Function at 0x40f030
Capabilities:
Check mutex on windows
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd9b7
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x18]
push str.kernel32.dll
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2c4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test esi, esi
je 0x40f165
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x40f0c1
push str.SetDllDirectoryW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f0b6
push esi
call eax
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x40f0c8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x40f1c9
lea eax, [ebp - 0x264]
push 2
push eax
call fcn.00416f00
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40f122
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, dword [ebp - 0x250]
cmp edx, 8
jb 0x40f1c9
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f1bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f1bf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
xor edi, edi
test esi, esi
je 0x40f197
push str.SetDllDirectoryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f18c
push 0x4f0da4
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x40f19e
push 0x4f0da4
call ebx
lea eax, [ebp - 0x264]
push 2
push eax
call fcn.00416f00
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40f1b7
mov eax, dword [eax]
push eax
call ebx
jmp 0x40f129
push edx
push ecx
call fcn.004bee2d
add esp, 8
lea eax, [ebp - 0x234]
push 7
push eax
call fcn.00416f00
add esp, 8
cmp dword [ebp - 0x224], 0
je 0x40f203
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
push str.WPS_OFFICE6_ROOT_DIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x40f243
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f239
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov dword [ebp - 0x2b4], 0
call fcn.004101c0
push 0x43
xor eax, eax
mov dword [ebp - 0x224], 0
push str.HKCUSoftwareKingsoftOffice6.0CommonupdateinfocacheStatusInfo
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.004033b0
push str.RunningPid
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00404b80
add esp, 0xc
mov edx, dword [ebp - 0x220]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x40f2e7
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f2dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x224], 0
cmp dword [ebp - 0x268], 8
lea esi, [ebp - 0x27c]
push eax
cmovae esi, dword [ebp - 0x27c]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
call fcn.0044bd90
mov edx, dword [ebp - 0x268]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x40f370
mov ecx, dword [ebp - 0x27c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f366
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
call fcn.0040ed90
push dword [ebp - 0x2b8]
push dword [ebp - 0x2c0]
call fcn.0041d400
mov ebx, dword [ebp - 0x2bc]
push ebx
push str.kupdate::Execute_cmd__s_
push str.kupdate::Execute
push 0xed
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 4
call fcn.00412750
add esp, 0x20
push 1
push ebx
call fcn.004104b0
mov ecx, eax
call fcn.00413c10
mov edi, eax
call fcn.00410410
mov ecx, eax
call fcn.00446780
test eax, eax
je 0x40f49a
push dword [0x4fef28]
call fcn.004104b0
mov ecx, eax
call fcn.00413b30
test al, al
jne 0x40f3fe
push dword [0x4fef10]
push dword [0x4fef28]
call fcn.004104b0
mov ecx, eax
call fcn.00414960
push dword [0x4fef48]
call fcn.004104b0
mov ecx, eax
call fcn.00413b30
test al, al
jne 0x40f49a
push dword [0x4fef28]
lea eax, [ebp - 0x264]
push eax
call fcn.004104b0
mov ecx, eax
call fcn.00413a10
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 3
jb 0x40f440
mov eax, dword [eax]
push eax
push dword [0x4fef48]
call fcn.004104b0
mov ecx, eax
call fcn.00414960
mov edx, dword [ebp - 0x250]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x40f49a
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f490
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5421c0]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x540fac]
cmp eax, dword [esi + 4]
jg 0x40fd11
push 1
mov ecx, 0x540fa8
call fcn.0044e090
mov eax, dword [0x540fec]
cmp eax, dword [esi + 4]
jg 0x40fd5f
test edi, edi
js 0x40f791
call fcn.0043b7e0
test al, al
jne 0x40f782
call fcn.004d6ef0
test al, al
mov edx, str.Global_UPD_Session_MutexName_WpsPdf
mov ecx, str.Global_UPD_Session_MutexName_
cmovne ecx, edx
push ecx
push 0
push 0
mov dword [ebp - 0x2bc], ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x2c0], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 6
test esi, esi
je 0x40f540
cmp esi, 0xffffffff
je 0x40f540
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f609
push dword [0x4fef74]
call fcn.004104b0
mov ecx, eax
call fcn.00413b30
test al, al
jne 0x40f570
push dword [0x4fefc4]
call fcn.004104b0
mov ecx, eax
call fcn.00413b30
test al, al
je 0x40f5fb
mov ebx, 4
push ebx
push str.Try_wait_mutex__d_.
push str._anonymous_namespace::CreateUpdateMutex
push 0x53
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 7
call fcn.00412750
add esp, 0x18
test esi, esi
je 0x40f59d
cmp esi, 0xffffffff
je 0x40f59d
push esi
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x2bc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, esi
je 0x40f5d6
test esi, esi
je 0x40f5ce
cmp esi, 0xffffffff
je 0x40f5ce
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
mov dword [ebp - 0x2c0], esi
test esi, esi
je 0x40f5ec
cmp esi, 0xffffffff
je 0x40f5ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f609
sub ebx, 1
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jns 0x40f575
test esi, esi
je 0x40f607
cmp esi, 0xffffffff
je 0x40f607
push esi
call edi
xor esi, esi
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 4], 7
test esi, esi
je 0x40f6a4
cmp esi, 0xffffffff
je 0x40f6a4
push 0
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], 0
push eax
push str.HKCUSoftwareKingsoftOffice6.0CommonupdateinfoDbgBanUpdEnable
call fcn.0044b690
add esp, 0xc
cmp dword [ebp - 0x2b8], 0
jne 0x40f684
lea ecx, [ebp - 0x9c]
call fcn.004233a0
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 8
push eax
call fcn.0041eb90
add esp, 4
mov dword [ebp - 0x2b4], eax
lea ecx, [ebp - 0x9c]
call fcn.00423750
jmp 0x40f75e
push str.wpsupdate_is_banned__skip_run
push str.kupdate::Execute
push 0x11e
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 4
call fcn.00412750
jmp 0x40f75b
push dword [0x4ff018]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, eax
test ebx, ebx
je 0x40f6f0
lea ecx, [ebp - 0x2ad]
call fcn.0040ecd0
test al, al
je 0x40f6f0
push str.Another_instance_of_wpsupdate_is_running_set_event.
push str.kupdate::Execute
push 0x105
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 4
call fcn.00412750
add esp, 0x14
push ebx
call edi
push dword [0x4ff01c]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebx, eax
test ebx, ebx
je 0x40f736
lea ecx, [ebp - 0x2ad]
call fcn.0040ecd0
test al, al
je 0x40f736
push str.Another_instance_of_wpsupdate_is_running_set_hShowUIEvent.
push str.kupdate::Execute
push 0x10c
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 4
call fcn.00412750
add esp, 0x14
push ebx
call edi
push str.Another_instance_of_wpsupdate_is_running__exit.
push str.kupdate::Execute
push 0x110
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 4
call fcn.00412750
mov dword [ebp - 0x2b4], 0xffffffff
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40f860
cmp esi, 0xffffffff
je 0x40f860
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f860
mov dword [ebp - 0x2b4], 1
jmp 0x40f860
push ebx
push str.Faild_parse_command_line:__s.
push str.kupdate::Execute
push 0x129
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 0
call fcn.00412750
mov ecx, ebx
mov dword [ebp - 0x224], 0
add esp, 0x18
mov dword [ebp - 0x220], 7
xor eax, eax
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f7d2
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x234]
call fcn.004033b0
mov eax, dword [0x5405c0]
mov dword [ebp - 4], 9
cmp eax, dword [esi + 4]
jg 0x40fdad
lea eax, [ebp - 0x234]
mov ecx, 0x5405bc
push eax
push 1
call fcn.004131f0
mov edx, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x40f860
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f856
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
push dword [0x4fef60]
call fcn.004104b0
mov ecx, eax
call fcn.00413b30
test al, al
je 0x40f8b0
push dword [0x4fef60]
lea eax, [ebp - 0x264]
push eax
call fcn.004104b0
mov ecx, eax
call fcn.00413a10
push dword [0x4fef64]
mov dword [ebp - 0x2c4], 1
push eax
call fcn.0040e720
add esp, 8
test al, al
je 0x40f8b0
mov bl, 1
jmp 0x40f8b2
xor bl, bl
test byte [ebp - 0x2c4], 1
je 0x40f8fb
mov edx, dword [ebp - 0x250]
cmp edx, 8
jb 0x40f8fb
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f8f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
test bl, bl
je 0x40f908
call fcn.0041f8e0
test al, al
je 0x40f90d
call fcn.0041f080
push dword [0x4fef5c]
lea eax, [ebp - 0x264]
push eax
call fcn.004104b0
mov ecx, eax
call fcn.00413a10
mov esi, eax
push 0x40
xor eax, eax
mov dword [ebp - 4], 0xa
push str.HKCUSoftwareKingsoftOffice6.0CommonupdateinfoExecuteState
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.004033b0
push 0x4f0efc
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00404b80
add esp, 0xc
mov edx, eax
mov ecx, dword [edx + 0x14]
mov ebx, dword [edx + 0x10]
sub ecx, ebx
mov edi, dword [esi + 0x10]
mov byte [ebp - 4], 0xc
cmp edi, ecx
jbe 0x40f9b0
mov eax, dword [esi + 0x14]
sub eax, edi
cmp eax, ebx
jb 0x40f9b0
cmp dword [edx + 0x14], 8
jb 0x40f9a3
mov edx, dword [edx]
push ebx
push edx
push 0
mov ecx, esi
call fcn.0040a600
jmp 0x40f9c1
cmp dword [esi + 0x14], 8
jb 0x40f9b8
mov esi, dword [esi]
push edi
push esi
mov ecx, edx
call fcn.00403230
mov edx, eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
mov ecx, dword [edx]
mov dword [ebp - 0x24c], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x248], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x244], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x240], ecx
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x23c], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x238], eax
xor eax, eax
mov word [edx], ax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0x268]
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x40fa5f
mov ecx, dword [ebp - 0x27c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fa55
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 7
mov word [ebp - 0x27c], ax
mov edx, dword [ebp - 0x220]
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x40fac0
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fab6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
mov edx, dword [ebp - 0x250]
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x40fb21
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fb17
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x254], 0
cmp dword [ebp - 0x238], 8
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x24c]
push 0
push eax
mov dword [ebp - 0x250], 7
call fcn.0044b150
add esp, 8
mov dword [ebp - 0x284], 0
xor eax, eax
mov dword [ebp - 0x280], 7
lea ecx, [ebp - 0x294]
mov word [ebp - 0x294], ax
push 0x43
push str.HKCUSoftwareKingsoftOffice6.0CommonupdateinfocacheStatusInfo
call fcn.004033b0
push str.RunningPid
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.00404b80
add esp, 0xc
mov edx, dword [ebp - 0x280]
mov byte [ebp - 4], 0x13
cmp edx, 8
jb 0x40fbef
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fbe5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x284], 0
cmp dword [ebp - 0x298], 8
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x2ac]
cmovae eax, dword [ebp - 0x2ac]
push 0
push eax
mov dword [ebp - 0x280], 7
call fcn.0044b150
mov edx, dword [ebp - 0x298]
add esp, 8
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x40fc6f
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fc65
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
call fcn.0044ee90
push str.Update_Exit.
push str.kupdate::Execute
push 0x13d
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcwpsupdateimpl.cpp
push 4
call fcn.00412750
add esp, 0x14
call fcn.00410410
mov ecx, eax
call fcn.004465e0
mov esi, dword [ebp - 0x2b4]
test eax, eax
je 0x40fcb1
push esi
call fcn.00410730
add esp, 4
mov edx, dword [ebp - 0x238]
cmp edx, 8
jb 0x40fcf1
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fce7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f15f
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret 0x18
push 0x540fac
call fcn.004bf206
add esp, 4
cmp dword [0x540fac], 0xffffffff
jne 0x40f4ba
mov ecx, 0x540fa8
mov dword [ebp - 4], 4
call fcn.0044cbf0
push 0x4ebe30
call fcn.004bf0be
push 0x540fac
mov dword [ebp - 4], 0xffffffff
call fcn.004bf1bc
add esp, 8
jmp 0x40f4ba
push 0x540fec
call fcn.004bf206
add esp, 4
cmp dword [0x540fec], 0xffffffff
jne 0x40f4d7
mov ecx, 0x540fc4
mov dword [ebp - 4], 5
call fcn.0044fa90
push 0x4ebe50
call fcn.004bf0be
push 0x540fec
mov dword [ebp - 4], 0xffffffff
call fcn.004bf1bc
add esp, 8
jmp 0x40f4d7
push 0x5405c0
call fcn.004bf206
add esp, 4
cmp dword [0x5405c0], 0xffffffff
jne 0x40f806
push 0x4ebe40
mov byte [0x5405bc], 0
call fcn.004bf0be
push 0x5405c0
call fcn.004bf1bc
add esp, 8
jmp 0x40f806