Function at 0x425640
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66fe88
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0xbf4
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xbe0], ebx
mov byte [ebp - 0xb48], bl
push 0x40f
push ebx
lea eax, [ebp - 0xb47]
push eax
call fcn.005dfd60
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [0x6afbd4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00418430
mov eax, dword [0x6ae128]
lea edi, [ebx + 1]
cmp eax, ebx
jne 0x425864
push ebx
push edi
push str.Starting_Initialization
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x6b0550]
cmp eax, ebx
je 0x42571a
push eax
push str.Waiting___u_secs__before_MSI_BdInitialize_and_then_going_to_next_step...
lea edx, [ebp - 0x120]
push edx
call fcn.005dfb23
push ebx
push edi
lea eax, [ebp - 0x120]
push eax
push 0x6aec98
call fcn.004311c0
mov ecx, dword [0x6b0550]
push ecx
call fcn.004d84d0
add esp, 0x20
cmp dword [0x6ae130], edi
jne 0x425739
push ebx
mov edx, dword [0x67e110]
push edx
push 0x6af2b0
call fcn.004780b0
add esp, 0xc
jmp 0x425746
push 0x6af2b0
call fcn.0043da40
add esp, 4
mov esi, eax
mov eax, dword [0x6b0550]
cmp eax, ebx
je 0x425786
push esi
push eax
push str.Waiting___u_secs__MSI_BdInitialize_finished__and_then_going_to_next_step__hr__0x_x_...
lea eax, [ebp - 0x120]
push eax
call fcn.005dfb23
push ebx
push edi
lea ecx, [ebp - 0x120]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [0x6b0550]
push edx
call fcn.004d84d0
add esp, 0x24
cmp esi, ebx
jge 0x425840
push esi
push str.Error:_Initialization_Failed._Return_Code:_0x_x
lea eax, [ebp - 0xb48]
push eax
call fcn.005dfb23
push ebx
push edi
lea ecx, [ebp - 0xb48]
push ecx
push 0x6aec98
call fcn.004311c0
push 0x60cf3c
push str.MonitorStatus
push 0x60c810
call fcn.004ee3d0
push ebx
push str.MonitorStatusExt
push 0x60c810
call fcn.004ee3d0
add esp, 0x34
push ebx
push str.MonitorStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e110], ebx
je 0x425829
call fcn.004d9930
test eax, eax
jne 0x425829
call fcn.004d9b00
cmp eax, edi
jne 0x425824
push ebx
push edi
push str.Invoking_SetAVStatusToMonitorEnabled_For_Failed_Init
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.00421380
jmp 0x425829
call fcn.004250d0
mov dword [0x6861b4], ebx
mov dword [0x6b3cf4], ebx
mov dword [0x6ae128], ebx
jmp 0x4263bb
mov dword [0x6ae128], edi
mov dword [0x6b3cf4], edi
mov dword [ebp - 0xbe0], edi
mov edx, dword [0x6ade78]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x6ae128]
cmp eax, edi
jne 0x426029
cmp dword [0x6ae12c], ebx
jne 0x426029
xor edi, edi
mov dword [ebp - 0xc04], edi
push ebx
push 1
push 0x6143ec
push 0x6aec98
call fcn.004311c0
push ebx
push 1
push str.Loading_File_Monitor
push 0x6aec98
call fcn.004311c0
push 0x615678
push str.MonitorStatus
push 0x60c810
call fcn.004ee3d0
push ebx
push str.MonitorStatusExt
push 0x60c810
call fcn.004ee3d0
add esp, 0x38
push 1
push str.MonitorStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e110], ebx
je 0x4259ab
call fcn.004d9930
test eax, eax
jne 0x4259ab
call fcn.004d9b00
cmp eax, 1
jne 0x4259a6
mov dword [ebp - 0xbfc], ebx
lea eax, [ebp - 0xbfc]
push eax
push str.DoNotSetSecurityStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x6b0548], ebx
jne 0x425939
cmp dword [ebp - 0xbfc], ebx
je 0x42598a
push 0x60cf3c
push str.MonitorStatus
push 0x60c810
call fcn.004ee3d0
push ebx
push str.MonitorStatusExt
push 0x60c810
call fcn.004ee3d0
add esp, 0x18
push ebx
push str.MonitorStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push 1
push str.FORCIBLY_SETTING_MONITOR_STATUS_TO_0__A_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push ebx
push 1
push str.Invoking_SetAVStatusToMonitorEnabled_For_Loading_Mon
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.00421380
jmp 0x4259ab
call fcn.004250d0
cmp dword [0x6ae130], ebx
jne 0x4259e3
push 1
push str.klif
call fcn.004d8010
add esp, 8
push ebx
push 1
cmp eax, 1
jne 0x4259d1
push str.Klif_Service_Present_And_Running
jmp 0x4259d6
push str.Klif_Service_Not_Running
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.004d9930
test eax, eax
jne 0x425b6f
mov dword [ebp - 0xbf0], 0xffffffff
mov dword [ebp - 0xc00], ebx
lea ecx, [ebp - 0xbf0]
push ecx
push str.WinOSValue
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea edx, [ebp - 0xc00]
push edx
push str.Win10Build
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.004f79d0
test eax, eax
je 0x425a7a
mov dword [ebp - 0xbdc], ebx
push 0x90
push ebx
lea eax, [ebp - 0xbd8]
push eax
call fcn.005dfd60
add esp, 0xc
mov esi, 5
push ebx
lea ecx, [ebp - 0xbdc]
push ecx
call fcn.004f4a40
mov edi, dword [ebp - 0xbd0]
mov dword [ebp - 0xc04], edi
jmp 0x425a98
call fcn.004f78e0
test eax, eax
je 0x425a8a
mov esi, 4
jmp 0x425a98
call fcn.004d9950
mov esi, eax
neg esi
sbb esi, esi
neg esi
inc esi
mov eax, dword [ebp - 0xbf0]
cmp eax, 0xffffffff
je 0x425aa7
cmp eax, esi
jne 0x425ab3
cmp edi, ebx
je 0x425ac7
cmp dword [ebp - 0xc00], edi
je 0x425ac7
push str.FirewallDriverChecked
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
call fcn.004d9950
test eax, eax
jne 0x425ad9
call fcn.004f78e0
test eax, eax
je 0x425b41
mov dword [ebp - 0xbf8], ebx
lea edx, [ebp - 0xbf8]
push edx
push str.FirewallDriverChecked
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov eax, dword [ebp - 0xbf8]
push eax
push str.Starting_eScan_Firewall_Check_Status_Thread___u_...
lea ecx, [ebp - 0x120]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0x120]
push edx
push 0x6aec98
call fcn.004311c0
push ebx
push ebx
push 0x420780
call fcn.005e07ac
push ebx
push eax
push str.AVM_2a
call fcn.00411ca0
add esp, 0x34
push esi
push str.WinOSValue
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp edi, ebx
je 0x425b6f
push edi
push str.Win10Build
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov eax, dword [0x6b0550]
cmp eax, ebx
je 0x425bad
push eax
push str.Waiting___u_secs__before_MSI_BdLoadMonitorEx_and_then_going_to_next_step...
lea eax, [ebp - 0x120]
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x120]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [0x6b0550]
push edx
call fcn.004d84d0
add esp, 0x20
cmp dword [0x6ae130], 1
jne 0x425bbd
call fcn.0049b180
jmp 0x425bc2
call fcn.0043e540
mov esi, eax
mov eax, dword [0x6b0550]
cmp eax, ebx
je 0x425c09
push esi
push eax
push str.Waiting___u_secs___MSI_BdLoadMonitorEx_finished__and_then_going_to_next_step__hr__0x_x_...
lea eax, [ebp - 0x120]
push eax
call fcn.005dfb23
push ebx
mov edi, 1
push edi
lea ecx, [ebp - 0x120]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [0x6b0550]
push edx
call fcn.004d84d0
add esp, 0x24
jmp 0x425c0e
mov edi, 1
cmp esi, ebx
jge 0x425cd1
push esi
push str.Error:_Loading_Monitor_Failed._Result_Code:_0x_x
lea eax, [ebp - 0xb48]
push eax
call fcn.005dfb23
push ebx
push edi
lea ecx, [ebp - 0xb48]
push ecx
push 0x6aec98
call fcn.004311c0
push 0x60cf3c
push str.MonitorStatus
push 0x60c810
call fcn.004ee3d0
push ebx
push str.MonitorStatusExt
push 0x60c810
call fcn.004ee3d0
add esp, 0x34
push ebx
push str.MonitorStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e110], ebx
je 0x425cc0
call fcn.004d9930
test eax, eax
jne 0x425cc0
call fcn.004d9b00
cmp eax, edi
jne 0x425cbb
push ebx
push edi
push str.Invoking_SetAVStatusToMonitorEnabled_For_Failed_Mon_Load
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.00421380
mov dword [0x6861b4], ebx
mov dword [0x6ae12c], ebx
jmp 0x4263bb
call fcn.004250d0
mov dword [0x6861b4], ebx
mov dword [0x6ae12c], ebx
jmp 0x4263bb
mov dword [0x6ae12c], edi
push ebx
push edi
push str.Success:_File_Monitor_Successfully_Loaded.
