Function at 0x4159f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push esi
push 0x5199e4
push 0x104
push eax
call fcn.00407090
lea ebx, [esi - 1]
add esp, 0x10
mov dword [ebp - 0x114], ebx
lea eax, [ebp - 0x108]
cmp ebx, 8
ja case.default.0x415a3b
jmp dword [ebx*4 + 0x415ee8]
push str.Console_Connect
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Console_Disconnect
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Remote_Connect
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Remote_Disonnect
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Logon
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Logoff
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Lock
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415b25
push str.Unlock
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push str.Remote_Control
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
jmp 0x415d24
push eax
push str.TRG:_Check_Session_Trigger___s_
call fcn.004133e0
add esp, 8
cmp esi, 7
jne 0x415d24
push str.UPD:_Check_Session_Lock
call fcn.004133e0
xor esi, esi
add esp, 4
mov dword [ebp - 0x10c], esi
cmp dword [0x5664cc], esi
jle 0x415d24
xor ebx, ebx
mov dword [ebp - 0x110], ebx
nop
mov eax, dword [0x5664d0]
add eax, ebx
cmp byte [eax + 0x280], 0
je 0x415cff
push 0xb63938
push eax
call fcn.00415940
add esp, 8
test al, al
je 0x415cff
mov eax, dword [0x5664d0]
add eax, ebx
push eax
push str.UPD:_Session_Lock__Profile___s__
call fcn.004133e0
mov eax, dword [0x5664d0]
add esp, 8
cmp byte [ebx + eax + 0x104], 0
lea edi, [ebx + eax]
je 0x415cff
cmp byte [edi + 0xeb4], 0
je 0x415c7f
push edi
push str.PRF:_Updating_Profile___s_
call fcn.004133e0
mov eax, dword [edi + 0x268]
add esp, 8
mov byte [edi + 0xeb4], 0
sub eax, 0
je 0x415c70
sub eax, 1
je 0x415c6a
sub eax, 1
jne 0x415c7f
mov ecx, dword [edi + 0xe98]
xor esi, esi
cmp dword [ecx], esi
jle 0x415c56
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [ecx + 4]
test byte [eax + ebx + 0x108], 1
lea edx, [eax + ebx]
jne 0x415c3f
test esi, esi
js 0x415c38
mov eax, dword [ecx]
dec eax
cmp esi, eax
jg 0x415c38
mov dword [ecx], eax
je 0x415c38
sub eax, esi
imul eax, eax, 0x2740
push eax
lea eax, [edx + 0x2740]
push eax
push edx
call fcn.00482d10
add esp, 0xc
dec esi
sub ebx, 0x2740
mov ecx, dword [edi + 0xe98]
inc esi
add ebx, 0x2740
cmp esi, dword [ecx]
jl 0x415c00
mov ebx, dword [ebp - 0x110]
push 1
push 0
push 0xffffffffffffffff
push edi
call fcn.00411240
mov esi, dword [ebp - 0x10c]
jmp 0x415c7c
push 1
push 0
jmp 0x415c74
push 1
push 1
push 0xffffffffffffffff
push edi
call fcn.00411240
add esp, 0x10
cmp byte [edi + 0x26c], 0
je 0x415cac
lea eax, [ebp - 0x118]
push eax
push 0
push edi
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x415cac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x57c7d8]
test edx, edx
je 0x415cff
imul eax, dword [0x57c900], 0xeb8
add eax, dword [0x5664d0]
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x415ce6
test cl, cl
je 0x415ce2
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x415ce6
add edi, 2
add eax, 2
test cl, cl
jne 0x415cc6
xor eax, eax
jmp 0x415ceb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x415cff
push 0xffffffffffffffff
push 1
push 0x405
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
inc esi
add ebx, 0xeb8
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], ebx
cmp esi, dword [0x5664cc]
jl 0x415b50
mov ebx, dword [ebp - 0x114]
xor edi, edi
cmp dword [0x5664cc], edi
jle 0x415ed3
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [0x5664d0]
add eax, esi
cmp dword [eax + 0x238], 0
je case.default.0x415d73
push 0xb63938
push eax
call fcn.00415940
add esp, 8
test al, al
je case.default.0x415d73
cmp ebx, 8
ja case.default.0x415d73
jmp dword [ebx*4 + 0x415f0c]
mov eax, dword [0x5664d0]
mov al, byte [esi + eax + 0x238]
and eax, 0xffffff01
jmp 0x415e03
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 1
jmp 0x415e01
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 2
jmp 0x415e01
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 3
jmp 0x415e01
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 4
jmp 0x415e01
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 5
jmp 0x415e01
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 6
jmp 0x415e01
mov eax, dword [0x5664d0]
mov eax, dword [esi + eax + 0x238]
shr eax, 7
and al, 1
test al, al
jne 0x415e22
jmp case.default.0x415d73
mov eax, dword [0x5664d0]
test dword [esi + eax + 0x238], 0x100
je case.default.0x415d73
mov eax, dword [0x5664d0]
push dword [esi + eax + 0x23c]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [0x5664d0]
add ebx, esi
cmp byte [ebx + 0x220], 0
je 0x415e88
cmp byte [ebx + 0x104], 0
je 0x415e97
push ebx
push str.PRF:_Executing_Profile___s_
call fcn.004133e0
push 1
push ebx
mov byte [0x5661e0], 0
call fcn.00414930
add esp, 0x10
cmp byte [ebx + 0x28c], 0
je 0x415e7f
push 2
push ebx
call fcn.00411f80
add esp, 8
mov byte [0x5661e0], 1
jmp 0x415e97
push 1
push 1
push 1
push edi
call fcn.00423e00
add esp, 0x10
mov eax, dword [0x5664d0]
cmp byte [esi + eax + 0x221], 0
je 0x415ec0
inc edi
add esi, 0xeb8
cmp edi, dword [0x5664cc]
jge 0x415ed3
mov ebx, dword [ebp - 0x114]
jmp 0x415d40
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00481761
mov esp, ebp
pop ebp
ret