Function at 0x49f2d0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60860b
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x160], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
lea eax, [ecx + 0x18]
push eax
lea eax, [ecx + 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00423fa0
add esp, 0xc
mov esi, eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov ecx, dword [ebx + 0x318]
push ecx
add ecx, 0x58
push ecx
push eax
call fcn.00423fa0
add esp, 0xc
lea edi, [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x49f357
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
lea ebx, [eax + 0x10]
jb 0x49f362
mov eax, dword [eax]
mov edi, dword [edi]
mov ecx, edi
mov ebx, dword [ebx]
cmp ebx, edi
cmovb ecx, ebx
test ecx, ecx
je 0x49f382
push ecx
push esi
push eax
call fcn.00433ef0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x49f38f
cmp edi, ebx
jbe 0x49f38b
or esi, 0xffffffff
jmp 0x49f38f
sbb esi, esi
neg esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x49f3a4
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x49f3d4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00434bd0
test esi, esi
jne 0x49f5f0
push 0x63f3e0
lea ecx, [ebp - 0x40]
call fcn.004347d0
push str.Incident_Start_Deletion
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.004347d0
mov edi, dword [ebp - 0x158]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x154]
push eax
lea eax, [ebp - 0x15c]
mov esi, dword [edi]
mov edi, dword [edi + 4]
lea ecx, [ebx + 0x18c]
push eax
call fcn.0041ca10
mov ecx, dword [ebp - 0x15c]
cmp ecx, dword [ebx + 0x190]
je 0x49f45d
mov eax, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x24]
cmp eax, ecx
je 0x49f45d
nop dword [eax]
cmp dword [eax + 0x50], esi
jne 0x49f454
cmp dword [eax + 0x54], edi
jne 0x49f454
cmp dword [eax + 0x58], 2
je 0x49f60e
add eax, 0xe0
cmp eax, ecx
jne 0x49f440
xor bl, bl
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x49f474
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x49f4a4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00434bd0
test bl, bl
jne 0x49f5f0
lea ecx, [ebp - 0x150]
call fcn.0049ca90
mov ebx, dword [ebp - 0x154]
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 2
push dword [ebx]
push eax
call fcn.004a6260
push 0x25
push str._deleted_the_incident_start_process:
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0041d8c0
mov esi, dword [ebp - 0x160]
lea eax, [ebp - 0x40]
push dword [esi + 0x318]
push eax
call fcn.004a6260
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0041d9d0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x49f521
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00434bd0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x158]
push 2
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 4]
push dword [eax]
push dword [ebx]
call fcn.004a5ef0
push str.Incident_Start_Deletion
lea ecx, [ebp - 0x28]
call fcn.004347d0
push ebx
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004a5b50
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x49f583
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00434bd0
push str.File_Deletion
lea ecx, [ebp - 0x70]
call fcn.004347d0
push ebx
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.004a5b50
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x49f5bc
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00434bd0
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x49f5d1
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x44], 7
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.00430c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 8
mov bl, 1
jmp 0x49f45f