Function at 0x402f90
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ceae0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x978
mov eax, dword [0x68a140]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x898], ecx
mov dword [ebp - 0x424], 0
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x8c0], ecx
movups xmmword [ebp - 0x4d4], xmm0
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4c0], 7
mov word [ebp - 0x4d4], ax
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ecx]
mov dword [ebp - 0x894], edi
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4048b1
xor ecx, ecx
mov dword [ebp - 0x8ac], edi
push eax
push ecx
movups xmmword [ebp - 0x8bc], xmm0
push 0x2000000
mov dword [ebp - 0x8a8], 7
mov word [ebp - 0x8bc], cx
mov dword [ebp - 0x424], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x42c], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x403126
mov ecx, dword [ebp - 0x8ac]
cmp ecx, 0x104
jb 0x4030ac
cmp dword [ebp - 0x8a8], 7
lea eax, [ebp - 0x8bc]
mov dword [ebp - 0x8ac], 0x104
cmova eax, dword [ebp - 0x8bc]
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x4030c1
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp - 0x8bc]
push 0
push eax
call fcn.004286f0
cmp dword [ebp - 0x8a8], 7
lea eax, [ebp - 0x8bc]
push dword [ebp - 0x8ac]
cmova eax, dword [ebp - 0x8bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov ecx, dword [ebp - 0x8ac]
cmp eax, ecx
ja 0x40310f
cmp dword [ebp - 0x8a8], 7
lea ecx, [ebp - 0x8bc]
mov dword [ebp - 0x8ac], eax
cmova ecx, dword [ebp - 0x8bc]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x40311f
sub eax, ecx
lea ecx, [ebp - 0x8bc]
push 0
push eax
call fcn.004286f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x4d4]
call fcn.00428f30
movups xmm0, xmmword [ebp - 0x8bc]
xor eax, eax
lea ecx, [ebp - 0x8bc]
mov word [ebp - 0x8bc], ax
movups xmmword [ebp - 0x4d4], xmm0
movq xmm0, qword [ebp - 0x8ac]
movq qword [ebp - 0x4c4], xmm0
mov dword [ebp - 0x8ac], 0
mov dword [ebp - 0x8a8], 7
mov byte [ebp - 4], al
call fcn.00428f30
mov esi, dword [ebp - 0x898]
mov eax, dword [esi]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
je 0x404974
mov eax, dword [0x629468]
mov edx, 2
movq xmm0, qword [str.dump]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x48c], 0x35423232
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x488], 0x36363239
mov ecx, dword [ebp - 0x488]
movq qword [ebp - 0x468], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x608]
push eax
mov dword [ebp - 0x454], 0x168
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x440], 0
call fcn.004254c0
mov eax, 8
add esp, 4
mov dword [ebp - 0x878], eax
push str.Debugger_attached_to_process:
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 3
call fcn.00426c60
lea ecx, [ebp - 0x4d4]
push ecx
mov ecx, eax
call fcn.00428440
push str._PID:
mov ecx, eax
call fcn.00426c60
mov ecx, dword [esi]
add ecx, 0x1c
push ecx
mov ecx, eax
call fcn.00408960
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 0
call fcn.00426740
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
test eax, eax
je 0x4049b5
mov byte [ebp - 0x879], 0
mov byte [ebp - 0x886], 1
mov byte [ebp - 0x885], 0
mov byte [ebp - 0x872], 0
mov dword [ebp - 0x88c], 0xffffffff
nop dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x884], 0x10002
movups xmmword [ebp - 0x4f0], xmm0
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4dc], 0xf
mov byte [ebp - 0x4f0], 0
xor al, al
mov byte [ebp - 4], 5
mov byte [ebp - 0x871], al
mov byte [ebp - 0x873], al
lea eax, [ebp - 0x868]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x4049d0
mov eax, dword [0x629468]
lea edx, [ebp - 0x868]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x8cc], 0x35423232
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x864]
mov dword [ebp - 0x8c8], 0x36363239
mov ecx, dword [ebp - 0x8c8]
push eax
movq qword [ebp - 0x468], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x468]
push 0x1d
push str.Event:_Process:_Thread:
mov dword [ebp - 0x454], 0x182
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x440], 0
call fcn.004089e0
add esp, 0x10
cmp byte [ebp - 0x886], 0
je 0x403465
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
test eax, eax
je 0x4033a3
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [ebp - 0x864]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [0x6ede08]
call fcn.00422c40
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4033dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40341c
push 0
lea eax, [ebp - 0x4ac]
mov dword [ebp - 0x4b4], edi
push eax
push 0
push 0
push 5
lea eax, [ebp - 0x4b4]
mov byte [ebp - 0x4b0], 1
push eax
push 0xb2d601c4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x403415
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6eefcc
mov byte [ebp - 0x886], 0
mov dword [ebp - 0x42c], 0x6eefcc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x4d4]
mov byte [ebp - 4], 6
push eax
call fcn.00405a10
mov edi, eax
mov byte [ebp - 4], 5
push 0x6eefcc
mov dword [ebp - 0x894], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x898]
mov ecx, dword [ebp - 0x868]
dec ecx
cmp ecx, 8
ja case.0x403475.2
jmp dword [ecx*4 + 0x404a1c]
mov eax, dword [0x629468]
lea edx, [ebp - 0x864]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x8d8], 0x35423232
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x8d4], 0x36363239
mov ecx, dword [ebp - 0x8d4]
push eax
lea eax, [ebp - 0x85c]
movq qword [ebp - 0x468], xmm0
push eax
lea eax, [ebp - 0x860]
mov dword [ebp - 0x458], ecx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x454], 0x195
push 0x64
push str.EXCEPTION_DEBUG_EVENT_Process:_Thread:_Exception:0x:08X_FirstChance:_ExceptionFlags:0x:08X
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x440], 0
movups xmmword [ebp - 0x450], xmm0
call fcn.00408a10
movaps xmm0, xmmword [0x64a500]
xor eax, eax
movups xmmword [ebp - 0x808], xmm0
mov dword [ebp - 0x880], 0
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x7f8], 0
movups xmmword [ebp - 0x7f4], xmm0
mov dword [ebp - 0x7e4], 0
movups xmmword [ebp - 0x7dc], xmm0
mov dword [ebp - 0x7e0], 7
mov word [ebp - 0x7f4], ax
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c8], 7
mov word [ebp - 0x7dc], ax
mov word [ebp - 0x7c4], ax
mov eax, dword [esi]
push eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x944], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x940], 1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7f4]
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x808], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x804], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x800], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x7fc], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x7f8], eax
lea eax, [esi + 0x2c]
cmp ecx, eax
je 0x4035fa
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x4035ed
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x7f4]
call fcn.00428770
lea eax, [esi + 0x44]
lea ecx, [ebp - 0x7dc]
cmp ecx, eax
je 0x40361f
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x403612
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x7dc]
call fcn.00428770
movzx eax, byte [esi + 0x5c]
mov byte [ebp - 0x7c4], al
movzx eax, byte [esi + 0x5d]
mov byte [ebp - 4], 7
push dword [ebp - 0x434]
mov byte [ebp - 0x7c3], al
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x80c], 0
mov ecx, dword [ebp - 0x85c]
sete byte [ebp - 0x425]
mov byte [ebp - 0x940], 0
mov dword [ebp - 0x434], ecx
cmp ecx, 0x60aa0003
jne 0x4036fe
push dword [ebp - 0x864]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4036ae
push esi
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
movzx ecx, byte [ebp - 0x879]
test eax, eax
mov eax, 1
cmovne ecx, eax
push esi
mov byte [ebp - 0x879], cl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x7dc]
call fcn.00428f30
lea ecx, [ebp - 0x7f4]
call fcn.00428f30
push dword [ebp - 0x884]
push dword [ebp - 0x860]
push dword [ebp - 0x864]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
cmp byte [ebp - 0x871], 0
mov esi, dword [ebp - 0x898]
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x894]
je 0x4032a0
jmp 0x40494b
cmp ecx, 0x80000003
jne 0x40381a
cmp byte [ebp - 0x879], 0
je 0x403739
lea ecx, [ebp - 0x7dc]
mov byte [ebp - 0x871], 1
mov byte [ebp - 4], 5
call fcn.00428f30
lea ecx, [ebp - 0x7f4]
call fcn.00428f30
jmp 0x404818
cmp byte [ebp - 0x885], 0
jne 0x40381a
push dword [ebp - 0x864]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4037ed
lea eax, [ebp - 0x490]
push eax
push 0x400
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x4037e6
mov eax, dword [ebp - 0x490]
cmp eax, 0x400
jbe 0x403799
mov eax, 0x400
mov dword [ebp - 0x490], eax
xor edi, edi
test eax, 0xfffffffc
jbe 0x4037e6
push 0x104
lea eax, [ebp - 0x700]
push eax
push dword [ebp + edi*4 - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x4037d8
lea eax, [ebp - 0x700]
push str.verifier.dll
push eax
call fcn.005a577a
add esp, 8
test eax, eax
je 0x403800
mov eax, dword [ebp - 0x490]
inc edi
shr eax, 2
cmp edi, eax
jb 0x4037a2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x872], 0
mov byte [ebp - 0x885], 1
jmp 0x4036ae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x872], 1
mov byte [ebp - 0x885], 1
jmp 0x4036ae
mov eax, 0x80010001
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x890], eax
cmp ecx, 0xc0000008
ja 0x403902
je 0x4038d2
cmp ecx, 0x80000001
je 0x4038c2
cmp ecx, 0x80000003
je 0x403877
cmp ecx, 0x80000004
jne 0x40397e
mov eax, 0x10002
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x890], eax
mov eax, 1
lock xadd dword [edi + 8], eax
inc eax
jmp 0x4038a0
cmp byte [ebp - 0x872], 0
je 0x403ce0
mov eax, 0x10002
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x890], eax
mov eax, 1
lock xadd dword [edi + 4], eax
inc eax
cmp eax, 0x1e
jae 0x403ce0
cmp dword [edi + 0x10], 0x5000
jae 0x403ce0
mov byte [ebp - 0x425], 1
jmp 0x403ce0
mov eax, 1
lock xadd dword [edi + 0xc], eax
inc eax
cmp eax, 0xa
jmp 0x4038b0
mov eax, 0x10002
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x890], eax
mov eax, 1
lock xadd dword [edi], eax
inc eax
cmp eax, 0xa
jae 0x403ce0
mov byte [ebp - 0x425], 1
jmp 0x403ce0
cmp ecx, 0xc000070a
je 0x403cc8
cmp ecx, 0xc0000710
jne 0x40397e
push dword [ebp - 0x860]
mov dword [ebp - 0x424], 0
push 0
push 0x80
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x403952
push 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, dword [ebp - 0x424]
mov byte [ebp - 0x425], 0
mov ecx, 0x10002
mov dword [ebp - 0x884], ecx
mov dword [ebp - 0x890], ecx
test eax, eax
je 0x403ce0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403ce0
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0xcede0000
jne 0x403ce0
mov eax, dword [ebp - 0x808]
cmp cl, 4
mov ecx, 2
mov dword [ebp - 0x470], 0
cmove eax, ecx
mov dword [ebp - 0x46c], 0
push 0x1f
xorps xmm0, xmm0
mov dword [ebp - 0x808], eax
push str.Cause:_VectoredExceptionHandler
lea ecx, [ebp - 0x480]
movups xmmword [ebp - 0x480], xmm0
call fcn.00428be0
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 9
push eax
mov edx, 0x624450
lea ecx, [ebp - 0x454]
call fcn.00408b20
add esp, 4
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x403a04
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x7dc]
call fcn.00422330
lea ecx, [ebp - 0x454]
call fcn.00428f30
lea ecx, [ebp - 0x480]
call fcn.00428f30
mov eax, dword [ebp - 0x434]
shr eax, 8
test al, 1
je 0x403c92
cmp dword [ebp - 0x84c], 2
jb 0x403c92
cmp dword [ebp - 0x848], 0
je 0x403c92
cmp dword [ebp - 0x844], 0
je 0x403c92
push dword [ebp - 0x864]
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x42c], esi
test esi, esi
je 0x403c92
xorps xmm0, xmm0
mov dword [ebp - 0x470], 0
movups xmmword [ebp - 0x480], xmm0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x424], eax
cmp eax, 0x104
jbe 0x403b43
mov dword [ebp - 0x424], 0x104
mov eax, 0x104
push 0
push eax
lea ecx, [ebp - 0x480]
call fcn.00427f30
cmp dword [ebp - 0x46c], 0xf
lea ecx, [ebp - 0x424]
push ecx
push dword [ebp - 0x424]
lea eax, [ebp - 0x480]
cmova eax, dword [ebp - 0x480]
push eax
push dword [ebp - 0x844]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x403c4d
mov ecx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x470]
cmp ecx, eax
ja 0x403b56
cmp dword [ebp - 0x46c], 0xf
lea eax, [ebp - 0x480]
mov dword [ebp - 0x470], ecx
cmova eax, dword [ebp - 0x480]
mov byte [eax + ecx], 0
jmp 0x403b66
test eax, eax
jne 0x403ace
mov dword [ebp - 0x470], eax
mov byte [ebp + eax - 0x480], al
jmp 0x403adc
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x480]
call fcn.00427f30
cmp dword [ebp - 0x46c], 0xf
lea edx, [ebp - 0x480]
push 0xfde9
push dword [ebp - 0x470]
cmova edx, dword [ebp - 0x480]
lea ecx, [ebp - 0x454]
call fcn.00421960
mov edi, dword [ebp - 0x878]
add esp, 8
or edi, 0x400
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x928]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x918], 0
push str.___Cause:
movups xmmword [ebp - 0x928], xmm0
mov dword [ebp - 0x914], 0
call fcn.00428be0
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x928]
push eax
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x960]
call fcn.00409fd0
or edi, 0x800
mov dword [ebp - 0x878], edi
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x960]
cmp dword [ebp - 0x94c], 7
lea ecx, [ebp - 0x7dc]
push dword [ebp - 0x950]
cmova eax, dword [ebp - 0x960]
push eax
call fcn.00422330
lea ecx, [ebp - 0x960]
call fcn.00428f30
lea ecx, [ebp - 0x928]
call fcn.00428f30
lea ecx, [ebp - 0x454]
call fcn.00428f30
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x46c]
cmp ecx, 0xf
jbe 0x403c8b
mov edx, dword [ebp - 0x480]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403c81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a11
push ecx
push edx
call fcn.0059a0ba
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
shr eax, 0xa
test al, 1
je 0x403cbf
cmp dword [ebp - 0x84c], 3
jb 0x403cbf
mov eax, dword [ebp - 0x840]
test eax, eax
mov ecx, dword [ebp - 0x880]
cmovne ecx, eax
mov dword [ebp - 0x880], ecx
mov byte [ebp - 0x425], 1
jmp 0x403ccf
mov byte [ebp - 0x425], 0
mov eax, 0x10002
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x884], eax
push dword [ebp - 0x860]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
mov dword [ebp - 0x434], esi
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [ebp - 0x43c], xmm0
xor edi, edi
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], edi
cmp dword [ebp - 0x80c], edi
jne 0x403e60
cmp dword [ebp - 0x884], 0x10002
je 0x403e60
mov byte [ebp - 4], 0x12
xor edx, edx
mov edi, dword [ebp - 0x878]
xor eax, eax
or edi, 0x40
movlpd qword [ebp - 0x430], xmm0
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x878], edi
mov dword [ebp - 0x424], edi
test esi, esi
je 0x403dfd
push 0x2c8
push eax
lea eax, [ebp - 0x7bc]
push eax
call fcn.0059bcc0
add esp, 0xc
mov dword [ebp - 0x7c0], 0x1003f
lea eax, [ebp - 0x7c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x403df1
push 0x2d8
call fcn.0059a103
mov dword [ebp - 0x42c], eax
lea esi, [ebp - 0x7c0]
xorps xmm0, xmm0
mov ecx, 0xb3
add esp, 4
movq qword [eax], xmm0
lea edx, [eax + 0xc]
mov dword [eax + 8], 0
mov edi, edx
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_struct__CONTEXT_.0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x878]
or edi, 0x80
jmp 0x403dfd
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x438], eax
lea ecx, [ebp - 0x4d4]
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], edx
push eax
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 0x11
and edi, 0xffffffbf
lea edx, [ebp - 0x868]
push eax
mov dword [ebp - 0x878], edi
call fcn.00402950
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
mov ecx, dword [ebp - 0x43c]
mov al, 1
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x438]
mov byte [ebp - 0x871], al
mov byte [ebp - 0x873], al
cmp byte [ebp - 0x425], 0
jne 0x403ec4
test edi, edi
je 0x403eb6
mov eax, dword [ebp - 0x88c]
lock xadd dword [edi + 4], eax
jne 0x403eb6
mov eax, dword [edi]
mov edi, dword [eax]
mov ecx, edi
call dword [0x5f3508]
mov ecx, dword [ebp - 0x438]
call edi
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0x438]
lock xadd dword [ecx + 8], eax
jne 0x403eb6
mov eax, dword [ecx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x5f3508]
mov ecx, dword [ebp - 0x438]
call edi
test esi, esi
je 0x4046b8
push esi
jmp 0x4046b2
test ecx, ecx
jne 0x40402b
mov byte [ebp - 4], 0x13
xorps xmm0, xmm0
mov eax, dword [ebp - 0x878]
xor edx, edx
or eax, 0x100
movlpd qword [ebp - 0x430], xmm0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x424], eax
test esi, esi
je 0x403fa4
push 0x2c8
push edx
lea eax, [ebp - 0x7bc]
push eax
call fcn.0059bcc0
add esp, 0xc
mov dword [ebp - 0x7c0], 0x1003f
lea eax, [ebp - 0x7c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x403f98
push 0x2d8
call fcn.0059a103
mov edx, eax
lea esi, [ebp - 0x7c0]
mov dword [ebp - 0x42c], edx
xorps xmm0, xmm0
mov ecx, 0xb3
add esp, 4
or dword [ebp - 0x878], 0x200
movq qword [edx], xmm0
lea edi, [edx + 0xc]
mov dword [edx + 8], 0
mov dword [edx + 4], 1
mov dword [edx + 8], 1
mov dword [edx], vtable.std::_Ref_count_obj2_struct__CONTEXT_.0
mov dword [ebp - 0x428], edi
rep movsd dword es:[edi], dword [esi]
jmp 0x403f9e
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x438]
mov edi, edx
mov dword [ebp - 0x43c], ecx
mov esi, eax
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x438], edi
test eax, eax
je 0x40401d
mov eax, dword [ebp - 0x88c]
mov edx, esi
lock xadd dword [edx + 4], eax
jne 0x40401d
mov eax, dword [esi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f3508]
mov ecx, dword [ebp - 0x424]
call esi
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0x42c]
lock xadd dword [ecx + 8], eax
jne 0x404017
mov eax, ecx
mov eax, dword [eax]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f3508]
mov ecx, dword [ebp - 0x424]
call esi
mov ecx, dword [ebp - 0x428]
mov esi, dword [ebp - 0x878]
and esi, 0xfffffeff
jmp 0x404031
mov esi, dword [ebp - 0x878]
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x86c], ecx
mov ecx, dword [ebp - 0x880]
xorps xmm0, xmm0
mov dword [ebp - 0x870], eax
test ecx, ecx
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x804], eax
sete byte [ebp - 0x7c4]
mov eax, dword [ebp - 0x860]
test ecx, ecx
mov dword [ebp - 0x800], eax
lea eax, [ebp - 0x870]
cmovne eax, ecx
mov dword [ebp - 0x498], 0
cmp byte [ebp - 0x872], 0
mov ecx, 2
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x808]
cmovne eax, ecx
mov dword [ebp - 0x494], 7
mov dword [ebp - 0x808], eax
xor eax, eax
movups xmmword [ebp - 0x4a8], xmm0
mov word [ebp - 0x4a8], ax
push eax
push 0x104
