Function at 0x41e250
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5b88
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
push esi
push edi
mov eax, dword [0x4e43e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
push 0
mov dword [ebp - 0x74], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x41e2a8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x4c1efc
push 1
push 0
push 0x4c747c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41e436
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xa8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0xa8], xmm0
call esi
movups xmm0, xmmword [ebp - 0xa8]
lea eax, [ebp - 0x98]
push eax
movups xmmword [ebp - 0xcc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
call esi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0xbc]
push eax
movups xmmword [ebp - 0xdc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xbc], xmm0
call esi
movups xmm0, xmmword [ebp - 0xbc]
lea eax, [ebp - 0x84]
push eax
movups xmmword [ebp - 0xec], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x84], xmm0
call esi
movups xmm0, xmmword [ebp - 0xcc]
mov eax, dword [ebp - 0x14]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 4
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xdc]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xec]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x84]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call edi
lea eax, [ebp - 0xbc]
push eax
call edi
lea eax, [ebp - 0x98]
push eax
call edi
lea eax, [ebp - 0xa8]
push eax
call edi
test esi, esi
js 0x41e436
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x14]
push 0x4bc670
mov byte [ebp - 4], 5
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41f2f5
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
push esi
push edi
mov byte [ebp - 4], 6
call dword [eax + 0x1c]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x41e453
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x41e436
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41f2d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41f2d9
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 7
test eax, eax
jne 0x41e46f
xor esi, esi
mov dword [ebp - 0x38], esi
jmp 0x41e484
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call eax
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x41f2f5
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push esi
push edi
mov byte [ebp - 4], 8
call dword [eax + 0x34]
push esi
mov edi, eax
mov byte [ebp - 4], 7
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x41e734
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41e734
mov dword [ebp - 0x68], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x68]
push edx
push eax
mov byte [ebp - 4], 9
call dword [ecx + 0x4c]
test eax, eax
js 0x41e723
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x41e712
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x5c]
push edx
push 1
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x20]
test eax, eax
js 0x41e701
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x50]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x41e701
cmp dword [ebp - 0x50], 0
jne 0x41e701
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x54]
call fcn.0041dac0
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x41e6f3
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4bc6f0
call edi
mov esi, eax
mov dword [ebp - 0xac], esi
test esi, esi
je 0x41f2f5
push 0x4bc6f0
mov byte [ebp - 4], 0xd
call edi
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41f2ff
mov eax, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4bc6f0
mov byte [ebp - 4], 0xe
call eax
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41f309
mov ecx, dword [ebp + 0xc]
push esi
mov byte [ebp - 4], 0xf
call fcn.0041f360
test eax, eax
jne 0x41e5d2
mov ecx, dword [ebp + 0xc]
push edi
lea ecx, [ecx + 4]
call fcn.0041f360
test eax, eax
jne 0x41e5d2
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x58]
lea ecx, [ecx + 8]
call fcn.0041f360
test eax, eax
je 0x41e661
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0041db10
mov edx, dword [ebp - 0x18]
push dword [eax]
mov byte [ebp - 4], 0x10
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
push dword [ebp - 0x10]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call fcn.0041db10
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x11
push edx
mov ecx, dword [edx]
call dword [ecx + 0x3c]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0041db10
mov edx, dword [ebp - 0x10]
push dword [eax]
mov byte [ebp - 4], 0x12
push edx
mov ecx, dword [edx]
call dword [ecx + 0x34]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x41e6db
cmp word [ebp - 0x38], 0xffff
je 0x41e68b
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41e6b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41e6c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 9
test eax, eax
je 0x41e6d3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
jmp 0x41f27e
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41e701
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41e712
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 9
test eax, eax
je 0x41e723
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 7
test eax, eax
je 0x41e734
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x41e745
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x41e759
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41f2f5
mov eax, dword [edi]
push 0
push esi
push edi
mov byte [ebp - 4], 0x13
call dword [eax + 0x3c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x24]
test eax, eax
jns 0x41e7b8
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x41e79e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x41e425
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e425
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41e7cc
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov eax, dword [ebp - 0x2c]
jns 0x41e7fb
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41e78d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e78d
cmp word [0x4e7f00], 0
mov dword [ebp - 0x50], eax
jne 0x41e81e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e7f00
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e7f00
lea ecx, [ebp - 0x38]
call fcn.00406da0
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x16
test eax, eax
jne 0x41e884
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x50]
push esi
push ecx
mov byte [ebp - 4], 0x17
mov eax, dword [ecx]
call dword [eax + 0x28]
push esi
call edi
mov edx, dword [ebp - 0x38]
or edi, 0xffffffff
mov byte [ebp - 4], 0x15
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e86d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x41e89a
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x41e8b1
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41f313
jmp 0x41e83b
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41f2f5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push esi
push ecx
mov byte [ebp - 4], 0x18
call dword [eax + 0x20]
push esi
mov byte [ebp - 4], 0x15
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41e8db
mov dword [ebp - 0x2c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x41e922
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x41e908
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41e78d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e78d
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x3c]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x1a
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x28]
mov esi, eax
test edx, edx
je 0x41e955
mov dword [ebp - 0x28], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
test esi, esi
jns 0x41e97d
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41e96d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test edx, edx
je 0x41e908
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x41e908
xor ecx, ecx
mov dword [ebp - 0x30], ecx
test eax, eax
je 0x41e9a7
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push 0x4c1e04
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x30]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x3c]
cmovs ecx, edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 0x1b
test ecx, ecx
je 0x41e95c
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov eax, dword [ebp - 0x30]
push str.Trigger1
mov dword [ebp - 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x41f2f5
mov ecx, dword [ebp - 0x10]
push esi
push ecx
mov byte [ebp - 4], 0x1c
mov eax, dword [ecx]
call dword [eax + 0x24]
push esi
mov byte [ebp - 4], 0x1b
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp word [0x4e8100], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
jne 0x41ea15
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e8100
push 2
call sub.Secur32.dll_GetUserNameExW
push 0x4e8100
lea ecx, [ebp - 0x38]
call fcn.00406da0
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x1d
test eax, eax
jne 0x41eb52
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x50]
push esi
push ecx
mov byte [ebp - 4], 0x1e
mov eax, dword [ecx]
call dword [eax + 0x5c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x38]
mov eax, edi
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ea69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4e7d74]
test al, 1
jne 0x41eaa8
or eax, 1
mov dword [0x4e7d74], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x4ba3c0
mov dword [0x4e7d68], 0x4bc678
mov dword [0x4e7d6c], eax
mov byte [0x4e7d70], 0
call fcn.0042a250
mov eax, dword [0x4e7d74]
add esp, 4
test al, 2
jne 0x41eb04
or eax, 2
mov dword [0x4e7d78], 0x4bc690
mov dword [0x4e7d74], eax
xor eax, eax
push 0x4ba3f0
mov dword [0x4e7d7c], 0x4e7d68
mov dword [0x4e7d8c], 2
mov dword [0x4e7d84], 0
mov dword [0x4e7d88], 0
mov dword [0x4e7d90], eax
mov dword [0x4e7d80], 0x4e7d78
call fcn.0042a250
add esp, 4
mov eax, dword [0x4e7d78]
mov ecx, 0x4e7d78
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x3c
mov byte [ebp - 4], 0x1f
mov eax, dword [eax + 0x10]
cdq
idiv ecx
push edx
push eax
lea eax, [ebp - 0x38]
push str.PT_dM_dS
push eax
call fcn.0040a940
mov esi, dword [ebp - 0x38]
add esp, 0x10
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
test esi, esi
jne 0x41eb6b
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x41eb82
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41f31d
jmp 0x41ea36
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x41f2f5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x20
call dword [eax + 0x54]
push edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x1f
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x41ebaf
mov dword [ebp - 0x30], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0x10], 0
jge 0x41ebfc
or eax, 0xffffffff
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41ebd1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x41ebe2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41e8f7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41e8f7
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x41ec2b
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41ebb5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41ebb5
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x4c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x22
call dword [ecx + 0x30]
mov edx, dword [ebp - 0x34]
mov edi, eax
test edx, edx
je 0x41ec5e
mov dword [ebp - 0x34], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
test edi, edi
jns 0x41ec8d
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41ec76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test edx, edx
je 0x41ebb5
mov eax, dword [edx]
push edx
call dword [eax + 8]
jmp 0x41ebb5
xor edi, edi
mov dword [ebp - 0x44], edi
test eax, eax
je 0x41ecb7
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push 0x4c1df4
push eax
call dword [ecx]
mov edi, dword [ebp - 0x44]
xor ecx, ecx
mov edx, dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0x4c]
cmovs edi, ecx
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0x23
test edi, edi
je 0x41ec65
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x41eccd
mov dword [ebp - 0x58], eax
jmp 0x41ecdf
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41f2f5
mov ecx, dword [edi]
push eax
push edi
mov byte [ebp - 4], 0x24
call dword [ecx + 0x2c]
push dword [ebp - 0x58]
mov byte [ebp - 4], 0x23
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
test eax, eax
jne 0x41ed0e
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x41ed25
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x41f2f5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x25
call dword [eax + 0x3c]
push edi
mov byte [ebp - 4], 0x23
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 8]
test eax, eax
jne 0x41ed52
xor edi, edi
mov dword [ebp + 0xc], edi
jmp 0x41ed69
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp + 0xc], edi
test edi, edi
je 0x41f2f5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push edi
push ecx
mov byte [ebp - 4], 0x26
call dword [eax + 0x34]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0x27
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
mov eax, dword [ebp - 0x48]
jns 0x41edd3
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41eda8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41edb9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41ec18
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41ec18
cmp word [0x4e7f00], 0
mov dword [ebp - 0x50], eax
jne 0x41edf6
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e7f00
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e7f00
lea ecx, [ebp + 0xc]
call fcn.00406da0
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x28
test eax, eax
jne 0x41eed6
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x50]
push edi
push ecx
mov byte [ebp - 4], 0x29
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
mov byte [ebp - 4], 0x27
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ee4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
push str.BUILTINAdministrators
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41f2f5
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov byte [ebp - 4], 0x2a
mov eax, dword [ecx]
call dword [eax + 0x40]
push edi
mov byte [ebp - 4], 0x27
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x48]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x41eea1
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
mov eax, dword [ebp - 0x40]
jns 0x41eeef
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41eece
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
jmp 0x41ed9a
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x41f327
jmp 0x41ee17
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x40]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x40]
push str.PT0S
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x41f2f5
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov byte [ebp - 4], 0x2c
mov eax, dword [ecx]
call dword [eax + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x60]
push edx
push eax
mov byte [ebp - 4], 0x2d
mov ecx, dword [eax]
call dword [ecx + 0x9c]
test eax, eax
js 0x41ef6a
mov eax, dword [ebp - 0x60]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x41ef7e
mov dword [ebp - 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x6c], 0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x98]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x98], xmm0
call edi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0xa8]
push eax
movups xmmword [ebp - 0xdc], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa8], xmm0
call edi
cmp word [0x4e7f00], 0
movups xmm0, xmmword [ebp - 0xa8]
mov byte [ebp - 4], 0x30
movups xmmword [ebp - 0xcc], xmm0
jne 0x41eff1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4e7f00
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4e7f00
lea ecx, [ebp + 0xc]
call fcn.00406da0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x18], edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x41f331
mov eax, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [ebp - 0x84], ax
call edi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x41f04b
cmp dword [ebp - 0x18], eax
jne 0x41f337
movups xmm0, xmmword [ebp - 0x84]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x18], edx
movups xmmword [ebp - 0xec], xmm0
test eax, eax
jne 0x41f071
xor edi, edi
mov dword [ebp + 8], edi
jmp 0x41f08b
push eax
call edi
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x41f354
movups xmm0, xmmword [ebp - 0xec]
mov edx, dword [ebp - 0x18]
movups xmm1, xmmword [ebp - 0xdc]
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
sub esp, 0x10
mov byte [ebp - 4], 0x33
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm1
mov eax, esp
sub esp, 0x10
movups xmm1, xmmword [ebp - 0xcc]
movups xmmword [eax], xmm1
mov eax, esp
push 6
push dword [ebp - 0x1c]
push edi
push edx
movups xmmword [eax], xmm0
call dword [ecx + 0x44]
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp + 0xc]
or edi, 0xffffffff
mov byte [ebp - 4], 0x30
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f0ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 8], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0x2d
jge 0x41f1ae
test eax, eax
je 0x41f134
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x41f145
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41f156
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41f167
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41f178
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41f189
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41f19a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jmp 0x41ebc7
test eax, eax
je 0x41f1b8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x41f1c9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x41f1da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x41f1eb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x22
test eax, eax
je 0x41f1fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x41f20d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x41f21e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x41f237
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x41f248
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x41f259
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x41f26a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x41f27b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x41f28c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
test eax, eax
je 0x41f29d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
test eax, eax
je 0x41f2ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41f2c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x88]
push str.Computer_Z
call fcn.0041f470
mov dword [ebp - 0x74], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
push eax
call fcn.004031c0
mov eax, 0xa
mov dword [ebp - 0x7c], 0x8007000e
push 0x8007000e
mov word [ebp - 0x84], ax
call fcn.004031c0
push 0x8007000e
call fcn.004031c0
int3