Function at 0x18002d0fc
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x800
mov qword [rsp + 0x1d8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
mov r13d, edx
mov r15, rcx
lea rdx, str.SBWUpdateTask_Logon_
lea rcx, [rsp + 0x50]
call fcn.1800041c0
nop
xor r14d, r14d
cmp r13d, r14d
jne 0x18002d179
lea rcx, str.SBWUpdateTask_Time_
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.SBWUpdateTask_Time_
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.180003e28
mov rax, qword [0x18015f768]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
lea rcx, [0x18015f720]
call fcn.1800cf560
mov rbx, qword [rsp + 0x60]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x50]
call fcn.180008324
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
or edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov r12d, eax
cmp eax, r14d
jge 0x18002d25e
cmp eax, 0x80010119
je 0x18002d25e
mov dword [rsp + 0x20], eax
lea r9, [0x18011a530]
mov r8d, 0x23c
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000dc6c
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d235
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d235
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d256
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d256
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov qword [rsp + 0x78], r14
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x18010c9a0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x18010cb90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp eax, r14d
jge 0x18002d304
mov dword [rsp + 0x20], eax
lea r9, str.Failed_to_create_an_instance_of_ITaskService:__x
mov r8d, 0x24a
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d2dc
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d2dc
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d2fd
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d2fd
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x1a8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x190]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x190]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x1c0]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x1e0]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x250]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x230]
call qword [rax + 0x50]
mov ebx, eax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x190]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp ebx, r14d
jge 0x18002d4cf
mov dword [rsp + 0x20], ebx
lea r9, str.ITaskService::Connect_failed:__x
mov r8d, 0x252
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d4a7
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d4a7
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d4c8
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d4c8
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0x68], r14
lea rdx, [0x18010d37c]
lea rcx, [rsp + 0x148]
call fcn.18002b694
nop
mov rcx, qword [rax]
cmp rcx, r14
je 0x18002d4f6
mov rdx, qword [rcx]
jmp 0x18002d4f9
mov rdx, r14
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
call qword [rax + reloc.WS2_32.dll_getservbyport]
mov r12d, eax
mov rbx, qword [rsp + 0x148]
cmp rbx, r14
je 0x18002d54d
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
add ecx, edi
jne 0x18002d54d
cmp rbx, r14
je 0x18002d54d
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002d537
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002d545
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
cmp r12d, r14d
jge 0x18002d5d9
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_get_Root_Folder_pointer:__x
mov r8d, 0x25e
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d5b0
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d5b0
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d5d1
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002d5d1
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x118]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002d5f9
mov rdx, qword [rdx]
jmp 0x18002d5fc
mov rdx, r14
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x78]
nop
mov rbx, qword [rsp + 0x118]
cmp rbx, r14
je 0x18002d654
or r12d, 0xffffffff
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
add eax, r12d
jne 0x18002d658
cmp rbx, r14
je 0x18002d658
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002d63c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002d64a
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
jmp 0x18002d658
or r12d, 0xffffffff
mov qword [rsp + 0x58], r14
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
xor edx, edx
call qword [rax + 0x48]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002d708
mov dword [rsp + 0x20], ebx
lea r9, str.Failed_to_create_a_task_definition:__x
mov r8d, 0x26d
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d6df
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d6df
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d701
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d701
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0xe8], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xe8]
call qword [rax + reloc.WS2_32.dll_getservbyport]
mov ebx, eax
cmp eax, r14d
jge 0x18002d7c2
mov dword [rsp + 0x20], eax
lea r9, str.Cannot_get_identification_pointer:__x
mov r8d, 0x278
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d799
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d799
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d7bb
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d7bb
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov dword [rsp + 0xe4], 0x200
lea rdx, [rsp + 0xe4]
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x3e0]
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002d8a0
mov dword [rsp + 0x20], ebx
lea r9, str.Cannot_put_identification_info:__x
mov r8d, 0x287
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d877
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d877
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d899
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d899
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0xa8], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x78]
mov ebx, eax
cmp eax, r14d
jge 0x18002d954
mov dword [rsp + 0x20], eax
lea r9, str.Cannot_get_principal_pointer:__x
mov r8d, 0x293
lea rdx, str..SPWTaskMgr.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002d92b
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d92b
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002d94d
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002d94d
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
lea rdx, str.Author
lea rcx, [rsp + 0x158]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002d976
mov rdx, qword [rdx]
jmp 0x18002d979
mov rdx, r14
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov edi, eax
mov rbx, qword [rsp + 0x158]
cmp rbx, r14
je 0x18002d9cc
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
add ecx, r12d
jne 0x18002d9cc
cmp rbx, r14
je 0x18002d9cc
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002d9b6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002d9c4
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
lea rbp, str..SPWTaskMgr.cpp
lea rsi, [0x18015f578]
cmp edi, r14d
jge 0x18002d9fb
mov dword [rsp + 0x20], edi
lea r9, str.Cannot_put_the_principal_ID:__x
mov r8d, 0x29c
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
mov edx, 3
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
cmp eax, r14d
jge 0x18002da2f
mov dword [rsp + 0x20], eax
lea r9, str.Cannot_put_principal_logon_type:__x
mov r8d, 0x2a0
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
mov edi, 1
mov edx, edi
call qword [rax + 0x90]
mov ebx, eax
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002dae6
mov dword [rsp + 0x20], ebx
lea r9, str.Cannot_put_principal_run_level:__x
mov r8d, 0x2a7
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002dabd
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002dabd
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002dadf
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002dadf
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0x80], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x80]
call qword [rax + 0x58]
mov ebx, eax
cmp eax, r14d
jge 0x18002db92
mov dword [rsp + 0x20], eax
lea r9, str.Cannot_get_settings_pointer:__x
mov r8d, 0x2b3
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002db69
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002db69
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002db8b
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r14d
jg 0x18002db8b
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x90]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov edx, 0x3e7
call qword [rax + 0x60]
lea rdx, str.PT1M
lea rcx, [rsp + 0x128]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002dbfd
mov rdx, qword [rdx]
jmp 0x18002dc00
mov rdx, r14
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov r12d, eax
mov rbx, qword [rsp + 0x128]
cmp rbx, r14
je 0x18002dc54
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
jne 0x18002dc54
cmp rbx, r14
je 0x18002dc54
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002dc3e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002dc4c
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp r12d, r14d
jge 0x18002dcf1
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_put_setting_info:__x
mov r8d, 0x2c2
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002dcc8
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002dcc8
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002dce9
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002dce9
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov qword [rsp + 0xc0], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xc0]
call qword [rax + 0x48]
mov ebx, eax
cmp eax, r14d
jge 0x18002dd9b
mov dword [rsp + 0x20], eax
lea r9, str.Cannot_get_trigger_collection:__x
mov r8d, 0x2ce
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002dd73
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002dd73
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002dd94
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002dd94
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0x98], r14
cmp r13d, r14d
je 0x18002ddc7
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
lea r8, [rsp + 0x98]
mov edx, 9
call qword [rax + 0x50]
mov ebx, eax
jmp 0x18002dde4
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
lea r8, [rsp + 0x98]
mov edx, 2
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r14d
jge 0x18002de7f
mov dword [rsp + 0x20], ebx
lea r9, str.Cannot_create_the_trigger:__x
mov r8d, 0x2dd
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002de57
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002de57
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002de78
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002de78
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
lea rdi, [0x18015f758]
cmp r13d, r14d
je 0x18002e136
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
lea r8, [rsp + 0xc8]
lea rdx, [0x18010ca50]
call qword [rax]
mov ebx, eax
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002df50
mov dword [rsp + 0x20], ebx
lea r9, str.QueryInterface_call_failed_for_ILogonTrigger:__x
mov r8d, 0x2ea
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002df28
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002df28
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002df49
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002df49
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
lea rdx, str.Trigger1
lea rcx, [rsp + 0x108]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002df72
mov rdx, qword [rdx]
jmp 0x18002df75
mov rdx, r14
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r12d, eax
mov rbx, qword [rsp + 0x108]
cmp rbx, r14
je 0x18002dfcf
or r13d, 0xffffffff
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
add ecx, r13d
jne 0x18002dfd3
cmp rbx, r14
je 0x18002dfd3
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002dfb7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002dfc5
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
jmp 0x18002dfd3
or r13d, 0xffffffff
cmp r12d, r14d
jge 0x18002dff5
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_put_the_trigger_ID:__x
mov r8d, 0x2f2
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov dword [rsp + 0xe0], 0x100
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x5e0]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x138]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002e03d
mov rdx, qword [rdx]
jmp 0x18002e040
mov rdx, r14
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0xb8]
mov r12d, eax
mov rbx, qword [rsp + 0x138]
cmp rbx, r14
je 0x18002e097
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
add ecx, r13d
jne 0x18002e097
cmp rbx, r14
je 0x18002e097
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002e081
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002e08f
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp r12d, r14d
jge 0x18002e92a
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_add_user_ID_to_logon_trigger:__x
mov r8d, 0x2ff
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e10c
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002e10c
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e12e
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002e12e
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov qword [rsp + 0x90], r14
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
lea r8, [rsp + 0x90]
lea rdx, [0x18010ca90]
call qword [rax]
mov ebx, eax
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002e1f7
mov dword [rsp + 0x20], ebx
lea r9, str.QueryInterface_call_failed_for_ITimeTrigger:__x
mov r8d, 0x30c
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e1cf
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002e1cf
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e1f0
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r14d
jg 0x18002e1f0
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
lea rdx, str.Trigger2
lea rcx, [rsp + 0x110]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002e219
mov rdx, qword [rdx]
jmp 0x18002e21c
mov rdx, r14
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r12d, eax
mov rbx, qword [rsp + 0x110]
cmp rbx, r14
je 0x18002e270
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
jne 0x18002e270
cmp rbx, r14
je 0x18002e270
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002e25a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002e268
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
cmp r12d, r14d
jge 0x18002e292
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_put_trigger_ID:__x
mov r8d, 0x314
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
xor ecx, ecx
call fcn.1800d1cf8
mov qword [rsp + 0xa0], rax
mov rax, qword [0x18015f768]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x3b8]
call fcn.1800d4390
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x2f0]
call fcn.1800d4390
or r12d, 0xffffffff
cmp eax, r14d
cmove r12d, dword [rsp + 0x2f4]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x340]
call fcn.1800d4390
or r13d, 0xffffffff
cmp eax, r14d
cmove r13d, dword [rsp + 0x348]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x390]
call fcn.1800d4390
test eax, eax
cmove r14d, dword [rsp + 0x39c]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x368]
call fcn.1800d4390
test eax, eax
jne 0x18002e353
mov ebx, dword [rsp + 0x378]
inc ebx
jmp 0x18002e355
xor ebx, ebx
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x318]
call fcn.1800d4390
test eax, eax
jne 0x18002e37f
mov r8d, dword [rsp + 0x32c]
add r8d, 0x76c
jmp 0x18002e382
xor r8d, r8d
lea eax, [r12 + 2]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
mov r9d, ebx
lea rdx, str._d__02d__02dT_02d:_02d:00
lea rcx, [rsp + 0x88]
call fcn.180008f64
mov rbx, qword [rsp + 0x88]
mov rdx, rbx
lea rcx, [rsp + 0xf0]
call fcn.18002b694
nop
mov rdx, qword [rax]
xor r14d, r14d
cmp rdx, r14
je 0x18002e3d5
mov rdx, qword [rdx]
jmp 0x18002e3d8
mov rdx, r14
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov r13d, eax
mov r12, qword [rsp + 0xf0]
cmp r12, r14
je 0x18002e440
or ecx, 0xffffffff
lock xadd dword [r12 + 0x10], ecx
add ecx, 0xffffffff
jne 0x18002e430
cmp r12, r14
je 0x18002e430
mov rcx, qword [r12]
cmp rcx, r14
je 0x18002e419
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
cmp rcx, r14
je 0x18002e428
call fcn.1800d1434
mov rcx, r12
call fcn.1800d1290
mov qword [rsp + 0xf0], r14
mov rbx, qword [rsp + 0x88]
cmp r13d, r14d
jge 0x18002e4f0
mov dword [rsp + 0x20], r13d
lea r9, str.Cannot_add_start_boundary_to_trigger:__x
mov r8d, 0x327
mov rdx, rbp
mov rcx, rsi
call fcn.18000dc6c
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e4a4
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e4a7
call fcn.1800d1434
jmp 0x18002e4a7
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e4c8
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e4c8
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e4e8
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e4e8
call fcn.1800d1434
mov eax, r13d
jmp 0x18002f02b
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0xa8]
mov r12d, eax
cmp eax, r14d
jge 0x18002e5b8
mov edx, eax
lea rcx, str._nCannot_put_days_interval:__x
call fcn.1800d46c0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e56c
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e56f
call fcn.1800d1434
jmp 0x18002e56f
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e590
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e590
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e5b0
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e5b0
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov qword [rsp + 0xb8], r14
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb8]
call qword [rax + 0x50]
mov r12d, eax
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp r12d, r14d
jge 0x18002e689
mov edx, r12d
lea rcx, str._nCannot_get_repetition_pattern:__x
call fcn.1800d46c0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e63d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e640
call fcn.1800d1434
jmp 0x18002e640
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e661
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e661
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e681
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e681
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
lea rdx, str.PT1H
lea rcx, [rsp + 0x120]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002e6ab
mov rdx, qword [rdx]
jmp 0x18002e6ae
mov rdx, r14
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r13d, eax
mov r12, qword [rsp + 0x120]
cmp r12, r14
je 0x18002e718
or ecx, 0xffffffff
lock xadd dword [r12 + 0x10], ecx
add ecx, 0xffffffff
jne 0x18002e710
cmp r12, r14
je 0x18002e710
mov rcx, qword [r12]
cmp rcx, r14
je 0x18002e6ef
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
cmp rcx, r14
je 0x18002e6fe
call fcn.1800d1434
mov rcx, r12
call fcn.1800d1290
mov rbx, qword [rsp + 0x88]
jmp 0x18002e718
mov rbx, qword [rsp + 0x88]
cmp r13d, r14d
jge 0x18002e7c8
mov edx, r13d
lea rcx, str._nCannot_put_repetition_duration:__x
call fcn.1800d46c0
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e77c
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e77f
call fcn.1800d1434
jmp 0x18002e77f
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e7a0
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e7a0
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e7c0
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e7c0
call fcn.1800d1434
mov eax, r13d
jmp 0x18002f02b
lea rdx, str.PT24H
lea rcx, [rsp + 0x130]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002e7ea
mov rdx, qword [rdx]
jmp 0x18002e7ed
mov rdx, r14
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov r13d, eax
mov r12, qword [rsp + 0x130]
cmp r12, r14
je 0x18002e857
or ecx, 0xffffffff
lock xadd dword [r12 + 0x10], ecx
add ecx, 0xffffffff
jne 0x18002e84f
cmp r12, r14
je 0x18002e84f
mov rcx, qword [r12]
cmp rcx, r14
je 0x18002e82e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
cmp rcx, r14
je 0x18002e83d
call fcn.1800d1434
mov rcx, r12
call fcn.1800d1290
mov rbx, qword [rsp + 0x88]
jmp 0x18002e857
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp r13d, r14d
jge 0x18002e907
mov edx, r13d
lea rcx, str._nCannot_put_repetition_duration:__x
call fcn.1800d46c0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
cmp rcx, rdi
je 0x18002e8bb
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e8be
call fcn.1800d1434
jmp 0x18002e8be
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e8df
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e8df
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e8ff
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, r14d
jg 0x18002e8ff
call fcn.1800d1434
mov eax, r13d
jmp 0x18002f02b
lea rcx, [rbx - 0xc]
cmp rcx, rdi
je 0x18002e930
or r13d, 0xffffffff
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002e934
call fcn.1800d1434
jmp 0x18002e934
or r13d, 0xffffffff
jmp 0x18002e934
or r13d, 0xffffffff
mov qword [rsp + 0xd0], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xd0]
call qword [rax + 0x88]
mov ebx, eax
cmp eax, r14d
jge 0x18002e9d8
mov dword [rsp + 0x20], eax
lea r9, str.Cannot_get_Task_collection_pointer:__x
mov r8d, 0x360
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e9af
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002e9af
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002e9d1
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002e9d1
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0xd8], r14
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
lea r8, [rsp + 0xd8]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002ea8c
mov dword [rsp + 0x20], ebx
lea r9, str.Cannot_create_the_action:__x
mov r8d, 0x36c
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ea63
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ea63
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ea85
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ea85
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov qword [rsp + 0xb0], r14
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
lea r8, [rsp + 0xb0]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp ebx, r14d
jge 0x18002eb44
mov dword [rsp + 0x20], ebx
lea r9, str.QueryInterface_call_failed_for_IExecAction:__x
mov r8d, 0x378
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002eb1b
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002eb1b
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002eb3d
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002eb3d
call fcn.1800d1434
mov eax, ebx
jmp 0x18002f02b
mov rdx, qword [r15 + 8]
lea rcx, [rsp + 0x140]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002eb63
mov rdx, qword [rdx]
jmp 0x18002eb66
mov rdx, r14
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov r12d, eax
mov rbx, qword [rsp + 0x140]
cmp rbx, r14
je 0x18002ebba
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
add ecx, r13d
jne 0x18002ebba
cmp rbx, r14
je 0x18002ebba
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002eba4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002ebb2
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
cmp r12d, r14d
jge 0x18002ec44
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_set_path_of_executable:__x
mov r8d, 0x382
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ec1a
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ec1a
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ec3c
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ec3c
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov rax, qword [r15 + 0x10]
cmp dword [rax - 8], r14d
je 0x18002ed63
lea rdx, [0x18011ada8]
lea rcx, [rsp + 0x150]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002ec74
mov rdx, qword [rdx]
jmp 0x18002ec77
mov rdx, r14
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov r12d, eax
mov rbx, qword [rsp + 0x150]
cmp rbx, r14
je 0x18002eccb
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
add ecx, r13d
jne 0x18002eccb
cmp rbx, r14
je 0x18002eccb
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002ecb5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002ecc3
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp r12d, r14d
jge 0x18002ed71
mov dword [rsp + 0x20], r12d
lea r9, str.Cannot_set_path_of_executable:__x
mov r8d, 0x38f
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ed39
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ed39
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ed5b
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ed5b
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x100], r14
mov eax, 8
mov word [rsp + 0x160], ax
lea rcx, [0x18010d528]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x168], rax
cmp rax, r14
jne 0x18002edab
mov ecx, 0x8007000e
call fcn.1800f10e0
nop
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x160]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x1f8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x178]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x178]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xf8]
call fcn.18002b694
nop
mov rdx, qword [rax]
cmp rdx, r14
je 0x18002ee5b
mov rdx, qword [rdx]
jmp 0x18002ee5e
mov rdx, r14
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r8, [rsp + 0x100]
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x210]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], 3
lea r8, [rsp + 0x290]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x2d0]
mov qword [rsp + 0x20], r8
mov r9d, 6
mov r8, qword [rsp + 0x58]
call qword [rax + 0x88]
mov r12d, eax
mov rbx, qword [rsp + 0xf8]
cmp rbx, r14
je 0x18002ef01
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
add ecx, r13d
jne 0x18002eef9
cmp rbx, r14
je 0x18002eef9
mov rcx, qword [rbx]
cmp rcx, r14
je 0x18002eee3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x18002eef1
call fcn.1800d1434
mov rcx, rbx
call fcn.1800d1290
mov qword [rsp + 0xf8], r14
lea rcx, [rsp + 0x178]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x160]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp r12d, r14d
jge 0x18002efb0
mov dword [rsp + 0x20], r12d
lea r9, str.Error_saving_the_Task_:__x
mov r8d, 0x3a7
mov rdx, rbp
mov rcx, rsi
call fcn.18000b1e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002ef89
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002ef89
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002efab
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002efab
call fcn.1800d1434
mov eax, r12d
jmp 0x18002f02b
lea rdx, str._Success__VISTA_WIN7_Task_successfully_registered.
mov rcx, rsi
call fcn.1800098e8
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002f007
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002f007
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18002f029
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r14d
jg 0x18002f029
call fcn.1800d1434
xor eax, eax
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret