Function at 0x49d9e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [esp + 0x10], eax
mov ebx, edx
mov eax, dword [ebp + 0x18]
push esi
mov dword [esp + 0x10], eax
mov esi, ecx
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0xc], eax
push edi
test ecx, ecx
je 0x49da3a
push 4
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x49deae
mov dword [edi], 0
jmp 0x49da3c
xor edi, edi
mov ecx, esi
call fcn.00414690
mov ecx, dword [esi + 0x44]
cmp ecx, dword [esi + 0x38]
jae 0x49deef
mov edx, dword [ebp + 0xc]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x621a68
mov ecx, esi
call fcn.00410110
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49df05
movd xmm0, ebx
lea eax, [ecx + 8]
cvtdq2pd xmm0, xmm0
mov dword [esi + 0x44], eax
mov edx, 0xfffffffe
push 0x621a74
movsd qword [ecx], xmm0
mov ecx, esi
call fcn.00410110
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49df05
movd xmm0, dword [ebp + 8]
lea eax, [ecx + 8]
cvtdq2pd xmm0, xmm0
mov dword [esi + 0x44], eax
mov edx, 0xfffffffe
push 0x621a9c
movsd qword [ecx], xmm0
mov ecx, esi
call fcn.00410110
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49deef
mov edx, dword [ebp + 0x14]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x621ac8
mov ecx, esi
call fcn.00410110
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49deef
mov edx, dword [esp + 0xc]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x621ae8
mov ecx, esi
call fcn.00410110
mov ecx, dword [esi + 0x44]
add esp, 4
cmp ecx, dword [esi + 0x38]
jae 0x49deef
mov edx, dword [esp + 0x10]
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x621b10
mov ecx, esi
call fcn.00410110
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x49dba3
mov edx, eax
mov ecx, esi
call fcn.00414170
push 0x621b34
mov edx, 0xfffffffe
mov ecx, esi
call fcn.00410110
add esp, 4
mov edx, dword [ebp + 0x1c]
test edx, edx
je 0x49dbdc
mov ecx, dword [esi + 0x44]
cmp ecx, dword [esi + 0x38]
jae 0x49deef
lea eax, [ecx + 8]
mov dword [esi + 0x44], eax
xor eax, eax
or eax, 0xfff60000
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, 0xfffffffe
push 0x621b50
mov ecx, esi
call fcn.00410110
add esp, 4
mov ecx, esi
call fcn.00415510
mov eax, dword [esp + 0xc]
test eax, eax
je 0x49dbfb
push dword [esp + 0x10]
mov edx, eax
mov ecx, esi
call fcn.00471570
add esp, 4
test bl, 2
jne 0x49dc7f
mov ecx, esi
call fcn.004a8770
push 0x489740
mov edx, 0x61117c
mov ecx, esi
call fcn.00456a80
add esp, 4
mov edx, str.global_tunnel
mov ecx, esi
push 0x48a280
call fcn.00456a80
add esp, 4
mov edx, 0x611190
mov ecx, esi
push 0x48c5a0
call fcn.00456a80
add esp, 4
mov edx, str.dgram
mov ecx, esi
push 0x45cac0
call fcn.00456a80
add esp, 4
mov edx, 0x60ffa0
mov ecx, esi
push fcn.00485180
call fcn.00456a80
add esp, 4
mov edx, 0x60ffa8
mov ecx, esi
push 0x485440
call fcn.00456a80
add esp, 4
test ebx, 0x8000000
jne 0x49dc9b
push 0x46d510
mov edx, str._GenericMarshal
mov ecx, esi
call fcn.00456a80
add esp, 4
test ebx, 0x4000000
jne 0x49dccb
push 0x458470
mov edx, str.child_process
mov ecx, esi
call fcn.00456a80
add esp, 4
mov edx, str.heci
mov ecx, esi
push fcn.0046ffd0
call fcn.00456a80
add esp, 4
test bl, 1
jne 0x49dce4
push 0x466860
mov edx, 0x60ad74
mov ecx, esi
call fcn.00456a80
add esp, 4
mov ecx, esi
call fcn.004a62d0
push 0x45e200
mov edx, str.EncryptionStream
mov ecx, esi
call fcn.00456a80
add esp, 4
mov edx, str.events
mov ecx, esi
push 0x461ca0
call fcn.00456a80
add esp, 4
mov ecx, esi
call fcn.00496ff0
push 0x4860e0
mov edx, str.MemoryStream
mov ecx, esi
call fcn.00456a80
add esp, 4
mov edx, str.NetworkMonitor
mov ecx, esi
push 0x48d080
call fcn.00456a80
movaps xmm0, xmmword [0x5f2050]
lea eax, [esp + 0x20]
add esp, 4
mov dword [esp + 0x34], 0x621b78
mov edx, str.ContainerPermissions
mov dword [esp + 0x38], str.NO_AGENT
mov ecx, esi
mov dword [esp + 0x3c], str.NO_MARSHAL
mov dword [esp + 0x40], str.NO_PROCESS_SPAWNING
push 6
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x4c], str.NO_FILE_SYSTEM_ACCESS
push eax
mov dword [esp + 0x54], str.NO_NETWORK_ACCESS
movups xmmword [esp + 0x28], xmm0
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 2
call fcn.00470980
movaps xmm0, xmmword [0x5f2040]
lea eax, [esp + 0x40]
add esp, 0xc
mov dword [esp + 0x1c], str.DEFAULT
mov edx, str.ContainerUserTypes
mov dword [esp + 0x20], str.USER
mov ecx, esi
mov dword [esp + 0x24], str.TERMINAL
mov dword [esp + 0x28], str.WINLOGON
push 4
push eax
lea eax, [esp + 0x24]
push eax
movups xmmword [esp + 0x40], xmm0
call fcn.00470980
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x49de0a
cmp dword [ebp + 0x1c], 0
je 0x49de0a
push 0x4a2620
mov edx, 0x621cac
jmp 0x49de14
push 0x4a27d0
mov edx, str.ScriptContainer
mov ecx, esi
call fcn.00456a80
mov ebx, dword [ebp + 0x14]
add esp, 4
mov edx, dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.00457150
add esp, 4
mov edx, ebx
mov ecx, esi
call fcn.004a7290
push 0x49d780
mov edx, 0x6219b8
mov ecx, esi
call fcn.00456a80
mov edx, dword [esp + 0x1c]
add esp, 4
mov ecx, esi
call fcn.0049c190
test edi, edi
je 0x49de93
push edi
mov edx, 0x49c670
mov dword [edi], esi
mov ecx, esi
call fcn.00471570
add esp, 4
mov ecx, esi
call fcn.00471c10
imul ecx, dword [ebp + 8], 0x3e8
mov edx, edi
push 0
push 0x49c6b0
push ecx
mov ecx, dword [eax + 0x2e4]
call fcn.004b2bf0
add esp, 0xc
mov ecx, esi
call fcn.00495870
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
push str.cannot_push_beyond_allocated_stack
push 0x30010f5
mov edx, 0x605a80
mov ecx, esi
call fcn.0040d970
push str.cannot_push_beyond_allocated_stack
push 0x3001094
mov edx, 0x605a20
mov ecx, esi
call fcn.0040d970
int3