Function at 0x412e30
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0x370]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x68]
cmp dword [eax], 0
je 0x4133b7
mov eax, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebp, [esi + 0x300]
mov dword [esp + 0x10], eax
nop dword [eax]
push 0x1f4
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x41326b
mov eax, dword [ebp]
dec eax
cmp eax, 8
ja case.default.0x412e91
jmp dword [eax*4 + 0x4133bc]
cmp dword [esi + 0x35c], 0
je 0x4132f3
mov ecx, dword [esi + 0x30c]
mov eax, 0x80010001
cmp ecx, 0x80000003
mov edx, 0x10002
cmove eax, edx
mov dword [esi + 0x378], eax
cmp ecx, 0xc0000409
je 0x412ee0
cmp ecx, 0xc0000374
je 0x412ee0
cmp ecx, 0xc000041d
jne case.default.0x412e91
mov ecx, esi
call fcn.00417370
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x412e91
cmp byte [0x4ea458], 0
je case.default.0x412e91
cmp byte [0x4ea4a0], 0
je case.default.0x412e91
push dword [esi + 0x310]
push dword [esi + 0x314]
push dword [esi + 0x30c]
push dword [esi + 0x308]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_CreateThread_TID1:__08p__TID2:__08p__Base:_0x_p__TLB:_0x_p__n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x28
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x412fbe
cmp byte [0x4ea458], 0
je 0x412fbe
cmp byte [0x4ea4a0], 0
je 0x412f88
push dword [esi + 0x310]
push str.Debugger:_CreateProcess_hProcess:_0x_08I32X__n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x14
cmp byte [0x4ea458], 0
je 0x412fbe
cmp byte [0x4ea4a0], 0
je 0x412fbe
push dword [esi + 0x318]
movzx eax, word [esi + 0x330]
push eax
push str.Debugger:_CreateProcess_Unicode:__d__Base:_0x_p__n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x18
mov eax, dword [esi + 0x310]
mov dword [esi + 0x360], eax
mov eax, dword [esi + 0x30c]
test eax, eax
je case.default.0x412e91
cmp eax, 0xffffffff
je case.default.0x412e91
push eax
call edi
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x412e91
cmp byte [0x4ea458], 0
je case.default.0x412e91
cmp byte [0x4ea4a0], 0
je case.default.0x412e91
push dword [esi + 0x30c]
push dword [esi + 0x308]
push str.Debugger:_ExitThread_TID:_0x_08X__ExitCode:_0x_X__n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x18
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x41315b
mov eax, dword [esi + 0x31c]
test eax, eax
je 0x413124
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push ecx
push 8
lea ecx, [esp + 0x20]
movlpd qword [esp + 0x20], xmm0
push ecx
push eax
push dword [esi + 0x360]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x413124
cmp dword [esp + 0x14], 0
je 0x413124
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.00416670
test eax, eax
je 0x413124
cmp word [esi + 0x320], 0
je 0x4130f6
cmp byte [0x4ea458], 0
je 0x41315b
cmp byte [0x4ea4a0], 0
je 0x41315b
push dword [esi + 0x310]
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__s___0x_p_n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x20
jmp 0x41315b
cmp byte [0x4ea458], 0
je 0x41315b
cmp byte [0x4ea4a0], 0
je 0x41315b
push dword [esi + 0x310]
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__S___0x_p_n
jmp 0x4130e3
cmp byte [0x4ea458], 0
je 0x41315b
cmp byte [0x4ea4a0], 0
je 0x41315b
push dword [esi + 0x310]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll____p_n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x1c
mov eax, dword [esi + 0x30c]
cmp eax, 0xffffffff
je case.default.0x412e91
push eax
call edi
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x412e91
cmp byte [0x4ea458], 0
je case.default.0x412e91
cmp byte [0x4ea4a0], 0
je case.default.0x412e91
push dword [esi + 0x30c]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_UnloadDll___0x_p_n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x1c
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x412e91
movzx edi, word [esi + 0x312]
test di, di
je 0x41324f
cmp dword [esi + 0x30c], 0
je 0x41324f
call fcn.00413f80
push eax
push edi
lea ecx, [esi + 0x384]
call fcn.004034c0
test al, al
je 0x41324f
push dword [esi + 0x30c]
mov ecx, esi
call fcn.00416670
test eax, eax
je 0x41324f
cmp word [esi + 0x310], 0
je 0x41327f
cmp byte [0x4ea458], 0
je 0x41324f
cmp byte [0x4ea4a0], 0
je 0x41324f
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__s_n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x378]
push dword [esi + 0x308]
push dword [esi + 0x304]
call dword [esp + 0x1c]
mov eax, dword [esi + 0x68]
cmp dword [eax], 0
jne 0x412e70
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp byte [0x4ea458], 0
je 0x41324f
cmp byte [0x4ea4a0], 0
je 0x41324f
push dword [esi + 0x394]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__S_n
jmp 0x41323e
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x412e91
cmp byte [0x4ea458], 0
je case.default.0x412e91
cmp byte [0x4ea4a0], 0
je case.default.0x412e91
push dword [esi + 0x310]
push dword [esi + 0x30c]
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_Rip:_Error:_0x_X__Type:_0x_X__n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x20
jmp case.default.0x412e91
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x41332e
cmp byte [0x4ea458], 0
je 0x41332e
cmp byte [0x4ea4a0], 0
je 0x41332e
push dword [esi + 0x37c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_EXCEPTION_DEBUG_EVENT__FirstChance_Exception___Crash._n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x18
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00417370
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x41337a
cmp byte [0x4ea458], 0
je 0x41337a
cmp byte [0x4ea4a0], 0
je 0x41337a
push dword [esi + 0x30c]
push dword [esi + 0x308]
push str.Debugger:_ExitProcess_TID:_0x_08X__ExitCode:_0x_x__n
push 0
push 8
push 0x46a400
call fcn.00419900
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, 0x10002
shr eax, 0x19
not al
test al, 1
mov eax, 0x40010004
cmove eax, ecx
mov ecx, esi
mov dword [esi + 0x378], eax
mov eax, dword [esi]
call dword [eax + 0x7c]
push dword [esi + 0x378]
push dword [esi + 0x308]
push dword [esi + 0x304]
call dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret