0x79e7f4]
movzx eax, al
mov dword [ebp - 0x88], eax
mov eax, 0xbb0
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.RtlDllShutdownInProgress_returned__ld_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov esi, dword [0x79e7b8]
test esi, esi
je 0x4a2692
mov dword [esp], 0x4a01c0
call dword [0x79e7c0]
sub esp, 4
mov dword [ebp - 0x88], eax
mov eax, 0xbb8
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.FlsAlloc_returned__ld_n
cmp eax, 0xffffffff
mov dword [esp + 8], eax
setne al
movzx eax, al
mov dword [esp], eax
mov esi, dword fs:[0x18]
call fcn.0049fda0
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [0x57f2ac], eax
mov dword [esp], eax
call dword [0x79e7b8]
sub esp, 4
mov ebx, eax
mov eax, 0xbbc
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.FlsGetValue_returned__p__expected_NULL_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xbbd
call fcn.0049f440
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.FlsGetValue_failed_with_error__lu_n
mov dword [esp + 8], eax
mov ebx, dword [esi + 0x34]
xor eax, eax
test ebx, ebx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0x31415
mov eax, dword [0x57f2ac]
mov dword [esp], eax
call dword [0x79e7bc]
sub esp, 8
mov ebx, eax
mov eax, 0xbbf
call fcn.0049f440
mov dword [esp + 4], str.FlsSetValue_failed_n
mov dword [esp], ebx
call fcn.0049fda0
add dword [0x79e04c], 1
mov dword [esp], 0x4a01c0
call dword [0x79e7c0]
sub esp, 4
mov dword [0x57f2a8], eax
mov eax, 0xbc3
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.FlsAlloc_returned__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [0x57f2a8], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0049fda0
add dword [0x79e048], 1
mov eax, dword [0x79ea50]
mov edx, dword [0x8f075c]
mov dword [eax], edx
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
cmp edi, 3
jne 0x4a34f0
mov eax, 0xcc5
call fcn.0049f440
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8c]
mov dword [esp], str.dll:__p__DLL_THREAD_DETACH___p_n
mov dword [esp + 4], eax
call fcn.0049f7c0
sub dword [0x79e048], 1
add dword [0x79e044], 1
call dword [0x79e7f4]
mov ebx, dword [0x79e040]
movzx eax, al
mov dword [ebp - 0x88], eax
test ebx, ebx
je 0x4a3520
mov eax, 0xccf
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.RtlDllShutdownInProgress_returned__ld_n
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79e7b8]
test eax, eax
je 0x4a2699
mov edx, dword [0x57f2ac]
cmp edx, 0xffffffff
je 0x4a2699
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], edx
call eax
sub esp, 4
mov ebx, eax
mov eax, 0xcdd
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.FlsGetValue_returned__p__expected_NULL_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xcde
call fcn.0049f440
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.FlsGetValue_failed_with_error__lu_n
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x34]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0x31415
mov eax, dword [0x57f2a8]
mov dword [esp], eax
call dword [0x79e7bc]
sub esp, 8
mov ebx, eax
mov eax, 0xce1
call fcn.0049f440
mov dword [esp + 4], str.FlsSetValue_failed_n
mov dword [esp], ebx
call fcn.0049fda0
mov edi, dword [0x79e050]
test edi, edi
je 0x4a2699
mov ebx, dword [edi]
mov edx, dword [esi + 0xfb4]
cmp edi, ebx
je 0x4a3aaa
mov ecx, 0xffffffff
xor esi, esi
jmp 0x4a282d
mov ebx, dword [ebx]
add esi, 1
cmp edi, ebx
je 0x4a3660
cmp edx, ebx
jne 0x4a2820
mov eax, 0xb96
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x90], ecx
call fcn.0049f440
mov dword [esp + 4], str.Duplicate_list_entry._n
xor eax, eax
mov ecx, dword [ebp - 0x90]
cmp ecx, 0xffffffff
sete al
mov dword [esp], eax
call fcn.0049fda0
mov edx, dword [ebp - 0x8c]
mov ecx, esi
jmp 0x4a2820
mov eax, 0xbd0
call fcn.0049f440
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8c]
mov dword [esp], str.dll:__p__DLL_PROCESS_DETACH___p_n
mov dword [esp + 4], eax
call fcn.0049f7c0
mov eax, dword [0x79e068]
lea ecx, [eax - 4]
cmp ecx, 1
jbe 0x4a35b0
cmp eax, 6
je 0x4a3a00
cmp eax, 7
je 0x4a3a80
mov ecx, eax
and ecx, 0xfffffffb
cmp ecx, 3
je 0x4a28ca
cmp eax, 1
ja 0x4a35d8
mov eax, 0xbea
call fcn.0049f440
xor eax, eax
test esi, esi
mov dword [esp + 8], esi
setne al
mov dword [esp + 4], str.dll:_param__p_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79e068]
cmp eax, 1
jbe 0x4a3618
cmp eax, 3
je 0x4a3608
mov ebx, 0x103
cmp eax, 7
je 0x4a3aa0
call dword [0x79e7f4]
movzx eax, al
mov dword [ebp - 0x88], eax
mov eax, dword [0x79e068]
cmp eax, 1
jbe 0x4a37f0
cmp eax, 3
je 0x4a37f0
mov dword [ebp - 0x90], 0
call fcn.0057d110
mov edx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea ecx, [edx + edx]
mov edx, dword [ebp - 0x90]
or ecx, edx
mov dword [eax + 0x10], ecx
jmp 0x4a299c
mov eax, 0xbfc
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.RtlDllShutdownInProgress_returned__ld_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4a2968
test esi, esi
je 0x4a2a80
mov eax, dword [0x79e7b8]
test eax, eax
je 0x4a2a80
mov edx, dword [0x57f2ac]
mov ecx, dword fs:[0x18]
mov dword [ecx + 0x34], 0xdeadbeef
mov dword [ebp - 0x94], ecx
mov dword [esp], edx
call eax
sub esp, 4
mov dword [ebp - 0x90], eax
mov eax, 0xc07
call fcn.0049f440
mov edx, dword [ebp - 0x90]
xor eax, eax
mov dword [esp + 4], str.FlsGetValue_returned__p__expected_NULL_n
test edx, edx
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc08
call fcn.0049f440
mov ecx, dword [ebp - 0x94]
mov eax, dword [ecx + 0x34]
mov dword [esp + 4], str.FlsGetValue_failed_with_error__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0x34]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc09
call fcn.0049f440
mov eax, dword [0x79e044]
mov ecx, dword [0x79e054]
mov dword [esp + 4], str.wrong_FLS_callback_count__ld__expected__d_n
add eax, 1
mov dword [esp + 8], ecx
cmp eax, ecx
mov dword [esp + 0xc], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79e7b4]
test eax, eax
je 0x4a2b0d
mov ecx, dword [0x57f2ac]
mov dword [esp], ecx
call eax
sub esp, 4
mov dword [ebp - 0x90], eax
mov eax, 0xc11
call fcn.0049f440
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.FlsFree_failed_with_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x90]
mov dword [esp], edx
call fcn.0049fda0
mov eax, 0xc13
mov dword [0x57f2ac], 0xffffffff
call fcn.0049f440
mov eax, dword [0x79e054]
mov ecx, dword [0x79e04c]
mov dword [esp + 4], str.wrong_FLS_callback_count__ld__expected__d_n
cmp ecx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ecx
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc17
call fcn.0049f440
mov dword [esp + 4], str.attached_thread_count_should_be___2_n
xor eax, eax
cmp dword [0x79e0a8], 1
seta al
mov dword [esp], eax
call fcn.0049fda0
mov edx, dword [0x79e0a8]
mov eax, dword [sym.imp.kernel32.dll_WaitForSingleObject]
test edx, edx
mov dword [ebp - 0x94], eax
je 0x4a2c74
mov dword [ebp - 0x90], esi
mov esi, edi
mov edi, eax
lea esi, [esi]
lea esi, [esi]
cmp ebx, 0x103
je 0x4a2bb1
mov dword [esp + 4], 0x3e8
mov eax, dword [esi*4 + 0x79e0c0]
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc21
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_OBJECT_0__got__lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea eax, [ebp - 0x84]
mov dword [esp + 4], eax
mov eax, dword [esi*4 + 0x79e0c0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeThread]
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc24
call fcn.0049f440
mov eax, dword [ebp - 0x84]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.dll:_GetExitCodeThread__lu_____ld__lu_n
call fcn.0049f7c0
mov eax, 0xc25
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.GetExitCodeThread_returned__ld__expected_1_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc26
call fcn.0049f440
mov eax, dword [ebp - 0x84]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.expected_thread_exit_code__lu__got__lu_n
cmp eax, ebx
mov dword [esp + 0xc], eax
sete al
add esi, 1
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
cmp esi, dword [0x79e0a8]
jb 0x4a2b60
mov esi, dword [ebp - 0x90]
mov dword [esp + 4], 0
mov eax, dword [0x79e0a4]
mov dword [esp], eax
mov edi, dword [ebp - 0x94]
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc2a
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e0a0]
mov dword [esp], eax
call edi
mov dword [ebp - 0x88], eax
sub esp, 8
cmp ebx, 0x103
je 0x4a36d0
mov eax, 0xc30
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_ABANDONED__got__lx_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e09c]
mov dword [esp], eax
mov edi, dword [ebp - 0x94]
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc34
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e0c0]
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc40
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_OBJECT_0__got__lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e0c4]
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc42
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_OBJECT_0__got__lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea edi, [ebp - 0x88]
mov dword [0x79e040], 0
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x79e040
mov dword [esp + 8], 0x49f890
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 0x90], eax
sub esp, 0x18
test esi, esi
je 0x4a3820
mov eax, 0xc4d
call fcn.0049f440
mov dword [esp + 4], str.CreateThread_should_fail_n
xor eax, eax
mov ecx, dword [ebp - 0x90]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc4e
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d400c
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 5
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x98], eax
mov ebx, dword fs:[0x18]
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov dword [ebp - 0x90], eax
mov eax, 0xc5b
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d4067
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x90]
xor eax, eax
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [0x79e040], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x79e040
mov dword [esp + 0xc], 0x49f890
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
sub esp, 0x1c
mov edi, eax
test esi, esi
je 0x4a3950
mov eax, 0xc62
call fcn.0049f440
xor eax, eax
test edi, edi
mov dword [esp + 4], str.CreateRemoteThread_should_fail_n
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc63
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d400c
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 5
sete al
mov dword [esp], eax
call fcn.0049fda0
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
mov ebx, eax
mov eax, 0xc70
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x5d40be
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0049fda0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x78]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x80]
mov dword [esp + 0x24], 2
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [0x79e80c]
sub esp, 0x28
mov dword [ebp - 0x88], eax
mov eax, 0xc78
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], 0x5d40dc
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call dword [0x79e808]
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc7a
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], 0x5d40fc
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], ebx
mov ebx, dword [ebp - 0x98]
call ebx
mov eax, dword [ebp - 0x90]
sub esp, 4
mov dword [esp], eax
call ebx
mov edx, dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp], str.winver.exe
mov dword [ebp - 0x90], edx
call edx
sub esp, 4
mov ebx, eax
mov eax, 0xc80
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 4], str.winver.exe_shouldnt_be_loaded_yet_n
sete al
mov dword [esp], eax
call fcn.0049fda0
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp], str.winver.exe
call dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 4
mov ebx, eax
mov eax, 0xc83
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.LoadLibrary_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x88], eax
mov eax, 0xc86
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.FreeLibrary_error__ld_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], str.winver.exe
mov edx, dword [ebp - 0x90]
call edx
sub esp, 4
mov ebx, eax
test esi, esi
je 0x4a38e0
mov eax, 0xc89
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 4], str.winver.exe_should_not_be_unloaded_n
setne al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x70]
mov edi, dword [sym.imp.kernel32.dll_WaitForDebugEvent]
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], edx
mov dword [esp + 4], 0
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc90
call fcn.0049f440
mov dword [esp + 4], str.WaitForDebugEvent_should_fail_n
xor eax, eax
mov edx, dword [ebp - 0x88]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc91
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d41e0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 6
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DebugActiveProcess]
sub esp, 4
mov dword [ebp - 0x88], eax
mov eax, 0xc95
call fcn.0049f440
mov dword [esp + 4], str.DebugActiveProcess_should_fail_n
xor eax, eax
mov ecx, dword [ebp - 0x88]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc96
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d400c
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 5
sete al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x70]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], edx
mov dword [esp + 4], 0
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc9a
call fcn.0049f440
mov dword [esp + 4], str.WaitForDebugEvent_should_fail_n
xor eax, eax
mov edi, dword [ebp - 0x88]
test edi, edi
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc9b
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.expected_ERROR_SEM_TIMEOUT__got__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 0x79
sete al
mov dword [esp], eax
call fcn.0049fda0
cmp dword [0x79e068], 2
je 0x4a3abb
mov eax, 0xca3
call fcn.0049f440
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8c]
mov dword [esp], str.dll:__p__DLL_PROCESS_DETACH___p___DONE_n
mov dword [esp + 4], eax
call fcn.0049f7c0
jmp 0x4a2699
mov eax, 0xca7
call fcn.0049f440
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8c]
mov dword [esp], str.dll:__p__DLL_THREAD_ATTACH___p_n
mov dword [esp + 4], eax
call fcn.0049f7c0
add dword [0x79e048], 1
call dword [0x79e7f4]
movzx eax, al
mov dword [ebp - 0x88], eax
mov eax, 0xcac
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.RtlDllShutdownInProgress_returned__ld_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79e0a8]
cmp eax, 9
jbe 0x4a3558
mov eax, dword [0x79e7b8]
test eax, eax
je 0x4a2699
mov edx, dword [0x57f2ac]
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], edx
call eax
sub esp, 4
mov ebx, eax
mov eax, 0xcbc
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.FlsGetValue_returned__p__expected_NULL_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xcbd
call fcn.0049f440
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.FlsGetValue_failed_with_error__lu_n
mov dword [esp + 8], eax
mov esi, dword [esi + 0x34]
xor eax, eax
test esi, esi
sete al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0x31415
mov eax, dword [0x57f2ac]
mov dword [esp], eax
call dword [0x79e7bc]
sub esp, 8
mov ebx, eax
mov eax, 0xcbf
call fcn.0049f440
mov dword [esp + 4], str.FlsSetValue_failed_n
mov dword [esp], ebx
call fcn.0049fda0
add dword [0x79e04c], 1
jmp 0x4a2699
mov eax, 0xced
call fcn.0049f440
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x8c]
mov dword [esp], str.dll:__p___ld___p_n
mov dword [esp + 4], eax
call fcn.0049f7c0
jmp 0x4a2699
mov eax, 0xcd1
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.RtlDllShutdownInProgress_returned__ld_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4a273c
lea eax, [eax*4 + 0x79e0c0]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xfffffffe
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_DuplicateHandle]
add dword [0x79e0a8], 1
sub esp, 0x1c
jmp 0x4a3434
mov eax, 0xbd4
call fcn.0049f440
mov dword [esp + 4], str.dll_entry_point_DLL_PROCESS_DETACH__should_not_be_called_n
mov dword [esp], 0
call fcn.0049fda0
jmp 0x4a2699
mov eax, 0xbec
call fcn.0049f440
xor eax, eax
test esi, esi
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.dll:_param__p_n
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4a28ef
mov ebx, 0xc4
jmp 0x4a2914
mov ebx, 0xc3
call dword [0x79e7f4]
movzx eax, al
mov dword [ebp - 0x88], eax
mov eax, dword [0x79e068]
cmp eax, 1
jbe 0x4a37f0
cmp eax, 3
je 0x4a37f0
mov edx, dword [0x8f0770]
xor eax, eax
test edx, edx
setne al
mov dword [ebp - 0x90], eax
jmp 0x4a2944
xor ebx, ebx
cmp ecx, 0xffffffff
sete bl
mov eax, 0xce6
mov dword [ebp - 0x8c], ecx
call fcn.0049f440
mov eax, dword [0x79e048]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Got_unexpected_count__u__thread_count__u._n
cmp eax, esi
mov dword [esp + 0xc], eax
setae al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xce7
call fcn.0049f440
mov ecx, dword [ebp - 0x8c]
mov dword [esp], ebx
mov dword [esp + 4], str.Got_unexpected_index__u._n
mov dword [esp + 8], ecx
call fcn.0049fda0
jmp 0x4a2699
mov eax, 0xc2e
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e09c]
mov dword [esp], eax
mov edi, dword [ebp - 0x94]
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc34
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e0c0]
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc39
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0
mov eax, dword [0x79e0c4]
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc3b
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4a2df8
mov eax, 0xbf6
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.RtlDllShutdownInProgress_returned__ld_n
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4a29af
mov eax, 0xc52
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateThread_error__ld_n
mov dword [esp + 8], eax
mov ebx, dword [ebp - 0x90]
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0x3e8
mov dword [esp], ebx
mov eax, dword [ebp - 0x94]
call eax
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc54
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc55
call fcn.0049f440
mov dword [esp + 4], str.thread_shouldnt_start_yet_n
xor eax, eax
mov edx, dword [0x79e040]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ebx
mov dword [ebp - 0x98], eax
call eax
sub esp, 4
jmp 0x4a2eb4
mov edi, dword [0x8f0770]
call fcn.0057d110
xor ecx, ecx
mov edx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
add edx, edx
test edi, edi
setne cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x4a3931
mov eax, 0xc8c
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 4], str.winver.exe_should_be_unloaded_n
sete al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4a3908
jmp 0x4a322a
mov eax, 0xc67
call fcn.0049f440
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d40a0
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 4], 0x3e8
mov dword [esp], edi
mov eax, dword [ebp - 0x94]
call eax
sub esp, 8
mov dword [ebp - 0x88], eax
mov eax, 0xc69
call fcn.0049f440
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], str.expected_WAIT_TIMEOUT__got__lx_n
cmp eax, 0x102
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xc6a
call fcn.0049f440
mov dword [esp + 4], str.thread_shouldnt_start_yet_n
xor eax, eax
mov edx, dword [0x79e040]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov eax, dword [ebp - 0x98]
call eax
sub esp, 4
jmp 0x4a2fb9
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapLock]
mov ebx, dword [0x8f0770]
sub esp, 4
call fcn.0057d110
xor ecx, ecx
mov edx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
add edx, edx
test ebx, ebx
setne cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x4a3a66
mov eax, 0xbe1
call fcn.0049f440
mov dword [esp + 4], str.dll_entry_point:_process_should_already_deadlock_n
mov dword [esp], 0
call fcn.0049fda0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4a3a40
jmp 0x4a2699
mov dword [esp], 0x79e06c
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x79e068]
sub esp, 4
jmp 0x4a28b7
mov ebx, 0xc7
jmp 0x4a361d
mov ebx, 1
mov ecx, 0xffffffff
xor esi, esi
jmp 0x4a3668
mov eax, 0xc9f
call fcn.0049f440
mov dword [esp], str.dll:_call_ExitProcess___n
call fcn.0049f7c0
mov edx, dword [0x8f075c]
mov eax, dword [0x79ea50]
mov dword [eax], edx
mov dword [esp], 0xc5
call dword [sym.imp.kernel32.dll_ExitProcess]