Function at 0x49c514
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49d067
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004861b8
mov eax, dword [eax]
cmp eax, 0x10129
jg 0x49c611
je 0x49cbeb
cmp eax, 0x1010e
jg 0x49c5d4
je 0x49c8d2
cmp eax, 0x1000f
jg 0x49c5a9
je 0x49cb04
add eax, 0xfffeffff
cmp eax, 7
ja case.default.0x49c5e2
jmp dword [eax*4 + 0x49c589]
sub eax, 0x10012
je 0x49c758
sub eax, 0xf
je 0x49c7ff
sub eax, 6
je 0x49c6f8
sub eax, 4
je 0x49cfe0
jmp case.default.0x49c5e2
add eax, 0xfffefef0
cmp eax, 9
ja case.default.0x49c5e2
jmp dword [eax*4 + 0x49c5e9]
cmp eax, 0x10605
jg 0x49c691
je 0x49cab7
cmp eax, 0x10507
jg 0x49c66c
je 0x49cf79
cmp eax, 0x10154
jg 0x49c651
je 0x49d00f
sub eax, 0x1014f
je 0x49ce1a
sub eax, 4
je 0x49cffd
jmp case.default.0x49c5e2
sub eax, 0x1040a
je 0x49cbfc
sub eax, 0xfc
je 0x49cd35
jmp case.default.0x49c5e2
sub eax, 0x10601
je 0x49ca29
dec eax
je 0x49ca42
dec eax
je 0x49ca84
dec eax
je case.0x49c5e2.65815
jmp case.default.0x49c5e2
cmp eax, 0x10613
jg 0x49c6c7
je 0x49cf42
sub eax, 0x10607
je 0x49cdbc
dec eax
je case.0x49c5e2.65815
sub eax, 2
je 0x49cdcd
sub eax, 8
je case.0x49c5e2.65815
jmp case.default.0x49c5e2
sub eax, 0x10614
je case.0x49c5e2.65815
sub eax, 0x3ed
je 0x49ceb1
sub eax, 0x11f
je 0x49cfb6
sub eax, 0x2cbba1
je 0x49ce77
jmp case.default.0x49c5e2
mov eax, esi
call fcn.00495248
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186a0
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186a3
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186a4
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186a2
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov esi, eax
mov eax, dword [ebx + 0x350]
lea edx, [eax + 0x30]
mov eax, esi
mov ecx, 0x20
call fcn.00408dd0
test al, al
je case.0x49c5e2.65815
cmp byte [ebx + 0x318], 1
setne byte [ebp - 9]
cmp dword [esi + 0x20], 2
setne dl
mov eax, ebx
call fcn.0049db0c
cmp dword [esi + 0x20], 2
jne case.0x49c5e2.65815
cmp byte [ebp - 9], 0
je 0x49c7bf
push 0
push 0
push 0x10
mov eax, ebx
call fcn.0045917c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x49c5e2.65815
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49c7e7
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_TerminateProcess
jmp case.0x49c5e2.65815
push 0
push 0
push 0x10
mov eax, ebx
call fcn.0045917c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov ebx, eax
mov eax, dword [ebx + 0x88]
push eax
mov eax, dword [ebx + 0x8c]
push eax
lea eax, [ebp - 0x20]
mov edx, ebx
mov ecx, 0x80
call fcn.00404a38
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x84]
mov eax, dword [0x4a1878]
mov eax, dword [eax]
call fcn.0048641c
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov edi, eax
mov eax, dword [edi]
push eax
lea eax, [ebx + 0x384]
mov ecx, 1
mov edx, dword [0x497b3c]
call fcn.00405db4
add esp, 4
mov eax, dword [edi]
dec eax
test eax, eax
jl 0x49c8b0
inc eax
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, esi
shl eax, 5
add eax, esi
mov eax, dword [edi + eax*4 + 4]
mov edx, dword [ebx + 0x384]
mov dword [edx + esi*8], eax
mov eax, esi
shl eax, 5
add eax, esi
lea eax, [edi + eax*4 + 8]
lea edx, [ebp - 0x24]
call fcn.0047d3ac
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x384]
lea eax, [eax + esi*8 + 4]
call fcn.00404f28
