Function at 0x49d5c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [esp + 0x10], eax
mov ebx, edx
mov eax, dword [ebp + 0x18]
push esi
mov dword [esp + 0x10], eax
mov esi, ecx
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0xc], eax
push edi
test ecx, ecx
je 0x49d61a
push 4
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x49daba
mov dword [edi], 0
jmp 0x49d61c
xor edi, edi
mov ecx, esi
call fcn.00413e30
mov ecx, dword [esi + 0x44]
cmp ecx, dword [esi + 0x38]
jae 0x49dafb
mov edx, dword [ebp + 0xc]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x619e28
mov ecx, esi
call fcn.0040f8b0
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49db11
movd xmm0, ebx
lea eax, [ecx + 8]
cvtdq2pd xmm0, xmm0
mov dword [esi + 0x44], eax
mov edx, 0xfffffffe
push 0x619e34
movsd qword [ecx], xmm0
mov ecx, esi
call fcn.0040f8b0
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49db11
movd xmm0, dword [ebp + 8]
lea eax, [ecx + 8]
cvtdq2pd xmm0, xmm0
mov dword [esi + 0x44], eax
mov edx, 0xfffffffe
push 0x619e5c
movsd qword [ecx], xmm0
mov ecx, esi
call fcn.0040f8b0
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49dafb
mov edx, dword [ebp + 0x14]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x619e88
mov ecx, esi
call fcn.0040f8b0
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49dafb
mov edx, dword [esp + 0xc]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x619ea8
mov ecx, esi
call fcn.0040f8b0
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49dafb
mov edx, dword [esp + 0x10]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x619ed0
mov ecx, esi
call fcn.0040f8b0
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x49d783
mov edx, eax
mov ecx, esi
call fcn.00413910
push 0x619ef4
mov edx, 0xfffffffe
mov ecx, esi
call fcn.0040f8b0
add esp, 4
mov edx, dword [ebp + 0x1c]
test edx, edx
je 0x49d7bc
mov ecx, dword [esi + 0x44]
cmp ecx, dword [esi + 0x38]
jae 0x49dafb
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x619f10
mov ecx, esi
call fcn.0040f8b0
add esp, 4
mov ecx, esi
call fcn.00414cb0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x49d7db
push dword [esp + 0x10]
mov edx, eax
mov ecx, esi
call fcn.004707c0
add esp, 4
test bl, 2
jne 0x49d88b
mov ecx, esi
call fcn.004a81f0
push 0x474e30
mov edx, str.http_digest
mov ecx, esi
call fcn.00456220
add esp, 4
mov edx, str.http_headers
mov ecx, esi
push 0x475260
call fcn.00456220
add esp, 4
mov edx, 0x610588
mov ecx, esi
push 0x48aaa0
call fcn.00456220
add esp, 4
mov edx, str.global_tunnel
mov ecx, esi
push 0x48b5a0
call fcn.00456220
add esp, 4
mov edx, 0x61059c
mov ecx, esi
push 0x48d840
call fcn.00456220
add esp, 4
mov edx, str.dgram
mov ecx, esi
push 0x45c1f0
call fcn.00456220
add esp, 4
mov edx, 0x60f3fc
mov ecx, esi
push fcn.00486800
call fcn.00456220
add esp, 4
mov edx, 0x60f404
mov ecx, esi
push 0x486a90
call fcn.00456220
add esp, 4
test ebx, 0x8000000
jne 0x49d8a7
push 0x46c6f0
mov edx, str._GenericMarshal
mov ecx, esi
call fcn.00456220
add esp, 4
test ebx, 0x4000000
jne 0x49d8d7
push 0x457c00
mov edx, str.child_process
mov ecx, esi
call fcn.00456220
add esp, 4
mov edx, str.heci
mov ecx, esi
push fcn.0046f170
call fcn.00456220
add esp, 4
test bl, 1
jne 0x49d8f0
push 0x465b00
mov edx, 0x60970c
mov ecx, esi
call fcn.00456220
add esp, 4
mov ecx, esi
call fcn.004a5d90
push 0x45d8b0
mov edx, str.EncryptionStream
mov ecx, esi
call fcn.00456220
add esp, 4
mov edx, str.events
mov ecx, esi
push 0x460fc0
call fcn.00456220
add esp, 4
mov ecx, esi
call fcn.00496dc0
push 0x4876f0
mov edx, str.MemoryStream
mov ecx, esi
call fcn.00456220
add esp, 4
mov edx, str.NetworkMonitor
mov ecx, esi
push 0x48e310
call fcn.00456220
movaps xmm0, xmmword [0x5f1050]
lea eax, [esp + 0x20]
add esp, 4
mov dword [esp + 0x34], 0x619f38
mov edx, str.ContainerPermissions
mov dword [esp + 0x38], str.NO_AGENT
mov ecx, esi
mov dword [esp + 0x3c], str.NO_MARSHAL
mov dword [esp + 0x40], str.NO_PROCESS_SPAWNING
push 6
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x4c], str.NO_FILE_SYSTEM_ACCESS
push eax
mov dword [esp + 0x54], str.NO_NETWORK_ACCESS
movups xmmword [esp + 0x28], xmm0
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 2
call fcn.0046fb00
movaps xmm0, xmmword [0x5f1040]
lea eax, [esp + 0x40]
add esp, 0xc
mov dword [esp + 0x1c], str.DEFAULT
mov edx, str.ContainerUserTypes
mov dword [esp + 0x20], str.USER
mov ecx, esi
mov dword [esp + 0x24], str.TERMINAL
mov dword [esp + 0x28], str.WINLOGON
push 4
push eax
lea eax, [esp + 0x24]
push eax
movups xmmword [esp + 0x40], xmm0
call fcn.0046fb00
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x49da16
cmp dword [ebp + 0x1c], 0
je 0x49da16
push 0x4a21d0
mov edx, 0x61a06c
jmp 0x49da20
push 0x4a2380
mov edx, str.ScriptContainer
mov ecx, esi
call fcn.00456220
mov ebx, dword [ebp + 0x14]
add esp, 4
mov edx, dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.004568f0
add esp, 4
mov edx, ebx
mov ecx, esi
call fcn.004a6d40
push 0x49d360
mov edx, 0x619d78
mov ecx, esi
call fcn.00456220
mov edx, dword [esp + 0x1c]
add esp, 4
mov ecx, esi
call fcn.0049bd80
test edi, edi
je 0x49da9f
push edi
mov edx, 0x49c250
mov dword [edi], esi
mov ecx, esi
call fcn.004707c0
add esp, 4
mov ecx, esi
call fcn.00470e90
imul ecx, dword [ebp + 8], 0x3e8
mov edx, edi
push 0
push 0x49c290
push ecx
mov ecx, dword [eax + 0x2e4]
call fcn.004b2450
add esp, 0xc
mov ecx, esi
call fcn.00496a90
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
push str.cannot_push_beyond_allocated_stack
push 0x30010f5
mov edx, 0x604448
mov ecx, esi
call fcn.0040d110
push str.cannot_push_beyond_allocated_stack
push 0x3001094
mov edx, 0x6043e8
mov ecx, esi
call fcn.0040d110
int3