Function at 0x4e4f2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x69c
mov eax, dword [0x5a1014]
xor eax, esp
mov dword [esp + 0x698], eax
mov eax, dword [0x5a1100]
push ebx
mov dword [esp + 0x2c], ecx
xor ecx, ecx
push esi
mov dword [esp + 0x38], eax
mov eax, dword [0x5a3530]
push edi
mov dword [0x5a1100], 0x41cdf0
mov byte [esp + 0x1f], cl
mov byte [esp + 0x17], cl
mov dword [esp + 0x38], ecx
mov dword [esp + 0x10], eax
cmp dword [0x5a3538], ecx
jbe 0x4e595a
mov edx, dword [eax + 4]
xor ecx, ecx
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
call fcn.0045c251
mov ecx, dword [esp + 0x10]
mov ebx, eax
xor eax, eax
mov edi, eax
mov dword [esp + 0x24], edi
mov ecx, dword [ecx + 4]
call fcn.0045c3b6
mov ecx, dword [ebx]
mov edx, 0x4032cc
mov dword [esp + 0x18], eax
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4e4fdc
test ax, ax
je 0x4e4fd8
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4e4fdc
add ecx, 4
add edx, 4
test ax, ax
jne 0x4e4fb6
xor eax, eax
jmp 0x4e4fe1
sbb eax, eax
or eax, 1
test eax, eax
je 0x4e5978
push 0x403988
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5047
mov byte [0x5a4ef0], al
cmp dword [ebx + 4], eax
jbe 0x4e58ae
lea eax, [ebx + 0xc]
mov dword [esp + 0x24], eax
cmp dword [eax - 4], 0
jne 0x4e52c2
push 0x41ce28
push dword [eax]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52c2
mov eax, dword [esp + 0x24]
inc edi
add eax, 8
mov byte [0x5a4ef0], 1
mov dword [esp + 0x24], eax
cmp edi, dword [ebx + 4]
jb 0x4e500d
jmp 0x4e58ac
push 0x403dc0
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e508b
xor ecx, ecx
cmp dword [ebx + 4], ecx
jbe 0x4e52f5
mov eax, dword [ebx + 0xc]
cmp word [eax], cx
je 0x4e52f5
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 4]
add ecx, 6
call fcn.0045c3b6
xor edi, edi
mov dword [0x5a2ffc], eax
inc edi
xor eax, eax
jmp 0x4e58b2
push 0x41ce30
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e50a6
mov byte [0x5a304c], 1
jmp 0x4e58ac
push 0x403d54
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e517c
xor esi, esi
cmp dword [ebx + 4], esi
je 0x4e52f5
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x30
jne 0x4e50e7
cmp word [eax + 2], 0x78
jne 0x4e50e7
push 1
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x38]
push ecx
push 0x41b000
jmp 0x4e50f8
push 1
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x38]
push ecx
push 0x40433c
push eax
call fcn.004782dc
add esp, 0x14
cmp eax, 1
jne 0x4e592a
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4e515f
cmp eax, 0x40
ja 0x4e515f
push 5
pop ecx
mov esi, 0x41ce54
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x2a
push eax
lea eax, [esp + 0x7e]
movsw word es:[edi], word [esi]
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, 0x14
push eax
lea eax, [esp + 0x70]
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
lea ecx, [esp + 0x60]
call fcn.005264f2
jmp 0x4e58d8
push 4
push 0x40
push eax
push 0x41ce40
push 0x10af
push esi
call fcn.004fd88b
add esp, 0x18
jmp 0x4e58d8
push 0x403db8
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e51b9
xor ecx, ecx
cmp dword [ebx + 4], ecx
jbe 0x4e52f5
mov eax, dword [ebx + 0xc]
cmp word [eax], cx
je 0x4e52f5
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 4]
add ecx, 6
call fcn.005264f2
mov edi, dword [ebx + 4]
jmp 0x4e5084
push 0x403224
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e529a
cmp dword [ebx + 4], eax
jbe 0x4e58d8
lea ecx, [ebx + 0xc]
mov dword [esp + 0x28], ecx
jmp 0x4e51e0
xor eax, eax
cmp dword [ecx - 4], eax
jne 0x4e52c2
mov edi, dword [ecx]
push 0x41ce6c
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5200
mov dword [0x5a1db8], eax
jmp 0x4e5278
push 0x41ce78
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e521a
mov dword [0x5a1db8], 1
jmp 0x4e5278
push 0x41ce88
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5234
mov dword [0x5a1db8], 2
jmp 0x4e5278
push 0x41ce94
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e524e
mov dword [0x5a1db8], 3
jmp 0x4e5278
push 0x404fa4
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5263
mov byte [esp + 0x1f], 1
jmp 0x4e5278
push 0x41cea0
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52c2
mov byte [0x5a5122], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
inc eax
add ecx, 8
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
cmp eax, dword [ebx + 4]
jb 0x4e51de
jmp 0x4e58d8
push 0x404180
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52d3
cmp dword [ebx + 4], eax
je 0x4e52f5
push 0x41ceb4
push dword [ebx + 0xc]
call esi
pop ecx
pop ecx
test eax, eax
je 0x4e509a
mov eax, dword [esp + 0x10]
push dword [eax + 4]
push 0x45d
jmp 0x4e5936
push 0x404228
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5306
xor ecx, ecx
cmp dword [ebx + 4], ecx
jbe 0x4e52f5
mov eax, dword [ebx + 0xc]
cmp word [eax], cx
jne 0x4e58d8
mov eax, dword [esp + 0x10]
push dword [eax + 4]
push 0x47a
jmp 0x4e5936
push 0x403188
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e531f
mov byte [0x5a2fac], al
jmp 0x4e58ae
push 0x4043d4
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5418
mov esi, 0x41ced0
lea edi, [esp + 0x40]
xor ecx, ecx
mov byte [esp + 0x16], cl
mov byte [esp + 0x1e], cl
movsd dword es:[edi], dword [esi]
mov byte [esp + 0x1d], cl
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x4a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, ecx
cmp dword [ebx + 4], ecx
jbe 0x4e5403
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [ebx + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [eax]
push 0x41cedc
push eax
mov dword [esp + 0x30], eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5396
cmp byte [esp + 0x1d], al
jne 0x4e53ee
mov byte [esp + 0x1d], 1
push 0x41cef4
jmp 0x4e53de
push 0x41cef8
push dword [esp + 0x2c]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e53b9
cmp byte [esp + 0x1e], al
jne 0x4e53ee
mov byte [esp + 0x1e], 1
push 0x41cf08
jmp 0x4e53de
push 0x41cf0c
push dword [esp + 0x2c]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52c2
cmp byte [esp + 0x16], al
jne 0x4e53ee
mov byte [esp + 0x16], 1
push 0x41cf1c
lea eax, [esp + 0x44]
push 0x10
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [esp + 0x20]
inc edi
add eax, 8
mov dword [esp + 0x20], eax
cmp edi, dword [ebx + 4]
jb 0x4e5370
lea ecx, [esp + 0x40]
call fcn.0045c3b6
mov ecx, eax
call fcn.00473f61
jmp 0x4e58ac
push 0x40448c
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5491
cmp dword [ebx + 4], eax
jbe 0x4e52f5
mov esi, dword [ebx + 0xc]
cmp word [esi], ax
je 0x4e52f5
xor edi, edi
mov ecx, esi
inc edi
call fcn.0053b722
mov ecx, dword [esp + 0x34]
mov word [ecx + 0x40], ax
movzx ecx, ax
test ax, ax
jne 0x4e5474
push 0x41cf20
push esi
xor eax, eax
push 0xfac
push eax
call fcn.004fd88b
mov eax, dword [esp + 0x44]
add esp, 0x10
movzx ecx, word [eax + 0x40]
mov eax, 0xa641
cmp cx, ax
jne 0x4e58ac
push 0x41cf6c
push 0x573
jmp 0x4e5936
push 0x402e30
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e54ac
mov byte [0x5a4f4c], 1
jmp 0x4e58ac
push 0x403150
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e54c7
mov byte [0x5a2fac], 1
jmp 0x4e58ac
push 0x404548
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e54e2
mov byte [0x5a5121], 1
jmp 0x4e58ac
push 0x4046c4
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5513
cmp dword [ebx + 4], eax
je 0x4e52f5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 0x18
call fcn.0045c3b6
mov dword [0x5a4f48], eax
jmp 0x4e58d8
push 0x403100
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5603
cmp dword [ebx + 4], eax
je 0x4e52f5
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
add eax, 8
mov dword [0x5a3054], eax
mov dword [0x5a362c], eax
cmp dword [0x5a30e8], edi
je 0x4e58d8
push 0x100
lea ecx, [esp + 0xa4]
xor ebx, ebx
push ecx
push 0x200
lea ecx, [esp + 0x2ac]
push ecx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
mov eax, dword [esp + 0x3c]
add esp, 0x24
test eax, eax
je 0x4e5589
push eax
call dword [sym.imp.tbbmalloc.dll_scalable_free]
pop ecx
lea ecx, [esp + 0x2a0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4e5593
sub ecx, edx
lea edx, [esp + 0xa0]
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x4e55ac
sub edx, esi
lea esi, [ecx + 9]
sar edx, 1
add esi, edx
lea edi, [esi + esi]
push edi
call dword [sym.imp.tbbmalloc.dll_scalable_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4e55df
call fcn.004575aa
test al, al
jne 0x4e55c3
call fcn.004fd4dc
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x2a4]
push eax
push 0x41cf7c
push esi
push ebx
call fcn.00470ccb
add esp, 0x14
jmp 0x4e58dc
push 0x404d9c
push dword [ebx]
xor eax, eax
mov byte [esp + 0x1e], al
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5629
mov eax, dword [esp + 0x10]
mov esi, 0x5a4f3c
mov ecx, dword [eax + 4]
add ecx, 0xe
jmp 0x4e566c
push 0x404cfc
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5649
mov eax, dword [esp + 0x10]
mov esi, 0x5a4f30
mov ecx, dword [eax + 4]
add ecx, 0x12
jmp 0x4e566c
push 0x404d5c
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e56cf
mov eax, dword [esp + 0x10]
mov esi, 0x5a4f24
mov byte [esp + 0x16], 1
mov ecx, dword [eax + 4]
add ecx, 0x10
xor eax, eax
cmp dword [ebx + 4], eax
je 0x4e52f5
call fcn.0044a9ea
mov edi, eax
push 0x3d
push edi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4e52c2
cmp eax, edi
je 0x4e52c2
xor ebx, ebx
lea ecx, [eax + 2]
cmp byte [esp + 0x16], bl
jne 0x4e56ad
cmp word [ecx], bx
je 0x4e52c2
cmp esi, 0x5a4f3c
jne 0x4e56b9
mov ecx, ebx
jmp 0x4e56be
xor edx, edx
mov word [eax], dx
push ebx
push ecx
push edi
mov edx, esi
xor ecx, ecx
call fcn.00470834
jmp 0x4e58d8
push 0x4030d4
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e572e
mov byte [0x5a4f23], al
cmp dword [ebx + 4], eax
jbe 0x4e58ae
lea eax, [ebx + 0xc]
mov dword [esp + 0x20], eax
xor ecx, ecx
cmp dword [eax - 4], ecx
jne 0x4e52c2
push 0x41ce28
push dword [eax]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52c2
mov eax, dword [esp + 0x20]
inc edi
add eax, 8
mov byte [0x5a4f23], 1
mov dword [esp + 0x20], eax
cmp edi, dword [ebx + 4]
jb 0x4e56f3
jmp 0x4e58ac
push 0x41cf98
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e574e
mov byte [0x5a2ee4], al
mov byte [0x5a5330], 1
jmp 0x4e58ae
push 0x404f98
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e57ba
xor ecx, ecx
mov byte [0x5a3634], 1
mov dword [0x5a3630], 0x41cfa4
cmp dword [ebx + 4], ecx
jbe 0x4e58d8
lea eax, [ebx + 0xc]
mov dword [esp + 0x20], eax
cmp dword [eax - 4], ecx
jne 0x4e52c2
push 0x41ce28
push dword [eax]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52c2
mov eax, dword [esp + 0x20]
xor ecx, ecx
inc edi
mov byte [0x5a3634], cl
add eax, 8
mov dword [esp + 0x20], eax
cmp edi, dword [ebx + 4]
jb 0x4e5780
jmp 0x4e58d8
push 0x404f8c
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e57df
mov byte [0x5a3634], 1
mov dword [0x5a3630], 0x4133c8
jmp 0x4e58ac
push 0x405124
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5814
cmp dword [ebx + 4], eax
jbe 0x4e5803
mov eax, dword [ebx + 0xc]
xor ecx, ecx
cmp word [eax], cx
jne 0x4e52c2
xor eax, eax
mov byte [0x5a2ee4], 1
mov byte [0x5a5330], al
jmp 0x4e58ae
push 0x4037fc
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5841
cmp dword [ebx + 4], eax
jbe 0x4e5838
mov eax, dword [ebx + 0xc]
xor ecx, ecx
cmp word [eax], cx
jne 0x4e52c2
xor eax, eax
mov byte [0x5a4f22], 1
jmp 0x4e58ae
push 0x41cfac
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e5896
mov byte [esp + 0x17], 1
cmp dword [ebx + 4], eax
jbe 0x4e58ae
lea eax, [ebx + 0xc]
mov dword [esp + 0x20], eax
xor ecx, ecx
cmp dword [eax - 4], ecx
jne 0x4e52c2
push 0x41ce28
push dword [eax]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e52c2
mov byte [esp + 0x17], al
inc edi
mov eax, dword [esp + 0x20]
add eax, 8
mov dword [esp + 0x20], eax
cmp edi, dword [ebx + 4]
jb 0x4e5861
jmp 0x4e58ac
push 0x41cfb4
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4e58c1
mov byte [0x5a5120], 1
xor eax, eax
mov esi, dword [esp + 0x10]
cmp dword [ebx + 4], edi
jbe 0x4e58d8
push dword [esi + 4]
push 0xfd8
jmp 0x4e58cf
mov eax, dword [esp + 0x10]
push dword [eax + 4]
xor eax, eax
push 0xfcc
push eax
call fcn.004fd88b
add esp, 0xc
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x38]
inc esi
cmp dword [0x5a30e8], 0
mov dword [esp + 0x38], esi
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
je 0x4e590d
push ebx
push 0x41ce1c
push dword [0x5a352c]
call fcn.004fd8fd
add esp, 0xc
test ebx, ebx
je 0x4e5919
push ebx
call dword [sym.imp.tbbmalloc.dll_scalable_free]
pop ecx
cmp esi, dword [0x5a3538]
jae 0x4e593e
mov eax, dword [esp + 0x10]
jmp 0x4e4f85
mov eax, dword [esp + 0x10]
push dword [eax + 4]
push 0x47b
xor eax, eax
push eax
call fcn.0047dc0b
cmp byte [esp + 0x1f], 0
je 0x4e594c
xor eax, eax
mov byte [0], al
cmp byte [esp + 0x17], 0
je 0x4e595a
mov byte [0x5a4e55], 1
mov ecx, dword [esp + 0x6a4]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x5a1100], eax
call fcn.0047a40f
mov esp, ebp
pop ebp
ret
mov edx, 0x2600
lea ecx, [edx - 0x1c]
call fcn.0053551f
push 0x44c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3