Function at 0x646ea0
Capabilities:
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
push 0xffffffffffffffff
push 0x7c54ee
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0xdc]
mov dword fs:[0], eax
xor esi, esi
push esi
mov dword [esp + 0x94], esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
jge 0x646ee8
xor eax, eax
jmp 0x648403
push esi
push esi
push esi
push 3
push 6
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
push eax
push 0x80eed0
push 1
push esi
push 0x8278e8
mov dword [esp + 0xf8], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jge 0x646f45
mov eax, dword [esp + 0x18]
mov dword [esp + 0xe4], 0xffffffff
cmp eax, esi
je 0x6483f6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x6483f6
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
mov ebp, dword [esp + 0xac]
mov ebx, dword [esp + 0xb0]
lea ecx, [esp + 0xc8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xcc]
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], edx
mov edx, dword [esp + 0xd4]
lea eax, [esp + 0xb4]
push eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x80], edx
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0xc0]
lea edx, [esp + 0x94]
push edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x78]
mov dword [eax + 4], edi
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebx
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x8c]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x90]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x94]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x9c]
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0xb0]
mov dword [eax + 4], esi
mov esi, dword [esp + 0xb4]
mov dword [eax + 8], esi
mov esi, dword [esp + 0xb8]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0xc4]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0xd8]
mov dword [eax + 4], esi
mov esi, dword [esp + 0xdc]
mov dword [eax + 8], esi
mov esi, dword [esp + 0xe0]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x28]
push ecx
mov byte [esp + 0x128], 4
call eax
lea ecx, [esp + 0x94]
mov esi, eax
push ecx
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
call edi
lea edx, [esp + 0xb4]
push edx
call edi
lea eax, [esp + 0xc8]
push eax
call edi
lea ecx, [esp + 0xa4]
push ecx
call edi
test esi, esi
jge 0x6470f7
mov eax, dword [esp + 0x18]
mov dword [esp + 0xe4], 0xffffffff
test eax, eax
je 0x6483f6
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x6483f6
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x18]
push 0x82f470
mov byte [esp + 0xe8], 5
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jne 0x64712a
push 0x8007000e
call fcn.004066b0
mov ecx, dword [edi]
mov eax, dword [ecx + 0x1c]
lea edx, [esp + 0x20]
push edx
push esi
push edi
mov byte [esp + 0xf0], 6
call eax
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, eax
call esi
test edi, edi
jge 0x64718b
mov eax, dword [esp + 0x20]
mov byte [esp + 0xe4], 0
test eax, eax
je 0x647167
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xe4], 0xffffffff
test eax, eax
je 0x6483f6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x6483f6
xor edi, edi
mov dword [esp + 0x24], edi
mov ebp, dword [esp + 0xec]
mov ebx, dword [esp + 0x20]
mov byte [esp + 0xe4], 7
cmp ebp, edi
jne 0x6474d9
mov dword [esp + 0x64], edi
mov eax, dword [ebx]
mov edx, dword [eax + 0x34]
lea ecx, [esp + 0x24]
push ecx
push edi
push ebx
mov byte [esp + 0xf0], 8
call edx
push edi
mov ebx, eax
mov byte [esp + 0xe8], 7
call esi
test ebx, ebx
jl 0x647571
mov eax, dword [esp + 0x24]
xor edi, edi
cmp eax, edi
je 0x647571
mov dword [esp + 0x5c], edi
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
push edx
push eax
mov eax, dword [ecx + 0x4c]
mov byte [esp + 0xec], 9
call eax
cmp eax, edi
jl 0x647559
mov dword [esp + 0x58], edi
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [ecx + 0x44]
mov byte [esp + 0xec], 0xa
call eax
cmp eax, edi
jl 0x647541
mov dword [esp + 0x54], edi
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push 1
push eax
mov eax, dword [ecx + 0x20]
mov byte [esp + 0xf0], 0xb
call eax
cmp eax, edi
jl 0x647529
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0xd8]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
cmp eax, edi
jl 0x647529
cmp dword [esp + 0xd8], edi
jne 0x647529
mov ecx, dword [esp + 0x54]
push ecx
lea ecx, [esp + 0x34]
call fcn.00646b40
mov eax, dword [esp + 0x30]
mov byte [esp + 0xe4], 0xc
cmp eax, edi
je 0x647513
push 0x830150
lea ecx, [esp + 0x4c]
call fcn.004b6660
push 0x830150
lea ecx, [esp + 0xc8]
mov byte [esp + 0xe8], 0xd
call fcn.004b6660
push 0x830150
lea ecx, [esp + 0x90]
mov byte [esp + 0xe8], 0xe
call fcn.004b6660
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0xf0]
mov bl, 0xf
push ebp
mov byte [esp + 0xe8], bl
call fcn.00513bc0
mov edi, dword [esp + 0xc4]
test eax, eax
jne 0x647339
mov ecx, dword [esp + 0xf0]
push edi
add ecx, 4
call fcn.00513bc0
test eax, eax
jne 0x647339
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0xf0]
push edx
add ecx, 8
call fcn.00513bc0
test eax, eax
je 0x6473ea
mov eax, dword [esp + 0xf0]
mov eax, dword [eax]
mov edi, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.004b6660
mov eax, dword [eax]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x2c]
push eax
push edi
mov byte [esp + 0xec], 0x10
call edx
mov eax, dword [esp + 0x14]
push eax
mov byte [esp + 0xe8], bl
call esi
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx + 4]
mov edi, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.004b6660
mov eax, dword [eax]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x3c]
push edi
mov byte [esp + 0xec], 0x11
call eax
mov ecx, dword [esp + 0x14]
push ecx
mov byte [esp + 0xe8], bl
call esi
mov edx, dword [esp + 0xf0]
mov eax, dword [edx + 8]
mov edi, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.004b6660
mov eax, dword [eax]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x34]
push eax
push edi
mov byte [esp + 0xec], 0x12
call edx
mov eax, dword [esp + 0x14]
push eax
mov byte [esp + 0xe8], bl
call esi
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x64]
mov dword [esp + 0x64], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jl 0x6474f8
or ebx, 0xffffffff
cmp word [esp + 0x64], bx
je 0x647422
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push ebx
push eax
call edx
mov eax, dword [esp + 0x8c]
push eax
mov dword [esp + 0x94], 1
call esi
push edi
call esi
push ebp
call esi
mov eax, dword [esp + 0x30]
mov byte [esp + 0xe4], 0xb
test eax, eax
je 0x647455
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x54]
mov byte [esp + 0xe4], 0xa
test eax, eax
je 0x64746d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x58]
mov byte [esp + 0xe4], 9
test eax, eax
je 0x647485
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x5c]
mov byte [esp + 0xe4], 7
test eax, eax
je 0x64749d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
mov byte [esp + 0xe4], 5
test eax, eax
je 0x6474b5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
mov byte [esp + 0xe4], 0
test eax, eax
je 0x6474cd
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xe4], ebx
jmp 0x6483d9
push ebp
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x64], edi
test edi, edi
jne 0x6471b0
push 0x8007000e
call fcn.004066b0
mov eax, dword [esp + 0x8c]
push eax
call esi
push edi
call esi
push ebp
call esi
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0xec]
xor edi, edi
mov byte [esp + 0xe4], 0xb
cmp eax, edi
je 0x647529
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x54]
mov byte [esp + 0xe4], 0xa
cmp eax, edi
je 0x647541
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x58]
mov byte [esp + 0xe4], 9
cmp eax, edi
je 0x647559
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x5c]
mov byte [esp + 0xe4], 7
cmp eax, edi
je 0x647571
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ebx, dword [esp + 0x20]
test ebp, ebp
jne 0x647581
xor edi, edi
mov dword [esp + 0x14], edi
jmp 0x64759e
push ebp
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jne 0x64759c
push 0x8007000e
call fcn.004066b0
xor ebp, ebp
mov eax, dword [ebx]
mov ecx, dword [eax + 0x3c]
push ebp
push edi
push ebx
mov byte [esp + 0xf0], 0x13
call ecx
push edi
call esi
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push eax
mov byte [esp + 0xf0], 0x14
call edx
cmp eax, ebp
jge 0x647641
mov eax, dword [esp + 0x1c]
mov byte [esp + 0xe4], 7
cmp eax, ebp
je 0x6475ed
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
mov byte [esp + 0xe4], 5
cmp eax, ebp
je 0x647605
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
mov byte [esp + 0xe4], 0
cmp eax, ebp
je 0x64761d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xe4], 0xffffffff
cmp eax, ebp
je 0x6483f6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x6483f6
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x647655
mov dword [esp + 0x18], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [ecx + 0x1c]
mov byte [esp + 0xec], 0x15
call eax
cmp eax, ebp
jge 0x647697
mov eax, dword [esp + 0x2c]
mov byte [esp + 0xe4], 0x14
cmp eax, ebp
je 0x6475d5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x6475d5
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x48]
push eax
call fcn.00646e20
add esp, 4
mov eax, dword [eax]
mov byte [esp + 0xe4], 0x16
cmp eax, ebp
jne 0x64778a
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x28]
push edi
push ebx
mov byte [esp + 0xec], 0x17
call edx
push edi
call esi
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xe4], 0x15
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6476fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx + 0xc]
mov ebx, dword [esp + 0x2c]
cmp eax, ebp
jne 0x6477a9
xor edi, edi
mov dword [esp + 0x14], edi
mov edx, dword [ebx]
mov eax, dword [edx + 0x20]
push edi
push ebx
mov byte [esp + 0xec], 0x18
call eax
push edi
mov byte [esp + 0xe8], 0x15
call esi
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x647748
mov dword [esp + 0x2c], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x28], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [ecx + 0x24]
mov byte [esp + 0xec], 0x19
call eax
cmp eax, ebp
jge 0x6477c8
mov eax, dword [esp + 0x28]
mov byte [esp + 0xe4], 0x15
cmp eax, ebp
je 0x647676
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x647676
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x6476c0
push 0x8007000e
call fcn.004066b0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647718
push 0x8007000e
call fcn.004066b0
mov dword [esp + 0x3c], ebp
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
lea edx, [esp + 0x3c]
push edx
push 9
push eax
mov eax, dword [ecx + 0x28]
mov byte [esp + 0xf0], 0x1a
call eax
mov ecx, dword [esp + 0x28]
mov edi, eax
mov eax, ecx
cmp ecx, ebp
je 0x647803
mov dword [esp + 0x28], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x28]
cmp edi, ebp
jge 0x647858
mov eax, dword [esp + 0x3c]
mov byte [esp + 0xe4], 0x19
cmp eax, ebp
je 0x647823
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x28]
mov byte [esp + 0xe4], 0x15
cmp ecx, ebp
je 0x647837
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
mov eax, dword [esp + 0x2c]
mov byte [esp + 0xe4], 0x14
cmp eax, ebp
je 0x6475d5
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x6475d5
mov edx, dword [esp + 0x3c]
xor eax, eax
mov dword [esp + 0x34], eax
cmp edx, ebp
je 0x647883
mov eax, dword [edx]
lea ecx, [esp + 0x34]
push ecx
push 0x80ef4c
push edx
mov edx, dword [eax]
call edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov byte [esp + 0xe4], 0x1b
cmp eax, ebp
jne 0x6478c4
mov byte [esp + 0xe4], 0x19
cmp edx, ebp
je 0x6478a7
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push edx
call ecx
mov ecx, dword [esp + 0x28]
mov byte [esp + 0xe4], 0x15
cmp ecx, ebp
je 0x647676
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
jmp 0x647676
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push 0xffffffffffffffff
push eax
call edx
mov ebx, dword [esp + 0x34]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x6478f1
push 0x8007000e
call fcn.004066b0
mov eax, dword [ebx]
mov ecx, dword [eax + 0x24]
push edi
push ebx
mov byte [esp + 0xec], 0x1c
call ecx
push edi
mov byte [esp + 0xe8], 0x1b
call esi
mov ebx, dword [esp + 0x34]
lea edx, [esp + 0x48]
push edx
call fcn.00646e60
add esp, 4
mov eax, dword [eax]
mov byte [esp + 0xe4], 0x1d
cmp eax, ebp
jne 0x647a49
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5c]
push edi
push ebx
mov byte [esp + 0xec], 0x1e
