Function at 0x49a750
Capabilities:
Terminate process

Disassembly:
sub esp, 0x68
mov eax, dword [0x6dad44]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x14], eax
mov edi, ecx
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x84]
push eax
mov dword [esp + 0x1c], ecx
call fcn.004a33a6
mov ecx, dword [edi + 8]
mov ebx, 0x9bc
push ebx
push 0x75eb20
add ecx, 0xa
mov dword [esp + 0x28], eax
push 1
push ecx
call fcn.005f5c60
mov esi, eax
add esp, 0x14
mov dword [esp + 0x10], esi
test esi, esi
je 0x49aa35
mov edx, dword [edi + 8]
mov ecx, esi
push edx
push dword [edi]
add edx, 0xa
call section..text
mov ecx, dword [edi + 8]
push 1
push 0x75eb98
push 0xa
add ecx, esi
pop edx
call section..text
mov ecx, dword [edi + 8]
lea eax, [edi + 0x21]
push 8
push eax
inc ecx
push 9
add ecx, esi
pop edx
call section..text
mov eax, dword [edi + 8]
xor ebx, ebx
add esp, 0x18
mov byte [esi + eax + 9], bl
mov eax, dword [edi + 0x78]
mov esi, dword [eax + 0x10]
test esi, esi
je 0x49a804
mov esi, dword [esi + 8]
jmp 0x49a806
mov esi, ebx
mov ecx, dword [esp + 0x14]
push 0x76c040
push 0xc
pop edx
call fcn.00485bd0
push dword [esp + 0x10]
push 0x76c040
push str.Generating_ICE_Request___s__Credentials__s_
push 4
push 2
push esi
call fcn.004920d4
mov eax, dword [edi + 0x78]
add esp, 0x18
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a841
mov esi, dword [eax + 8]
jmp 0x49a843
mov esi, ebx
mov ecx, dword [esp + 0x18]
call fcn.00491cd5
push eax
push str....Address___s
push 4
push 2
push esi
call fcn.004920d4
push dword [esp + 0x28]
xor edx, edx
mov ecx, ebp
inc edx
call fcn.004a324a
mov ecx, dword [edi + 8]
mov esi, eax
add ecx, 9
mov edx, esi
push ecx
push dword [esp + 0x2c]
mov ecx, ebp
push 6
call fcn.004a327c
add esi, eax
add esp, 0x24
mov eax, dword [edi + 0x78]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a896
mov eax, dword [eax + 8]
jmp 0x49a898
mov eax, ebx
push esi
push str....USERNAME____PTR___d
push 8
push 2
push eax
call fcn.004920d4
add esp, 0x14
cmp dword [esp + 0x80], ebx
je 0x49a8c6
push ebx
push ebx
push 0x25
mov edx, esi
mov ecx, ebp
call fcn.004a327c
add esp, 0xc
add esi, eax
lea eax, [edi + 0x4b]
mov edx, esi
mov ecx, ebp
push 8
push eax
cmp dword [edi + 0x6c], ebx
jne 0x49a8fc
push 0x802a
call fcn.004a327c
add esi, eax
add esp, 0xc
mov eax, dword [edi + 0x78]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a8f3
mov eax, dword [eax + 8]
jmp 0x49a8f5
mov eax, ebx
push str....CONTROLLING
jmp 0x49a921
push 0x8029
call fcn.004a327c
add esi, eax
add esp, 0xc
mov eax, dword [edi + 0x78]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a91a
mov eax, dword [eax + 8]
jmp 0x49a91c
mov eax, ebx
push str....CONTROLLED
push 4
push 2
push eax
call fcn.004920d4
mov eax, dword [edi + 0x78]
add esp, 0x10
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a93d
mov eax, dword [eax + 8]
jmp 0x49a93f
mov eax, ebx
push esi
push str....____PTR___d
push 8
push 2
push eax
call fcn.004920d4
push dword [esp + 0x30]
lea eax, [esp + 0x38]
mov edx, esi
push eax
push 0x20
mov ecx, ebp
call fcn.004a327c
add esi, eax
add esp, 0x20
mov eax, dword [edi + 0x78]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a977
mov eax, dword [eax + 8]
jmp 0x49a979
mov eax, ebx
push esi
push str...._XORADDR____PTR___d
push 8
push 2
push eax
call fcn.004920d4
push dword [edi + 0xc]
mov edx, esi
mov ecx, ebp
push dword [edi + 4]
call fcn.004986c9
add esi, eax
mov ecx, ebp
mov edx, esi
call fcn.00498742
push 1
push dword [esp + 0x30]
add esi, eax
call fcn.005f5b20
push dword [edi + 0xc]
lea ecx, [esp + 0x5c]
push dword [edi + 4]
push 0x40
pop edx
call section..text
mov eax, dword [edi + 0xc]
add esp, 0x2c
cmp eax, 0x40
jae 0x49aa68
mov byte [esp + eax + 0x34], bl
mov eax, dword [edi + 0x78]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49a9e4
mov eax, dword [eax + 8]
jmp 0x49a9e6
mov eax, ebx
lea ecx, [esp + 0x34]
push ecx
push str....Using_Integrity_Key:__s
push 8
push 2
push eax
call fcn.004920d4
mov eax, dword [edi + 0x78]
add esp, 0x14
mov eax, dword [eax + 0x10]
test eax, eax
je 0x49aa0a
mov ebx, dword [eax + 8]
push esi
push str....PTR___d
push 8
push 2
push ebx
call fcn.004920d4
mov ecx, dword [esp + 0x88]
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c0e20
add esp, 0x68
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75eb3c
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x75eb58
push 0x75eb74
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
call fcn.005c0f80
int3