Function at 0x406740
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da48c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1508
call fcn.004923d0
push ebx
push esi
push edi
lea edi, [ebp - 0x1514]
mov ecx, 0x542
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 1
push 3
lea ecx, [ebp - 0x98]
call fcn.004021c6
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1098]
push eax
call fcn.00402040
add esp, 4
lea ecx, [ebp - 0x109c]
call fcn.00574407
mov byte [ebp - 4], 1
push str.STOP_VRVSAFEC.EXE
call fcn.00402603
add esp, 4
mov esi, esp
lea ecx, [ebp - 0x10ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp esi, esp
call fcn.00491c30
mov edx, dword [ebp - 0x10a6]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x10aa]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x10ac]
and ecx, 0xffff
push ecx
push str._.4d__.2d__.2d
lea edx, [ebp - 0x109c]
push edx
call fcn.004f1116
add esp, 0x14
lea ecx, [ebp - 0x109c]
call fcn.00574460
push eax
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
push 0
call fcn.00401730
add esp, 0xc
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x10b0]
push eax
mov ecx, 0x70e51c
call fcn.005744aa
push eax
push str.__svrvsafec.exe___stop__lu
lea ecx, [ebp - 0x109c]
push ecx
call fcn.004f1116
add esp, 0x10
mov esi, esp
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 2
call fcn.00401b90
test eax, eax
je 0x4068c9
mov edx, dword [ebp - 0x10b0]
push edx
mov ecx, 0x70e51c
call fcn.005744aa
push eax
push str.__svrvsafec64.exe___stop__lu
lea eax, [ebp - 0x109c]
push eax
call fcn.004f1116
add esp, 0x10
mov esi, esp
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
lea ecx, [ebp - 0x10b8]
call fcn.0040227a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10b8]
call fcn.004022b1
push str.vrvsafec.exe
push 0x70e51c
lea ecx, [ebp - 0x1120]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1338], eax
mov edx, dword [ebp - 0x1338]
mov dword [ebp - 0x133c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x133c]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1120]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 3
push str.vrvsafec64.exe
push 0x70e51c
lea ecx, [ebp - 0x1124]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1340], eax
mov edx, dword [ebp - 0x1340]
mov dword [ebp - 0x1344], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1344]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1124]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 4
mov ecx, dword [ebp + 8]
push ecx
push 1
call fcn.00401640
add esp, 8
test eax, eax
jne 0x406a78
push str.Pipeline_notification_to_watchclient_in_stopping_process_protection_failed__r_n
lea edx, [ebp - 0x1134]
push edx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1348], eax
mov eax, dword [ebp - 0x1348]
mov dword [ebp - 0x134c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x134c]
push ecx
lea edx, [ebp - 0x1144]
push edx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1350], eax
mov eax, dword [ebp - 0x1350]
mov dword [ebp - 0x1354], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1354]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1144]
call fcn.004020cc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1134]
call fcn.004020cc
mov ecx, 0x70e51c
call fcn.005744aa
push eax
push str.__swatchclient.exe___stop
lea eax, [ebp - 0x109c]
push eax
call fcn.004f1116
add esp, 0xc
mov esi, esp
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 5
mov esi, esp
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
lea ecx, [ebp - 0x1148]
push ecx
push str.EDP_MAIN
lea ecx, [ebp - 0x10c8]
call fcn.00401bdb
mov byte [ebp - 4], 7
lea edx, [ebp - 0x114c]
push edx
push str.EDP_POLICY
lea ecx, [ebp - 0x10d8]
call fcn.00401bdb
mov byte [ebp - 4], 8
lea eax, [ebp - 0x1150]
push eax
push str.EDP_POLICY64
lea ecx, [ebp - 0x10e8]
call fcn.00401bdb
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10c8]
call fcn.00401f64
mov esi, esp
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.00491c30
mov dword [ebp - 0x10ec], eax
lea ecx, [ebp - 0x10d8]
call fcn.00401f64
mov esi, esp
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.00491c30
mov dword [ebp - 0x10f0], eax
lea ecx, [ebp - 0x10e8]
call fcn.00401f64
mov esi, esp
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.00491c30
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0x10ec], 0
je 0x406c5e
push str.Found__m__send_stop_message___r_n
lea ecx, [ebp - 0x1160]
push ecx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1358], eax
mov edx, dword [ebp - 0x1358]
mov dword [ebp - 0x135c], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x1170]
push ecx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1360], eax
mov edx, dword [ebp - 0x1360]
mov dword [ebp - 0x1364], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x1364]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1170]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1160]
call fcn.004020cc
mov esi, esp
push 0
push 1
push 0xa40
mov edx, dword [ebp - 0x10ec]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
push 0
push 0x7e8
mov eax, dword [ebp - 0x10ec]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 6
cmp dword [ebp - 0x10f0], 0
je 0x406d3a
push str.Found__c__send_stop_message___r_n
lea ecx, [ebp - 0x1180]
push ecx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1368], eax
mov edx, dword [ebp - 0x1368]
mov dword [ebp - 0x136c], edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x136c]
push eax
lea ecx, [ebp - 0x1190]
push ecx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1370], eax
mov edx, dword [ebp - 0x1370]
mov dword [ebp - 0x1374], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x1374]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1190]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1180]
call fcn.004020cc
mov esi, esp
push 0
push 1
push 0xa40
mov edx, dword [ebp - 0x10f0]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
push 0
push 0x7e8
mov eax, dword [ebp - 0x10f0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 7
cmp dword [ebp - 0x10f4], 0
je 0x406e16
push str.Found__c64__send_stop_message___r_n
lea ecx, [ebp - 0x11a0]
push ecx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1378], eax
mov edx, dword [ebp - 0x1378]
mov dword [ebp - 0x137c], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x137c]
push eax
lea ecx, [ebp - 0x11b0]
push ecx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1380], eax
mov edx, dword [ebp - 0x1380]
mov dword [ebp - 0x1384], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x1384]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x11b0]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11a0]
call fcn.004020cc
mov esi, esp
push 0
push 1
push 0xa40
mov edx, dword [ebp - 0x10f4]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
push 0
push 0x7e8
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 8
mov esi, esp
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 9
lea ecx, [ebp - 0x10b8]
call fcn.004022b1
push str.vrvsafec.exe
push 0x70e51c
lea ecx, [ebp - 0x11b4]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1388], eax
mov edx, dword [ebp - 0x1388]
mov dword [ebp - 0x138c], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x138c]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11b4]
call fcn.0051bacc
mov dword [0x70e948], 0xa
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
push str.vrvsafec64.exe
push 0x70e51c
lea ecx, [ebp - 0x11b8]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1390], eax
mov edx, dword [ebp - 0x1390]
mov dword [ebp - 0x1394], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1394]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11b8]
call fcn.0051bacc
mov dword [0x70e948], 0xb
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
push str.vrvedp_m.exe
push 0x70e51c
lea ecx, [ebp - 0x11bc]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1398], eax
mov edx, dword [ebp - 0x1398]
mov dword [ebp - 0x139c], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x139c]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11bc]
call fcn.0051bacc
mov dword [0x70e948], 0xc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
push str.vrvrf_c.exe
push 0x70e51c
lea ecx, [ebp - 0x11c0]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x13a0], eax
mov edx, dword [ebp - 0x13a0]
mov dword [ebp - 0x13a4], edx
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x13a4]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c0]
call fcn.0051bacc
mov dword [0x70e948], 0xd
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0xe
push str.vrvrf_c64.exe
push 0x70e51c
lea ecx, [ebp - 0x11c4]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x13a8], eax
mov edx, dword [ebp - 0x13a8]
mov dword [ebp - 0x13ac], edx
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x13ac]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c4]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0xf
mov ecx, dword [ebp + 8]
push ecx
push 2
call fcn.00401640
add esp, 8
test eax, eax
jne 0x40712a
push str.Pipeline_notification_to_watchclient_on_exit_failed___r_n
lea edx, [ebp - 0x11d4]
push edx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x13b0], eax