call ecx
push edi
call esi
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xe4], 0x1b
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x647972
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x8a14f8]
mov eax, dword [edx + 0xc]
mov ecx, 0x8a14f8
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx + 0x10]
cdq
mov ecx, 0x3c
idiv ecx
mov byte [esp + 0xe4], 0x1f
push edx
push eax
lea edx, [esp + 0x38]
push str.PT_dM_dS
push edx
call fcn.0040e430
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
add esp, 0x10
cmp eax, ebp
jne 0x647a68
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [ebx]
mov ecx, dword [eax + 0x54]
push edi
push ebx
mov byte [esp + 0xec], 0x20
call ecx
push edi
mov ebx, eax
mov byte [esp + 0xe8], 0x1f
call esi
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x6479ff
mov dword [esp + 0x34], ebp
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
cmp ebx, ebp
jge 0x647a87
lea ecx, [esp + 0x30]
call fcn.00405ef0
mov eax, dword [esp + 0x34]
mov byte [esp + 0xe4], 0x1a
cmp eax, ebp
je 0x647a28
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x3c]
mov byte [esp + 0xe4], 0x19
cmp eax, ebp
je 0x647769
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x647769
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647936
push 0x8007000e
call fcn.004066b0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x6479cd
push 0x8007000e
call fcn.004066b0
mov dword [esp + 0x38], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push eax
mov eax, dword [ecx + 0x44]
mov byte [esp + 0xec], 0x21
call eax
cmp eax, ebp
jge 0x647ac9
mov eax, dword [esp + 0x38]
mov byte [esp + 0xe4], 0x1f
cmp eax, ebp
je 0x647a07
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x647a07
mov dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push ebp
push eax
mov eax, dword [ecx + 0x30]
mov byte [esp + 0xf0], 0x22
call eax
mov edi, eax
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x647b01
mov dword [esp + 0x38], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x38]
cmp edi, ebp
mov ecx, dword [esp + 0x4c]
jge 0x647b3e
mov byte [esp + 0xe4], 0x21
cmp ecx, ebp
je 0x647b21
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
mov eax, dword [esp + 0x38]
mov byte [esp + 0xe4], 0x1f
cmp eax, ebp
je 0x647a07
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x647a07
xor ebx, ebx
mov dword [esp + 0x44], ebx
cmp ecx, ebp
je 0x647b65
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0x80ef3c
push ecx
call eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x44]
mov byte [esp + 0xe4], 0x23
cmp ebx, ebp
jne 0x647b8e
mov byte [esp + 0xe4], 0x21
cmp ecx, ebp
je 0x647aac
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
jmp 0x647aa8
mov eax, dword [esp + 0xf0]
mov eax, dword [eax]
cmp eax, ebp
jne 0x647c9f
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x2c]
push edi
push ebx
mov byte [esp + 0xec], 0x24
call edx
push edi
mov byte [esp + 0xe8], 0x23
call esi
mov eax, dword [esp + 0xf0]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x44]
cmp eax, ebp
jne 0x647cbe
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x3c]
push edi
push ebx
mov byte [esp + 0xec], 0x25
call edx
push edi
mov byte [esp + 0xe8], 0x23
call esi
mov eax, dword [esp + 0xf0]
mov eax, dword [eax + 8]
mov ebx, dword [esp + 0x44]
cmp eax, ebp
jne 0x647cdd
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x34]
push edi
push ebx
mov byte [esp + 0xec], 0x26
call edx
push edi
call esi
mov dword [esp + 0x50], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
push edx
push eax
mov eax, dword [ecx + 0x3c]
mov byte [esp + 0xec], 0x27
call eax
cmp eax, ebp
jge 0x647cfc
mov eax, dword [esp + 0x50]
mov byte [esp + 0xe4], 0x23
cmp eax, ebp
je 0x647c66
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x44]
mov byte [esp + 0xe4], 0x22
cmp eax, ebp
je 0x647c7e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x4c]
mov byte [esp + 0xe4], 0x21
cmp eax, ebp
je 0x647aa8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x647aa8
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647ba5
push 0x8007000e
call fcn.004066b0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647bdd
push 0x8007000e
call fcn.004066b0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647c15
push 0x8007000e
call fcn.004066b0
mov ebx, dword [esp + 0x50]
lea eax, [esp + 0x48]
push eax
call fcn.00646e20
add esp, 4
mov eax, dword [eax]
mov byte [esp + 0xe4], 0x28
cmp eax, ebp
jne 0x647d80
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x20]
push edi
push ebx
mov byte [esp + 0xec], 0x29
call edx
push edi
call esi
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xe4], 0x27
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x647d5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x50]
push str.BUILTINAdministrators
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647d9b
push 0x8007000e
call fcn.004066b0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647d21
push 0x8007000e
call fcn.004066b0
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x40]
push edi
push ebx
mov byte [esp + 0xec], 0x2a
call edx
push edi
mov byte [esp + 0xe8], 0x27
call esi
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push 1
push eax
call edx
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x647dd9
mov dword [esp + 0x44], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push eax
mov eax, dword [ecx + 0x2c]
mov byte [esp + 0xec], 0x2b
call eax
cmp eax, ebp
mov eax, dword [esp + 0x40]
jge 0x647e1b
mov byte [esp + 0xe4], 0x27
cmp eax, ebp
je 0x647c4e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x647c4e
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push ebp
push eax
call edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push ebp
push eax
call edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push ebp
push eax
call edx
mov ebx, dword [esp + 0x40]
push str.PT0S
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebp
jne 0x647e61
push 0x8007000e
call fcn.004066b0
mov eax, dword [ebx]
mov ecx, dword [eax + 0x70]
push edi
push ebx
mov byte [esp + 0xec], 0x2c
call ecx
push edi
call esi
mov dword [esp + 0x60], ebp
mov eax, dword [esp + 0x40]
mov edx, dword [eax]
mov edx, dword [edx + 0x9c]
lea ecx, [esp + 0x60]
push ecx
push eax
mov byte [esp + 0xec], 0x2d
call edx
cmp eax, ebp
jl 0x647ea6
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x647eba
mov dword [esp + 0x40], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x78], ebp
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0xb4]
push eax
call edi
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xbc]
mov eax, dword [esp + 0xc0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xc8]
push ecx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], eax
call edi
mov eax, dword [esp + 0xcc]
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0xd4]
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0xe8], 0x30
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], edx
call fcn.00646e20
add esp, 4
mov edi, dword [eax]
lea edx, [esp + 0x68]
xor ecx, ecx
push edx
mov byte [esp + 0xe8], 0x31
mov word [esp + 0x6c], cx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 8
push edi
mov word [esp + 0x6c], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x70], eax
cmp eax, ebp
jne 0x647fa8
cmp edi, ebp
je 0x647fa8
mov ecx, 0xa
push 0x8007000e
mov word [esp + 0x6c], cx
mov dword [esp + 0x74], 0x8007000e
call fcn.004066b0
cmp dword [esp + 0xec], 0
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x94], edx
mov edx, dword [esp + 0x74]
mov byte [esp + 0xe4], 0x32
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], edx
jne 0x648231
xor edi, edi
mov dword [esp + 0x14], edi
lea edx, [esp + 0x78]
push edx
mov edx, dword [esp + 0xac]
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], edx
mov edx, dword [esp + 0xc0]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xc4]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x90]
push 3
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0xa8]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xac]
mov ecx, dword [ebp]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xb0]
mov ecx, dword [ecx + 0x44]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0xbc]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0xd0]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xd4]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xd8]
