Function at 0x4978c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x18], 0
xor edi, edi
mov ebx, edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
test esi, esi
je 0x497cda
call fcn.004aed40
test eax, eax
je 0x497cda
cmp dword [esi + 0x34], edi
je 0x497934
push dword [ebp + 0xc]
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.00497280
add esp, 8
cmp dword [esi + 0x34], edi
jne 0x49792a
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x49792a
push dword [esi + 0xc]
mov dword [esi + 0x34], 1
push esi
call eax
add esp, 8
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x497949
cmp eax, ebx
je 0x497a06
push 0xffffffffffffffff
push dword [esi + 0x18]
call ecx
push 0
push 1
push dword [esi + 0x18]
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], edi
test eax, eax
je 0x49797a
nop
inc dword [esi + 0x1c]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x497970
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi + 0x14]
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x4979f4
nop dword [eax + eax]
mov edi, dword [ebx + 4]
test edi, edi
je 0x497a92
push dword [edi + 0x2c]
mov eax, dword [esp + 0x18]
push dword [ebp + 0xc]
mov dword [edi + 0x34], eax
push dword [ebp + 8]
mov eax, dword [edi + 0x1c]
push edi
mov dword [edi + 0x30], 0xffffffff
call eax
add esp, 0x10
cmp eax, 0xfffffffc
je 0x4979db
test eax, eax
je 0x497a7a
cmp eax, 1
jne 0x4979e5
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push esi
push edi
call fcn.004974e0
add esp, 8
mov edi, dword [esp + 0x10]
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x497990
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x497be8
mov ebx, dword [esp + 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi + 0x18]
call ecx
push 0
push 1
push dword [esi + 0x18]
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [esi + 0x4c]
mov edx, 0x61e2f4
push 0
call fcn.0045e2d0
add esp, 4
test eax, eax
je 0x497c80
mov ecx, dword [esi + 4]
call fcn.004b5130
test eax, eax
je 0x497c00
test ebx, ebx
jne 0x497b5d
mov ecx, dword [esi]
xor edx, edx
push 3
call fcn.00414f10
mov ebx, dword [ebp + 0xc]
add esp, 4
mov ecx, dword [esi]
or edx, 0xffffffff
push ebx
push dword [ebp + 8]
call fcn.0040e670
add esp, 8
jmp 0x497b60
mov dword [edi + 0x10], fcn.004974e0
mov dword [edi + 0x14], esi
mov edi, 1
mov dword [esp + 0x10], edi
jmp 0x4979e9
cmp dword [ebx], 0
je 0x4979e5
cmp dword [esp + 0x18], 0
jne 0x4979e5
mov edi, dword [esi + 4]
cmp dword [edi + 8], 0
je 0x497b34
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
je 0x497b34
mov eax, dword [ebp + 0xc]
add eax, 0xc
push eax
mov dword [esp + 0x1c], eax
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x497ce6
push dword [esp + 0x18]
push 0
push edi
call fcn.00587250
mov eax, dword [esp + 0x20]
lea ecx, [edi + 0xc]
add esp, 0xc
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
mov dword [edi], esi
mov dword [edi + 4], eax
push eax
push dword [ebp + 8]
call fcn.00401000
mov ecx, dword [esi + 4]
mov edx, 0x497870
push edi
push 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 1
call fcn.004af160
add esp, 0x10
mov edi, 1
jmp 0x4979e9
push dword [ebp + 0xc]
mov edx, dword [ebx]
mov ecx, esi
push dword [ebp + 8]
call fcn.004975d0
mov edi, dword [esp + 0x18]
add esp, 8
test eax, eax
mov eax, 1
cmove edi, eax
mov dword [esp + 0x10], edi
jmp 0x4979e9
mov ebx, dword [ebp + 0xc]
mov edx, dword [esi + 8]
mov ecx, dword [esi]
call fcn.00415060
mov ecx, dword [esi]
or edx, 0xffffffff
push 0x61e2fc
call fcn.0040fe40
mov ecx, dword [esi]
add esp, 4
mov edx, 0xfffffffe
call fcn.00411550
mov ecx, dword [esi]
mov edx, 0x61e304
call fcn.00414170
cmp dword [esp + 0x14], 0
jne 0x497bb0
push 1
push ebx
push ecx
mov ecx, dword [esi]
mov edx, 0xfffffffc
call fcn.00414c60
add esp, 0xc
jmp 0x497bbe
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
push ebx
call fcn.004140e0
add esp, 4
mov ecx, dword [esi]
mov edx, 2
push 0
call fcn.0040e880
add esp, 4
test eax, eax
je 0x497bda
mov ecx, dword [esi]
call fcn.00471b60
cmp dword [esp + 0x14], 0
mov ecx, dword [esi]
jne 0x497bf9
call fcn.004155f0
test edi, edi
je 0x49792a
cmp dword [esi + 0x34], 0
jmp 0x497911
call fcn.00415510
jmp 0x497be8
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + 0xc]
push eax
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x497ce6
lea eax, [ebx + 0xc]
push eax
push 0
push edi
call fcn.00587250
mov eax, dword [esp + 0x20]
lea ecx, [edi + 0xc]
add esp, 0xc
mov dword [edi + 4], ebx
mov edx, ebx
mov dword [edi + 8], eax
mov dword [edi], esi
push ebx
push dword [ebp + 8]
call fcn.00401000
mov ecx, dword [esi + 4]
add esp, 8
call fcn.004b5130
push edi
test eax, eax
jne 0x497c6c
mov ecx, dword [esi + 4]
mov edx, fcn.00497340
push eax
call fcn.004af160
add esp, 8
cmp dword [esi + 0x34], 0
jmp 0x497911
push dword [esi + 4]
call fcn.00497340
add esp, 8
cmp dword [esi + 0x34], 0
jmp 0x497911
cmp dword [esi + 0x3c], 0
je 0x497cb7
mov ecx, dword [esi + 0x4c]
mov edx, 0x61e30c
push 0
call fcn.0045e2d0
add esp, 4
test eax, eax
jne 0x497cb7
push dword [ebp + 0xc]
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.00497280
add esp, 8
cmp dword [esi + 0x34], 0
jmp 0x497911
mov ecx, dword [esi + 0x4c]
mov edx, 0x61e310
push 0
call fcn.0045e2d0
add esp, 4
test eax, eax
je 0x497be8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3