Function at 0x100870b0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x18]
push 0x208
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x21c], 0
call fcn.1008da10
add esp, 0xc
test esi, esi
je 0x10087411
test ebx, ebx
je 0x10087411
call sym.XNewLookSch.dll_bool___cdecl_LEnvironment::IsXP_void_
test al, al
je 0x10087411
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x21c]
push eax
push 0x100e05d0
push 1
push 0
push 0x100e05f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1008725b
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
push edi
push edx
push 0x100e05c0
push 0x100e05e0
mov dword [ebp - 0x218], 0
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
jns 0x10087284
mov eax, dword [ebp - 0x21c]
cmp edi, 0x80070050
jne 0x1008726b
lea edx, [ebp - 0x218]
mov dword [ebp - 0x210], 0
mov ecx, dword [eax]
push edx
push 0x100e05c0
push esi
push eax
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
js 0x10087209
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x210]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edi, eax
test edi, edi
js 0x10087209
mov eax, dword [ebp - 0x210]
cmp eax, 0x41301
je 0x100873fe
cmp eax, 0x41300
je 0x100873fe
cmp eax, 0x41303
je 0x100873fe
mov eax, dword [ebp - 0x21c]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
jns 0x10087228
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
push edx
push 0x100e05c0
push 0x100e05e0
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
jns 0x10087284
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x218]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov esi, eax
test esi, esi
js 0x10087332
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100964eb
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov esi, eax
test esi, esi
js 0x10087332
mov edx, dword [ebp - 0x228]
test edx, edx
je 0x100872fc
mov eax, dword [ebp - 0x218]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov esi, eax
test esi, esi
js 0x10087332
mov eax, dword [ebp - 0x218]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov esi, eax
test esi, esi
js 0x10087332
mov edx, dword [ebp - 0x22c]
test edx, edx
je 0x1008733d
mov eax, dword [ebp - 0x218]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov esi, eax
test esi, esi
jns 0x1008733d
mov ecx, dword [ebp - 0x218]
jmp 0x10087252
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x220]
push edx
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x10087363
mov eax, dword [ebp - 0x218]
jmp 0x100873dc
mov eax, dword [ebp - 0x220]
push dword [ebp - 0x230]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
jns 0x1008738d
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x220]
jmp 0x100873dc
lea edx, [ebp - 0x224]
push edx
push 0x100e2824
push eax
call dword [ecx]
mov eax, dword [ebp - 0x224]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
jns 0x100873fe
push eax
push str.Failed_calling_IPersistFile::Save:_error__0x_x_n
call fcn.1006d430
mov eax, dword [ebp - 0x218]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
xor ecx, ebp
pop ebx
call fcn.1008bffe
mov esp, ebp
pop ebp
ret