Function at 0x413240
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0x370]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x68]
cmp dword [eax], 0
je 0x4137c7
mov eax, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebp, [esi + 0x300]
mov dword [esp + 0x10], eax
nop dword [eax]
push 0x1f4
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x41367b
mov eax, dword [ebp]
dec eax
cmp eax, 8
ja case.default.0x4132a1
jmp dword [eax*4 + 0x4137cc]
cmp dword [esi + 0x35c], 0
je 0x413703
mov ecx, dword [esi + 0x30c]
mov eax, 0x80010001
cmp ecx, 0x80000003
mov edx, 0x10002
cmove eax, edx
mov dword [esi + 0x378], eax
cmp ecx, 0xc0000409
je 0x4132f0
cmp ecx, 0xc0000374
je 0x4132f0
cmp ecx, 0xc000041d
jne case.default.0x4132a1
mov ecx, esi
call fcn.004172a0
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4132a1
cmp byte [0x4eb528], 0
je case.default.0x4132a1
cmp byte [0x4eb570], 0
je case.default.0x4132a1
push dword [esi + 0x310]
push dword [esi + 0x314]
push dword [esi + 0x30c]
push dword [esi + 0x308]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_CreateThread_TID1:__08p__TID2:__08p__Base:_0x_p__TLB:_0x_p__n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x28
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x4133ce
cmp byte [0x4eb528], 0
je 0x4133ce
cmp byte [0x4eb570], 0
je 0x413398
push dword [esi + 0x310]
push str.Debugger:_CreateProcess_hProcess:_0x_08I32X__n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x14
cmp byte [0x4eb528], 0
je 0x4133ce
cmp byte [0x4eb570], 0
je 0x4133ce
push dword [esi + 0x318]
movzx eax, word [esi + 0x330]
push eax
push str.Debugger:_CreateProcess_Unicode:__d__Base:_0x_p__n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x18
mov eax, dword [esi + 0x310]
mov dword [esi + 0x360], eax
mov eax, dword [esi + 0x30c]
test eax, eax
je case.default.0x4132a1
cmp eax, 0xffffffff
je case.default.0x4132a1
push eax
call edi
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4132a1
cmp byte [0x4eb528], 0
je case.default.0x4132a1
cmp byte [0x4eb570], 0
je case.default.0x4132a1
push dword [esi + 0x30c]
push dword [esi + 0x308]
push str.Debugger:_ExitThread_TID:_0x_08X__ExitCode:_0x_X__n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x18
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x41356b
mov eax, dword [esi + 0x31c]
test eax, eax
je 0x413534
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push ecx
push 8
lea ecx, [esp + 0x20]
movlpd qword [esp + 0x20], xmm0
push ecx
push eax
push dword [esi + 0x360]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x413534
cmp dword [esp + 0x14], 0
je 0x413534
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.004165a0
test eax, eax
je 0x413534
cmp word [esi + 0x320], 0
je 0x413506
cmp byte [0x4eb528], 0
je 0x41356b
cmp byte [0x4eb570], 0
je 0x41356b
push dword [esi + 0x310]
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__s___0x_p_n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x20
jmp 0x41356b
cmp byte [0x4eb528], 0
je 0x41356b
cmp byte [0x4eb570], 0
je 0x41356b
push dword [esi + 0x310]
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__S___0x_p_n
jmp 0x4134f3
cmp byte [0x4eb528], 0
je 0x41356b
cmp byte [0x4eb570], 0
je 0x41356b
push dword [esi + 0x310]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll____p_n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x1c
mov eax, dword [esi + 0x30c]
cmp eax, 0xffffffff
je case.default.0x4132a1
push eax
call edi
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4132a1
cmp byte [0x4eb528], 0
je case.default.0x4132a1
cmp byte [0x4eb570], 0
je case.default.0x4132a1
push dword [esi + 0x30c]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_UnloadDll___0x_p_n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x1c
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4132a1
movzx edi, word [esi + 0x312]
test di, di
je 0x41365f
cmp dword [esi + 0x30c], 0
je 0x41365f
call fcn.00414220
push eax
push edi
lea ecx, [esi + 0x384]
call fcn.00403410
test al, al
je 0x41365f
push dword [esi + 0x30c]
mov ecx, esi
call fcn.004165a0
test eax, eax
je 0x41365f
cmp word [esi + 0x310], 0
je 0x41368f
cmp byte [0x4eb528], 0
je 0x41365f
cmp byte [0x4eb570], 0
je 0x41365f
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__s_n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x378]
push dword [esi + 0x308]
push dword [esi + 0x304]
call dword [esp + 0x1c]
mov eax, dword [esi + 0x68]
cmp dword [eax], 0
jne 0x413280
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp byte [0x4eb528], 0
je 0x41365f
cmp byte [0x4eb570], 0
je 0x41365f
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__S_n
jmp 0x41364e
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4132a1
cmp byte [0x4eb528], 0
je case.default.0x4132a1
cmp byte [0x4eb570], 0
je case.default.0x4132a1
push dword [esi + 0x310]
push dword [esi + 0x30c]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_Rip:_Error:_0x_X__Type:_0x_X__n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x20
jmp case.default.0x4132a1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x41373e
cmp byte [0x4eb528], 0
je 0x41373e
cmp byte [0x4eb570], 0
je 0x41373e
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_EXCEPTION_DEBUG_EVENT__FirstChance_Exception___Crash._n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x18
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.004172a0
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x41378a
cmp byte [0x4eb528], 0
je 0x41378a
cmp byte [0x4eb570], 0
je 0x41378a
push dword [esi + 0x30c]
push dword [esi + 0x308]
push str.Debugger:_ExitProcess_TID:_0x_08X__ExitCode:_0x_x__n
push 0
push 8
push 0x46b4d0
call fcn.00419800
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, 0x10002
shr eax, 0x19
not al
test al, 1
mov eax, 0x40010004
cmove eax, ecx
mov ecx, esi
mov dword [esi + 0x378], eax
mov eax, dword [esi]
call dword [eax + 0x7c]
push dword [esi + 0x378]
push dword [esi + 0x308]
push dword [esi + 0x304]
call dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret