Function at 0x409430
Capabilities:
Execute vbscript javascript or jscript in memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x41b140]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x5c
mov dword [ebp - 0x28], edx
mov edi, ecx
mov dword [ebp - 0x34], eax
mov dword [0x41b4fc], 0x40e860
mov dword [0x41b4d0], 0x40e8e0
mov dword [0x41b4dc], 0x40e970
mov dword [0x41b500], 0x40e9a0
mov dword [0x41b4e4], 0x40efb0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.0040b7e3
add esp, 4
test eax, eax
je 0x409721
push ecx
mov ecx, eax
call fcn.00408d30
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x409728
push 0x1000
lea ecx, [esi + 0x38]
call fcn.004097b9
mov ebx, eax
test ebx, ebx
js 0x40972d
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov ebx, eax
test ebx, ebx
js 0x40972d
mov edx, 0x402538
lea ecx, [ebp - 0x18]
call fcn.00403e51
test eax, eax
je 0x409542
sub esp, 8
mov ecx, 0x41b640
push 1
call fcn.0040f885
lea ecx, [ebp - 0x20]
call fcn.0040f629
test eax, eax
js 0x409542
cmp dword [ebp - 0x20], 0
je 0x409542
mov eax, dword [0x4026dc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4026e0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4026e4]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4026e8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x24]
push eax
push 0x4020c4
push 0x17
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x40972d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
mov edi, dword [eax]
lea eax, [esi + 0x2c]
mov esi, esp
mov dword [ebp - 0x20], eax
push eax
push 0x4024ac
push ecx
mov ecx, edi
call dword [0x41c348]
call edi
cmp esi, esp
je 0x40958e
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov ecx, dword [ebp - 0x24]
mov esi, esp
mov eax, dword [ecx]
mov edi, dword [eax]
mov eax, dword [ebp - 0x1c]
add eax, 0x30
push eax
push 0x40248c
push ecx
mov ecx, edi
mov dword [ebp - 0x30], eax
call dword [0x41c348]
call edi
cmp esi, esp
je 0x4095c6
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov ecx, dword [ebp - 0x20]
mov esi, esp
push dword [ebp - 0x1c]
mov ecx, dword [ecx]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x41c348]
call edi
cmp esi, esp
je 0x4095f5
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov eax, dword [ebp - 0x30]
mov edi, esp
mov dword [ebp - 0x2c], 1
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x41c348]
call esi
cmp edi, esp
je 0x409628
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov eax, dword [ebp - 0x20]
mov esi, esp
push 2
push 0x401d74
mov ecx, dword [eax]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x41c348]
call edi
cmp esi, esp
je 0x40965b
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov eax, dword [ebp - 0x20]
mov esi, esp
push 2
push 0x401d08
mov ecx, dword [eax]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x41c348]
call edi
cmp esi, esp
je 0x40968e
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov eax, dword [ebp - 0x20]
mov esi, esp
push 5
mov ecx, dword [eax]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x41c348]
call edi
cmp esi, esp
je 0x4096bc
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + 0x33]
mov byte [edx + 0x58], al
test al, al
je 0x409703
mov ecx, dword [edx + 0x2c]
mov esi, esp
mov eax, dword [ecx]
mov edi, dword [eax]
lea eax, [edx + 0x54]
push eax
push 0x40249c
push ecx
mov ecx, edi
call dword [0x41c348]
call edi
cmp esi, esp
je 0x4096fa
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x40972d
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x41b50c]
inc eax
mov dword [ebp - 0x1c], 0
mov dword [edx + 0x28], eax
xor ebx, ebx
mov dword [0x41b50c], eax
mov eax, dword [ebp - 0x34]
mov dword [eax], edx
jmp 0x40972d
mov dword [ebp - 0x1c], 0
mov ebx, 0x8007000e
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x409751
mov eax, dword [ecx]
mov edi, esp
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x41c348]
call esi
cmp edi, esp
je 0x409751
mov ecx, 4
int 0x29
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40979e
cmp dword [ebp - 0x2c], 0
je 0x409781
mov eax, dword [ecx + 0x2c]
mov edi, esp
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x41c348]
call esi
cmp edi, esp
je 0x40977e
mov ecx, 4
int 0x29
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov edi, esp
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x41c348]
call esi
cmp edi, esp
je 0x40979e
mov ecx, 4
int 0x29
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b820
mov esp, ebp
pop ebp
ret 4