Function at 0x41e210
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5b38
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
push esi
push edi
mov eax, dword [0x4e43e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
push 0
mov dword [ebp - 0x74], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x41e268
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x4c1efc
push 1
push 0
push 0x4c747c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41e3f6
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xa8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0xa8], xmm0
call esi
movups xmm0, xmmword [ebp - 0xa8]
lea eax, [ebp - 0x98]
push eax
movups xmmword [ebp - 0xcc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
call esi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0xbc]
push eax
movups xmmword [ebp - 0xdc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xbc], xmm0
call esi
movups xmm0, xmmword [ebp - 0xbc]
lea eax, [ebp - 0x84]
push eax
movups xmmword [ebp - 0xec], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x84], xmm0
call esi
movups xmm0, xmmword [ebp - 0xcc]
mov eax, dword [ebp - 0x14]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 4
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xdc]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xec]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x84]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call edi
lea eax, [ebp - 0xbc]
push eax
call edi
lea eax, [ebp - 0x98]
push eax
call edi
lea eax, [ebp - 0xa8]
push eax
call edi
test esi, esi
js 0x41e3f6
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x14]
push 0x4bc670
mov byte [ebp - 4], 5
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41f2b5
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
push esi
push edi
mov byte [ebp - 4], 6
call dword [eax + 0x1c]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x41e413
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x41e3f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41f299
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41f299
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 7
test eax, eax
jne 0x41e42f
xor esi, esi
mov dword [ebp - 0x38], esi
jmp 0x41e444
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call eax
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x41f2b5
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push esi
push edi
mov byte [ebp - 4], 8
call dword [eax + 0x34]
push esi
mov edi, eax
mov byte [ebp - 4], 7
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x41e6f4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41e6f4
mov dword [ebp - 0x68], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x68]
push edx
push eax
mov byte [ebp - 4], 9
call dword [ecx + 0x4c]
test eax, eax
js 0x41e6e3
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x41e6d2
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x5c]
push edx
push 1
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x20]
test eax, eax
js 0x41e6c1
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x50]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x41e6c1
cmp dword [ebp - 0x50], 0
jne 0x41e6c1
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x54]
call fcn.0041da80
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x41e6b3
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4bc6f0
call edi
mov esi, eax
mov dword [ebp - 0xac], esi
test esi, esi
je 0x41f2b5
push 0x4bc6f0
mov byte [ebp - 4], 0xd
call edi
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41f2bf
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4bc6f0
mov byte [ebp - 4], 0xe
call eax
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41f2c9
mov ecx, dword [ebp + 0xc]
push esi
mov byte [ebp - 4], 0xf
call fcn.0041f320
test eax, eax
jne 0x41e592
mov ecx, dword [ebp + 0xc]
push edi
lea ecx, [ecx + 4]
call fcn.0041f320
test eax, eax
jne 0x41e592
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x58]
lea ecx, [ecx + 8]
call fcn.0041f320
test eax, eax
je 0x41e621
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0041dad0
mov edx, dword [ebp - 0x18]
push dword [eax]
mov byte [ebp - 4], 0x10
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
push dword [ebp - 0x10]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call fcn.0041dad0
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x11
push edx
mov ecx, dword [edx]
call dword [ecx + 0x3c]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0041dad0
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x12
push edx
mov ecx, dword [edx]
call dword [ecx + 0x34]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x41e69b
cmp word [ebp - 0x38], 0xffff
je 0x41e64b
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41e671
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41e682
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 9
test eax, eax
je 0x41e693
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
jmp 0x41f23e
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41e6c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41e6d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 9
test eax, eax
je 0x41e6e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 7
test eax, eax
je 0x41e6f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x41e705
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x41e719
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41f2b5
mov eax, dword [edi]
push 0
push esi
push edi
mov byte [ebp - 4], 0x13
call dword [eax + 0x3c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x24]
test eax, eax
jns 0x41e778
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x41e75e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x41e3e5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e3e5
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41e78c
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov eax, dword [ebp - 0x2c]
jns 0x41e7bb
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41e74d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e74d
cmp word [0x4e7f00], 0
mov dword [ebp - 0x50], eax
jne 0x41e7de
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e7f00
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e7f00
lea ecx, [ebp - 0x38]
call fcn.00406da0
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x16
test eax, eax
jne 0x41e844
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x50]
push esi
push ecx
mov byte [ebp - 4], 0x17
mov eax, dword [ecx]
call dword [eax + 0x28]
push esi
call edi
mov edx, dword [ebp - 0x38]
or edi, 0xffffffff
mov byte [ebp - 4], 0x15
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e82d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x41e85a
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x41e871
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41f2d3
jmp 0x41e7fb
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41f2b5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x18
call dword [eax + 0x20]
push esi
mov byte [ebp - 4], 0x15
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41e89b
mov dword [ebp - 0x2c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x41e8e2
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x41e8c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41e74d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e74d
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x3c]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x1a
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x28]
mov esi, eax
test edx, edx
je 0x41e915
mov dword [ebp - 0x28], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
test esi, esi
jns 0x41e93d
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41e92d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test edx, edx
je 0x41e8c8
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x41e8c8
xor ecx, ecx
mov dword [ebp - 0x30], ecx
test eax, eax
je 0x41e967
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push 0x4c1e04
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x30]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x3c]
cmovs ecx, edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 0x1b
test ecx, ecx
je 0x41e91c
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov eax, dword [ebp - 0x30]
push str.Trigger1
mov dword [ebp - 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x41f2b5
mov ecx, dword [ebp - 0x10]
push esi
push ecx
mov byte [ebp - 4], 0x1c
mov eax, dword [ecx]
call dword [eax + 0x24]
push esi
mov byte [ebp - 4], 0x1b
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp word [0x4e8100], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
jne 0x41e9d5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e8100
push 2
call sub.Secur32.dll_GetUserNameExW
push 0x4e8100
lea ecx, [ebp - 0x38]
call fcn.00406da0
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x1d
test eax, eax
jne 0x41eb12
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x50]
push esi
push ecx
mov byte [ebp - 4], 0x1e
mov eax, dword [ecx]
call dword [eax + 0x5c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x38]
mov eax, edi
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ea29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4e7d74]
test al, 1
jne 0x41ea68
or eax, 1
mov dword [0x4e7d74], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x4ba370
mov dword [0x4e7d68], 0x4bc678
mov dword [0x4e7d6c], eax
mov byte [0x4e7d70], 0
call fcn.0042a213
mov eax, dword [0x4e7d74]
add esp, 4
test al, 2
jne 0x41eac4
or eax, 2
mov dword [0x4e7d78], 0x4bc690
mov dword [0x4e7d74], eax
xor eax, eax
push 0x4ba3a0
mov dword [0x4e7d7c], 0x4e7d68
mov dword [0x4e7d8c], 2
mov dword [0x4e7d84], 0
mov dword [0x4e7d88], 0
mov dword [0x4e7d90], eax
mov dword [0x4e7d80], 0x4e7d78
call fcn.0042a213
add esp, 4
mov eax, dword [0x4e7d78]
mov ecx, 0x4e7d78
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x3c
mov byte [ebp - 4], 0x1f
mov eax, dword [eax + 0x10]
cdq
idiv ecx
push edx
push eax
lea eax, [ebp - 0x38]
push str.PT_dM_dS
push eax
call fcn.0040a940
mov esi, dword [ebp - 0x38]
add esp, 0x10
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
test esi, esi
jne 0x41eb2b
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x41eb42
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41f2dd
jmp 0x41e9f6
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x41f2b5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x20
call dword [eax + 0x54]
push edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x1f
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x41eb6f
mov dword [ebp - 0x30], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0x10], 0
jge 0x41ebbc
or eax, 0xffffffff
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41eb91
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x41eba2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41e8b7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e8b7
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x41ebeb
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41eb75
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41eb75
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x4c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x22
call dword [ecx + 0x30]
mov edx, dword [ebp - 0x34]
mov edi, eax
test edx, edx
je 0x41ec1e
mov dword [ebp - 0x34], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
test edi, edi
jns 0x41ec4d
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41ec36
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test edx, edx
je 0x41eb75
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x41eb75
xor edi, edi
mov dword [ebp - 0x44], edi
test eax, eax
je 0x41ec77
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push 0x4c1df4
push eax
call dword [ecx]
mov edi, dword [ebp - 0x44]
xor ecx, ecx
mov edx, dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0x4c]
cmovs edi, ecx
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0x23
test edi, edi
je 0x41ec25
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x41ec8d
mov dword [ebp - 0x58], eax
jmp 0x41ec9f
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41f2b5
mov ecx, dword [edi]
push eax
push edi
mov byte [ebp - 4], 0x24
call dword [ecx + 0x2c]
push dword [ebp - 0x58]
mov byte [ebp - 4], 0x23
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
test eax, eax
jne 0x41ecce
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x41ece5
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x41f2b5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x25
call dword [eax + 0x3c]
push edi
mov byte [ebp - 4], 0x23
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 8]
test eax, eax
jne 0x41ed12
xor edi, edi
mov dword [ebp + 0xc], edi
jmp 0x41ed29
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp + 0xc], edi
test edi, edi
je 0x41f2b5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x26
call dword [eax + 0x34]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0x27
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
mov eax, dword [ebp - 0x48]
jns 0x41ed93
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41ed68
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41ed79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41ebd8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41ebd8
cmp word [0x4e7f00], 0
mov dword [ebp - 0x50], eax
jne 0x41edb6
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e7f00
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e7f00
lea ecx, [ebp + 0xc]
call fcn.00406da0
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x28
test eax, eax
jne 0x41ee96
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x50]
push edi
push ecx
mov byte [ebp - 4], 0x29
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
mov byte [ebp - 4], 0x27
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ee0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
push str.BUILTINAdministrators
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41f2b5
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov byte [ebp - 4], 0x2a
mov eax, dword [ecx]
call dword [eax + 0x40]
push edi
mov byte [ebp - 4], 0x27
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x48]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x41ee61
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
mov eax, dword [ebp - 0x40]
jns 0x41eeaf
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41ee8e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
jmp 0x41ed5a
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x41f2e7
jmp 0x41edd7
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x40]
push str.PT0S
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41f2b5
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov byte [ebp - 4], 0x2c
mov eax, dword [ecx]
call dword [eax + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x60]
push edx
push eax
mov byte [ebp - 4], 0x2d
mov ecx, dword [eax]
call dword [ecx + 0x9c]
test eax, eax
js 0x41ef2a
mov eax, dword [ebp - 0x60]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x41ef3e
mov dword [ebp - 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x6c], 0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x98]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x98], xmm0
call edi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0xa8]
push eax
movups xmmword [ebp - 0xdc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa8], xmm0
call edi
cmp word [0x4e7f00], 0
movups xmm0, xmmword [ebp - 0xa8]
mov byte [ebp - 4], 0x30
movups xmmword [ebp - 0xcc], xmm0
jne 0x41efb1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e7f00
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e7f00
lea ecx, [ebp + 0xc]
call fcn.00406da0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x18], edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x41f2f1
mov eax, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [ebp - 0x84], ax
call edi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x41f00b
cmp dword [ebp - 0x18], eax
jne 0x41f2f7
movups xmm0, xmmword [ebp - 0x84]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x18], edx
movups xmmword [ebp - 0xec], xmm0
test eax, eax
jne 0x41f031
xor edi, edi
mov dword [ebp + 8], edi
jmp 0x41f04b
push eax
call edi
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x41f314
movups xmm0, xmmword [ebp - 0xec]
mov edx, dword [ebp - 0x18]
movups xmm1, xmmword [ebp - 0xdc]
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
sub esp, 0x10
mov byte [ebp - 4], 0x33
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm1
mov eax, esp
sub esp, 0x10
movups xmm1, xmmword [ebp - 0xcc]
movups xmmword [eax], xmm1
mov eax, esp
push 6
push dword [ebp - 0x1c]
push edi
push edx
movups xmmword [eax], xmm0
call dword [ecx + 0x44]
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp + 0xc]
or edi, 0xffffffff
mov byte [ebp - 4], 0x30
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f0bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 8], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0x2d
jge 0x41f16e
test eax, eax
je 0x41f0f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x41f105
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41f116
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41f127
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41f138
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41f149
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41f15a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jmp 0x41eb87
test eax, eax
je 0x41f178
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x41f189
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41f19a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41f1ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41f1bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41f1cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41f1de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x41f1f7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x41f208
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41f219
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x41f22a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41f23b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x41f24c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x41f25d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x41f26e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41f282
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x88]
push str.Computer_Z
call fcn.0041f430
mov dword [ebp - 0x74], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push eax
call fcn.004031c0
mov eax, 0xa
mov dword [ebp - 0x7c], 0x8007000e
push 0x8007000e
mov word [ebp - 0x84], ax
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
int3