push 6
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x58]
push eax
push edi
push ebp
mov byte [esp + 0x12c], 0x33
call ecx
push edi
mov ebx, eax
call esi
lea edx, [esp + 0x68]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xe4], 0x30
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6480c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xc8]
push ecx
call esi
lea edx, [esp + 0xb4]
push edx
call esi
mov eax, dword [esp + 0x78]
mov byte [esp + 0xe4], 0x2d
test ebx, ebx
jge 0x648257
test eax, eax
je 0x6480ff
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x60]
mov byte [esp + 0xe4], 0x2b
test eax, eax
je 0x648117
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x40]
mov byte [esp + 0xe4], 0x27
test eax, eax
je 0x64812f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x50]
mov byte [esp + 0xe4], 0x23
test eax, eax
je 0x648147
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x44]
mov byte [esp + 0xe4], 0x22
test eax, eax
je 0x64815f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x4c]
mov byte [esp + 0xe4], 0x21
test eax, eax
je 0x648177
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x38]
mov byte [esp + 0xe4], 0x1f
test eax, eax
je 0x64818f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x30]
call fcn.00405ef0
mov eax, dword [esp + 0x34]
mov byte [esp + 0xe4], 0x1a
test eax, eax
je 0x6481b0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x3c]
mov byte [esp + 0xe4], 0x19
test eax, eax
je 0x6481c8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
mov byte [esp + 0xe4], 0x15
test eax, eax
je 0x6481e0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x2c]
mov byte [esp + 0xe4], 0x14
test eax, eax
je 0x6481f8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
mov byte [esp + 0xe4], 7
test eax, eax
je 0x648210
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
mov byte [esp + 0xe4], 5
test eax, eax
je 0x64714f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x64714f
mov eax, dword [esp + 0xec]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jne 0x647ff0
push 0x8007000e
call fcn.004066b0
mov dword [esp + 0x90], 1
test eax, eax
je 0x64826e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x60]
mov byte [esp + 0xe4], 0x2b
test eax, eax
je 0x648286
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x40]
mov byte [esp + 0xe4], 0x27
test eax, eax
je 0x64829e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x50]
mov byte [esp + 0xe4], 0x23
test eax, eax
je 0x6482b6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x44]
mov byte [esp + 0xe4], 0x22
test eax, eax
je 0x6482ce
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x4c]
mov byte [esp + 0xe4], 0x21
test eax, eax
je 0x6482e6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x38]
mov byte [esp + 0xe4], 0x1f
test eax, eax
je 0x6482fe
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xe4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x648326
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
mov byte [esp + 0xe4], 0x1a
test eax, eax
je 0x64833e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x3c]
mov byte [esp + 0xe4], 0x19
test eax, eax
je 0x648356
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
mov byte [esp + 0xe4], 0x15
test eax, eax
je 0x64836e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x2c]
mov byte [esp + 0xe4], 0x14
test eax, eax
je 0x648386
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
mov byte [esp + 0xe4], 7
test eax, eax
je 0x64839e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
mov byte [esp + 0xe4], 5
test eax, eax
je 0x6483b6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
mov byte [esp + 0xe4], 0
test eax, eax
je 0x6483ce
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xe4], 0xffffffff
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6483e9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push str.LDS_GAMECENTER
call fcn.006464e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0xdc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret