Function at 0x4d0a80
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x190
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x188], eax
call fcn.004f7370
test al, al
jne 0x4d1e46
lea eax, [ebp + 8]
pxor xmm0, xmm0
lea ecx, [esp + 0x178]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov ebx, dword [eax]
mov dword [esp + 0x1c], ecx
push ecx
push ebx
call fcn.004f73a0
add esp, 8
mov esi, dword [ebx + 0x3c]
mov edi, dword [ebx + 0x40]
cmp esi, edi
je 0x4d0b4e
lea ebx, [esp + 0xc8]
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x4d0afb
mov eax, dword [esi + 4]
test eax, eax
js 0x4d1e05
mov ecx, dword [esi]
test eax, eax
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d1e05
push eax
push ecx
push ebx
call fcn.00557150
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push ebx
call fcn.004f73a0
add esp, 8
cmp byte [esp + 0xd3], 0
jns 0x4d0b42
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
add esi, 0xc
cmp esi, edi
jne 0x4d0ae4
lea eax, [ebp + 8]
mov ebx, dword [eax]
movsx eax, byte [ebx + 0x17]
test eax, eax
jns 0x4d0b59
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4d0bdb
lea eax, [esp + 0x48]
mov byte [eax + 3], 8
mov ecx, str.database
lea edx, [esp + 0x40]
cmp edx, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4d1e05
lea eax, [ebx + 0xc]
lea edx, [esp + 0x40]
mov dword [edx + 4], 0x65736162
mov dword [edx], 0x61746164
mov byte [edx + 8], 0
lea esi, [esp + 0xc8]
mov ecx, esi
push eax
call fcn.004d23d0
add esp, 4
lea eax, [esp + 0x178]
push eax
push esi
call fcn.004f73a0
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4d0bd0
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x4b], 0
js 0x4d1eea
movsx eax, byte [ebx + 0x23]
test eax, eax
js 0x4d1e49
test eax, eax
jne 0x4d2071
movsx eax, byte [ebx + 0x2f]
test eax, eax
jns 0x4d1e51
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4d0cc5
js 0x4d1e05
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x4d1e05
lea edi, [esp + 0x40]
push eax
push ecx
push edi
call fcn.00557150
add esp, 0xc
lea eax, [esp + 0x93]
mov byte [eax + 8], 3
mov ecx, 0x788682
lea edx, [esp + 0x90]
cmp edx, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4d1e05
mov al, byte [0x788684]
lea edx, [esp + 0x90]
mov byte [edx + 2], al
movzx eax, word [0x788682]
mov word [edx], ax
mov byte [edx + 3], 0
lea esi, [esp + 0xc8]
mov ecx, esi
push edi
call fcn.004d23d0
add esp, 4
lea eax, [esp + 0x178]
push eax
push esi
call fcn.004f73a0
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4d0ca4
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x9b], 0
js 0x4d1efb
cmp byte [esp + 0x4b], 0
jns 0x4d0cc5
push dword [esp + 0x40]
call fcn.005c8b90
add esp, 4
mov esi, dword [ebx + 0x30]
add ebx, 0x34
cmp esi, ebx
je 0x4d0f58
mov eax, str.annotation
lea ecx, [esp + 0x16c]
cmp ecx, eax
setbe cl
lea edx, [esp + 0x176]
cmp edx, eax
seta al
and al, cl
mov byte [esp + 0xf], al
mov dword [esp + 0x18], ebx
jmp 0x4d0ed7
pxor xmm0, xmm0
movq qword [esp + 0x30], xmm0
mov dword [esp + 0x38], 0
mov byte [esp + 0x3b], al
test dl, dl
jns 0x4d0d1b
mov ecx, dword [ecx]
lea esi, [esp + 0x30]
test edi, edi
jns 0x4d0d2e
jmp 0x4d1e05
mov ecx, dword [esp + 4]
mov ecx, dword [ecx]
cmp ecx, esi
jb 0x4d0d3d
lea eax, [esi + edi]
cmp eax, ecx
ja 0x4d1e05
test edi, edi
je 0x4d0d4c
push edi
push ecx
push esi
call fcn.005cc950
add esp, 0xc
mov word [esi + edi], 0x3d
mov esi, dword [esp + 0x10]
movsx eax, byte [esi + 0x27]
test eax, eax
js 0x4d0d63
lea edx, [esi + 0x1c]
jmp 0x4d0d69
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
lea ebx, [esp + 0x40]
lea ecx, [esp + 0x30]
push eax
push edx
call fcn.0054aa70
mov ecx, dword [eax + 8]
mov dword [esp + 0x98], ecx
movq xmm0, qword [eax]
movq qword [esp + 0x90], xmm0
pxor xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
movsx eax, byte [esp + 0x9b]
test eax, eax
cmovs eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
lea edx, [esp + 0x90]
cmovns ecx, edx
test eax, eax
js 0x4d1e05
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d1e05
mov esi, dword [esp + 0x18]
push eax
push ecx
mov edi, ebx
push ebx
call fcn.00557150
add esp, 0xc
mov byte [esp + 0x177], 0xa
cmp byte [esp + 0xf], 0
jne 0x4d1e05
mov word [esp + 0x174], 0x6e6f
mov dword [esp + 0x170], 0x69746174
mov dword [esp + 0x16c], 0x6f6e6e61
mov byte [esp + 0x176], 0
lea ebx, [esp + 0xc8]
mov ecx, ebx
lea edx, [esp + 0x16c]
push edi
call fcn.004d23d0
add esp, 4
lea eax, [esp + 0x178]
push eax
push ebx
call fcn.004f73a0
add esp, 8
cmp byte [esp + 0xd3], 0
jns 0x4d0e68
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x177], 0
mov ebx, esi
js 0x4d1e21
cmp byte [esp + 0x4b], 0
mov esi, dword [esp + 0x10]
jns 0x4d0e8f
push dword [esp + 0x40]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x9b], 0
jns 0x4d0ea8
push dword [esp + 0x90]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x3b], 0
js 0x4d1e35
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x4d0ec5
mov eax, dword [esi + 8]
cmp dword [eax], esi
mov esi, eax
jne 0x4d0eba
jmp 0x4d0ecd
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4d0ec5
mov esi, eax
cmp eax, ebx
je 0x4d0f58
movsx edx, byte [esi + 0x1b]
mov edi, edx
test edx, edx
jns 0x4d0ee4
mov edi, dword [esi + 0x14]
xor eax, eax
dec eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [edi + 1]
cmp eax, 0x7ffffff8
jae 0x4d1e18
lea ecx, [esi + 0x10]
cmp eax, 0xb
mov dword [esp + 0x10], esi
jb 0x4d0cff
mov dword [esp + 4], ecx
mov ebx, eax
or ebx, 7
inc ebx
push ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], eax
call fcn.005c8b59
add esp, 4
mov esi, eax
or ebx, 0x80000000
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
cmp byte [esp + 8], 0
js 0x4d0d28
mov ecx, dword [esp + 4]
jmp 0x4d0d2e
lea eax, [ebp + 8]
mov ebx, dword [eax]
mov esi, dword [ebx + 0x48]
mov edi, dword [ebx + 0x4c]
cmp esi, edi
mov dword [esp + 0x14], ebx
jne 0x4d20de
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4d216d
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x90]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
xor edx, edx
mov ecx, esi
push edx
push 0x8206e4
push edx
push 0x8206d8
push edx
push 0x8206cc
mov dword [esp + 0x28], eax
push eax
push dword [ebx + 0x64]
push dword [0x811a84]
push dword [0x811a80]
push dword [0x811a78]
call fcn.004f7640
lea edi, [esp + 0x30]
mov ecx, esi
push edi
call fcn.004f7a30
push 0x18
call fcn.005c8b59
add esp, 4
mov dword [esp + 0x16c], eax
mov dword [esp + 0x174], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [esp + 0x170], 0x16
lea ecx, [eax + 0x16]
mov edx, str.__initial_client_data
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x4d1e05
movsd xmm0, qword [0x799b75]
movsd qword [eax + 0xe], xmm0
movups xmm0, xmmword [str.__initial_client_data]
movups xmmword [eax], xmm0
movsx edx, byte [esp + 0x3b]
test edx, edx
cmovs edx, dword [esp + 0x34]
mov byte [eax + 0x16], 0
mov eax, dword [esp + 0x30]
cmovns eax, edi
lea ecx, [esp + 0x16c]
push edx
push eax
call fcn.0054aa70
mov ecx, dword [eax + 8]
lea edx, [esp + 0x40]
mov dword [edx + 8], ecx
movq xmm0, qword [eax]
movq qword [edx], xmm0
pxor xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
movsx eax, byte [edx + 0xb]
test eax, eax
cmovs eax, dword [edx + 4]
mov ecx, dword [edx]
cmovns ecx, edx
test eax, eax
js 0x4d1e05
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d1e05
lea esi, [esp + 0xc8]
push eax
push ecx
push esi
call fcn.00557150
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push esi
call fcn.004f73a0
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4d10e2
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x4d10f5
push dword [esp + 0x40]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x177], 0
js 0x4d1f0f
cmp byte [esp + 0x3b], 0
jns 0x4d1116
push dword [esp + 0x30]
call fcn.005c8b90
add esp, 4
pxor xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
xorps xmm1, xmm1
movsd qword [esp + 0x80], xmm1
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
mov dword [esp + 0x6c], 0x100
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
mov dword [esp + 0x78], eax
push 0xfffffffffffffff5
call esi
mov dword [esp + 0x7c], eax
push 0xfffffffffffffff4
call esi
mov dword [esp + 0x80], eax
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov eax, dword [0x820708]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4d11d7
push 0x820708
call fcn.005c8bdd
add esp, 4
cmp dword [0x820708], 0xffffffff
jne 0x4d11d7
push 0
push str.::InitializeProcThreadAttributeList
push 0x782b66
call fcn.004f7af0
add esp, 0xc
mov dword [0x820704], eax
push 0x820708
call fcn.005c8c57
add esp, 4
mov eax, dword [0x820710]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4d123d
push 0x820710
call fcn.005c8bdd
add esp, 4
cmp dword [0x820710], 0xffffffff
jne 0x4d123d
cmp dword [0x820704], 0
je 0x4d1e61
push 0
push str.::UpdateProcThreadAttribute
push 0x782b66
call fcn.004f7af0
add esp, 0xc
mov dword [0x82070c], eax
push 0x820710
call fcn.005c8c57
add esp, 4
mov ecx, dword [0x820704]
test ecx, ecx
je 0x4d1e86
cmp dword [0x82070c], 0
je 0x4d1e86
mov dword [esp + 0x40], 0x48
mov dword [esp + 0x30], 0xffffffff
call dword [0x8072c0]
xor esi, esi
push edi
push esi
push 1
push esi
call ecx
test eax, eax
jne 0x4d1fca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4d1f78
push dword [esp + 0x30]
call fcn.005c8bc3
add esp, 4
mov edi, eax
mov dword [esp + 0x84], eax
mov ecx, dword [0x820704]
call dword [0x8072c0]
lea eax, [esp + 0x30]
push eax
push 0
push 1
mov dword [esp + 0x10], edi
push edi
call ecx
test eax, eax
je 0x4d2023
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x174]
mov eax, edx
sub eax, ecx
cmp eax, 0x1f
ja 0x4d1df9
mov edi, dword [esp + 0x170]
push 0x20
mov dword [esp + 0xc], ecx
call fcn.005c8b59
mov ecx, dword [esp + 0xc]
add esp, 4
mov ebx, eax
lea edx, [eax + 0x20]
sub edi, ecx
lea esi, [eax + edi]
jne 0x4d2155
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], edx
test ecx, ecx
jne 0x4d1de9
cmp esi, edx
jb 0x4d1d83
mov eax, dword [esp + 0x16c]
sub esi, eax
sar esi, 2
lea ecx, [esi + 1]
cmp ecx, 0x40000000
jae 0x4d1e0c
sub edx, eax
mov eax, edx
sar eax, 1
cmp eax, ecx
cmovbe eax, ecx
cmp edx, 0x7ffffffc
mov edi, 0x3fffffff
cmovb edi, eax
test edi, edi
je 0x4d1ea7
cmp edi, 0x40000000
jae 0x4d1e07
lea eax, [edi*4]
push eax
call fcn.005c8b59
add esp, 4
shl esi, 2
add esi, eax
je 0x4d1e05
lea ebx, [eax + edi*4]
mov eax, dword [0x811a78]
mov dword [esi], eax
lea edi, [esi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub esi, ecx
push ecx
push eax
push esi
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], edi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d13e6
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], edi
mov eax, dword [esp + 0x174]
cmp edi, eax
jb 0x4d1d98
mov ecx, dword [esp + 0x16c]
sub edi, ecx
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov esi, 0x3fffffff
cmovb esi, ecx
test esi, esi
je 0x4d1eae
cmp esi, 0x40000000
jae 0x4d1e07
lea eax, [esi*4]
push eax
call fcn.005c8b59
add esp, 4
shl edi, 2
add edi, eax
je 0x4d1e05
lea esi, [eax + esi*4]
mov eax, dword [0x811a80]
mov dword [edi], eax
lea ebx, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], esi
test eax, eax
je 0x4d14b1
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], ebx
mov eax, dword [esp + 0x174]
cmp ebx, eax
jb 0x4d1dad
mov ecx, dword [esp + 0x16c]
sub ebx, ecx
sar ebx, 2
lea edx, [ebx + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov esi, 0x3fffffff
cmovb esi, ecx
test esi, esi
je 0x4d1eb5
cmp esi, 0x40000000
jae 0x4d1e07
lea eax, [esi*4]
push eax
call fcn.005c8b59
add esp, 4
shl ebx, 2
add ebx, eax
je 0x4d1e05
lea edi, [eax + esi*4]
mov eax, dword [0x811a84]
mov dword [ebx], eax
lea esi, [ebx + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub ebx, ecx
push ecx
push eax
push ebx
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], edi
test eax, eax
je 0x4d157c
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], esi
lea eax, [ebp + 8]
mov edi, dword [eax]
mov eax, dword [esp + 0x174]
cmp esi, eax
jb 0x4d1dc2
mov ecx, dword [esp + 0x16c]
sub esi, ecx
sar esi, 2
lea edx, [esi + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, ecx
test ebx, ebx
je 0x4d1ebc
cmp ebx, 0x40000000
jae 0x4d1e07
lea eax, [ebx*4]
push eax
call fcn.005c8b59
add esp, 4
shl esi, 2
add esi, eax
je 0x4d1e05
mov ecx, edi
lea edi, [eax + ebx*4]
mov eax, dword [ecx + 0x64]
mov dword [esi], eax
lea ebx, [esi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub esi, ecx
push ecx
push eax
push esi
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], edi
test eax, eax
je 0x4d164c
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], ebx
mov eax, dword [esp + 0x174]
cmp ebx, eax
jb 0x4d1dd5
mov ecx, dword [esp + 0x16c]
sub ebx, ecx
sar ebx, 2
lea edx, [ebx + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp ecx, edx
cmovbe ecx, edx
cmp eax, 0x7ffffffc
mov esi, 0x3fffffff
cmovb esi, ecx
test esi, esi
je 0x4d1ec3
cmp esi, 0x40000000
jae 0x4d1e07
lea eax, [esi*4]
push eax
call fcn.005c8b59
add esp, 4
shl ebx, 2
add ebx, eax
je 0x4d1e05
lea edi, [eax + esi*4]
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
lea esi, [ebx + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub ebx, ecx
push ecx
push eax
push ebx
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], edi
test eax, eax
je 0x4d1716
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x78]
lea eax, [esi + 1]
cmp eax, 2
jb 0x4d1823
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x4d1823
mov eax, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
cmp eax, edi
je 0x4d1763
mov ecx, eax
cmp dword [ecx], esi
je 0x4d1823
add ecx, 4
cmp ecx, edi
jne 0x4d1754
mov ecx, dword [esp + 0x174]
cmp edi, ecx
jb 0x4d1d47
sub edi, eax
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub ecx, eax
mov eax, ecx
sar eax, 1
cmp eax, edx
cmovbe eax, edx
cmp ecx, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, eax
test ebx, ebx
je 0x4d1eca
cmp ebx, 0x40000000
jae 0x4d1e07
lea eax, [ebx*4]
push eax
call fcn.005c8b59
add esp, 4
shl edi, 2
add edi, eax
je 0x4d1e05
lea ebx, [eax + ebx*4]
mov dword [edi], esi
lea esi, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d181c
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x7c]
lea eax, [esi + 1]
cmp eax, 2
jb 0x4d1929
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x4d1929
mov eax, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
cmp eax, edi
je 0x4d1869
mov ecx, eax
cmp dword [ecx], esi
je 0x4d1929
add ecx, 4
cmp ecx, edi
jne 0x4d185a
mov ecx, dword [esp + 0x174]
cmp edi, ecx
jb 0x4d1d5b
sub edi, eax
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub ecx, eax
mov eax, ecx
sar eax, 1
cmp eax, edx
cmovbe eax, edx
cmp ecx, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, eax
test ebx, ebx
je 0x4d1ed1
cmp ebx, 0x40000000
jae 0x4d1e07
lea eax, [ebx*4]
push eax
call fcn.005c8b59
add esp, 4
shl edi, 2
add edi, eax
je 0x4d1e05
lea ebx, [eax + ebx*4]
mov dword [edi], esi
lea esi, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d1922
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x80]
lea eax, [esi + 1]
cmp eax, 2
jb 0x4d1a32
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x4d1a32
mov eax, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
cmp eax, edi
je 0x4d1972
mov ecx, eax
cmp dword [ecx], esi
je 0x4d1a32
add ecx, 4
cmp ecx, edi
jne 0x4d1963
mov ecx, dword [esp + 0x174]
cmp edi, ecx
jb 0x4d1d6f
sub edi, eax
sar edi, 2
lea edx, [edi + 1]
cmp edx, 0x40000000
jae 0x4d1e0c
sub ecx, eax
mov eax, ecx
sar eax, 1
cmp eax, edx
cmovbe eax, edx
cmp ecx, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, eax
test ebx, ebx
je 0x4d1ed8
cmp ebx, 0x40000000
jae 0x4d1e07
lea eax, [ebx*4]
push eax
call fcn.005c8b59
add esp, 4
shl edi, 2
add edi, eax
je 0x4d1e05
lea ebx, [eax + ebx*4]
mov dword [edi], esi
lea esi, [edi + 4]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
sub ecx, eax
sub edi, ecx
push ecx
push eax
push edi
call fcn.005cc950
add esp, 0xc
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], ebx
test eax, eax
je 0x4d1a2b
push eax
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x170], esi
mov esi, dword [esp + 0x16c]
mov edi, dword [esp + 0x170]
sub edi, esi
je 0x4d1e05
mov ecx, dword [0x82070c]
mov ebx, dword [esp + 0x84]
call dword [0x8072c0]
xor eax, eax
push eax
push eax
push edi
push esi
push 0x20002
push eax
push ebx
call ecx
test eax, eax
je 0x4d1f23
lea eax, [ebp + 8]
mov esi, dword [eax]
mov dword [esp + 8], 0x80000
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x4d1e68
cmp dword [esi + 4], 0xc
jb 0x4d1edf
mov ecx, dword [esi + 4]
cmp ecx, 0xb
jbe 0x4d1e73
mov edx, esi
test al, al
jns 0x4d1aa9
mov edx, dword [esi]
lea edi, [edx + ecx*2]
add edi, 0xffffffe8
push 0x20
call fcn.005c8b59
add esp, 4
mov dword [esp + 0xc8], eax
mov dword [esp + 0xd0], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [esp + 0xcc], 0xc
lea ecx, [eax + 0x18]
cmp eax, edi
seta dl
cmp ecx, edi
setbe cl
or cl, dl
je 0x4d1e05
movdqu xmm0, xmmword [edi]
movsd xmm1, qword [edi + 0x10]
movsd qword [eax + 0x10], xmm1
movdqu xmmword [eax], xmm0
mov word [eax + 0x18], 0
cmp byte [esp + 0xd3], 0
lea eax, [esp + 0xc8]
jns 0x4d1b1b
mov eax, dword [esp + 0xc8]
push str.rundll32.exe
push eax
call fcn.005e141f
add esp, 8
test eax, eax
sete bl
cmp byte [esp + 0xd3], 0
lea edi, [esp + 0x30]
jns 0x4d1b4b
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
cmp byte [esp + 0x183], 0
jns 0x4d1b6a
mov eax, dword [esp + 0x178]
mov dword [esp + 0x1c], eax
xor eax, eax
mov ecx, 0
test bl, bl
jne 0x4d1b81
cmp byte [esi + 0xb], 0
jns 0x4d1e7f
mov ecx, dword [esi]
push edi
lea edx, [esp + 0x44]
push edx
push eax
push eax
push dword [esp + 0x18]
push 1
push eax
push eax
push dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4d21c0
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d1bc6
test ebx, ebx
je 0x4d2213
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d1be8
test ebx, ebx
je 0x4d2256
lea eax, [ebp + 8]
mov esi, dword [eax]
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
je 0x4d1bfe
push eax
call fcn.004f7170
add esp, 4
mov dword [esi + 0x64], 0xffffffff
pxor xmm0, xmm0
lea eax, [esp + 0xc8]
movdqu xmmword [eax + 0x14], xmm0
movdqu xmmword [eax + 4], xmm0
mov dword [eax], 2
pxor xmm0, xmm0
lea ecx, [esp + 0x20]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
add esi, 0x54
push ecx
push eax
push esi
call fcn.004f6a30
add esp, 0xc
mov ebx, eax
mov esi, dword [esp + 4]
mov edi, esi
test esi, esi
je 0x4d1cb5
mov eax, dword [0x820718]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4d1ca6
push 0x820718
call fcn.005c8bdd
add esp, 4
cmp dword [0x820718], 0xffffffff
jne 0x4d1ca6
push 1
push str.::DeleteProcThreadAttributeList
push 0x782b66
call fcn.004f7af0
add esp, 0xc
mov dword [0x820714], eax
push 0x820718
call fcn.005c8c57
add esp, 4
mov ecx, dword [0x820714]
call dword [0x8072c0]
push esi
call ecx
test edi, edi
je 0x4d1cc2
push edi
call fcn.005c8bcc
add esp, 4
mov eax, dword [esp + 0x16c]
test eax, eax
je 0x4d1cf2
mov ecx, dword [esp + 0x170]
cmp ecx, eax
je 0x4d1ce2
add ecx, 0xfffffffc
jne 0x4d1cd4
jmp 0x4d1e05
mov dword [esp + 0x170], eax
push eax
call fcn.005c8b90
add esp, 4
push dword [esp + 0x10]
call fcn.004f7180
add esp, 4
cmp byte [esp + 0x183], 0
jns 0x4d1d17
push dword [esp + 0x178]
call fcn.005c8b90
add esp, 4
movzx eax, bl
mov ecx, 2
sub ecx, eax
mov dword [0x820700], ecx
lea ecx, [ebp + 8]
call fcn.004d22c0
mov ecx, dword [esp + 0x188]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x4d1e05
mov dword [edi], esi
add edi, 4
mov esi, edi
jmp 0x4d181c
test edi, edi
je 0x4d1e05
mov dword [edi], esi
add edi, 4
mov esi, edi
jmp 0x4d1922
test edi, edi
je 0x4d1e05
mov dword [edi], esi
add edi, 4
mov esi, edi
jmp 0x4d1a2b
test esi, esi
je 0x4d1e05
mov eax, dword [0x811a78]
mov dword [esi], eax
add esi, 4
mov edi, esi
jmp 0x4d13e6
test edi, edi
je 0x4d1e05
mov eax, dword [0x811a80]
mov dword [edi], eax
add edi, 4
mov ebx, edi
jmp 0x4d14b1
test ebx, ebx
je 0x4d1e05
mov eax, dword [0x811a84]
mov dword [ebx], eax
add ebx, 4
mov esi, ebx
jmp 0x4d157c
test esi, esi
je 0x4d1e05
mov eax, dword [edi + 0x64]
mov dword [esi], eax
add esi, 4
mov ebx, esi
jmp 0x4d164c
test ebx, ebx
je 0x4d1e05
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
add ebx, 4
mov esi, ebx
jmp 0x4d1716
push ecx
call fcn.005c8b90
add esp, 4
mov edx, dword [esp + 0x174]
mov esi, dword [esp + 0x170]
jmp 0x4d1328
ud2
call fcn.005fe460
lea ecx, [esp + 0x16c]
call fcn.005fddc0
lea ecx, [esp + 0x30]
call fcn.005fe450
push dword [esp + 0x16c]
call fcn.005c8b90
add esp, 4
jmp 0x4d0e78
push dword [esp + 0x30]
call fcn.005c8b90
add esp, 4
jmp 0x4d0eb3
int3
mov eax, dword [ebx + 0x1c]
jmp 0x4d0be7
test al, al
je 0x4d0cc5
lea ecx, [ebx + 0x24]
jmp 0x4d0c0f
xor eax, eax
jmp 0x4d122b
cmp al, 0xc
jb 0x4d1edf
mov ecx, eax
jmp 0x4d1a98
lea ecx, [esp + 0xc8]
call fcn.005fe570
mov ecx, esi
jmp 0x4d1b81
mov dword [esp + 0x40], 0x44
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov esi, dword [esp + 0x14]
jmp 0x4d1a7f
xor eax, eax
jmp 0x4d1388
xor eax, eax
jmp 0x4d1453
xor eax, eax
jmp 0x4d151e
xor eax, eax
jmp 0x4d15ee
xor eax, eax
jmp 0x4d16b9
xor eax, eax
jmp 0x4d17c3
xor eax, eax
jmp 0x4d18c9
xor eax, eax
jmp 0x4d19d2
xor ebx, ebx
lea edi, [esp + 0x30]
jmp 0x4d1b4b
push dword [esp + 0x40]
call fcn.005c8b90
add esp, 4
jmp 0x4d0bdb
push dword [esp + 0x90]
call fcn.005c8b90
add esp, 4
jmp 0x4d0cb2
push dword [esp + 0x16c]
call fcn.005c8b90
add esp, 4
jmp 0x4d1103
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d1f6f
call fcn.00646ae0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 2
push 0x201
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0x19
push 0x799c4e
push eax
call fcn.00535510
add esp, 0xc
mov ecx, ebx
call fcn.00646cf0
mov esi, dword [esp + 4]
jmp 0x4d2018
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d2010
call fcn.00646ae0
lea edi, [esp + 0xc8]
mov ecx, edi
push eax
push 2
push 0x1dc
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0x28
push str.InitializeProcThreadAttributeList__size_
push eax
call fcn.00535510
add esp, 0xc
mov ecx, edi
call fcn.00646cf0
jmp 0x4d2010
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d2010
lea edi, [esp + 0xc8]
mov ecx, edi
push 2
push 0x1d8
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.004ba0e0
lea eax, [esp + 0xd0]
push 0x44
push str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
push eax
call fcn.00535510
add esp, 0xc
mov ecx, edi
call fcn.004ba5c0
mov dword [esp + 4], 0
mov edi, dword [esp + 4]
xor ebx, ebx
jmp 0x4d1c49
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d2018
call fcn.00646ae0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 2
push 0x1e7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0x21
push 0x799c2c
push eax
call fcn.00535510
add esp, 0xc
mov ecx, ebx
call fcn.00646cf0
jmp 0x4d2018
mov dword [esp + 0x18], ebx
lea edi, [ebx + 0x18]
lea esi, [esp + 0x40]
mov ecx, esi
push str.metrics_dir
call fcn.00537240
lea ebx, [esp + 0xc8]
mov ecx, ebx
mov edx, esi
push edi
call fcn.004d23d0
add esp, 4
lea eax, [esp + 0x178]
push eax
push ebx
call fcn.004f73a0
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x4d20c2
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x4d20d5
push dword [esp + 0x40]
call fcn.005c8b90
add esp, 4
mov ebx, dword [esp + 0x18]
jmp 0x4d0bef
lea ebx, [esp + 0x40]
mov ecx, ebx
push 0x799b50
call fcn.00537240
lea ecx, [esp + 0xc8]
mov edx, ebx
push esi
call fcn.004d23d0
add esp, 4
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0xcc]
push eax
call fcn.004f73a0
add esp, 8
cmp byte [esp + 0xd3], 0
jns 0x4d2131
push dword [esp + 0xc8]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x4d2144
push dword [esp + 0x40]
call fcn.005c8b90
add esp, 4
add esi, 0xc
cmp esi, edi
mov ebx, dword [esp + 0x14]
je 0x4d0f6f
jmp 0x4d20de
push edi
push ecx
push ebx
mov edi, edx
call fcn.005cc950
mov ecx, dword [esp + 0x14]
mov edx, edi
add esp, 0xc
jmp 0x4d130b
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d21b9
call fcn.00646ae0
lea esi, [esp + 0xc8]
mov ecx, esi
push eax
push 2
push 0x1a7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0xb
push 0x799b5b
push eax
call fcn.00535510
add esp, 0xc
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
jmp 0x4d1cfe
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d220c
call fcn.00646ae0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 2
push 0x223
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0xd
push str.CreateProcess
push eax
call fcn.00535510
add esp, 0xc
mov ecx, ebx
call fcn.00646cf0
xor ebx, ebx
jmp 0x4d1c43
call fcn.00646ae0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 1
push 0x228
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0x12
push str.CloseHandle_thread
push eax
call fcn.00535510
add esp, 0xc
mov ecx, ebx
call fcn.00646cf0
jmp 0x4d1bc6
call fcn.00646ae0
lea ebx, [esp + 0xc8]
mov ecx, ebx
push eax
push 1
push 0x22b
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00646c90
lea eax, [esp + 0xd0]
push 0x13
push str.CloseHandle_process
push eax
call fcn.00535510
add esp, 0xc
mov ecx, ebx
call fcn.00646cf0
jmp 0x4d1be8