Function at 0x4ae1a0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bed8
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x567e00]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0
jne 0x4ae1e6
mov eax, 0x80004005
jmp 0x4aecf9
mov dword [ebp - 0xd0], 0
lea eax, [ebp - 0xd0]
mov dword [ebp - 4], 0
push eax
push 0x535a80
push 1
push 0
push 0x535a70
mov dword [ebp - 0xcc], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x4aeccf
mov dword [ebp - 0xa8], 0
cmp dword [ebx + 0x14], 8
mov eax, dword [ebp - 0xd0]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
mov ecx, ebx
jb 0x4ae249
mov ecx, dword [ebx]
lea edi, [ebp - 0xa8]
push edi
push 0x535a90
push ecx
push eax
call edx
test eax, eax
js 0x4ae348
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0xb4], 0
je 0x4ae331
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xb0]
push edx
push 0x535a90
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 3
call dword [ecx]
mov edi, eax
test edi, edi
jns 0x4ae2d1
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 4], 4
test eax, eax
je 0x4ae2b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x4aeccf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4aeccf
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xb4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
test eax, eax
jns 0x4ae302
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 4], 6
test eax, eax
je 0x4ae2fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
jmp 0x4ae2b8
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 4], 8
test eax, eax
je 0x4ae316
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0xb4], 0x41302
mov byte [ebp - 4], 2
je 0x4ae331
mov edi, 0x80070050
mov byte [ebp - 4], 9
jmp 0x4ae2b8
push ebx
mov ecx, esi
call fcn.004abf80
mov edi, eax
test edi, edi
jns 0x4ae348
mov byte [ebp - 4], 0xa
jmp 0x4ae2b8
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x4ae36a
mov dword [ebp - 0xa8], 0
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 0xc
call dword [ecx + 8]
mov byte [ebp - 4], 2
cmp dword [ebx + 0x14], 8
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
jb 0x4ae37a
mov ebx, dword [ebx]
lea edx, [ebp - 0xa8]
push edx
push 0x535a90
push 0x535a60
push ebx
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
jns 0x4ae39f
mov byte [ebp - 4], 0xd
jmp 0x4ae2b8
mov dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xac]
push edx
push 0x535a90
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xe
call dword [ecx]
mov edi, eax
test edi, edi
jns 0x4ae3e7
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4ae3de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
jmp 0x4ae2b8
cmp dword [esi + 0x40], 8
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
lea ecx, [esi + 0x2c]
jb 0x4ae400
mov ecx, dword [ecx]
push ecx
push eax
call edx
mov edi, eax
test edi, edi
jns 0x4ae427
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x11
test eax, eax
je 0x4ae41e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x12
jmp 0x4ae2b8
cmp dword [esi + 0x54], 0
je 0x4ae46d
cmp dword [esi + 0x58], 8
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
lea ecx, [esi + 0x44]
jb 0x4ae446
mov ecx, dword [ecx]
push ecx
push eax
call edx
mov edi, eax
test edi, edi
jns 0x4ae46d
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x4ae464
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x14
jmp 0x4ae2b8
cmp dword [esi + 0x6c], 0
je 0x4ae4b3
cmp dword [esi + 0x70], 8
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x90]
lea ecx, [esi + 0x5c]
jb 0x4ae48c
mov ecx, dword [ecx]
push ecx
push eax
call edx
mov edi, eax
test edi, edi
jns 0x4ae4b3
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4ae4aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x16
jmp 0x4ae2b8
cmp dword [esi + 0x84], 0
je 0x4ae521
cmp byte [esi + 0xd4], 0
je 0x4ae521
xor edx, edx
cmp dword [esi + 0x9c], edx
je 0x4ae4e0
cmp dword [esi + 0xa0], 8
lea edx, [esi + 0x8c]
jb 0x4ae4e0
mov edx, dword [edx]
cmp dword [esi + 0x88], 8
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov edi, dword [ecx + 0x78]
lea ecx, [esi + 0x74]
jb 0x4ae4f9
mov ecx, dword [ecx]
push edx
push ecx
push eax
call edi
mov edi, eax
test edi, edi
jns 0x4ae521
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x17
test eax, eax
je 0x4ae518
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x18
jmp 0x4ae2b8
cmp dword [esi + 0xb4], 0
je 0x4ae56d
cmp dword [esi + 0xb8], 8
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
lea ecx, [esi + 0xa4]
jb 0x4ae546
mov ecx, dword [ecx]
push ecx
push eax
call edx
mov edi, eax
test edi, edi
jns 0x4ae56d
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x4ae564
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1a
jmp 0x4ae2b8
mov eax, dword [ebp - 0xac]
push dword [esi + 0xd8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov edi, eax
test edi, edi
jns 0x4ae5a2
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x4ae599
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1c
jmp 0x4ae2b8
cmp dword [esi + 0x28], 0
jne 0x4ae5b3
xor eax, eax
cmp ax, word [esi]
je 0x4ae744
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xb0]
push edx
lea edx, [ebp - 0xb4]
mov byte [ebp - 4], 0x1d
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
jns 0x4ae61c
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 4], 0x1e
test eax, eax
je 0x4ae5ff
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x4ae613
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x20
jmp 0x4ae2b8
push 0x30
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movzx ecx, word [esi + 6]
mov eax, 0x30
mov word [ebp - 0x44], ax
xor edx, edx
movzx eax, word [esi]
add esp, 0xc
mov word [ebp - 0x40], ax
movzx eax, word [esi + 2]
mov word [ebp - 0x3e], ax
movzx eax, word [esi + 8]
mov word [ebp - 0x34], ax
movzx eax, word [esi + 0xa]
mov word [ebp - 0x32], ax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x30], eax
movzx eax, word [esi + 0x10]
mov word [ebp - 0x3c], cx
cmp dx, ax
je case.default.0x4ae692
mov word [ebp - 0x3a], ax
movzx eax, word [esi + 0x12]
mov word [ebp - 0x38], ax
movzx eax, word [esi + 0x16]
mov dword [ebp - 0x28], 1
mov word [ebp - 0x36], ax
mov eax, dword [esi + 0x28]
dec eax
jmp dword [eax*4 + 0x4aed18]
mov dword [ebp - 0x24], edx
jmp 0x4ae6e9
mov eax, 1
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], ax
jmp 0x4ae6e9
push esi
mov ecx, esi
mov dword [ebp - 0x24], 2
call fcn.004b2420
mov word [ebp - 0x1e], ax
mov eax, 1
mov word [ebp - 0x20], ax
jmp 0x4ae6e9
dec ecx
mov dword [ebp - 0x24], 3
mov eax, 1
shl eax, cl
mov dword [ebp - 0x20], eax
mov eax, 0xfff
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0x44]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
jns 0x4ae730
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x4ae713
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x4ae727
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x23
jmp 0x4ae2b8
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 4], 0x24
test eax, eax
je 0x4ae744
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xc8]
push edx
push 0x538b60
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x25
call dword [ecx]
mov edi, eax
test edi, edi
jns 0x4ae7a0
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x26
test eax, eax
je 0x4ae783
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x4ae797
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x28
jmp 0x4ae2b8
mov eax, dword [ebp - 0xc8]
push 0
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
jns 0x4ae7e7
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x29
test eax, eax
je 0x4ae7ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x2a
test eax, eax
je 0x4ae7de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2b
jmp 0x4ae2b8
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xcc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov dword [ebp - 0xc4], vtable.ATL::CAccessToken.0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
lea ecx, [ebp - 0xa4]
call fcn.004aaf70
mov byte [ebp - 4], 0x2d
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [ebp - 0xb4]
push ecx
push 1
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x4ae864
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
call dword [eax + 4]
mov eax, dword [ebp - 0xb4]
jmp 0x4ae8a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x4aec13
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0xb0]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4aec13
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
call dword [eax + 4]
mov eax, dword [ebp - 0xb0]
push 0
mov dword [ebp - 0xc0], eax
lea ecx, [ebp - 0xc4]
push 1
lea eax, [ebp - 0xa4]
push eax
call fcn.004aabb0
test al, al
je 0x4aec13
mov dword [ebp - 0xec], 0
mov byte [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 2
mov dword [ebp - 0xf0], vtable.ATL::CDacl.0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xcc]
mov byte [ebp - 4], 0x31
test eax, eax
je 0x4ae955
lea ecx, [ebp - 0xb0]
push ecx
push 0
lea ecx, [ebp - 0xb4]
push ecx
push 0
push 0
push 4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x4aea06
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0xf0]
mov edi, 0x80004005
call fcn.004ab460
lea ecx, [ebp - 0xa4]
call fcn.004ab540
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], vtable.ATL::CAccessToken.0
test ecx, ecx
je 0x4ae9a6
test eax, eax
je 0x4ae99c
push ecx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], 0
test eax, eax
je 0x4ae9bb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc0], 0
push 4
push dword [ebp - 0xb8]
call fcn.004c6f6f
add esp, 8
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x32
test eax, eax
je 0x4ae9e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x33
test eax, eax
je 0x4ae9fd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x34
jmp 0x4ae2b8
mov esi, dword [ebp - 0xb4]
test esi, esi
je 0x4aea3b
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
mov eax, dword [eax + 8]
cmp eax, fcn.004ae0a0
jne 0x4aea2d
call fcn.004ae0a0
jmp 0x4aea2f
call eax
push esi
lea ecx, [ebp - 0xf0]
call fcn.004abbd0
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xb4], 0
setne al
test al, al
je 0x4ae955
push 0
push 0x1f01ff
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004aba10
test al, al
je 0x4aeb62
mov esi, dword [ebp - 0xcc]
test esi, esi
je 0x4aeb62
lea ecx, [ebp - 0xf0]
call fcn.004ac930
push 0
push eax
push 0
push 0
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x4aeb62
lea ecx, [ebp - 0xf0]
call fcn.004ab460
lea ecx, [ebp - 0xa4]
call fcn.004ab540
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], vtable.ATL::CAccessToken.0
test ecx, ecx
je 0x4aeb02
test eax, eax
je 0x4aeaf8
push ecx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], 0
test eax, eax
je 0x4aeb17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc0], 0
push 4
push dword [ebp - 0xb8]
call fcn.004c6f6f
add esp, 8
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x38
test eax, eax
je 0x4aeb45
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x39
test eax, eax
je 0x4aeb59
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3a
jmp 0x4ae2b8
lea ecx, [ebp - 0xf0]
mov edi, 0x80004005
call fcn.004ab460
lea ecx, [ebp - 0xa4]
call fcn.004ab540
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], vtable.ATL::CAccessToken.0
test ecx, ecx
je 0x4aebb3
test eax, eax
je 0x4aeba9
push ecx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], 0
test eax, eax
je 0x4aebc8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc0], 0
push 4
push dword [ebp - 0xb8]
call fcn.004c6f6f
add esp, 8
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x35
test eax, eax
je 0x4aebf6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x36
test eax, eax
je 0x4aec0a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x37
jmp 0x4ae2b8
lea ecx, [ebp - 0xa4]
mov edi, 0x80004005
call fcn.004ab540
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], vtable.ATL::CAccessToken.0
test ecx, ecx
je 0x4aec59
test eax, eax
je 0x4aec4f
push ecx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], 0
test eax, eax
je 0x4aec6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc0], 0
push 4
push dword [ebp - 0xb8]
call fcn.004c6f6f
add esp, 8
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x2e
test eax, eax
je 0x4aec9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x2f
test eax, eax
je 0x4aecb0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x30
jmp 0x4ae2b8
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x4aece0
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 4], 0x3c
test eax, eax
je 0x4aecf7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c6f8b
mov esp, ebp
pop ebp
ret 8