Function at 0x4151d0
Capabilities:
Check os version
Get http document via iwebbrowser2
Get session user name
Resolve function by parsing pe exports
Schedule task via itaskscheduler
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435512
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x44d080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x2a5], cl
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x2bc], xmm0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
movzx esi, al
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, 5
ja 0x415527
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x447994
push 0x17
push 0
push 0x438418
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x415264
mov byte [ebp - 0x2a5], 0
jmp 0x41550a
mov dword [ebp - 0x21c], 0
mov byte [ebp - 4], 6
lea esi, [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
lea edx, [ebp + 0x48]
cmp dword [ebp + 0x5c], 8
push esi
cmovae edx, dword [ebp + 0x48]
mov ecx, dword [eax]
push 0x4383f8
push 0x438408
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x4152b0
cmp eax, 0x80070050
sete byte [ebp - 0x2a5]
jmp 0x4154f6
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 7
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x21c]
push edx
mov dword [ebp - 0x23c], 0
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4154d4
push 0x30
lea eax, [ebp - 0x2a4]
push 0
push eax
call fcn.0041bd40
movzx eax, word [ebp - 0x2b6]
lea edx, [ebp - 0x2a4]
mov word [ebp - 0x29c], ax
add esp, 0xc
movzx eax, word [ebp - 0x2ba]
mov word [ebp - 0x29e], ax
movzx eax, word [ebp - 0x2bc]
mov word [ebp - 0x2a0], ax
movzx eax, word [ebp - 0x2b4]
mov word [ebp - 0x294], ax
movzx eax, word [ebp - 0x2b2]
mov word [ebp - 0x292], ax
mov eax, 0x30
mov word [ebp - 0x2a4], ax
mov eax, 1
mov word [ebp - 0x280], ax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x284], 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
js 0x4154d4
mov eax, dword [ebp - 0x21c]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x80]
test eax, eax
js 0x4154d4
mov eax, dword [ebp - 0x21c]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x88]
test eax, eax
js 0x4154d4
mov eax, dword [ebp - 0x21c]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
test eax, eax
js 0x4154d4
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0041bd40
add esp, 0xc
mov dword [ebp - 0x238], 0x104
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4154d4
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
test eax, eax
js 0x4154d4
mov dword [ebp - 0x228], 0
mov byte [ebp - 4], 8
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 0x21c]
push edx
push 0x4362b0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4154c0
mov eax, dword [ebp - 0x228]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x4154c0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x415489
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x41549d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4154b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
jmp 0x415c76
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x4154d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x224]
mov byte [ebp - 0x2a5], 0
test eax, eax
je 0x4154f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 0x2a5], 0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x41550a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x415de4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x415de4
mov dword [ebp - 0x234], 0
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 9
push eax
push 0x4479a4
push 0x17
push 0
push 0x447974
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x415dc9
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x25c]
mov eax, dword [ebp - 0x234]
sub esp, 0x10
mov ecx, esp
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
js 0x415dc9
mov dword [ebp - 0x228], 0
mov byte [ebp - 4], 0xa
lea eax, [ebp + 0x60]
cmp dword [ebp + 0x74], 8
mov edi, dword [ebp - 0x234]
jb 0x415798
mov eax, dword [ebp + 0x60]
test eax, eax
jne 0x415798
xor esi, esi
mov dword [ebp - 0x230], esi
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0xb
mov eax, dword [edi]
push ecx
push esi
push edi
call dword [eax + 0x1c]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x415db5
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 0x234]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x415da1
mov dword [ebp - 0x23c], 0
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x415d8d
mov dword [ebp - 0x238], 0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x23c]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x415d79
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x238]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x415d65
mov eax, dword [ebp - 0x224]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
test eax, eax
js 0x415d65
mov eax, dword [ebp - 0x224]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
js 0x415d65
mov dword [ebp - 0x24c], 0
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x415d51
mov dword [ebp - 0x220], 0
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x24c]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x415d3d
mov edx, 0x44263c
lea ecx, [ebp + 0x78]
call fcn.0040c9e0
test al, al
je 0x41582a
mov dword [ebp - 0x230], 0
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x415b05
mov edi, dword [ebp - 0x230]
push 0x447850
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x2ac], esi
test esi, esi
je 0x415f76
jmp 0x4157b4
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x230], esi
test esi, esi
je 0x415f80
jmp 0x4155d4
mov byte [ebp - 4], 0x13
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0x28]
push esi
mov edi, eax
mov byte [ebp - 4], 0x12
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x415b05
cmp dword [ebp + 0x8c], 8
lea eax, [ebp + 0x78]
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x2ac]
cmovae eax, dword [ebp + 0x78]
push eax
call fcn.00415030
mov byte [ebp - 4], 0x14
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x20]
push dword [ebp - 0x2ac]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
js 0x415b05
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x41582a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x244], 0
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0x220]
push edx
push 0x4479b4
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x415d29
mov eax, dword [ebp - 0x244]
push str.Trigger1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x415d29
movzx edx, word [ebp - 0x2b0]
lea ecx, [ebp - 0x28c]
call fcn.00415070
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x374]
movzx edx, word [ebp - 0x2b2]
call fcn.00415070
mov edi, eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x35c]
movzx edx, word [ebp - 0x2b4]
call fcn.00415070
mov esi, eax
push 0x447880
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x18
call fcn.0040b240
push esi
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x32c]
call fcn.004164a0
push 0x44787c
mov edx, eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x314]
call fcn.0040c700
push edi
mov edx, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x2fc]
call fcn.004164a0
push 0x44787c
mov edx, eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x2e4]
call fcn.0040c700
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x274]
push dword [ebp - 0x2ac]
mov edx, eax
call fcn.004164a0
add esp, 0x14
lea ecx, [ebp - 0x2e4]
call fcn.004014b0
lea ecx, [ebp - 0x2fc]
call fcn.004014b0
lea ecx, [ebp - 0x314]
call fcn.004014b0
lea ecx, [ebp - 0x32c]
call fcn.004014b0
lea ecx, [ebp - 0x344]
call fcn.004014b0
lea ecx, [ebp - 0x35c]
call fcn.004014b0
lea ecx, [ebp - 0x374]
call fcn.004014b0
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0x26
call fcn.004014b0
cmp dword [ebp - 0x260], 8
lea edx, [ebp - 0x274]
cmovae edx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x244]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x415d1e
mov dword [ebp - 0x240], 0
mov byte [ebp - 4], 0x27
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x415d0a
mov eax, dword [ebp - 0x240]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jne 0x415a04
mov eax, dword [ebp - 0x240]
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dword [ebp - 0x21c], 0
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x415cf6
mov eax, dword [ebp - 0x21c]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x98]
test eax, eax
js 0x415cf6
mov eax, dword [ebp - 0x21c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
js 0x415cf6
mov eax, dword [ebp - 0x21c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
test eax, eax
js 0x415cf6
mov eax, dword [ebp - 0x21c]
push str.PT3M
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x415cf6
mov eax, dword [ebp - 0x21c]
push 0x3e7
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x415cf6
mov eax, dword [ebp - 0x21c]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
js 0x415cf6
mov dword [ebp - 0x248], 0
cmp byte [ebp - 0x2a5], 0
mov byte [ebp - 4], 0x29
je 0x415c92
xor eax, eax
mov word [ebp - 0x2cc], ax
mov eax, 8
push str.Local_Service
mov word [ebp - 0x2bc], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x2b4], eax
test eax, eax
je 0x415f8a
jmp 0x415b14
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x230]
jmp 0x415d33
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x248]
cmp dword [ebp + 0x5c], 8
lea esi, [ebp + 0x48]
movups xmm0, xmmword [ebp - 0x25c]
cmovae esi, dword [ebp + 0x48]
mov eax, dword [ebp - 0x228]
push ecx
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
push 3
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2cc]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x2bc]
push 2
push dword [ebp - 0x22c]
movups xmmword [ecx], xmm0
push esi
push eax
call dword [edx + 0x44]
mov esi, eax
lea eax, [ebp - 0x2bc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x415ce2
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x415b99
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x415bad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x415bc1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x274]
call fcn.004014b0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x415be0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x415bf4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x415c08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x415c1c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x415c30
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x415c44
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x415c58
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x415c6c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x415c80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0x2a5], 1
jmp 0x415de4
cmp dword [ebp + 0x5c], 8
lea ecx, [ebp - 0x248]
movups xmm0, xmmword [ebp - 0x25c]
mov eax, dword [ebp - 0x228]
lea esi, [ebp + 0x48]
cmovae esi, dword [ebp + 0x48]
push ecx
sub esp, 0x10
mov edx, dword [eax]
mov ecx, esp
push 3
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push 2
push dword [ebp - 0x22c]
push esi
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x44]
test eax, eax
jns 0x415b85
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x415cf6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x415d0a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x415d1e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x274]
call fcn.004014b0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x415d3d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x415d51
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x415d65
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x415d79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x415d8d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x415da1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x415db5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x415dc9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x415ddd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 0x2a5], 0
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x415e1e
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415e14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415f94
push edx
push ecx
call fcn.00419f4a
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x415e6c
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415e62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415f99
push edx
push ecx
call fcn.00419f4a
add esp, 8
mov edx, dword [ebp + 0x5c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp edx, 8
jb 0x415eba
mov ecx, dword [ebp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415eb0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415f9e
push edx
push ecx
call fcn.00419f4a
add esp, 8
mov edx, dword [ebp + 0x74]
xor eax, eax
mov dword [ebp + 0x58], 0
mov dword [ebp + 0x5c], 7
mov word [ebp + 0x48], ax
cmp edx, 8
jb 0x415f08
mov ecx, dword [ebp + 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415efe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415fa3
push edx
push ecx
call fcn.00419f4a
add esp, 8
mov edx, dword [ebp + 0x8c]
xor eax, eax
mov dword [ebp + 0x70], 0
mov dword [ebp + 0x74], 7
mov word [ebp + 0x60], ax
cmp edx, 8
jb 0x415f55
mov ecx, dword [ebp + 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415f4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415fa8
push edx
push ecx
call fcn.00419f4a
add esp, 8
mov al, byte [ebp - 0x2a5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419c6a
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00415010
push 0x8007000e
call fcn.00415010
push 0x8007000e
call fcn.004198c0
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
int3