Function at 0x439410
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db9c1
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push esi
push edi
mov eax, dword [0x527064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
cmp dword [ebp + 0x34], 8
lea esi, [ebp + 0x20]
push eax
cmovae esi, dword [ebp + 0x20]
push 0x4ed44c
push 1
push 0
push 0x4ed45c
mov dword [ebp - 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x4394c3
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4bb
push 4
lea ecx, [ebp - 0x1c]
call fcn.00431610
mov byte [ebp - 4], 2
mov edx, str.Failed_to_create_an_instance_of_ITaskService
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
call fcn.004327d0
mov eax, dword [ebp - 0x1c]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
jmp 0x439e3b
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x50]
push eax
call ebx
movups xmm0, xmmword [ebp - 0x50]
lea eax, [ebp - 0x70]
push eax
movups xmmword [ebp - 0x80], xmm0
call ebx
movups xmm0, xmmword [ebp - 0x70]
lea eax, [ebp - 0x60]
push eax
movups xmmword [ebp - 0x90], xmm0
call ebx
movups xmm0, xmmword [ebp - 0x60]
lea eax, [ebp - 0xb0]
push eax
movups xmmword [ebp - 0xa0], xmm0
call ebx
mov byte [ebp - 4], 7
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x80]
mov ecx, dword [ebp - 0x28]
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x90]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xa0]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xb0]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x28]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, eax
lea eax, [ebp - 0xb0]
push eax
call ebx
lea eax, [ebp - 0x60]
push eax
call ebx
lea eax, [ebp - 0x70]
push eax
call ebx
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
call ebx
test edi, edi
jns 0x4395d1
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4c4
push 4
lea ecx, [ebp - 0x1c]
call fcn.00431610
mov byte [ebp - 4], 8
mov edx, str.ITaskService::Connect_failed
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1c]
call fcn.004327d0
mov eax, dword [ebp - 0x1c]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor bl, bl
jmp 0x439e3b
push 0x4f8180
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], 0
call fcn.00433d60
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
test eax, eax
je 0x4395f3
mov edx, dword [eax]
jmp 0x4395f5
xor edx, edx
mov eax, dword [ebp - 0x28]
lea edi, [ebp - 0x18]
push edi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
mov edi, eax
call fcn.00433e10
test edi, edi
jns 0x43964f
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4cf
push 4
lea ecx, [ebp - 0x1c]
call fcn.00431610
mov byte [ebp - 4], 0xb
mov edx, str.Cannot_get_Root_Folder_pointer
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0xc
jmp 0x4395a8
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x2c], 0
call fcn.00433d60
mov byte [ebp - 4], 0xd
mov eax, dword [eax]
test eax, eax
je 0x43966d
mov edx, dword [eax]
jmp 0x43966f
xor edx, edx
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x2c]
push edi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
mov edi, eax
call fcn.00433e10
test edi, edi
jns 0x439dd0
cmp dword [ebp - 0x2c], 0
jne 0x439dd0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x439720
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4df
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0xe
mov edx, str.Failed_to_create_a_task_definition
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
call fcn.004327d0
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor bl, bl
jmp 0x439e3b
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
jns 0x439774
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4e9
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x10
mov edx, str.Cannot_get_identification_pointer
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x11
jmp 0x439d57
mov eax, dword [ebp - 0x30]
push 0x4fc7c4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov ecx, dword [ebp - 0x30]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x4397cb
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4f3
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x12
mov edx, str.Cannot_put_identification_info
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x13
jmp 0x439d57
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edi, eax
test edi, edi
jns 0x43981f
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x4fe
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x14
mov edx, str.Cannot_get_settings_pointer
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x15
jmp 0x439d57
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edi, eax
test edi, edi
jns 0x439873
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x509
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x16
mov edx, str.Cannot_get_principal_pointer
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x17
jmp 0x439d57
mov eax, dword [ebp - 0x34]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x34]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x4398c7
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x514
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x18
mov edx, str.Cannot_put_principal_info
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x19
jmp 0x439d57
mov eax, dword [ebp - 0x20]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov edi, eax
test edi, edi
jns 0x439948
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x51e
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x1a
mov edx, str.Cannot_put_setting_info
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x10]
call fcn.004327d0
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor bl, bl
jmp 0x439e3b
mov eax, dword [ebp - 0x20]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edi, eax
test edi, edi
jns 0x439993
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x529
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x1c
mov edx, str.Cannot_put_setting_info
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x1d
jmp 0x43990d
mov eax, dword [ebp - 0x20]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov edi, eax
test edi, edi
jns 0x4399de
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x534
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x1e
mov edx, str.Cannot_put_setting_info
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x1f
jmp 0x43990d
mov eax, dword [ebp - 0x20]
push str.PT0S
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov ecx, dword [ebp - 0x20]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x439a35
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x540
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x20
mov edx, str.Cannot_put_setting_info
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x21
jmp 0x439d57
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edi, eax
test edi, edi
jns 0x439a89
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x54b
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x22
mov edx, str.Cannot_get_trigger_collection
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x23
jmp 0x439d57
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], 0
push 9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov ecx, dword [ebp - 0x38]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x439ac1
push edi
push str._nCannot_create_the_trigger:__x
call fcn.00433b20
add esp, 8
jmp 0x439d70
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edi, eax
test edi, edi
jns 0x439b1e
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x565
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x24
mov edx, str.Cannot_get_Task_collection_pointer
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x25
jmp 0x439d57
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x40]
push edx
mov dword [ebp - 0x40], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x3c]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x439b7d
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x571
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x26
mov edx, str.Cannot_create_the_action
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x27
jmp 0x439d57
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 0
push str.MbLk
mov ecx, dword [eax]
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x40]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
lea ecx, [ebp - 0x10]
test edi, edi
jns 0x439bde
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x57e
push 4
call fcn.00431610
mov byte [ebp - 4], 0x28
mov edx, str.QueryInterface_call_failed_for_IExecAction
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x29
jmp 0x439d57
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00433d60
mov byte [ebp - 4], 0x2a
mov edx, dword [eax]
test edx, edx
je 0x439bfd
mov edx, dword [edx]
jmp 0x439bff
xor edx, edx
mov eax, dword [ebp - 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov edi, eax
call fcn.00433e10
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test edi, edi
jns 0x439c5e
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x589
push 4
lea ecx, [ebp - 0x10]
call fcn.00431610
mov byte [ebp - 4], 0x2b
mov edx, str.Cannot_set_path_of_executable
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x2c
jmp 0x439d57
push 0x4f7ee0
lea ecx, [ebp - 0x60]
call fcn.00433e70
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x50]
push eax
movups xmmword [ebp - 0xa0], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [ebp - 0x50]
push str.BuiltinUsers
movups xmmword [ebp - 0x90], xmm0
call fcn.00433e70
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x10]
movups xmm0, xmmword [eax]
push esi
movups xmmword [ebp - 0x80], xmm0
call fcn.00433d60
mov byte [ebp - 4], 0x30
mov esi, dword [eax]
test esi, esi
je 0x439cbd
mov esi, dword [esi]
jmp 0x439cbf
xor esi, esi
movups xmm0, xmmword [ebp - 0xa0]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
push eax
sub esp, 0x10
mov eax, esp
mov edx, dword [ecx]
push 4
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x90]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x80]
push 6
push dword [ebp - 0x14]
movups xmmword [eax], xmm0
push esi
push ecx
call dword [edx + 0x44]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00433e10
lea eax, [ebp - 0x70]
push eax
call ebx
lea eax, [ebp - 0x50]
push eax
call ebx
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 1
push eax
call ebx
lea ecx, [ebp - 0x10]
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
test esi, esi
jns 0x439d89
push 0x59d
push 4
call fcn.00431610
mov byte [ebp - 4], 0x31
mov edx, str.Error_saving_the_Task
mov ecx, dword [eax]
push esi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x10]
call fcn.004327d0
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor bl, bl
jmp 0x439e3b
push 0x5a3
push 3
call fcn.00431610
mov byte [ebp - 4], 0x33
mov edx, str.Success_Task_successfully_registered
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x10]
call fcn.004327d0
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
jmp 0x439e2a
push str...includeMcDi2Utils.cpp
push str.CMcDi2Utils::CreateTaskInSchedulerToRunAfterLogon
push 0x5ab
push 3
lea ecx, [ebp - 0x24]
call fcn.00431610
mov byte [ebp - 4], 0x35
mov edx, str.Task_already_exists:
mov ecx, dword [eax]
push edi
call fcn.004333c0
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x24]
call fcn.004327d0
mov eax, dword [ebp - 0x24]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov bl, 1
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x439e52
push 2
inc eax
push eax
push dword [ebp + 8]
call fcn.00402ff0
add esp, 0xc
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x439e7d
push 2
inc ecx
push ecx
push dword [ebp + 0x20]
call fcn.00402ff0
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30