Function at 0x41a910
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], ecx
push eax
push 0x5461c0
push 1
push 0
push 0x5461a8
mov esi, edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41acaa
xor edx, edx
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov edi, dword [ecx]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov eax, esp
mov edi, dword [edi + 0x28]
sub esp, 0x10
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov eax, esp
sub esp, 0x10
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov eax, esp
push ecx
mov ecx, edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
call dword [0x4fe8dc]
call edi
test eax, eax
js 0x41ac97
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
mov edi, dword [eax]
mov edi, dword [edi + 0x20]
mov ecx, edi
call dword [0x4fe8dc]
call edi
test eax, eax
js 0x41ac97
mov eax, 0x16
lea edx, [ebp - 0x20]
mov word [ebp - 0x38], ax
mov eax, dword [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x1c]
mov ecx, edi
call dword [0x4fe8dc]
call edi
test eax, eax
js 0x41ac84
mov ebx, 1
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x20], ebx
jl 0x41ac84
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x38]
push eax
sub esp, 0x10
mov edi, dword [ecx]
mov eax, esp
push ecx
mov edi, dword [edi + 0x20]
mov ecx, edi
mov dword [eax], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edx
call dword [0x4fe8dc]
call edi
test eax, eax
js 0x41ac77
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x24]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push edx
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 0x38]
mov ecx, edi
call dword [0x4fe8dc]
call edi
test eax, eax
js 0x41ac64
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ecx + 0x10]
jne 0x41ac64
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x2c]
mov ecx, edi
call dword [0x4fe8dc]
call edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x24]
mov ecx, edi
call dword [0x4fe8dc]
call edi
mov edi, dword [0x5461e0]
mov ebx, dword [0x5461e4]
test edi, edi
je 0x41aae7
mov ecx, dword [esi + 4]
mov eax, ecx
mov edx, dword [ecx]
add edx, edi
cmp dword [esi], edx
jae 0x41aac0
mov ecx, esi
call fcn.004a80b0
mov ecx, dword [esi + 4]
mov eax, ecx
test ebx, ebx
je 0x41aad7
mov eax, dword [ecx + 4]
add eax, dword [ecx]
push edi
push ebx
push eax
call fcn.004dd620
mov eax, dword [esi + 4]
add esp, 0xc
add dword [eax], edi
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov word [ecx + eax], dx
mov eax, dword [ebp - 8]
mov ebx, str.Unknown_action
test eax, eax
cmovne ebx, eax
push ebx
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x1c], eax
je 0x41ab47
mov edi, dword [esi + 4]
mov ecx, edi
mov edx, dword [edi]
add edx, eax
cmp dword [esi], edx
jae 0x41ab1d
mov ecx, esi
call fcn.004a80b0
mov edi, dword [esi + 4]
mov ecx, edi
mov eax, dword [ebp - 0x1c]
test ebx, ebx
je 0x41ab34
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push ebx
push eax
call fcn.004dd620
mov ecx, dword [esi + 4]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
add dword [ecx], eax
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov word [ecx + eax], dx
push 0x525c40
call sym.ProcessHacker.exe_PhCountStringZ
mov edi, eax
add edi, edi
je 0x41ab96
mov eax, dword [esi + 4]
mov ecx, dword [eax]
lea edx, [ecx + edi]
cmp dword [esi], edx
jae 0x41ab6f
mov ecx, esi
call fcn.004a80b0
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push edi
add eax, ecx
push 0x525c40
push eax
call fcn.004dd620
mov eax, dword [esi + 4]
add esp, 0xc
add dword [eax], edi
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov word [ecx + eax], dx
mov eax, dword [ebp - 0xc]
mov ebx, str.Unknown_path
test eax, eax
cmovne ebx, eax
push ebx
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x1c], eax
je 0x41abf6
mov edi, dword [esi + 4]
mov ecx, edi
mov edx, dword [edi]
add edx, eax
cmp dword [esi], edx
jae 0x41abcc
mov ecx, esi
call fcn.004a80b0
mov edi, dword [esi + 4]
mov ecx, edi
mov eax, dword [ebp - 0x1c]
test ebx, ebx
je 0x41abe3
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push ebx
push eax
call fcn.004dd620
mov ecx, dword [esi + 4]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
add dword [ecx], eax
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov word [ecx + eax], dx
push 0x525c48
call sym.ProcessHacker.exe_PhCountStringZ
mov edi, eax
add edi, edi
je 0x41ac45
mov eax, dword [esi + 4]
mov ecx, dword [eax]
lea edx, [ecx + edi]
cmp dword [esi], edx
jae 0x41ac1e
mov ecx, esi
call fcn.004a80b0
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push edi
add eax, ecx
push 0x525c48
push eax
call fcn.004dd620
mov eax, dword [esi + 4]
add esp, 0xc
add dword [eax], edi
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov word [ecx + eax], dx
mov eax, dword [ebp - 8]
test eax, eax
je 0x41ac53
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41ac61
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x4fe8dc]
call edi
inc ebx
mov dword [ebp - 0x10], ebx
cmp ebx, dword [ebp - 0x20]
jle 0x41a9f5
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4fe8dc]
call esi
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4fe8dc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret