Function at 0x411cca
Capabilities:
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4566c8]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x54
mov eax, 0x43dcea
call fcn.004212a4
call fcn.00407829
push str.step_remove_scheduler
push 0x4464a0
call fcn.0040a84b
pop ecx
pop ecx
push 0x4464b0
lea ecx, [ebp - 0x28]
call fcn.00405457
lea eax, [ebp - 0x28]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00410905
pop ecx
xor edi, edi
push esi
inc edi
or ebx, 0xffffffff
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00403f19
push 0x4464cc
lea ecx, [ebp - 0x28]
call fcn.00405457
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], edi
call fcn.00410905
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00403f19
push str.drwebscd.exe
lea ecx, [ebp - 0x28]
call fcn.00405457
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 2
call fcn.0040b1ef
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00403f19
push str.drwebsched.exe
lea ecx, [ebp - 0x28]
call fcn.00405457
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 3
call fcn.0040b1ef
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00403f19
xor eax, eax
push 0x206
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push esi
push eax
call fcn.00421420
push 0x4580a8
push str._sTasks
lea eax, [ebp + 0x208]
push 0x104
push eax
call fcn.004035e3
push 0x4547e8
lea eax, [ebp - 0x28]
push eax
call fcn.0040aa05
add esp, 0x24
push 8
pop ebx
mov dword [ebp - 4], 4
cmp dword [eax + 0x18], ebx
jb 0x411e0b
mov eax, dword [eax + 4]
jmp 0x411e0e
add eax, 4
push eax
lea eax, [ebp + 0x208]
push eax
call fcn.0040b252
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
lea eax, [ebp - 0x28]
push 0x454820
push eax
call fcn.0040aa05
pop ecx
pop ecx
mov dword [ebp - 4], 5
cmp dword [eax + 0x18], ebx
jb 0x411e4c
mov eax, dword [eax + 4]
jmp 0x411e4f
add eax, 4
push eax
lea eax, [ebp + 0x208]
push eax
call fcn.0040b252
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
lea eax, [ebp - 0x28]
push 0x454854
push eax
call fcn.0040aa05
pop ecx
pop ecx
mov dword [ebp - 4], 6
cmp dword [eax + 0x18], ebx
jb 0x411e8d
mov eax, dword [eax + 4]
jmp 0x411e90
add eax, 4
push eax
lea eax, [ebp + 0x208]
push eax
call fcn.0040b252
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
lea eax, [ebp - 0x28]
push 0x454878
push eax
call fcn.0040aa05
pop ecx
pop ecx
mov dword [ebp - 4], 7
cmp dword [eax + 0x18], ebx
jb 0x411ece
mov eax, dword [eax + 4]
jmp 0x411ed1
add eax, 4
push eax
lea eax, [ebp + 0x208]
push eax
call fcn.0040b252
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
lea eax, [ebp - 0x28]
push 0x4548a4
push eax
call fcn.0040aa05
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x18], ebx
jb 0x411f0b
mov eax, dword [eax + 4]
jmp 0x411f0e
add eax, 4
push eax
lea eax, [ebp + 0x208]
push eax
call fcn.0040b252
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
lea eax, [ebp - 0x28]
push 0x4548e8
push eax
call fcn.0040aa05
push eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
mov dword [ebp - 4], 9
call fcn.0040f3a1
or dword [ebp - 4], 0xffffffff
add esp, 0x10
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
lea eax, [ebp - 0x28]
push 0x45492c
push eax
call fcn.0040aa05
push eax
push SysReAllocString
mov dword [ebp - 4], 0xa
call fcn.0040f3a1
or dword [ebp - 4], 0xffffffff
add esp, 0x10
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
push 0x446540
lea ecx, [ebp - 0x28]
call fcn.00405457
lea eax, [ebp - 0x60]
push 0x454960
push eax
mov dword [ebp - 4], 0xb
call fcn.0040aa05
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.004088a8
add esp, 0x14
push esi
push edi
lea ecx, [ebp - 0x60]
call fcn.00403f19
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00403f19
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.00421420
push 0x457ea0
push str._sTasksDoctorWeb
lea eax, [ebp]
push 0x104
push eax
call fcn.004035e3
add esp, 0x1c
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x44]
call fcn.00405457
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0xc
call fcn.0040e42d
pop ecx
push esi
push edi
lea ecx, [ebp - 0x44]
call fcn.00403f19
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0042090d
add ebp, 0x414
leave
ret