Function at 0x4a81d0
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e85ed
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
push 0x510324
push 1
push 0
push 0x51500c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x4a83d4
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x24]
push eax
call ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0xb0]
push eax
call ebx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0xa0]
push eax
call ebx
mov eax, dword [ebp - 0x94]
mov esi, dword [ebp - 0xa0]
mov edi, dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x98]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, dword [ebp - 0x34]
sub esp, 0x10
mov ecx, esp
mov eax, dword [ebp - 0x38]
sub esp, 0x10
mov byte [ebp - 4], 5
mov dword [ecx], edx
mov edx, dword [ebp - 0x74]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x78]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0xc], edx
mov ecx, esp
mov edx, dword [ebp - 0x80]
sub esp, 0x10
mov dword [ecx], edx
mov edx, dword [ebp - 0x84]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x88]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x8c]
mov dword [ecx + 0xc], edx
mov ecx, esp
mov edx, dword [ebp - 0x64]
sub esp, 0x10
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edx
mov edx, esp
mov ecx, dword [ebp - 0xc4]
push eax
mov eax, dword [eax]
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc0]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [edx + 0xc], ecx
call dword [eax + 0x28]
mov esi, eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xc4]
push eax
call edi
lea eax, [ebp - 0xa0]
push eax
call edi
lea eax, [ebp - 0xb0]
push eax
call edi
lea eax, [ebp - 0x24]
push eax
call edi
test esi, esi
js 0x4a83d4
mov dword [ebp - 0x40], 0
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
push 0x4f0efc
mov byte [ebp - 4], 6
call fcn.004a5210
mov eax, dword [eax]
mov byte [ebp - 4], 7
test eax, eax
je 0x4a83a4
mov ecx, dword [eax]
jmp 0x4a83a6
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x40]
push edx
push ecx
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 6
mov esi, eax
call fcn.004a5510
test esi, esi
jns 0x4a83f1
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 1
test eax, eax
je 0x4a83d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x4a9598
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
jmp 0x4a9598
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp - 0x54]
jne 0x4a840a
push dword [ebp - 0x6c]
mov ecx, ebx
call fcn.004a5ea0
mov esi, eax
test esi, esi
js 0x4a83c3
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 8
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
jns 0x4a843d
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 6
test eax, eax
je 0x4a83c3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a83c3
cmp dword [ebx + 0xf4], 0
je 0x4a84e3
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x34]
push edx
push eax
mov byte [ebp - 4], 9
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov esi, eax
test esi, esi
jns 0x4a847b
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a842a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a842a
mov eax, dword [ebx + 0xf4]
sub eax, 1
jne 0x4a84d2
mov eax, dword [ebp - 0x34]
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov esi, eax
test esi, esi
js 0x4a8468
mov esi, dword [ebp - 0x34]
lea eax, [ebx + 0xf8]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x4a84bb
mov ecx, dword [eax]
jmp 0x4a84bd
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x40]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004a5510
test esi, esi
js 0x4a8468
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a84e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x4c]
push edx
push eax
mov byte [ebp - 4], 0xb
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x4a8509
mov eax, dword [ebp - 0x4c]
jmp 0x4a846b
mov esi, dword [ebp - 0x4c]
lea eax, [ebx + 0x74]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x4a852a
mov ecx, dword [eax]
jmp 0x4a852c
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x28]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xb
mov esi, eax
call fcn.004a5510
test esi, esi
jns 0x4a854d
mov eax, dword [ebp - 0x4c]
jmp 0x4a846b
mov esi, dword [ebp - 0x4c]
lea eax, [ebx + 0xa4]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x4a8571
mov ecx, dword [eax]
jmp 0x4a8573
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x20]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004a5510
test esi, esi
jns 0x4a8590
mov eax, dword [ebp - 0x4c]
jmp 0x4a846b
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xe
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
jns 0x4a85c7
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4a85bf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
jmp 0x4a846b
mov dword [ebp - 0x44], 0
mov eax, dword [ebx + 0x28]
dec eax
mov byte [ebp - 4], 0xf
cmp eax, 4
ja case.default.0x4a85df
jmp dword [eax*4 + 0x4a95b8]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x4a860e
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x4a85ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a85ae
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x54]
push edx
push 0x510354
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x10
call dword [ecx]
mov esi, eax
test esi, esi
jns 0x4a8643
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4a85fb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a85fb
cmp word [ebx], 0
je 0x4a86df
mov esi, dword [ebp - 0x54]
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x11
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x12
test eax, eax
je 0x4a867c
mov ecx, dword [eax]
jmp 0x4a867e
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x3c]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x4a86d5
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a86cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a86cb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
jne 0x4a8630
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4a8e48
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a8e48
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x2d], 0
push eax
call fcn.004aa2b0
add esp, 4
test eax, eax
js 0x4a89bb
cmp byte [ebp - 0x2d], 0
je 0x4a89bb
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
js 0x4a85fb
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x34]
push edx
push 0x510354
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x13
call dword [ecx]
mov esi, eax
test esi, esi
jns 0x4a875e
mov eax, dword [ebp - 0x34]
jmp 0x4a8633
cmp word [ebx], 0
je 0x4a87fe
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x14
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4a8797
mov ecx, dword [eax]
jmp 0x4a8799
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x3c]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x13
cmp edx, 8
jb 0x4a87f0
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a87e6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a87e6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
je 0x4a87fe
mov eax, dword [ebp - 0x34]
jmp 0x4a8633
cmp word [ebx + 0x10], 0
lea eax, [ebx + 0x10]
je 0x4a88a2
mov esi, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x16
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x17
test eax, eax
je 0x4a883b
mov ecx, dword [eax]
jmp 0x4a883d
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x44]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x13
cmp edx, 8
jb 0x4a8894
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a888a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a888a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
je 0x4a88a2
mov eax, dword [ebp - 0x34]
jmp 0x4a8633
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x54]
push edx
push eax
mov byte [ebp - 4], 0x18
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x4a88d9
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4a88d1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
jmp 0x4a8633
push dword [ebx + 0x20]
mov esi, dword [ebp - 0x54]
lea eax, [ebp - 0x2c]
push eax
call fcn.004aa0e0
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x19
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x4a890a
mov ecx, dword [eax]
jmp 0x4a890c
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x20]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x18
cmp edx, 8
jb 0x4a8963
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8959
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a8959
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
jne 0x4a88c0
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x54]
push 0
push eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x54]
test esi, esi
js 0x4a88c7
test eax, eax
je 0x4a89a1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4a8e48
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a8e48
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
js 0x4a85fb
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x34]
push edx
push 0x510364
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x1c
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4a88d1
cmp word [ebx], 0
je 0x4a8a96
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1d
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x1e
test eax, eax
je 0x4a8a33
mov ecx, dword [eax]
jmp 0x4a8a35
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x3c]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x1c
cmp edx, 8
jb 0x4a8a8c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8a82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a8a82
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
jne 0x4a88d1
cmp word [ebx + 0x10], 0
lea eax, [ebx + 0x10]
je 0x4a8b36
mov esi, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1f
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x20
test eax, eax
je 0x4a8ad3
mov ecx, dword [eax]
jmp 0x4a8ad5
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x44]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x1c
cmp edx, 8
jb 0x4a8b2c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8b22
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a8b22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
jne 0x4a88d1
mov eax, dword [ebp - 0x34]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov esi, eax
test esi, esi
js 0x4a88d1
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x54]
push edx
push eax
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x4a8b72
mov byte [ebp - 4], 0x1c
jmp 0x4a88c4
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4a8c14
mov esi, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004aa0e0
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x22
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x4a8bac
mov ecx, dword [eax]
jmp 0x4a8bae
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x28]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x21
cmp edx, 8
jb 0x4a8c05
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8bfb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a8bfb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
je 0x4a8c14
mov byte [ebp - 4], 0x1c
jmp 0x4a88c4
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4a8cb6
mov esi, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004aa0e0
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x24
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x25
test eax, eax
je 0x4a8c4e
mov ecx, dword [eax]
jmp 0x4a8c50
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x20]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x21
cmp edx, 8
jb 0x4a8ca7
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8c9d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a8c9d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
je 0x4a8cb6
mov byte [ebp - 4], 0x1c
jmp 0x4a88c4
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0x1c
jmp 0x4a8997
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
js 0x4a85fb
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x34]
push edx
push 0x510374
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x26
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4a88d1
cmp word [ebx], 0
je 0x4a8d9d
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x27
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x28
test eax, eax
je 0x4a8d3a
mov ecx, dword [eax]
jmp 0x4a8d3c
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x3c]
mov esi, eax
lea ecx, [ebp - 0x50]
test esi, esi
sets byte [ebp - 0x2d]
call fcn.004a5510
mov edx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x26
cmp edx, 8
jb 0x4a8d93
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8d89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a8d89
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x2d], 0
jne 0x4a88d1
cmp word [ebx + 0x10], 0
lea eax, [ebx + 0x10]
je 0x4a8dfd
mov esi, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x29
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x2a
test eax, eax
je 0x4a8dd6
mov ecx, dword [eax]
jmp 0x4a8dd8
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x44]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004a5510
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x26
call fcn.00402d80
test esi, esi
js 0x4a88d1
mov esi, dword [ebp - 0x34]
mov ecx, ebx
push ebx
mov edi, dword [esi]
call fcn.004a9f10
movzx eax, ax
push eax
push esi
call dword [edi + 0x54]
mov esi, eax
mov eax, dword [ebp - 0x34]
test esi, esi
js 0x4a8633
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x5c]
mov esi, eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x34]
test esi, esi
js 0x4a8637
test eax, eax
je 0x4a8e42
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x5c]
push edx
push eax
mov byte [ebp - 4], 0x36
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
jns 0x4a910a
mov eax, dword [ebp - 0x5c]
jmp 0x4a8633
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
js 0x4a85fb
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x34]
push edx
push 0x510384
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x2b
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4a88d1
cmp word [ebx], 0
je 0x4a8f0d
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x2c
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x2d
test eax, eax
je 0x4a8ee6
mov ecx, dword [eax]
jmp 0x4a8ee8
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x3c]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004a5510
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2b
call fcn.00402d80
test esi, esi
js 0x4a88d1
cmp word [ebx + 0x10], 0
lea eax, [ebx + 0x10]
je 0x4a8f6d
mov esi, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x2e
push eax
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x2f
test eax, eax
je 0x4a8f46
mov ecx, dword [eax]
jmp 0x4a8f48
xor ecx, ecx
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x44]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004a5510
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2b
call fcn.00402d80
test esi, esi
js 0x4a88d1
mov eax, dword [ebp - 0x34]
mov edx, 1
movzx ecx, word [ebx + 6]
dec ecx
shl edx, cl
mov esi, dword [eax]
push edx
push eax
call dword [esi + 0x54]
mov esi, eax
mov eax, dword [ebp - 0x34]
test esi, esi
js 0x4a8633
mov ecx, dword [eax]
push 0xfff
push eax
call dword [ecx + 0x5c]
mov esi, eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x34]
test esi, esi
jns 0x4a86e6
jmp 0x4a8637
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
js 0x4a85fb
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x34]
push edx
push 0x510394
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x30
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4a88d1
cmp dword [ebx + 0xcc], 0
je 0x4a903c
mov esi, dword [ebp - 0x34]
lea eax, [ebx + 0xbc]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x50], esi
push eax
call fcn.004aac20
add esp, 8
mov esi, dword [esi]
mov ecx, eax
mov byte [ebp - 4], 0x31
call fcn.004a5620
push eax
push dword [ebp - 0x50]
call dword [esi + 0x5c]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x30
mov esi, eax
call fcn.004a5510
test esi, esi
js 0x4a88d1
lea ecx, [ebx + 0xdc]
call fcn.004aa280
test al, al
je 0x4a90a6
mov eax, dword [ebp - 0x34]
lea ecx, [ebx + 0xdc]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004aa540
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x32
push eax
call fcn.004aac20
add esp, 8
mov esi, dword [ebp - 0x54]
mov ecx, eax
mov byte [ebp - 4], 0x33
mov esi, dword [esi]
call fcn.004a5620
push eax
push dword [ebp - 0x54]
call dword [esi + 0x54]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004a5510
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x30
call fcn.00402d80
test esi, esi
js 0x4a88d1
cmp word [ebx], 0
je 0x4a89a1
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 0x50], esi
call fcn.004a9f50
add esp, 8
push eax
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x34
push eax
call fcn.004aac20
add esp, 8
mov esi, dword [esi]
mov ecx, eax
mov byte [ebp - 4], 0x35
call fcn.004a5620
push eax
push dword [ebp - 0x50]
call dword [esi + 0x3c]
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004a5510
lea ecx, [ebp - 0x2c]
call fcn.00402d80
test esi, esi
jns 0x4a89a1
mov eax, dword [ebp - 0x34]
jmp 0x4a8633
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x60]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x37
call dword [ecx + 0x30]
mov esi, eax
test esi, esi
jns 0x4a9143
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x36
test eax, eax
je 0x4a913b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
jmp 0x4a8633
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x58]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x38
call dword [ecx]
mov esi, eax
test esi, esi
jns 0x4a9178
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0x37
test eax, eax
je 0x4a912a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a912a
mov esi, dword [ebp - 0x58]
lea eax, [ebx + 0x2c]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x50], esi
push eax
call fcn.004aac20
add esp, 8
mov esi, dword [esi]
mov ecx, eax
mov byte [ebp - 4], 0x39
call fcn.004a5620
push eax
push dword [ebp - 0x50]
call dword [esi + 0x2c]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x38
mov esi, eax
call fcn.004a5510
test esi, esi
js 0x4a9165
cmp dword [ebx + 0x6c], 0
je 0x4a91fa
mov esi, dword [ebp - 0x58]
lea eax, [ebx + 0x5c]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x50], esi
push eax
call fcn.004aac20
add esp, 8
mov esi, dword [esi]
mov ecx, eax
mov byte [ebp - 4], 0x3a
call fcn.004a5620
push eax
push dword [ebp - 0x50]
call dword [esi + 0x3c]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x38
mov esi, eax
call fcn.004a5510
test esi, esi
js 0x4a9165
cmp dword [ebx + 0x54], 0
je 0x4a923c
mov esi, dword [ebp - 0x58]
lea eax, [ebx + 0x44]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x50], esi
push eax
call fcn.004aac20
add esp, 8
mov esi, dword [esi]
mov ecx, eax
mov byte [ebp - 4], 0x3b
call fcn.004a5620
push eax
push dword [ebp - 0x50]
call dword [esi + 0x34]
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004a5510
test esi, esi
js 0x4a9165
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x68]
push edx
push eax
mov byte [ebp - 4], 0x3c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
jns 0x4a9274
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 0x38
test eax, eax
je 0x4a9165
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a9165
mov esi, dword [ebp - 0x68]
lea ecx, [ebp - 0x24]
push 0
call fcn.004a52b0
mov ecx, eax
mov byte [ebp - 4], 0x3d
call fcn.004a5630
movzx ecx, ax
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x40]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call edi
test esi, esi
js 0x4a925a
movzx eax, byte [ebx + 0xd5]
lea ecx, [ebp - 0x24]
mov esi, dword [ebp - 0x68]
push eax
call fcn.004a52b0
mov ecx, eax
mov byte [ebp - 4], 0x3e
call fcn.004a5630
movzx ecx, ax
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x24]
push eax
call edi
mov eax, dword [ebp - 0x68]
test esi, esi
js 0x4a925d
mov ecx, dword [eax]
push 4
push eax
call dword [ecx + 0x88]
mov esi, eax
test esi, esi
js 0x4a925a
mov dword [ebp - 0x70], 0
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xa0]
push eax
call ebx
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0xb0]
push eax
call ebx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x24]
push eax
call ebx
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 0x42
call fcn.004aac20
add esp, 8
mov edx, eax
lea eax, [ebp - 0x70]
mov esi, dword [ebx]
push eax
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 0x43
push 3
mov dword [ecx], eax
sub esp, 0x10
mov eax, dword [ebp - 0x64]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [ecx + 0xc], eax
mov eax, esp
mov ecx, dword [ebp - 0x84]
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [ebp - 0x80]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x7c]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x78]
mov dword [eax + 0xc], ecx
mov eax, esp
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x54]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xb4]
push 2
push dword [ebp - 0x3c]
mov dword [eax + 0xc], ecx
mov ecx, edx
call fcn.004a5620
push eax
push ebx
call dword [esi + 0x44]
lea ecx, [ebp - 0x90]
mov esi, eax
call fcn.004a5510
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp - 0xb0]
push eax
call edi
lea eax, [ebp - 0xa0]
push eax
call edi
mov eax, dword [ebp - 0x70]
mov byte [ebp - 4], 0x3c
test esi, esi
jns 0x4a945e
test eax, eax
je 0x4a925a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a925a
test eax, eax
je 0x4a9468
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 0x38
test eax, eax
je 0x4a9479
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0x37
test eax, eax
je 0x4a948a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x36
test eax, eax
je 0x4a949b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4a94ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x4a94bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4a94ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a94df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 6
test eax, eax
je 0x4a94f0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 1
test eax, eax
je 0x4a9584
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a9584
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4a9518
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a9529
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 6
test eax, eax
je 0x4a953a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 1
test eax, eax
je 0x4a954b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4a955f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x4a959a
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4a9598
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret 8