Function at 0x437a60
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1f30
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push esi
push edi
mov eax, dword [0x524a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 0x74], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x437ab0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x4f0ab8
push 1
push 0
push 0x500b04
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437c3e
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xa4]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0xa4], xmm0
call esi
movups xmm0, xmmword [ebp - 0xa4]
lea eax, [ebp - 0x94]
push eax
movups xmmword [ebp - 0xc8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x94], xmm0
call esi
movups xmm0, xmmword [ebp - 0x94]
lea eax, [ebp - 0xb8]
push eax
movups xmmword [ebp - 0xd8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xb8], xmm0
call esi
movups xmm0, xmmword [ebp - 0xb8]
lea eax, [ebp - 0x84]
push eax
movups xmmword [ebp - 0xe8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x84], xmm0
call esi
movups xmm0, xmmword [ebp - 0xc8]
mov eax, dword [ebp - 0x14]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 4
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd8]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xe8]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x84]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call edi
lea eax, [ebp - 0xb8]
push eax
call edi
lea eax, [ebp - 0x94]
push eax
call edi
lea eax, [ebp - 0xa4]
push eax
call edi
test esi, esi
js 0x437c3e
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x14]
push 0x4eaa20
mov byte [ebp - 4], 5
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4389ab
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
push esi
push edi
mov byte [ebp - 4], 6
call dword [eax + 0x1c]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x437c5b
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x437c3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x438991
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x438991
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 7
test eax, eax
jne 0x437d5f
xor esi, esi
mov dword [ebp - 0x5c], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push esi
push edi
mov byte [ebp - 4], 8
call dword [eax + 0x34]
push esi
mov edi, eax
mov byte [ebp - 4], 7
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x437f45
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x437f45
mov dword [ebp - 0x60], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x60]
push edx
push eax
mov byte [ebp - 4], 9
call dword [ecx + 0x4c]
test eax, eax
js 0x437f34
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x68]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x437f23
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x58]
push edx
push 1
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x20]
test eax, eax
js 0x437f12
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x437f12
cmp dword [ebp - 0x54], 0
jne 0x437f12
push dword [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.00437770
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x437f04
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4e8ad8
call edi
mov esi, eax
mov dword [ebp - 0xa8], esi
test esi, esi
je 0x4389b5
jmp 0x437d79
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call eax
mov esi, eax
mov dword [ebp - 0x5c], esi
test esi, esi
je 0x4389bf
jmp 0x437c79
push 0x4e8ad8
mov byte [ebp - 4], 0xd
call edi
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x4389c9
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4e8ad8
mov byte [ebp - 4], 0xe
call eax
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4389d3
mov ecx, dword [ebp + 0xc]
push esi
mov byte [ebp - 4], 0xf
call fcn.00438aa0
test eax, eax
jne 0x437de3
mov ecx, dword [ebp + 0xc]
push edi
lea ecx, [ecx + 4]
call fcn.00438aa0
test eax, eax
jne 0x437de3
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x48]
lea ecx, [ecx + 8]
call fcn.00438aa0
test eax, eax
je 0x437e72
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.004377b0
mov edx, dword [ebp - 0x18]
push dword [eax]
mov byte [ebp - 4], 0x10
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
push dword [ebp - 0x10]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call fcn.004377b0
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x11
push edx
mov ecx, dword [edx]
call dword [ecx + 0x3c]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
call fcn.004377b0
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x12
push edx
mov ecx, dword [edx]
call dword [ecx + 0x34]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x437eec
cmp word [ebp - 0x5c], 0xffff
je 0x437e9c
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push dword [ebp - 0x48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x437ec2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x437ed3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 9
test eax, eax
je 0x437ee4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
jmp 0x438939
push dword [ebp - 0x48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x437f12
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x437f23
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 9
test eax, eax
je 0x437f34
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 7
test eax, eax
je 0x437f45
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x437fb3
xor esi, esi
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
push 0
push esi
push edi
mov byte [ebp - 4], 0x13
call dword [eax + 0x3c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x24]
test eax, eax
jns 0x437fc9
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x437f99
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x437c2d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x437c2d
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4389dd
jmp 0x437f54
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x437fdd
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov eax, dword [ebp - 0x2c]
jns 0x43800f
mov byte [ebp - 4], 0x14
test eax, eax
je 0x437f88
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x437f88
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00438e50
add esp, 4
mov eax, dword [eax]
mov byte [ebp - 4], 0x16
test eax, eax
jne 0x438074
xor esi, esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x18]
push esi
push ecx
mov byte [ebp - 4], 0x17
mov eax, dword [ecx]
call dword [eax + 0x28]
push esi
call edi
mov edx, dword [ebp - 0x54]
or eax, 0xffffffff
mov byte [ebp - 4], 0x15
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43805d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x43808a
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x4380a1
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4389e7
jmp 0x43802d
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4389f1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x18
call dword [eax + 0x20]
push esi
mov byte [ebp - 4], 0x15
call edi
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4380c7
mov dword [ebp - 0x2c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x43810e
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4380f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x437f88
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x437f88
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x3c]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x1a
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x28]
mov esi, eax
test edx, edx
je 0x438141
mov dword [ebp - 0x28], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
test esi, esi
jns 0x438169
mov byte [ebp - 4], 0x19
test eax, eax
je 0x438159
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test edx, edx
je 0x4380f4
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x4380f4
xor ecx, ecx
mov dword [ebp - 0x34], ecx
test eax, eax
je 0x438193
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push 0x4f09b8
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x34]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x3c]
cmovs ecx, edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 0x1b
test ecx, ecx
je 0x438148
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov eax, dword [ebp - 0x34]
push str.Trigger1
mov dword [ebp - 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x4389fb
mov ecx, dword [ebp - 0x10]
push esi
push ecx
mov byte [ebp - 4], 0x1c
mov eax, dword [ecx]
call dword [eax + 0x24]
push esi
mov byte [ebp - 4], 0x1b
call edi
cmp word [0x52ac18], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
jne 0x4381fd
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x52ac18
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.004045a0
mov ecx, eax
test ecx, ecx
je 0x438a05
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push 0x52ac18
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1d
call fcn.004040f0
test al, al
jne 0x438253
mov ecx, 0x52ac18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438236
sub ecx, edx
sar ecx, 1
push ecx
push 0x52ac18
lea ecx, [ebp - 0x48]
call fcn.00404e90
mov edi, dword [ebp - 0x48]
mov byte [ebp - 4], 0x1e
test edi, edi
jne 0x4382a5
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x54]
push esi
push ecx
mov byte [ebp - 4], 0x1f
mov eax, dword [ecx]
call dword [eax + 0x5c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x1b
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x438294
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004045a0
mov ecx, eax
test ecx, ecx
je 0x438a0f
jmp 0x4382bb
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x438a19
jmp 0x438263
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x3c
mov byte [ebp - 4], 0x20
mov eax, dword [eax + 0x10]
cdq
idiv ecx
push edx
push eax
lea eax, [ebp - 0x30]
push str.PT_dM_dS
push eax
call fcn.00407c50
mov eax, dword [ebp - 0x30]
add esp, 0x10
mov ecx, dword [ebp - 0x34]
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x438307
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x43831a
push eax
call edi
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x438a23
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x21
call dword [eax + 0x54]
push esi
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x20
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x34]
test edx, edx
je 0x438347
mov dword [ebp - 0x34], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0x10], 0
jge 0x438380
lea ecx, [ebp - 0x30]
call fcn.00403980
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x438366
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x4380e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4380e3
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x38]
push edx
push eax
mov byte [ebp - 4], 0x22
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x4383af
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x20
test eax, eax
je 0x43834d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x43834d
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x50]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x23
call dword [ecx + 0x30]
mov edx, dword [ebp - 0x38]
mov esi, eax
test edx, edx
je 0x4383e2
mov dword [ebp - 0x38], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
test esi, esi
jns 0x438411
mov byte [ebp - 4], 0x22
test eax, eax
je 0x4383fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x38]
mov byte [ebp - 4], 0x20
test edx, edx
je 0x43834d
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x43834d
xor esi, esi
mov dword [ebp - 0x44], esi
test eax, eax
je 0x43843b
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push 0x4f09a8
push eax
call dword [ecx]
mov esi, dword [ebp - 0x44]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
test eax, eax
mov eax, dword [ebp - 0x50]
cmovs esi, ecx
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], 0x24
test esi, esi
je 0x4383e9
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x438480
xor edi, edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
push edi
push esi
mov byte [ebp - 4], 0x25
call dword [eax + 0x2c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x24
call edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
test eax, eax
jne 0x438492
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x4384a9
push eax
call edi
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x438a2d
jmp 0x438451
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x438a37
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x26
call dword [eax + 0x3c]
push esi
mov byte [ebp - 4], 0x24
call edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 8]
test eax, eax
jne 0x4384d2
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x4384e9
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x438a41
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x27
call dword [eax + 0x34]
push esi
call edi
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x4c]
push edx
push eax
mov byte [ebp - 4], 0x28
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
mov eax, dword [ebp - 0x4c]
jns 0x43854f
mov byte [ebp - 4], 0x24
test eax, eax
je 0x438524
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x438535
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x43839c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x43839c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00438e50
add esp, 4
mov eax, dword [eax]
mov byte [ebp - 4], 0x29
test eax, eax
jne 0x4385bd
xor esi, esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x18]
push esi
push ecx
mov byte [ebp - 4], 0x2a
mov eax, dword [ecx]
call dword [eax + 0x20]
push esi
call edi
mov edx, dword [ebp - 0x54]
or eax, 0xffffffff
mov byte [ebp - 4], 0x28
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43859d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4c]
push str.BUILTINAdministrators
mov dword [ebp - 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x438a4b
jmp 0x4385d3
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x438a55
jmp 0x43856d
mov ecx, dword [ebp - 0x10]
push esi
push ecx
mov byte [ebp - 4], 0x2b
mov eax, dword [ecx]
call dword [eax + 0x40]
push esi
mov byte [ebp - 4], 0x28
call edi
mov eax, dword [ebp - 0x4c]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x438607
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x2c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
mov eax, dword [ebp - 0x40]
jns 0x43863c
mov byte [ebp - 4], 0x28
test eax, eax
je 0x438634
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
jmp 0x438516
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x40]
push str.PT0S
mov dword [ebp - 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x438a5f
mov ecx, dword [ebp - 0x10]
push esi
push ecx
mov byte [ebp - 4], 0x2d
mov eax, dword [ecx]
call dword [eax + 0x70]
push esi
call edi
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x64]
push edx
push eax
mov byte [ebp - 4], 0x2e
mov ecx, dword [eax]
call dword [ecx + 0x9c]
test eax, eax
js 0x4386b3
mov eax, dword [ebp - 0x64]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x4386c7
mov dword [ebp - 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x6c], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x94]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x94], xmm0
call esi
movups xmm0, xmmword [ebp - 0x94]
lea eax, [ebp - 0xa4]
push eax
movups xmmword [ebp - 0xd8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa4], xmm0
call esi
movups xmm0, xmmword [ebp - 0xa4]
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x31
push eax
movups xmmword [ebp - 0xc8], xmm0
call fcn.00438e50
add esp, 4
mov esi, dword [eax]
xor eax, eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x10], esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x438a69
mov eax, 8
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [ebp - 0x84], ax
call esi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x438772
cmp dword [ebp - 0x10], eax
jne 0x438a6f
movups xmm0, xmmword [ebp - 0x84]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x18], edx
movups xmmword [ebp - 0xe8], xmm0
test eax, eax
jne 0x438798
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x4387b2
push eax
call esi
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x438a8c
movups xmm0, xmmword [ebp - 0xe8]
mov edx, dword [ebp - 0x18]
movups xmm1, xmmword [ebp - 0xd8]
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
sub esp, 0x10
mov byte [ebp - 4], 0x34
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm1
mov eax, esp
sub esp, 0x10
movups xmm1, xmmword [ebp - 0xc8]
movups xmmword [eax], xmm1
mov eax, esp
push 6
push dword [ebp - 0x1c]
push esi
push edx
movups xmmword [eax], xmm0
call dword [ecx + 0x44]
push esi
mov dword [ebp - 0x10], eax
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x84]
push eax
call edi
mov edx, dword [ebp - 0x48]
or esi, 0xffffffff
mov byte [ebp - 4], 0x31
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x438824
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xa4]
push eax
call edi
lea eax, [ebp - 0x94]
push eax
call edi
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0x2e
jge 0x438866
test eax, eax
je 0x43884d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0x2c
test eax, eax
je 0x43885e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
jmp 0x438626
test eax, eax
je 0x438870
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0x2c
test eax, eax
je 0x438881
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x28
test eax, eax
je 0x438892
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x24
test eax, eax
je 0x4388a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x4388b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x4388c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x20
test eax, eax
je 0x4388d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4388f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x438903
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x438914
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x438925
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x438936
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x438947
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x438958
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x438969
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x43897d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.LDS_GAMECENTER
call fcn.00438b40
add esp, 4
mov dword [ebp - 0x74], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x80004005
call fcn.00403f90
push 0x80004005
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
push eax
call fcn.00403f90
mov eax, 0xa
mov dword [ebp - 0x7c], 0x8007000e
push 0x8007000e
mov word [ebp - 0x84], ax
call fcn.00403f90
push 0x8007000e
call fcn.00403f90
int3