Function at 0x409c30
Capabilities:
Check os version
Get http document via iwebbrowser2
Get session user name
Resolve function by parsing pe exports
Schedule task via itaskscheduler
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41a9f8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1614
call fcn.00414b40
mov eax, dword [0x422084]
xor eax, esp
mov dword [esp + 0x1610], eax
push ebx
push esi
push edi
mov eax, dword [0x422084]
xor eax, esp
push eax
lea eax, [esp + 0x1628]
mov dword fs:[0], eax
push 0x114
xor esi, esi
lea eax, [esp + 0x108]
push esi
push eax
call fcn.004107d0
add esp, 0xc
lea ecx, [esp + 0x104]
push ecx
mov dword [esp + 0x108], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x108], 6
push esi
jb 0x40ade6
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push 3
push 6
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40b061
mov dword [esp + 0x10], esi
lea edx, [esp + 0x10]
push edx
push 0x41e3cc
push 1
push esi
push 0x41e5dc
mov dword [esp + 0x1644], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x409d10
mov dword [esp + 0x1630], 0xffffffff
mov eax, dword [esp + 0x10]
jmp 0x40b055
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0x84]
mov edi, dword [esp + 0x88]
mov ebx, dword [esp + 0x8c]
lea edx, [esp + 0x94]
push edx
mov dword [esp + 0xd4], ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0xb4]
push ecx
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0xc0]
lea eax, [esp + 0xa4]
push eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x1630], 4
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0xe0]
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x7c]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x90]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x94]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x98]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x7c]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x90]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x94]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x98]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0xd4]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0xe8]
mov dword [eax + 4], esi
mov esi, dword [esp + 0xec]
mov dword [eax + 8], esi
mov esi, dword [esp + 0xf0]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x28]
push ecx
call eax
test eax, eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xa4]
push ecx
sets bl
call esi
lea edx, [esp + 0xb4]
push edx
call esi
lea eax, [esp + 0x94]
push eax
call esi
lea ecx, [esp + 0x84]
push ecx
call esi
test bl, bl
je 0x409ec7
mov dword [esp + 0x1630], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40b061
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x40b061
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x1630], 5
mov edi, dword [esp + 0x10]
push 0xc
call fcn.0040b59c
mov esi, eax
add esp, 4
mov dword [esp + 0x7c], esi
mov byte [esp + 0x1630], 6
cmp esi, ebx
je 0x409f1a
push 0x41eb04
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
cmp eax, ebx
jne 0x409f1c
push 0x8007000e
call fcn.00416000
xor esi, esi
mov byte [esp + 0x1630], 5
mov dword [esp + 0x7c], esi
cmp esi, ebx
jne 0x409f36
push 0x8007000e
call fcn.00416000
mov byte [esp + 0x1630], 7
mov eax, dword [esi]
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 0x18]
push edx
push eax
push edi
call ecx
lea edx, [esi + 8]
test eax, eax
push edx
sets bl
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x409f87
mov eax, dword [esi]
test eax, eax
je 0x409f6e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x409f7e
push eax
call fcn.0040bb97
add esp, 4
push esi
call fcn.0040b23d
add esp, 4
test bl, bl
jne 0x40adb8
mov byte [esp + 0x54], bl
xor ebx, ebx
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x3c]
mov byte [esp + 0x1630], 8
mov esi, dword [esp + 0x18]
push eax
mov edi, 0x41efb8
call fcn.00409690
mov byte [esp + 0x1630], 9
mov eax, dword [eax]
cmp eax, ebx
je 0x409fc6
mov eax, dword [eax]
jmp 0x409fc8
xor eax, eax
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [ecx + 0x34]
push esi
call eax
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x40a018
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x40a018
cmp esi, ebx
je 0x40a018
mov eax, dword [esi]
cmp eax, ebx
je 0x409fff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40a00f
push eax
call fcn.0040bb97
add esp, 4
push esi
call fcn.0040b23d
add esp, 4
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x40a26c
mov dword [esp + 0x38], ebx
lea edx, [esp + 0x38]
mov byte [esp + 0x1630], 0xa
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x4c]
call eax
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x40a207
mov dword [esp + 0x3c], ebx
lea edx, [esp + 0x3c]
mov byte [esp + 0x1630], 0xb
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x40a1ef
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov edi, 1
cmp dword [esp + 0x34], edi
jl 0x40a1e9
lea ebx, [ebx]
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1630], 0xc
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push edi
push eax
mov eax, dword [ecx + 0x20]
call eax
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40a187
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
push str.MbLk
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x40a16f
mov dword [esp + 0x40], ebx
lea edx, [esp + 0x40]
mov byte [esp + 0x1630], 0xe
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
push 0x7fe
lea edx, [esp + 0x622]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x628], cx
call fcn.004107d0
add esp, 0xc
push 0x400
lea eax, [esp + 0x620]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x61c]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
cmp esi, ebx
je 0x40a1a8
mov edx, dword [esp + 0x40]
push 0
push 0x400
push esi
push edx
call dword [sym.imp.OLEAUT32.dll_VarR8Pow]
cmp eax, 1
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
sete bl
call esi
mov eax, dword [esp + 0x40]
push eax
test bl, bl
jne 0x40a1b2
call esi
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov byte [esp + 0x1630], 0xc
cmp eax, ebx
je 0x40a183
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1630], 0xb
cmp eax, ebx
je 0x40a19b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
inc edi
cmp edi, dword [esp + 0x34]
jle 0x40a090
jmp 0x40a1eb
push 0x8007000e
call fcn.004079f0
mov byte [esp + 0x58], 1
call esi
mov byte [esp + 0x1630], 0xc
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40a1d1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0xb
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40a1e9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor ebx, ebx
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x1630], 0xa
cmp eax, ebx
je 0x40a203
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x38]
mov byte [esp + 0x1630], 8
cmp eax, ebx
je 0x40a21b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp byte [esp + 0x54], 0
je 0x40a268
mov byte [esp + 0x1630], 5
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x40a23a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40a252
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1630], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
jmp 0x40b057
mov eax, dword [esp + 0x30]
mov byte [esp + 0x1630], 5
cmp eax, ebx
je 0x40a280
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
mov edi, 0x41efb8
call fcn.00409690
mov byte [esp + 0x1630], 0xf
mov eax, dword [eax]
cmp eax, ebx
je 0x40a2a5
mov eax, dword [eax]
jmp 0x40a2a7
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x3c]
push ebx
push eax
push esi
call edx
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x40a2f3
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x40a2f3
cmp esi, ebx
je 0x40a2f3
mov eax, dword [esi]
cmp eax, ebx
je 0x40a2da
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40a2ea
push eax
call fcn.0040bb97
add esp, 4
push esi
call fcn.0040b23d
add esp, 4
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1630], 0x10
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jns 0x40a326
mov byte [esp + 0x1630], 5
mov eax, dword [esp + 0x14]
jmp 0x40a22e
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x1630], 0x11
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jns 0x40a370
mov byte [esp + 0x1630], 0x10
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40a315
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 5
mov eax, dword [esp + 0x14]
jmp 0x40a22e
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov edi, str.video_calendar
call fcn.00409690
mov byte [esp + 0x1630], 0x12
mov eax, dword [eax]
cmp eax, ebx
je 0x40a395
mov eax, dword [eax]
jmp 0x40a397
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x28]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
call fcn.00409730
test bl, bl
jne 0x40ad88
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1630], 0x13
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
test eax, eax
jns 0x40a3fa
mov byte [esp + 0x1630], 0x11
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x40a347
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x40a347
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x58]
push 1
push eax
call edx
test eax, eax
js 0x40a3d9
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push ebx
push eax
call edx
test eax, eax
js 0x40a3d9
mov dword [esp + 0x28], ebx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jns 0x40a458
mov byte [esp + 0x1630], 0x13
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40a3d9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x40a3d9
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1630], 0x15
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push 2
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jns 0x40a495
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40a43e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x40a43e
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1630], 0x16
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push 0x41e4bc
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jns 0x40a4d4
mov byte [esp + 0x1630], 0x15
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x40a47b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x40a47b
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov edi, str.video_calendar_Trigger1
call fcn.00409690
mov byte [esp + 0x1630], 0x17
mov eax, dword [eax]
cmp eax, ebx
je 0x40a4f9
mov eax, dword [eax]
jmp 0x40a4fb
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x24]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
mov byte [esp + 0x1630], 0x16
call fcn.00409730
test bl, bl
je 0x40a547
mov byte [esp + 0x1630], 0x15
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40a536
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x2c]
jmp 0x40ad4c
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov edi, str.2014_12_01T12:05:00
call fcn.00409690
mov byte [esp + 0x1630], 0x18
mov eax, dword [eax]
test eax, eax
je 0x40a56c
mov eax, dword [eax]
jmp 0x40a56e
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x3c]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
mov byte [esp + 0x1630], 0x16
call fcn.00409730
test bl, bl
jne 0x40a51e
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov edi, str.2065_05_02T08:00:00
call fcn.00409690
mov byte [esp + 0x1630], 0x19
mov eax, dword [eax]
test eax, eax
je 0x40a5b6
mov eax, dword [eax]
jmp 0x40a5b8
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x44]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
mov byte [esp + 0x1630], 0x16
call fcn.00409730
test bl, bl
jne 0x40a51e
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 1
push eax
call edx
mov byte [esp + 0x1630], 0x15
test eax, eax
mov eax, dword [esp + 0x24]
js 0x40a52a
xor ebx, ebx
cmp eax, ebx
je 0x40a60f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40a627
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1630], 0x1a
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push 9
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
js 0x40a47b
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1630], 0x1b
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push 0x41e47c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jns 0x40a680
mov byte [esp + 0x1630], 0x1a
jmp 0x40a4c2
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov edi, str.video_calendar_Trigger2
call fcn.00409690
mov byte [esp + 0x1630], 0x1c
mov eax, dword [eax]
cmp eax, ebx
je 0x40a6a5
mov eax, dword [eax]
jmp 0x40a6a7
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x24]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
mov byte [esp + 0x1630], 0x1b
call fcn.00409730
test bl, bl
je 0x40a6d7
mov byte [esp + 0x1630], 0x1a
jmp 0x40a526
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov edi, str.2014_12_01T00:00:00
call fcn.00409690
mov byte [esp + 0x1630], 0x1d
mov eax, dword [eax]
test eax, eax
je 0x40a6fc
mov eax, dword [eax]
jmp 0x40a6fe
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x3c]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
mov byte [esp + 0x1630], 0x1b
call fcn.00409730
test bl, bl
je 0x40a72e
mov byte [esp + 0x1630], 0x1a
jmp 0x40a526
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov edi, str.2065_12_01T00:00:00
call fcn.00409690
mov byte [esp + 0x1630], 0x1e
mov eax, dword [eax]
test eax, eax
je 0x40a753
mov eax, dword [eax]
jmp 0x40a755
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x44]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x30]
sets bl
mov byte [esp + 0x1630], 0x1b
call fcn.00409730
test bl, bl
je 0x40a785
mov byte [esp + 0x1630], 0x1a
jmp 0x40a526
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x426]
push ecx
mov dword [esp + 0x64], 0x100
mov word [esp + 0x428], ax
call fcn.004107d0
add esp, 0xc
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x30]
push ecx
lea edi, [esp + 0x420]
call fcn.00409690
mov byte [esp + 0x1630], 0x1f
mov eax, dword [eax]
test eax, eax
je 0x40a7e7
mov eax, dword [eax]
jmp 0x40a7e9
xor eax, eax
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x5c]
push esi
call eax
test eax, eax
lea edi, [esp + 0x30]
sets bl
call fcn.00409730
mov byte [esp + 0x1630], 0x1a
mov eax, dword [esp + 0x24]
test bl, bl
jne 0x40a52a
xor ebx, ebx
cmp eax, ebx
je 0x40a822
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40a83a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x1630], 0x20
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
test eax, eax
jns 0x40a86c
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x44]
jmp 0x40a487
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x1630], 0x21
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
jns 0x40a8b7
mov byte [esp + 0x1630], 0x20
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x40a8a6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x44]
jmp 0x40a487
mov dword [esp + 0x48], ebx
mov byte [esp + 0x1630], 0x22
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push 0x41e52c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jns 0x40a8f6
mov byte [esp + 0x1630], 0x21
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x40a88e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x40a88e
push 0x7fe
lea ecx, [esp + 0xe22]
xor eax, eax
push ebx
push ecx
mov word [esp + 0xe28], ax
call fcn.004107d0
add esp, 0xc
push 0x400
lea edx, [esp + 0xe20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [esp + 0x48]
lea eax, [esp + 0x58]
push eax
lea edi, [esp + 0xe20]
call fcn.00409690
mov byte [esp + 0x1630], 0x23
mov eax, dword [eax]
cmp eax, ebx
je 0x40a951
mov eax, dword [eax]
jmp 0x40a953
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2c]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x58]
sets bl
mov byte [esp + 0x1630], 0x22
call fcn.00409730
test bl, bl
jne 0x40ad10
mov esi, dword [esp + 0x48]
lea eax, [esp + 0x58]
push eax
mov edi, 0x41ef54
call fcn.00409690
mov byte [esp + 0x1630], 0x24
mov eax, dword [eax]
test eax, eax
je 0x40a99f
mov eax, dword [eax]
jmp 0x40a9a1
xor eax, eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x34]
push eax
push esi
call edx
test eax, eax
lea edi, [esp + 0x58]
sets bl
call fcn.00409730
test bl, bl
jne 0x40ad10
xor esi, esi
mov dword [esp + 0x50], esi
mov byte [esp + 0x1630], 0x25
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
jns 0x40aad3
mov byte [esp + 0x1630], 0x22
mov eax, dword [esp + 0x50]
cmp eax, esi
je 0x40a9ff
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x21
mov eax, dword [esp + 0x48]
cmp eax, esi
je 0x40aa17
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x20
mov eax, dword [esp + 0x4c]
cmp eax, esi
je 0x40aa2f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x44]
cmp eax, esi
je 0x40aa47
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x13
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x40aa5f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x11
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x40aa77
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x10
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x40aa8f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 5
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40aaa7
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x40aabf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1630], 0xffffffff
mov eax, dword [esp + 0x10]
jmp 0x40b055
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push 3
push eax
call edx
test eax, eax
js 0x40a9e7
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push esi
push eax
call edx
test eax, eax
js 0x40a9e7
mov dword [esp + 0x80], esi
mov eax, 8
mov byte [esp + 0x1630], 0x26
push 0x41e888
mov word [esp + 0xa8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0xac], eax
cmp eax, esi
jne 0x40ab3a
push 0x8007000e
call fcn.00416000
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xb0]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0xb4]
push eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x94], edx
call esi
mov edx, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0xc0]
lea edx, [esp + 0x94]
push edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
call esi
mov byte [esp + 0x1630], 0x29
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
mov edx, dword [esp + 0x9c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x58]
push ecx
mov edi, 0x41efb8
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
call fcn.00409690
mov byte [esp + 0x1630], 0x2a
mov eax, dword [eax]
test eax, eax
je 0x40ac03
mov ecx, dword [eax]
jmp 0x40ac05
xor ecx, ecx
mov edi, dword [esp + 0x88]
lea eax, [esp + 0x80]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], edi
mov edi, dword [esp + 0xa0]
mov dword [eax + 8], edi
mov edi, dword [esp + 0xa4]
mov dword [eax + 0xc], edi
mov edi, dword [esp + 0x70]
push 3
sub esp, 0x10
mov eax, esp
mov dword [eax], edi
mov edi, dword [esp + 0x88]
mov dword [eax + 4], edi
mov edi, dword [esp + 0x8c]
mov edx, dword [esi]
mov dword [eax + 8], edi
mov edi, dword [esp + 0x90]
mov dword [eax + 0xc], edi
mov edi, dword [esp + 0x94]
sub esp, 0x10
mov eax, esp
mov dword [eax], edi
mov edi, dword [esp + 0xa8]
mov dword [eax + 4], edi
mov edi, dword [esp + 0xac]
mov dword [eax + 8], edi
mov edi, dword [esp + 0xb0]
push 6
mov dword [eax + 0xc], edi
mov eax, dword [esp + 0x50]
push eax
push ecx
mov ecx, dword [edx + 0x44]
push esi
call ecx
test eax, eax
lea edi, [esp + 0x58]
sets bl
call fcn.00409730
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [esp + 0x94]
push edx
call esi
lea eax, [esp + 0xb4]
push eax
call esi
lea ecx, [esp + 0xa4]
push ecx
call esi
mov byte [esp + 0x1630], 0x25
mov eax, dword [esp + 0x80]
test bl, bl
je 0x40acec
test eax, eax
je 0x40acf8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x40acf8
test eax, eax
je 0x40acf8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x22
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40ad10
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x21
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40ad28
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x20
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x40ad40
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x14
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40ad58
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x13
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40ad70
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x11
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40ad88
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x10
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40ada0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40adb8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40add0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1630], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
jmp 0x40b057
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x38], esi
lea eax, [esp + 0x38]
push eax
push 0x41e67c
push 1
push esi
push 0x41e69c
mov dword [esp + 0x1644], 0x2b
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40b046
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
mov bl, 0x2d
mov byte [esp + 0x1630], bl
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x41efb8
push eax
call edx
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push 0x41e66c
push 0x41e68c
push 0x41efb8
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
js 0x40b016
push 0x7fe
lea ecx, [esp + 0x622]
xor eax, eax
push esi
push ecx
mov word [esp + 0x628], ax
call fcn.004107d0
add esp, 0xc
push 0x400
lea edx, [esp + 0x620]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
lea edx, [esp + 0x61c]
push edx
push eax
mov eax, dword [ecx + 0x80]
call eax
test eax, eax
js 0x40b016
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0x41ef54
push eax
call edx
test eax, eax
js 0x40b016
push 0x1fe
lea ecx, [esp + 0x222]
xor eax, eax
push esi
push ecx
mov dword [esp + 0x88], 0x100
mov word [esp + 0x228], ax
call fcn.004107d0
add esp, 0xc
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x220]
push edx
push eax
mov eax, dword [ecx + 0x78]
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push 0x2000
push eax
call edx
mov dword [esp + 0x3c], esi
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x1634], 0x2e
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x40afff
push 0x30
lea eax, [esp + 0xd8]
push esi
push eax
call fcn.004107d0
mov eax, 0x7de
mov word [esp + 0xe4], ax
mov edx, 0xd
mov word [esp + 0xf0], dx
mov eax, 1
mov word [esp + 0x104], ax
mov eax, dword [esp + 0x48]
add esp, 0xc
mov ecx, 0x30
lea edx, [esp + 0xd4]
mov dword [esp + 0xda], 0x1000c
mov word [esp + 0xd4], cx
mov dword [esp + 0xf4], 7
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x40afff
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 0x41c36c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x40afff
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push esi
push eax
call edx
mov byte [esp + 0x1630], bl
mov eax, dword [esp + 0x3c]
cmp eax, esi
je 0x40b016
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x2c
mov eax, dword [esp + 0x40]
cmp eax, esi
je 0x40b02e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1630], 0x2b
mov eax, dword [esp + 0x34]
cmp eax, esi
je 0x40b046
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1630], 0xffffffff
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x40b061
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x1628]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1610]
xor ecx, esp
call fcn.0040b177
mov esp, ebp
pop ebp
ret 4