Function at 0x4a6c60
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8301
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0xc]
mov esi, ecx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx], 0
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x64], eax
jb 0x4a6ccc
mov esi, dword [ecx]
xor ecx, ecx
mov word [esi], cx
mov dword [edx + 0x10], ecx
mov ecx, edx
cmp dword [edx + 0x14], 8
jb 0x4a6cde
mov ecx, dword [edx]
xor edx, edx
mov word [ecx], dx
mov ecx, eax
mov dword [eax + 0x10], edx
cmp dword [eax + 0x14], 8
jb 0x4a6cf0
mov ecx, dword [eax]
xor eax, eax
mov word [ecx], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push 0x510324
push 1
push 0
push 0x51500c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x4a6f57
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xcc]
push eax
call esi
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0xbc]
push eax
call esi
mov eax, dword [ebp - 0xb4]
mov edi, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xb8]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xdc]
push eax
call esi
mov edx, dword [ebp - 0x5c]
sub esp, 0x10
mov ecx, esp
mov eax, dword [ebp - 0x30]
sub esp, 0x10
mov byte [ebp - 4], 5
mov dword [ecx], edx
mov edx, dword [ebp - 0x88]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x8c]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x94]
mov dword [ecx + 0xc], edx
mov ecx, esp
mov edx, dword [ebp - 0xac]
sub esp, 0x10
mov esi, dword [eax]
mov dword [ecx], edx
mov edx, dword [ebp - 0x9c]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x80]
mov dword [ecx + 0xc], edx
mov ecx, esp
mov edx, dword [ebp - 0x84]
sub esp, 0x10
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x60]
mov dword [ecx + 0xc], edx
mov edx, esp
mov ecx, dword [ebp - 0xdc]
push eax
mov dword [edx], ecx
mov ecx, dword [ebp - 0xd8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0xd4]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0xd0]
mov dword [edx + 0xc], ecx
call dword [esi + 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, eax
lea eax, [ebp - 0xdc]
push eax
call esi
lea eax, [ebp - 0xbc]
push eax
call esi
lea eax, [ebp - 0xcc]
push eax
call esi
lea eax, [ebp - 0x24]
push eax
call esi
test edi, edi
jns 0x4a6e8d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4a6e86
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x4a7461
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x60]
push 0x4f0efc
mov byte [ebp - 4], 6
call fcn.004a5210
mov eax, dword [eax]
mov byte [ebp - 4], 7
test eax, eax
je 0x4a6eb6
mov ecx, dword [eax]
jmp 0x4a6eb8
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ecx
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.004a5510
test esi, esi
jns 0x4a6eeb
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x4a744b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
jmp 0x4a744b
mov dword [ebp - 0x34], 0
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 8
call fcn.004aac20
add esp, 8
mov eax, dword [eax]
mov byte [ebp - 4], 9
test eax, eax
je 0x4a6f16
mov ecx, dword [eax]
jmp 0x4a6f18
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push ecx
push esi
call dword [eax + 0x34]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 8
mov esi, eax
call fcn.004a5510
mov eax, dword [ebp - 0x34]
test esi, esi
jns 0x4a6f74
mov byte [ebp - 4], 6
test eax, eax
je 0x4a6f46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x4a6f57
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x4a745f
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
jmp 0x4a745f
mov dword [ebp - 0x6c], 0
lea edx, [ebp - 0x6c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
jns 0x4a6f90
mov eax, dword [ebp - 0x34]
jmp 0x4a6f38
mov eax, dword [ebp - 0x6c]
cmp eax, 1
je 0x4a6fa0
test eax, eax
je 0x4a6fa0
mov bl, 1
jmp 0x4a6fa2
xor bl, bl
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x3c]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov esi, eax
test esi, esi
jns 0x4a6fd9
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a6fd1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
jmp 0x4a6f38
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0xb
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
mov eax, dword [ebp - 0x40]
test esi, esi
jns 0x4a700a
mov byte [ebp - 4], 0xa
test eax, eax
je 0x4a6fc0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a6fc0
mov dword [ebp - 0x70], 0
lea edx, [ebp - 0x70]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
cmp dword [ebp - 0x70], 0
je 0x4a720c
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x44]
push edx
push 1
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xc
call dword [ecx + 0x20]
mov esi, eax
mov eax, dword [ebp - 0x44]
test esi, esi
jns 0x4a705b
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4a7056
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
jmp 0x4a6ffa
mov dword [ebp - 0x74], 0
lea edx, [ebp - 0x74]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
mov esi, eax
test esi, esi
jns 0x4a7077
mov eax, dword [ebp - 0x44]
jmp 0x4a7048
cmp word [ebp - 0x74], 0xffff
mov dword [ebp - 0x48], 0
sete bh
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xd
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
mov eax, dword [ebp - 0x48]
test esi, esi
jns 0x4a70b3
mov byte [ebp - 4], 0xc
test eax, eax
je 0x4a70ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
jmp 0x4a7048
mov ecx, dword [eax]
lea edx, [ebp - 0x90]
push edx
push eax
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
jns 0x4a70cb
mov eax, dword [ebp - 0x48]
jmp 0x4a70a0
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x4a71ea
push eax
lea ecx, [ebp - 0x58]
call fcn.004a5210
mov eax, dword [eax]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x4a70f0
mov eax, dword [eax]
jmp 0x4a70f2
xor eax, eax
mov esi, dword [ebp - 0x64]
mov ecx, esi
push eax
call fcn.004239c0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xd
call fcn.004a5510
push 0xffffffffffffffff
push 0x5c
mov ecx, esi
call fcn.004aa230
cmp eax, 0xffffffff
jne 0x4a711d
xor eax, eax
jmp 0x4a7129
push 0xffffffffffffffff
push 0x5c
mov ecx, esi
call fcn.004aa230
inc eax
push dword [esi + 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0043c610
push eax
mov ecx, esi
call fcn.00405210
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4a717c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a7172
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a7172
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x4c]
push edx
push eax
mov byte [ebp - 4], 0xf
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, eax
mov eax, dword [ebp - 0x4c]
test esi, esi
jns 0x4a71b3
mov byte [ebp - 4], 0xd
test eax, eax
je 0x4a71ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
jmp 0x4a70a0
mov dword [ebp - 0x78], 0
lea edx, [ebp - 0x78]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x4a71cf
mov eax, dword [ebp - 0x4c]
jmp 0x4a719d
cmp dword [ebp - 0x78], 0
jne 0x4a726e
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x4a71ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x4a71fb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4a720c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x4a721d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a722e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 6
test eax, eax
je 0x4a723f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x4a7250
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4a7264
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x4a7461
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x54]
push edx
push 1
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x10
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
jns 0x4a72a7
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4a729f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
jmp 0x4a719d
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x11
call dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x50]
test esi, esi
jns 0x4a72dc
mov byte [ebp - 4], 0x10
test eax, eax
je 0x4a728e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a728e
mov ecx, dword [eax]
lea edx, [ebp - 0x98]
push edx
push eax
call dword [ecx + 0x28]
mov esi, eax
mov eax, dword [ebp - 0x50]
test esi, esi
js 0x4a72cc
mov ecx, dword [eax]
lea edx, [ebp - 0xa0]
push edx
push eax
call dword [ecx + 0x30]
mov esi, eax
test esi, esi
jns 0x4a730a
mov eax, dword [ebp - 0x50]
jmp 0x4a72cc
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4a7342
push eax
lea ecx, [ebp - 0x64]
call fcn.004a5210
mov eax, dword [eax]
mov byte [ebp - 4], 0x12
test eax, eax
je 0x4a732b
mov eax, dword [eax]
jmp 0x4a732d
xor eax, eax
mov ecx, dword [ebp - 0x68]
push eax
call fcn.004239c0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x11
call fcn.004a5510
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x4a7379
push eax
lea ecx, [ebp - 0x68]
call fcn.004a5210
mov eax, dword [eax]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x4a7363
mov eax, dword [eax]
jmp 0x4a7365
xor eax, eax
mov ecx, dword [ebp - 0xa4]
push eax
call fcn.004239c0
lea ecx, [ebp - 0x68]
call fcn.004a5510
test bl, bl
je 0x4a7388
test bh, bh
je 0x4a7388
mov eax, 1
jmp 0x4a738a
xor eax, eax
mov ecx, dword [ebp - 0xa8]
mov byte [ebp - 4], 0x10
mov dword [ecx], eax
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4a73a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4a73b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x4a73c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x4a73d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4a73e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x4a73f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 8
test eax, eax
je 0x4a7409
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 6
test eax, eax
je 0x4a741a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x4a744b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4a744b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4a745f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret 0x14