Function at 0x41d360
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4428
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
push esi
push edi
mov eax, dword [0x4e13b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
push 0
mov dword [ebp - 0x74], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x41d3b8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x4bfd7c
push 1
push 0
push 0x4c52bc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41d546
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xa8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0xa8], xmm0
call esi
movups xmm0, xmmword [ebp - 0xa8]
lea eax, [ebp - 0x98]
push eax
movups xmmword [ebp - 0xcc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
call esi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0xbc]
push eax
movups xmmword [ebp - 0xdc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xbc], xmm0
call esi
movups xmm0, xmmword [ebp - 0xbc]
lea eax, [ebp - 0x84]
push eax
movups xmmword [ebp - 0xec], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x84], xmm0
call esi
movups xmm0, xmmword [ebp - 0xcc]
mov eax, dword [ebp - 0x14]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 4
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xdc]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xec]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x84]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call edi
lea eax, [ebp - 0xbc]
push eax
call edi
lea eax, [ebp - 0x98]
push eax
call edi
lea eax, [ebp - 0xa8]
push eax
call edi
test esi, esi
js 0x41d546
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x14]
push 0x4ba660
mov byte [ebp - 4], 5
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41e405
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
push esi
push edi
mov byte [ebp - 4], 6
call dword [eax + 0x1c]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x41d563
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x41d546
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41e3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e3e9
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 7
test eax, eax
jne 0x41d57f
xor esi, esi
mov dword [ebp - 0x38], esi
jmp 0x41d594
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call eax
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x41e405
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push esi
push edi
mov byte [ebp - 4], 8
call dword [eax + 0x34]
push esi
mov edi, eax
mov byte [ebp - 4], 7
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x41d844
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d844
mov dword [ebp - 0x68], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x68]
push edx
push eax
mov byte [ebp - 4], 9
call dword [ecx + 0x4c]
test eax, eax
js 0x41d833
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x41d822
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x5c]
push edx
push 1
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x20]
test eax, eax
js 0x41d811
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x50]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x41d811
cmp dword [ebp - 0x50], 0
jne 0x41d811
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x54]
call fcn.0041cbd0
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x41d803
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4ba6e0
call edi
mov esi, eax
mov dword [ebp - 0xac], esi
test esi, esi
je 0x41e405
push 0x4ba6e0
mov byte [ebp - 4], 0xd
call edi
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41e40f
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4ba6e0
mov byte [ebp - 4], 0xe
call eax
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41e419
mov ecx, dword [ebp + 0xc]
push esi
mov byte [ebp - 4], 0xf
call fcn.0041e470
test eax, eax
jne 0x41d6e2
mov ecx, dword [ebp + 0xc]
push edi
lea ecx, [ecx + 4]
call fcn.0041e470
test eax, eax
jne 0x41d6e2
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x58]
lea ecx, [ecx + 8]
call fcn.0041e470
test eax, eax
je 0x41d771
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0041cc20
mov edx, dword [ebp - 0x18]
push dword [eax]
mov byte [ebp - 4], 0x10
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
push dword [ebp - 0x10]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call fcn.0041cc20
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x11
push edx
mov ecx, dword [edx]
call dword [ecx + 0x3c]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0041cc20
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x12
push edx
mov ecx, dword [edx]
call dword [ecx + 0x34]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x41d7eb
cmp word [ebp - 0x38], 0xffff
je 0x41d79b
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41d7c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41d7d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 9
test eax, eax
je 0x41d7e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
jmp 0x41e38e
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41d811
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41d822
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 9
test eax, eax
je 0x41d833
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 7
test eax, eax
je 0x41d844
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x41d855
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x41d869
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41e405
mov eax, dword [edi]
push 0
push esi
push edi
mov byte [ebp - 4], 0x13
call dword [eax + 0x3c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x24]
test eax, eax
jns 0x41d8c8
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x41d8ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x41d535
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41d535
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41d8dc
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov eax, dword [ebp - 0x2c]
jns 0x41d90b
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41d89d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41d89d
cmp word [0x4e4d18], 0
mov dword [ebp - 0x50], eax
jne 0x41d92e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e4d18
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e4d18
lea ecx, [ebp - 0x38]
call fcn.00406d80
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x16
