Function at 0x4a0ed0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [edx]
mov dword [esp + 0x1c], edi
mov ecx, dword [edi + 8]
mov esi, dword [edi]
lea eax, [ecx + 0x320]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
add edx, 4
je 0x4a0f28
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x18], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a0f10
sub ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00413880
add esp, 4
jmp 0x4a0f43
mov ecx, dword [esi + 0x44]
cmp ecx, dword [esi + 0x38]
jae 0x4a1248
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
mov eax, 0xfff4
mov word [ecx + 6], ax
mov edi, dword [edi]
or edx, 0xffffffff
mov ecx, edi
call fcn.004108f0
mov esi, eax
mov ecx, edi
push 0
push bind
mov edx, esi
call fcn.00423d70
mov edx, esi
mov ecx, edi
call fcn.00411220
push dword [ebp + 0xc]
call fcn.0058bf82
mov esi, dword [esp + 0x28]
add esp, 0xc
or eax, 0xffffffff
mov edi, dword [esi]
test edi, edi
je 0x4a0fc7
push 0x61a840
or edx, eax
mov ecx, edi
call fcn.0040fec0
add esp, 4
test eax, eax
je 0x4a0fc4
push 0x61a840
or edx, 0xffffffff
mov ecx, edi
call fcn.0040f5e0
add esp, 4
or edx, 0xffffffff
mov ecx, edi
call fcn.004123e0
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.00414cb0
mov eax, dword [esp + 0x1c]
jmp 0x4a0fc7
or eax, 0xffffffff
dec eax
cmp eax, 0x7f
ja case.0x4a0fd8.3
movzx eax, byte [eax + 0x4a12b4]
jmp dword [eax*4 + 0x4a12a0]
mov edi, dword [esp + 0x14]
mov ecx, dword [esi]
push esi
push 0x49db30
mov edx, dword [edi + 0x18]
push 0
push 0
push 0
push 0
push dword [esi + 8]
push 0
call fcn.0049d5c0
mov ecx, dword [esi]
mov edx, 0x4a0ca0
push edi
call fcn.00470b00
movups xmm0, xmmword [str._command_:__1_]
mov al, byte [0x61a858]
add esp, 0x24
mov byte [esp + 0x30], al
movups xmmword [esp + 0x20], xmm0
push 0x15
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4a125e
mov eax, dword [esp + 0x14]
lea ecx, [edi + 4]
xorps xmm0, xmm0
mov edx, 0x11
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov byte [edi + 0x14], 0
mov dword [edi], eax
lea eax, [esp + 0x20]
push 0x11
push eax
call fcn.00401000
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x1c], ecx
cmp dword [ecx + 8], 0
je 0x4a10ab
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
je 0x4a10ab
mov ecx, dword [eax + 0xc]
mov edx, fcn.004a0850
push edi
push 1
call fcn.004ae9f0
add esp, 8
mov ecx, dword [esi]
call fcn.00414cb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push dword [eax + 0xc]
call fcn.004a0850
mov ecx, dword [esi]
add esp, 8
call fcn.00414cb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
lea eax, [esp + 0x1c]
push eax
push 0
push str.base64
or edx, 0xffffffff
call fcn.0046f9f0
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x14], eax
push ecx
mov ecx, eax
call fcn.004b22e0
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [esi]
push 0
push 0
push eax
call fcn.0049dc40
add esp, 0xc
test eax, eax
jne 0x4a1118
mov ecx, dword [esi]
xor edx, edx
call fcn.0040df70
test eax, eax
je 0x4a1127
push str.ScriptContainer_Error:
push dword [esi]
call fcn.00470ba0
add esp, 8
mov ecx, dword [esi]
call fcn.00414cb0
mov ecx, dword [esi]
call fcn.00414cb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 4], 0
je case.0x4a0fd8.3
mov ecx, dword [esi]
or edx, 0xffffffff
push 0x61a87c
call fcn.0040f5e0
mov ecx, dword [esi]
add esp, 4
call fcn.0040ea50
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [edx + 4]
call fcn.00414800
mov ecx, dword [esi]
or edx, 0xffffffff
push 0x61a884
call fcn.0040f5e0
mov ecx, dword [esi]
add esp, 4
mov edx, 0xfffffffe
call fcn.00410cf0
mov ecx, dword [esi]
mov edx, 0x61a88c
call fcn.00413910
mov ecx, dword [esi]
mov edx, 0xfffffffc
call fcn.00410d60
mov ecx, dword [esi]
mov edx, 2
push 0
call fcn.0040e020
add esp, 4
test eax, eax
je 0x4a11c5
push 0x6234ab
push dword [esi]
call fcn.00470ba0
add esp, 8
mov ecx, dword [esi]
call fcn.00414d90
mov ecx, dword [esi]
call fcn.00414cb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [esi]
xor eax, eax
test edi, edi
je 0x4a1226
push str.noResponse
or edx, 0xffffffff
mov ecx, edi
call fcn.0040fec0
add esp, 4
test eax, eax
je 0x4a1224
push str.noResponse
or edx, 0xffffffff
mov ecx, edi
call fcn.0040f5e0
add esp, 4
or edx, 0xffffffff
mov ecx, edi
call fcn.004123e0
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.00414cb0
mov eax, dword [esp + 0x1c]
jmp 0x4a1226
xor eax, eax
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
call fcn.00414cb0
mov ecx, dword [esi]
test ecx, ecx
je 0x4a10a5
mov ecx, dword [ecx + 0x2c]
call fcn.0042fbe0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.cannot_push_beyond_allocated_stack
push 0x300104f
mov edx, 0x604398
mov ecx, esi
call fcn.0040d110
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
nop
fisttp word [edi]
dec edx
add ah, al
adc byte [edx], cl
cmp edx, dword [ecx]
dec edx
add cl, bl
adc dword [edx], ecx
sahf
adc byte [edx], cl
add byte [ecx], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 2
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 3
int3