Function at 0x45b8b0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x8591e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push ebp
push esi
mov esi, ecx
push 0x7c
lea ecx, [esp + 0x14]
call fcn.004b5e30
lea ecx, [esp + 0x2c]
mov dword [esp + 0xf8], 0
call fcn.004df100
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, 0x9cded8
mov byte [esp + 0x100], 1
call fcn.004dd4b0
mov eax, dword [0x9dce80]
or ebp, 0xffffffff
test eax, eax
je 0x45b933
mov edx, dword [esp + 0x5c]
push edx
push str.CDeadLockHelper::SelfKill_00___s_
push str.DeadLockHelper
push ebp
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
mov eax, dword [esp + 0x5c]
push 0x935e4c
push eax
call fcn.005fc4b7
add esp, 8
test eax, eax
jne 0x45b9f6
lea ecx, [esp + 0x88]
mov byte [esp + 0xf8], 5
call fcn.00831eeb
lea ecx, [esp + 0x68]
mov byte [esp + 0xf8], 4
call fcn.00636c90
lea ecx, [esp + 0x5c]
mov byte [esp + 0xf8], 3
call fcn.00617ec0
lea ecx, [esp + 0x4c]
mov byte [esp + 0xf8], 2
call fcn.0061ebe0
lea ecx, [esp + 0x34]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x48]
mov byte [esp + 0xf8], 7
call fcn.00831eeb
lea ecx, [esp + 0x44]
mov byte [esp + 0xf8], 6
call fcn.00831eeb
lea ecx, [esp + 0x2c]
mov byte [esp + 0xf8], 0
call fcn.004b5e20
lea ecx, [esp + 0x10]
mov dword [esp + 0xf8], ebp
call fcn.004b5e20
pop esi
pop ebp
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
add esp, 0xf4
ret
push ebx
push edi
lea ecx, [esp + 0x90]
mov byte [esp + 0x100], 0xb
call fcn.00831eeb
lea ecx, [esp + 0x70]
mov byte [esp + 0x100], 0xa
call fcn.00636c90
lea ecx, [esp + 0x64]
mov byte [esp + 0x100], 9
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x100], 8
call fcn.0061ebe0
lea edx, [esp + 0x3c]
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x100], 0xd
call fcn.00831eeb
lea ecx, [esp + 0x4c]
mov byte [esp + 0x100], 0xc
call fcn.00831eeb
lea ecx, [esp + 0x34]
mov byte [esp + 0x100], 0
call fcn.004b5e20
lea ecx, [esp + 0x18]
mov dword [esp + 0x100], ebp
call fcn.004b5e20
push 0x7b
lea ecx, [esp + 0x1c]
call fcn.004b5e30
lea ecx, [esp + 0x34]
mov dword [esp + 0x100], 0xe
call fcn.004df100
mov eax, dword [esi + 4]
lea ecx, [esp + 0x14]
push 0x92f11c
lea edx, [esp + 0xac]
mov bl, 0xf
push ecx
push edx
mov byte [esp + 0x10c], bl
mov dword [esp + 0x80], 1
mov dword [esp + 0x84], eax
call fcn.005f121f
mov ecx, eax
call fcn.005f19ce
mov eax, dword [eax]
lea ecx, [esp + 0x64]
push eax
mov byte [esp + 0x104], 0x10
call fcn.006181a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x100], bl
call fcn.00831eeb
lea eax, [esp + 0x34]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, 0x9cded8
call fcn.004dd8c0
lea ecx, [esp + 0x90]
mov byte [esp + 0x100], 0x14
call fcn.00831eeb
lea ecx, [esp + 0x70]
mov byte [esp + 0x100], 0x13
call fcn.00636c90
mov byte [esp + 0x100], 0x12
lea ecx, [esp + 0x64]
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x100], 0x11
call fcn.0061ebe0
lea edx, [esp + 0x3c]
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x100], 0x16
call fcn.00831eeb
lea ecx, [esp + 0x4c]
mov byte [esp + 0x100], 0x15
call fcn.00831eeb
lea ecx, [esp + 0x34]
mov byte [esp + 0x100], 0xe
call fcn.004b5e20
lea ecx, [esp + 0x18]
mov dword [esp + 0x100], ebp
call fcn.004b5e20
mov eax, dword [0x98b454]
mov dword [esp + 0x10], eax
mov ebx, 0x17
mov dword [esp + 0x100], ebx
call fcn.00662510
test eax, eax
je 0x45bbe0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esp + 0x14]
push str.taskkill.exe__f__pid__lu
push ecx
jmp 0x45bbf1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [esp + 0x14]
push str.ntsd.exe__c_q__p__lu
push edx
call fcn.00826097
mov eax, dword [0x9dce80]
add esp, 0xc
test eax, eax
je 0x45bc43
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call fcn.00617650
mov ecx, dword [eax]
mov byte [esp + 0x100], 0x18
push ecx
push str.CDeadLockHelper::SelfKill_0___s_
push str.DeadLockHelper
push ebp
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x100], bl
call fcn.00617ec0
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xb8]
mov dword [esp + 0xb4], 0x44
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
xor edx, edx
lea ecx, [esp + 0xb4]
xor edi, edi
push eax
mov dword [esp + 0x2c], edx
push ecx
push edi
mov dword [esp + 0x38], edx
push edi
push edi
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x24]
push edi
push edi
push edi
push edx
push edi
mov dword [esp + 0x108], 1
mov word [esp + 0x10c], di
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [0x9dce80]
cmp eax, edi
je 0x45bcf1
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
call fcn.00617650
mov ecx, dword [eax]
mov byte [esp + 0x100], 0x19
push ecx
push esi
push str.CDeadLockHelper::SelfKill_1__lu___s_
push str.DeadLockHelper
push ebp
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
lea ecx, [esp + 0x20]
mov byte [esp + 0x100], bl
call fcn.00617ec0
cmp esi, edi
pop edi
pop ebx
je 0x45bd0b
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
push 0x7b
call dword [sym.imp.KERNEL32.dll_ExitProcess]