Function at 0x4a1320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [edx]
mov dword [esp + 0x1c], edi
mov ecx, dword [edi + 8]
mov esi, dword [edi]
lea eax, [ecx + 0x320]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
add edx, 4
je 0x4a1378
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x18], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a1360
sub ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004140e0
add esp, 4
jmp 0x4a1393
mov ecx, dword [esi + 0x44]
cmp ecx, dword [esi + 0x38]
jae 0x4a1690
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
mov eax, 0xfff4
mov word [ecx + 6], ax
mov edi, dword [edi]
or edx, 0xffffffff
mov ecx, edi
call fcn.00411150
mov esi, eax
mov ecx, edi
push 0
push bind
mov edx, esi
call fcn.004245d0
mov edx, esi
mov ecx, edi
call fcn.00411a80
push dword [ebp + 0xc]
call fcn.0058c812
mov esi, dword [esp + 0x28]
add esp, 0xc
or eax, 0xffffffff
mov edi, dword [esi]
test edi, edi
je 0x4a1417
push 0x622480
or edx, eax
mov ecx, edi
call fcn.00410720
add esp, 4
test eax, eax
je 0x4a1414
push 0x622480
or edx, 0xffffffff
mov ecx, edi
call fcn.0040fe40
add esp, 4
or edx, 0xffffffff
mov ecx, edi
call fcn.00412c40
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.00415510
mov eax, dword [esp + 0x1c]
jmp 0x4a1417
or eax, 0xffffffff
dec eax
cmp eax, 0x7f
ja case.0x4a1428.3
movzx eax, byte [eax + 0x4a16fc]
jmp dword [eax*4 + 0x4a16e8]
mov edi, dword [esp + 0x14]
mov ecx, dword [esi]
push esi
push 0x49df20
mov edx, dword [edi + 0x18]
push 0
push 0
push 0
push 0
push dword [esi + 8]
push 0
call fcn.0049d9e0
mov ecx, dword [esi]
mov edx, 0x4a10f0
push edi
call fcn.004718b0
movups xmm0, xmmword [str._command_:__1_]
mov al, byte [0x622498]
add esp, 0x24
mov byte [esp + 0x30], al
movups xmmword [esp + 0x20], xmm0
push 0x15
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4a16a6
mov eax, dword [esp + 0x14]
lea ecx, [edi + 4]
xorps xmm0, xmm0
mov edx, 0x11
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov byte [edi + 0x14], 0
mov dword [edi], eax
lea eax, [esp + 0x20]
push 0x11
push eax
call fcn.00401000
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x1c], ecx
cmp dword [ecx + 8], 0
je 0x4a14fb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
je 0x4a14fb
mov ecx, dword [eax + 0xc]
mov edx, fcn.004a0ca0
push edi
push 1
call fcn.004af160
add esp, 8
mov ecx, dword [esi]
call fcn.00415510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push dword [eax + 0xc]
call fcn.004a0ca0
mov ecx, dword [esi]
add esp, 8
call fcn.00415510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
lea eax, [esp + 0x1c]
push eax
push 0
push str.base64
or edx, 0xffffffff
call fcn.00470870
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x14], eax
push ecx
mov ecx, eax
call fcn.004b2a80
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [esi]
push 0
push 0
push eax
call fcn.0049e030
add esp, 0xc
test eax, eax
jne 0x4a1568
mov ecx, dword [esi]
xor edx, edx
call fcn.0040e7d0
test eax, eax
je 0x4a1577
push str.ScriptContainer_Error:
push dword [esi]
call fcn.00471950
add esp, 8
mov ecx, dword [esi]
call fcn.00415510
mov ecx, dword [esi]
call fcn.00415510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 4], 0
je case.0x4a1428.3
mov ecx, dword [esi]
or edx, 0xffffffff
push 0x6224bc
call fcn.0040fe40
mov ecx, dword [esi]
add esp, 4
call fcn.0040f2b0
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [edx + 4]
call fcn.00415060
mov ecx, dword [esi]
or edx, 0xffffffff
push 0x6224c4
call fcn.0040fe40
mov ecx, dword [esi]
add esp, 4
mov edx, 0xfffffffe
call fcn.00411550
mov ecx, dword [esi]
mov edx, 0x6224cc
call fcn.00414170
mov ecx, dword [esi]
mov edx, 0xfffffffc
call fcn.004115c0
mov ecx, dword [esi]
mov edx, 2
push 0
call fcn.0040e880
add esp, 4
test eax, eax
je 0x4a160d
mov ecx, dword [esi]
call fcn.00471b60
mov ecx, dword [esi]
call fcn.004155f0
mov ecx, dword [esi]
call fcn.00415510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [esi]
xor eax, eax
test edi, edi
je 0x4a166e
push str.noResponse
or edx, 0xffffffff
mov ecx, edi
call fcn.00410720
add esp, 4
test eax, eax
je 0x4a166c
push str.noResponse
or edx, 0xffffffff
mov ecx, edi
call fcn.0040fe40
add esp, 4
or edx, 0xffffffff
mov ecx, edi
call fcn.00412c40
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.00415510
mov eax, dword [esp + 0x1c]
jmp 0x4a166e
xor eax, eax
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
call fcn.00415510
mov ecx, dword [esi]
test ecx, ecx
je 0x4a14f5
mov ecx, dword [ecx + 0x2c]
call fcn.00430440
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.cannot_push_beyond_allocated_stack
push 0x300104f
mov edx, 0x6059d0
mov ecx, esi
call fcn.0040d970
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
nop
das
adc al, 74
add byte [edx + 0x158b004a], dl
dec edx
add byte [ecx], ah
push ss
dec edx
add dh, ch
adc al, 0x4a
add byte [eax], al
add dword [esp + eax], eax
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 2
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 3
int3