Function at 0x526c70
Capabilities:
Encode data using base64
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585a15
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x410
mov eax, dword [0x5e8024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38c], edx
mov esi, ecx
mov eax, dword [ebx + 8]
lea edx, [ecx + 2]
mov dword [ebp - 0x388], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x344], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x354], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x358], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x35c], eax
xor eax, eax
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x526d40
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2b8]
call fcn.004082a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.0052a470
mov dword [ebp - 0x390], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x390]
push eax
push 0x5934bc
push 1
push 0
push 0x59351c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x5290bc
mov esi, dword [ebp - 0x390]
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2a0]
movups xmm0, xmmword [ebp - 0x378]
push eax
movups xmmword [ebp - 0x3c0], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 5
lea eax, [ebp - 0x260]
movups xmm0, xmmword [ebp - 0x2a0]
push eax
movups xmmword [ebp - 0x288], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 6
lea eax, [ebp - 0x3a0]
movups xmm0, xmmword [ebp - 0x260]
push eax
movups xmmword [ebp - 0x270], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 7
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x3c0]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x288]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x270]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x3a0]
push esi
movups xmmword [eax], xmm0
call edi
mov edi, eax
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x3a0]
push eax
call esi
mov byte [ebp - 4], 5
lea eax, [ebp - 0x260]
push eax
call esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2a0]
push eax
call esi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x378]
push eax
call esi
test edi, edi
js 0x5290bc
mov dword [ebp - 0x3a4], 0
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x390]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
mov dword [ebp - 0x320], eax
add esp, 4
mov dword [ebp - 0x32c], edi
mov byte [ebp - 4], 0xb
test edi, edi
je 0x526f01
push 0x59a78c
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x529115
jmp 0x526f09
xor edi, edi
mov dword [ebp - 0x320], edi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x330], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x3a4]
push eax
push dword [edi]
push esi
call dword [ebp - 0x324]
mov edi, eax
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x320]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x526f7b
mov eax, dword [esi]
test eax, eax
je 0x526f59
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x526f70
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x330], 0
test edi, edi
js 0x5290a5
mov esi, dword [ebp - 0x3a4]
cmp dword [ebp - 0x2a4], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x2b8]
cmovae eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x320], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x32c], edi
mov byte [ebp - 4], 0xf
test edi, edi
je 0x527000
push dword [ebp - 0x320]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x527002
cmp dword [ebp - 0x320], eax
jne 0x529115
jmp 0x527002
xor edi, edi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x330], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x10
push 0
push dword [edi]
push esi
call dword [ebp - 0x324]
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x527067
mov eax, dword [edi]
test eax, eax
je 0x527045
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x52705c
push eax
call fcn.0052e812
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x350], 0
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x350]
mov eax, dword [ebp - 0x390]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edi, eax
test edi, edi
js 0x52908e
mov dword [ebp - 0x3a8], 0
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 0x350]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
js 0x529077
mov esi, dword [ebp - 0x3a8]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x320], edi
mov dword [ebp - 0x32c], edi
mov byte [ebp - 4], 0x1c
test edi, edi
je 0x527128
push dword [ebp - 0x3ac]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x527130
cmp dword [ebp - 0x3ac], eax
jne 0x529115
jmp 0x527130
xor edi, edi
mov dword [ebp - 0x320], edi
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x330], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x1d
push dword [edi]
push esi
call dword [ebp - 0x324]
mov edi, eax
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0x320]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x52719b
mov eax, dword [esi]
test eax, eax
je 0x527179
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x527190
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x330], 0
test edi, edi
js 0x529077
mov esi, dword [ebp - 0x3a8]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x320], edi
mov dword [ebp - 0x32c], edi
mov byte [ebp - 4], 0x22
test edi, edi
je 0x52720c
push dword [ebp - 0x354]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x527214
cmp dword [ebp - 0x354], eax
jne 0x529115
jmp 0x527214
xor edi, edi
mov dword [ebp - 0x320], edi
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x330], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x23
push dword [edi]
push esi
call dword [ebp - 0x324]
mov edi, eax
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0x320]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x52727f
mov eax, dword [esi]
test eax, eax
je 0x52725d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x527274
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x330], 0
test edi, edi
js 0x529077
mov dword [ebp - 0x34c], 0
mov byte [ebp - 4], 0x29
lea edx, [ebp - 0x34c]
mov eax, dword [ebp - 0x350]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edi, eax
test edi, edi
js 0x529060
mov eax, dword [ebp - 0x34c]
mov edx, dword [ebp - 0x35c]
mov ecx, dword [eax]
push dword [edx]
push eax
call dword [ecx + 0x38]
mov edi, eax
test edi, edi
js 0x529060
mov eax, dword [ebp - 0x34c]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov eax, dword [ebp - 0x34c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x34c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
push 3
xor eax, eax
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 0
push 0x5a5cd8
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.004082a0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x2e8]
cmp dword [ebp - 0x2d4], 8
cmovae ecx, dword [ebp - 0x2e8]
cmp dword [ebp - 0x2d8], 3
jne 0x527399
push 3
mov edx, 0x5ab910
call fcn.00407970
add esp, 4
test eax, eax
jne 0x527399
mov eax, dword [ebp - 0x34c]
push 6
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov dword [ebp - 0x320], 0
mov byte [ebp - 4], 0x36
lea edx, [ebp - 0x320]
mov eax, dword [ebp - 0x350]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edi, eax
test edi, edi
js 0x52903d
mov eax, dword [ebp - 0x320]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov edi, eax
test edi, edi
js 0x52903d
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x5273f0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x340], 0
mov byte [ebp - 4], 0x45
lea edx, [ebp - 0x340]
mov eax, dword [ebp - 0x350]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edi, eax
test edi, edi
js 0x52902e
mov ecx, dword [ebp - 0x358]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x32c], ecx
cmp eax, ecx
je 0x52849b
nop word [eax + eax]
mov dword [ebp - 0x328], 0
mov byte [ebp - 4], 0x4d
mov eax, dword [eax]
dec eax
mov byte [ebp - 0x319], 0
cmp eax, 0xc
ja case.default.0x527461
jmp dword [eax*4 + 0x52912c]
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x354], 0
mov byte [ebp - 4], 0x56
lea edx, [ebp - 0x354]
mov eax, dword [ebp - 0x328]
push edx
push 0x5934ac
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x52858f
mov eax, dword [ebp - 0x354]
mov edi, dword [ebp - 0x33c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
movzx ecx, word [edi + 4]
push ecx
push eax
call edx
mov byte [ebp - 0x319], 1
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x354]
jmp 0x527e32
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x37c], 0
mov byte [ebp - 4], 0x68
lea edx, [ebp - 0x37c]
mov eax, dword [ebp - 0x328]
push edx
push 0x59350c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x5285ac
mov eax, dword [ebp - 0x37c]
mov edi, dword [ebp - 0x33c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x5c]
movzx ecx, word [edi + 4]
push ecx
push eax
call edx
mov eax, dword [ebp - 0x37c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
movzx ecx, word [edi + 0xc]
push ecx
push eax
call edx
mov byte [ebp - 0x319], 1
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x37c]
jmp 0x527e32
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x380], 0
mov byte [ebp - 4], 0x7a
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 0x328]
push edx
push 0x5934fc
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x5285c9
mov eax, dword [ebp - 0x380]
mov edx, 1
mov edi, dword [ebp - 0x33c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, dword [edi + 4]
dec ecx
shl edx, cl
push edx
push eax
call esi
mov eax, dword [ebp - 0x380]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x5c]
movzx ecx, word [edi + 0xc]
push ecx
push eax
call edx
mov byte [ebp - 0x319], 1
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x380]
jmp 0x527e32
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 5
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x364], 0
mov byte [ebp - 4], 0x8c
lea edx, [ebp - 0x364]
mov eax, dword [ebp - 0x328]
push edx
push 0x5934dc
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x5285e6
mov eax, dword [ebp - 0x364]
mov edx, 1
mov edi, dword [ebp - 0x33c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, dword [edi + 4]
shl dx, cl
movzx ecx, dx
push ecx
push eax
call esi
mov eax, dword [ebp - 0x364]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x64]
movzx ecx, word [edi + 0xc]
push ecx
push eax
call edx
mov eax, dword [ebp - 0x364]
mov edx, 1
mov ecx, dword [eax]
mov esi, dword [ecx + 0x5c]
mov ecx, dword [edi + 8]
dec ecx
shl dx, cl
movzx ecx, dx
push ecx
push eax
call esi
mov byte [ebp - 0x319], 1
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x364]
jmp 0x527e32
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 6
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x358], 0
mov byte [ebp - 4], 0x9e
lea edx, [ebp - 0x358]
mov eax, dword [ebp - 0x34c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x9c]
mov edi, eax
test edi, edi
js 0x528621
push 2
xor eax, eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x268], 0
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], 0
push 0x5ab908
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
call fcn.004082a0
mov byte [ebp - 4], 0xa7
mov edi, dword [ebp - 0x33c]
movzx ecx, word [edi + 4]
mov byte [ebp - 4], 0xa8
lea edx, [ebp - 0x220]
call fcn.004a9cd0
xor eax, eax
mov dword [ebp - 0x318], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 7
mov word [ebp - 0x318], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5277c0
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x318]
call fcn.004082a0
mov esi, dword [ebp - 0x334]
lea eax, [ebp - 0x318]
or esi, 4
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x334], esi
cmp dword [ebp - 0x304], 8
push dword [ebp - 0x308]
cmovae eax, dword [ebp - 0x318]
push eax
call fcn.00408c60
and esi, 0xfffffffb
mov dword [ebp - 0x334], esi
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x318]
call fcn.00408570
push 1
push 0x598470
lea ecx, [ebp - 0x278]
call fcn.00408c60
mov esi, dword [ebp - 0x358]
cmp dword [ebp - 0x264], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x278]
cmovae eax, dword [ebp - 0x278]
mov dword [ebp - 0x330], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x414], edi
mov byte [ebp - 4], 0xa9
test edi, edi
je 0x5278ba
push dword [ebp - 0x330]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x5278c2
cmp dword [ebp - 0x330], eax
jne 0x529115
jmp 0x5278c2
xor edi, edi
mov dword [ebp - 0x324], edi
mov byte [ebp - 4], 0xa7
mov dword [ebp - 0x3e8], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0xaa
push dword [edi]
push esi
call dword [ebp - 0x338]
mov edi, eax
mov byte [ebp - 4], 0xa7
mov esi, dword [ebp - 0x324]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x52792d
mov eax, dword [esi]
test eax, eax
je 0x52790b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x527922
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x3e8], 0
test edi, edi
js 0x528612
push 5
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x224], 0
push str.PT60M
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
call fcn.004082a0
mov byte [ebp - 4], 0xb3
mov esi, dword [ebp - 0x358]
cmp dword [ebp - 0x224], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x410], edi
mov byte [ebp - 4], 0xb4
test edi, edi
je 0x527a09
push dword [ebp - 0x324]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x527a11
cmp dword [ebp - 0x324], eax
jne 0x529115
jmp 0x527a11
xor edi, edi
mov dword [ebp - 0x330], edi
mov byte [ebp - 4], 0xb3
mov dword [ebp - 0x3d4], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0xb5
push dword [edi]
push esi
call dword [ebp - 0x338]
mov edi, eax
mov byte [ebp - 4], 0xb3
mov esi, dword [ebp - 0x330]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x527a7c
mov eax, dword [esi]
test eax, eax
je 0x527a5a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x527a71
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x3d4], 0
test edi, edi
js 0x528603
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x238]
call fcn.00408570
mov byte [ebp - 4], 0x9e
lea ecx, [ebp - 0x278]
call fcn.00408570
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x358]
jmp 0x527e32
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 8
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
jmp case.default.0x527461
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
jmp case.default.0x527461
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x320], 0
mov byte [ebp - 4], 0xd5
lea edx, [ebp - 0x320]
mov eax, dword [ebp - 0x328]
push edx
push 0x5934ec
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x528637
mov esi, dword [ebp - 0x320]
mov edi, dword [ebp - 0x33c]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x338], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x418], edi
mov byte [ebp - 4], 0xde
test edi, edi
je 0x527bbf
push dword [ebp - 0x324]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x527bc7
cmp dword [ebp - 0x324], eax
jne 0x529115
jmp 0x527bc7
xor edi, edi
mov dword [ebp - 0x330], edi
mov byte [ebp - 4], 0xd5
mov dword [ebp - 0x3d8], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0xdf
push dword [edi]
push esi
call dword [ebp - 0x338]
mov edi, eax
mov byte [ebp - 4], 0xd5
mov esi, dword [ebp - 0x330]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x527c32
mov eax, dword [esi]
test eax, eax
je 0x527c10
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x527c27
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x3d8], 0
test edi, edi
js 0x528637
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x320]
jmp 0x527e32
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
jmp case.default.0x527461
mov eax, dword [ebp - 0x340]
lea edx, [ebp - 0x328]
push edx
push 0xb
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x52868d
mov dword [ebp - 0x35c], 0
mov byte [ebp - 4], 0xf8
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 0x328]
push edx
push 0x5934cc
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x52864d
mov esi, dword [ebp - 0x35c]
mov edi, dword [ebp - 0x33c]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x338], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x41c], edi
mov dword [ebp - 4], 0x101
test edi, edi
je 0x527d36
push dword [ebp - 0x324]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x527d3e
cmp dword [ebp - 0x324], eax
jne 0x529115
jmp 0x527d3e
xor edi, edi
mov dword [ebp - 0x330], edi
mov dword [ebp - 4], 0xf8
mov dword [ebp - 0x3dc], edi
test edi, edi
je 0x529115
mov dword [ebp - 4], 0x102
push dword [edi]
push esi
call dword [ebp - 0x338]
mov edi, eax
mov dword [ebp - 4], 0xf8
mov esi, dword [ebp - 0x330]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x527db2
mov eax, dword [esi]
test eax, eax
je 0x527d90
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x527da7
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x3dc], 0
test edi, edi
js 0x52864d
mov ecx, dword [ebp - 0x33c]
xor edx, edx
mov eax, dword [ecx]
add eax, 0xfffffff6
cmp eax, 3
ja case.default.0x527dd6
jmp dword [eax*4 + 0x529160]
mov edx, dword [ecx + 0x18]
shr edx, 0x11
not edx
and edx, 2
or edx, 1
jmp case.default.0x527dd6
mov edx, dword [ecx + 0x18]
and edx, 0x40000
neg edx
sbb edx, edx
and edx, 0xfffffffe
add edx, 4
jmp case.default.0x527dd6
mov edx, 7
jmp case.default.0x527dd6
mov edx, 8
mov eax, dword [ebp - 0x35c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edi, eax
test edi, edi
js 0x52864d
mov dword [ebp - 4], 0x4d
mov eax, dword [ebp - 0x35c]
test eax, eax
je case.default.0x527461
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x33c]
cmp dword [eax + 0x14], 0
je 0x5282e7
mov dword [ebp - 0x360], 0
mov dword [ebp - 4], 0x115
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 0x328]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
js 0x528666
push 2
xor eax, eax
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2c0], 0
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2bc], 0
push 0x5ab908
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 7
mov word [ebp - 0x2d0], ax
call fcn.004082a0
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x33c]
mov ecx, dword [eax + 0x14]
mov byte [ebp - 4], 0x1f
lea edx, [ebp - 0x220]
call fcn.004a9cd0
xor eax, eax
mov dword [ebp - 0x300], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 7
mov word [ebp - 0x300], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x527f27
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x300]
call fcn.004082a0
or dword [ebp - 0x334], 8
lea eax, [ebp - 0x300]
cmp dword [ebp - 0x2ec], 8
lea ecx, [ebp - 0x2d0]
push dword [ebp - 0x2f0]
cmovae eax, dword [ebp - 0x300]
push eax
call fcn.00408c60
and dword [ebp - 0x334], 0xfffffff7
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x300]
call fcn.00408570
push 1
push 0x598470
lea ecx, [ebp - 0x2d0]
call fcn.00408c60
mov esi, dword [ebp - 0x360]
cmp dword [ebp - 0x2bc], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x2d0]
cmovae eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x40c], edi
mov byte [ebp - 4], 0x20
test edi, edi
je 0x528011
push dword [ebp - 0x324]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x528013
cmp dword [ebp - 0x324], eax
jne 0x529115
jmp 0x528013
xor edi, edi
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x3e0], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x21
push dword [edi]
push esi
call dword [ebp - 0x338]
mov byte [ebp - 4], 0x1e
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x528076
mov eax, dword [edi]
test eax, eax
je 0x528054
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x52806b
push eax
call fcn.0052e812
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0052df65
add esp, 8
mov esi, dword [ebp - 0x33c]
mov dword [ebp - 0x3e0], 0
cmp dword [esi + 0x10], 0
je 0x5282a5
push 2
xor eax, eax
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x280], 0
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], 0
push 0x5ab908
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
call fcn.004082a0
mov byte [ebp - 4], 0x22
mov ecx, dword [esi + 0x10]
mov byte [ebp - 4], 0x23
lea edx, [ebp - 0x220]
call fcn.004a9cd0
xor eax, eax
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x528137
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.004082a0
or dword [ebp - 0x334], 0x10
lea eax, [ebp - 0x250]
cmp dword [ebp - 0x23c], 8
lea ecx, [ebp - 0x290]
push dword [ebp - 0x240]
cmovae eax, dword [ebp - 0x250]
push eax
call fcn.00408c60
and dword [ebp - 0x334], 0xffffffef
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x250]
call fcn.00408570
push 1
push 0x598470
lea ecx, [ebp - 0x290]
call fcn.00408c60
mov esi, dword [ebp - 0x360]
cmp dword [ebp - 0x27c], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x290]
cmovae eax, dword [ebp - 0x290]
mov dword [ebp - 0x324], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x3b4], edi
mov byte [ebp - 4], 0x24
test edi, edi
je 0x528221
push dword [ebp - 0x324]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x528223
cmp dword [ebp - 0x324], eax
jne 0x529115
jmp 0x528223
xor edi, edi
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x3e4], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x25
push dword [edi]
push esi
call dword [ebp - 0x338]
mov byte [ebp - 4], 0x22
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x528286
mov eax, dword [edi]
test eax, eax
je 0x528264
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x52827b
push eax
call fcn.0052e812
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x3e4], 0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x290]
call fcn.00408570
mov esi, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x360]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
mov ecx, dword [esi + 0x18]
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
push ecx
push eax
call edx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x2d0]
call fcn.00408570
mov dword [ebp - 4], 0x4d
mov eax, dword [ebp - 0x360]
test eax, eax
je 0x5282e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x2a0]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x2a0], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x33c]
xorps xmm0, xmm0
movzx edx, word [ebp - 0x29a]
movzx ecx, word [ebp - 0x29e]
movups xmmword [ebp - 0x260], xmm0
movzx edi, word [eax + 0x1c]
mov eax, edi
mov word [ebp - 0x25e], cx
movzx ecx, word [ebp - 0x298]
mov si, di
shr eax, 5
and eax, 0x3f
shr si, 0xb
movups xmmword [ebp - 0x3a0], xmm0
mov word [ebp - 0x396], ax
movzx eax, word [ebp - 0x2a0]
mov word [ebp - 0x25a], dx
mov dl, byte [ebp - 0x319]
mov word [ebp - 0x260], ax
test dl, dl
movzx eax, si
cmovne ecx, eax
mov word [ebp - 0x398], si
mov eax, dword [ebp - 0x398]
mov word [ebp - 0x258], cx
movzx ecx, word [ebp - 0x296]
shr eax, 0x10
test dl, dl
movsd qword [ebp - 0x374], xmm0
cmovne ecx, eax
mov dword [ebp - 0x36c], 0
and edi, 0x1f
mov word [ebp - 0x256], cx
movzx ecx, word [ebp - 0x294]
add edi, edi
test dl, dl
movzx eax, di
lea edx, [ebp - 0x374]
cmovne ecx, eax
mov word [ebp - 0x254], cx
lea ecx, [ebp - 0x260]
call fcn.005298b0
neg eax
push ecx
sbb eax, eax
lea ecx, [ebp - 0x374]
inc eax
mov dword [ebp - 0x36c], eax
lea eax, [ebp - 0x348]
push eax
call fcn.00529510
mov dword [ebp - 4], 0x127
mov eax, dword [eax]
test eax, eax
jne 0x52840b
xor esi, esi
mov dword [ebp - 0x3b0], esi
jmp 0x528422
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x3b0], esi
test esi, esi
je 0x529105
mov byte [ebp - 4], 0x29
or eax, 0xffffffff
mov edx, dword [ebp - 0x348]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x528444
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x328]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edi, eax
test edi, edi
js 0x52867f
mov dword [ebp - 4], 0x4d
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0x45
mov eax, dword [ebp - 0x328]
test eax, eax
je 0x528480
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x33c]
add eax, 0x24
mov dword [ebp - 0x33c], eax
cmp eax, dword [ebp - 0x32c]
jne 0x527440
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 4], 0x134
lea edx, [ebp - 0x3c4]
mov eax, dword [ebp - 0x350]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edi, eax
test edi, edi
js 0x529017
mov dword [ebp - 0x3c8], 0
mov byte [ebp - 4], 0x3d
lea edx, [ebp - 0x3c8]
mov eax, dword [ebp - 0x3c4]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edi, eax
test edi, edi
js 0x529003
mov dword [ebp - 0x384], 0
mov byte [ebp - 4], 0x47
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 0x3c8]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x528fef
mov esi, dword [ebp - 0x384]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x32c], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x3b4], edi
mov byte [ebp - 4], 0x51
test edi, edi
je 0x52869f
push dword [ebp - 0x38c]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x5286a7
cmp dword [ebp - 0x38c], eax
jne 0x529115
jmp 0x5286a7
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x37c]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x380]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x364]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x238]
call fcn.00408570
mov byte [ebp - 4], 0x9e
lea ecx, [ebp - 0x278]
call fcn.00408570
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x358]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov dword [ebp - 4], 0x4d
mov eax, dword [ebp - 0x35c]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov dword [ebp - 4], 0x4d
mov eax, dword [ebp - 0x360]
test eax, eax
je 0x52868d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x52868d
mov dword [ebp - 4], 0x4d
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0x45
mov eax, dword [ebp - 0x328]
jmp 0x529024
xor edi, edi
mov dword [ebp - 0x324], edi
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x348], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x52
push dword [edi]
push esi
call dword [ebp - 0x32c]
mov edi, eax
mov byte [ebp - 4], 0x47
mov esi, dword [ebp - 0x324]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x528712
mov eax, dword [esi]
test eax, eax
je 0x5286f0
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x528707
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x348], 0
test edi, edi
js 0x528fef
mov esi, dword [ebp - 0x384]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x32c], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x38c], edi
mov dword [ebp - 0x3b4], edi
mov byte [ebp - 4], 0x5c
test edi, edi
je 0x528783
push dword [ebp - 0x388]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x52878b
cmp dword [ebp - 0x388], eax
jne 0x529115
jmp 0x52878b
xor edi, edi
mov dword [ebp - 0x38c], edi
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x348], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x5d
push dword [edi]
push esi
call dword [ebp - 0x32c]
mov edi, eax
mov byte [ebp - 4], 0x47
mov esi, dword [ebp - 0x38c]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x5287f6
mov eax, dword [esi]
test eax, eax
je 0x5287d4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x5287eb
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x348], 0
test edi, edi
js 0x528fef
mov esi, dword [ebp - 0x384]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x32c], eax
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x388], edi
mov dword [ebp - 0x3b4], edi
mov byte [ebp - 4], 0x67
test edi, edi
je 0x528867
push dword [ebp - 0x3d0]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x52886f
cmp dword [ebp - 0x3d0], eax
jne 0x529115
jmp 0x52886f
xor edi, edi
mov dword [ebp - 0x388], edi
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x348], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x68
push dword [edi]
push esi
call dword [ebp - 0x32c]
mov edi, eax
mov byte [ebp - 4], 0x47
mov esi, dword [ebp - 0x388]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x5288da
mov eax, dword [esi]
test eax, eax
je 0x5288b8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x5288cf
push eax
call fcn.0052e812
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x348], 0
test edi, edi
js 0x528fef
mov edi, dword [ebp - 0x3ac]
mov eax, 8
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
mov word [ebp - 0x408], ax
call esi
mov dword [ebp - 0x400], eax
test eax, eax
jne 0x528919
test edi, edi
jne 0x529115
mov byte [ebp - 4], 0x72
mov eax, 8
push dword [ebp - 0x344]
mov word [ebp - 0x3f8], ax
call esi
mov dword [ebp - 0x3f0], eax
test eax, eax
jne 0x528947
cmp dword [ebp - 0x344], eax
jne 0x529115
mov byte [ebp - 4], 0x73
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x240], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x528990
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x250]
call fcn.004082a0
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x344]
mov esi, dword [ebp - 0x334]
lea eax, [ebp - 0x250]
or esi, 1
mov dword [ebp - 0x334], esi
cmp dword [ebp - 0x23c], 8
push ecx
cmovae eax, dword [ebp - 0x250]
push 1
push eax
push 0
mov dword [ebp - 0x344], 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupGetInfo]
test eax, eax
jne 0x528a0e
push dword [ebp - 0x344]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov dword [ebp - 0x320], 4
jmp 0x528c3e
mov ecx, edi
mov dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
lea edx, [ecx + 2]
mov word [ebp - 0x238], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x528a50
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x238]
call fcn.004082a0
mov dword [ebp - 4], 0x175
or esi, 2
mov dword [ebp - 0x334], esi
lea eax, [ebp - 0x320]
push dword [ebp - 0x3b4]
lea edx, [ebp - 0x32c]
mov dword [ebp - 0x320], 0
lea ecx, [ebp - 0x3b8]
mov dword [ebp - 0x32c], eax
call fcn.0052a700
add esp, 4
mov dword [ebp - 4], 0x176
mov dword [ebp - 0x374], 0x59a564
mov dword [ebp - 0x370], 0
mov byte [ebp - 4], 0x77
mov ecx, str.Advapi32.dll
mov dword [ebp - 0x36c], 0
call fcn.00457d30
mov ecx, dword [ebp - 0x370]
mov esi, eax
cmp esi, ecx
je 0x528b02
mov edx, dword [ebp - 0x374]
lea ecx, [ebp - 0x374]
call dword [edx + 4]
mov dword [ebp - 0x370], esi
mov ecx, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ecx, ecx
jne 0x528b14
call edi
mov dword [ebp - 0x36c], eax
mov byte [ebp - 4], 0x78
lea esi, [ebp - 0x238]
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x370]
cmovae esi, dword [ebp - 0x238]
test eax, eax
je 0x528bfc
push str.ConvertStringSidToSidW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x528bf4
lea ecx, [ebp - 0x320]
push ecx
push esi
call eax
test eax, eax
je 0x528bfc
mov ecx, dword [ebp - 0x320]
lea edx, [ebp - 0x344]
mov dword [ebp - 0x344], 7
call fcn.0052a780
test al, al
jne 0x528b84
jmp 0x528bfc
mov eax, dword [ebp - 0x344]
cmp eax, 4
je 0x528ba0
cmp eax, 2
je 0x528ba0
mov byte [ebp - 0x319], 0
cmp eax, 5
jne 0x528ba7
mov byte [ebp - 0x319], 1
mov byte [ebp - 4], 0x76
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x374], 0x59a564
test eax, eax
je 0x528bd0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x370], 0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x3b8]
call fcn.0052a680
cmp byte [ebp - 0x319], 0
je 0x528c34
mov dword [ebp - 0x320], 4
jmp 0x528c3e
call edi
mov dword [ebp - 0x36c], eax
mov byte [ebp - 4], 0x76
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x374], 0x59a564
test eax, eax
je 0x528c25
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x370], 0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x3b8]
call fcn.0052a680
mov dword [ebp - 0x320], 3
mov dword [ebp - 4], 0x174
mov eax, dword [ebp - 0x334]
test al, 2
je 0x528c69
and eax, 0xfffffffd
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x334], eax
call fcn.00408570
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0x173
test al, 1
je 0x528c88
and eax, 0xfffffffe
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x334], eax
call fcn.00408570
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x7c
lea eax, [ebp - 0x3a0]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push eax
lea eax, [ebp - 0x3f8]
push eax
call esi
test eax, eax
js 0x52910f
mov byte [ebp - 4], 0x73
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, dword [ebp - 0x3ac]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
lea edx, [ecx + 2]
mov word [ebp - 0x238], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x528d10
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x238]
call fcn.004082a0
mov byte [ebp - 4], 0x7d
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x528d6d
cmp dword [ebp - 0x224], 8
lea ecx, [ebp - 0x238]
cmovae ecx, dword [ebp - 0x238]
cmp eax, 6
jne 0x528e01
push eax
mov edx, 0x5a05d4
call fcn.00407970
add esp, 4
test eax, eax
jne 0x528e01
mov eax, 8
mov dword [ebp - 0x320], 5
push 0x5a05d4
mov word [ebp - 0x3a0], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x398], eax
test eax, eax
je 0x529115
mov byte [ebp - 4], 0x7e
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
test eax, eax
js 0x52911f
mov byte [ebp - 4], 0x7d
lea eax, [ebp - 0x3a0]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call edi
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x7f
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x3f8]
push eax
call esi
test eax, eax
js 0x529125
mov byte [ebp - 4], 0x7d
lea eax, [ebp - 0x3a0]
push eax
call edi
mov dword [ebp - 0x3cc], 0
mov byte [ebp - 4], 0x81
mov esi, dword [ebp - 0x3a4]
push 0x593988
mov eax, dword [esi]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x348], eax
mov eax, 8
mov word [ebp - 0x3a0], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x398], eax
test eax, eax
je 0x529115
mov byte [ebp - 4], 0x82
movups xmm0, xmmword [ebp - 0x3a0]
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x2a4], 8
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x2b8]
movups xmm0, xmmword [ebp - 0x3f8]
cmovae eax, dword [ebp - 0x2b8]
push 0xc
movups xmmword [ebp - 0x288], xmm0
mov dword [ebp - 0x344], eax
movups xmm0, xmmword [ebp - 0x408]
movups xmmword [ebp - 0x260], xmm0
call fcn.0052df96
mov edi, eax
add esp, 4
mov dword [ebp - 0x3b4], edi
mov byte [ebp - 4], 0x83
test edi, edi
je 0x528ee1
push dword [ebp - 0x344]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x528ee3
cmp dword [ebp - 0x344], eax
jne 0x529115
jmp 0x528ee3
xor edi, edi
mov byte [ebp - 4], 0x82
mov dword [ebp - 0x3b0], edi
test edi, edi
je 0x529115
mov byte [ebp - 4], 0x84
lea eax, [ebp - 0x3cc]
movups xmm0, xmmword [ebp - 0x270]
push eax
sub esp, 0x10
mov eax, esp
push dword [ebp - 0x320]
movups xmmword [eax], xmm0
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x288]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x260]
push 6
push dword [ebp - 0x32c]
movups xmmword [eax], xmm0
push dword [edi]
push esi
call dword [ebp - 0x348]
mov esi, eax
mov byte [ebp - 4], 0x82
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x528f8a
mov ecx, dword [edi]
test ecx, ecx
je 0x528f68
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x528f7f
push eax
call fcn.0052e812
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0052df65
add esp, 8
mov dword [ebp - 0x3b0], 0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edi, edi
test esi, esi
cmovs edi, esi
mov byte [ebp - 4], 0x7d
mov eax, dword [ebp - 0x3cc]
test eax, eax
je 0x528fc0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x238]
call fcn.00408570
mov byte [ebp - 4], 0x72
lea eax, [ebp - 0x3f8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call esi
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x408]
push eax
call esi
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x384]
test eax, eax
je 0x529003
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x529017
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x45
mov eax, dword [ebp - 0x3c4]
test eax, eax
je 0x52902e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x34
mov eax, dword [ebp - 0x340]
jmp 0x529047
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x529051
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x2e8]
call fcn.00408570
mov dword [ebp - 4], 0x17
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x529077
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x12
mov eax, dword [ebp - 0x3a8]
test eax, eax
je 0x52908e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x350]
test eax, eax
je 0x5290a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3a4]
test eax, eax
je 0x5290bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x390]
test ecx, ecx
je 0x5290d3
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.00408570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052df57
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x8007000e
call fcn.00409a00
push eax
call fcn.0052bee0
push 0x8007000e
call fcn.0052bee0
push eax
call fcn.0052bee0
push eax
call fcn.0052bee0
nop
push 0xe5005274
je 5411205
add byte [ebp + 0x75], dh
push edx
add byte [esi + esi*2], cl
push edx
add byte [ebx - 0x20ffad86], bh
jp 0x529195
add ah, al
jbe 0x529199
add byte [ebx], al
jnp 0x52919d
add byte [ebx + 0x7c], dl
push edx
add byte [edi + 0x7c], dh
push edx
add byte [edi + 0x7c], dh
push edx
add byte [edi + 0x7c], dh
push edx
add byte [edi + 0x7c], dh
push edx
add ch, bl
jge 0x5291b5
add ch, ch
jge 0x5291b9
add byte [edx], al
jle 0x5291bd
add byte [ecx], cl
jle 0x5291c1
add byte [ebx - 0x75], dl
fadd qword [ebx - 0x1b7cf714]
clc
in al, dx
add byte [eax], al
sbb byte [esi], 0x33
lds ecx, [ecx + 0x5756ec45]
add byte [eax], al
add bh, al
inc ebp
in al, 0
add byte [eax], al
add byte [ebp + 0x45c70271], cl
call 0x5291cd
add byte [eax], al