Function at 0x4fa650
Capabilities:
Acquire debug privileges
Create thread
Terminate thread

Disassembly:
sub esp, 0x46c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x468], eax
mov eax, dword [esp + 0x478]
push ebp
xor ebp, ebp
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ebp
cmp dword [0x74ba9c], ebp
jne 0x4fa704
push 0x61bf44
call fcn.004f4be0
mov dword [0x74ba9c], eax
cmp eax, ebp
jne 0x4fa69d
xor eax, eax
jmp 0x4fac31
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwQuerySystemInformation
push eax
call esi
mov ecx, dword [0x74ba9c]
push str.ZwDuplicateObject
push ecx
mov dword [0x74ba98], eax
call esi
mov edx, dword [0x74ba9c]
push str.ZwQueryObject
push edx
mov dword [0x74ba94], eax
call esi
mov dword [0x74ba90], eax
mov eax, dword [0x74ba9c]
push str.ZwClose
push eax
call esi
mov dword [0x74ba8c], eax
cmp dword [0x74ba90], ebp
je 0x4fa696
cmp dword [0x74ba94], ebp
je 0x4fa696
cmp dword [0x74ba98], ebp
je 0x4fa696
cmp eax, ebp
je 0x4fa696
push ebp
push 0x643ce8
call fcn.004e21c0
mov ecx, dword [esp + 0x480]
push ecx
push ebp
push 0x40
call fcn.004e45c0
mov esi, eax
add esp, 0x14
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x4fa696
xor ecx, ecx
mov eax, 0x1000
mov dword [esp + 8], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005ddec6
mov ecx, dword [esp + 0xc]
add esp, 4
push ebp
lea edx, [ecx*4]
push edx
push eax
push 0x10
mov dword [esp + 0x28], eax
call dword [0x74ba98]
cmp eax, 0xc0000004
jne 0x4fa7c1
mov eax, dword [esp + 0x18]
push eax
call fcn.005e132a
mov eax, dword [esp + 0xc]
add eax, eax
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005ddec6
mov ecx, dword [esp + 0x10]
add esp, 8
push ebp
lea edx, [ecx*4]
push edx
push eax
push 0x10
mov dword [esp + 0x28], eax
call dword [0x74ba98]
cmp eax, 0xc0000004
je 0x4fa773
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], ebp
cmp dword [ecx], ebp
jbe 0x4fac1a
push ebx
push edi
lea ebx, [ecx + 0xa]
jmp 0x4fa7e6
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov eax, dword [esp + 0x480]
cmp dword [ebx - 6], eax
jne 0x4fac00
movzx edi, word [ebx]
mov ecx, dword [esp + 0x484]
mov eax, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
test ecx, ecx
je 0x4fa822
cmp edi, ecx
jne 0x4fac00
mov eax, 1
push eax
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
push edi
push esi
call dword [0x74ba94]
test eax, eax
jne 0x4fac00
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x38
lea eax, [esp + 0x44]
push eax
push 0
push ecx
call dword [0x74ba90]
test eax, eax
jge 0x4fa873
mov edx, dword [esp + 0x14]
mov eax, dword [0x74ba8c]
push edx
push eax
call fcn.004dbf90
add esp, 8
jmp 0x4fac00
cmp dword [esp + 0x48c], 0
je 0x4fa8b3
movzx ecx, byte [ebx - 2]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x40]
add edx, 0xfffffffe
push edx
movzx edx, byte [ebx - 1]
dec eax
push eax
mov eax, dword [ebx + 6]
push ecx
movzx ecx, word [ebx]
push edx
mov edx, dword [ebx + 2]
push eax
push ecx
push edx
push str._p__04hx__6lx__2x__3lx__3ld__4ld__2d
call fcn.005e0e7f
add esp, 0x24
mov eax, dword [esp + 0x64]
add eax, 2
push eax
push 0x40
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4fa8e6
mov eax, dword [esp + 0x14]
mov ecx, dword [0x74ba8c]
push eax
push ecx
call fcn.004dbf90
add esp, 8
jmp 0x4fac00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 2
push ecx
call dword [0x74ba90]
test eax, eax
jl 0x4faa0f
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004da960
add esp, 8
cmp eax, 1
jne 0x4fa9a7
mov edi, dword [esp + 0x18]
push str.File
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4fa96c
cmp dword [esp + 0x48c], 0
je 0x4fa957
movzx edx, word [esi]
mov ecx, dword [esi + 4]
push ecx
shr edx, 1
push edx
push str.__14.ws_n
call fcn.005e0e7f
add esp, 0xc
push edi
call fcn.005e0865
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4fa8cd
push edi
mov ebp, 1
call fcn.005e0865
add esp, 4
cmp dword [esp + 0x48c], 0
mov dword [esp + 0x18], 0
je 0x4fa9a3
movzx eax, word [esi]
mov edx, dword [esi + 4]
push edx
shr eax, 1
push eax
push str.__14.ws
call fcn.005e0e7f
add esp, 0xc
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebx + 6]
cmp eax, 0x12019f
je 0x4faaf0
cmp eax, 0x100000
je 0x4faaf0
test ebp, ebp
je 0x4fa9d6
cmp eax, 0x120189
je 0x4fab96
mov eax, dword [esp + 0x60]
test eax, eax
jne 0x4fa9e3
mov eax, 0x800
push eax
push 0x40
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4faa2b
mov ecx, dword [esp + 0x14]
mov edx, dword [0x74ba8c]
push ecx
push edx
call fcn.004dbf90
add esp, 8
jmp 0x4fac00
cmp dword [esp + 0x48c], 0
je 0x4fa9a7
push str.ZwQueryObject__OTI__FAILED
call fcn.005e0e7f
add esp, 4
jmp 0x4fa9a7
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push 1
push edx
call dword [0x74ba90]
test eax, eax
jl 0x4faacc
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.004da960
add esp, 8
cmp eax, 1
jne 0x4faae4
cmp dword [esp + 0x48c], 0
je 0x4faa86
movzx eax, word [esi]
mov edx, dword [esi + 4]
push edx
shr eax, 1
push eax
push str._.ws
call fcn.005e0e7f
add esp, 0xc
cmp dword [esp + 0x28], 0
mov edi, dword [esp + 0x18]
je 0x4faab3
mov eax, dword [esp + 0x28]
cmp byte [eax], 0
je 0x4faab3
push 0
push eax
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4faab3
mov dword [esp + 0x24], 1
push edi
call fcn.005e0865
mov edi, dword [esp + 0x20]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4fab96
cmp dword [esp + 0x48c], 0
je 0x4faae4
push edi
push str.ZwQueryObject__ONI__FAILED_for_handle__04hx
call fcn.005e0e7f
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4fab96
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x38]
push edx
push 0
lea eax, [esp + 0x7c]
push eax
push 0x4dbdd0
push 0
push 0
mov dword [esp + 0x8c], ecx
mov byte [esp + 0x90], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x4fab96
push 0
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
jne 0x4fab45
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4fab8c
cmp byte [esp + 0x78], 0
je 0x4fab8c
cmp dword [esp + 0x48c], 0
je 0x4fab68
lea ecx, [esp + 0x78]
push ecx
push 0x64a224
call fcn.005e0e7f
add esp, 8
mov edx, dword [esp + 0x28]
push 0
push edx
lea eax, [esp + 0x80]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4fab8c
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x1c]
push ecx
call fcn.004dca10
mov edx, dword [esp + 0x14]
mov eax, dword [0x74ba8c]
push edx
push eax
call fcn.004dbf90
add esp, 8
cmp dword [esp + 0x24], 1
jne 0x4fabe9
mov edx, dword [esp + 0x2c]
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
push edi
push edx
call dword [0x74ba94]
test eax, eax
jne 0x4fac00
mov eax, dword [esp + 0x14]
mov ecx, dword [0x74ba8c]
push eax
push ecx
call fcn.004dbf90
add esp, 8
mov dword [esp + 0x30], 1
cmp dword [esp + 0x48c], 0
je 0x4fac00
push 0x60cc70
call fcn.005e0e7f
add esp, 4
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
inc eax
add ebx, 0x10
mov dword [esp + 0x34], eax
cmp eax, dword [ecx]
jb 0x4fa7e0
pop edi
pop ebx
push ecx
call fcn.005e132a
add esp, 4
lea edx, [esp + 0x24]
push edx
call fcn.004dca10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x470]
pop esi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x46c
ret 0x10