Function at 0x467ad0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49477e
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4ad1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0x80010119
je 0x467b2f
test eax, eax
je 0x467b2f
xor eax, eax
jmp 0x467d9a
mov dword [ebp - 0x70], 0
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
push 0x4977dc
push 1
push 0
push 0x4977fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x467b60
xor esi, esi
jmp 0x467d84
mov eax, dword [ebp - 0x70]
push dword [esi + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x70]
mov ebx, dword [esi + 4]
push edx
push 0x4977cc
mov ecx, dword [eax]
push 0x4977ec
push ebx
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x467d71
mov eax, dword [esi]
mov edi, dword [ebp - 0x58]
cmp dword [eax - 4], 1
jle 0x467baf
push dword [eax - 0xc]
mov ecx, esi
call fcn.00403a80
push dword [esi]
mov eax, dword [edi]
push edi
call dword [eax + 0x80]
test eax, eax
js 0x467d71
mov eax, dword [ebp - 0x58]
push dword [esi + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
test eax, eax
js 0x467d71
mov eax, dword [ebp - 0x58]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
test eax, eax
js 0x467d71
mov eax, dword [ebp - 0x58]
push 0
push 0x49cf5c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
test eax, eax
js 0x467d71
cmp dword [esi + 0x24], 0
mov edi, 0x30
je 0x467c8a
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x58]
push edx
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x467d60
push edi
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004760a0
mov eax, 0x7cf
mov word [ebp - 0x50], di
mov word [ebp - 0x4c], ax
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x54]
add esp, 0xc
mov dword [ebp - 0x4a], 0x10001
mov dword [ebp - 0x30], 7
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x467d60
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x467c86
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
cmp dword [esi + 0x28], 0
mov edi, dword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
je 0x467e9a
lea eax, [ebp - 0x80]
mov dword [ebp - 0x68], 0
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
push str._d__d:_d:_d
push dword [esi + 0x1c]
call fcn.00467660
add esp, 0x18
test eax, eax
jle 0x467e9a
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x58]
push edx
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x467f3b
push 0x30
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004760a0
add esp, 0xc
push 0
call fcn.004829ed
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edx
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x64]
movsd qword [ebp - 0x64], xmm0
push eax
call fcn.004677a0
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x20], ax
movq qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x467db6
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x467db6
mov ax, word [ebp - 0x1a]
jmp 0x467dbb
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x467d71
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x467d84
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x31
mov ecx, dword [ebp - 0x70]
test ecx, ecx
je 0x467d98
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047137e
mov esp, ebp
pop ebp
ret
mov eax, 0xffff
mov word [ebp - 0x48], ax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x1e], xmm0
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x467df7
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x467df7
mov ax, word [ebp - 0x1e]
jmp 0x467dfc
mov eax, 0xffff
mov word [ebp - 0x4a], ax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x1e], xmm0
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x467e38
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x467e38
mov ax, word [ebp - 0x20]
jmp 0x467e3d
mov eax, 0xffff
mov word [ebp - 0x4c], ax
lea edx, [ebp - 0x50]
mov eax, 0x30
mov dword [ebp - 0x30], 1
mov word [ebp - 0x50], ax
movzx eax, word [ebp - 0x78]
mov word [ebp - 0x40], ax
movzx eax, word [ebp - 0x7c]
mov word [ebp - 0x3e], ax
movzx eax, word [ebp - 0x68]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], 0x5a0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
js 0x467f3b
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x467e96
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
cmp dword [esi + 0x2c], 0
je 0x468146
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0x1d
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x58]
push edx
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x468193
push 0x30
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004760a0
add esp, 0xc
push 0
call fcn.004829ed
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edx
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x64]
movsd qword [ebp - 0x64], xmm0
push eax
call fcn.004677a0
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x20], ax
movq qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x467f44
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x467f44
mov ax, word [ebp - 0x1a]
jmp 0x467f49
mov byte [ebp - 4], 0x19
jmp 0x467d64
mov eax, 0xffff
mov word [ebp - 0x48], ax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x1e], xmm0
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x467f85
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x467f85
mov ax, word [ebp - 0x1e]
jmp 0x467f8a
mov eax, 0xffff
mov word [ebp - 0x4a], ax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x1e], xmm0
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x467fc6
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x467fc6
mov ax, word [ebp - 0x20]
jmp 0x467fcb
mov eax, 0xffff
mov word [ebp - 0x4c], ax
xorps xmm0, xmm0
mov eax, 0x30
movq qword [ebp - 0x1e], xmm0
mov word [ebp - 0x50], ax
xor eax, eax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x468010
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x468010
mov ax, word [ebp - 0x18]
jmp 0x468015
mov eax, 0xffff
mov word [ebp - 0x40], ax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x1e], xmm0
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp - 0x5c], eax
jne 0x468051
movsd xmm0, qword [ebp - 0x64]
lea eax, [ebp - 0x20]
push eax
sub esp, 8
movsd qword [esp], xmm0
call edi
cmp eax, 1
jne 0x468051
mov ax, word [ebp - 0x16]
jmp 0x468056
mov eax, 0xffff
mov ecx, dword [esi + 0x18]
sub ecx, 0x10
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x3c], 0x5a0
call fcn.004049a0
lea esi, [eax + 0x10]
mov dword [ebp - 0x68], esi
mov byte [ebp - 4], 0x21
cmp dword [esi - 4], 1
jle 0x468091
push dword [esi - 0xc]
lea ecx, [ebp - 0x68]
call fcn.00403a80
mov esi, dword [ebp - 0x68]
push esi
call fcn.0047a449
add esp, 4
mov byte [ebp - 4], 0x1d
mov edi, eax
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4680b8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0xc22e4507
imul edi
mov eax, 0xc22e4507
add edx, edi
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, 0x28de80
cmp ecx, 0x1f
cmovg edi, edx
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4680f6
mov ecx, 1
mov word [ebp - 0x2c], cx
jmp 0x4680fa
mov word [ebp - 0x2c], ax
cmp edi, 0x15180
jle 0x46810a
imul eax, eax, 0xfffeae80
add edi, eax
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x54]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
js 0x468193
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x468142
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x70]
push dword [ebp - 0x58]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x467d71
mov dword [ebp - 0x74], 0
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x58]
push edx
push 0x495330
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x46819c
mov eax, dword [ebp - 0x74]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x46819c
mov esi, 1
jmp 0x46819e
mov byte [ebp - 4], 0x22
jmp 0x467d64
xor esi, esi
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x467d73
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x467d73