Function at 0x4c31c1
Capabilities:
Schedule task via itaskservice

Disassembly:
push 0x9c
mov eax, 0x512ed1
call fcn.005060cc
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
push eax
push 0x519fa8
push 1
push ecx
push 0x51a1b8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x2c]
or ebx, 0xffffffff
test ecx, ecx
je 0x4c36c1
test eax, eax
js 0x4c36c1
lea ecx, [ebp - 0x40]
call fcn.004c29ee
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0x40]
test esi, esi
jne 0x4c3226
xor edi, edi
jmp 0x4c36ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4c3242
push eax
call fcn.004f5d90
pop ecx
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x4c3246
xor eax, eax
jmp 0x4c325b
lea eax, [edi + edi]
call fcn.004f0800
mov edx, dword [ebp - 0x14]
mov ecx, esp
push 0
push edi
call fcn.00407760
mov ecx, dword [esi]
push 0
push eax
push esi
call dword [ecx + 0x3c]
and dword [ebp - 0x1c], 0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4c369e
test eax, eax
js 0x4c369e
and dword [ebp - 0x44], 0
mov byte [ebp - 4], 7
lea edx, [ebp - 0x44]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x24]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x4c3689
test eax, eax
js 0x4c3689
and dword [ebp - 0x28], 0
push 8
pop eax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], al
mov eax, dword [ecx]
push edx
push 9
push ecx
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4c3674
test eax, eax
js 0x4c3674
push 0x51e784
lea ecx, [ebp + 0x14]
call fcn.0040d992
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
je 0x4c334f
mov eax, dword [ebp - 0x28]
xor esi, esi
mov dword [ebp - 0x14], esi
test eax, eax
je 0x4c331a
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x5618a4
push eax
call dword [ecx]
mov esi, dword [ebp - 0x14]
xor ecx, ecx
test eax, eax
cmovs esi, ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 9
test esi, esi
je 0x4c3341
push dword [ebp + 0x14]
lea ecx, [ebp - 0x24]
call fcn.004c49b1
mov byte [ebp - 4], 0xa
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x54]
push dword [ebp - 0x24]
call edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 8
test esi, esi
je 0x4c334f
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor esi, esi
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x4c365a
test eax, eax
js 0x4c365a
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0x38]
mov byte [ebp - 4], 0xc
mov eax, dword [ecx]
push edx
push esi
push ecx
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x4c3645
test eax, eax
js 0x4c3645
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], esi
mov eax, dword [ecx]
push edx
push str.MbLk
push ecx
call dword [eax]
mov esi, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
cmovs esi, ecx
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0xd
test esi, esi
jne 0x4c33ca
xor edi, edi
jmp 0x4c3632
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
call fcn.004c49b1
mov byte [ebp - 4], 0xe
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x2c]
mov byte [ebp - 4], 0xd
push dword [ebp - 0x24]
call edi
push dword [ebp + 0x10]
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
call fcn.004c49b1
mov byte [ebp - 4], 0xf
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x34]
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x30], 0
je 0x4c3448
and dword [ebp - 0x14], 0
mov byte [ebp - 4], pe_nt_image_headers32
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4c34a3
test eax, eax
js 0x4c34a3
mov eax, dword [ecx]
push 1
push ecx
call dword [eax + 0x48]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4c3448
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x18], 0
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4c361f
test eax, eax
js 0x4c361f
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x48]
mov eax, dword [ebp - 0x18]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x18]
push str.PT7200H
mov dword [ebp - 0x30], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x4c3754
jmp 0x4c34b8
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x4c34b1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
xor edi, edi
jmp 0x4c362f
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x30]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x70]
push esi
mov byte [ebp - 4], 0x11
call edi
mov eax, dword [ebp - 0x18]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
and dword [ebp - 0x34], 0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x9c]
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4c360a
test eax, eax
js 0x4c360a
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x30]
and dword [ebp - 0x48], 0
push 8
pop eax
mov byte [ebp - 4], 0x14
push 0x51e7cc
mov word [ebp - 0x58], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x4c375e
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x58]
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x78]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call ebx
lea esi, [ebp - 0x78]
lea edi, [ebp - 0x98]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x68]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call ebx
mov byte [ebp - 4], 0x17
lea esi, [ebp - 0x68]
push dword [ebp + 8]
lea edi, [ebp - 0xa8]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004c49b1
mov byte [ebp - 4], 0x18
lea esi, [ebp - 0x48]
push esi
sub esp, 0x10
mov ecx, dword [eax]
mov edi, esp
mov eax, dword [ebp - 0x40]
lea esi, [ebp - 0x88]
push 0
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x98]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0xa8]
push 6
push dword [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push ecx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [edx + 0x44]
push dword [ebp - 0x30]
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x68]
push eax
call esi
lea eax, [ebp - 0x78]
push eax
call esi
lea eax, [ebp - 0x58]
push eax
call esi
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x4c35f2
test edi, edi
js 0x4c35f2
xor edi, edi
inc edi
jmp 0x4c35f4
xor edi, edi
mov byte [ebp - 4], 0x13
test eax, eax
je 0x4c3602
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x34]
or ebx, 0xffffffff
jmp 0x4c360c
xor edi, edi
mov byte [ebp - 4], 0x11
test ecx, ecx
je 0x4c361a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x18]
jmp 0x4c3621
xor edi, edi
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x4c362f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [ebp - 0x20]
mov byte [ebp - 4], 0xc
test esi, esi
je 0x4c3640
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x38]
jmp 0x4c3647
mov edi, esi
mov byte [ebp - 4], 0xb
test ecx, ecx
je 0x4c3655
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x3c]
jmp 0x4c365c
mov edi, esi
push 8
pop eax
mov byte [ebp - 4], al
test ecx, ecx
je 0x4c366c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x40]
jmp 0x4c3676
xor edi, edi
mov byte [ebp - 4], 7
test ecx, ecx
je 0x4c3684
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x44]
jmp 0x4c368b
xor edi, edi
mov byte [ebp - 4], 6
test ecx, ecx
je 0x4c3699
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
jmp 0x4c36a0
xor edi, edi
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4c36ae
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 4
test esi, esi
je 0x4c36bc
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x2c]
jmp 0x4c36c3
xor edi, edi
mov byte [ebp - 4], 3
test ecx, ecx
je 0x4c36d1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c36ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c370d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp + 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c372b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4c3746
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
lea esp, [ebp - 0xb8]
call fcn.00506076
ret
push 0x8007000e
call fcn.00409844
push 0x8007000e
call fcn.004efb80
int3