Function at 0x4069d0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495010
mov eax, dword fs:[0]
push eax
mov eax, 0x130c
call fcn.0044abc0
mov eax, dword [0x4d7204]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
lea eax, [ebp - 0x680]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1a0]
call fcn.00401da0
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x74]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x56], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x680]
call fcn.00404db0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x406b39
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x688]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x1a4], eax
mov edx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1a8]
call fcn.00401da0
mov dword [ebp - 0x78], eax
push str._Begin
mov eax, dword [ebp - 0x64]
add eax, 0x28
push eax
push str._AddAutoRunTaskSchedule
lea ecx, [ebp - 0x1ac]
push ecx
push 0x49b470
lea ecx, [ebp - 0x7d0]
call fcn.00404010
mov dword [ebp - 0x1b0], eax
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1b4]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.00401a10
mov ecx, eax
call fcn.00401970
push eax
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7d0]
call fcn.00405070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x688]
call fcn.00404db0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x10], 0x80004005
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x406c8e
lea ecx, [ebp - 0x690]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x1b8], eax
mov edx, dword [ebp - 0x1b8]
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x1bc]
call fcn.00401da0
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x45], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x690]
call fcn.00404db0
movzx ecx, byte [ebp - 0x45]
test ecx, ecx
je 0x406c87
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1c8], eax
lea edx, [ebp - 0x698]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x1c4]
call fcn.00401da0
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x10]
push ecx
push str._AddAutoRunTaskSchedule_CoInitialize_hr:
lea edx, [ebp - 0x1c8]
push edx
push 0x49b49c
lea ecx, [ebp - 0x868]
call fcn.00404010
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1d0]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x80]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x80]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x868]
call fcn.00405070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x698]
call fcn.00404db0
xor eax, eax
jmp 0x409a9e
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
call fcn.004030d0
mov dword [ebp - 4], 6
push 1
push 0
push 0x4ba9fc
lea ecx, [ebp - 0x14]
call fcn.0040a290
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x406e1b
lea ecx, [ebp - 0x6a0]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x1d4], eax
mov edx, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d8], edx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1d8]
call fcn.00401da0
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x84]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x46], al
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6a0]
call fcn.00404db0
movzx ecx, byte [ebp - 0x46]
test ecx, ecx
je 0x406e07
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1e4], eax
lea edx, [ebp - 0x6a8]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1e0]
call fcn.00401da0
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x10]
push ecx
push str._AddAutoRunTaskSchedule_ITaskService_CoCreateInstance_hr:
lea edx, [ebp - 0x1e4]
push edx
push 0x49b4d0
lea ecx, [ebp - 0x900]
call fcn.00404010
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1ec]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x88]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x88]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x900]
call fcn.00405070
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6a8]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x6f8]
call fcn.00403eb0
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x1f4]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x504], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x500], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x4fc], ecx
lea ecx, [ebp - 0x6e8]
call fcn.00403eb0
mov dword [ebp - 0x1f8], eax
mov edx, dword [ebp - 0x1f8]
mov dword [ebp - 0x1fc], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x1fc]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x514], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x510], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x50c], edx
lea ecx, [ebp - 0x6d8]
call fcn.00403eb0
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x204], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x204]
mov edx, dword [ecx]
mov dword [ebp - 0x528], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x524], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x520], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x51c], eax
lea ecx, [ebp - 0x6c8]
call fcn.00403eb0
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x20c]
mov eax, dword [edx]
mov dword [ebp - 0x538], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x534], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x530], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x52c], ecx
lea ecx, [ebp - 0x14]
call fcn.00405e20
mov dword [ebp - 0x8c], eax
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x508]
mov dword [edx], eax
mov ecx, dword [ebp - 0x504]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x500]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x4fc]
mov dword [edx + 0xc], ecx
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x518]
mov dword [edx], eax
mov ecx, dword [ebp - 0x514]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x510]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x50c]
mov dword [edx + 0xc], ecx
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x528]
mov dword [edx], eax
mov ecx, dword [ebp - 0x524]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x520]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x51c]
mov dword [edx + 0xc], ecx
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x538]
mov dword [edx], eax
mov ecx, dword [ebp - 0x534]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x530]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x52c]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x8c]
push edx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x6c8]
call fcn.00404fc0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x6d8]
call fcn.00404fc0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6e8]
call fcn.00404fc0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6f8]
call fcn.00404fc0
cmp dword [ebp - 0x10], 0
jge 0x407193
lea eax, [ebp - 0x6b0]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x214], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x214]
call fcn.00401da0
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x90]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x47], al
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6b0]
call fcn.00404db0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x40717f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x6b8]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], edx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x21c]
call fcn.00401da0
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x10]
push eax
push str._AddAutoRunTaskSchedule_ITaskService_Connect_hr:
lea ecx, [ebp - 0x220]
push ecx
push 0x49b514
lea ecx, [ebp - 0x998]
call fcn.00404010
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0x228], edx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x228]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x94]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x998]
call fcn.00405070
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6b8]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x18]
call fcn.004030d0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
call fcn.0040c040
movzx ecx, al
test ecx, ecx
je 0x407384
lea ecx, [ebp - 0x14]
call fcn.00405e20
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0x18]
call fcn.00403290
push eax
push 0x49b550
lea ecx, [ebp - 0x234]
call fcn.00403e30
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x230]
call fcn.00405e20
push eax
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x234]
call fcn.00404fa0
cmp dword [ebp - 0x10], 0
jge 0x40737f
lea ecx, [ebp - 0x580]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x238], eax
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], edx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x23c]
call fcn.00401da0
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x48], al
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x580]
call fcn.00404db0
movzx ecx, byte [ebp - 0x48]
test ecx, ecx
je 0x40735f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x248], eax
lea edx, [ebp - 0x588]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x244]
call fcn.00401da0
mov dword [ebp - 0xa0], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x49b55c
lea edx, [ebp - 0x248]
push edx
push 0x49b554
lea ecx, [ebp - 0xa30]
call fcn.00404010
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x250]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xa30]
call fcn.00405070
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x588]
call fcn.00404db0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
jmp 0x40786a
lea ecx, [ebp - 0x60]
call fcn.004030d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x14]
call fcn.00405e20
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x60]
call fcn.00403290
push eax
push 0x49b590
lea ecx, [ebp - 0x25c]
call fcn.00403e30
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x258], ecx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x258]
call fcn.00405e20
push eax
mov edx, dword [ebp - 0xa4]
push edx
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x25c]
call fcn.00404fa0
cmp dword [ebp - 0x10], 0
jge 0x407566
lea eax, [ebp - 0x590]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x264], ecx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x264]
call fcn.00401da0
mov dword [ebp - 0xa8], eax
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x590]
call fcn.00404db0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x40753a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x270], eax
lea ecx, [ebp - 0x598]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x268], eax
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x26c], edx
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x26c]
call fcn.00401da0
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x10]
push eax
push str._AddAutoRunTaskSchedule_ITaskService_GetFolder_hr:
lea ecx, [ebp - 0x270]
push ecx
push 0x49b594
lea ecx, [ebp - 0xac8]
call fcn.00404010
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x278], edx
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x278]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xac]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xac8]
call fcn.00405070
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x598]
call fcn.00404db0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x60]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x60]
call fcn.00405e20
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0x18]
call fcn.00403290
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
call fcn.00405e20
push eax
lea ecx, [ebp - 0x284]
call fcn.00403e30
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], ecx
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x280]
call fcn.00405e20
push eax
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x284]
call fcn.00404fa0
cmp dword [ebp - 0x10], 0
jge 0x4076dd
lea ecx, [ebp - 0x708]
call fcn.00403eb0
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x28c], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x28c]
mov edx, dword [ecx]
mov dword [ebp - 0x548], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x544], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x540], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x53c], eax
lea ecx, [ebp - 0x60]
call fcn.00405e20
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0x18]
call fcn.00403290
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x548]
mov dword [ecx], edx
mov eax, dword [ebp - 0x544]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x540]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x53c]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
call fcn.00405e20
push eax
lea ecx, [ebp - 0x298]
call fcn.00403e30
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x294], ecx
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x294]
call fcn.00405e20
push eax
mov edx, dword [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x298]
call fcn.00404fa0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x708]
call fcn.00404fc0
cmp dword [ebp - 0x10], 0
jge 0x40785e
lea eax, [ebp - 0x5a0]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x29c], eax
mov ecx, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], ecx
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x2a0]
call fcn.00401da0
mov dword [ebp - 0xb8], eax
mov edx, dword [ebp - 0xb8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x4a], al
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x5a0]
call fcn.00404db0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x407832
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x2ac], eax
lea ecx, [ebp - 0x5a8]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x2a4], eax
mov edx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], edx
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x2a8]
call fcn.00401da0
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
push str.__TaskFolder:
lea ecx, [ebp - 0x10]
push ecx
push str._AddAutoRunTaskSchedule_ITaskService_CreateFolder_hr:
lea edx, [ebp - 0x2ac]
push edx
push 0x49b5d0
lea ecx, [ebp - 0xb60]
call fcn.00404010
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x2b4]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.00401a10
push eax
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xbc]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xb60]
call fcn.00405070
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x5a8]
call fcn.00404db0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x60]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x60]
call fcn.00404920
lea ecx, [ebp - 0x18]
call fcn.00405e20
mov dword [ebp - 0xc0], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2c0]
call fcn.00403e30
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], edx
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x2bc]
call fcn.00405e20
push eax
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c0]
call fcn.00404fa0
lea ecx, [ebp - 0x1c]
call fcn.004030d0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x14]
call fcn.00405e20
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0x1c]
call fcn.00403290
push eax
push 0
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
call ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x407a74
lea edx, [ebp - 0x5b0]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x2c8]
call fcn.00401da0
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x4b], al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x5b0]
call fcn.00404db0
movzx ecx, byte [ebp - 0x4b]
test ecx, ecx
je 0x407a48
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x2d4], eax
lea edx, [ebp - 0x5b8]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x2d0]
call fcn.00401da0
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_ITaskService_NewTask_hr_:
lea edx, [ebp - 0x2d4]
push edx
push 0x49b620
lea ecx, [ebp - 0xbf8]
call fcn.00404010
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x2dc]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xcc]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xbf8]
call fcn.00405070
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x5b8]
call fcn.00404db0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x14]
call fcn.0040c6f0
lea ecx, [ebp - 0x20]
call fcn.004030d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1c]
call fcn.00405e20
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0x20]
call fcn.00403290
push eax
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0xd0]
mov eax, dword [edx]
mov ecx, dword [eax + 0x1c]
call ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x407c29
lea edx, [ebp - 0x5c0]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x2e4]
call fcn.00401da0
mov dword [ebp - 0xd4], eax
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xd4]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x4c], al
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x5c0]
call fcn.00404db0
movzx ecx, byte [ebp - 0x4c]
test ecx, ecx
je 0x407bf1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x2f0], eax
lea edx, [ebp - 0x5c8]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x2ec]
call fcn.00401da0
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_ITaskDefinition_get_RegistrationInfo_hr_:
lea edx, [ebp - 0x2f0]
push edx
push 0x49b680
lea ecx, [ebp - 0xc90]
call fcn.00404010
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f8], eax
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x2f8]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xc90]
call fcn.00405070
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x5c8]
call fcn.00404db0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x20]
call fcn.00405e20
mov dword [ebp - 0xdc], eax
lea ecx, [ebp - 0x310]
push ecx
mov ecx, dword [ebp - 0x64]
call fcn.0040b2f0
mov dword [ebp - 0x2fc], eax
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], edx
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x300]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x30c]
call fcn.00403e30
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x308], eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x308]
call fcn.00405e20
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [eax + 0x28]
call ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x30c]
call fcn.00404fa0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x310]
call fcn.004049f0
lea ecx, [ebp - 0x20]
call fcn.00405e20
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
call fcn.00405e20
push eax
lea ecx, [ebp - 0x31c]
call fcn.00403e30
mov dword [ebp - 0x314], eax
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x318], edx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x318]
call fcn.00405e20
push eax
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x31c]
call fcn.00404fa0
lea ecx, [ebp - 0x20]
call fcn.0040c6f0
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x1c]
call fcn.00405e20
mov dword [ebp - 0xe4], eax
lea ecx, [ebp - 0x28]
call fcn.00403290
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0xe4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
call ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x407ef8
lea edx, [ebp - 0x5d0]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x324], eax
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x324]
call fcn.00401da0
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe8]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x4d], al
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x5d0]
call fcn.00404db0
movzx ecx, byte [ebp - 0x4d]
test ecx, ecx
je 0x407eb4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x330], eax
lea edx, [ebp - 0x5d8]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x32c], eax
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x32c]
call fcn.00401da0
mov dword [ebp - 0xec], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_ITaskDefinition_get_Triggers_hr_:
lea edx, [ebp - 0x330]
push edx
push 0x49b6cc
lea ecx, [ebp - 0xd28]
call fcn.00404010
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x338], eax
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x338]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xec]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xd28]
call fcn.00405070
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x5d8]
call fcn.00404db0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x2c]
call fcn.004030d0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x28]
call fcn.00405e20
mov dword [ebp - 0xf0], eax
lea ecx, [ebp - 0x2c]
call fcn.00403290
push eax
push 9
mov ecx, dword [ebp - 0xf0]
push ecx
mov edx, dword [ebp - 0xf0]
mov eax, dword [edx]
mov ecx, dword [eax + 0x28]
call ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.0040c6f0
cmp dword [ebp - 0x10], 0
jge 0x4080c7
lea edx, [ebp - 0x5e0]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x340]
call fcn.00401da0
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xf4]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x4e], al
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x5e0]
call fcn.00404db0
movzx ecx, byte [ebp - 0x4e]
test ecx, ecx
je 0x408077
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x34c], eax
lea edx, [ebp - 0x5e8]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x348], eax
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x348]
call fcn.00401da0
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_spTriggerCollection_Create_hr_:
lea edx, [ebp - 0x34c]
push edx
push 0x49b710
lea ecx, [ebp - 0xdc0]
call fcn.00404010
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x354], eax
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x354]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xdc0]
call fcn.00405070
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x5e8]
call fcn.00404db0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x2c]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x24]
call fcn.00403160
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x24]
call fcn.00405cc0
movzx ecx, al
test ecx, ecx
je 0x4082d8
lea edx, [ebp - 0x5f0]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x35c]
call fcn.00401da0
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xfc]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x4f], al
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x5f0]
call fcn.00404db0
movzx ecx, byte [ebp - 0x4f]
test ecx, ecx
je 0x408220
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x368], eax
lea edx, [ebp - 0x5f8]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x364], eax
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0x364]
call fcn.00401da0
mov dword [ebp - 0x100], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_spLogonTrigger_Create_hr_:
lea edx, [ebp - 0x368]
push edx
push 0x49b750
lea ecx, [ebp - 0xe58]
call fcn.00404010
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x370]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x100]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xe58]
call fcn.00405070
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x5f8]
call fcn.00404db0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x24]
call fcn.00405e20
mov dword [ebp - 0x104], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
mov ecx, dword [eax + 0x4c]
call ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
call fcn.00405e20
mov dword [ebp - 0x108], eax
push str.Trigger1
lea ecx, [ebp - 0x37c]
call fcn.00403e30
mov dword [ebp - 0x374], eax
mov edx, dword [ebp - 0x374]
mov dword [ebp - 0x378], edx
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x378]
call fcn.00405e20
push eax
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x37c]
call fcn.00404fa0
lea ecx, [ebp - 0x24]
call fcn.00405e20
mov dword [ebp - 0x10c], eax
lea ecx, [ebp - 0x394]
push ecx
mov ecx, dword [ebp - 0x64]
call fcn.0040af80
mov dword [ebp - 0x380], eax
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x384], edx
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x384]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x390]
call fcn.00403e30
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x38c], eax
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x38c]
call fcn.00405e20
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x5c]
call ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x390]
call fcn.00404fa0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x394]
call fcn.004049f0
lea ecx, [ebp - 0x3c]
call fcn.00403360
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
cdq
mov ecx, 0x3c
idiv ecx
push edx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
cdq
mov ecx, 0x3c
idiv ecx
push eax
push str.PT_dM_dS
lea edx, [ebp - 0x3c]
push edx
call fcn.0040ad60
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.00405e20
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x3c]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x3a0]
call fcn.00403e30
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x39c]
call fcn.00405e20
push eax
mov ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x110]
mov eax, dword [edx]
mov ecx, dword [eax + 0x54]
call ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x3a0]
call fcn.00404fa0
lea ecx, [ebp - 0x24]
call fcn.0040c6f0
cmp dword [ebp - 0x10], 0
jge 0x408656
lea edx, [ebp - 0x600]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3a8], eax
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0x3a8]
call fcn.00401da0
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x50], al
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x600]
call fcn.00404db0
movzx ecx, byte [ebp - 0x50]
test ecx, ecx
je 0x4085ee
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x3b4], eax
lea edx, [ebp - 0x608]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0x3f
mov ecx, dword [ebp - 0x3b0]
call fcn.00401da0
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_spLogonTrigger_put_Delay_hr_:
lea edx, [ebp - 0x3b4]
push edx
push 0x49b7b4
lea ecx, [ebp - 0xef0]
call fcn.00404010
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], eax
mov byte [ebp - 4], 0x40
mov ecx, dword [ebp - 0x3bc]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x118]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xef0]
call fcn.00405070
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x608]
call fcn.00404db0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x38]
call fcn.004030d0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x1c]
call fcn.00405e20
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x38]
call fcn.00403290
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x44]
call ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40883f
lea edx, [ebp - 0x610]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c4], eax
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x3c4]
call fcn.00401da0
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x120]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x57], al
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x610]
call fcn.00404db0
movzx ecx, byte [ebp - 0x57]
test ecx, ecx
je 0x4087cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x3d0], eax
lea edx, [ebp - 0x618]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], eax
mov byte [ebp - 4], 0x43
mov ecx, dword [ebp - 0x3cc]
call fcn.00401da0
mov dword [ebp - 0x124], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_spTaskDefinition_get_Actions_hr_:
lea edx, [ebp - 0x3d0]
push edx
push 0x49b7f4
lea ecx, [ebp - 0xf88]
call fcn.00404010
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x3d8], eax
mov byte [ebp - 4], 0x44
mov ecx, dword [ebp - 0x3d8]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x124]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0xf88]
call fcn.00405070
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x618]
call fcn.00404db0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x44]
call fcn.004030d0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x38]
call fcn.00405e20
mov dword [ebp - 0x128], eax
lea ecx, [ebp - 0x44]
call fcn.00403290
push eax
push 0
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x128]
mov eax, dword [edx]
mov ecx, dword [eax + 0x30]
call ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x38]
call fcn.0040c6f0
cmp dword [ebp - 0x10], 0
jge 0x408a3e
lea edx, [ebp - 0x620]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], eax
mov byte [ebp - 4], 0x46
mov ecx, dword [ebp - 0x3e0]
call fcn.00401da0
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x58], al
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x620]
call fcn.00404db0
movzx ecx, byte [ebp - 0x58]
test ecx, ecx
je 0x4089be
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x3ec], eax
lea edx, [ebp - 0x628]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], eax
mov byte [ebp - 4], 0x47
mov ecx, dword [ebp - 0x3e8]
call fcn.00401da0
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_spActionCollection_Create_hr_:
lea edx, [ebp - 0x3ec]
push edx
push 0x49b838
lea ecx, [ebp - 0x1020]
call fcn.00404010
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f4], eax
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0x3f4]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x130]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1020]
call fcn.00405070
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x628]
call fcn.00404db0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x44]
call fcn.00404920
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x44]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x34]
call fcn.00403110
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x34]
call fcn.00405cc0
movzx ecx, al
test ecx, ecx
je 0x408c23
lea edx, [ebp - 0x630]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x3fc]
call fcn.00401da0
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x134]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x55], al
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x630]
call fcn.00404db0
movzx ecx, byte [ebp - 0x55]
test ecx, ecx
je 0x408b97
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x408], eax
lea edx, [ebp - 0x638]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp - 0x404]
call fcn.00401da0
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x10]
push ecx
push str.AddAutoRunTaskSchedule_spExecAction_Create_hr_:
lea edx, [ebp - 0x408]
push edx
push 0x49b878
lea ecx, [ebp - 0x10b8]
call fcn.00404010
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x410], eax
mov byte [ebp - 4], 0x4c
mov ecx, dword [ebp - 0x410]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x138]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x10b8]
call fcn.00405070
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x638]
call fcn.00404db0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x34]
call fcn.00404970
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x44]
call fcn.00404920
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
push 0x49b8b4
lea ecx, [ebp - 0x5c]
call fcn.004032e0
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.00406300
push 0x49b8b8
lea ecx, [ebp - 0x5c]
call fcn.00406320
lea ecx, [ebp - 0x34]
call fcn.00405e20
mov dword [ebp - 0x13c], eax
lea ecx, [ebp - 0x5c]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x41c]
call fcn.00403e30
mov dword [ebp - 0x414], eax
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x418], edx
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x418]
call fcn.00405e20
push eax
mov eax, dword [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x41c]
call fcn.00404fa0
lea ecx, [ebp - 0x34]
call fcn.00405e20
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp + 0xc]
add ecx, 4
call fcn.00405e20
push eax
lea ecx, [ebp - 0x428]
call fcn.00403e30
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x420]
mov dword [ebp - 0x424], ecx
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x424]
call fcn.00405e20
push eax
mov edx, dword [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x428]
call fcn.00404fa0
lea ecx, [ebp - 0x34]
call fcn.00405e20
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp + 0xc]
add ecx, 8
call fcn.00405e20
push eax
lea ecx, [ebp - 0x434]
call fcn.00403e30
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0x50
mov ecx, dword [ebp - 0x430]
call fcn.00405e20
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [edx]
mov ecx, dword [eax + 0x34]
call ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x434]
call fcn.00404fa0
lea ecx, [ebp - 0x40]
call fcn.004030d0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x1c]
call fcn.00405e20
mov dword [ebp - 0x148], eax
lea ecx, [ebp - 0x40]
call fcn.00403290
push eax
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
call edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x408faa
lea eax, [ebp - 0x640]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 4], 0x52
mov ecx, dword [ebp - 0x43c]
call fcn.00401da0
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x54], al
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x640]
call fcn.00404db0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x408f06
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x448], eax
lea ecx, [ebp - 0x648]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x440], eax
mov edx, dword [ebp - 0x440]
mov dword [ebp - 0x444], edx
mov byte [ebp - 4], 0x53
mov ecx, dword [ebp - 0x444]
call fcn.00401da0
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x10]
push eax
push str.AddAutoRunTaskSchedule_spTaskDefinition_get_Principal_hr_:
lea ecx, [ebp - 0x448]
push ecx
push 0x49b8e0
lea ecx, [ebp - 0x1150]
call fcn.00404010
mov dword [ebp - 0x44c], eax
mov edx, dword [ebp - 0x44c]
mov dword [ebp - 0x450], edx
mov byte [ebp - 4], 0x54
mov ecx, dword [ebp - 0x450]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x150]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x1150]
call fcn.00405070
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x648]
call fcn.00404db0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x40]
call fcn.00404920
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x5c]
call fcn.004049f0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x34]
call fcn.00404970
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x44]
call fcn.00404920
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x40]
call fcn.00405e20
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [ebp - 0x64]
call fcn.0040b2f0
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x458], edx
mov byte [ebp - 4], 0x55
mov ecx, dword [ebp - 0x458]
call fcn.00405e20
push eax
lea ecx, [ebp - 0x464]
call fcn.00403e30
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x460], eax
mov byte [ebp - 4], 0x56
mov ecx, dword [ebp - 0x460]
call fcn.00405e20
push eax
mov ecx, dword [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x154]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
call ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x464]
call fcn.00404fa0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x468]
call fcn.004049f0
lea ecx, [ebp - 0x40]
call fcn.00405e20
mov dword [ebp - 0x158], eax
push str.BUILTINAdministrators
lea ecx, [ebp - 0x474]
call fcn.00403e30
mov dword [ebp - 0x46c], eax
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x470], edx
mov byte [ebp - 4], 0x57
mov ecx, dword [ebp - 0x470]
call fcn.00405e20
push eax
mov eax, dword [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
call eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x474]
call fcn.00404fa0
lea ecx, [ebp - 0x40]
call fcn.00405e20
mov dword [ebp - 0x15c], eax
push 1
mov ecx, dword [ebp - 0x15c]
push ecx
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x48]
call ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x34]
call fcn.0040c6f0
lea ecx, [ebp - 0x30]
call fcn.004030d0
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x1c]
call fcn.00405e20
mov dword [ebp - 0x160], eax
lea ecx, [ebp - 0x30]
call fcn.00403290
push eax
mov edx, dword [ebp - 0x160]
push edx
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
call edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x409305
lea eax, [ebp - 0x650]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x478], eax
mov ecx, dword [ebp - 0x478]
mov dword [ebp - 0x47c], ecx
mov byte [ebp - 4], 0x59
mov ecx, dword [ebp - 0x47c]
call fcn.00401da0
mov dword [ebp - 0x164], eax
mov edx, dword [ebp - 0x164]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x164]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x53], al
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x650]
call fcn.00404db0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x409255
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x488], eax
lea ecx, [ebp - 0x658]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x480], eax
mov edx, dword [ebp - 0x480]
mov dword [ebp - 0x484], edx
mov byte [ebp - 4], 0x5a
mov ecx, dword [ebp - 0x484]
call fcn.00401da0
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x10]
push eax
push str.AddAutoRunTaskSchedule_spTaskDefinition_get_Settings_hr_:
lea ecx, [ebp - 0x488]
push ecx
push 0x49b954
lea ecx, [ebp - 0x11e8]
call fcn.00404010
mov dword [ebp - 0x48c], eax
mov edx, dword [ebp - 0x48c]
mov dword [ebp - 0x490], edx
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x490]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov eax, dword [ebp - 0x168]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x168]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x11e8]
call fcn.00405070
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x658]
call fcn.00404db0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x30]
call fcn.00404920
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x40]
call fcn.00404920
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x5c]
call fcn.004049f0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x34]
call fcn.00404970
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x44]
call fcn.00404920
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
lea ecx, [ebp - 0x30]
call fcn.00405e20
mov dword [ebp - 0x16c], eax
push 0
mov ecx, dword [ebp - 0x16c]
push ecx
mov edx, dword [ebp - 0x16c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x40]
call ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.00405e20
mov dword [ebp - 0x170], eax
push 0
mov edx, dword [ebp - 0x170]
push edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
call edx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.00405e20
mov dword [ebp - 0x174], eax
push 0
mov eax, dword [ebp - 0x174]
push eax
mov ecx, dword [ebp - 0x174]
mov edx, dword [ecx]
mov eax, dword [edx + 0x50]
call eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.00405e20
mov dword [ebp - 0x178], eax
push str.PT0S
lea ecx, [ebp - 0x49c]
call fcn.00403e30
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x498], ecx
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0x498]
call fcn.00405e20
push eax
mov edx, dword [ebp - 0x178]
push edx
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x49c]
call fcn.00404fa0
lea ecx, [ebp - 0x30]
call fcn.00405e20
mov dword [ebp - 0x17c], eax
push 4
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x88]
call eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x68]
call fcn.004030d0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x30]
call fcn.00405e20
mov dword [ebp - 0x180], eax
lea ecx, [ebp - 0x68]
call fcn.00403290
push eax
mov ecx, dword [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x180]
mov eax, dword [edx]
mov ecx, dword [eax + 0x9c]
call ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x409471
lea ecx, [ebp - 0x68]
call fcn.00405e20
mov dword [ebp - 0x184], eax
push 0
mov edx, dword [ebp - 0x184]
push edx
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
call edx
lea ecx, [ebp - 0x30]
call fcn.0040c6f0
lea ecx, [ebp - 0x6c]
call fcn.004030d0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x738]
call fcn.00403eb0
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ecx]
mov dword [ebp - 0x558], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x554], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x550], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x54c], eax
lea ecx, [ebp - 0x728]
call fcn.00403eb0
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp - 0x4ac], ecx
mov byte [ebp - 4], 0x60
mov edx, dword [ebp - 0x4ac]
mov eax, dword [edx]
mov dword [ebp - 0x568], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x564], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x560], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x55c], ecx
lea ecx, [ebp - 0x718]
call fcn.00403eb0
mov dword [ebp - 0x4b0], eax
mov edx, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], edx
mov byte [ebp - 4], 0x61
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [eax]
mov dword [ebp - 0x578], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x574], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x570], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x56c], edx
lea ecx, [ebp - 0x18]
call fcn.00405e20
mov dword [ebp - 0x188], eax
lea ecx, [ebp - 0x6c]
call fcn.00403290
push eax
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x558]
mov dword [eax], ecx
mov edx, dword [ebp - 0x554]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x550]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x54c]
mov dword [eax + 0xc], edx
push 3
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x568]
mov dword [eax], ecx
mov edx, dword [ebp - 0x564]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x560]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x55c]
mov dword [eax + 0xc], edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x578]
mov dword [eax], ecx
mov edx, dword [ebp - 0x574]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x570]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x56c]
mov dword [eax + 0xc], edx
push 6
lea ecx, [ebp - 0x1c]
call fcn.00405e20
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x4c0]
call fcn.00403e30
mov dword [ebp - 0x4b8], eax
mov ecx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], ecx
mov byte [ebp - 4], 0x62
mov ecx, dword [ebp - 0x4bc]
call fcn.00405e20
push eax
mov edx, dword [ebp - 0x188]
push edx
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
call edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x4c0]
call fcn.00404fa0
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x718]
call fcn.00404fc0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x728]
call fcn.00404fc0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x738]
call fcn.00404fc0
cmp dword [ebp - 0x10], 0
jge 0x409886
lea eax, [ebp - 0x660]
push eax
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x4c4], eax
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ecx
mov byte [ebp - 4], 0x63
mov ecx, dword [ebp - 0x4c8]
call fcn.00401da0
mov dword [ebp - 0x18c], eax
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x18c]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 0x52], al
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x660]
call fcn.00404db0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x4097be
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x4d4], eax
lea ecx, [ebp - 0x668]
push ecx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x4cc], eax
mov edx, dword [ebp - 0x4cc]
mov dword [ebp - 0x4d0], edx
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0x4d0]
call fcn.00401da0
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x10]
push eax
push str.AddAutoRunTaskSchedule_spTaskFolder_RegisterTaskDefinition_hr_:
lea ecx, [ebp - 0x4d4]
push ecx
push 0x49b9a4
lea ecx, [ebp - 0x1280]
call fcn.00404010
mov dword [ebp - 0x4d8], eax
mov edx, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], edx
mov byte [ebp - 4], 0x65
mov ecx, dword [ebp - 0x4dc]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019d0
push eax
mov eax, dword [ebp - 0x190]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x190]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x1280]
call fcn.00405070
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x668]
call fcn.00404db0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x6c]
call fcn.00404920
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x68]
call fcn.00404920
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x30]
call fcn.00404920
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x40]
call fcn.00404920
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x5c]
call fcn.004049f0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x34]
call fcn.00404970
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x44]
call fcn.00404920
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
jmp 0x409958
mov dword [ebp - 0x70], 1
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x6c]
call fcn.00404920
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x68]
call fcn.00404920
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x30]
call fcn.00404920
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x40]
call fcn.00404920
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x5c]
call fcn.004049f0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x34]
call fcn.00404970
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x44]
call fcn.00404920
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x38]
call fcn.00404920
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3c]
call fcn.004049f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x24]
call fcn.00404970
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2c]
call fcn.00404920
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00404920
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20]
call fcn.00404920
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call fcn.00404920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404920
xor ecx, ecx
jne 0x406c8e
call dword [sym.imp.ole32.dll_CoUninitialize]
lea edx, [ebp - 0x670]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 4], 0x66
mov ecx, dword [ebp - 0x4e4]
call fcn.00401da0
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x194]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x51], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x670]
call fcn.00404db0
movzx ecx, byte [ebp - 0x51]
test ecx, ecx
je 0x409a9b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x4f0], eax
lea edx, [ebp - 0x678]
push edx
call fcn.0042a2f0
add esp, 4
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 4], 0x67
mov ecx, dword [ebp - 0x4ec]
call fcn.00401da0
mov dword [ebp - 0x198], eax
lea ecx, [ebp - 0x70]
push ecx
push str.AddAutoRunTaskSchedule_End_bRet:
lea edx, [ebp - 0x4f0]
push edx
push str.tid_:
lea ecx, [ebp - 0x1318]
call fcn.00404010
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x4f8], eax
mov byte [ebp - 4], 0x68
mov ecx, dword [ebp - 0x4f8]
call fcn.00401970
mov ecx, eax
call fcn.004019f0
mov ecx, eax
call fcn.00401970
mov ecx, eax
call fcn.004019b0
push eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x198]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x1318]
call fcn.00405070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x678]
call fcn.00404db0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8