Function at 0x416630
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x684250
push 0x5e8080
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
sub esp, 0xa8
mov eax, dword [0x69cffc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebx + 8]
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xb4], 0
xor ecx, ecx
cmp cx, word [esi + 4]
je 0x416b14
test edi, edi
je 0x416b14
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x416b14
mov eax, dword [esi + 0x2c]
cmp dword [eax - 0xc], 1
jl 0x416b14
lea eax, [ebp - 0xac]
push eax
push 0x663640
push 1
push 0
push 0x663630
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xa0], eax
test eax, eax
js 0x416b19
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
lea edx, [ebp - 0xa8]
push edx
push 0x663650
push edi
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0xa0], eax
test eax, eax
js 0x41677b
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0xa8], 0
mov ecx, edi
call fcn.00416b60
mov dword [ebp - 0xa0], eax
test eax, eax
jns 0x41677b
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x69cffc
call fcn.005ead40
add esp, 0xc
mov eax, dword [ebp - 0xa0]
jmp 0x416b19
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
lea edx, [ebp - 0xa8]
push edx
push 0x663650
push 0x663620
push edi
push eax
call dword [ecx + 0x20]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
jns 0x4167bf
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x69cffc
call fcn.005ead40
add esp, 0xc
mov eax, edi
jmp 0x416b19
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
lea edx, [ebp - 0xa4]
push edx
push 0x663650
push eax
call dword [ecx]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
push dword [esi + 0x2c]
push eax
call dword [ecx + 0x80]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
mov edx, dword [esi + 0x30]
cmp dword [edx - 0xc], 0
jle 0x41683f
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x88]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
mov edx, dword [esi + 0x34]
cmp dword [edx - 0xc], 0
jle 0x416868
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x90]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
cmp dword [esi + 0x44], 0
je 0x41688f
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
push 0
push dword [esi + 0x38]
push eax
call dword [ecx + 0x78]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
mov edx, dword [esi + 0x40]
cmp dword [edx - 0xc], 0
jle 0x4168b5
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
mov edi, dword [esi + 0x28]
mov dword [ebp - 0xbc], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4168d1
or edi, 1
mov dword [ebp - 0xbc], edi
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x70]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
lea edx, [ebp - 0xb4]
push edx
lea edx, [ebp - 0xb8]
push edx
push eax
call dword [ecx + 0xc]
mov edi, eax
mov dword [ebp - 0xa0], edi
test edi, edi
js 0x4167a5
push 0x30
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.005e8c40
add esp, 0xc
mov eax, 0x30
mov word [ebp - 0x54], ax
lea edx, [esi + 4]
movzx eax, word [edx]
mov word [ebp - 0x50], ax
movzx eax, word [esi + 6]
mov word [ebp - 0x4e], ax
movzx ecx, word [esi + 0xa]
mov word [ebp - 0x4c], cx
movzx eax, word [esi + 0xc]
mov word [ebp - 0x44], ax
movzx eax, word [esi + 0xe]
mov word [ebp - 0x42], ax
movzx eax, word [esi + 0x14]
xor edi, edi
cmp di, ax
je case.default.0x416985
mov dword [ebp - 0x38], 1
mov word [ebp - 0x4a], ax
movzx eax, word [esi + 0x16]
mov word [ebp - 0x48], ax
movzx eax, word [esi + 0x1a]
mov word [ebp - 0x46], ax
mov eax, dword [esi + 0x24]
dec eax
jmp dword [eax*4 + 0x416b3c]
mov dword [ebp - 0x34], edi
jmp 0x416a43
mov dword [ebp - 0x34], 1
mov eax, 1
mov word [ebp - 0x30], ax
jmp 0x416a43
mov dword [ebp - 0x34], 2
push 0xffffffffffffffff
push edx
lea ecx, [ebp - 0xc4]
call fcn.00416c70
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.005f14a6
add esp, 8
test eax, eax
jne 0x4169fd
movups xmm0, xmmword [ebp - 0x78]
movups xmmword [ebp - 0x9c], xmm0
movups xmm0, xmmword [ebp - 0x68]
movups xmmword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x7c], eax
psrldq xmm0, 8
movd eax, xmm0
inc eax
jmp 0x4169ff
xor eax, eax
movzx eax, word [eax*2 + 0x6707f4]
mov word [ebp - 0x2e], ax
mov eax, 1
mov word [ebp - 0x30], ax
jmp 0x416a43
mov dword [ebp - 0x34], 3
dec ecx
mov eax, 1
shl eax, cl
mov dword [ebp - 0x30], eax
mov eax, 0xfff
mov word [ebp - 0x2c], ax
jmp 0x416a43
mov dword [ebp - 0x34], 7
jmp 0x416a43
mov dword [ebp - 0x34], 6
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
lea edx, [ebp - 0x54]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
jns 0x416a79
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x69cffc
call fcn.005ead40
add esp, 0xc
mov eax, esi
jmp 0x416b19
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
lea edx, [ebp - 0xb0]
push edx
push 0x65ae4c
push eax
call dword [ecx]
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x416a5f
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x18]
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x416a5f
mov dword [ebp - 4], 0xfffffffe
call fcn.00416ad1
mov eax, esi
jmp 0x416b19
mov eax, 0x80004005
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0058f0d5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8