Function at 0x4d12c0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x190
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x188], eax
call fcn.004f8020
test al, al
jne 0x4d2686
lea eax, [ebp + 8]
pxor xmm0, xmm0
lea ecx, [esp + 0x178]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov ebx, dword [eax]
mov dword [esp + 0x1c], ecx
push ecx
push ebx
call fcn.004f8050
add esp, 8
mov esi, dword [ebx + 0x3c]
mov edi, dword [ebx + 0x40]
cmp esi, edi
je 0x4d138e
lea ebx, [esp + 0xc8]
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x4d133b
mov eax, dword [esi + 4]
test eax, eax
js 0x4d2645
mov ecx, dword [esi]
test eax, eax
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d2645
push eax
push ecx
push ebx
call fcn.005555e0
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push ebx
call fcn.004f8050
add esp, 8
cmp byte [esp + 0xd3], 0
jns 0x4d1382
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
add esi, 0xc
cmp esi, edi
jne 0x4d1324
lea eax, [ebp + 8]
mov ebx, dword [eax]
movsx eax, byte [ebx + 0x17]
test eax, eax
jns 0x4d1399
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4d141b
lea eax, [esp + 0x48]
mov byte [eax + 3], 8
mov ecx, str.database
lea edx, [esp + 0x40]
cmp edx, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4d2645
lea eax, [ebx + 0xc]
lea edx, [esp + 0x40]
mov dword [edx + 4], 0x65736162
mov dword [edx], 0x61746164
mov byte [edx + 8], 0
lea esi, [esp + 0xc8]
mov ecx, esi
push eax
call fcn.004d2c10
add esp, 4
lea eax, [esp + 0x178]
push eax
push esi
call fcn.004f8050
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4d1410
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x4b], 0
js 0x4d272a
movsx eax, byte [ebx + 0x23]
test eax, eax
js 0x4d2689
test eax, eax
jne 0x4d28b1
movsx eax, byte [ebx + 0x2f]
test eax, eax
jns 0x4d2691
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4d1505
js 0x4d2645
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x4d2645
lea edi, [esp + 0x40]
push eax
push ecx
push edi
call fcn.005555e0
add esp, 0xc
lea eax, [esp + 0x93]
mov byte [eax + 8], 3
mov ecx, 0x7825e2
lea edx, [esp + 0x90]
cmp edx, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4d2645
mov al, byte [0x7825e4]
lea edx, [esp + 0x90]
mov byte [edx + 2], al
movzx eax, word [0x7825e2]
mov word [edx], ax
mov byte [edx + 3], 0
lea esi, [esp + 0xc8]
mov ecx, esi
push edi
call fcn.004d2c10
add esp, 4
lea eax, [esp + 0x178]
push eax
push esi
call fcn.004f8050
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4d14e4
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x9b], 0
js 0x4d273b
cmp byte [esp + 0x4b], 0
jns 0x4d1505
push dword [esp + 0x40]
call fcn.005c57c0
add esp, 4
mov esi, dword [ebx + 0x30]
add ebx, 0x34
cmp esi, ebx
je 0x4d1798
mov eax, str.annotation
lea ecx, [esp + 0x16c]
cmp ecx, eax
setbe cl
lea edx, [esp + 0x176]
cmp edx, eax
seta al
and al, cl
mov byte [esp + 0xf], al
mov dword [esp + 0x18], ebx
jmp 0x4d1717
pxor xmm0, xmm0
movq qword [esp + 0x30], xmm0
mov dword [esp + 0x38], 0
mov byte [esp + 0x3b], al
test dl, dl
jns 0x4d155b
mov ecx, dword [ecx]
lea esi, [esp + 0x30]
test edi, edi
jns 0x4d156e
jmp 0x4d2645
mov ecx, dword [esp + 4]
mov ecx, dword [ecx]
cmp ecx, esi
jb 0x4d157d
lea eax, [esi + edi]
cmp eax, ecx
ja 0x4d2645
test edi, edi
je 0x4d158c
push edi
push ecx
push esi
call fcn.005c9580
add esp, 0xc
mov word [esi + edi], 0x3d
mov esi, dword [esp + 0x10]
movsx eax, byte [esi + 0x27]
test eax, eax
js 0x4d15a3
lea edx, [esi + 0x1c]
jmp 0x4d15a9
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
lea ebx, [esp + 0x40]
lea ecx, [esp + 0x30]
push eax
push edx
call fcn.005499f0
mov ecx, dword [eax + 8]
mov dword [esp + 0x98], ecx
movq xmm0, qword [eax]
movq qword [esp + 0x90], xmm0
pxor xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
movsx eax, byte [esp + 0x9b]
test eax, eax
cmovs eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
lea edx, [esp + 0x90]
cmovns ecx, edx
test eax, eax
js 0x4d2645
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d2645
mov esi, dword [esp + 0x18]
push eax
push ecx
mov edi, ebx
push ebx
call fcn.005555e0
add esp, 0xc
mov byte [esp + 0x177], 0xa
cmp byte [esp + 0xf], 0
jne 0x4d2645
mov word [esp + 0x174], 0x6e6f
mov dword [esp + 0x170], 0x69746174
mov dword [esp + 0x16c], 0x6f6e6e61
mov byte [esp + 0x176], 0
lea ebx, [esp + 0xc8]
mov ecx, ebx
lea edx, [esp + 0x16c]
push edi
call fcn.004d2c10
add esp, 4
lea eax, [esp + 0x178]
push eax
push ebx
call fcn.004f8050
add esp, 8
cmp byte [esp + 0xd3], 0
jns 0x4d16a8
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x177], 0
mov ebx, esi
js 0x4d2661
cmp byte [esp + 0x4b], 0
mov esi, dword [esp + 0x10]
jns 0x4d16cf
push dword [esp + 0x40]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x9b], 0
jns 0x4d16e8
push dword [esp + 0x90]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x3b], 0
js 0x4d2675
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x4d1705
mov eax, dword [esi + 8]
cmp dword [eax], esi
mov esi, eax
jne 0x4d16fa
jmp 0x4d170d
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4d1705
mov esi, eax
cmp eax, ebx
je 0x4d1798
movsx edx, byte [esi + 0x1b]
mov edi, edx
test edx, edx
jns 0x4d1724
mov edi, dword [esi + 0x14]
xor eax, eax
dec eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [edi + 1]
cmp eax, 0x7ffffff8
jae 0x4d2658
lea ecx, [esi + 0x10]
cmp eax, 0xb
mov dword [esp + 0x10], esi
jb 0x4d153f
mov dword [esp + 4], ecx
mov ebx, eax
or ebx, 7
inc ebx
push ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], eax
call fcn.005c5789
add esp, 4
mov esi, eax
or ebx, 0x80000000
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
cmp byte [esp + 8], 0
js 0x4d1568
mov ecx, dword [esp + 4]
jmp 0x4d156e
lea eax, [ebp + 8]
mov ebx, dword [eax]
mov esi, dword [ebx + 0x48]
mov edi, dword [ebx + 0x4c]
cmp esi, edi
mov dword [esp + 0x14], ebx
jne 0x4d291e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4d29ad
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x90]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
xor edx, edx
mov ecx, esi
push edx
push 0x81a6e4
push edx
push 0x81a6d8
push edx
push 0x81a6cc
mov dword [esp + 0x28], eax
push eax
push dword [ebx + 0x64]
push dword [0x80ba9c]
push dword [0x80ba98]
push dword [0x80ba90]
call fcn.004f82f0
lea edi, [esp + 0x30]
mov ecx, esi
push edi
call fcn.004f86e0
push 0x18
call fcn.005c5789
add esp, 4
mov dword [esp + 0x16c], eax
mov dword [esp + 0x174], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [esp + 0x170], 0x16
lea ecx, [eax + 0x16]
mov edx, str.__initial_client_data
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x4d2645
movsd xmm0, qword [0x793a95]
movsd qword [eax + 0xe], xmm0
movups xmm0, xmmword [str.__initial_client_data]
movups xmmword [eax], xmm0
movsx edx, byte [esp + 0x3b]
test edx, edx
cmovs edx, dword [esp + 0x34]
mov byte [eax + 0x16], 0
mov eax, dword [esp + 0x30]
cmovns eax, edi
lea ecx, [esp + 0x16c]
push edx
push eax
call fcn.005499f0
mov ecx, dword [eax + 8]
lea edx, [esp + 0x40]
mov dword [edx + 8], ecx
movq xmm0, qword [eax]
movq qword [edx], xmm0
pxor xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
movsx eax, byte [edx + 0xb]
test eax, eax
cmovs eax, dword [edx + 4]
mov ecx, dword [edx]
cmovns ecx, edx
test eax, eax
js 0x4d2645
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d2645
lea esi, [esp + 0xc8]
push eax
push ecx
push esi
call fcn.005555e0
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push esi
call fcn.004f8050
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4d1922
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x4d1935
push dword [esp + 0x40]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x177], 0
js 0x4d274f
cmp byte [esp + 0x3b], 0
jns 0x4d1956
push dword [esp + 0x30]
call fcn.005c57c0
add esp, 4
pxor xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
xorps xmm1, xmm1
movsd qword [esp + 0x80], xmm1
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
mov dword [esp + 0x6c], 0x100
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
mov dword [esp + 0x78], eax
push 0xfffffffffffffff5
call esi
mov dword [esp + 0x7c], eax
push 0xfffffffffffffff4
call esi
mov dword [esp + 0x80], eax
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov eax, dword [0x81a708]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4d1a17
push 0x81a708
call fcn.005c580d
add esp, 4
cmp dword [0x81a708], 0xffffffff
jne 0x4d1a17
push 0
push str.::InitializeProcThreadAttributeList
push 0x77caae
call fcn.004f87a0
add esp, 0xc
mov dword [0x81a704], eax
push 0x81a708
call fcn.005c5887
add esp, 4
mov eax, dword [0x81a710]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4d1a7d
push 0x81a710
call fcn.005c580d
add esp, 4
cmp dword [0x81a710], 0xffffffff
jne 0x4d1a7d
cmp dword [0x81a704], 0
je 0x4d26a1
push 0
push str.::UpdateProcThreadAttribute
push 0x77caae
call fcn.004f87a0
add esp, 0xc
mov dword [0x81a70c], eax
push 0x81a710
call fcn.005c5887
add esp, 4
mov ecx, dword [0x81a704]
test ecx, ecx
je 0x4d26c6
cmp dword [0x81a70c], 0
je 0x4d26c6
mov dword [esp + 0x40], 0x48
mov dword [esp + 0x30], 0xffffffff
call dword [0x8010bc]
xor esi, esi
push edi
push esi
push 1
push esi
call ecx
test eax, eax
jne 0x4d280a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4d27b8
push dword [esp + 0x30]
call fcn.005c57f3
add esp, 4
mov edi, eax
mov dword [esp + 0x84], eax
mov ecx, dword [0x81a704]
call dword [0x8010bc]
lea eax, [esp + 0x30]
push eax
push 0
push 1
mov dword [esp + 0x10], edi
push edi
call ecx
test eax, eax
je 0x4d2863
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x174]
mov eax, edx
sub eax, ecx
cmp eax, 0x1f
ja 0x4d2639
mov edi, dword [esp + 0x170]
push 0x20
mov dword [esp + 0xc], ecx
call fcn.005c5789
mov ecx, dword [esp + 0xc]
add esp, 4
mov ebx, eax
lea edx, [eax + 0x20]
sub edi, ecx
lea esi, [eax + edi]
jne 0x4d2995
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], edx
test ecx, ecx
jne 0x4d2629
cmp esi, edx
jb 0x4d25c3
mov eax, dword [esp + 0x16c]
sub esi, eax
sar esi, 2
lea ecx, [esi + 1]
cmp ecx, 0x40000000
jae 0x4d264c
sub edx, eax
mov eax, edx
sar eax, 1
cmp eax, ecx
cmovbe eax, ecx
cmp edx, 0x7ffffffc
mov edi, 0x3fffffff
cmovb edi, eax
test edi, edi
je 0x4d26e7
cmp edi, 0x40000000
jae 0x4d2647
lea eax, [edi*4]
push eax
call fcn.005c5789
add esp, 4
shl esi, 2
add esi, eax
je 0x4d2645
lea ebx, [eax + edi*4]
mov eax, dword [0x80ba90]
mov dword [esi], eax
lea edi, [esi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub esi, ecx
push ecx
push eax
push esi
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], edi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d1c26
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], edi
mov eax, dword [esp + 0x174]
cmp edi, eax
jb 0x4d25d8
mov ecx, dword [esp + 0x16c]
sub edi, ecx
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov esi, 0x3fffffff
cmovb esi, ecx
test esi, esi
je 0x4d26ee
cmp esi, 0x40000000
jae 0x4d2647
lea eax, [esi*4]
push eax
call fcn.005c5789
add esp, 4
shl edi, 2
add edi, eax
je 0x4d2645
lea esi, [eax + esi*4]
mov eax, dword [0x80ba98]
mov dword [edi], eax
lea ebx, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], esi
test eax, eax
je 0x4d1cf1
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], ebx
mov eax, dword [esp + 0x174]
cmp ebx, eax
jb 0x4d25ed
mov ecx, dword [esp + 0x16c]
sub ebx, ecx
sar ebx, 2
lea edx, [ebx + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov esi, 0x3fffffff
cmovb esi, ecx
test esi, esi
je 0x4d26f5
cmp esi, 0x40000000
jae 0x4d2647
lea eax, [esi*4]
push eax
call fcn.005c5789
add esp, 4
shl ebx, 2
add ebx, eax
je 0x4d2645
lea edi, [eax + esi*4]
mov eax, dword [0x80ba9c]
mov dword [ebx], eax
lea esi, [ebx + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub ebx, ecx
push ecx
push eax
push ebx
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], edi
test eax, eax
je 0x4d1dbc
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], esi
lea eax, [ebp + 8]
mov edi, dword [eax]
mov eax, dword [esp + 0x174]
cmp esi, eax
jb 0x4d2602
mov ecx, dword [esp + 0x16c]
sub esi, ecx
sar esi, 2
lea edx, [esi + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, ecx
test ebx, ebx
je 0x4d26fc
cmp ebx, 0x40000000
jae 0x4d2647
lea eax, [ebx*4]
push eax
call fcn.005c5789
add esp, 4
shl esi, 2
add esi, eax
je 0x4d2645
mov ecx, edi
lea edi, [eax + ebx*4]
mov eax, dword [ecx + 0x64]
mov dword [esi], eax
lea ebx, [esi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub esi, ecx
push ecx
push eax
push esi
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], edi
test eax, eax
je 0x4d1e8c
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], ebx
mov eax, dword [esp + 0x174]
cmp ebx, eax
jb 0x4d2615
mov ecx, dword [esp + 0x16c]
sub ebx, ecx
sar ebx, 2
lea edx, [ebx + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov esi, 0x3fffffff
cmovb esi, ecx
test esi, esi
je 0x4d2703
cmp esi, 0x40000000
jae 0x4d2647
lea eax, [esi*4]
push eax
call fcn.005c5789
add esp, 4
shl ebx, 2
add ebx, eax
je 0x4d2645
lea edi, [eax + esi*4]
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
lea esi, [ebx + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub ebx, ecx
push ecx
push eax
push ebx
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], edi
test eax, eax
je 0x4d1f56
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x78]
lea eax, [esi + 1]
cmp eax, 2
jb 0x4d2063
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x4d2063
mov eax, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
cmp eax, edi
je 0x4d1fa3
mov ecx, eax
cmp dword [ecx], esi
je 0x4d2063
add ecx, 4
cmp ecx, edi
jne 0x4d1f94
mov ecx, dword [esp + 0x174]
cmp edi, ecx
jb 0x4d2587
sub edi, eax
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub ecx, eax
mov eax, ecx
sar eax, 1
cmp eax, edx
cmovbe eax, edx
cmp ecx, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, eax
test ebx, ebx
je 0x4d270a
cmp ebx, 0x40000000
jae 0x4d2647
lea eax, [ebx*4]
push eax
call fcn.005c5789
add esp, 4
shl edi, 2
add edi, eax
je 0x4d2645
lea ebx, [eax + ebx*4]
mov dword [edi], esi
lea esi, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d205c
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x7c]
lea eax, [esi + 1]
cmp eax, 2
jb 0x4d2169
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x4d2169
mov eax, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
cmp eax, edi
je 0x4d20a9
mov ecx, eax
cmp dword [ecx], esi
je 0x4d2169
add ecx, 4
cmp ecx, edi
jne 0x4d209a
mov ecx, dword [esp + 0x174]
cmp edi, ecx
jb 0x4d259b
sub edi, eax
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub ecx, eax
mov eax, ecx
sar eax, 1
cmp eax, edx
cmovbe eax, edx
cmp ecx, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, eax
test ebx, ebx
je 0x4d2711
cmp ebx, 0x40000000
jae 0x4d2647
lea eax, [ebx*4]
push eax
call fcn.005c5789
add esp, 4
shl edi, 2
add edi, eax
je 0x4d2645
lea ebx, [eax + ebx*4]
mov dword [edi], esi
lea esi, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d2162
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x80]
lea eax, [esi + 1]
cmp eax, 2
jb 0x4d2272
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x4d2272
mov eax, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
cmp eax, edi
je 0x4d21b2
mov ecx, eax
cmp dword [ecx], esi
je 0x4d2272
add ecx, 4
cmp ecx, edi
jne 0x4d21a3
mov ecx, dword [esp + 0x174]
cmp edi, ecx
jb 0x4d25af
sub edi, eax
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d264c
sub ecx, eax
mov eax, ecx
sar eax, 1
cmp eax, edx
cmovbe eax, edx
cmp ecx, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, eax
test ebx, ebx
je 0x4d2718
cmp ebx, 0x40000000
jae 0x4d2647
lea eax, [ebx*4]
push eax
call fcn.005c5789
add esp, 4
shl edi, 2
add edi, eax
je 0x4d2645
lea ebx, [eax + ebx*4]
mov dword [edi], esi
lea esi, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005c9580
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d226b
push eax
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
sub edi, esi
je 0x4d2645
mov ecx, dword [0x81a70c]
mov ebx, dword [esp + 0x84]
call dword [0x8010bc]
xor eax, eax
push eax
push eax
push edi
push esi
push 0x20002
push eax
push ebx
call ecx
test eax, eax
je 0x4d2763
lea eax, [ebp + 8]
mov esi, dword [eax]
mov dword [esp + 8], 0x80000
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x4d26a8
cmp dword [esi + 4], 0xc
jb 0x4d271f
mov ecx, dword [esi + 4]
cmp ecx, 0xb
jbe 0x4d26b3
mov edx, esi
test al, al
jns 0x4d22e9
mov edx, dword [esi]
lea edi, [edx + ecx*2]
add edi, 0xffffffe8
push 0x20
call fcn.005c5789
add esp, 4
mov dword [esp + 0xc8], eax
mov dword [esp + 0xd0], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [esp + 0xcc], 0xc
lea ecx, [eax + 0x18]
cmp eax, edi
seta dl
cmp ecx, edi
setbe cl
or cl, dl
je 0x4d2645
movdqu xmm0, xmmword [edi]
movsd xmm1, qword [edi + 0x10]
movsd qword [eax + 0x10], xmm1
movdqu xmmword [eax], xmm0
mov word [eax + 0x18], 0
cmp byte [esp + 0xd3], 0
lea eax, [esp + 0xc8]
jns 0x4d235b
mov eax, dword [esp + 0xc8]
push str.rundll32.exe
push eax
call fcn.005de04f
add esp, 8
test eax, eax
sete bl
cmp byte [esp + 0xd3], 0
lea edi, [esp + 0x30]
jns 0x4d238b
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
cmp byte [esp + 0x183], 0
jns 0x4d23aa
mov eax, dword [esp + 0x178]
mov dword [esp + 0x1c], eax
xor eax, eax
mov ecx, 0
test bl, bl
jne 0x4d23c1
cmp byte [esi + 0xb], 0
jns 0x4d26bf
mov ecx, dword [esi]
push edi
lea edx, [esp + 0x44]
push edx
push eax
push eax
push dword [esp + 0x18]
push 1
push eax
push eax
push dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4d2a00
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
push 1
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2406
test ebx, ebx
je 0x4d2a53
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
push 1
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2428
test ebx, ebx
je 0x4d2a96
lea eax, [ebp + 8]
mov esi, dword [eax]
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
je 0x4d243e
push eax
call fcn.004f7e20
add esp, 4
mov dword [esi + 0x64], 0xffffffff
pxor xmm0, xmm0
lea eax, [esp + 0xc8]
movdqu xmmword [eax + 0x14], xmm0
movdqu xmmword [eax + 4], xmm0
mov dword [eax], 2
pxor xmm0, xmm0
lea ecx, [esp + 0x20]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
add esi, 0x54
push ecx
push eax
push esi
call fcn.004f76e0
add esp, 0xc
mov ebx, eax
mov esi, dword [esp + 4]
mov edi, esi
test esi, esi
je 0x4d24f5
mov eax, dword [0x81a718]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4d24e6
push 0x81a718
call fcn.005c580d
add esp, 4
cmp dword [0x81a718], 0xffffffff
jne 0x4d24e6
push 1
push str.::DeleteProcThreadAttributeList
push 0x77caae
call fcn.004f87a0
add esp, 0xc
mov dword [0x81a714], eax
push 0x81a718
call fcn.005c5887
add esp, 4
mov ecx, dword [0x81a714]
call dword [0x8010bc]
push esi
call ecx
test edi, edi
je 0x4d2502
push edi
call fcn.005c57fc
add esp, 4
mov eax, dword [esp + 0x16c]
test eax, eax
je 0x4d2532
mov ecx, dword [esp + 0x170]
cmp ecx, eax
je 0x4d2522
add ecx, 0xfffffffc
jne 0x4d2514
jmp 0x4d2645
mov dword [esp + 0x170], eax
push eax
call fcn.005c57c0
add esp, 4
push dword [esp + 0x10]
call fcn.004f7e30
add esp, 4
cmp byte [esp + 0x183], 0
jns 0x4d2557
push dword [esp + 0x178]
call fcn.005c57c0
add esp, 4
movzx eax, bl
mov ecx, 2
sub ecx, eax
mov dword [0x81a700], ecx
lea ecx, [ebp + 8]
call fcn.004d2b00
mov ecx, dword [esp + 0x188]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x4d2645
mov dword [edi], esi
add edi, 4
mov esi, edi
jmp 0x4d205c
test edi, edi
je 0x4d2645
mov dword [edi], esi
add edi, 4
mov esi, edi
jmp 0x4d2162
test edi, edi
je 0x4d2645
mov dword [edi], esi
add edi, 4
mov esi, edi
jmp 0x4d226b
test esi, esi
je 0x4d2645
mov eax, dword [0x80ba90]
mov dword [esi], eax
add esi, 4
mov edi, esi
jmp 0x4d1c26
test edi, edi
je 0x4d2645
mov eax, dword [0x80ba98]
mov dword [edi], eax
add edi, 4
mov ebx, edi
jmp 0x4d1cf1
test ebx, ebx
je 0x4d2645
mov eax, dword [0x80ba9c]
mov dword [ebx], eax
add ebx, 4
mov esi, ebx
jmp 0x4d1dbc
test esi, esi
je 0x4d2645
mov eax, dword [edi + 0x64]
mov dword [esi], eax
add esi, 4
mov ebx, esi
jmp 0x4d1e8c
test ebx, ebx
je 0x4d2645
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
add ebx, 4
mov esi, ebx
jmp 0x4d1f56
push ecx
call fcn.005c57c0
add esp, 4
mov edx, dword [esp + 0x174]
mov esi, dword [esp + 0x170]
jmp 0x4d1b68
ud2
call fcn.005fb090
lea ecx, [esp + 0x16c]
call fcn.005fa9f0
lea ecx, [esp + 0x30]
call fcn.005fb080
push dword [esp + 0x16c]
call fcn.005c57c0
add esp, 4
jmp 0x4d16b8
push dword [esp + 0x30]
call fcn.005c57c0
add esp, 4
jmp 0x4d16f3
int3
mov eax, dword [ebx + 0x1c]
jmp 0x4d1427
test al, al
je 0x4d1505
lea ecx, [ebx + 0x24]
jmp 0x4d144f
xor eax, eax
jmp 0x4d1a6b
cmp al, 0xc
jb 0x4d271f
mov ecx, eax
jmp 0x4d22d8
lea ecx, [esp + 0xc8]
call fcn.005fb1a0
mov ecx, esi
jmp 0x4d23c1
mov dword [esp + 0x40], 0x44
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov esi, dword [esp + 0x14]
jmp 0x4d22bf
xor eax, eax
jmp 0x4d1bc8
xor eax, eax
jmp 0x4d1c93
xor eax, eax
jmp 0x4d1d5e
xor eax, eax
jmp 0x4d1e2e
xor eax, eax
jmp 0x4d1ef9
xor eax, eax
jmp 0x4d2003
xor eax, eax
jmp 0x4d2109
xor eax, eax
jmp 0x4d2212
xor ebx, ebx
lea edi, [esp + 0x30]
jmp 0x4d238b
push dword [esp + 0x40]
call fcn.005c57c0
add esp, 4
jmp 0x4d141b
push dword [esp + 0x90]
call fcn.005c57c0
add esp, 4
jmp 0x4d14f2
push dword [esp + 0x16c]
call fcn.005c57c0
add esp, 4
jmp 0x4d1943
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d27af
call fcn.00642ea0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 2
push 0x201
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0x19
push 0x793b6e
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, ebx
call fcn.00642f10
mov esi, dword [esp + 4]
jmp 0x4d2858
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2850
call fcn.00642ea0
lea edi, [esp + 0xc8]
mov ecx, edi
push eax
push 2
push 0x1dc
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0x28
push str.InitializeProcThreadAttributeList__size_
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, edi
call fcn.00642f10
jmp 0x4d2850
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2850
lea edi, [esp + 0xc8]
mov ecx, edi
push 2
push 0x1d8
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.004ba430
lea eax, [esp + 0xd0]
push 0x44
push str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, edi
call fcn.004ba910
mov dword [esp + 4], 0
mov edi, dword [esp + 4]
xor ebx, ebx
jmp 0x4d2489
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2858
call fcn.00642ea0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 2
push 0x1e7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0x21
push 0x793b4c
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, ebx
call fcn.00642f10
jmp 0x4d2858
mov dword [esp + 0x18], ebx
lea edi, [ebx + 0x18]
lea esi, [esp + 0x40]
mov ecx, esi
push str.metrics_dir
call fcn.00535cf0
lea ebx, [esp + 0xc8]
mov ecx, ebx
mov edx, esi
push edi
call fcn.004d2c10
add esp, 4
lea eax, [esp + 0x178]
push eax
push ebx
call fcn.004f8050
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x4d2902
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x4d2915
push dword [esp + 0x40]
call fcn.005c57c0
add esp, 4
mov ebx, dword [esp + 0x18]
jmp 0x4d142f
lea ebx, [esp + 0x40]
mov ecx, ebx
push 0x793a70
call fcn.00535cf0
lea ecx, [esp + 0xc8]
mov edx, ebx
push esi
call fcn.004d2c10
add esp, 4
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0xcc]
push eax
call fcn.004f8050
add esp, 8
cmp byte [esp + 0xd3], 0
jns 0x4d2971
push dword [esp + 0xc8]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x4d2984
push dword [esp + 0x40]
call fcn.005c57c0
add esp, 4
add esi, 0xc
cmp esi, edi
mov ebx, dword [esp + 0x14]
je 0x4d17af
jmp 0x4d291e
push edi
push ecx
push ebx
mov edi, edx
call fcn.005c9580
mov ecx, dword [esp + 0x14]
mov edx, edi
add esp, 0xc
jmp 0x4d1b4b
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d29f9
call fcn.00642ea0
lea esi, [esp + 0xc8]
mov ecx, esi
push eax
push 2
push 0x1a7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0xb
push 0x793a7b
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
jmp 0x4d253e
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2a4c
call fcn.00642ea0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 2
push 0x223
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0xd
push str.CreateProcess
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, ebx
call fcn.00642f10
xor ebx, ebx
jmp 0x4d2483
call fcn.00642ea0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 1
push 0x228
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0x12
push str.CloseHandle_thread
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, ebx
call fcn.00642f10
jmp 0x4d2406
call fcn.00642ea0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 1
push 0x22b
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00642eb0
lea eax, [esp + 0xd0]
push 0x13
push str.CloseHandle_process
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, ebx
call fcn.00642f10
jmp 0x4d2428