Function at 0x405560
Capabilities:
Query environment variable
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f8ea
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x418
mov eax, dword [0x4a237c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3d4], edi
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40631f
lea eax, [ebp - 0x388]
mov dword [ebp - 0x388], 0
push eax
push 0x4936b0
push 1
push 0
push 0x4936d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x406319
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x408]
push eax
call esi
movups xmm0, xmmword [ebp - 0x408]
lea eax, [ebp - 0x340]
push eax
movups xmmword [ebp - 0x3e8], xmm0
call esi
movups xmm0, xmmword [ebp - 0x340]
lea eax, [ebp - 0x3d0]
push eax
movups xmmword [ebp - 0x418], xmm0
call esi
movups xmm0, xmmword [ebp - 0x3d0]
lea eax, [ebp - 0x3f8]
push eax
movups xmmword [ebp - 0x428], xmm0
call esi
mov byte [ebp - 4], 4
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x388]
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x418]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x428]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x3f8]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x28]
mov esi, eax
lea eax, [ebp - 0x3f8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x408]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x40630d
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x49e090]
movups xmmword [ebp - 0x384], xmm0
mov dword [ebp - 0x390], 0
mov esi, dword [eax]
movaps xmm0, xmmword [0x49e0a0]
movups xmmword [ebp - 0x374], xmm0
mov dword [ebp - 0x364], 0x71122323
mov eax, dword [esi + 0x1e4]
mov dword [ebp - 0x360], 0x6a192d36
mov word [ebp - 0x35c], 0x166d
mov byte [ebp - 0x35a], 0x77
mov dword [ebp - 0x3d8], esi
test al, 1
jne 0x40578c
or eax, 1
mov dword [esi + 0x1e4], eax
mov byte [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x338], xmm0
mov edx, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x338]
mov byte [esi + 0x213], 1
nop
mov al, byte [ebp + ecx - 0x384]
mov byte [esi + ecx + 0x1e8], al
add ecx, 1
adc edx, 0
jne 0x40577b
cmp ecx, 0x2b
jb 0x405760
push 0x47fc80
call fcn.0045a847
add esp, 4
mov byte [ebp - 4], 0
cmp byte [esi + 0x213], 0
lea eax, [esi + 0x1e8]
mov dword [ebp - 0x3bc], eax
je 0x4057ff
mov edi, dword [ebp - 0x3bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov eax, dword [ebp - 0x3c4]
mov esi, dword [ebp - 0x3c8]
mov dword [ebp - 0x3c0], eax
mov ecx, esi
mov eax, 0x1777103
and ecx, 7
mov edx, 0x36d5f59
shl ecx, 3
call fcn.0047f150
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3c0], 0
jne 0x4057ef
cmp esi, 0x2b
jb 0x4057c4
mov eax, dword [ebp - 0x3bc]
mov byte [edi + 0x2b], 0
mov edi, dword [ebp - 0x3d4]
push eax
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 6
mov eax, dword [eax]
test eax, eax
je 0x405819
mov edx, dword [eax]
jmp 0x40581b
xor edx, edx
mov eax, dword [ebp - 0x388]
lea esi, [ebp - 0x390]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
mov dword [ebp - 0x3bc], eax
test esi, esi
je 0x40588d
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x40588d
test esi, esi
je 0x40588d
mov eax, dword [esi]
test eax, eax
je 0x405865
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40587c
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
mov eax, dword [ebp - 0x3bc]
add esp, 8
test eax, eax
jns 0x40592f
push 0x49dff8
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 7
mov eax, dword [eax]
test eax, eax
je 0x4058b3
mov edx, dword [eax]
jmp 0x4058b5
xor edx, edx
mov eax, dword [ebp - 0x388]
lea esi, [ebp - 0x390]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
mov dword [ebp - 0x3bc], eax
test esi, esi
je 0x405927
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x405927
test esi, esi
je 0x405927
mov eax, dword [esi]
test eax, eax
je 0x4058ff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405916
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
mov eax, dword [ebp - 0x3bc]
add esp, 8
test eax, eax
js 0x40630d
mov eax, dword [ebp - 0x388]
lea edx, [ebp - 0x38c]
push edx
mov dword [ebp - 0x38c], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x406301
mov eax, dword [ebp - 0x38c]
lea edx, [ebp - 0x398]
mov dword [ebp - 0x398], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x4062f5
mov eax, dword [ebp - 0x398]
lea edx, [ebp - 0x39c]
push edx
mov dword [ebp - 0x39c], 0
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x4062e9
mov eax, dword [ebp - 0x39c]
lea edx, [ebp - 0x394]
push edx
mov dword [ebp - 0x394], 0
push 0x4936c0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x4062dd
push str.Trigger1
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 8
mov edx, dword [eax]
test edx, edx
je 0x4059e9
mov edx, dword [edx]
jmp 0x4059eb
xor edx, edx
mov eax, dword [ebp - 0x394]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x405a4a
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405a4a
test esi, esi
je 0x405a4a
mov eax, dword [esi]
test eax, eax
je 0x405a28
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405a3f
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
mov esi, dword [ebp - 0x3d8]
movaps xmm0, xmmword [0x49e0d0]
movups xmmword [ebp - 0x358], xmm0
mov dword [ebp - 0x348], 0xb3cd139d
mov eax, dword [esi + 0x1c4]
test al, 1
jne 0x405acc
or eax, 1
mov dword [esi + 0x1c4], eax
mov byte [ebp - 4], 9
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
mov byte [esi + 0x1e0], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x358]
mov byte [esi + ecx + 0x1cc], al
add ecx, 1
adc edx, 0
jne 0x405abb
cmp ecx, 0x14
jb 0x405aa0
push 0x47fc40
call fcn.0045a847
add esp, 4
mov byte [ebp - 4], 0
cmp byte [esi + 0x1e0], 0
lea eax, [esi + 0x1cc]
mov dword [ebp - 0x3c0], eax
je 0x405b3f
mov edi, dword [ebp - 0x3c0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov eax, dword [ebp - 0x3c4]
mov esi, dword [ebp - 0x3c8]
mov dword [ebp - 0x3bc], eax
mov ecx, esi
mov eax, 0xb3fd23a7
and ecx, 7
mov edx, 0xafc9b32f
shl ecx, 3
call fcn.0047f150
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3bc], 0
jne 0x405b2f
cmp esi, 0x14
jb 0x405b04
mov eax, dword [ebp - 0x3c0]
mov byte [edi + 0x14], 0
mov edi, dword [ebp - 0x3d4]
push eax
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 0xa
mov edx, dword [eax]
test edx, edx
je 0x405b59
mov edx, dword [edx]
jmp 0x405b5b
xor edx, edx
mov eax, dword [ebp - 0x394]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x405bba
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405bba
test esi, esi
je 0x405bba
mov eax, dword [esi]
test eax, eax
je 0x405b98
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405baf
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
mov esi, dword [ebp - 0x3d8]
movaps xmm0, xmmword [0x49e0f0]
movups xmmword [ebp - 0x358], xmm0
mov dword [ebp - 0x348], 0xdf6c9add
mov eax, dword [esi + 0x214]
test al, 1
jne 0x405c3c
or eax, 1
mov dword [esi + 0x214], eax
mov byte [ebp - 4], 0xb
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
mov byte [esi + 0x1c0], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x358]
mov byte [esi + ecx + 0x1ac], al
add ecx, 1
adc edx, 0
jne 0x405c2b
cmp ecx, 0x14
jb 0x405c10
push 0x47fc00
call fcn.0045a847
add esp, 4
mov byte [ebp - 4], 0
cmp byte [esi + 0x1c0], 0
lea eax, [esi + 0x1ac]
mov dword [ebp - 0x3c0], eax
je 0x405caf
mov edi, dword [ebp - 0x3c0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov eax, dword [ebp - 0x3c4]
mov esi, dword [ebp - 0x3c8]
mov dword [ebp - 0x3bc], eax
mov ecx, esi
mov eax, 0xdf55afe7
and ecx, 7
mov edx, 0x83af0533
shl ecx, 3
call fcn.0047f150
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3bc], 0
jne 0x405c9f
cmp esi, 0x14
jb 0x405c74
mov eax, dword [ebp - 0x3c0]
mov byte [edi + 0x14], 0
mov edi, dword [ebp - 0x3d4]
push eax
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 0xc
mov edx, dword [eax]
test edx, edx
je 0x405cc9
mov edx, dword [edx]
jmp 0x405ccb
xor edx, edx
mov eax, dword [ebp - 0x394]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x405d2a
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405d2a
test esi, esi
je 0x405d2a
mov eax, dword [esi]
test eax, eax
je 0x405d08
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405d1f
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
mov eax, dword [ebp - 0x394]
lea edx, [ebp - 0x3b4]
mov dword [ebp - 0x3b4], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x4062d1
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
lea ecx, [ebp - 0x334]
cmovae eax, dword [ebx + 8]
push eax
call fcn.00405260
mov byte [ebp - 4], 0xd
mov edx, dword [eax]
test edx, edx
je 0x405d74
mov edx, dword [edx]
jmp 0x405d76
xor edx, edx
mov eax, dword [ebp - 0x3b4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x405dd5
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405dd5
test esi, esi
je 0x405dd5
mov eax, dword [esi]
test eax, eax
je 0x405db3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405dca
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
mov eax, dword [ebp - 0x38c]
lea edx, [ebp - 0x3a0]
mov dword [ebp - 0x3a0], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x4062d1
mov eax, dword [ebp - 0x3a0]
lea edx, [ebp - 0x3a4]
push edx
mov dword [ebp - 0x3a4], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
test eax, eax
js 0x4062c5
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a8]
push edx
mov dword [ebp - 0x3a8], 0
push str.MbLk
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x4062b9
push 0x104
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0045c350
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push 0
push eax
call fcn.0045c350
lea ecx, [ebp - 0x120]
add esp, 0xc
sub ecx, edi
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x405e80
lea edi, [ebp - 0x120]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405e94
mov ax, word [0x49dff8]
mov word [edi], ax
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x228]
push 0x5c
push eax
call fcn.0045c210
mov edx, eax
add esp, 8
test edx, edx
je 0x405ed3
inc edx
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x405ed5
lea edi, [ebp - 0x120]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405ee5
mov ecx, edx
lea eax, [ebp - 0x330]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x120]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 0xe
mov edx, dword [eax]
test edx, edx
je 0x405f34
mov edx, dword [edx]
jmp 0x405f36
xor edx, edx
mov eax, dword [ebp - 0x3a8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x405f95
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405f95
test esi, esi
je 0x405f95
mov eax, dword [esi]
test eax, eax
je 0x405f73
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405f8a
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
push str.__check
lea ecx, [ebp - 0x334]
call fcn.00405260
mov byte [ebp - 4], 0xf
mov edx, dword [eax]
test edx, edx
je 0x405fb3
mov edx, dword [edx]
jmp 0x405fb5
xor edx, edx
mov eax, dword [ebp - 0x3a8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x406014
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x406014
test esi, esi
je 0x406014
mov eax, dword [esi]
test eax, eax
je 0x405ff2
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x406009
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
mov eax, dword [ebp - 0x38c]
lea edx, [ebp - 0x3ac]
mov dword [ebp - 0x3ac], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x4062f5
mov eax, dword [ebp - 0x3ac]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x38c]
push dword [ebp - 0x3ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
test eax, eax
jns 0x406068
mov eax, dword [ebp - 0x3ac]
jmp 0x4062ef
mov eax, 8
mov dword [ebp - 0x3b0], 0
push 0x49e010
mov word [ebp - 0x3f8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x3f0], eax
test eax, eax
je 0x4064a5
movups xmm0, xmmword [ebp - 0x3f8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x3e8]
push eax
movups xmmword [ebp - 0x428], xmm0
call esi
movups xmm0, xmmword [ebp - 0x3e8]
lea eax, [ebp - 0x408]
push eax
movups xmmword [ebp - 0x418], xmm0
call esi
mov esi, dword [ebp - 0x3d8]
mov byte [ebp - 4], 0x12
movups xmm0, xmmword [ebp - 0x408]
mov dword [ebp - 0x338], 0x96490090
mov eax, dword [esi + 0x1c8]
mov word [ebp - 0x334], 0x482a
mov byte [ebp - 0x332], 0x79
movups xmmword [ebp - 0x358], xmm0
test al, 1
jne 0x40615e
or eax, 1
mov dword [esi + 0x1c8], eax
mov byte [ebp - 4], 0x13
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
mov byte [esi + 0x1ab], 1
mov al, byte [ebp + ecx - 0x338]
mov byte [esi + ecx + 0x1a4], al
add ecx, 1
adc edx, 0
jne 0x40614d
cmp ecx, 7
jb 0x406132
push 0x47fbc0
call fcn.0045a847
add esp, 4
mov byte [ebp - 4], 0x12
cmp byte [esi + 0x1ab], 0
lea edi, [esi + 0x1a4]
je 0x4061bf
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c8], xmm0
mov eax, dword [ebp - 0x3c4]
mov esi, dword [ebp - 0x3c8]
mov dword [ebp - 0x3bc], eax
nop word [eax + eax]
mov ecx, esi
mov eax, 0xf72761dd
and ecx, 7
mov edx, 0xd792d4d
shl ecx, 3
call fcn.0047f150
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3bc], 0
jne 0x4061bb
cmp esi, 7
jb 0x406190
mov byte [edi + 7], 0
push edi
lea ecx, [ebp - 0x3c0]
call fcn.00405260
mov byte [ebp - 4], 0x14
mov eax, dword [eax]
test eax, eax
je 0x4061d9
mov esi, dword [eax]
jmp 0x4061db
xor esi, esi
movups xmm0, xmmword [ebp - 0x428]
mov ecx, dword [ebp - 0x390]
lea eax, [ebp - 0x3b0]
push eax
sub esp, 0x10
mov eax, esp
mov edx, dword [ecx]
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x418]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x358]
push 6
push dword [ebp - 0x38c]
movups xmmword [eax], xmm0
push esi
push ecx
call dword [edx + 0x44]
mov esi, dword [ebp - 0x3c0]
mov edi, eax
test esi, esi
je 0x406280
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x406276
test esi, esi
je 0x406276
mov eax, dword [esi]
test eax, eax
je 0x406254
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40626b
push eax
call fcn.0045a764
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045a799
add esp, 8
mov dword [ebp - 0x3c0], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x408]
push eax
call esi
lea eax, [ebp - 0x3e8]
push eax
call esi
lea eax, [ebp - 0x3f8]
mov byte [ebp - 4], 0
push eax
call esi
test edi, edi
jns 0x40635b
mov eax, dword [ebp - 0x3a8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x3a0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x394]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x39c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x398]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x390]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x388]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 1
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x406485
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40647b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4064af
jmp 0x40647b
lea eax, [ebp - 0x3e8]
mov dword [ebp - 0x3b8], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x3b8]
mov ecx, dword [ebp - 0x3b0]
movups xmm0, xmmword [ebp - 0x3e8]
push eax
sub esp, 0x10
mov edx, dword [ecx]
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x30]
mov esi, eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0x3e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x3b0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jns 0x406402
mov eax, dword [ebp - 0x3b4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x394]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x39c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x398]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x3a0]
jmp 0x4062ef
mov eax, dword [ebp - 0x3a8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x3a0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x394]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x39c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x398]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x390]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x388]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
jmp 0x406324
push edx
push ecx
call fcn.0045a799
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a753
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x8007000e
call fcn.0045a3e0
call fcn.00460059
int3