Function at 0x4b042f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5989d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
mov dword [ebp - 0x94], ecx
push 0xf1110000
push 0
push 0x689218
push 0x227
push 0x689228
call fcn.004b8320
add esp, 0x14
push 0
mov ecx, dword [ebp - 0x94]
call fcn.004b1463
mov eax, dword [ebp - 0x94]
cmp dword [eax + 4], 0
jne 0x4b04da
push 4
call fcn.00588c18
add esp, 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x48], 0
je 0x4b04b4
mov ecx, dword [ebp - 0x48]
call fcn.00540f00
mov dword [ebp - 0x98], eax
jmp 0x4b04be
mov dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x44]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x94]
cmp dword [ecx + 0x10], 0
jne 0x4b0515
push 0x24
call fcn.00588c18
add esp, 4
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x4c]
mov dword [edx + 0x10], eax
push 0x24
push 0
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
push edx
call fcn.00578340
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x18], 0
jne 0x4b056b
push 0x60
call fcn.00588c18
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x18], ecx
push 0x60
push 0
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.00578340
add esp, 0xc
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x5c], edx
lea eax, [ebp - 0x18]
push eax
call fcn.0049ef72
add esp, 4
mov byte [ebp - 0x24], al
lea ecx, [ebp - 0x14]
call fcn.00540f00
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004b0070
add esp, 4
mov dword [ebp - 0x28], eax
push str.e.exe
push 5
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x14]
call fcn.004b98a0
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa0]
call fcn.0049ea50
mov byte [ebp - 0x54], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.004995e0
mov ecx, dword [ebp - 0x54]
and ecx, 0xff
test ecx, ecx
je 0x4b06fb
push 0xffffffffffffffff
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004b9800
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
add edx, 1
push edx
lea ecx, [ebp - 0x14]
call fcn.0049eca0
push eax
lea ecx, [ebp - 0x30]
call fcn.00498e70
mov byte [ebp - 4], 3
push str.libkrnln.fne
lea ecx, [ebp - 0x30]
call fcn.004b9740
lea ecx, [ebp - 0x30]
call fcn.0049eca0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4b06ef
mov eax, dword [ebp - 0x24]
and eax, 0xff
test eax, eax
je 0x4b0693
push str.GetNewInf
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b0693
mov dword [ebp - 0xa4], 1
jmp 0x4b069d
mov dword [ebp - 0xa4], 0
mov dl, byte [ebp - 0xa4]
mov byte [ebp - 0x24], dl
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
je 0x4b06dc
push 0
call fcn.0049ef72
add esp, 4
and eax, 0xff
test eax, eax
je 0x4b06dc
mov dword [ebp - 0xa8], 1
jmp 0x4b06e6
mov dword [ebp - 0xa8], 0
mov dl, byte [ebp - 0xa8]
mov byte [ebp - 0x24], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004995e0
call fcn.004ae840
sub eax, dword [0x6e3e80]
sbb edx, dword [0x6e3e84]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
cmp dword [ebp - 0xac], 0
ja 0x4b072d
cmp dword [ebp - 0xb0], 0x3a98
jbe 0x4b078b
mov eax, dword [0x6e3e7c]
and eax, 0x200000
test eax, eax
jne 0x4b078b
push 0xffffffffffffffff
push 0x25c
push 0x689288
push 0x25c
push 0x6892c4
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x25c
push 0x689300
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
push 0
push 0
push 0x7ee
call fcn.0049ef40
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x2c]
jne 0x4b07d3
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x18]
je 0x4b07d3
mov edx, dword [0x6e3e7c]
and edx, 0x200000
neg edx
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x24]
and eax, 0xff
cmp edx, eax
je 0x4b083e
push 0xf1110000
push 0
push str.error.
push 0x265
push 0x689384
call fcn.004b8320
add esp, 0x14
mov byte [ebp - 0x24], 0
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.00588c41
add esp, 4
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov dword [eax + 0x18], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004995e0
mov eax, dword [ebp - 0x60]
jmp 0x4b0d01
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
add eax, 0x5c
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [ecx + 2]
and edx, 0x20
test edx, edx
je 0x4b086e
mov eax, dword [ebp - 0x10]
mov cl, byte [eax + 2]
and cl, 0xdf
mov edx, dword [ebp - 0x10]
mov byte [edx + 2], cl
mov eax, dword [ebp - 0x24]
and eax, 0xff
test eax, eax
je 0x4b0889
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 2]
or dl, 0x20
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], dl
push 0xffffffffffffffff
push 0x278
push 0x6893c0
push 0
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
push ecx
call fcn.004b8730
add esp, 0x14
test eax, eax
je 0x4b094c
push 0xf1110000
push 0
push str.error._if__cmp_crypt_peData_m_base_pData__pClass__isDebug___isMemory____FILE______LINE_____1____0_
push 0x27a
push 0x689460
call fcn.004b8320
add esp, 0x14
mov edx, 1
test edx, edx
je 0x4b092e
push 0xffffffffffffffff
push 0x27b
push 0x68949c
push 0x27b
push 0x6894d8
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x27b
push 0x689514
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004995e0
mov eax, dword [ebp - 0x64]
jmp 0x4b0d01
push 0xf1110000
push 0
push 0x689550
push 0x27f
push 0x689570
call fcn.004b8320
add esp, 0x14
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x94]
call fcn.004b0f28
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4b0a04
push 0xf1110000
push 0
push str.error._if___IsWindow_m_base_pData__ieWnd________
push 0x283
push 0x6895ec
call fcn.004b8320
add esp, 0x14
push 0
push 0x689628
lea ecx, [ebp - 0x68]
call fcn.00499550
mov byte [ebp - 4], 4
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x94]
call fcn.004b2673
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.004995e0
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004995e0
mov eax, dword [ebp - 0x6c]
jmp 0x4b0d01
push 0xf1110000
push 0
push 0x68964c
push 0x288
push 0x68966c
call fcn.004b8320
add esp, 0x14
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x94]
call fcn.004b115a
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x1c], 0
jne 0x4b0b17
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x10]
mov dword [eax], 0
mov dword [ebp - 0x3c], 0x6896a8
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x70]
call fcn.00499550
mov byte [ebp - 4], 5
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x94]
call fcn.004b2673
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.004995e0
push 0xf1110000
push 0
push 0x3a8
push 0
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.004997a0
add esp, 0x10
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xb8]
call fcn.0049eca0
push eax
push 0x293
push 0x68981c
call fcn.004b8320
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004995e0
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004995e0
mov eax, dword [ebp - 0x78]
jmp 0x4b0d01
mov ecx, dword [ebp - 0x94]
call fcn.004b253d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4b0b99
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
call dword [edx + 0xc0]
push 0x689858
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.00579092
add esp, 8
test eax, eax
je 0x4b0b6f
push 0x689864
mov edx, dword [ebp - 0x40]
push edx
call fcn.00579092
add esp, 8
test eax, eax
jne 0x4b0b85
mov dword [0x64ffe4], 0
mov dword [0x64ffe0], 1
jmp 0x4b0b99
mov dword [0x64ffe0], 0
mov dword [0x64ffe4], 1
push 0xf1110000
push 0
push 0x689870
push 0x2a6
push 0x689888
call fcn.004b8320
add esp, 0x14
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x14], 0
jne 0x4b0c17
push 4
call fcn.00588c18
add esp, 4
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x80], 0
je 0x4b0bf1
push 0
push 0
mov ecx, dword [ebp - 0x80]
call fcn.004f1ca0
mov dword [ebp - 0xbc], eax
jmp 0x4b0bfb
mov dword [ebp - 0xbc], 0
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0x7c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0x14], edx
mov dword [ebp - 0x84], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
mov ecx, dword [edx + 0x14]
call fcn.004ba880
push 0x18
call fcn.00588c18
add esp, 4
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x8c], 0
je 0x4b0c72
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x8c]
call fcn.00527d2b
mov dword [ebp - 0xc0], eax
jmp 0x4b0c7c
mov dword [ebp - 0xc0], 0
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x54], eax
mov ecx, dword [ebp - 0x1c]
call fcn.00527df8
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x10]
add edx, 4
mov eax, dword [ebp - 0x94]
mov dword [eax + 8], edx
push 0xf1110000
push 0
push 0x6898c4
push 0x2b2
push 0x6898dc
call fcn.004b8320
add esp, 0x14
mov dword [ebp - 0x90], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004995e0
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4