Function at 0x423be2
Capabilities:
Enumerate processes

Disassembly:
push 0x294
mov eax, 0x62dc7f
call fcn.004e5a7f
mov esi, ecx
mov dword [ebp - 0x250], esi
xor ebx, ebx
lea edx, [ebp - 0x224]
mov dword [ebp - 0x218], ebx
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
call fcn.00413087
push dword [ebp - 0x224]
lea eax, [ebp - 0xa4]
push dword [ebp - 0x220]
push str._d._d
push eax
call fcn.00412ef9
add esp, 0x10
lea ecx, [esi + 0x98]
push eax
call fcn.004052f6
lea ecx, [ebp - 0xa4]
call fcn.004060fd
call fcn.00413197
test eax, eax
lea ecx, [ebp - 0x8c]
setne al
movzx eax, al
push eax
call fcn.004d82b0
mov edi, str.System
mov dword [ebp - 4], ebx
push edi
mov ecx, 0x6e52b8
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
mov esi, eax
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.004060b1
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00409503
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, 0x60
cmp dword [eax + 0x14], 0x10
jb 0x423cc1
mov eax, dword [eax]
lea ecx, [ebp - 0x8c]
push ecx
push eax
mov ecx, esi
call fcn.004d8a20
mov ecx, eax
call fcn.004d8510
lea ecx, [ebp - 0x44]
call fcn.004060fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004d84a0
push ebx
lea ecx, [ebp - 0x8c]
call fcn.004d82b0
push edi
mov ecx, 0x6e52b8
mov dword [ebp - 4], 2
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
mov esi, eax
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.004060b1
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00409503
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
cmp dword [eax + 0x14], 0x10
jb 0x423d49
mov eax, dword [eax]
lea ecx, [ebp - 0x8c]
push ecx
push eax
mov ecx, esi
call fcn.004d8a20
mov ecx, eax
call fcn.004d8510
lea ecx, [ebp - 0x44]
call fcn.004060fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004d84a0
push ecx
push str.root_unset
lea eax, [ebp - 0x240]
push eax
call fcn.0040fafc
cmp dword [eax + 4], ebx
je 0x423d91
mov eax, ebx
jmp 0x423d93
mov eax, dword [eax]
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.0040b066
mov esi, eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 4
push ebx
push eax
mov edx, str.SOFTWARE
mov ecx, reloc.WS2_32.dll_accept
call fcn.00412c32
lea eax, [ebp - 0x238]
mov edx, str.SOFTWARE
push ebx
push eax
mov ecx, reloc.WS2_32.dll_bind
call fcn.00412c32
lea eax, [ebp - 0x238]
mov edx, esi
push ebx
push eax
mov ecx, reloc.WS2_32.dll_accept
call fcn.00412c32
lea eax, [ebp - 0x238]
mov edx, esi
push ebx
push eax
mov ecx, reloc.WS2_32.dll_bind
call fcn.00412c32
add esp, 0x20
mov ecx, 0x6e52b8
push edi
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
mov edi, eax
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.004060b1
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00409503
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, 0x60
cmp dword [eax + 0x14], 0x10
jb 0x423e63
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.004d8a20
mov ecx, eax
call fcn.004d9650
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
mov bl, al
call fcn.004060fd
test bl, bl
je 0x423ede
mov edi, 0x100
lea eax, [ebp - 0x238]
push edi
mov ebx, str.SOFTWARE
mov ecx, reloc.WS2_32.dll_accept
push eax
mov edx, ebx
call fcn.00412c32
mov edx, ebx
lea eax, [ebp - 0x238]
push edi
mov ebx, reloc.WS2_32.dll_bind
push eax
mov ecx, ebx
call fcn.00412c32
lea eax, [ebp - 0x238]
mov edx, esi
push edi
push eax
lea ecx, [ebx - 1]
call fcn.00412c32
lea eax, [ebp - 0x238]
mov edx, esi
push edi
push eax
mov ecx, ebx
call fcn.00412c32
add esp, 0x20
push ecx
push str.root_kav_ide
lea eax, [ebp - 0x240]
push eax
call fcn.0040fafc
xor ebx, ebx
cmp dword [eax + 4], ebx
je 0x423efb
mov eax, ebx
jmp 0x423efd
mov eax, dword [eax]
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.0040b066
push 0xf
pop esi
push eax
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], esi
mov byte [ebp - 0xe8], bl
call fcn.004060b1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5c]
push 0x6c2ba8
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x5c], bl
call fcn.004060b1
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 7
push eax
lea edx, [ebp - 0xe8]
lea ecx, [ebp - 0x25c]
call fcn.00413449
pop ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.004060fd
mov eax, dword [ebp - 0x234]
mov edi, ebx
mov esi, dword [ebp - 0x238]
sub eax, esi
push 0x18
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x218], eax
test eax, eax
je 0x42422e
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.004060b1
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00409503
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, 0x30
cmp dword [eax + 0x14], 0x10
jb 0x423ff2
mov eax, dword [eax]
mov ecx, dword [ebp - 0x228]
push eax
call fcn.004d8a20
mov ecx, eax
call fcn.004d9650
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
mov bl, al
call fcn.004060fd
test bl, bl
jne 0x4241c1
mov eax, dword [ebp - 0x258]
xor ebx, ebx
mov ecx, dword [ebp - 0x25c]
sub eax, ecx
cdq
idiv dword [ebp - 0x22c]
mov dword [ebp - 0x220], ebx
test eax, eax
je 0x4241c3
mov edi, ebx
lea eax, [ecx + edi]
cmp dword [eax + 0x14], 0x10
jb 0x42404d
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00414fd5
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], ebx
mov byte [ebp - 0x29c], bl
movups xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x288], ebx
mov byte [ebp - 0x284], bl
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], ebx
mov byte [ebp - 0x278], bl
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov byte [ebp - 0x26c], bl
mov byte [ebp - 4], 0xc
mov edx, esi
cmp dword [esi + 0x14], 0x10
jb 0x4240ab
mov edx, dword [esi]
mov ecx, esi
jb 0x4240b1
mov ecx, dword [esi]
add ecx, dword [esi + 0x10]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x4240be
mov eax, dword [esi]
push edx
push ecx
push ecx
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x2a0]
call fcn.0042eaf3
add esp, 0x10
test al, al
jne 0x424125
lea ecx, [ebp - 0x298]
call fcn.0042ada1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 9
call fcn.00414fad
mov ecx, dword [ebp - 0x25c]
push 0x18
pop eax
add edi, eax
inc dword [ebp - 0x220]
mov eax, dword [ebp - 0x258]
sub eax, ecx
cdq
idiv dword [ebp - 0x22c]
cmp dword [ebp - 0x220], eax
jb 0x424042
mov edi, dword [ebp - 0x224]
jmp 0x4241c3
push 1
lea ecx, [ebp - 0x2c]
call fcn.004d82b0
push str.System
mov ecx, 0x6e52b8
mov byte [ebp - 4], 0xd
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], ebx
mov edi, eax
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], bl
call fcn.004060b1
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00409503
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, 0x30
cmp dword [eax + 0x14], 0x10
jb 0x424182
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, edi
call fcn.004d8a20
mov ecx, eax
call fcn.004d8510
lea ecx, [ebp - 0x74]
call fcn.004060fd
lea ecx, [ebp - 0x2c]
call fcn.004d84a0
lea ecx, [ebp - 0x298]
call fcn.0042ada1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 9
call fcn.00414fad
jmp 0x42411a
xor ebx, ebx
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
push str.Apps
mov ecx, eax
call fcn.004d8a20
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x228], eax
jb 0x4241ee
mov ecx, dword [esi]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004d8040
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x228]
push eax
call fcn.004d95f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004d84a0
push 0x18
inc edi
pop eax
add esi, eax
mov dword [ebp - 0x224], edi
cmp edi, dword [ebp - 0x218]
jb 0x423f9f
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push ebx
push 2
mov byte [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x214], 0x128
test edi, edi
je 0x4242c2
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
push str.Process
mov ecx, eax
call fcn.004d8a20
mov esi, eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x1f0]
push eax
call fcn.004d8040
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
push eax
mov ecx, esi
call fcn.004d95f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x10
call fcn.004d84a0
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x424262
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str._root_kav_item
lea eax, [ebp - 0xb8]
mov ecx, 0x6e5350
push eax
call fcn.0040fb54
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0xac]
jmp 0x4245e3
mov esi, dword [eax]
lea ecx, [ebp - 0x2c]
mov eax, dword [eax + 4]
push ebx
mov dword [ebp - 0x220], eax
call fcn.004d82b0
push str.System
mov ecx, 0x6e52b8
mov byte [ebp - 4], 0x13
call fcn.004d8a20
mov edi, eax
mov ecx, esi
xor eax, eax
cmp dword [ebp - 0x220], eax
push str.name
cmovne ecx, eax
lea eax, [ebp - 0x268]
mov dword [ebp - 0x218], ecx
lea ecx, [ebp - 0x218]
push eax
call fcn.0040af6c
mov ecx, eax
call fcn.0040af21
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, edi
call fcn.004d8a20
mov ecx, eax
call fcn.004d8510
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
call fcn.004d84a0
push 0x6c2ba8
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], bl
call fcn.004060b1
xor ecx, ecx
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x220], ecx
mov eax, esi
cmovne eax, ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], eax
call fcn.0040afea
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], bl
call fcn.004060b1
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 0x15
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x50]
call fcn.00413449
pop ecx
lea ecx, [ebp - 0x74]
call fcn.004060fd
push 0x18
pop eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], al
call fcn.004060fd
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x50]
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x22c], ebx
test eax, eax
je 0x4245ce
mov dword [ebp - 0x224], ebx
push str.System
mov ecx, 0x6e52b8
mov edi, ebx
call fcn.004d8a20
push str.Process
mov ecx, eax
call fcn.004d8a20
mov ecx, eax
call fcn.004dabb0
test eax, eax
je 0x42454f
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
push str.Process
mov ecx, eax
call fcn.004d8a20
push edi
mov ecx, eax
call fcn.004d87b0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.004d99d0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x224]
add ecx, dword [ebp - 0x50]
cmp dword [ecx + 0x14], 0x10
jb 0x424478
mov ecx, dword [ecx]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4244cd
push 0x18
pop eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], al
call fcn.004060fd
push str.System
mov ecx, 0x6e52b8
inc edi
call fcn.004d8a20
push str.Process
mov ecx, eax
call fcn.004d8a20
mov ecx, eax
call fcn.004dabb0
cmp edi, eax
jb 0x424435
jmp 0x42454f
push 1
lea ecx, [ebp - 0xa4]
call fcn.004d82b0
push str.System
mov ecx, 0x6e52b8
mov byte [ebp - 4], 0x1a
call fcn.004d8a20
mov edi, eax
mov ecx, esi
xor eax, eax
cmp dword [ebp - 0x220], eax
push str.name
cmovne ecx, eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x218], ecx
lea ecx, [ebp - 0x218]
push eax
call fcn.0040af6c
mov ecx, eax
call fcn.0040af21
lea ecx, [ebp - 0xa4]
push ecx
push eax
mov ecx, edi
call fcn.004d8a20
mov ecx, eax
call fcn.004d8510
lea ecx, [ebp - 0xa4]
call fcn.004d84a0
push 0x18
pop eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], al
call fcn.004060fd
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
mov edi, eax
mov ecx, esi
xor eax, eax
cmp dword [ebp - 0x220], eax
push str.name
cmovne ecx, eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x218], ecx
lea ecx, [ebp - 0x218]
push eax
call fcn.0040af6c
mov ecx, eax
call fcn.0040af21
push eax
mov ecx, edi
call fcn.004d8a20
mov ecx, eax
call fcn.004d9650
cmp al, 1
je 0x4245ce
push 0x18
pop eax
add dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x50]
push 0x18
cdq
pop edi
idiv edi
mov ecx, dword [ebp - 0x22c]
inc ecx
mov dword [ebp - 0x22c], ecx
cmp ecx, eax
jb 0x424409
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x12
call fcn.00409827
mov eax, dword [ebp - 0x228]
add eax, 8
mov dword [ebp - 0x228], eax
cmp eax, dword [ebp - 0xa8]
jne 0x4242e8
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
mov esi, eax
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.004060b1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0x218], 1
push eax
call fcn.00409503
push 0x18
pop edi
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, edi
cmp dword [eax + 0x14], 0x10
jb 0x424650
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004d8a20
mov ecx, eax
call fcn.004d9650
test al, al
jne 0x424673
call fcn.0041ef28
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x424679
mov byte [ebp - 0x219], bl
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0x12
call fcn.004060fd
cmp byte [ebp - 0x219], 0
je 0x424749
call fcn.0041f0cc
test eax, eax
jne 0x4246bd
call fcn.0041f22a
test eax, eax
jne 0x4246bd
call fcn.0041f405
test eax, eax
jne 0x4246bd
call fcn.0041f49a
test eax, eax
je 0x424749
push 1
lea ecx, [ebp - 0xa4]
call fcn.004d82b0
push str.System
mov ecx, 0x6e52b8
mov byte [ebp - 4], 0x1c
call fcn.004d8a20
push 0x6c2c20
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
mov esi, eax
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.004060b1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00409503
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, edi
cmp dword [eax + 0x14], 0x10
jb 0x42471c
mov eax, dword [eax]
lea ecx, [ebp - 0xa4]
push ecx
push eax
mov ecx, esi
call fcn.004d8a20
mov ecx, eax
call fcn.004d8510
lea ecx, [ebp - 0x2c]
call fcn.004060fd
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x12
call fcn.004d84a0
push ecx
push str.root_kav_order
lea eax, [ebp - 0x240]
push eax
call fcn.0040fafc
cmp dword [eax + 4], ebx
je 0x424764
mov eax, ebx
jmp 0x424766
mov eax, dword [eax]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], eax
call fcn.0040b066
push eax
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], bl
call fcn.004060b1
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x2c]
push 0x6c2ba8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.004060b1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
push eax
lea edx, [ebp - 0xd0]
lea ecx, [ebp - 0x24c]
call fcn.00413449
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x21
call fcn.004060fd
mov eax, dword [ebp - 0x248]
mov esi, ebx
sub eax, dword [ebp - 0x24c]
cdq
idiv edi
test eax, eax
je 0x424842
mov edi, ebx
push str.System
mov ecx, 0x6e52b8
call fcn.004d8a20
mov ecx, dword [ebp - 0x24c]
add ecx, edi
cmp dword [ecx + 0x14], 0x10
jb 0x424813
mov ecx, dword [ecx]
push ecx
mov ecx, eax
call fcn.004d8a20
mov ecx, eax
call fcn.004d9650
cmp al, 1
jne 0x424829
bts ebx, esi
mov eax, dword [ebp - 0x248]
inc esi
sub eax, dword [ebp - 0x24c]
push 0x18
pop ecx
cdq
add edi, ecx
idiv ecx
cmp esi, eax
jb 0x4247f4
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
mov dword [eax + 0xf8], ebx
call fcn.00409827
lea ecx, [ebp - 0xd0]
call fcn.004060fd
lea ecx, [ebp - 0xb8]
call fcn.0040f6ec
lea ecx, [ebp - 0x38]
call fcn.00409827
lea ecx, [ebp - 0x25c]
call fcn.00409827
lea ecx, [ebp - 0xe8]
call fcn.004060fd
lea ecx, [ebp - 0x238]
call fcn.00409827
call fcn.004e5a3a
ret