Function at 0x6104c200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edx, dword [ebp + 0x10]
movzx eax, byte [ebp + 0xc]
test edx, edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x11], al
lea eax, [ebp + 0x14]
je 0x6104c2e6
jmp 0x6104c230
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [edx + 4]
mov edx, dword [edx]
mov dword [ebp - 0x24], eax
mov eax, dword [0x611630ec]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 4]
test eax, eax
jne 0x6104c256
mov eax, edx
mov edx, dword [ebp - 0x1c]
sub eax, edx
mov ebx, dword [ebp - 0x1c]
mov edi, eax
mov edx, dword [ebp - 0x20]
cmp ebx, edx
jae 0x6104c2d0
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x10], 0
lea eax, [ebx + edi]
cmp eax, dword [ebp - 0x20]
jbe 0x6104c284
mov edi, dword [ebp - 0x20]
sub edi, ebx
cmp byte [ebp - 0x11], 0
jne 0x6104c300
mov dword [esp + 0xc], edi
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.KERNEL32.dll_ReadProcessMemory
sub esp, 0x14
test byte [0x6110a820], 1
mov esi, eax
jne 0x6104c32c
test esi, esi
je 0x6104c37b
mov edx, dword [ebp - 0x10]
cmp edi, edx
jne 0x6104c38d
add ebx, edx
cmp ebx, dword [ebp - 0x20]
jb 0x6104c270
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
add eax, 4
mov edx, dword [edx]
mov dword [ebp - 0x18], edx
test edx, edx
jne 0x6104c230
test byte [0x6110a820], 1
jne 0x6104c429
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edi
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
test byte [0x6110a820], 1
mov esi, eax
je 0x6104c2b6
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov edx, dword [ebp - 0x18]
mov eax, str._s___hp__p_low__p__high__p__res__d
mov dword [esp + 0xc], eax
mov eax, str.bool_child_copy_void__bool__..._
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
test esi, esi
jne 0x6104c2be
mov edx, 0x2be
mov eax, str._ext_build_netrel_src_cygwin_1.5.24_2_winsup_cygwin_fork.cc
call sym.__Z8seterrnoPKci_8
mov edx, dword [ebp - 0x10]
mov eax, dword [0x61107154]
mov ecx, str.bool_child_copy_void__bool__..._
mov ebx, str._s__s_copy_failed___p.._p__done__d__windows_pid__u___E
mov eax, dword [eax + 0x14]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x18], edx
mov edx, 0x8000
movzx eax, byte [ebp - 0x11]
mov eax, dword [eax*4 + 0x61100440]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, 1
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
test byte [0x6110a820], 1
jne 0x6104c45a
call sym.cygwin1.dll___errno
mov edx, dword [sym.cygwin1.dll__impure_ptr]
mov dword [edx], 0xb
mov dword [eax], 0xb
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x6110a820
mov eax, str.done
mov dword [esp + 0xc], eax
mov eax, str.bool_child_copy_void__bool__..._
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, 1
jmp 0x6104c2f8
mov dword [esp], 0x6110a820
mov eax, 0xb
mov edi, str.bool_child_copy_void__bool__..._
mov dword [esp + 0x18], eax
mov esi, 0x61123dd4
mov eax, 0x2cd
mov dword [esp + 0x14], eax
mov ebx, 0x61123d10
mov ecx, 0x40
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104c408