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x14
call fcn.004286f0
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [ebp - 0x494], 7
lea ecx, [ebp - 0x4a8]
push dword [ebp - 0x488]
cmova ecx, dword [ebp - 0x4a8]
mov edx, str.unp_u_ux_manual.mdmp
push dword [ebp - 0x484]
cmp dword [ebp - 0x80c], 0
mov eax, str.unp_u_ux_unhandled.mdmp
cmovne eax, edx
push eax
push dword [ebp - 0x498]
push ecx
call fcn.00422c20
mov ecx, dword [ebp - 0x498]
add esp, 0x14
cmp eax, ecx
ja 0x40414f
cmp dword [ebp - 0x494], 7
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x498], eax
cmova ecx, dword [ebp - 0x4a8]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x40415f
sub eax, ecx
lea ecx, [ebp - 0x4a8]
push 0
push eax
call fcn.004286f0
mov ecx, dword [ebp - 0x498]
mov eax, 0x5c
mov word [ebp - 0x428], ax
cmp ecx, 0x7ffffffe
je 0x404a16
cmp dword [ebp - 0x494], 7
lea eax, [ebp - 0x4a8]
push ecx
cmova eax, dword [ebp - 0x4a8]
push eax
push 1
lea eax, [ebp - 0x428]
push eax
push ecx
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x928]
call fcn.004218a0
or esi, 0x20
mov dword [ebp - 0x878], esi
mov dword [ebp - 0x424], esi
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x928]
cmp dword [ebp - 0x914], 7
lea ecx, [ebp - 0x7f4]
push dword [ebp - 0x918]
cmova eax, dword [ebp - 0x928]
push eax
call fcn.00422330
lea ecx, [ebp - 0x928]
call fcn.00428f30
mov byte [ebp - 4], 0x16
sub esp, 0x48
mov esi, esp
mov dword [ebp - 0x948], esi
mov eax, dword [ebp - 0x808]
mov dword [esi], eax
lea ecx, [esi + 0x14]
mov eax, dword [ebp - 0x804]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x800]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x7fc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x7f8]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x7f4]
push eax
call fcn.00422b20
lea eax, [ebp - 0x7dc]
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x2c]
push eax
call fcn.00422b20
movzx eax, byte [ebp - 0x7c4]
mov byte [esi + 0x44], al
movzx eax, byte [ebp - 0x7c3]
mov byte [esi + 0x45], al
mov byte [ebp - 4], 0x16
call fcn.0045d0c0
mov eax, dword [ebp - 0x808]
add esp, 0x48
movq xmm0, qword [str.dump]
mov dword [ebp - 0x42c], eax
mov eax, dword [0x629468]
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x8e4], 0x35423232
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x930], eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x8e0], 0x36363239
mov ecx, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x804]
movq qword [ebp - 0x93c], xmm0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x92c], ecx
push 0x58
mov dword [ebp - 0x928], 0x258
movups xmmword [ebp - 0x924], xmm0
mov dword [ebp - 0x914], 0
push str.Debugger_exception_0x:08X_successfully_dumped_process__into___dump_level:_:x_
lea edx, [ebp - 0x85c]
lea ecx, [ebp - 0x93c]
call fcn.00408b90
add esp, 0x14
lea ecx, [ebp - 0x460]
cmp dword [ebp - 0x7e0], 7
lea eax, [ebp - 0x7f4]
cmova eax, dword [ebp - 0x7f4]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x404355
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0x440]
shrd ecx, eax, 0x14
mov eax, dword [ebp - 0x894]
add eax, 0x10
lock xadd dword [eax], ecx
mov esi, dword [ebp - 0x88c]
mov dword [ebp - 4], 0x14
jmp 0x404661
lea ecx, [ebp - 0x4a8]
call fcn.00428f30
test edi, edi
je 0x4046a7
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4046a7
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f3508]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x88c]
lock xadd dword [edi + 8], eax
jne 0x4046a7
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f3508]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x4046b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x7dc]
mov byte [ebp - 4], 5
lea esi, [ebp - 0x7f4]
call fcn.00428f30
mov ecx, esi
call fcn.00428f30
cmp byte [ebp - 0x871], 0
je case.0x403475.2
jmp 0x404818
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x403475.2
mov eax, dword [0x629468]
lea edx, [ebp - 0x4d4]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x8f0], 0x35423232
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x864]
mov dword [ebp - 0x8ec], 0x36363239
mov ecx, dword [ebp - 0x8ec]
push eax
movq qword [ebp - 0x468], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x468]
push 0x2a
push str.Process_exited:___PID:___Exit_Code:_
mov dword [ebp - 0x454], 0x282
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x440], 0
call fcn.00408ca0
add esp, 0x10
jmp 0x404811
mov eax, dword [0x629468]
lea edx, [ebp - 0x85c]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x8a4], 0x35423232
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x858]
push eax
mov dword [ebp - 0x8a0], 0x36363239
mov ecx, dword [ebp - 0x8a0]
movq qword [ebp - 0x468], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x468]
push 0x19
push str.RIP_EVENT_occurred_:_
mov dword [ebp - 0x454], 0x295
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x440], 0
call fcn.00408da0
add esp, 0xc
mov byte [ebp - 0x871], 1
mov edi, dword [ebp - 0x864]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [0x6ede08]
call fcn.00422c40
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404860
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x864]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
jmp 0x4036dc
push 0
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0x4bc], edi
push eax
push 0
push 0
push 5
lea eax, [ebp - 0x4bc]
mov byte [ebp - 0x4b8], 0
push eax
push 0xb2d601c4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x404899
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x864]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
jmp 0x4036dc
mov eax, dword [0x629468]
mov edx, 7
movq xmm0, qword [str.dump]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x8a4], 0x35423232
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a0], 0x36363239
mov ecx, dword [ebp - 0x8a0]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x468]
movq qword [ebp - 0x468], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x608]
push eax
mov dword [ebp - 0x454], 0x16c
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x440], edi
call fcn.004254c0
add esp, 4
push str.Debugging_of_own_process_is_not_supported
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 4
call fcn.00426c60
lea ecx, [ebp - 0x608]
call fcn.00426740
lea ecx, [ebp - 0x4d4]
call fcn.00428f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00599e5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x894], eax
mov ecx, esi
lea eax, [ebp - 0x894]
push eax
call fcn.00407bd0
add eax, 0x1c
lea ecx, [ebp - 0x988]
push eax
push 0x3f
push str.Unable_to_start_debugging_of_process_with_id___error_code:_
call fcn.00408860
push 0x685e44
lea eax, [ebp - 0x988]
push eax
call fcn.0059b61b
push 0x685e24
lea eax, [ebp - 0x910]
mov dword [ebp - 0x910], str.Unable_to_disable_kill_on_exit
push eax
call fcn.0059b61b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x894], eax
mov ecx, esi
lea eax, [ebp - 0x894]
push eax
call fcn.00407bd0
add eax, 0x1c
lea ecx, [ebp - 0x978]
push eax
push 0x48
push str.Unable_to_wait_for_debugging_event_of_process_with_id___error_code:_
call fcn.00408860
push 0x685e44
lea eax, [ebp - 0x978]
push eax
call fcn.0059b61b
call fcn.005a55ef
call fcn.00428b70
nop
jl 0x404a52
inc eax
add ah, al
inc eax
add dh, ah
inc esi
inc eax
add ah, al
inc eax
add bh, dh
inc esi
inc eax
add dh, ah
inc esi
inc eax
add ah, al
inc eax
add ah, al
inc eax
invalid
mov al, byte [edi + 0x40]
invalid