Function at 0x41bce0
Capabilities:
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
push 0xffffffffffffffff
push 0x4bf381
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e7d04]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
xor esi, esi
push esi
mov dword [esp + 0x9c], esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
jge 0x41bd28
xor eax, eax
jmp 0x41d162
push esi
push esi
push esi
push 3
push 6
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x1c]
push eax
push 0x4d38d4
push 1
push esi
push 0x4cf914
mov dword [esp + 0x104], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jge 0x41bd77
mov dword [esp + 0xf0], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, esi
jmp 0x41d14b
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0xac]
mov edi, dword [esp + 0xb0]
mov ebp, dword [esp + 0xb4]
mov ebx, dword [esp + 0xb8]
lea ecx, [esp + 0xd4]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xd8]
mov edx, dword [esp + 0xd4]
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], edx
mov edx, dword [esp + 0xe0]
lea eax, [esp + 0xbc]
push eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, dword [esp + 0xc0]
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x88], edx
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0xc8]
lea edx, [esp + 0x9c]
push edx
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0xf0], 4
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x7c]
mov dword [eax + 4], edi
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebx
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x90]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x94]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x98]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0xa4]
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0xb8]
mov dword [eax + 4], esi
mov esi, dword [esp + 0xbc]
mov dword [eax + 8], esi
mov esi, dword [esp + 0xc0]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0xcc]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0xe0]
mov dword [eax + 4], esi
mov esi, dword [esp + 0xe4]
mov dword [eax + 8], esi
mov esi, dword [esp + 0xe8]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x28]
push ecx
call eax
lea ecx, [esp + 0x9c]
mov esi, eax
push ecx
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
call edi
lea edx, [esp + 0xbc]
push edx
call edi
lea eax, [esp + 0xd4]
push eax
call edi
lea ecx, [esp + 0xac]
push ecx
call edi
test esi, esi
jge 0x41bf2c
mov dword [esp + 0xf0], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41d155
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x41d155
mov dword [esp + 0x24], 0
mov byte [esp + 0xf0], 5
mov edi, dword [esp + 0x1c]
push 0x4d0e64
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x41bf5f
push 0x8007000e
call fcn.004048a0
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0xf4], 6
mov ecx, dword [edi]
mov eax, dword [ecx + 0x1c]
push esi
push edi
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov ebx, eax
call edi
test ebx, ebx
jl 0x41d122
xor esi, esi
mov dword [esp + 0x28], esi
mov ebp, dword [esp + 0xf8]
mov byte [esp + 0xf0], 7
mov ebx, dword [esp + 0x24]
cmp ebp, esi
jne 0x41c2d5
mov dword [esp + 0x68], esi
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0xf4], 8
mov eax, dword [ebx]
mov edx, dword [eax + 0x34]
push esi
push ebx
call edx
push esi
mov ebx, eax
mov byte [esp + 0xf4], 7
call edi
test ebx, ebx
jl 0x41c36d
mov eax, dword [esp + 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x41c36d
mov dword [esp + 0x60], ebx
lea edx, [esp + 0x60]
mov byte [esp + 0xf0], 9
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x4c]
call eax
cmp eax, ebx
jl 0x41c355
mov dword [esp + 0x5c], ebx
mov byte [esp + 0xf0], 0xa
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
cmp eax, ebx
jl 0x41c33d
mov dword [esp + 0x58], ebx
mov byte [esp + 0xf0], 0xb
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push 1
push eax
mov eax, dword [ecx + 0x20]
call eax
cmp eax, ebx
jl 0x41c325
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0xe4]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
cmp eax, ebx
jl 0x41c325
cmp dword [esp + 0xe4], ebx
jne 0x41c325
mov eax, dword [esp + 0x58]
lea esi, [esp + 0x34]
call fcn.0041dab0
mov byte [esp + 0xf0], 0xc
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x41c311
push 0x4d2188
lea ecx, [esp + 0x50]
call fcn.0041e0e0
push 0x4d2188
lea ecx, [esp + 0xd4]
mov byte [esp + 0xf4], 0xd
call fcn.0041e0e0
push 0x4d2188
lea ecx, [esp + 0x98]
mov byte [esp + 0xf4], 0xe
call fcn.0041e0e0
mov ecx, dword [esp + 0xfc]
mov bl, 0xf
mov byte [esp + 0xf0], bl
mov ebp, dword [esp + 0x4c]
push ebp
call fcn.00409190
mov esi, dword [esp + 0xd0]
test eax, eax
jne 0x41c135
mov ecx, dword [esp + 0xfc]
push esi
add ecx, 4
call fcn.00409190
test eax, eax
jne 0x41c135
mov ecx, dword [esp + 0x94]
push ecx
mov ecx, dword [esp + 0x100]
add ecx, 8
call fcn.00409190
test eax, eax
je 0x41c1e6
mov edx, dword [esp + 0xfc]
mov eax, dword [edx]
mov esi, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041e0e0
mov byte [esp + 0xf0], 0x10
mov eax, dword [eax]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2c]
push eax
push esi
call edx
mov byte [esp + 0xf0], bl
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0xfc]
mov eax, dword [ecx + 4]
mov esi, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041e0e0
mov byte [esp + 0xf0], 0x11
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x3c]
push esi
call eax
mov byte [esp + 0xf0], bl
mov ecx, dword [esp + 0x18]
push ecx
call edi
mov edx, dword [esp + 0xfc]
mov eax, dword [edx + 8]
mov esi, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041e0e0
mov byte [esp + 0xf0], 0x12
mov eax, dword [eax]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x34]
push eax
push esi
call edx
mov byte [esp + 0xf0], bl
mov eax, dword [esp + 0x18]
push eax
call edi
mov esi, dword [esp + 0xd0]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jl 0x41c2f4
or ebx, 0xffffffff
cmp word [esp + 0x68], bx
je 0x41c21e
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push ebx
push eax
call edx
mov eax, dword [esp + 0x94]
push eax
mov dword [esp + 0x9c], 1
call edi
push esi
call edi
push ebp
call edi
mov byte [esp + 0xf0], 0xb
mov eax, dword [esp + 0x34]
test eax, eax
je 0x41c251
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0xa
mov eax, dword [esp + 0x58]
test eax, eax
je 0x41c269
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 9
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x41c281
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 7
mov eax, dword [esp + 0x60]
test eax, eax
je 0x41c299
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 5
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41c2b1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41c2c9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xf0], ebx
jmp 0x41d145
push ebp
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x68], esi
test esi, esi
jne 0x41bfad
push 0x8007000e
call fcn.004048a0
mov eax, dword [esp + 0x94]
push eax
call edi
push esi
call edi
push ebp
call edi
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0xf8]
xor ebx, ebx
mov byte [esp + 0xf0], 0xb
cmp eax, ebx
je 0x41c325
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0xa
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x41c33d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 9
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x41c355
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 7
mov eax, dword [esp + 0x60]
cmp eax, ebx
je 0x41c36d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ebx, dword [esp + 0x24]
test ebp, ebp
jne 0x41c416
xor esi, esi
mov dword [esp + 0x18], esi
xor ebp, ebp
push ebp
mov byte [esp + 0xf4], 0x13
mov eax, dword [ebx]
mov ecx, dword [eax + 0x3c]
push esi
push ebx
call ecx
push esi
call edi
mov dword [esp + 0x20], ebp
mov byte [esp + 0xf0], 0x14
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [esp + 0x20]
push ecx
push ebp
push eax
call edx
cmp eax, ebp
jge 0x41c435
mov byte [esp + 0xf0], 7
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x41c3d0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 5
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x41c3e8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x41c400
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xf0], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, ebp
jmp 0x41d14b
push ebp
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x41c37f
push 0x8007000e
call fcn.004048a0
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x41c449
mov dword [esp + 0x1c], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x30], ebp
mov byte [esp + 0xf0], 0x15
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
cmp eax, ebp
jge 0x41c48b
mov byte [esp + 0xf0], 0x14
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x41c3b8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x41c3b8
mov ebx, dword [esp + 0x30]
lea esi, [esp + 0x4c]
call fcn.0041d780
mov byte [esp + 0xf0], 0x16
mov eax, dword [eax]
cmp eax, ebp
jne 0x41c57a
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x17
mov eax, dword [ebx]
mov ecx, dword [eax + 0x28]
push esi
push ebx
call ecx
push esi
call edi
mov byte [esp + 0xf0], 0x15
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41c4ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xfc]
mov eax, dword [ecx + 0xc]
mov ebx, dword [esp + 0x30]
cmp eax, ebp
jne 0x41c599
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x18
mov edx, dword [ebx]
mov eax, dword [edx + 0x20]
push esi
push ebx
call eax
push esi
mov byte [esp + 0xf4], 0x15
call edi
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x41c538
mov dword [esp + 0x30], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x2c], ebp
mov byte [esp + 0xf0], 0x19
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
cmp eax, ebp
jge 0x41c5b8
mov byte [esp + 0xf0], 0x15
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x41c46a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x41c46a
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c4b0
push 0x8007000e
call fcn.004048a0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c508
push 0x8007000e
call fcn.004048a0
mov dword [esp + 0x40], ebp
mov byte [esp + 0xf0], 0x1a
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 9
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [esp + 0x2c]
mov esi, eax
mov eax, ecx
cmp ecx, ebp
je 0x41c5f3
mov dword [esp + 0x2c], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x2c]
cmp esi, ebp
jge 0x41c648
mov byte [esp + 0xf0], 0x19
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x41c613
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0xf0], 0x15
cmp ecx, ebp
je 0x41c627
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
mov byte [esp + 0xf0], 0x14
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x41c3b8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x41c3b8
mov edx, dword [esp + 0x40]
xor eax, eax
mov dword [esp + 0x38], eax
cmp edx, ebp
je 0x41c673
mov eax, dword [edx]
lea ecx, [esp + 0x38]
push ecx
push 0x4d38c4
push edx
mov edx, dword [eax]
call edx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov byte [esp + 0xf0], 0x1b
cmp eax, ebp
jne 0x41c6b4
mov byte [esp + 0xf0], 0x19
cmp edx, ebp
je 0x41c697
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push edx
call ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0xf0], 0x15
cmp ecx, ebp
je 0x41c46a
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
jmp 0x41c46a
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push 0xffffffffffffffff
push eax
call edx
mov ebx, dword [esp + 0x38]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c6e1
push 0x8007000e
call fcn.004048a0
mov byte [esp + 0xf0], 0x1c
mov eax, dword [ebx]
mov ecx, dword [eax + 0x24]
push esi
push ebx
call ecx
push esi
mov byte [esp + 0xf4], 0x1b
call edi
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x4c]
call fcn.0041d7c0
mov byte [esp + 0xf0], 0x1d
mov eax, dword [eax]
cmp eax, ebp
jne 0x41c835
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x1e
mov edx, dword [ebx]
mov eax, dword [edx + 0x5c]
push esi
push ebx
call eax
push esi
call edi
mov byte [esp + 0xf0], 0x1b
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c75e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x4eab28]
mov eax, dword [edx + 0xc]
mov ecx, 0x4eab28
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0xfc]
mov byte [esp + 0xf0], 0x1f
mov eax, dword [ecx + 0x10]
cdq
mov ecx, 0x3c
idiv ecx
push edx
push eax
lea edx, [esp + 0x3c]
push str.PT_dM_dS
push edx
call fcn.00409b50
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
jne 0x41c854
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x20
mov eax, dword [ebx]
mov ecx, dword [eax + 0x54]
push esi
push ebx
call ecx
push esi
mov ebx, eax
mov byte [esp + 0xf4], 0x1f
call edi
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x41c7eb
mov dword [esp + 0x38], ebp
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
cmp ebx, ebp
jge 0x41c873
lea ecx, [esp + 0x34]
call fcn.00404680
mov byte [esp + 0xf0], 0x1a
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x41c814
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x19
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x41c559
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x41c559
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c722
push 0x8007000e
call fcn.004048a0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c7b9
push 0x8007000e
call fcn.004048a0
mov dword [esp + 0x3c], ebp
mov byte [esp + 0xf0], 0x21
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x3c]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
cmp eax, ebp
jge 0x41c8b5
mov byte [esp + 0xf0], 0x1f
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x41c7f3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x41c7f3
mov dword [esp + 0x50], ebp
mov byte [esp + 0xf0], 0x22
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
push edx
push ebp
push eax
mov eax, dword [ecx + 0x30]
call eax
mov esi, eax
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x41c8ed
mov dword [esp + 0x3c], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x3c]
cmp esi, ebp
jge 0x41c92a
mov byte [esp + 0xf0], 0x21
mov ecx, dword [esp + 0x50]
cmp ecx, ebp
je 0x41c90d
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
mov eax, dword [esp + 0x3c]
mov byte [esp + 0xf0], 0x1f
cmp eax, ebp
je 0x41c7f3
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x41c7f3
mov ecx, dword [esp + 0x50]
xor ebx, ebx
mov dword [esp + 0x48], ebx
cmp ecx, ebp
je 0x41c955
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x48]
push edx
push str.MbLk
push ecx
call eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x50]
mov ebx, dword [esp + 0x48]
mov byte [esp + 0xf0], 0x23
cmp ebx, ebp
jne 0x41c986
mov byte [esp + 0xf0], 0x21
cmp ecx, ebp
je 0x41c979
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
mov eax, dword [esp + 0x3c]
mov byte [esp + 0xf0], 0x1f
jmp 0x41c8a0
mov eax, dword [esp + 0xfc]
mov eax, dword [eax]
cmp eax, ebp
jne 0x41ca97
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x24
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x2c]
push esi
push ebx
call edx
push esi
mov byte [esp + 0xf4], 0x23
call edi
mov eax, dword [esp + 0xfc]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x48]
cmp eax, ebp
jne 0x41cab6
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x25
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x3c]
push esi
push ebx
call edx
push esi
mov byte [esp + 0xf4], 0x23
call edi
mov eax, dword [esp + 0xfc]
mov eax, dword [eax + 8]
mov ebx, dword [esp + 0x48]
cmp eax, ebp
jne 0x41cad5
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x26
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x34]
push esi
push ebx
call edx
push esi
call edi
mov dword [esp + 0x54], ebp
mov byte [esp + 0xf0], 0x27
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
cmp eax, ebp
jge 0x41caf4
mov byte [esp + 0xf0], 0x23
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x41ca5e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x22
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x41ca76
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x21
mov eax, dword [esp + 0x50]
cmp eax, ebp
je 0x41c894
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x41c894
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c99d
push 0x8007000e
call fcn.004048a0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41c9d5
push 0x8007000e
call fcn.004048a0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41ca0d
push 0x8007000e
call fcn.004048a0
mov ebx, dword [esp + 0x54]
lea esi, [esp + 0x4c]
call fcn.0041d780
mov byte [esp + 0xf0], 0x28
mov eax, dword [eax]
cmp eax, ebp
jne 0x41cb74
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x29
mov eax, dword [ebx]
mov ecx, dword [eax + 0x20]
push esi
push ebx
call ecx
push esi
call edi
mov byte [esp + 0xf0], 0x27
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41cb51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x54]
push str.BUILTINAdministrators
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41cb8f
push 0x8007000e
call fcn.004048a0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41cb15
push 0x8007000e
call fcn.004048a0
mov byte [esp + 0xf0], 0x2a
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x40]
push esi
push ebx
call edx
push esi
mov byte [esp + 0xf4], 0x27
call edi
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push 1
push eax
call edx
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x41cbcd
mov dword [esp + 0x48], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x44], ebp
mov byte [esp + 0xf0], 0x2b
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
cmp eax, ebp
jge 0x41cc0f
mov byte [esp + 0xf0], 0x27
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x41ca46
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x41ca46
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push ebp
push eax
call edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push ebp
push eax
call edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push ebp
push eax
call edx
mov ebx, dword [esp + 0x44]
push str.PT0S
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
jne 0x41cc59
push 0x8007000e
call fcn.004048a0
mov byte [esp + 0xf0], 0x2c
mov eax, dword [ebx]
mov ecx, dword [eax + 0x70]
push esi
push ebx
call ecx
push esi
call edi
mov dword [esp + 0x64], ebp
mov byte [esp + 0xf0], 0x2d
mov eax, dword [esp + 0x44]
mov edx, dword [eax]
mov edx, dword [edx + 0x9c]
lea ecx, [esp + 0x64]
push ecx
push eax
call edx
cmp eax, ebp
jl 0x41cc9e
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x41ccb2
mov dword [esp + 0x44], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x80], ebp
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0xbc]
push eax
call esi
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xc4]
mov eax, dword [esp + 0xc8]
mov ebx, dword [esp + 0xbc]
mov dword [esp + 0xb0], ecx
lea ecx, [esp + 0xd4]
push ecx
mov dword [esp + 0xb8], edx
mov dword [esp + 0xbc], eax
call esi
mov byte [esp + 0xf0], 0x30
mov edx, dword [esp + 0xd4]
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0x84], edx
mov edx, dword [esp + 0xe0]
lea esi, [esp + 0x4c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
call fcn.0041d780
mov byte [esp + 0xf0], 0x31
mov esi, dword [eax]
lea ecx, [esp + 0x6c]
xor eax, eax
push ecx
mov word [esp + 0x70], ax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, 8
push esi
mov word [esp + 0x70], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x74], eax
cmp eax, ebp
jne 0x41cda2
cmp esi, ebp
je 0x41cda2
mov eax, 0xa
push 0x8007000e
mov word [esp + 0x70], ax
mov dword [esp + 0x78], 0x8007000e
call fcn.004048a0
cmp dword [esp + 0xf8], 0
mov byte [esp + 0xf0], 0x32
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov ebp, dword [esp + 0x24]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], edx
mov dword [esp + 0xa8], eax
jne 0x41cf9d
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0xf0], 0x33
mov ecx, dword [esp + 0xb0]
lea eax, [esp + 0x80]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xcc]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x98]
push 3
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0xb0]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xb4]
mov edx, dword [ebp]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xb8]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0xc4]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0xd8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xdc]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xe0]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x58]
mov ecx, dword [edx + 0x44]
push 6
push eax
push esi
push ebp
call ecx
push esi
mov ebx, eax
call edi
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0xf0], 0x30
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cec2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xd4]
push ecx
call esi
lea edx, [esp + 0xbc]
push edx
call esi
mov byte [esp + 0xf0], 0x2d
mov eax, dword [esp + 0x80]
test ebx, ebx
jge 0x41cfc3
test eax, eax
je 0x41ceff
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x2b
mov eax, dword [esp + 0x64]
test eax, eax
je 0x41cf17
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x27
mov eax, dword [esp + 0x44]
test eax, eax
je 0x41cf2f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x23
mov eax, dword [esp + 0x54]
test eax, eax
je 0x41cf47
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x22
mov eax, dword [esp + 0x48]
test eax, eax
je 0x41cf5f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x21
mov eax, dword [esp + 0x50]
test eax, eax
je 0x41cf77
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x1f
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41cf8f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x34]
call fcn.00404680
jmp 0x41d092
mov ecx, dword [esp + 0xf8]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x41cdea
push 0x8007000e
call fcn.004048a0
mov dword [esp + 0x98], 1
test eax, eax
je 0x41cfda
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x2b
mov eax, dword [esp + 0x64]
test eax, eax
je 0x41cff2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x27
mov eax, dword [esp + 0x44]
test eax, eax
je 0x41d00a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x23
mov eax, dword [esp + 0x54]
test eax, eax
je 0x41d022
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x22
mov eax, dword [esp + 0x48]
test eax, eax
je 0x41d03a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x21
mov eax, dword [esp + 0x50]
test eax, eax
je 0x41d052
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x1f
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41d06a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x1b
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d092
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf0], 0x1a
mov eax, dword [esp + 0x38]
test eax, eax
je 0x41d0aa
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x19
mov eax, dword [esp + 0x40]
test eax, eax
je 0x41d0c2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x15
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x41d0da
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0x14
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41d0f2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 7
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41d10a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 5
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41d122
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xf0], 0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41d13a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xf0], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41d155
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret 8