Function at 0x4a4510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov ecx, dword [eax + 4]
mov esi, dword fs:[0]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0xffffffff
je 0x4a476d
cmp dword [esi + 4], 0
ja 0x4a4577
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 1
push eax
call edi
push eax
call ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax + 0xc]
cmp dword [0x5c7520], edi
jne 0x4a45dd
mov eax, dword [0x5ab0f0]
inc eax
mov dword [0x5ab0f0], eax
cmp eax, 0x32
jl 0x4a45b0
cmp byte [0x5c751c], 0
jne 0x4a45b0
push ecx
mov byte [0x5c751c], 1
call fcn.00425930
mov eax, dword [0x5ab0f0]
add esp, 4
cmp eax, 0x1e8480
jle 0x4a45e7
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 1
push eax
call edi
push eax
call ebx
jmp 0x4a45f3
mov dword [0x5ab0f0], 0
mov dword [0x5c7520], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [esi + 4]
cmp eax, dword [0x5aff78]
jbe 0x4a4624
cmp eax, dword [0x5aff7c]
jae 0x4a4624
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0x15
push eax
call edi
push eax
call ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
cmp eax, dword [0x5ab164]
ja 0x4a4658
cmp eax, dword [0x5aff74]
jb 0x4a4658
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0x1b
push eax
call edi
push eax
call ebx
cmp byte [0x5a7bef], 0
jne 0x4a46c0
cmp dword [0x5c0cd8], 0
je 0x4a46c0
push ecx
mov ecx, dword [esi + 4]
mov dl, 1
call fcn.0045f810
add esp, 4
test al, al
jne 0x4a4696
mov eax, dword [esi + 4]
cmp eax, dword [0x5ad894]
jbe 0x4a468f
cmp eax, dword [0x5ad898]
jb 0x4a4696
mov al, 1
mov byte [ebp - 1], al
jmp 0x4a4699
mov al, byte [ebp - 1]
cmp byte [0x5c61cd], 0
je 0x4a46aa
test al, al
jne 0x4a4797
cmp byte [0x5c61f4], 0
je 0x4a46c0
cmp byte [0x5c61f5], 0
jne 0x4a4797
mov eax, dword fs:[0]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x4a44f0
mov dword [ebp - 0x18], esi
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push esi
push dword [ebp - 8]
call ecx
cmp byte [0x5aa073], 0
mov ecx, dword [ebp - 0x20]
mov dword fs:[0], ecx
mov byte [0x5a7bef], 0
je 0x4a470d
mov esi, dword fs:[0]
cmp eax, 3
ja case.0x4a4712.3
jmp dword [eax*4 + 0x4a47d0]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtContinue]
jmp case.0x4a4712.2
mov eax, dword [ebp - 8]
test byte [eax + 4], 8
je 0x4a4750
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0x1b
push eax
call edi
push eax
call ebx
mov eax, dword [ebp - 8]
cmp byte [0x5aa073], 0
je 0x4a4762
mov byte [0x5aa073], 0
jmp 0x4a4764
mov esi, dword [esi]
cmp esi, 0xffffffff
jne 0x4a4550
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0x1b
push eax
call edi
push eax
call ebx
mov eax, 0xa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
call fcn.004a47e0
mov esi, eax
cmp esi, 0xffffffff
je 0x4a47c4
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0x1b
push eax
call edi
push eax
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret