Function at 0x41b620
Capabilities:
Check for time delay via gettickcount
Get http document via iwebbrowser2
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x486850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor bl, bl
push 0
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x41], bl
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x41bb2b
lea eax, [ebp - 0x64]
push eax
push 0x4615e8
push 1
push 0
push 0x4617f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41bb25
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
mov ebx, dword [ebp - 0x64]
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, esp
push ebx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [ebx]
call dword [eax + 0x28]
test eax, eax
js 0x41bb19
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x468374
call esi
mov edi, eax
mov dword [ebp - 0x98], edi
test edi, edi
je 0x41bb19
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x5c]
mov ecx, dword [eax]
push edx
push edi
push eax
call dword [ecx + 0x1c]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
js 0x41bb16
push str.DD552472_A185_4a0c_AC58_90AA40E9E26A
call esi
mov edx, eax
mov dword [ebp - 0x6c], edx
test edx, edx
je 0x41bb0d
mov eax, dword [ebp - 0x5c]
push 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x48]
mov ecx, dword [eax]
push edx
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x41bb08
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x84]
mov ecx, dword [eax]
push edx
push eax
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x44], 0
call dword [ecx + 0x1c]
test eax, eax
js 0x41b78e
push str.TuneUp_Setup___Force_Shell_Restart
call esi
mov edi, eax
test edi, edi
je 0x41b782
mov eax, dword [ebp - 0x84]
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push edi
call ebx
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x8c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x41b866
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x4c]
mov ecx, dword [eax]
push edx
push 7
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x41b85a
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 0x42], 1
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x41b851
add dword [ebp - 0x58], 0x23c34600
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
adc ecx, 0
push eax
mov dword [ebp - 0x54], ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x41b851
movzx eax, word [ebp - 0x34]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x38]
push eax
movzx eax, word [ebp - 0x3a]
push eax
movzx eax, word [ebp - 0x3e]
push eax
movzx eax, word [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push str._04d__02d__02dT_02d:_02d:_02dZ
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x30]
push eax
call esi
mov edi, eax
test edi, edi
je 0x41b851
mov eax, dword [ebp - 0x4c]
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
test eax, eax
push edi
setns byte [ebp - 0x43]
call ebx
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x50]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
test eax, eax
js 0x41b8e1
mov ecx, dword [ebp - 0x50]
xor eax, eax
cmp byte [ebp - 0x42], al
mov edx, dword [ecx]
setne al
dec eax
push eax
push ecx
call dword [edx + 0x20]
mov eax, dword [ebp - 0x50]
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
push str.PT0S
call esi
mov edi, eax
test edi, edi
je 0x41b8af
mov eax, dword [ebp - 0x50]
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
push edi
call ebx
cmp byte [ebp - 0x43], 0
je 0x41b8d8
push str.PT0S
call esi
mov edi, eax
test edi, edi
je 0x41b8d8
mov eax, dword [ebp - 0x50]
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
test eax, eax
push edi
setns byte [ebp - 0x44]
call ebx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x60]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
test eax, eax
js 0x41baf9
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x90]
mov ecx, dword [eax]
push edx
push 0
push eax
call dword [ecx + 0x30]
test eax, eax
js 0x41baf0
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x88]
mov ecx, dword [eax]
push edx
push str.MbLk
push eax
call dword [ecx]
test eax, eax
js 0x41bae4
push dword [ebp - 0x68]
call esi
mov esi, eax
mov dword [ebp - 0x94], esi
test esi, esi
je 0x41bad8
mov eax, dword [ebp - 0x88]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
js 0x41bad5
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x68]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x3c]
test eax, eax
js 0x41bad5
mov eax, dword [ebp - 0x68]
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
test eax, eax
js 0x41bacc
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
call fcn.0041b530
mov dword [ebp - 0x38], eax
test eax, eax
je 0x41b9a0
mov eax, 8
mov word [ebp - 0x40], ax
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
mov ebx, dword [ebp - 0x5c]
lea eax, [ebp - 0x4c]
push eax
sub esp, 0x10
mov eax, esp
push 3
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x40]
mov ecx, esp
push 6
push dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x6c]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx]
push ebx
call dword [eax + 0x44]
test eax, eax
js 0x41bab6
cmp byte [ebp - 0x42], 0
jne 0x41ba3c
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x4c]
push 0
mov esi, dword [edx]
sub esp, 0x10
mov ecx, esp
push edx
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x78]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [ecx + 0xc], eax
call dword [esi + 0x30]
mov byte [ebp - 0x41], 0
test eax, eax
js 0x41ba40
mov byte [ebp - 0x41], 1
cmp byte [ebp - 0x44], 0
jne 0x41baad
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x3c]
test eax, eax
js 0x41ba9f
fldz
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x58]
fucompp
fnstsw ax
test ah, 0x44
jp 0x41ba9f
call edi
cmp esi, eax
jbe 0x41ba7d
mov esi, eax
sub eax, esi
cmp eax, 0x1388
jae 0x41ba9f
push 0x64
call ebx
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x3c]
fldz
test eax, eax
jns 0x41ba69
fstp st(0)
mov eax, dword [ebp - 0x5c]
push 0
push dword [ebp - 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
je 0x41bac6
push eax
call ebx
mov esi, dword [ebp - 0x94]
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call ebx
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [ebp - 0x98]
push dword [ebp - 0x6c]
call ebx
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call ebx
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov bl, byte [ebp - 0x41]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043d3b4
mov esp, ebp
pop ebp
ret