Function at 0x403430
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424f3f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x140
mov eax, dword [0x444624]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
mov dword [ebp - 0xb4], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xe8], eax
xor eax, eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0xf8]
push eax
mov dword [ebp - 0x80], ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 4], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 2
push eax
push 0x4262a8
push 1
push 0
push 0x4289cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4035d7
mov eax, dword [ebp - 0x9c]
sub esp, 0x10
mov edi, dword [ebp - 0xf4]
mov edx, dword [ebp - 0xf8]
mov esi, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x28]
mov ecx, esp
sub esp, 0x10
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xf8]
mov dword [ecx], edx
mov edx, dword [ebp - 0xec]
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov ecx, esp
sub esp, 0x10
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov ecx, esp
sub esp, 0x10
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp - 0x9c]
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
push eax
mov dword [ecx + 0xc], edx
call dword [ebp - 0x84]
test eax, eax
js 0x4035d7
mov edi, dword [ebp - 0x9c]
push 0x426264
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x84], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x90], esi
test esi, esi
je 0x403eef
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 3
push eax
mov ecx, 1
push esi
push edi
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x94], ecx
call dword [ebp - 0x84]
test eax, eax
js 0x4035dd
mov byte [ebp - 0x79], 0
jmp 0x4035e1
mov esi, dword [ebp - 0x90]
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 4], 2
test al, 1
je 0x4035fc
and eax, 0xfffffffe
push esi
mov dword [ebp - 0x80], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [ebp - 0x79], 0
je 0x403609
xor edi, edi
jmp 0x403e90
mov edi, dword [ebp - 0xb0]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xb4]
test eax, eax
jne 0x40362e
xor esi, esi
mov dword [ebp - 0x84], esi
jmp 0x403645
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x84], esi
test esi, esi
je 0x403eef
push 0
push esi
push edi
mov byte [ebp - 4], 6
call dword [ebp - 0x90]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 7
call dword [ecx + 0x24]
test eax, eax
jns 0x403688
xor edi, edi
jmp 0x403e7c
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0
push eax
call fcn.0040f8b0
mov esi, eax
add esp, 4
test esi, esi
je 0x40375e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x2000
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x78]
lea eax, [ebp - 0x84]
push eax
call fcn.00401240
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x403712
push esi
push dword [ebp - 0x94]
push 0x42629c
push 0x1800
push 0
push 0
push 0x2000
push eax
call fcn.00406db0
add esp, 0x20
test eax, eax
jns 0x403712
push 0
lea ecx, [ebp - 0x78]
call fcn.00408040
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, eax
push 0
push edi
call esi
test eax, eax
je 0x403ee5
push dword [ebp - 0x94]
push 0
push edi
call esi
test eax, eax
je 0x403ee5
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x40375e
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x78]
cmp ecx, eax
setne al
push eax
call edx
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], esi
push eax
lea ecx, [ebp - 0x48]
call fcn.00401240
mov dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0xe0]
push edx
push eax
mov byte [ebp - 4], 0xe
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x4037f6
mov edi, dword [ebp - 0xe0]
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4037ba
xor esi, esi
mov dword [ebp - 0x90], esi
jmp 0x4037d1
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x90], esi
test esi, esi
je 0x403eef
mov eax, dword [ebp - 0x80]
or eax, 2
mov byte [ebp - 4], 0xf
push esi
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x94], eax
call dword [ebp - 0x84]
test eax, eax
js 0x4037fc
mov byte [ebp - 0x79], 0
jmp 0x403800
mov esi, dword [ebp - 0x90]
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 4], 0xe
test al, 2
je 0x40381b
and eax, 0xfffffffd
push esi
mov dword [ebp - 0x80], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [ebp - 0x79], 0
je 0x403828
xor edi, edi
jmp 0x403e22
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0xd0]
push edx
push eax
mov byte [ebp - 4], 0x16
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x403df8
mov eax, dword [ebp - 0xd0]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
js 0x403df8
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0xd4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x403df8
mov eax, dword [ebp - 0xd4]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
js 0x403df8
mov dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0xcc]
push edx
push eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x4038ce
xor edi, edi
jmp 0x403de2
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x28
call dword [ecx + 0x28]
test eax, eax
js 0x40397b
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
push edx
push 0x4268e0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x40397b
mov edi, dword [ebp - 0xc4]
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xb4]
test eax, eax
jne 0x40393f
xor esi, esi
mov dword [ebp - 0x90], esi
jmp 0x403956
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x90], esi
test esi, esi
je 0x403eef
mov eax, dword [ebp - 0x80]
or eax, 4
mov byte [ebp - 4], 0x29
push esi
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x94], eax
call dword [ebp - 0x84]
test eax, eax
js 0x403981
mov byte [ebp - 0x79], 0
jmp 0x403985
mov esi, dword [ebp - 0x90]
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 4], 0x28
test al, 4
je 0x4039a0
and eax, 0xfffffffb
push esi
mov dword [ebp - 0x80], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [ebp - 0x79], 0
je 0x4039ad
xor edi, edi
jmp 0x403dba
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0xbc]
push edx
push eax
mov byte [ebp - 4], 0x36
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x403af1
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xc0]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x403af1
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0xac]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x403af1
mov esi, dword [ebp - 0xac]
mov eax, dword [esi]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xa8]
test eax, eax
jne 0x403a4b
xor edi, edi
mov dword [ebp - 0x84], edi
jmp 0x403a62
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x403eef
mov eax, dword [ebp - 0x80]
or eax, 8
mov byte [ebp - 4], 0x37
push edi
push esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x94], eax
call dword [ebp - 0x90]
test eax, eax
js 0x403af7
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa8], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x34]
mov dword [ebp - 0xd8], ecx
mov ecx, dword [ebp - 0xe8]
test ecx, ecx
jne 0x403aac
xor esi, esi
mov dword [ebp - 0x90], esi
jmp 0x403ac9
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x90], esi
test esi, esi
je 0x403eef
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x80]
or ecx, 0x10
mov dword [ebp - 4], 0x38
push esi
push eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x94], ecx
call dword [ebp - 0xd8]
test eax, eax
js 0x403afd
mov byte [ebp - 0x79], 0
jmp 0x403b01
mov edi, dword [ebp - 0x84]
mov esi, dword [ebp - 0x90]
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x80]
test al, 0x10
je 0x403b1c
and eax, 0xffffffef
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x80], eax
call esi
mov eax, dword [ebp - 0x80]
jmp 0x403b22
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0x36
test al, 8
je 0x403b36
and eax, 0xfffffff7
push edi
mov dword [ebp - 0x80], eax
call esi
cmp byte [ebp - 0x79], 0
je 0x403b43
xor edi, edi
jmp 0x403d7e
mov dword [ebp - 0xb8], 0
mov edi, dword [ebp - 0xb0]
lea ecx, [ebp - 0x150]
push 0x426260
mov byte [ebp - 4], 0x46
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0xdc], eax
call fcn.00402520
mov ecx, dword [ebp - 0x80]
or ecx, 0x20
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x94], ecx
mov ecx, dword [eax]
mov dword [ebp - 0xa8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x84], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0xec]
push str.BuiltinAdministrators
mov dword [ebp - 0x11c], eax
call fcn.00402520
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x120], esi
or ecx, 0x40
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 4], 0x48
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0x128], esi
test eax, eax
jne 0x403c41
xor esi, esi
mov dword [ebp - 0xd8], esi
jmp 0x403c61
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0xd8], esi
test esi, esi
je 0x403ef9
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0xe8]
or ecx, 0x80
mov dword [ebp - 4], 0x49
mov dword [ebp - 0x80], ecx
lea eax, [ebp - 0xb8]
push eax
sub esp, 0x10
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp - 0xa8]
mov eax, esp
push 4
mov dword [eax], ecx
sub esp, 0x10
mov ecx, dword [ebp - 0x84]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x90]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xfc]
mov dword [eax + 0xc], ecx
mov eax, esp
mov ecx, dword [ebp - 0x108]
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x118]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x11c]
mov dword [eax + 0xc], ecx
mov eax, esp
mov ecx, dword [ebp - 0x120]
push 6
push dword [ebp - 0x130]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x128]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x12c]
push esi
push edi
mov dword [eax + 0xc], ecx
call dword [ebp - 0xdc]
test eax, eax
js 0x403d1f
mov eax, dword [ebp - 0xb8]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x403d1f
mov edi, 1
jmp 0x403d21
xor edi, edi
mov eax, dword [ebp - 0x80]
test al, al
jns 0x403d3a
and eax, 0xffffff7f
push esi
mov dword [ebp - 0x80], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x80]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test al, 0x40
je 0x403d56
and eax, 0xffffffbf
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x140]
push eax
call esi
mov eax, dword [ebp - 0x80]
mov dword [ebp - 4], 0x46
test al, 0x20
je 0x403d6a
lea eax, [ebp - 0x150]
push eax
call esi
mov eax, dword [ebp - 0xb8]
mov byte [ebp - 4], 0x4a
test eax, eax
je 0x403d7e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xbc]
mov byte [ebp - 4], 0x4b
test eax, eax
je 0x403d92
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x4c
test eax, eax
je 0x403da6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc0]
mov byte [ebp - 4], 0x4d
test eax, eax
je 0x403dba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc4]
mov byte [ebp - 4], 0x4e
test eax, eax
je 0x403dce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 0x4f
test eax, eax
je 0x403de2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xcc]
mov byte [ebp - 4], 0x50
test eax, eax
je 0x403dfa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x403dfa
xor edi, edi
mov eax, dword [ebp - 0xd0]
mov byte [ebp - 4], 0x51
test eax, eax
je 0x403e0e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xd4]
mov byte [ebp - 4], 0x52
test eax, eax
je 0x403e22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xe0]
mov byte [ebp - 4], 0x53
test eax, eax
je 0x403e36
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0x54
test eax, eax
je 0x403e5e
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xdc], eax
test ecx, ecx
je 0x403f03
mov eax, dword [ecx]
lea edx, [ebp - 0xdc]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x403e7c
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x48]
cmp ecx, eax
setne al
push eax
call edx
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x55
test eax, eax
je 0x403e90
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 4], 0x56
test eax, eax
je 0x403ea4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xb0]
mov byte [ebp - 4], 0x57
test ecx, ecx
je 0x403eb8
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call int.0041284a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.00402e30
push 0x8007000e
call fcn.00402e30
push 0x8007000e
call fcn.00402e30
call fcn.00412550
int3