push 0x6aec98
call fcn.004311c0
push ebx
push edi
push 0x6143ec
push 0x6aec98
call fcn.004311c0
push 0x615678
push str.MonitorStatus
push 0x60c810
call fcn.004ee3d0
push ebx
push str.MonitorStatusExt
push 0x60c810
call fcn.004ee3d0
add esp, 0x38
push edi
push str.MonitorStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e110], ebx
je 0x425dcf
call fcn.004d9b00
cmp eax, edi
jne 0x425dcf
mov dword [ebp - 0xbec], ebx
lea edx, [ebp - 0xbec]
push edx
push str.DoNotSetSecurityStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x6b0548], ebx
jne 0x425d7f
cmp dword [ebp - 0xbec], ebx
je 0x425dcf
push 0x60cf3c
push str.MonitorStatus
push 0x60c810
call fcn.004ee3d0
push ebx
push str.MonitorStatusExt
push 0x60c810
call fcn.004ee3d0
add esp, 0x18
push ebx
push str.MonitorStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push edi
push str.FORCIBLY_SETTING_MONITOR_STATUS_TO_0__B_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp - 0xbe0], ebx
je 0x425f8c
mov dword [ebp - 0xbe0], 0x3c
mov eax, dword [0x6ae144]
neg eax
sbb eax, eax
and eax, 0x3c
mov dword [ebp - 0xbe0], eax
lea ecx, [ebp - 0xbe0]
push ecx
push str.SendSessionEvents
push str.SoftwareMicroWorldeScan_for_Windows
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0xbe0], ebx
je 0x425f0c
mov dword [ebp - 0xbf4], ebx
cmp byte [0x6b2b48], bl
jne 0x425e67
push 0x6af4b8
push str._sESCAN.LAN
push 0x6b2b48
call fcn.005dfb23
add esp, 0xc
push 0x6b2b48
push 0x104
push 0x6b2a40
push 0x6195b8
push 0x6195b4
push str.SCANINST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0xbf4]
push edx
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.004f4f50
mov ecx, dword [ebp - 0xbf4]
cmp ecx, ebx
jbe 0x425f5d
cmp eax, ecx
jae 0x425f40
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.005dfd60
mov dword [0x6861b4], edi
push ebx
lea ecx, [ebp - 0x224]
push ecx
call fcn.004f00d0
lea edx, [ebp - 0x224]
push edx
push str.PC_STARTUP___s_
lea eax, [ebp - 0x120]
push eax
call fcn.005dfb23
add esp, 0x20
push ebx
push str.eScan_Monitor
push 0x6b2a40
lea ecx, [ebp - 0x120]
push ecx
push 0x60c810
push ebx
push str.eScan_Monitor
push 0x6b1
call fcn.00513910
jmp 0x425f63
mov dword [ebp - 0xbe8], ebx
lea edx, [ebp - 0xbe8]
push edx
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.004f4f50
mov ecx, dword [ebp - 0xbe8]
cmp ecx, ebx
jbe 0x425f5d
cmp eax, ecx
jb 0x425f5d
push eax
push str.EPSNow
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x6861b4], ebx
jmp 0x425f63
mov dword [0x6861b4], edi
cmp dword [0x6b0544], ebx
jne 0x425f92
push 0x6af4b8
push ebx
push 0x54c330
call fcn.005e07ac
push ebx
push eax
push str.AVM_2b
call fcn.00411ca0
add esp, 0x18
jmp 0x425f92
mov dword [0x6861b4], ebx
cmp dword [0x6b0760], ebx
jne 0x426019
mov eax, dword [0x6ade80]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x426019
mov byte [ebp - 0x530], bl
push 0x207
push ebx
lea ecx, [ebp - 0x52f]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x738], bl
push 0x207
push ebx
lea edx, [ebp - 0x737]
push edx
call fcn.005dfd60
push 0x208
lea eax, [ebp - 0x530]
push eax
call fcn.004d8c20
lea ecx, [ebp - 0x530]
push ecx
push str.Unable_to_set_MonEnabled_Event__Reason:__s
lea edx, [ebp - 0x738]
push edx
call fcn.005dfb23
push ebx
push edi
lea eax, [ebp - 0x738]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x3c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xbe4], edi
jmp 0x42604e
mov dword [0x6861b4], ebx
cmp eax, edi
jne 0x4263bb
cmp dword [0x6ae12c], edi
jne 0x4263bb
mov dword [ebp - 0xbe4], edi
mov edi, 1
cmp dword [0x6b07c4], edi
jne 0x4263bb
cmp dword [0x6b07c8], 1
jne 0x4263bb
mov byte [ebp - 0x328], bl
push 0x103
push ebx
lea ecx, [ebp - 0x327]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea edx, [ebp - 0x11f]
push edx
call fcn.005dfd60
add esp, 0x18
mov dword [0x6b07c8], ebx
push 0x6ae140
push str.FileRightsValue
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6b07cc
push str.FileInfectorDetectedEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6e91c4
push str.LogFilesCopiedToUSB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x426109
mov eax, dword [0x6e91c4]
push eax
push str.LogFilesCopiedToUSB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x685bbc
push str.BlockFileRenamesToMultipleExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x426141
mov ecx, dword [0x685bbc]
push ecx
push str.BlockFileRenamesToMultipleExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6e91c8
push str.NetworkSharesAccessControl
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x426183
xor eax, eax
cmp dword [0x6ae144], ebx
setne al
mov dword [0x6e91c8], eax
push eax
push str.NetworkSharesAccessControl
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push str.NetworkSharesNoAccess
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e02e0
add esp, 0x10
mov edi, eax
cmp edi, ebx
jne 0x4261ba
push 0x60c81c
push str.NetworkSharesNoAccess
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push ebx
push str.NetworkSharesReadOnlyAccess
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e02e0
add esp, 0x10
mov esi, eax
cmp esi, ebx
jne 0x4261f1
push 0x60c81c
push str.NetworkSharesReadOnlyAccess
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
cmp edi, ebx
je 0x4261fe
push edi
call fcn.005e0865
add esp, 4
cmp esi, ebx
je 0x42620b
push esi
call fcn.005e0865
add esp, 4
mov eax, 4
cmp dword [0x6ae140], eax
je 0x426225
cmp dword [0x6b07cc], ebx
je 0x426225
mov dword [0x6ae140], eax
test byte [0x6e91c4], al
je 0x42623b
push str.MWFSFLT
push 1
push str.Resuming_mwfsmflt__Network_File_Operations_Monitoring_...
jmp 0x4262a8
cmp dword [0x685bbc], ebx
je 0x426251
push str.MWFSFLT
push 1
push str.Resuming_mwfsmflt__Block_File_Renames_for_Ransomware_...
jmp 0x4262a8
cmp dword [0x6e91c8], ebx
je 0x426267
push str.MWFSFLT
push 1
push str.Resuming_mwfsmflt__Network_Access_Control_...
jmp 0x4262a8
cmp dword [0x6b07cc], ebx
je 0x42627d
push str.MWFSFLT
push 1
push str.Resuming_mwfsmflt__File_Infectors_Detected_...
jmp 0x4262a8
cmp dword [0x67e10c], ebx
je 0x42629c
call fcn.004d5950
test eax, eax
je 0x42629c
push str.MWFSFLT
push 1
push str.Resuming_mwfsmflt__EndPoint_feature_Detected_...
jmp 0x4262a8
push str.MWFSFLT
push 1
push str.Resuming_mwfsmflt...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x67e10c], ebx
je 0x4262cd
call fcn.004d5950
test eax, eax
je 0x4262cd
mov eax, 1
jmp 0x4262cf
xor eax, eax
lea edx, [ebp - 0x328]
push edx
push eax
mov eax, dword [0x685bbc]
push eax
mov ecx, dword [0x6e91c8]
push ecx
mov edx, dword [0x6e91c4]
push edx
mov eax, dword [0x6ae140]
push eax
call fcn.00535300
add esp, 0x18
test eax, eax
jne 0x426330
lea ecx, [ebp - 0x328]
push ecx
push str._A_ChangeProtectionState_failed___s_
lea edx, [ebp - 0x120]
push edx
call fcn.005dfb23
push str.MWFSFLT
push 1
lea eax, [ebp - 0x120]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
test byte [0x6e91c4], 4
jne 0x426359
mov ecx, dword [0x72bb90]
push ecx
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x426359
mov edx, dword [0x72bb90]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x6ae140], ebx
je 0x426374
push ebx
push str.c:windows_system32_svchost.exe
call fcn.005340f0
add esp, 8
call fcn.00536760
push ebx
mov eax, dword [0x6ae140]
push eax
call fcn.005373e0
cmp dword [0x6e91c8], ebx
je 0x426393
push 1
push ebx
call fcn.00418a70
add esp, 8
cmp dword [0x67e110], ebx
je 0x4263bb
call fcn.00430ef0
mov dword [0x732760], eax
push 1
call fcn.00418e10
add esp, 4
mov ecx, dword [0x732760]
mov dword [0x732764], ecx
cmp dword [0x6b0760], ebx
je 0x42640b
cmp dword [0x6ae12c], ebx
je 0x4263dc
mov edx, dword [0x6ade80]
push edx
call fcn.00477d90
add esp, 4
jmp 0x4263f1
push ebx
push 1
push str._FSIG__Monitor_Load_Failed__Not_Loading_Full_Signatures...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push str.ZTempLoad
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
mov dword [0x6b0760], ebx
call fcn.004205d0
mov eax, dword [0x6afbd4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00413850
call fcn.00418f40
jmp 0x426440
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0xbe4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret