Function at 0x41c710
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1dba
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xf0
push esi
push edi
mov eax, dword [0x4d61d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
push 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x8c], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x41c775
xor eax, eax
jmp 0x41deb6
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1c]
push eax
push 0x4aadc4
push 1
push 0
push 0x4b37fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x41c7d4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov esi, dword [ebp - 0x1c]
xorps xmm0, xmm0
mov eax, dword [esi]
movups xmmword [ebp - 0xc0], xmm0
mov edi, dword [eax + 0x28]
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
lea eax, [ebp - 0xb0]
movups xmm0, xmmword [ebp - 0xc0]
push eax
movups xmmword [ebp - 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xb0], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 4
lea eax, [ebp - 0xd0]
movups xmm0, xmmword [ebp - 0xb0]
push eax
movups xmmword [ebp - 0xf0], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xd0], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 5
lea eax, [ebp - 0xa0]
movups xmm0, xmmword [ebp - 0xd0]
push eax
movups xmmword [ebp - 0x100], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa0], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 6
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xe0]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xf0]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x100]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xa0]
push esi
movups xmmword [eax], xmm0
call edi
mov esi, eax
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xa0]
push eax
call edi
mov byte [ebp - 4], 4
lea eax, [ebp - 0xd0]
push eax
call edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0xb0]
push eax
call edi
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc0]
push eax
call edi
test esi, esi
jns 0x41c90e
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0x1c]
push 0x4a9994
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x60], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41decc
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x28]
push eax
push esi
push edi
call dword [ebp - 0x60]
mov edi, eax
mov byte [ebp - 4], 9
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x41c988
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41c96b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0xe
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebx + 8]
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x50], eax
test ecx, ecx
jne 0x41c9ac
xor esi, esi
mov dword [ebp - 0x60], esi
jmp 0x41c9c4
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push ecx
call eax
mov esi, eax
mov dword [ebp - 0x60], esi
test esi, esi
je 0x41ded6
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x24]
push ecx
push esi
push edi
call eax
mov edi, eax
mov byte [ebp - 4], 0xe
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x41ccc1
cmp dword [ebp - 0x24], 0
je 0x41ccc1
mov dword [ebp - 0x70], 0
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
test eax, eax
js 0x41ccb0
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x41cc9f
mov dword [ebp - 0x64], 0
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x6c]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test eax, eax
js 0x41cc8e
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x78]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x41cc8e
cmp dword [ebp - 0x78], 0
jne 0x41cc8e
push dword [ebp - 0x64]
lea ecx, [ebp - 0x5c]
call fcn.0041bc40
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x5c], 0
je 0x41cc7d
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4a9998
call esi
mov edi, eax
mov dword [ebp - 0x88], edi
test edi, edi
je 0x41dee0
mov byte [ebp - 4], 0x17
push 0x4a9998
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41deea
mov byte [ebp - 4], 0x18
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4a9998
call eax
mov dword [ebp - 0x50], eax
test eax, eax
je 0x41def4
mov byte [ebp - 4], 0x19
mov ecx, dword [ebx + 0xc]
push edi
call fcn.0041dfc0
test eax, eax
jne 0x41cb10
mov ecx, dword [ebx + 0xc]
push esi
lea ecx, [ecx + 4]
call fcn.0041dfc0
test eax, eax
jne 0x41cb10
mov ecx, dword [ebx + 0xc]
push dword [ebp - 0x50]
lea ecx, [ecx + 8]
call fcn.0041dfc0
test eax, eax
je 0x41cba2
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x18]
mov eax, dword [esi]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0xc]
push dword [eax]
call fcn.0041bcb0
mov byte [ebp - 4], 0x1a
push dword [eax]
push esi
call dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x3c]
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
push dword [eax + 4]
call fcn.0041bcb0
mov byte [ebp - 4], 0x1b
push dword [eax]
push esi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x19
push dword [ebp - 0x3c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x3c]
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
push dword [eax + 8]
call fcn.0041bcb0
mov byte [ebp - 4], 0x1c
push dword [eax]
push esi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x19
push dword [ebp - 0x3c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x60]
mov dword [ebp - 0x60], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x41cc5c
cmp word [ebp - 0x60], 0xffff
je 0x41cbd0
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 4], 0x18
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x17
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
mov byte [ebp - 4], 0x16
push edi
call esi
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x41cc02
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x41cc13
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x41cc24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x41cc35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41cc46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41cc57
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41de78
mov byte [ebp - 4], 0x18
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x17
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
mov byte [ebp - 4], 0x16
push edi
call esi
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x41cc8e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x41cc9f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x41ccb0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x41ccc1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x28]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
test eax, eax
jne 0x41cd60
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x2a
push 0
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0xe
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0x2c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x41cd79
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41cd21
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41cd32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41cd43
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41defe
jmp 0x41ccdc
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41cd8d
mov dword [ebp - 0x1c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 0x32
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x41ce0a
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41cdba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41cdcb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41cddc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41cded
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov edi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x74]
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0041e630
mov byte [ebp - 4], 0x38
mov eax, dword [eax]
test eax, eax
jne 0x41cf3f
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x39
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x38
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x32
or eax, 0xffffffff
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ce67
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x30]
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x41cf58
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x3b
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x32
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x41cead
mov dword [ebp - 0x30], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0x3d
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x41cf71
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41cede
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41ceef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41cf00
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41cf11
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41cf22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df08
jmp 0x41ce34
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df12
jmp 0x41ce85
mov dword [ebp - 0x40], 0
mov byte [ebp - 4], 0x45
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x34]
push edx
push 9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x34]
mov esi, eax
test edx, edx
je 0x41cfa1
mov dword [ebp - 0x34], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
test esi, esi
jns 0x41d02c
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41cfba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41cfcb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41cfdc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41cfed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41cffe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d00f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0x4e
test ecx, ecx
je 0x41d059
mov eax, dword [ecx]
lea edx, [ebp - 0x2c]
push edx
push 0x4aad44
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 0x4f
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x41d0fc
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d079
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d08a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d09b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d0ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d0bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d0ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d0df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x4c]
mov edi, dword [ebp - 0x2c]
push str.Trigger1
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x88], esi
test esi, esi
je 0x41df1c
mov byte [ebp - 4], 0x59
push esi
push edi
call dword [ebp - 0x14]
mov byte [ebp - 4], 0x4f
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x5a
cmp word [0x4dbd10], 0
jne 0x41d171
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x100
push eax
push 0x4dbd10
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00406390
mov ecx, eax
test ecx, ecx
je 0x41df26
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x50]
push 0x4dbd10
call fcn.004057b0
test al, al
jne 0x41d1cd
mov ecx, 0x4dbd10
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d1b0
sub ecx, edx
sar ecx, 1
push ecx
push 0x4dbd10
lea ecx, [ebp - 0x50]
call fcn.00406de0
mov byte [ebp - 4], 0x5a
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x7c], 1
test edi, edi
jne 0x41d235
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x5c
push esi
push dword [ebp - 0x18]
call dword [ebp - 0x3c]
mov byte [ebp - 4], 0x5a
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 1
mov dword [ebp - 0x7c], eax
and eax, 0xfffffffe
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 0x4f
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41d224
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00406390
mov ecx, eax
test ecx, ecx
je 0x41df30
jmp 0x41d24b
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df3a
jmp 0x41d1e4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0x5f
mov ecx, 0x3c
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x10]
cdq
idiv ecx
push edx
push eax
lea eax, [ebp - 0x4c]
push str.PT_dM_dS
push eax
call fcn.00405d00
mov edi, dword [ebp - 0x2c]
add esp, 0x10
mov eax, dword [edi]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x41d36a
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x60
push esi
push edi
call dword [ebp - 0x18]
mov edi, eax
mov byte [ebp - 4], 0x5f
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x41d2c2
mov dword [ebp - 0x2c], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
test edi, edi
jns 0x41d383
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d2e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d2f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d309
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d31a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d32b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d33c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d34d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df44
jmp 0x41d298
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0x6b
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x41d454
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41d3b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d3d1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d3e2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d3f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d404
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d415
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d426
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d437
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0x77
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x48]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [ebp - 0x48]
mov esi, eax
test edx, edx
je 0x41d484
mov dword [ebp - 0x48], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
test esi, esi
jns 0x41d54e
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41d49d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41d4ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d4cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d4dc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d4ed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d4fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d50f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d520
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d531
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x38], 0
mov byte [ebp - 4], 0x84
test ecx, ecx
je 0x41d57b
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
push str.MbLk
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x38]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 0x85
mov edi, dword [ebp - 0x38]
test edi, edi
jne 0x41d65d
mov byte [ebp - 4], 0x77
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41d59b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41d5ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41d5bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d5da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d5eb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d5fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d60d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d61e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d62f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d640
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov eax, dword [edi]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x41d7f3
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x93
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x85
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [ebp - 0x38]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 4]
test eax, eax
jne 0x41d80c
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x94
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x85
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [ebp - 0x38]
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
test eax, eax
jne 0x41d825
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x95
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0x85
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0x97
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x41d83e
mov byte [ebp - 4], 0x85
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41d720
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x77
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41d731
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41d742
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41d753
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d770
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d781
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d792
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d7a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d7b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d7c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41d7d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df4e
jmp 0x41d677
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df58
jmp 0x41d6a9
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df62
jmp 0x41d6db
mov edi, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x74]
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0041e630
mov byte [ebp - 4], 0xa6
mov eax, dword [eax]
test eax, eax
jne 0x41d8bf
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xa7
push esi
push edi
call dword [ebp - 0x18]
mov byte [ebp - 4], 0xa6
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x97
or eax, 0xffffffff
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41d897
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x54]
push str.BUILTINAdministrators
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x14], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x88], esi
test esi, esi
je 0x41df6c
jmp 0x41d8d5
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41df76
jmp 0x41d864
mov byte [ebp - 4], 0xa9
push esi
push edi
call dword [ebp - 0x14]
mov byte [ebp - 4], 0x97
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x41d908
mov dword [ebp - 0x38], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 0xab
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x41da1d
mov byte [ebp - 4], 0x97
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x41d939
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x85
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41d94a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x77
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41d95b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41d96c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41d97d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d99a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41d9ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41d9bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41d9cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41d9de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d9ef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41da00
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov eax, dword [ebp - 0x44]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x44]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x44]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edi, dword [ebp - 0x44]
push str.PT0S
mov eax, dword [edi]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x14], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x88], esi
test esi, esi
je 0x41df80
mov byte [ebp - 4], 0xbb
push esi
push edi
call dword [ebp - 0x14]
mov byte [ebp - 4], 0xab
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x68], 0
mov byte [ebp - 4], 0xbd
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0x44]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x9c]
test eax, eax
js 0x41daa2
mov eax, dword [ebp - 0x68]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x41dab6
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x80], 0
mov byte [ebp - 4], 0xbf
xorps xmm0, xmm0
mov edi, dword [ebp - 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [edi]
movups xmmword [ebp - 0xb0], xmm0
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0xb0]
push eax
call esi
mov byte [ebp - 4], 0xc0
lea eax, [ebp - 0xc0]
movups xmm0, xmmword [ebp - 0xb0]
push eax
movups xmmword [ebp - 0xf0], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xc0], xmm0
call esi
mov byte [ebp - 4], 0xc1
lea eax, [ebp - 0x78]
movups xmm0, xmmword [ebp - 0xc0]
mov ecx, dword [ebp - 0x74]
push eax
movups xmmword [ebp - 0xe0], xmm0
call fcn.0041e630
mov byte [ebp - 4], 0xc2
mov esi, dword [eax]
xor eax, eax
mov word [ebp - 0xa0], ax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0x14], esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x41df8a
mov eax, 8
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [ebp - 0xa0], ax
call esi
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x41db77
cmp dword [ebp - 0x14], eax
jne 0x41df90
mov byte [ebp - 4], 0xc3
mov eax, dword [ebp - 0x20]
movups xmm0, xmmword [ebp - 0xa0]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
movups xmmword [ebp - 0x100], xmm0
test eax, eax
jne 0x41db9d
xor esi, esi
mov dword [ebp - 0x14], esi
jmp 0x41dbb4
push eax
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41dfb0
movups xmm0, xmmword [ebp - 0x100]
mov byte [ebp - 4], 0xc4
lea eax, [ebp - 0x80]
movups xmm1, xmmword [ebp - 0xf0]
push eax
sub esp, 0x10
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm1
mov eax, esp
sub esp, 0x10
movups xmm1, xmmword [ebp - 0xe0]
movups xmmword [eax], xmm1
mov eax, esp
push 6
push dword [ebp - 0x18]
push esi
push edi
movups xmmword [eax], xmm0
call dword [ebp - 0x3c]
mov edi, eax
mov byte [ebp - 4], 0xc3
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0xc2
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0xc1
or esi, 0xffffffff
mov edx, dword [ebp - 0x78]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41dc2d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc0
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0xbf
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test edi, edi
jns 0x41dd6e
mov byte [ebp - 4], 0xbd
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x41dc68
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xab
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x41dc79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x97
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x41dc8a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x85
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41dc9b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x77
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41dcac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41dcbd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41dcce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x4c]
call fcn.00404000
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41dceb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41dcfc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41dd0d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41dd1e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41dd2f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41dd40
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41dd51
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41deaa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41deaa
mov byte [ebp - 4], 0xbd
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x41dd7f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xab
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x41dd90
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x97
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x41dda1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x85
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41ddb2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x77
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41ddc3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41ddd4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41dde5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x41de01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41de12
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41de23
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41de34
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x41de45
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41de56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41de67
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41de78
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41de8c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x81]
call fcn.0041c220
mov ecx, dword [ebp - 0x74]
push eax
call fcn.0041e260
mov dword [ebp - 0x8c], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x80004005
call fcn.00405790
push 0x80004005
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push 0x8007000e
call fcn.00405790
push eax
call fcn.00405790
mov eax, 0xa
mov dword [ebp - 0x98], 0x8007000e
push 0x8007000e
mov word [ebp - 0xa0], ax
call fcn.00405790
push 0x8007000e
call fcn.00405790
int3