Function at 0x415b60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffffffffffff
push 0x4b4a76
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4f4930]
xor eax, esp
mov dword [esp + 0x13c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov eax, dword [esp + 0x164]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
cmp byte [esi + 0x964], bl
jne 0x416412
call fcn.00426270
mov byte [esp + 0x1b], 1
call fcn.00423400
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test al, al
je 0x415bf0
call ebp
mov edi, eax
call fcn.0042cb40
push edi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_safemode
call fcn.0042c950
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne cl
mov byte [esi + 7], cl
call fcn.00423400
test al, al
je 0x415c5b
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x415c5b
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x415c33
mov dword [esi + 4], ebx
jmp 0x415c5b
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x415c5b
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x415c81
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_installpath
call fcn.0042c950
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00416730
test al, al
jne 0x415c96
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x415cf1
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x415cf1
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x415cc9
mov dword [esi + 4], ebx
jmp 0x415cf1
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x415cf1
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x415d17
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_TempPath
call fcn.0042c950
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.004165a0
test al, al
jne 0x415d2c
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x415d87
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x415d87
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x415d5f
mov dword [esi + 4], ebx
jmp 0x415d87
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x415d87
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x415dad
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_VistaIE7
call fcn.0042c950
mov esi, dword [esp + 0x20]
call fcn.00416440
test al, al
jne 0x415dbe
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x415e19
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x415e19
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x415df1
mov dword [esi + 4], ebx
jmp 0x415e19
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x415e19
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x415e3f
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_DataPath
call fcn.0042c950
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push esi
call fcn.004167c0
test al, al
jne 0x415e5a
mov byte [esp + 0x1b], bl
jmp 0x415edf
call fcn.00423400
test al, al
je 0x415e8c
mov dword [esp + 0x1c], str.initruntime_ProfilePath
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_ProfilePath
call fcn.0042c950
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, esi
mov dword [esp + 0x15c], ebx
call fcn.00416e10
test al, al
je 0x415ead
mov eax, esi
call fcn.00417230
test al, al
jne 0x415eb1
mov byte [esp + 0x1b], bl
mov dword [esp + 0x15c], 0xffffffff
call fcn.00423400
test al, al
je 0x415edf
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
cmp byte [eax], bl
je 0x415edf
call fcn.0042ca00
call fcn.00423400
test al, al
je 0x415f3a
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x415f3a
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x415f12
mov dword [esi + 4], ebx
jmp 0x415f3a
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x415f3a
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x415f60
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_SetBuildNo
call fcn.0042c950
call fcn.004230d0
mov edx, dword [esp + 0x20]
push eax
add edx, 0x4be
push 0xb
push edx
call fcn.0047149d
add esp, 0xc
call fcn.00423400
test al, al
je 0x415fd6
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x415fd6
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x415fae
mov dword [esi + 4], ebx
jmp 0x415fd6
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x415fd6
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x415ffc
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_SetCommandLine
call fcn.0042c950
mov eax, dword [esp + 0x20]
call fcn.00417270
test al, al
jne 0x41600d
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x416068
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x416068
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x416040
mov dword [esi + 4], ebx
jmp 0x416068
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x416068
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x41608e
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_SetProcessShortName
call fcn.0042c950
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.004172c0
test al, al
jne 0x4160a3
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x4160fe
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x4160fe
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x4160d6
mov dword [esi + 4], ebx
jmp 0x4160fe
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4160fe
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x416124
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_CheckMetro
call fcn.0042c950
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
call fcn.00418400
test al, al
jne 0x41613a
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x416195
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x416195
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x41616d
mov dword [esi + 4], ebx
jmp 0x416195
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x416195
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x4161bb
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_CheckConfig
call fcn.0042c950
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00417d40
test al, al
jne 0x4161d0
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x41622b
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x41622b
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x416203
mov dword [esi + 4], ebx
jmp 0x41622b
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x41622b
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x416251
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_CheckCorrectFullShape
call fcn.0042c950
mov esi, dword [esp + 0x20]
call fcn.00418800
test al, al
jne 0x416262
mov byte [esp + 0x1b], bl
call fcn.00423400
test al, al
je 0x4162bd
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x4162bd
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x416295
mov dword [esi + 4], ebx
jmp 0x4162bd
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4162bd
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00423400
test al, al
je 0x4162e3
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.initruntime_CheckIgnoreCancel
call fcn.0042c950
mov esi, dword [esp + 0x20]
cmp byte [esi + 0x966], bl
jne 0x416311
mov edx, dword [esi]
mov eax, dword [edx + 4]
push str.outlook.exe
mov ecx, esi
call eax
push eax
call fcn.0046ff94
add esp, 8
test eax, eax
jne 0x416311
mov byte [esi + 0x9b5], 1
call fcn.00423400
test al, al
je 0x41636c
call ebp
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
mov esi, eax
cmp byte [esi], bl
je 0x41636c
mov ecx, esi
call fcn.0042ca50
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x416344
mov dword [esi + 4], ebx
jmp 0x41636c
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x41636c
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
lea ecx, [esp + 0x28]
call fcn.0041ead0
mov edi, dword [esp + 0x24]
lea esi, [esp + 0x28]
mov dword [esp + 0x15c], 1
call fcn.00421400
mov esi, dword [esp + 0x20]
call fcn.00418930
test al, al
je 0x4163a0
cmp byte [esp + 0x1b], bl
jne 0x4163e5
mov ecx, edi
call fcn.0041a480
push 0x4d3d04
push 0x4d4204
mov edx, eax
call fcn.0041f080
add esp, 8
mov dword [esp + 0x28], 0x4d4d70
cmp byte [esp + 0x144], bl
jne 0x4163e1
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x4163e1
push eax
call fcn.00470027
add esp, 4
xor al, al
jmp 0x416414
mov byte [esi + 0x964], 1
mov dword [esp + 0x28], 0x4d4d70
cmp byte [esp + 0x144], bl
jne 0x416412
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x34]
cmp eax, edx
je 0x416412
push eax
call fcn.00470027
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.0046fdae
add esp, 0x14c
ret 4