Function at 0x41e340
Capabilities:
Check mutex on windows
Create process on windows
Schedule task via at
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523764
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1044
call fcn.004f6280
mov eax, dword [0x56a260]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x1058]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x28], ebx
call fcn.004a6760
test eax, eax
mov eax, str.SCProtect64.exe
jne 0x41e39e
mov eax, str.SCProtect.exe
push eax
call fcn.0041d780
add esp, 4
push 0x543e10
lea ecx, [esp + 0x14]
call fcn.00401f50
lea eax, [esp + 0x10]
xor edi, edi
push eax
mov dword [esp + 0x1064], edi
call fcn.004a4540
mov dword [esp + 0x1060], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e3eb
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push edi
call fcn.004a3380
push str.__TeenupExamClientApp__
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41e41a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41eefe
mov ecx, dword [ebx + 0x48]
push ecx
lea ecx, [esp + 0x24]
call fcn.00401f50
lea ecx, [esp + 0x40]
mov dword [esp + 0x1060], 1
call fcn.00434740
mov dword [esp + 0x40], vtable.CInitThread.0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1060], 2
call fcn.00434910
push str.JDPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekRAVCpl64General
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 3
call fcn.00401f50
push edi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 2
mov byte [esp + 0x1070], 4
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e4ae
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e4ce
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.JDPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekRAVCplGeneral
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 5
call fcn.00401f50
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 2
mov byte [esp + 0x1070], 6
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e528
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e548
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.JDPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekRtHDVCpl64General
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 7
call fcn.00401f50
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 2
mov byte [esp + 0x1070], 8
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e5a2
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e5c2
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.JDPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekRtHDVCplGeneral
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 9
call fcn.00401f50
push edi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 2
mov byte [esp + 0x1070], 0xa
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e61c
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e63c
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.JDPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekAudioRtkNGUI64General
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 0xb
call fcn.00401f50
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 2
mov byte [esp + 0x1070], 0xc
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e696
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e6b6
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.JDPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekAudioRtkNGUIGeneral
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 0xd
call fcn.00401f50
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 2
mov byte [esp + 0x1070], 0xe
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e710
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e730
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.AutoPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekHDAudio
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 0xf
call fcn.00401f50
push edi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 2
mov byte [esp + 0x1070], 0x10
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e78a
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e7aa
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push str.AutoPopup
lea ecx, [esp + 0x14]
call fcn.00401f50
push str.SoftwareRealtekHDAudio64
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 0x11
call fcn.00401f50
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 2
mov byte [esp + 0x1070], 0x12
call fcn.0049d230
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e804
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 2
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e824
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
call fcn.00402700
cmp eax, 1
jne 0x41e83e
mov eax, dword [esp + 0x1c]
mov dword [eax - 4], edi
push 0x543e10
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x13
call fcn.00401f50
push str.AppEventsSchemesAppsExplorerNavigating.Current
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 0x14
call fcn.00401f50
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 2
mov byte [esp + 0x1070], 0x15
call fcn.0049d440
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e8a4
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e8c4
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x41e9cd
cmp dword [eax - 4], edi
jle 0x41e9cd
push 0x543e10
lea ecx, [esp + 0x1c]
call fcn.00401f50
push 0x543e10
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x16
call fcn.00401f50
push str.AppEventsSchemesAppsExplorerNavigating.Current
lea ecx, [esp + 0x18]
mov byte [esp + 0x1064], 0x17
call fcn.00401f50
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 2
mov byte [esp + 0x1070], 0x18
call fcn.0049d3b0
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41e94d
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41e969
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41e989
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
push 0x54e028
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.AppEventsSchemesAppsExplorerNavigating.Current
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x19
call fcn.00401f50
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 2
mov byte [esp + 0x1070], 0x1a
call fcn.0049d3b0
jmp 0x41ea0f
push 0x54e028
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.AppEventsSchemesAppsExplorerNavigating.Current
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x1b
call fcn.00401f50
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 2
mov byte [esp + 0x1070], 0x1c
call fcn.0049d440
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41ea2b
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41ea4b
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
call fcn.0049d6b0
cmp eax, 0xd
jl 0x41eb4f
push str.ZoomDisabled
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.SoftwareMicrosoftInternet_ExplorerZoom
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x1d
call fcn.00401f50
push 1
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 2
mov byte [esp + 0x1070], 0x1e
call fcn.0049d230
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41eab4
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41ead4
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
push str.AutoRestartShell
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x1f
call fcn.00401f50
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 3
mov byte [esp + 0x1070], 0x20
call fcn.0049d230
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41eb2f
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41eb4f
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.004e0ee3
call fcn.004e0806
push edi
call fcn.004e263a
add esp, 4
push 0x54e134
mov ecx, ebx
call fcn.004e2baf
push str.ZoomDisabled
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], edi
call fcn.00401f50
push str.SoftwareMicrosoftInternet_ExplorerZoom
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x21
call fcn.00401f50
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 2
mov byte [esp + 0x1070], 0x22
call fcn.0049d2b0
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41ebed
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41ec0d
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
push str.ZoomDisabled
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.SoftwareMicrosoftInternet_ExplorerZoom
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x23
call fcn.00401f50
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 2
mov byte [esp + 0x1070], 0x24
call fcn.0049d230
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41ec68
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], 0x13
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41ec88
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
lea edx, [esp + 0x6c]
push edx
call fcn.00410d00
lea eax, [esp + 0x20]
mov bl, 0x25
push eax
lea ecx, [esp + 0xeb4]
mov byte [esp + 0x1064], bl
call fcn.00401fe0
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x6c]
mov dword [edx + 0x20], ecx
call fcn.004d4571
push str.ZoomDisabled
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.SoftwareMicrosoftInternet_ExplorerZoom
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x26
call fcn.00401f50
mov byte [esp + 0x1060], 0x27
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 2
call fcn.0049d230
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41ed1a
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], bl
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41ed39
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x41edc7
cmp dword [eax - 4], edi
jle 0x41edc7
push 0x543e10
lea ecx, [esp + 0x1c]
call fcn.00401f50
push str.AppEventsSchemesAppsExplorerNavigating.Current
lea ecx, [esp + 0x14]
mov byte [esp + 0x1064], 0x28
call fcn.00401f50
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 2
mov byte [esp + 0x1070], 0x29
call fcn.0049d3b0
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41eda8
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1060], bl
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41edc7
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
call fcn.0049d6b0
cmp eax, 0xd
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jl 0x41eea5
cmp dword [esp + 0xa10], edi
je 0x41eea5
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push edi
push str._Create__TN__explorer___TR__explorer.exe___SC_ONCE__ST_00:00
push str.schtasks
push str.open
push edi
call esi
push 0xbb8
call ebx
push edi
push edi
push str._Run__TN__explorer_
push str.schtasks
push str.open
push edi
call esi
push 0xbb8
call ebx
push edi
push edi
push str._Delete__F__TN__explorer_
push str.schtasks
push str.open
push edi
call esi
call fcn.00401bd0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
lea eax, [esp + 0x2c]
push eax
mov ecx, str.explorer.exe
mov byte [esp + 0x1064], 0x2a
call fcn.0041d390
add esp, 4
cmp dword [esp + 0x34], edi
jne 0x41ee9c
push str.explorer.exe
lea ecx, [esp + 0x1c]
call fcn.00401f50
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x1064], 0x2b
call fcn.0041d8d0
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, edi
je 0x41ee9c
add eax, 0xfffffff8
push eax
call fcn.004d37ab
add esp, 4
lea esi, [esp + 0x2c]
call fcn.0041a420
push 0x1f4
call ebx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1060], 0x13
call fcn.004113f0
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x41eed9
sub eax, 8
push eax
mov dword [esp + 0x20], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x40]
mov byte [esp + 0x1060], 1
call fcn.004348a0
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x41eefe
add eax, 0xfffffff8
push eax
call fcn.004d37ab
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1058]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1040]
xor ecx, esp
call fcn.004f2ac1
mov esp, ebp
pop ebp
ret