Function at 0x4f746f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c0a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
mov dword [ebp - 0x94], ecx
push 0xf1110000
push 0
push 0x7a2768
push 0x227
push 0x7a2778
call fcn.004ff360
add esp, 0x14
push 0
mov ecx, dword [ebp - 0x94]
call fcn.004f84a3
mov eax, dword [ebp - 0x94]
cmp dword [eax + 4], 0
jne 0x4f751a
push 4
call fcn.005f9769
add esp, 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x48], 0
je 0x4f74f4
mov ecx, dword [ebp - 0x48]
call fcn.005013a0
mov dword [ebp - 0x98], eax
jmp 0x4f74fe
mov dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x44]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x94]
cmp dword [ecx + 0x10], 0
jne 0x4f7555
push 0x24
call fcn.005f9769
add esp, 4
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x4c]
mov dword [edx + 0x10], eax
push 0x24
push 0
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
push edx
call fcn.005e7b30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x18], 0
jne 0x4f75ab
push 0x60
call fcn.005f9769
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x18], ecx
push 0x60
push 0
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.005e7b30
add esp, 0xc
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x5c], edx
lea eax, [ebp - 0x18]
push eax
call fcn.004e5fd2
add esp, 4
mov byte [ebp - 0x24], al
lea ecx, [ebp - 0x14]
call fcn.005013a0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004f70b0
add esp, 4
mov dword [ebp - 0x28], eax
push str.e.exe
push 5
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x14]
call fcn.00500890
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa0]
call fcn.004e5aa0
mov byte [ebp - 0x54], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.004e0030
mov ecx, dword [ebp - 0x54]
and ecx, 0xff
test ecx, ecx
je 0x4f773b
push 0xffffffffffffffff
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.005007f0
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
add edx, 1
push edx
lea ecx, [ebp - 0x14]
call fcn.004e1270
push eax
lea ecx, [ebp - 0x30]
call fcn.004dffa0
mov byte [ebp - 4], 3
push str.libkrnln.fne
lea ecx, [ebp - 0x30]
call fcn.00500730
lea ecx, [ebp - 0x30]
call fcn.004e1270
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4f772f
mov eax, dword [ebp - 0x24]
and eax, 0xff
test eax, eax
je 0x4f76d3
push str.GetNewInf
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4f76d3
mov dword [ebp - 0xa4], 1
jmp 0x4f76dd
mov dword [ebp - 0xa4], 0
mov dl, byte [ebp - 0xa4]
mov byte [ebp - 0x24], dl
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
je 0x4f771c
push 0
call fcn.004e5fd2
add esp, 4
and eax, 0xff
test eax, eax
je 0x4f771c
mov dword [ebp - 0xa8], 1
jmp 0x4f7726
mov dword [ebp - 0xa8], 0
mov dl, byte [ebp - 0xa8]
mov byte [ebp - 0x24], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004e0030
call fcn.004f5880
sub eax, dword [0x81fe68]
sbb edx, dword [0x81fe6c]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
cmp dword [ebp - 0xac], 0
ja 0x4f776d
cmp dword [ebp - 0xb0], 0x3a98
jbe 0x4f77cb
mov eax, dword [0x81fe64]
and eax, 0x200000
test eax, eax
jne 0x4f77cb
push 0xffffffffffffffff
push 0x25c
push 0x7a27d8
push 0x25c
push 0x7a2814
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x25c
push 0x7a2850
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
push 0
push 0
push 0x7ee
call fcn.004e5fa0
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x2c]
jne 0x4f7813
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x18]
je 0x4f7813
mov edx, dword [0x81fe64]
and edx, 0x200000
neg edx
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x24]
and eax, 0xff
cmp edx, eax
je 0x4f787e
push 0xf1110000
push 0
push str.error.
push 0x265
push 0x7a28d4
call fcn.004ff360
add esp, 0x14
mov byte [ebp - 0x24], 0
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.005f9792
add esp, 4
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov dword [eax + 0x18], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov eax, dword [ebp - 0x60]
jmp 0x4f7d41
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
add eax, 0x5c
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [ecx + 2]
and edx, 0x20
test edx, edx
je 0x4f78ae
mov eax, dword [ebp - 0x10]
mov cl, byte [eax + 2]
and cl, 0xdf
mov edx, dword [ebp - 0x10]
mov byte [edx + 2], cl
mov eax, dword [ebp - 0x24]
and eax, 0xff
test eax, eax
je 0x4f78c9
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 2]
or dl, 0x20
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], dl
push 0xffffffffffffffff
push 0x278
push 0x7a2910
push 0
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
push ecx
call fcn.004ff770
add esp, 0x14
test eax, eax
je 0x4f798c
push 0xf1110000
push 0
push str.error._if__cmp_crypt_peData_m_base_pData__pClass__isDebug___isMemory____FILE______LINE_____1____0_
push 0x27a
push 0x7a29b0
call fcn.004ff360
add esp, 0x14
mov edx, 1
test edx, edx
je 0x4f796e
push 0xffffffffffffffff
push 0x27b
push 0x7a29ec
push 0x27b
push 0x7a2a28
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x27b
push 0x7a2a64
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov eax, dword [ebp - 0x64]
jmp 0x4f7d41
push 0xf1110000
push 0
push 0x7a2aa0
push 0x27f
push 0x7a2ac0
call fcn.004ff360
add esp, 0x14
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x94]
call fcn.004f7f68
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4f7a44
push 0xf1110000
push 0
push str.error._if___IsWindow_m_base_pData__ieWnd________
push 0x283
push 0x7a2b3c
call fcn.004ff360
add esp, 0x14
push 0
push 0x7a2b78
lea ecx, [ebp - 0x68]
call fcn.004e0720
mov byte [ebp - 4], 4
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x94]
call fcn.004f96b3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.004e0030
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov eax, dword [ebp - 0x6c]
jmp 0x4f7d41
push 0xf1110000
push 0
push 0x7a2b9c
push 0x288
push 0x7a2bbc
call fcn.004ff360
add esp, 0x14
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x94]
call fcn.004f819a
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x1c], 0
jne 0x4f7b57
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov dword [eax], 0
mov dword [ebp - 0x3c], 0x7a2bf8
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x70]
call fcn.004e0720
mov byte [ebp - 4], 5
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x94]
call fcn.004f96b3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.004e0030
push 0xf1110000
push 0
push 0x3a8
push 0
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.004e0980
add esp, 0x10
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xb8]
call fcn.004e1270
push eax
push 0x293
push 0x7a2d6c
call fcn.004ff360
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004e0030
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov eax, dword [ebp - 0x78]
jmp 0x4f7d41
mov ecx, dword [ebp - 0x94]
call fcn.004f957d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f7bd9
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
call dword [edx + 0xc0]
push 0x7a2da8
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.005e87e2
add esp, 8
test eax, eax
je 0x4f7baf
push 0x7a2db4
mov edx, dword [ebp - 0x40]
push edx
call fcn.005e87e2
add esp, 8
test eax, eax
jne 0x4f7bc5
mov dword [0x769534], 0
mov dword [0x769530], 1
jmp 0x4f7bd9
mov dword [0x769530], 0
mov dword [0x769534], 1
push 0xf1110000
push 0
push 0x7a2dc0
push 0x2a6
push 0x7a2dd8
call fcn.004ff360
add esp, 0x14
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x14], 0
jne 0x4f7c57
push 4
call fcn.005f9769
add esp, 4
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x80], 0
je 0x4f7c31
push 0
push 0
mov ecx, dword [ebp - 0x80]
call fcn.0052eec0
mov dword [ebp - 0xbc], eax
jmp 0x4f7c3b
mov dword [ebp - 0xbc], 0
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0x7c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0x14], edx
mov dword [ebp - 0x84], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov ecx, dword [edx + 0x14]
call fcn.005018f0
push 0x18
call fcn.005f9769
add esp, 4
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x8c], 0
je 0x4f7cb2
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x8c]
call fcn.0056eebb
mov dword [ebp - 0xc0], eax
jmp 0x4f7cbc
mov dword [ebp - 0xc0], 0
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x54], eax
mov ecx, dword [ebp - 0x1c]
call fcn.0056ef88
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
add edx, 4
mov eax, dword [ebp - 0x94]
mov dword [eax + 8], edx
push 0xf1110000
push 0
push 0x7a2e14
push 0x2b2
push 0x7a2e2c
call fcn.004ff360
add esp, 0x14
mov dword [ebp - 0x90], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4