Function at 0x410a60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0x360]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x60]
cmp dword [eax], 0
je 0x410fe7
mov eax, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebp, [esi + 0x2f0]
mov dword [esp + 0x10], eax
nop dword [eax]
push 0x1f4
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x410e9b
mov eax, dword [ebp]
dec eax
cmp eax, 8
ja case.default.0x410ac1
jmp dword [eax*4 + 0x410fec]
cmp dword [esi + 0x34c], 0
je 0x410f23
mov ecx, dword [esi + 0x2fc]
mov eax, 0x80010001
cmp ecx, 0x80000003
mov edx, 0x10002
cmove eax, edx
mov dword [esi + 0x368], eax
cmp ecx, 0xc0000409
je 0x410b10
cmp ecx, 0xc0000374
je 0x410b10
cmp ecx, 0xc000041d
jne case.default.0x410ac1
mov ecx, esi
call fcn.00414730
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x410ac1
cmp byte [0x4e0338], 0
je case.default.0x410ac1
cmp byte [0x4e0380], 0
je case.default.0x410ac1
push dword [esi + 0x300]
push dword [esi + 0x304]
push dword [esi + 0x2fc]
push dword [esi + 0x2f8]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_CreateThread_TID1:__08p__TID2:__08p__Base:_0x_p__TLB:_0x_p__n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x28
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410bee
cmp byte [0x4e0338], 0
je 0x410bee
cmp byte [0x4e0380], 0
je 0x410bb8
push dword [esi + 0x300]
push str.Debugger:_CreateProcess_hProcess:_0x_08I32X__n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x14
cmp byte [0x4e0338], 0
je 0x410bee
cmp byte [0x4e0380], 0
je 0x410bee
push dword [esi + 0x308]
movzx eax, word [esi + 0x320]
push eax
push str.Debugger:_CreateProcess_Unicode:__d__Base:_0x_p__n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x18
mov eax, dword [esi + 0x300]
mov dword [esi + 0x350], eax
mov eax, dword [esi + 0x2fc]
test eax, eax
je case.default.0x410ac1
cmp eax, 0xffffffff
je case.default.0x410ac1
push eax
call edi
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x410ac1
cmp byte [0x4e0338], 0
je case.default.0x410ac1
cmp byte [0x4e0380], 0
je case.default.0x410ac1
push dword [esi + 0x2fc]
push dword [esi + 0x2f8]
push str.Debugger:_ExitThread_TID:_0x_08X__ExitCode:_0x_X__n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x18
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410d8b
mov eax, dword [esi + 0x30c]
test eax, eax
je 0x410d54
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push ecx
push 8
lea ecx, [esp + 0x20]
movlpd qword [esp + 0x20], xmm0
push ecx
push eax
push dword [esi + 0x350]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x410d54
cmp dword [esp + 0x14], 0
je 0x410d54
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.00413b40
test eax, eax
je 0x410d54
cmp word [esi + 0x310], 0
je 0x410d26
cmp byte [0x4e0338], 0
je 0x410d8b
cmp byte [0x4e0380], 0
je 0x410d8b
push dword [esi + 0x300]
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__s___0x_p_n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x20
jmp 0x410d8b
cmp byte [0x4e0338], 0
je 0x410d8b
cmp byte [0x4e0380], 0
je 0x410d8b
push dword [esi + 0x300]
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__S___0x_p_n
jmp 0x410d13
cmp byte [0x4e0338], 0
je 0x410d8b
cmp byte [0x4e0380], 0
je 0x410d8b
push dword [esi + 0x300]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll____p_n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x1c
mov eax, dword [esi + 0x2fc]
cmp eax, 0xffffffff
je case.default.0x410ac1
push eax
call edi
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x410ac1
cmp byte [0x4e0338], 0
je case.default.0x410ac1
cmp byte [0x4e0380], 0
je case.default.0x410ac1
push dword [esi + 0x2fc]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_UnloadDll___0x_p_n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x1c
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x410ac1
movzx edi, word [esi + 0x302]
test di, di
je 0x410e7f
cmp dword [esi + 0x2fc], 0
je 0x410e7f
call fcn.00411b80
push eax
push edi
lea ecx, [esi + 0x374]
call fcn.00403380
test al, al
je 0x410e7f
push dword [esi + 0x2fc]
mov ecx, esi
call fcn.00413b40
test eax, eax
je 0x410e7f
cmp word [esi + 0x300], 0
je 0x410eaf
cmp byte [0x4e0338], 0
je 0x410e7f
cmp byte [0x4e0380], 0
je 0x410e7f
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__s_n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x368]
push dword [esi + 0x2f8]
push dword [esi + 0x2f4]
call dword [esp + 0x1c]
mov eax, dword [esi + 0x60]
cmp dword [eax], 0
jne 0x410aa0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp byte [0x4e0338], 0
je 0x410e7f
cmp byte [0x4e0380], 0
je 0x410e7f
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__S_n
jmp 0x410e6e
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x410ac1
cmp byte [0x4e0338], 0
je case.default.0x410ac1
cmp byte [0x4e0380], 0
je case.default.0x410ac1
push dword [esi + 0x300]
push dword [esi + 0x2fc]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_Rip:_Error:_0x_X__Type:_0x_X__n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x20
jmp case.default.0x410ac1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410f5e
cmp byte [0x4e0338], 0
je 0x410f5e
cmp byte [0x4e0380], 0
je 0x410f5e
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_EXCEPTION_DEBUG_EVENT__FirstChance_Exception___Crash._n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x18
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00414730
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410faa
cmp byte [0x4e0338], 0
je 0x410faa
cmp byte [0x4e0380], 0
je 0x410faa
push dword [esi + 0x2fc]
push dword [esi + 0x2f8]
push str.Debugger:_ExitProcess_TID:_0x_08X__ExitCode:_0x_x__n
push 0
push 8
push 0x4602e0
call fcn.004166a0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, 0x10002
shr eax, 0x19
not al
test al, 1
mov eax, 0x40010004
cmove eax, ecx
mov ecx, esi
mov dword [esi + 0x368], eax
mov eax, dword [esi]
call dword [eax + 0x7c]
push dword [esi + 0x368]
push dword [esi + 0x2f8]
push dword [esi + 0x2f4]
call dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret