Function at 0x403584
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push 0x138
mov eax, 0x428c03
call fcn.0042437a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x138], eax
xor eax, eax
push 0x7e
mov word [ebp - 0x90], ax
xor ebx, ebx
lea eax, [ebp - 0x8e]
push ebx
push eax
mov edi, ecx
mov byte [ebp - 0x109], 1
call fcn.0041b1d0
add esp, 0xc
push 7
pop esi
xor eax, eax
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb8], ebx
mov word [ebp - 0xc8], ax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x11c]
push eax
push 0x42c698
push 1
push ebx
push 0x42c6b8
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x403621
mov byte [ebp - 0x109], bl
jmp 0x403a01
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
lea edx, [ebp - 0x110]
push edx
push 0x42c688
push 0x42c6a8
push edi
push eax
call dword [ecx + 0x20]
mov edi, eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jl 0x403616
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
lea edx, [ebp - 0x118]
push edx
lea edx, [ebp - 0x134]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x40368a
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x403616
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x30
lea eax, [ebp - 0xf8]
push ebx
push eax
call fcn.0041b1d0
add esp, 0xc
push 0x30
pop eax
mov word [ebp - 0xf8], ax
mov ax, word [ebp - 0x102]
mov word [ebp - 0xf0], ax
mov ax, word [ebp - 0x106]
mov word [ebp - 0xf2], ax
mov ax, word [ebp - 0x108]
mov word [ebp - 0xf4], ax
xor eax, eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov word [ebp - 0x144], ax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xd0], eax
xor eax, eax
mov word [ebp - 0xac], ax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x403731
sub eax, ecx
sar eax, 1
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0xac]
call fcn.004075fa
mov byte [ebp - 4], 1
lea ebx, [ebp - 0xac]
lea eax, [ebp - 0xc8]
call fcn.00407305
xor ebx, ebx
mov byte [ebp - 4], bl
push 1
xor edi, edi
lea esi, [ebp - 0xac]
call fcn.00407528
lea eax, [ebp - 0x114]
push eax
lea edi, [ebp - 0xc8]
mov dword [ebp - 0x114], 0x3a
call fcn.0040747b
push eax
mov dword [ebp - 0x114], eax
push ebx
lea eax, [ebp - 0xac]
push eax
mov eax, edi
push eax
call fcn.00407364
mov byte [ebp - 4], 2
push eax
call fcn.00402d14
pop ecx
mov word [ebp - 0xe8], ax
mov byte [ebp - 4], bl
push 1
xor edi, edi
lea esi, [ebp - 0xac]
call fcn.00407528
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x114]
sub ecx, eax
push ecx
inc eax
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00407364
mov byte [ebp - 4], 3
push eax
call fcn.00402d14
pop ecx
mov word [ebp - 0xe6], ax
mov byte [ebp - 4], bl
push 1
lea esi, [ebp - 0xac]
call fcn.00407528
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
lea edx, [ebp - 0xf8]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
jge 0x403864
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 0x109], bl
jmp 0x4039ff
push dword [ebp - 0x12c]
push eax
call dword [ecx + 0x80]
test eax, eax
jns 0x403893
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 0x109], bl
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push 0x20
push eax
call dword [ecx + 0x98]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push 0x2000
push eax
call dword [ecx + 0x70]
push str.WtsApi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSQuerySessionInformationW
push eax
mov dword [ebp - 0x114], eax
call esi
push str.WTSFreeMemory
push dword [ebp - 0x114]
mov edi, eax
call esi
mov esi, eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x128]
push eax
push 5
push 0xffffffffffffffff
push ebx
call edi
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x120]
push eax
push 7
push 0xffffffffffffffff
push ebx
call edi
push dword [ebp - 0x120]
mov edx, SysReAllocString
mov eax, 0x82
lea ecx, [ebp - 0x90]
call fcn.00402e1c
push 0x42e8b0
lea edi, [ebp - 0x90]
call fcn.00402dd2
push dword [ebp - 0x128]
call fcn.00402dd2
push dword [ebp - 0x128]
call esi
push dword [ebp - 0x120]
call esi
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push ebx
mov edx, edi
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x110]
push dword [ebp - 0x130]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push 0x42e92c
push eax
call dword [ecx + 0x90]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
lea edx, [ebp - 0x124]
push edx
push 0x42a580
push eax
call dword [ecx]
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
push 1
push ebx
push eax
call dword [ecx + 0x18]
cmp eax, ebx
jge 0x4039db
mov byte [ebp - 0x109], bl
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor ebx, ebx
mov esi, dword [ebp - 0x138]
cmp esi, ebx
je 0x403a23
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [esi], ax
movzx eax, byte [ebp - 0x109]
mov word [esi + 8], ax
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0xc8]
call fcn.00407528
xor eax, eax
call fcn.004243fd
ret 0x18