Function at 0x4058b0
Capabilities:
Query environment variable
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fcbb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x200
mov eax, dword [0x4a337c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x124], ecx
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40668f
lea eax, [ebp - 0x170]
mov dword [ebp - 0x170], 0
push eax
push 0x4946c0
push 1
push 0
push 0x4946e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x406689
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x1e0]
push eax
call esi
movups xmm0, xmmword [ebp - 0x1e0]
lea eax, [ebp - 0x1f0]
push eax
movups xmmword [ebp - 0x200], xmm0
call esi
movups xmm0, xmmword [ebp - 0x1f0]
lea eax, [ebp - 0x1c8]
push eax
movups xmmword [ebp - 0x210], xmm0
call esi
movups xmm0, xmmword [ebp - 0x1c8]
lea eax, [ebp - 0x1b8]
push eax
movups xmmword [ebp - 0x140], xmm0
call esi
mov byte [ebp - 4], 4
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x200]
mov ecx, dword [ebp - 0x170]
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x210]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x140]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x1b8]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x1b8]
push eax
call edi
lea eax, [ebp - 0x1c8]
push eax
call edi
lea eax, [ebp - 0x1f0]
push eax
call edi
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 0
push eax
call edi
test esi, esi
js 0x40667d
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x49f150]
movups xmmword [ebp - 0x16c], xmm0
mov dword [ebp - 0x178], 0
mov edi, dword [eax]
movaps xmm0, xmmword [0x49f130]
movups xmmword [ebp - 0x15c], xmm0
mov dword [ebp - 0x14c], 0xffdac50b
mov eax, dword [edi + 0x1f4]
mov dword [ebp - 0x148], 0x5ae719d4
mov word [ebp - 0x144], 0xf045
mov byte [ebp - 0x142], 0xbf
mov dword [ebp - 0x1cc], edi
test al, 1
jne 0x405ace
or eax, 1
mov dword [edi + 0x1f4], eax
mov byte [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c0], xmm0
mov edx, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x1c0]
mov byte [edi + 0x1db], 1
mov al, byte [ebp + ecx - 0x16c]
mov byte [edi + ecx + 0x1b0], al
add ecx, 1
adc edx, 0
jne 0x405abd
cmp ecx, 0x2b
jb 0x405aa2
push 0x4800d0
call fcn.0045aba7
add esp, 4
mov byte [ebp - 4], 0
cmp byte [edi + 0x1db], 0
lea eax, [edi + 0x1b0]
mov dword [ebp - 0x1a4], eax
je 0x405b41
mov edi, dword [ebp - 0x1a4]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a8], eax
mov ecx, esi
mov eax, 0x8fbf972b
and ecx, 7
mov edx, 0x33936bbb
shl ecx, 3
call fcn.0047f4b0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x1a8], 0
jne 0x405b31
cmp esi, 0x2b
jb 0x405b06
mov eax, dword [ebp - 0x1a4]
mov byte [edi + 0x2b], 0
mov edi, dword [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00405320
mov byte [ebp - 4], 6
mov eax, dword [eax]
test eax, eax
je 0x405b5b
mov edx, dword [eax]
jmp 0x405b5d
xor edx, edx
mov eax, dword [ebp - 0x170]
lea esi, [ebp - 0x178]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x1bc]
mov dword [ebp - 0x1a4], eax
test esi, esi
je 0x405bcf
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x405bcf
test esi, esi
je 0x405bcf
mov eax, dword [esi]
test eax, eax
je 0x405ba7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405bbe
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
mov eax, dword [ebp - 0x1a4]
add esp, 8
test eax, eax
jns 0x405c71
push 0x49f0a0
lea ecx, [ebp - 0x1bc]
call fcn.00405320
mov byte [ebp - 4], 7
mov eax, dword [eax]
test eax, eax
je 0x405bf5
mov edx, dword [eax]
jmp 0x405bf7
xor edx, edx
mov eax, dword [ebp - 0x170]
lea esi, [ebp - 0x178]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x1bc]
mov dword [ebp - 0x1a4], eax
test esi, esi
je 0x405c69
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x405c69
test esi, esi
je 0x405c69
mov eax, dword [esi]
test eax, eax
je 0x405c41
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405c58
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
mov eax, dword [ebp - 0x1a4]
add esp, 8
test eax, eax
js 0x40667d
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x174]
push edx
mov dword [ebp - 0x174], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x406671
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x180]
mov dword [ebp - 0x180], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x406665
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x184]
push edx
mov dword [ebp - 0x184], 0
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x406659
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x17c]
push edx
mov dword [ebp - 0x17c], 0
push 0x4946d0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x40664d
push str.Trigger1
lea ecx, [ebp - 0x1bc]
call fcn.00405320
mov byte [ebp - 4], 8
mov edx, dword [eax]
test edx, edx
je 0x405d2b
mov edx, dword [edx]
jmp 0x405d2d
xor edx, edx
mov eax, dword [ebp - 0x17c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x1bc]
test esi, esi
je 0x405d8c
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405d8c
test esi, esi
je 0x405d8c
mov eax, dword [esi]
test eax, eax
je 0x405d6a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405d81
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
movaps xmm0, xmmword [0x49f0e0]
mov eax, dword [edi + 0x23c]
mov dword [ebp - 0x130], 0x83c54dbf
movups xmmword [ebp - 0x140], xmm0
test al, 1
jne 0x405e0c
or eax, 1
mov dword [edi + 0x23c], eax
mov byte [ebp - 4], 9
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b0]
mov byte [edi + 0x254], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x140]
mov byte [edi + ecx + 0x240], al
add ecx, 1
adc edx, 0
jne 0x405dfb
cmp ecx, 0x14
jb 0x405de0
push 0x480090
call fcn.0045aba7
add esp, 4
mov byte [ebp - 4], 0
cmp byte [edi + 0x254], 0
lea eax, [edi + 0x240]
mov dword [ebp - 0x1a8], eax
je 0x405e7f
mov edi, dword [ebp - 0x1a8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a4], eax
mov ecx, esi
mov eax, 0x83f57d85
and ecx, 7
mov edx, 0x3d39cd17
shl ecx, 3
call fcn.0047f4b0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x1a4], 0
jne 0x405e6f
cmp esi, 0x14
jb 0x405e44
mov eax, dword [ebp - 0x1a8]
mov byte [edi + 0x14], 0
mov edi, dword [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00405320
mov byte [ebp - 4], 0xa
mov edx, dword [eax]
test edx, edx
je 0x405e99
mov edx, dword [edx]
jmp 0x405e9b
xor edx, edx
mov eax, dword [ebp - 0x17c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x1bc]
test esi, esi
je 0x405efa
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x405efa
test esi, esi
je 0x405efa
mov eax, dword [esi]
test eax, eax
je 0x405ed8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405eef
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
movaps xmm0, xmmword [0x49f1d0]
mov eax, dword [edi + 0x1e8]
mov dword [ebp - 0x130], 0x6f4c68eb
movups xmmword [ebp - 0x140], xmm0
test al, 1
jne 0x405f7c
or eax, 1
mov dword [edi + 0x1e8], eax
mov byte [ebp - 4], 0xb
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b0]
mov byte [edi + 0x26c], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x140]
mov byte [edi + ecx + 0x258], al
add ecx, 1
adc edx, 0
jne 0x405f6b
cmp ecx, 0x14
jb 0x405f50
push 0x480050
call fcn.0045aba7
add esp, 4
mov byte [ebp - 4], 0
cmp byte [edi + 0x26c], 0
lea eax, [edi + 0x258]
mov dword [ebp - 0x1a8], eax
je 0x405fef
mov edi, dword [ebp - 0x1a8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a4], eax
mov ecx, esi
mov eax, 0x6f755dd1
and ecx, 7
mov edx, 0xdb3147b5
shl ecx, 3
call fcn.0047f4b0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x1a4], 0
jne 0x405fdf
cmp esi, 0x14
jb 0x405fb4
mov eax, dword [ebp - 0x1a8]
mov byte [edi + 0x14], 0
mov edi, dword [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00405320
mov byte [ebp - 4], 0xc
mov edx, dword [eax]
test edx, edx
je 0x406009
mov edx, dword [edx]
jmp 0x40600b
xor edx, edx
mov eax, dword [ebp - 0x17c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x1bc]
test esi, esi
je 0x40606a
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x40606a
test esi, esi
je 0x40606a
mov eax, dword [esi]
test eax, eax
je 0x406048
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40605f
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x19c]
mov dword [ebp - 0x19c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x406641
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
lea ecx, [ebp - 0x1bc]
cmovae eax, dword [ebx + 8]
push eax
call fcn.00405320
mov byte [ebp - 4], 0xd
mov edx, dword [eax]
test edx, edx
je 0x4060b4
mov edx, dword [edx]
jmp 0x4060b6
xor edx, edx
mov eax, dword [ebp - 0x19c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x1bc]
test esi, esi
je 0x406115
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x406115
test esi, esi
je 0x406115
mov eax, dword [esi]
test eax, eax
je 0x4060f3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40610a
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x406641
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x18c]
push edx
mov dword [ebp - 0x18c], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
test eax, eax
js 0x406635
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x190]
push edx
mov dword [ebp - 0x190], 0
push str.MbLk
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x406629
push 0x104
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x124]
call fcn.00405320
mov byte [ebp - 4], 0xe
mov edx, dword [eax]
test edx, edx
je 0x4061c2
mov edx, dword [edx]
jmp 0x4061c4
xor edx, edx
mov eax, dword [ebp - 0x190]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x124]
test esi, esi
je 0x406223
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x406223
test esi, esi
je 0x406223
mov eax, dword [esi]
test eax, eax
je 0x406201
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x406218
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
mov eax, dword [edi + 0x238]
mov dword [ebp - 0x128], 0xeb50922a
mov dword [ebp - 0x124], 0x39929ce2
test al, 1
jne 0x40629c
or eax, 1
mov dword [edi + 0x238], eax
mov byte [ebp - 4], 0xf
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b0]
mov byte [edi + 0x1e4], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x128]
mov byte [edi + ecx + 0x1dc], al
add ecx, 1
adc edx, 0
jne 0x40628b
cmp ecx, 8
jb 0x406270
push 0x480010
call fcn.0045aba7
add esp, 4
mov byte [ebp - 4], 0
cmp byte [edi + 0x1e4], 0
lea eax, [edi + 0x1dc]
mov dword [ebp - 0x1a8], eax
je 0x40630f
mov edi, dword [ebp - 0x1a8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a4], eax
mov ecx, esi
mov eax, 0x8333bf07
and ecx, 7
mov edx, 0x39f9ff87
shl ecx, 3
call fcn.0047f4b0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x1a4], 0
jne 0x4062ff
cmp esi, 8
jb 0x4062d4
mov eax, dword [ebp - 0x1a8]
mov byte [edi + 8], 0
mov edi, dword [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x124]
call fcn.00405320
mov byte [ebp - 4], 0x10
mov edx, dword [eax]
test edx, edx
je 0x406329
mov edx, dword [edx]
jmp 0x40632b
xor edx, edx
mov eax, dword [ebp - 0x190]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x124]
test esi, esi
je 0x40638a
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x40638a
test esi, esi
je 0x40638a
mov eax, dword [esi]
test eax, eax
je 0x406368
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40637f
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x194]
mov dword [ebp - 0x194], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x406665
mov eax, dword [ebp - 0x194]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x174]
push dword [ebp - 0x194]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
test eax, eax
jns 0x4063de
mov eax, dword [ebp - 0x194]
jmp 0x40665f
mov eax, 8
mov dword [ebp - 0x198], 0
push 0x49f0b0
mov word [ebp - 0x1c8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x1c0], eax
test eax, eax
je 0x406815
movups xmm0, xmmword [ebp - 0x1c8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x1f0]
push eax
movups xmmword [ebp - 0x140], xmm0
call esi
movups xmm0, xmmword [ebp - 0x1f0]
lea eax, [ebp - 0x1e0]
push eax
movups xmmword [ebp - 0x210], xmm0
call esi
mov byte [ebp - 4], 0x13
movups xmm0, xmmword [ebp - 0x1e0]
mov eax, dword [edi + 0x270]
mov dword [ebp - 0x128], 0xd447b6c0
mov word [ebp - 0x124], 0x768a
mov byte [ebp - 0x122], 0x2f
movups xmmword [ebp - 0x200], xmm0
test al, 1
jne 0x4064ce
or eax, 1
mov dword [edi + 0x270], eax
mov byte [ebp - 4], 0x14
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b0]
mov byte [edi + 0x1f3], 1
mov al, byte [ebp + ecx - 0x128]
mov byte [edi + ecx + 0x1ec], al
add ecx, 1
adc edx, 0
jne 0x4064bd
cmp ecx, 7
jb 0x4064a2
push 0x47ffd0
call fcn.0045aba7
add esp, 4
mov byte [ebp - 4], 0x13
cmp byte [edi + 0x1f3], 0
lea edi, [edi + 0x1ec]
je 0x40652f
xorps xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a4], eax
nop word [eax + eax]
mov ecx, esi
mov eax, 0xb529d78d
and ecx, 7
mov edx, 0xc52f13ed
shl ecx, 3
call fcn.0047f4b0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x1a4], 0
jne 0x40652b
cmp esi, 7
jb 0x406500
mov byte [edi + 7], 0
push edi
lea ecx, [ebp - 0x1a8]
call fcn.00405320
mov byte [ebp - 4], 0x15
mov eax, dword [eax]
test eax, eax
je 0x406549
mov esi, dword [eax]
jmp 0x40654b
xor esi, esi
movups xmm0, xmmword [ebp - 0x140]
mov ecx, dword [ebp - 0x178]
lea eax, [ebp - 0x198]
push eax
sub esp, 0x10
mov eax, esp
mov edx, dword [ecx]
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x210]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x200]
push 6
push dword [ebp - 0x174]
movups xmmword [eax], xmm0
push esi
push ecx
call dword [edx + 0x44]
mov esi, dword [ebp - 0x1a8]
mov edi, eax
test esi, esi
je 0x4065f0
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4065e6
test esi, esi
je 0x4065e6
mov eax, dword [esi]
test eax, eax
je 0x4065c4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4065db
push eax
call fcn.0045aac4
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0045aaf9
add esp, 8
mov dword [ebp - 0x1a8], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x1e0]
push eax
call esi
lea eax, [ebp - 0x1f0]
push eax
call esi
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0
push eax
call esi
test edi, edi
jns 0x4066cb
mov eax, dword [ebp - 0x190]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x188]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x184]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x180]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x174]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x170]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 1
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x4067f5
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4067eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40681f
jmp 0x4067eb
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1a0], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1a0]
mov ecx, dword [ebp - 0x198]
movups xmm0, xmmword [ebp - 0x1e0]
push eax
sub esp, 0x10
mov edx, dword [ecx]
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x30]
mov esi, eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0x1e0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x198]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jns 0x406772
mov eax, dword [ebp - 0x19c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x184]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x180]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x188]
jmp 0x40665f
mov eax, dword [ebp - 0x190]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x188]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x184]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x180]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x174]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x170]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
jmp 0x406694
push edx
push ecx
call fcn.0045aaf9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045aab3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x8007000e
call fcn.0045a740
call fcn.004603b9
int3