Function at 0x4e6e64
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e6e6c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e72dd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403320
cmp byte [0x50112c], 0
jne 0x4e72c2
mov byte [0x50112c], 1
xor eax, eax
push ebp
push 0x4e72bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4e7276
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x511c5c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4e7094
mov eax, dword [0x511c5c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x4e7094
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e707d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [0x511c5c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004097f4
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
push 0x4e8208
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov edx, 2
call fcn.0049af78
mov eax, dword [ebp - 4]
push eax
push 0x4e87c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov edx, 3
call fcn.0049af78
mov eax, dword [ebp - 4]
push eax
push 0x4e8a14
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.0049b05c
mov eax, dword [ebp - 4]
push eax
push 0x4e8c18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
xor edx, edx
call fcn.0049af78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0xa0]
mov ecx, ebx
mov edx, 0x4e72f4
call fcn.0049a090
test al, al
je 0x4e6f97
mov edx, dword [ebp - 8]
mov eax, dword [0x511c5c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
jmp 0x4e7073
xor eax, eax
push ebp
push 0x4e7069
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0049b680
mov ebx, eax
test ebx, ebx
jle 0x4e705f
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x4e6fcb
cmp eax, dword [esp]
pop edx
pop eax
je 0x4e703b
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x10]
mov edx, 0x4e7304
call fcn.00409098
test eax, eax
je 0x4e703b
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x14]
mov edx, 0x4e731c
call fcn.00409098
test eax, eax
je 0x4e703b
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x18]
mov edx, 0x4e7330
call fcn.00409098
test eax, eax
je 0x4e703b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x1c]
mov edx, 0x4e7344
call fcn.00409098
test eax, eax
jne 0x4e704d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e7087
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e7073
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e7087
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x4e6ee5
mov eax, dword [0x511c5c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4e726c
mov eax, dword [0x511c5c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x4e726c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e7255
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 8]
mov eax, dword [0x511c5c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.004097f4
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
push 0x4e8208
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov edx, 2
call fcn.0049af78
mov eax, dword [ebp - 4]
push eax
push 0x4e87c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov edx, 3
call fcn.0049af78
mov eax, dword [ebp - 4]
push eax
push 0x4e8a14
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.0049b05c
mov eax, dword [ebp - 4]
push eax
push 0x4e8c18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
xor edx, edx
call fcn.0049af78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0xa0]
mov ecx, ebx
mov edx, 0x4e72f4
call fcn.0049a090
test al, al
je 0x4e716f
mov edx, dword [ebp - 8]
mov eax, dword [0x511c5c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
jmp 0x4e724b
xor eax, eax
push ebp
push 0x4e7241
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0049b680
mov ebx, eax
test ebx, ebx
jle 0x4e7237
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x4e71a3
cmp eax, dword [esp]
pop edx
pop eax
je 0x4e7213
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x24]
mov edx, 0x4e7304
call fcn.00409098
test eax, eax
je 0x4e7213
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x28]
mov edx, 0x4e731c
call fcn.00409098
test eax, eax
je 0x4e7213
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x2c]
mov edx, 0x4e7330
call fcn.00409098
test eax, eax
je 0x4e7213
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.004bbe3c
mov eax, dword [ebp - 0x30]
mov edx, 0x4e7344
call fcn.00409098
test eax, eax
jne 0x4e7225
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e725f
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e724b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e725f
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x4e70bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e72a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e72c2
mov byte [0x50112c], 0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e72e4
lea eax, [ebp - 0x30]
mov edx, 0xa
call fcn.00404c40
ret