Function at 0x40caf0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43cfd8
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x48d0b8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
je 0x40d20c
jne 0x40d20c
jmp dword [0x10093fc0]
mov eax, dword [ebp - 0x478]
mov edx, dword [eax]
push esi
push eax
mov eax, dword [edx + 0x70]
call eax
xor esi, esi
cmp eax, esi
je 0x40ceb6
jmp 0x40d3cb
lea ecx, [ebp - 0x474]
je 0x40cdad
jne 0x40cdad
push 0xd9dedc
add dword [esp + 0x34], 0x10
mov ah, 0x24
pop ecx
popal
invalid
je 0x40cc70
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push esi
push eax
call edx
jmp 0x40d312
lea ecx, [ebp - 0x474]
call fcn.0040b600
jmp 0x40d60e
mov dword [ebp - 0x450], 0xf
mov dword [ebp - 0x448], 1
mov ecx, dword [eax]
push 0x40d408
ret
push 0x400
push eax
lea ecx, [ebp - 0x426]
push ecx
mov word [ebp - reloc.uxtheme.dll_GetThemePartSize], ax
call fcn.004303a0
add esp, 0xc
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0x428]
push 0x40ce92
ret
mov eax, dword [ebp - 0x480]
mov byte [ebp - 4], 0
test eax, eax
je 0x40d0b0
mov ecx, dword [eax]
jmp 0x40d4eb
call fcn.0040b600
jmp 0x40d60e
lea ecx, [ebp - 0x438]
je 0x40d6ec
jne 0x40d6ec
mov ebx, dword [0x697b828c]
mov ebp, 0x8458b8f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
jmp 0x40d693
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x484]
mov byte [ebp - 4], 2
test eax, eax
je 0x40ce19
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x488]
add eax, 0xfffffff0
push 0x40d032
ret
mov eax, dword [ebp - 0x484]
push eax
lea ecx, [ebp - 0x498]
call int.0040b6c0
mov eax, dword [ebp - 0x498]
mov byte [ebp - 4], 8
cmp eax, esi
je 0x40cc91
jne 0x40cc91
call dword [0x44b12c]
push 0x11481b3c
mov dword [esi + 0xc], 0x11397120
cmp byte [0xdb91a0], 0
push 0x4128d8
or dl, byte [0x4b685050]
int 0x40
add bl, al
mov dword [0x106c140], edi
mov eax, 0x10d9c7ec
push 0x697a4eb8
push 0xdaf9dc
mov esp, 0xe8e9a07a
or byte [eax], al
add byte [ebx - 0x4777b], cl
jmp [eax + 0x7b]
jmp 0x40d79e
mov eax, dword [ebp - 0x478]
push 0x40d37b
ret
jne 0x40ce05
test eax, eax
je 0x40d7c4
jne 0x40d7c4
mov dword [0x459784], eax
mov dword [0x454880], eax
cmp dword [esi + 0x1d8], 0
push 0x10020584
outsd dx, dword [esi]
out dx, eax
mov byte [edi], cl
test byte [ebp - 2], cl
invalid
je 0x40cd8a
push esi
lea ecx, [ebp - 0x488]
call fcn.0040c8e0
mov byte [ebp - 4], 2
test edi, edi
jne 0x40d817
xor eax, eax
je 0x40cd11
jne 0x40cd11
push 0x41b788
fmul dword [0x4aada4]
mov dword [esi], 0xad2754
mov eax, 0x10376ab4
sar byte [edi], 0x8b
xchg ebp, eax
js 0x40cf7a
aas
mov edx, dword [ebp - 0x488]
push 0x403b30
push 0x403b50
push edx
push eax
jmp 0x40d5dc
invalid
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00430391
mov esp, ebp
pop ebp
ret
mov eax, dword [0x401664]
jmp 0x40d8ea
jg 0x40d79e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40ceb1
mov eax, dword [ebp - 0x48c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
je 0x40cfa8
jne 0x40cfa8
push 0x1147aba8
mov eax, dword [0x40d330]
clc
or eax, 0xfb748d89
invalid
mov dword [ebp - 0x48c], ecx
cmp eax, esi
je 0x40cc70
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x40ccc0
je 0x40d456
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
jmp 0x40d642
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
je 0x40cdd1
jne 0x40cdd1
movzx eax, byte [eax + 0x112d1b60]
push 0xb50050
mov dword [esi + 0xc], 0x1126d1f0
pmaddwd mm4, qword [0x697d0af0]
push 0x42b780
xchg esi, eax
pop ecx
jne 0x40d753
sub eax, edx
sar eax, 1
je 0x40ce47
jmp 0x40d33d
cmp eax, ecx
je 0x40d29a
dec ecx
cmp eax, ecx
je 0x40d29a
mov dl, byte [eax]
mov bl, byte [ecx]
mov byte [eax], bl
mov byte [ecx], dl
inc eax
jmp 0x40d27b
lea ecx, [ebp - 0x24]
push ecx
push 0x401648
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4ac], eax
test eax, eax
je 0x40cd84
lea edx, [ebp - 0x480]
push edx
push 0x403b40
push 1
jmp 0x40d668
adc byte [edx - 0x77fb4c56], ah
pop ebp
cld
mov bl, 4
mov byte [ebp - 4], bl
je 0x40d9ac
mov esi, edi
je 0x40d948
jne 0x40d948
mov dword [0xd2e584], edx
lea eax, [edi + 0xc08]
push 0x1146e344
mov ecx, 0xaf4390
mov dword [esi + 0x78], 0x102532a0
mov esi, 0x3bc933b1
invalid
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x498]
sete cl
mov byte [ebp - 4], bl
je 0x40d0d8
jne 0x40d0d8
lea edx, [esi + ecx + 0x28]
cmp ecx, 0x3b
mov byte [0xd07ce3], al
je 0x40d2d7
cli
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push edi
push eax
call edx
cmp eax, esi
push 0x40ce41
ret
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
je 0x40cffe
jne 0x40cffe
mov cx, word [ebp - reloc.uxtheme.dll_GetThemePartSize]
lea edi, [esi + 0xf0c]
mov dword [esi], 0x49ba1c
test dword [ecx + 0x56], edi
test eax, edx
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, esi
jne 0x40cc70
mov eax, dword [ebp - 0x478]
mov edx, dword [ebp - 0x4a0]
jmp 0x40d72c
lea ecx, [ebp - 0x46c]
call fcn.0040b600
jmp 0x40d79e
mov edx, dword [ecx + 8]
push eax
push 0x40d8cd
ret
cmp eax, esi
je 0x40d1d8
jne 0x40d1d8
mov eax, dword [0x100200e8]
push 0x11491e10
or dword [ebp - 0x210], 0x200
clc
pop esi
dec ebp
lea ecx, [ebp - 0x479]
call fcn.0040aa70
cmp eax, esi
jne 0x40cdb7
push 0x40cc70
ret
mov word [ebp - reloc.uxtheme.dll_GetThemePartSize], dx
lea edx, [ebp - 0x468]
mov word [ebp - reloc.uxtheme.dll_GetThemePartSize], cx
mov dword [ebp - 0x454], 0x5a0
je 0x40ccef
jne 0x40ccef
push 0xa73e7c
mov eax, dword [0x112b46b4]
mov byte [ecx + 0x7c], al
push 0xa5f5a8
push 0x45d104
pop edx
mov eax, dword [ecx + 0x20]
mov byte [ebp - 4], 3
call eax
test eax, eax
mov eax, dword [ebp - 0x484]
je 0x40cf0a
jne 0x40cf0a
call dword [0x9b8554]
mov dword [esi], 0x1147401c
invalid
mov eax, dword [ebp - 0x470]
mov byte [ebp - 4], 5
je 0x40d549
jne 0x40d549
lea esi, [ecx + edi + 0x38]
push 0x11488998
mov eax, 0xfa68f0
mov ecx, dword [0x40f1dc]
mov dword [0x112b983c], eax
xchg dword [ebx + esi*2 - 0x2d006b8e], edx
call edx
je 0x40d456
jne 0x40d456
mov dword [0x42bb20], eax
mov ecx, dword [0xdef8e0]
mov dword [0x11257130], eax
mov byte [0x100cba48], 1
or ch, byte [edx]
push 0
push 0x403b60
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40cd84
mov eax, dword [ebp - 0x480]
test eax, eax
jmp 0x40cf37
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x4a0], eax
xor eax, eax
mov dword [ebp - 0x4a4], ecx
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x48c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x480], eax
jmp 0x40cfe0
push ecx
lea edx, [ebp - 0x494]
push edx
call eax
mov ax, word [ebp - reloc.uxtheme.dll_GetThemePartSize]
mov cx, word [ebp - reloc.uxtheme.dll_GetThemePartSize]
mov edx, 1
mov word [ebp - reloc.uxtheme.dll_GetThemePartSize], ax
mov eax, dword [ebp - 0x470]
jmp 0x40d59a
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x80]
call eax
cmp eax, esi
jne 0x40cc70
mov edi, dword [ebp - 0x4a4]
cmp edi, esi
je 0x40ce47
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
push 0x40d248
ret
mov eax, dword [ebp - 0x478]
mov byte [ebp - 4], 3
cmp eax, esi
je 0x40cdff
mov ecx, dword [eax]
je 0x40cdf9
jne 0x40cdf9
and byte [eax], ah
sal dword [esi - 0x7bf0a3da], 0x3b
idiv bh
call dword [eax - 0x73]
lea ecx, [eax - 0x17000005]
stosb byte es:[edi], al
fdivp st(7)
inc dword [ebx - 0x47743]
inc dword [eax]
je 0x40ce05
push eax
lea ecx, [ebp - 0x478]
call fcn.0040b680
cmp dword [ebp - 0x478], 0
jmp 0x40d2da
mov eax, dword [ebp - 0x480]
push 0x40d4fb
ret
mov edx, dword [0x40166c]
mov ecx, dword [0x401668]
mov dword [ebp - 0x24], eax
mov al, byte [0x401670]
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], ecx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d912
sub eax, edx
lea ecx, [ebp + eax - 0x27]
lea eax, [ebp - 0x24]
je 0x40d27b
jne 0x40d27b
jmp dword [eax*4 + 0x4138f5]
neg esi
sbb esi, esi
push edi
lea ecx, [ebp - 0x46c]
push ecx
and esi, 0xffffe000
lea ecx, [ebp - 0x479]
add esi, 0x2200
call fcn.0040c460
mov byte [ebp - 4], 5
test edi, edi
jne 0x40cbf5
mov eax, dword [ebp - 0x46c]
lea edx, [eax + 2]
jmp 0x40d988
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d988
sub eax, edx
sar eax, 1
jne 0x40cbf5
lea ecx, [ebp - 0x46c]
call fcn.0040b600
xor esi, esi
push 0x40d79e
ret