Function at 0x410980
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0x360]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x60]
cmp dword [eax], 0
je 0x410f07
mov eax, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebp, [esi + 0x2f0]
mov dword [esp + 0x10], eax
nop dword [eax]
push 0x1f4
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x410dbb
mov eax, dword [ebp]
dec eax
cmp eax, 8
ja case.default.0x4109e1
jmp dword [eax*4 + 0x410f0c]
cmp dword [esi + 0x34c], 0
je 0x410e43
mov ecx, dword [esi + 0x2fc]
mov eax, 0x80010001
cmp ecx, 0x80000003
mov edx, 0x10002
cmove eax, edx
mov dword [esi + 0x368], eax
cmp ecx, 0xc0000409
je 0x410a30
cmp ecx, 0xc0000374
je 0x410a30
cmp ecx, 0xc000041d
jne case.default.0x4109e1
mov ecx, esi
call fcn.004146b0
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4109e1
cmp byte [0x4e02f8], 0
je case.default.0x4109e1
cmp byte [0x4e0340], 0
je case.default.0x4109e1
push dword [esi + 0x300]
push dword [esi + 0x304]
push dword [esi + 0x2fc]
push dword [esi + 0x2f8]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_CreateThread_TID1:__08p__TID2:__08p__Base:_0x_p__TLB:_0x_p__n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x28
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410b0e
cmp byte [0x4e02f8], 0
je 0x410b0e
cmp byte [0x4e0340], 0
je 0x410ad8
push dword [esi + 0x300]
push str.Debugger:_CreateProcess_hProcess:_0x_08I32X__n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x14
cmp byte [0x4e02f8], 0
je 0x410b0e
cmp byte [0x4e0340], 0
je 0x410b0e
push dword [esi + 0x308]
movzx eax, word [esi + 0x320]
push eax
push str.Debugger:_CreateProcess_Unicode:__d__Base:_0x_p__n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x18
mov eax, dword [esi + 0x300]
mov dword [esi + 0x350], eax
mov eax, dword [esi + 0x2fc]
test eax, eax
je case.default.0x4109e1
cmp eax, 0xffffffff
je case.default.0x4109e1
push eax
call edi
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4109e1
cmp byte [0x4e02f8], 0
je case.default.0x4109e1
cmp byte [0x4e0340], 0
je case.default.0x4109e1
push dword [esi + 0x2fc]
push dword [esi + 0x2f8]
push str.Debugger:_ExitThread_TID:_0x_08X__ExitCode:_0x_X__n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x18
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410cab
mov eax, dword [esi + 0x30c]
test eax, eax
je 0x410c74
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push ecx
push 8
lea ecx, [esp + 0x20]
movlpd qword [esp + 0x20], xmm0
push ecx
push eax
push dword [esi + 0x350]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x410c74
cmp dword [esp + 0x14], 0
je 0x410c74
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.00413a60
test eax, eax
je 0x410c74
cmp word [esi + 0x310], 0
je 0x410c46
cmp byte [0x4e02f8], 0
je 0x410cab
cmp byte [0x4e0340], 0
je 0x410cab
push dword [esi + 0x300]
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__s___0x_p_n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x20
jmp 0x410cab
cmp byte [0x4e02f8], 0
je 0x410cab
cmp byte [0x4e0340], 0
je 0x410cab
push dword [esi + 0x300]
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll__S___0x_p_n
jmp 0x410c33
cmp byte [0x4e02f8], 0
je 0x410cab
cmp byte [0x4e0340], 0
je 0x410cab
push dword [esi + 0x300]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_LoadDll____p_n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x1c
mov eax, dword [esi + 0x2fc]
cmp eax, 0xffffffff
je case.default.0x4109e1
push eax
call edi
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4109e1
cmp byte [0x4e02f8], 0
je case.default.0x4109e1
cmp byte [0x4e0340], 0
je case.default.0x4109e1
push dword [esi + 0x2fc]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_UnloadDll___0x_p_n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x1c
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4109e1
movzx edi, word [esi + 0x302]
test di, di
je 0x410d9f
cmp dword [esi + 0x2fc], 0
je 0x410d9f
call fcn.00411aa0
push eax
push edi
lea ecx, [esi + 0x374]
call fcn.004033c0
test al, al
je 0x410d9f
push dword [esi + 0x2fc]
mov ecx, esi
call fcn.00413a60
test eax, eax
je 0x410d9f
cmp word [esi + 0x300], 0
je 0x410dcf
cmp byte [0x4e02f8], 0
je 0x410d9f
cmp byte [0x4e0340], 0
je 0x410d9f
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__s_n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x368]
push dword [esi + 0x2f8]
push dword [esi + 0x2f4]
call dword [esp + 0x1c]
mov eax, dword [esi + 0x60]
cmp dword [eax], 0
jne 0x4109c0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp byte [0x4e02f8], 0
je 0x410d9f
cmp byte [0x4e0340], 0
je 0x410d9f
push dword [esi + 0x384]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_OutputDebugString:__S_n
jmp 0x410d8e
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je case.default.0x4109e1
cmp byte [0x4e02f8], 0
je case.default.0x4109e1
cmp byte [0x4e0340], 0
je case.default.0x4109e1
push dword [esi + 0x300]
push dword [esi + 0x2fc]
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_Rip:_Error:_0x_X__Type:_0x_X__n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x20
jmp case.default.0x4109e1
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410e7e
cmp byte [0x4e02f8], 0
je 0x410e7e
cmp byte [0x4e0340], 0
je 0x410e7e
push dword [esi + 0x36c]
call ebx
push eax
push str.Debugger_EnCase:_d_Remote:_d_:_EXCEPTION_DEBUG_EVENT__FirstChance_Exception___Crash._n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x18
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.004146b0
mov eax, dword [esi + 0x14]
shr eax, 0x17
test al, 1
je 0x410eca
cmp byte [0x4e02f8], 0
je 0x410eca
cmp byte [0x4e0340], 0
je 0x410eca
push dword [esi + 0x2fc]
push dword [esi + 0x2f8]
push str.Debugger:_ExitProcess_TID:_0x_08X__ExitCode:_0x_x__n
push 0
push 8
push 0x4602a0
call fcn.004166b0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, 0x10002
shr eax, 0x19
not al
test al, 1
mov eax, 0x40010004
cmove eax, ecx
mov ecx, esi
mov dword [esi + 0x368], eax
mov eax, dword [esi]
call dword [eax + 0x7c]
push dword [esi + 0x368]
push dword [esi + 0x2f8]
push dword [esi + 0x2f4]
call dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret