Function at 0x40cf60
Capabilities:
Check process job object
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c808
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x440008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100c
xor ebx, ebx
call fcn.0041a9c3
mov esi, eax
add esp, 4
mov dword [ebp - 0x50], esi
test esi, esi
je 0x40d1d9
mov ecx, 0x100c
nop dword [eax]
mov byte [eax], bl
lea eax, [eax + 1]
sub ecx, 1
jne 0x40cfb0
push ecx
push 0x100c
push esi
push 3
push ecx
mov dword [esi + 4], 0x400
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x40d1d0
mov eax, dword [esi]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ebx
test eax, eax
je 0x40d1c9
lea ecx, [esi + 8]
mov dword [ebp - 0x34], ecx
mov esi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jne 0x40d008
inc edi
mov dword [ebp - 0x2c], edi
jmp 0x40d1af
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40d1af
push 0x2000
call fcn.0041a9c3
mov ebx, eax
add esp, 4
mov dword [ebp - 0x48], ebx
test ebx, ebx
je 0x40d1a5
mov ecx, 0x2000
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x40d042
push 0x1000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x40d19c
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040d240
push str.WindowsSystem32conhost.exe
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0
call fcn.0040d240
mov ebx, eax
cmp dword [eax + 0x14], 8
jb 0x40d089
mov ebx, dword [eax]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edi, dword [eax + 0x10]
mov edx, dword [ebp - 0x28]
cmovae ecx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], edi
cmp edi, eax
ja 0x40d0e1
test edi, edi
jne 0x40d0b1
xor esi, esi
jmp 0x40d0e4
sub eax, edi
mov esi, ecx
inc eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x3c], eax
nop dword [eax]
sub eax, esi
sar eax, 1
je 0x40d0e1
movzx ecx, word [ebx]
nop dword [eax]
cmp word [esi], cx
je 0x40d1f7
add esi, 2
sub eax, 1
jne 0x40d0d0
or esi, 0xffffffff
mov eax, dword [ebp - 0x54]
cmp eax, 8
jb 0x40d11e
mov ecx, dword [ebp - 0x68]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d114
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d239
push edx
push ecx
call fcn.0041397e
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp esi, 0xffffffff
mov word [ebp - 0x68], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
lea edi, [ecx + 1]
mov dword [ebp - 0x58], 0
cmove edi, ecx
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x2c], edi
cmp eax, 8
jb 0x40d182
mov edx, dword [ebp - 0x44]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40d178
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d239
push ecx
push edx
call fcn.0041397e
add esp, 8
mov ebx, dword [ebp - 0x48]
xor eax, eax
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push ebx
call fcn.0041a9ce
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x50]
inc ebx
mov ecx, dword [ebp - 0x34]
add ecx, 4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ecx
mov eax, dword [esi]
cmp ebx, eax
jb 0x40cff3
xor ebx, ebx
cmp edi, eax
setne bl
push esi
call fcn.0041a9ce
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40d0e1
mov edx, edi
mov ecx, ebx
test edi, edi
je 0x40d221
mov edi, esi
sub edi, ebx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x40d22b
add ecx, 2
sub edx, 1
jne 0x40d210
sub esi, dword [ebp - 0x40]
sar esi, 1
jmp 0x40d0e4
mov edi, dword [ebp - 0x38]
add esi, 2
mov eax, dword [ebp - 0x3c]
jmp 0x40d0c0
call fcn.0041741c
int3