inc esi
dec dword [ebp - 0x1c]
jne 0x49c871
mov byte [ebx + 0x318], 4
push 0
push 0
push 0x8101
mov eax, ebx
call fcn.0045917c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov edx, dword [0x4a1ae0]
mov esi, eax
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x40
xor ecx, ecx
mov edx, 0x186a5
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov edi, eax
mov byte [edi + 0x7ff], 0
mov eax, 0xc00
call fcn.00402784
mov esi, eax
push 0xc00
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
lea eax, [ebx + 0x344]
mov edx, esi
call fcn.00405014
mov eax, dword [ebx + 0x344]
xor edx, edx
call fcn.004051bc
je 0x49c9c5
mov eax, dword [ebx + 0x344]
mov edx, 0x49d07c
call fcn.004051bc
je 0x49c9c5
mov ecx, dword [0x4a1a28]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x497578]
call fcn.004977d0
mov edi, eax
mov edx, dword [edi + 0x48]
mov eax, dword [ebx + 0x40]
cmp edx, eax
jge 0x49c98a
mov edx, eax
sub edx, dword [edi + 0x48]
mov eax, edi
call fcn.00452094
jmp 0x49c996
mov edx, eax
add edx, dword [ebx + 0x48]
mov eax, edi
call fcn.00452094
mov edx, dword [ebx + 0x44]
mov eax, edi
call fcn.004520b8
lea eax, [ebp - 0x28]
mov ecx, dword [ebx + 0x344]
mov edx, dword [ebx + 0x340]
call fcn.00405110
mov edx, dword [ebp - 0x28]
mov eax, edi
call fcn.00497780
mov eax, edi
call fcn.0046f438
mov eax, esi
call fcn.004027a4
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b8
lea edx, [eax + 8]
mov eax, dword [0x4a1ba0]
mov eax, dword [eax]
call fcn.0048ed68
cmp dword [ebx + 0x338], 0
je 0x49ca03
mov eax, dword [ebx + 0x338]
call fcn.00403a1c
xor eax, eax
mov dword [ebx + 0x338], eax
push 0x40
xor ecx, ecx
mov edx, 0x186a4
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
mov eax, dword [0x4a1ba0]
mov eax, dword [eax]
call fcn.0048ecac
jmp case.0x49c5e2.65815
mov edx, dword [0x4a1ac4]
mov edx, dword [edx]
mov eax, dword [0x4a17f0]
mov eax, dword [eax]
call fcn.0047d1e0
jmp case.0x49c5e2.65815
mov eax, dword [0x4a17f0]
mov eax, dword [eax]
mov edx, dword [0x4824e4]
call fcn.0047d0e8
mov edi, eax
mov eax, esi
call fcn.004861b0
mov ebx, eax
mov edx, ebx
mov eax, edi
call fcn.00482ff0
mov eax, dword [0x4a1ac4]
mov eax, dword [eax]
mov edx, edi
call fcn.00482808
mov edx, ebx
mov eax, edi
call fcn.0048ae68
jmp case.0x49c5e2.65815
call fcn.0048a8dc
cmp byte [ebx + 0x318], 2
jne 0x49ca9d
mov eax, dword [ebx + 0x338]
call fcn.0048d1fc
mov edx, dword [0x4a1af4]
mov edx, dword [edx + 4]
inc edx
mov eax, dword [ebx + 0x350]
call fcn.0048560c
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov ebx, eax
mov edx, dword [ebx]
mov eax, dword [0x4a1ac4]
mov eax, dword [eax]
call fcn.00482824
mov edi, eax
test edi, edi
je case.0x49c5e2.65815
mov eax, dword [0x4a17f0]
mov eax, dword [eax]
mov edx, dword [0x4822b8]
call fcn.0047d0e8
mov esi, eax
mov edx, ebx
mov eax, esi
call fcn.00482888
mov eax, dword [edi + 0x74]
mov edx, esi
call fcn.00482958
jmp case.0x49c5e2.65815
mov byte [ebx + 0x318], 2
push 0
push 0
push 0x8101
mov eax, ebx
call fcn.0045917c
push eax
call sub.user32.dll_PostMessageA
call fcn.00495098
cmp dword [ebx + 0x380], 0
je case.0x49c5e2.65815
mov edx, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xfc]
jmp case.0x49c5e2.65815
cmp dword [ebx + 0x33c], 0
jne 0x49cb80
mov ecx, dword [0x4a1a28]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x48e408]
call fcn.0048dc78
mov dword [ebx + 0x33c], eax
mov eax, dword [ebx + 0x33c]
mov dword [eax + 0x32c], ebx
mov dword [eax + 0x328], 0x49d944
mov eax, esi
call fcn.004861b0
mov edx, dword [eax]
mov esi, dword [ebx + 0x33c]
mov dword [esi + 0x31c], edx
mov eax, dword [eax + 4]
mov dword [esi + 0x320], eax
mov eax, dword [esi + 0x318]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x33c]
mov eax, dword [eax + 0x314]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x33c]
call fcn.0046f438
jmp case.0x49c5e2.65815
cmp dword [ebx + 0x33c], 0
je case.0x49c5e2.65815
mov eax, dword [ebx + 0x33c]
call fcn.0046f290
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
call fcn.004881ac
jmp case.0x49c5e2.65815
cmp byte [ebx + 0x318], 2
jne case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov dword [ebp - 4], eax
mov eax, dword [0x4a1ac4]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
dec eax
test eax, eax
jl case.0x49c5e2.65815
inc eax
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [0x4a1ac4]
mov eax, dword [eax]
mov edx, esi
call fcn.00482874
mov edi, eax
mov eax, dword [edi + 0x2c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jne 0x49cd26
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
sub eax, 1
jb 0x49cc63
je 0x49ccb0
dec eax
je 0x49cce5
jmp 0x49cd05
mov byte [edi + 0x54], 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov dword [edi + 0x60], edx
mov edx, dword [eax + 0x14]
mov dword [edi + 0x64], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov dword [edi + 0x68], edx
mov edx, dword [eax + 0x1c]
mov dword [edi + 0x6c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [edi + 0x50], eax
xor eax, eax
mov dword [edi + 0x88], eax
mov dword [edi + 0x7c], 1
cmp dword [edi + 0x10b0], 0x10
je 0x49cd05
xor eax, eax
mov dword [edi + 0x10b0], eax
jmp 0x49cd05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, 2
call fcn.004884d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [edi + 0x88], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0x10
jne 0x49cd05
mov byte [edi + 0x54], 0
mov dword [edi + 0x10b0], 0x10
jmp 0x49cd05
mov byte [edi + 0x54], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [edi + 0x10b0], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, 3
call fcn.004884d0
push 0
mov eax, dword [edi + 0x2c]
push eax
push 0x9000
mov eax, dword [ebx + 0x338]
call fcn.0045917c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x49c5e2.65815
inc esi
dec dword [ebp - 0x1c]
jne 0x49cc2c
jmp case.0x49c5e2.65815
cmp byte [ebx + 0x318], 2
jne case.0x49c5e2.65815
cmp dword [ebx + 0x338], 0
je case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x338]
call fcn.0048d218
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov edx, dword [eax + 4]
mov ecx, dword [ebx + 0x350]
mov dword [ecx + 0x50], edx
mov edx, dword [eax + 0x10]
mov ecx, dword [0x4a1ae0]
mov dword [ecx], edx
mov edx, dword [eax + 0x14]
mov ecx, dword [0x4a1ae0]
mov dword [ecx + 4], edx
mov eax, dword [eax + 0xc]
mov edx, dword [0x4a1ae0]
mov dword [edx + 8], eax
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186b1
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
mov eax, dword [0x4a1878]
mov eax, dword [eax]
call fcn.004864f4
jmp case.0x49c5e2.65815
call fcn.0048a304
test al, al
je case.0x49c5e2.65815
push 3
mov eax, dword [0x4a1920]
mov eax, dword [eax]
call eax
mov edi, eax
mov dword [ebx + 0x360], edi
test edi, edi
je case.0x49c5e2.65815
mov eax, esi
call fcn.004861b8
mov eax, dword [eax + 4]
push eax
mov eax, esi
call fcn.004861b8
add eax, 8
push eax
push edi
mov eax, dword [0x4a1a48]
mov eax, dword [eax]
call eax
jmp case.0x49c5e2.65815
call fcn.0048a304
test al, al
je case.0x49c5e2.65815
push 0xa
mov eax, dword [0x4a1920]
mov eax, dword [eax]
call eax
mov edi, eax
mov dword [ebx + 0x364], edi
test edi, edi
je case.0x49c5e2.65815
mov eax, esi
call fcn.004861b8
mov eax, dword [eax + 4]
push eax
mov eax, esi
call fcn.004861b8
add eax, 8
push eax
push edi
mov eax, dword [0x4a1a48]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x364]
push eax
mov eax, dword [0x4a1a4c]
mov eax, dword [eax]
call eax
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov edx, dword [eax]
cmp edx, 0x989680
jl 0x49cea1
cmp edx, 0xa7d8c0
jg 0x49cea1
mov eax, edx
mov edx, 1
call fcn.004884d0
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
mov byte [ebx + 0x318], 0
push 0
push 0
push 0x8101
mov eax, ebx
call fcn.0045917c
push eax
call sub.user32.dll_PostMessageA
lea ecx, [ebp - 0x10]
mov eax, dword [0x4a184c]
mov eax, dword [eax]
mov edx, 0x186bb
call fcn.004817a4
lea ecx, [ebp - 0x14]
mov eax, dword [0x4a184c]
mov eax, dword [eax]
mov edx, 0x2750
call fcn.004817a4
mov eax, dword [ebx + 0x350]
call fcn.00484d10
push 0x30
mov eax, dword [ebp - 0x14]
call fcn.00405094
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405094
push eax
mov eax, ebx
call fcn.0045917c
push eax
call sub.user32.dll_MessageBoxW
mov eax, dword [ebx + 0x350]
call fcn.00485820
mov byte [ebx + 0x356], 1
mov dl, 1
mov eax, ebx
call fcn.0049db0c
jmp case.0x49c5e2.65815
mov eax, dword [0x4a17f0]
mov eax, dword [eax]
mov edx, dword [0x4824e4]
call fcn.0047d0e8
mov edi, eax
mov eax, esi
call fcn.004861b0
mov edx, eax
mov eax, edi
call fcn.0048364c
mov eax, dword [0x4a1ac4]
mov eax, dword [eax]
mov edx, edi
call fcn.00482808
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
cmp dword [eax], 0
je case.0x49c5e2.65815
cmp byte [ebx + 0x368], 0
jne 0x49cfaa
mov dl, 1
mov eax, dword [0x4837dc]
call fcn.0047c1f8
mov dword [eax + 0x60], 1
call fcn.0047c29c
mov byte [ebx + 0x368], 1
jmp case.0x49c5e2.65815
mov dl, 1
mov eax, dword [0x4837dc]
call fcn.0047c1f8
mov esi, eax
lea eax, [esi + 0x64]
mov edx, dword [ebx + 0x380]
call fcn.0040481c
xor eax, eax
mov dword [esi + 0x60], eax
mov eax, esi
call fcn.0047c29c
jmp case.0x49c5e2.65815
mov eax, esi
call fcn.004861b0
mov edx, dword [eax + 8]
mov ecx, dword [ebx + 0x350]
mov dword [ecx + 0x5c], edx
add eax, 0x28
call fcn.00487e90
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186c9
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
push 0x40
xor ecx, ecx
mov edx, 0x186cb
mov eax, ebx
call fcn.0049d608
jmp case.0x49c5e2.65815
cmp dword [ebx + 0x358], 0
je case.0x49c5e2.65815
mov edx, esi
mov eax, dword [ebx + 0x358]
call fcn.0049305c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d06e
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404f04
lea eax, [ebp - 0x20]
call fcn.004047c8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404f04
ret