Function at 0x40cae5
Capabilities:
Check os version
Get http document via iwebbrowser2
Get session user name
Resolve function by parsing pe exports
Schedule task via itaskscheduler
Schedule task via itaskservice

Disassembly:
push 0x368
mov eax, 0x427adb
call fcn.00410a3c
mov byte [ebp - 0x2a5], cl
lea esi, [ebp + 0x38]
lea edi, [ebp - 0x2bc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
push ebx
movzx esi, al
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, 5
ja 0x40cdd3
mov dword [ebp - 0x220], ebx
lea eax, [ebp - 0x220]
push eax
push 0x438e4c
push 0x17
push ebx
push 0x42a3f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40cdc4
mov dword [ebp - 0x21c], ebx
mov byte [ebp - 4], 6
lea esi, [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
lea edx, [ebp + 0x48]
cmp dword [ebp + 0x5c], 8
push esi
cmovae edx, dword [ebp + 0x48]
mov ecx, dword [eax]
push 0x42a3d0
push 0x42a3e0
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x40cb91
cmp eax, 0x80070050
sete bl
jmp 0x40cdb0
mov dword [ebp - 0x224], ebx
mov byte [ebp - 4], 7
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x21c]
push edx
mov dword [ebp - 0x23c], ebx
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40cd9c
push 0x30
pop esi
push esi
lea eax, [ebp - 0x2a4]
push ebx
push eax
call fcn.004123e0
mov ax, word [ebp - 0x2b6]
lea edx, [ebp - 0x2a4]
mov word [ebp - 0x29c], ax
add esp, 0xc
mov ax, word [ebp - 0x2ba]
mov word [ebp - 0x29e], ax
mov ax, word [ebp - 0x2bc]
mov word [ebp - 0x2a0], ax
mov ax, word [ebp - 0x2b4]
mov word [ebp - 0x294], ax
mov ax, word [ebp - 0x2b2]
mov word [ebp - 0x292], ax
xor eax, eax
inc eax
mov word [ebp - 0x2a4], si
mov dword [ebp - 0x284], eax
mov word [ebp - 0x280], ax
mov eax, dword [ebp - 0x224]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
js 0x40cd9c
mov eax, dword [ebp - 0x21c]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x80]
test eax, eax
js 0x40cd9c
mov eax, dword [ebp - 0x21c]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x88]
test eax, eax
js 0x40cd9c
mov eax, dword [ebp - 0x21c]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
test eax, eax
js 0x40cd9c
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004123e0
add esp, 0xc
mov dword [ebp - 0x238], 0x104
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40cd9c
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
push ebx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
test eax, eax
js 0x40cd9c
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 8
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 0x21c]
push edx
push 0x428290
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x40cd88
mov eax, dword [ebp - 0x228]
push 1
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x40cd88
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x40cd51
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x40cd65
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40cd79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
jmp 0x40d4dd
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x40cd9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x40cdb0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40cdc4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
jmp 0x40d654
mov dword [ebp - 0x234], ebx
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 9
push eax
push 0x438e5c
push 0x17
push ebx
push 0x438e2c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40d64a
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
sub esp, 0x10
mov eax, dword [ebp - 0x234]
mov edi, esp
lea esi, [ebp - 0x25c]
sub esp, 0x10
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x25c]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x25c]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x25c]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
test eax, eax
js 0x40d64a
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 0xa
lea eax, [ebp + 0x60]
cmp dword [ebp + 0x74], 8
lea ecx, [ebp - 0x230]
mov esi, dword [ebp - 0x234]
cmovae eax, dword [ebp + 0x60]
push eax
call fcn.0040ca1c
lea edx, [ebp - 0x228]
mov byte [ebp - 4], 0xb
mov ecx, dword [esi]
push edx
push dword [eax]
push esi
call dword [ecx + 0x1c]
push dword [ebp - 0x230]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
js 0x40d636
mov dword [ebp - 0x22c], ebx
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 0x234]
push edx
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x40d622
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x40d60e
mov dword [ebp - 0x238], ebx
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x23c]
push edx
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x40d5fa
mov dword [ebp - 0x224], ebx
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x238]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x40d5e6
mov eax, dword [ebp - 0x224]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
test eax, eax
js 0x40d5e6
mov eax, dword [ebp - 0x224]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
js 0x40d5e6
mov dword [ebp - 0x24c], ebx
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x40d5d2
mov dword [ebp - 0x220], ebx
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x24c]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x40d5be
mov edx, 0x433b18
lea ecx, [ebp + 0x78]
call fcn.00407062
test al, al
jne 0x40d0a3
mov dword [ebp - 0x230], ebx
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x40d4f4
mov edi, dword [ebp - 0x230]
push 0x438d08
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x2ac], esi
test esi, esi
je 0x40d68e
mov byte [ebp - 4], 0x13
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0x28]
push esi
mov edi, eax
mov byte [ebp - 4], 0x12
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x40d4f4
cmp dword [ebp + 0x8c], 8
lea eax, [ebp + 0x78]
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x2ac]
cmovae eax, dword [ebp + 0x78]
push eax
call fcn.0040ca1c
mov byte [ebp - 4], 0x14
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x20]
push dword [ebp - 0x2ac]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
js 0x40d4f4
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x40d0a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x244], ebx
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0x220]
push edx
push 0x438e6c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x40d5aa
mov eax, dword [ebp - 0x244]
push str.Trigger1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x40d5aa
movzx edx, word [ebp - 0x2b0]
lea ecx, [ebp - 0x28c]
call fcn.0040ca55
mov ebx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x374]
movzx edx, word [ebp - 0x2b2]
call fcn.0040ca55
mov edi, eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x35c]
movzx edx, word [ebp - 0x2b4]
call fcn.0040ca55
mov esi, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2d4]
and dword [ebp - 0x2c4], 0
xor eax, eax
push 0x438d38
mov dword [ebp - 0x2c0], 7
mov word [ebp - 0x2d4], ax
call fcn.00406a23
push esi
lea edx, [ebp - 0x2d4]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x344]
call fcn.0040da3c
pop ecx
mov esi, 0x438d34
mov byte [ebp - 4], 0x1a
push esi
mov ecx, eax
call fcn.00406a98
push eax
lea ecx, [ebp - 0x314]
call fcn.00406675
push edi
lea edx, [ebp - 0x314]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x32c]
call fcn.0040da3c
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.00406a98
push eax
lea ecx, [ebp - 0x2fc]
call fcn.00406675
push ebx
lea edx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x274]
call fcn.0040da3c
pop ecx
lea ecx, [ebp - 0x2fc]
call fcn.0040680e
lea ecx, [ebp - 0x32c]
call fcn.0040680e
lea ecx, [ebp - 0x314]
call fcn.0040680e
lea ecx, [ebp - 0x344]
call fcn.0040680e
lea ecx, [ebp - 0x2d4]
call fcn.0040680e
lea ecx, [ebp - 0x35c]
call fcn.0040680e
lea ecx, [ebp - 0x374]
call fcn.0040680e
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0x26
call fcn.0040680e
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x274]
cmp dword [ebp - 0x260], 8
cmovae edx, dword [ebp - 0x274]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x3c]
test eax, eax
js 0x40d59d
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov byte [ebp - 4], 0x27
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x40d589
mov eax, dword [ebp - 0x240]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jne 0x40d29d
mov eax, dword [ebp - 0x240]
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dword [ebp - 0x21c], ebx
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x40d575
mov eax, dword [ebp - 0x21c]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x98]
test eax, eax
js 0x40d575
mov eax, dword [ebp - 0x21c]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
js 0x40d575
mov eax, dword [ebp - 0x21c]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
test eax, eax
js 0x40d575
mov eax, dword [ebp - 0x21c]
push str.PT3M
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x40d575
mov eax, dword [ebp - 0x21c]
push 0x3e7
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x40d575
mov eax, dword [ebp - 0x21c]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
js 0x40d575
mov dword [ebp - 0x248], ebx
cmp byte [ebp - 0x2a5], 0
mov byte [ebp - 4], 0x29
je 0x40d503
xor eax, eax
lea ecx, [ebp - 0x2e4]
push str.Local_Service
mov word [ebp - 0x2bc], ax
call fcn.0040893f
mov ecx, eax
mov byte [ebp - 4], 0x2a
lea esi, [ebp - 0x248]
cmp dword [ebp + 0x5c], 8
lea ebx, [ebp + 0x48]
push esi
cmovae ebx, dword [ebp + 0x48]
lea esi, [ebp - 0x25c]
sub esp, 0x10
mov eax, dword [ebp - 0x228]
mov edi, esp
push 3
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x2bc]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
mov esi, ecx
push 2
push dword [ebp - 0x22c]
movsd dword es:[edi], dword [esi]
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [edx + 0x44]
mov esi, eax
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x40d561
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x40d400
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40d414
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x40d428
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x274]
call fcn.0040680e
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x40d447
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x40d45b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x40d46f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x40d483
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x40d497
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x40d4ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x40d4bf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x40d4d3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x40d4e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov bl, 1
jmp 0x40d65e
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x230]
jmp 0x40d5b4
cmp dword [ebp + 0x5c], 8
lea esi, [ebp - 0x248]
push esi
lea edx, [ebp + 0x48]
mov eax, dword [ebp - 0x228]
cmovae edx, dword [ebp + 0x48]
lea esi, [ebp - 0x25c]
sub esp, 0x10
mov edi, esp
mov ecx, dword [eax]
push 3
movsd dword es:[edi], dword [esi]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x25c]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x25c]
push 2
push dword [ebp - 0x22c]
movsd dword es:[edi], dword [esi]
push edx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x44]
test eax, eax
jns 0x40d3ec
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x40d575
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40d589
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x40d59d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x274]
call fcn.0040680e
xor ebx, ebx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x40d5be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x40d5d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x40d5e6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x40d5fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x40d60e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x40d622
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x40d636
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x40d64a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x40d65e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp + 8]
call fcn.0040680e
lea ecx, [ebp + 0x20]
call fcn.0040680e
lea ecx, [ebp + 0x48]
call fcn.0040680e
lea ecx, [ebp + 0x60]
call fcn.0040680e
lea ecx, [ebp + 0x78]
call fcn.0040680e
mov al, bl
call fcn.004109e6
ret
push 0x8007000e
call fcn.0040ca00
int3