mov eax, dword [ebp - 0x13b0]
mov dword [ebp - 0x13b4], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x13b4]
push ecx
lea edx, [ebp - 0x11e4]
push edx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x13b8], eax
mov eax, dword [ebp - 0x13b8]
mov dword [ebp - 0x13bc], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x13bc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x11e4]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11d4]
call fcn.004020cc
mov ecx, 0x70e51c
call fcn.005744aa
push eax
push str.__swatchclient.exe____kill
lea eax, [ebp - 0x109c]
push eax
call fcn.004f1116
add esp, 0xc
mov esi, esp
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 0x10
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
push str.watchclient.exe
push 0x70e51c
lea ecx, [ebp - 0x11e8]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x13c0], eax
mov edx, dword [ebp - 0x13c0]
mov dword [ebp - 0x13c4], edx
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x13c4]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11e8]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x11
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 0x12
lea ecx, [ebp - 0x10b8]
call fcn.004022b1
mov dword [ebp - 0x10f8], 0
push str.vrvsafec.exe
call fcn.00401ef6
add esp, 4
test eax, eax
je 0x4072cf
push str.End_vrvsafec.exe_process__r_n
lea ecx, [ebp - 0x11f8]
push ecx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x13c8], eax
mov edx, dword [ebp - 0x13c8]
mov dword [ebp - 0x13cc], edx
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x13cc]
push eax
lea ecx, [ebp - 0x1208]
push ecx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x13d0], eax
mov edx, dword [ebp - 0x13d0]
mov dword [ebp - 0x13d4], edx
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x13d4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1208]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11f8]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
mov dword [0x70e948], 0x13
push str.vrvsafec64.exe
call fcn.00401ef6
add esp, 4
test eax, eax
je 0x40737f
push str.End_vrvsafec64.exe_process__r_n
lea edx, [ebp - 0x1218]
push edx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x13d8], eax
mov eax, dword [ebp - 0x13d8]
mov dword [ebp - 0x13dc], eax
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x13dc]
push ecx
lea edx, [ebp - 0x1228]
push edx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x13e0], eax
mov eax, dword [ebp - 0x13e0]
mov dword [ebp - 0x13e4], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x13e4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1228]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1218]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
mov dword [0x70e948], 0x14
push str.vrvedp_m.exe
call fcn.00401ef6
add esp, 4
test eax, eax
je 0x40742f
push str.End_vrvedp_m.exe_process__r_n
lea eax, [ebp - 0x1238]
push eax
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x13e8], eax
mov ecx, dword [ebp - 0x13e8]
mov dword [ebp - 0x13ec], ecx
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x13ec]
push edx
lea eax, [ebp - 0x1248]
push eax
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x13f0], eax
mov ecx, dword [ebp - 0x13f0]
mov dword [ebp - 0x13f4], ecx
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x13f4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1248]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1238]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
mov dword [0x70e948], 0x15
push str.vrvrf_c.exe
call fcn.00401ef6
add esp, 4
test eax, eax
je 0x4074df
push str.End_vrvrf_c.exe_process__r_n
lea ecx, [ebp - 0x1258]
push ecx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x13f8], eax
mov edx, dword [ebp - 0x13f8]
mov dword [ebp - 0x13fc], edx
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x13fc]
push eax
lea ecx, [ebp - 0x1268]
push ecx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1400], eax
mov edx, dword [ebp - 0x1400]
mov dword [ebp - 0x1404], edx
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x1404]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1268]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1258]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
mov dword [0x70e948], 0x16
push str.vrvrf_c64.exe
call fcn.00401ef6
add esp, 4
test eax, eax
je 0x40758f
push str.End_vrvrf_c64.exe_process__r_n
lea edx, [ebp - 0x1278]
push edx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1408], eax
mov eax, dword [ebp - 0x1408]
mov dword [ebp - 0x140c], eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x140c]
push ecx
lea edx, [ebp - 0x1288]
push edx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp - 0x1410]
mov dword [ebp - 0x1414], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x1414]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1288]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1278]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
mov dword [0x70e948], 0x17
push str.watchclient.exe
call fcn.00401ef6
add esp, 4
test eax, eax
je 0x40763f
push str.End_watchclient.exe_process__r_n
lea eax, [ebp - 0x1298]
push eax
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1418], eax
mov ecx, dword [ebp - 0x1418]
mov dword [ebp - 0x141c], ecx
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x141c]
push edx
lea eax, [ebp - 0x12a8]
push eax
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1420], eax
mov ecx, dword [ebp - 0x1420]
mov dword [ebp - 0x1424], ecx
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x1424]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x12a8]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1298]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
mov dword [0x70e948], 0x18
push str.edptrayicon.exe
push 0x70e51c
lea ecx, [ebp - 0x12ac]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1428], eax
mov edx, dword [ebp - 0x1428]
mov dword [ebp - 0x142c], edx
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12ac]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x19
push str.edpvistadlg.exe
push 0x70e51c
lea ecx, [ebp - 0x12b0]
push ecx
call fcn.0051bf2a
mov dword [ebp - 0x1430], eax
mov edx, dword [ebp - 0x1430]
mov dword [ebp - 0x1434], edx
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x1434]
push eax
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12b0]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x1a
call fcn.004020bd
cmp eax, 1
jne 0x4077cc
push str.End_Service_watchclient.exe_process__r_n
lea ecx, [ebp - 0x12c0]
push ecx
call fcn.00401c3f
add esp, 4
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1438]
mov dword [ebp - 0x143c], edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x143c]
push eax
lea ecx, [ebp - 0x12d0]
push ecx
call fcn.00401073
add esp, 0xc
mov dword [ebp - 0x1440], eax
mov edx, dword [ebp - 0x1440]
mov dword [ebp - 0x1444], edx
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x1444]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b31
add esp, 8
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x12d0]
call fcn.004020cc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12c0]
call fcn.004020cc
mov dword [ebp - 0x10f8], 1
cmp dword [ebp - 0x10f8], 1
jne 0x4079d7
push str.wmic_VRVWatchServer_where_name_ShardAccess__call_stopservice
lea ecx, [ebp - 0x10fc]
call fcn.0051bb58
mov byte [ebp - 4], 0x28
push str.wmic_process_where_name_vrvsafec.exe__delete
lea ecx, [ebp - 0x1100]
call fcn.0051bb58
mov byte [ebp - 4], 0x29
push str.wmic_process_where_name_vrvsafec64.exe__delete
lea ecx, [ebp - 0x1104]
call fcn.0051bb58
mov byte [ebp - 4], 0x2a
push str.wmic_process_where_name_watchclient.exe__delete
lea ecx, [ebp - 0x1108]
call fcn.0051bb58
mov byte [ebp - 4], 0x2b
push str.wmic_process_where_name_vrvedp_m.exe__delete
lea ecx, [ebp - 0x110c]
call fcn.0051bb58
mov byte [ebp - 4], 0x2c
push str.wmic_process_where_name_vrvrf_c.exe__delete
lea ecx, [ebp - 0x1110]
call fcn.0051bb58
mov byte [ebp - 4], 0x2d
push str.wmic_process_where_name_vrvrf_c64.exe__delete
lea ecx, [ebp - 0x1114]
call fcn.0051bb58
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x1118], 0
jmp 0x407880
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
cmp dword [ebp - 0x1118], 3
jge 0x40796e
mov esi, esp
push 0
lea ecx, [ebp - 0x10fc]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
lea ecx, [ebp - 0x1100]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
lea ecx, [ebp - 0x1104]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
lea ecx, [ebp - 0x1108]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
lea ecx, [ebp - 0x110c]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
lea ecx, [ebp - 0x1110]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0
lea ecx, [ebp - 0x1114]
call fcn.005744aa
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp esi, esp
call fcn.00491c30
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
jmp 0x407871
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x1114]
call fcn.0051bacc
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1110]
call fcn.0051bacc
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x110c]
call fcn.0051bacc
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1108]
call fcn.0051bacc
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1104]
call fcn.0051bacc
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1100]
call fcn.0051bacc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10fc]
call fcn.0051bacc
mov dword [0x70e948], 0x1b
push str.STOP_GET005.EXE
call fcn.00402603
add esp, 4
mov ecx, 0x70e508
call fcn.00401f64
push eax
push str.GET005
lea eax, [ebp - 0x12e0]
push eax
call fcn.004025e5
add esp, 0xc
mov dword [ebp - 0x1448], eax
mov ecx, dword [ebp - 0x1448]
mov dword [ebp - 0x144c], ecx
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x144c]
call fcn.00401f64
mov esi, esp
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.00491c30
mov dword [ebp - 0x111c], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12e0]
call fcn.004020cc
cmp dword [ebp - 0x111c], 0
je 0x407a73
push 0
push 0
push 0x10
mov edx, dword [ebp - 0x111c]
push edx
call fcn.004020b3
add esp, 0x10
mov dword [0x70e948], 0x1c
push str.KillProcess_VRVEISP.EXE
call fcn.00402603
add esp, 4
push str.VRVEISP.EXE
push 0x70e51c
lea eax, [ebp - 0x12e4]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1450], eax
mov ecx, dword [ebp - 0x1450]
mov dword [ebp - 0x1454], ecx
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x1454]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12e4]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x1d
push str.KillProcess_EDPSCR_C.EXE
call fcn.00402603
add esp, 4
push str.EDPSCR_C.EXE
push 0x70e51c
lea eax, [ebp - 0x12e8]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1458], eax
mov ecx, dword [ebp - 0x1458]
mov dword [ebp - 0x145c], ecx
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x145c]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12e8]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x1e
push str.KillProcess_EDPSCR_S.EXE
call fcn.00402603
add esp, 4
push str.EDPSCR_S.EXE
push 0x70e51c
lea eax, [ebp - 0x12ec]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1460], eax
mov ecx, dword [ebp - 0x1460]
mov dword [ebp - 0x1464], ecx
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x1464]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12ec]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x1f
push str.KillProcess_EISPM.EXE
call fcn.00402603
add esp, 4
push str.EISPM.EXE
push 0x70e51c
lea eax, [ebp - 0x12f0]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1468], eax
mov ecx, dword [ebp - 0x1468]
mov dword [ebp - 0x146c], ecx
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x146c]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12f0]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x20
push str.KillProcess_GET000.EXE
call fcn.00402603
add esp, 4
push str.GET000.EXE
push 0x70e51c
lea eax, [ebp - 0x12f4]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1470], eax
mov ecx, dword [ebp - 0x1470]
mov dword [ebp - 0x1474], ecx
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x1474]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12f4]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x21
push str.KillProcess_VRVSNIFFER.EXE
call fcn.00402603
add esp, 4
push str.VRVSNIFFER.EXE
push 0x70e51c
lea eax, [ebp - 0x12f8]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1478], eax
mov ecx, dword [ebp - 0x1478]
mov dword [ebp - 0x147c], ecx
mov byte [ebp - 4], 0x35
mov edx, dword [ebp - 0x147c]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12f8]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x22
push str.KillProcess_HOSTREGMON.EXE
call fcn.00402603
add esp, 4
push str.HOSTREGMON.EXE
push 0x70e51c
lea eax, [ebp - 0x12fc]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1480], eax
mov ecx, dword [ebp - 0x1480]
mov dword [ebp - 0x1484], ecx
mov byte [ebp - 4], 0x36
mov edx, dword [ebp - 0x1484]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12fc]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x23
push str.KillProcess_EDPNCLT.EXE
call fcn.00402603
add esp, 4
push str.EDPNCLT.EXE
push 0x70e51c
lea eax, [ebp - 0x1300]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1488], eax
mov ecx, dword [ebp - 0x1488]
mov dword [ebp - 0x148c], ecx
mov byte [ebp - 4], 0x37
mov edx, dword [ebp - 0x148c]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1300]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x24
push str.KillProcess_EDPVISTADLG.EXE
call fcn.00402603
add esp, 4
push str.EDPVISTADLG.EXE
push 0x70e51c
lea eax, [ebp - 0x1304]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1490], eax
mov ecx, dword [ebp - 0x1490]
mov dword [ebp - 0x1494], ecx
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0x1494]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1304]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x25
push str.KillProcess_EDPXCLT.EXE
call fcn.00402603
add esp, 4
push str.EDPXCLT.EXE
push 0x70e51c
lea eax, [ebp - 0x1308]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x1498], eax
mov ecx, dword [ebp - 0x1498]
mov dword [ebp - 0x149c], ecx
mov byte [ebp - 4], 0x39
mov edx, dword [ebp - 0x149c]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1308]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x26
push str.KillProcess_EDPSECURITYCHECK.EXE
call fcn.00402603
add esp, 4
push str.EDPSECURITYCHECK.EXE
push 0x70e51c
lea eax, [ebp - 0x130c]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x14a0], eax
mov ecx, dword [ebp - 0x14a0]
mov dword [ebp - 0x14a4], ecx
mov byte [ebp - 4], 0x3a
mov edx, dword [ebp - 0x14a4]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x130c]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x27
push str.KillProcess_EDPTOOLS.EXE
call fcn.00402603
add esp, 4
push str.EDPTOOLS.EXE
push 0x70e51c
lea eax, [ebp - 0x1310]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x14a8], eax
mov ecx, dword [ebp - 0x14a8]
mov dword [ebp - 0x14ac], ecx
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0x14ac]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1310]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x28
mov ecx, 0x70e508
call fcn.00401f64
push eax
push str.EDPAGENT
lea eax, [ebp - 0x1320]
push eax
call fcn.004025e5
add esp, 0xc
mov dword [ebp - 0x14b0], eax
mov ecx, dword [ebp - 0x14b0]
mov dword [ebp - 0x14b4], ecx
mov byte [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x14b4]
call fcn.00401f64
mov esi, esp
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.00491c30
mov dword [ebp - 0x111c], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1320]
call fcn.004020cc
cmp dword [ebp - 0x111c], 0
je 0x40810a
push 0
push 0
push 0x10
mov edx, dword [ebp - 0x111c]
push edx
call fcn.004020b3
add esp, 0x10
mov esi, esp
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00491c30
mov dword [0x70e948], 0x29
push str.KillProcess_EDPAGENT.EXE
call fcn.00402603
add esp, 4
push str.EDPAGENT.EXE
push 0x70e51c
lea eax, [ebp - 0x1324]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x14b8], eax
mov ecx, dword [ebp - 0x14b8]
mov dword [ebp - 0x14bc], ecx
mov byte [ebp - 4], 0x3d
mov edx, dword [ebp - 0x14bc]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1324]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x2a
push str.KillProcess_SECURITYCHECK.EXE
call fcn.00402603
add esp, 4
push str.SECURITYCHECK.EXE
push 0x70e51c
lea eax, [ebp - 0x1328]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x14c0], eax
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0x14c4], ecx
mov byte [ebp - 4], 0x3e
mov edx, dword [ebp - 0x14c4]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1328]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x2b
push str.KillProcess_SHOWMEMO.EXE
call fcn.00402603
add esp, 4
push str.SHOWMEMO.EXE
push 0x70e51c
lea eax, [ebp - 0x132c]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x14c8], eax
mov ecx, dword [ebp - 0x14c8]
mov dword [ebp - 0x14cc], ecx
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0x14cc]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x132c]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x2c
push str.KillProcess_PCCARE.EXE
call fcn.00402603
add esp, 4
push str.PCCARE.EXE
push 0x70e51c
lea eax, [ebp - 0x1330]
push eax
call fcn.0051bf2a
mov dword [ebp - 0x14d0], eax
mov ecx, dword [ebp - 0x14d0]
mov dword [ebp - 0x14d4], ecx
mov byte [ebp - 4], 0x40
mov edx, dword [ebp - 0x14d4]
push edx
lea ecx, [ebp - 0x109c]
call fcn.0051bcc6
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1330]
call fcn.0051bacc
push 1
push 0
lea ecx, [ebp - 0x109c]
call fcn.005744aa
push eax
lea ecx, [ebp - 0x10b8]
call fcn.004024be
mov dword [0x70e948], 0x2d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10e8]
call fcn.004020cc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10d8]
call fcn.004020cc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10c8]
call fcn.004020cc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10b8]
call fcn.00401857
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x109c]
call fcn.0051bacc
mov byte [ebp - 0x1334], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.0040125d
mov al, byte [ebp - 0x1334]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1514
cmp ebp, esp
call fcn.00491c30
mov esp, ebp
pop ebp
ret