test eax, eax
jne 0x41d994
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x50]
push esi
push ecx
mov byte [ebp - 4], 0x17
mov eax, dword [ecx]
call dword [eax + 0x28]
push esi
call edi
mov edx, dword [ebp - 0x38]
or edi, 0xffffffff
mov byte [ebp - 4], 0x15
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41d97d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x41d9aa
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x41d9c1
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41e423
jmp 0x41d94b
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41e405
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x18
call dword [eax + 0x20]
push esi
mov byte [ebp - 4], 0x15
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41d9eb
mov dword [ebp - 0x2c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x41da32
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x41da18
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41d89d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41d89d
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x3c]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x1a
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x28]
mov esi, eax
test edx, edx
je 0x41da65
mov dword [ebp - 0x28], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
test esi, esi
jns 0x41da8d
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41da7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test edx, edx
je 0x41da18
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x41da18
xor ecx, ecx
mov dword [ebp - 0x30], ecx
test eax, eax
je 0x41dab7
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push 0x4bfc84
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x30]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x3c]
cmovs ecx, edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 0x1b
test ecx, ecx
je 0x41da6c
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov eax, dword [ebp - 0x30]
push str.Trigger1
mov dword [ebp - 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x41e405
mov ecx, dword [ebp - 0x10]
push esi
push ecx
mov byte [ebp - 4], 0x1c
mov eax, dword [ecx]
call dword [eax + 0x24]
push esi
mov byte [ebp - 4], 0x1b
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp word [0x4e4f18], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
jne 0x41db25
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e4f18
push 2
call sub.Secur32.dll_GetUserNameExW
push 0x4e4f18
lea ecx, [ebp - 0x38]
call fcn.00406d80
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x1d
test eax, eax
jne 0x41dc62
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x50]
push esi
push ecx
mov byte [ebp - 4], 0x1e
mov eax, dword [ecx]
call dword [eax + 0x5c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x38]
mov eax, edi
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41db79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4e4b8c]
test al, 1
jne 0x41dbb8
or eax, 1
mov dword [0x4e4b8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x4b8b10
mov dword [0x4e4b80], 0x4ba668
mov dword [0x4e4b84], eax
mov byte [0x4e4b88], 0
call fcn.00428c30
mov eax, dword [0x4e4b8c]
add esp, 4
test al, 2
jne 0x41dc14
or eax, 2
mov dword [0x4e4b90], 0x4ba680
mov dword [0x4e4b8c], eax
xor eax, eax
push 0x4b8b40
mov dword [0x4e4b94], 0x4e4b80
mov dword [0x4e4ba4], 2
mov dword [0x4e4b9c], 0
mov dword [0x4e4ba0], 0
mov dword [0x4e4ba8], eax
mov dword [0x4e4b98], 0x4e4b90
call fcn.00428c30
add esp, 4
mov eax, dword [0x4e4b90]
mov ecx, 0x4e4b90
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x3c
mov byte [ebp - 4], 0x1f
mov eax, dword [eax + 0x10]
cdq
idiv ecx
push edx
push eax
lea eax, [ebp - 0x38]
push str.PT_dM_dS
push eax
call fcn.0040a920
mov esi, dword [ebp - 0x38]
add esp, 0x10
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
test esi, esi
jne 0x41dc7b
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x41dc92
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41e42d
jmp 0x41db46
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x41e405
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x20
call dword [eax + 0x54]
push edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x1f
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x41dcbf
mov dword [ebp - 0x30], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0x10], 0
jge 0x41dd0c
or eax, 0xffffffff
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41dce1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x41dcf2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41da07
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41da07
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x41dd3b
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41dcc5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41dcc5
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x4c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x22
call dword [ecx + 0x30]
mov edx, dword [ebp - 0x34]
mov edi, eax
test edx, edx
je 0x41dd6e
mov dword [ebp - 0x34], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
test edi, edi
jns 0x41dd9d
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41dd86
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test edx, edx
je 0x41dcc5
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x41dcc5
xor edi, edi
mov dword [ebp - 0x44], edi
test eax, eax
je 0x41ddc7
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push 0x4bfc74
push eax
call dword [ecx]
mov edi, dword [ebp - 0x44]
xor ecx, ecx
mov edx, dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0x4c]
cmovs edi, ecx
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0x23
test edi, edi
je 0x41dd75
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x41dddd
mov dword [ebp - 0x58], eax
jmp 0x41ddef
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41e405
mov ecx, dword [edi]
push eax
push edi
mov byte [ebp - 4], 0x24
call dword [ecx + 0x2c]
push dword [ebp - 0x58]
mov byte [ebp - 4], 0x23
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
test eax, eax
jne 0x41de1e
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x41de35
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x41e405
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x25
call dword [eax + 0x3c]
push edi
mov byte [ebp - 4], 0x23
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 8]
test eax, eax
jne 0x41de62
xor edi, edi
mov dword [ebp + 0xc], edi
jmp 0x41de79
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp + 0xc], edi
test edi, edi
je 0x41e405
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x26
call dword [eax + 0x34]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0x27
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
mov eax, dword [ebp - 0x48]
jns 0x41dee3
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41deb8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41dec9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41dd28
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41dd28
cmp word [0x4e4d18], 0
mov dword [ebp - 0x50], eax
jne 0x41df06
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e4d18
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e4d18
lea ecx, [ebp + 0xc]
call fcn.00406d80
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x28
test eax, eax
jne 0x41dfe6
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x50]
push edi
push ecx
mov byte [ebp - 4], 0x29
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
mov byte [ebp - 4], 0x27
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41df5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
push str.BUILTINAdministrators
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41e405
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov byte [ebp - 4], 0x2a
mov eax, dword [ecx]
call dword [eax + 0x40]
push edi
mov byte [ebp - 4], 0x27
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x48]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x41dfb1
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
mov eax, dword [ebp - 0x40]
jns 0x41dfff
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41dfde
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
jmp 0x41deaa
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x41e437
jmp 0x41df27
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x40]
push str.PT0S
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41e405
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov byte [ebp - 4], 0x2c
mov eax, dword [ecx]
call dword [eax + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x60]
push edx
push eax
mov byte [ebp - 4], 0x2d
mov ecx, dword [eax]
call dword [ecx + 0x9c]
test eax, eax
js 0x41e07a
mov eax, dword [ebp - 0x60]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x41e08e
mov dword [ebp - 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x6c], 0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x98]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x98], xmm0
call edi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0xa8]
push eax
movups xmmword [ebp - 0xdc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa8], xmm0
call edi
cmp word [0x4e4d18], 0
movups xmm0, xmmword [ebp - 0xa8]
mov byte [ebp - 4], 0x30
movups xmmword [ebp - 0xcc], xmm0
jne 0x41e101
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e4d18
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e4d18
lea ecx, [ebp + 0xc]
call fcn.00406d80
mov edi, dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x18], edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x41e441
mov eax, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [ebp - 0x84], ax
call edi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x41e15b
cmp dword [ebp - 0x18], eax
jne 0x41e447
movups xmm0, xmmword [ebp - 0x84]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x18], edx
movups xmmword [ebp - 0xec], xmm0
test eax, eax
jne 0x41e181
xor edi, edi
mov dword [ebp + 8], edi
jmp 0x41e19b
push eax
call edi
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x41e464
movups xmm0, xmmword [ebp - 0xec]
mov edx, dword [ebp - 0x18]
movups xmm1, xmmword [ebp - 0xdc]
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
sub esp, 0x10
mov byte [ebp - 4], 0x33
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm1
mov eax, esp
sub esp, 0x10
movups xmm1, xmmword [ebp - 0xcc]
movups xmmword [eax], xmm1
mov eax, esp
push 6
push dword [ebp - 0x1c]
push edi
push edx
movups xmmword [eax], xmm0
call dword [ecx + 0x44]
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp + 0xc]
or edi, 0xffffffff
mov byte [ebp - 4], 0x30
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e20f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 8], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0x2d
jge 0x41e2be
test eax, eax
je 0x41e244
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x41e255
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41e266
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41e277
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41e288
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41e299
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41e2aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jmp 0x41dcd7
test eax, eax
je 0x41e2c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x41e2d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41e2ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41e2fb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41e30c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41e31d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41e32e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x41e347
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x41e358
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41e369
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x41e37a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41e38b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x41e39c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x41e3ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x41e3be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41e3d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x88]
push str.Computer_Z
call fcn.0041e580
mov dword [ebp - 0x74], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x8007000e
call fcn.004031a0
push 0x8007000e
call fcn.004031a0
push 0x8007000e
call fcn.004031a0
push 0x8007000e
call fcn.004031a0
push 0x8007000e
call fcn.004031a0
push 0x8007000e
call fcn.004031a0
push eax
call fcn.004031a0
mov eax, 0xa
mov dword [ebp - 0x7c], 0x8007000e
push 0x8007000e
mov word [ebp - 0x84], ax
call fcn.004031a0
push 0x8007000e
call fcn.004031a0
int3