Function at 0x10001e52
Capabilities:
Query environment variable
Schedule task via itaskservice

Disassembly:
push 8
push 0x2d8
mov eax, 0x1001acb0
call fcn.1001aada
xor edi, edi
mov dword [ebp - 4], 2
push edi
mov dword [ebp - 0x244], edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x244]
xor esi, esi
push eax
push 0x1001b1f0
inc esi
push esi
push edi
push 0x1001b200
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x10001eb1
push eax
push str.Failed_to_create_an_instance_of_ITaskService:__x
call fcn.1000105f
pop ecx
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1000261e
lea eax, [ebx + 8]
push eax
lea ecx, [ebp - 0x238]
call fcn.1000272a
xor eax, eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x224], 7
lea edi, [ebp - 0x220]
mov ecx, 0x82
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [ebp - 0x220]
lea eax, [ebp - 0x238]
cmova eax, dword [ebp - 0x238]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x220]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10001f05
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.100027d1
mov eax, dword [ebp - 0x244]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x2a8]
lea edi, [ebp - 0x2b8]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x298]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x298]
lea edi, [ebp - 0x2c8]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2e8]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x2e8]
lea edi, [ebp - 0x2d8]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x288]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 7
lea esi, [ebp - 0x2b8]
sub esp, 0x10
mov edi, esp
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x2c8]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x2d8]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x288]
push dword [ebp - 0x244]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x26c]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, eax
lea eax, [ebp - 0x288]
push eax
call esi
lea eax, [ebp - 0x2e8]
push eax
call esi
lea eax, [ebp - 0x298]
push eax
call esi
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 3
push eax
call esi
test edi, edi
jns 0x10002034
push edi
push str.ITaskService::Connect_failed:__x
call fcn.1000105f
mov eax, dword [ebp - 0x244]
pop ecx
pop ecx
jmp 0x100025cf
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x26c]
xor edi, edi
mov dword [ebp - 0x240], edi
push 0x10020fac
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.100011c4
push 8
pop ecx
mov byte [ebp - 4], cl
mov eax, dword [eax]
test eax, eax
je 0x10002067
mov eax, dword [eax]
jmp 0x10002069
mov eax, edi
lea ecx, [ebp - 0x240]
push ecx
push eax
push dword [ebp - 0x244]
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.10001230
test esi, esi
jns 0x10002096
push esi
push str.Cannot_get_Root_Folder_pointer:__x
jmp 0x10002022
mov ecx, dword [ebp - 0x244]
lea edx, [ebp - 0x23c]
push edx
mov dword [ebp - 0x23c], edi
push edi
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
mov ecx, dword [ebp - 0x244]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x100020da
push esi
push str.Failed_to_create_a_task_definition:__x
call fcn.1000105f
mov eax, dword [ebp - 0x240]
pop ecx
pop ecx
jmp 0x100025cf
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x254]
mov dword [ebp - 0x254], edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
test eax, eax
jns 0x10002102
push eax
push str._nCannot_get_identification_pointer:__x
jmp 0x100025b6
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x26c]
push str.Microsoft_Onedrive
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
call fcn.100011c4
mov byte [ebp - 4], 9
mov eax, dword [eax]
test eax, eax
je 0x1000212b
mov eax, dword [eax]
jmp 0x1000212d
mov eax, edi
push eax
push dword [ebp - 0x254]
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.10001230
mov ecx, dword [ebp - 0x254]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x10002162
push esi
push str._nCannot_put_identification_info:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x250]
mov dword [ebp - 0x250], edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x2c]
test eax, eax
jns 0x1000218a
push eax
push str._nCannot_get_settings_pointer:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x250]
push 0xffffffffffffffff
push ecx
mov eax, dword [ecx]
call dword [eax + 0x58]
mov ecx, dword [ebp - 0x250]
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x40]
mov ecx, dword [ebp - 0x250]
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, dword [ebp - 0x250]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x100021cf
push esi
push str._nCannot_put_setting_info:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x258]
mov dword [ebp - 0x258], edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jns 0x100021f7
push eax
push str._nCannot_get_trigger_collection:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x258]
lea edx, [ebp - 0x25c]
push edx
mov dword [ebp - 0x25c], edi
push 7
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x258]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x1000222f
push esi
push str._nCannot_create_a_registration_trigger:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x25c]
lea edx, [ebp - 0x248]
push edx
mov dword [ebp - 0x248], edi
push 0x1001b1e0
mov eax, dword [ecx]
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x25c]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x10002269
push esi
push str._nQueryInterface_call_failed_on_IRegistrationTrigger:__x
jmp 0x100025b6
mov eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x26c]
push str.Trigger1
mov eax, dword [eax]
mov esi, dword [eax + 0x24]
call fcn.100011c4
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
test eax, eax
je 0x10002292
mov eax, dword [eax]
jmp 0x10002294
mov eax, edi
push eax
push dword [ebp - 0x248]
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.10001230
test esi, esi
jns 0x100022bf
push esi
push str._nCannot_put_trigger_ID:__x
call fcn.1000105f
pop ecx
pop ecx
mov eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x26c]
cmp dword [ebx + 0x4c], 7
mov eax, dword [eax]
mov esi, dword [eax + 0x54]
lea eax, [ebx + 0x38]
cmova eax, dword [ebx + 0x38]
push eax
call fcn.100011c4
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
test eax, eax
je 0x100022ef
mov eax, dword [eax]
jmp 0x100022f1
mov eax, edi
push eax
push dword [ebp - 0x248]
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.10001230
mov ecx, dword [ebp - 0x248]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x10002326
push esi
push str._nCannot_put_registration_trigger_delay:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x260]
mov dword [ebp - 0x260], edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jns 0x1000234e
push eax
push str._nCannot_get_Task_collection_pointer:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x260]
lea edx, [ebp - 0x264]
push edx
mov dword [ebp - 0x264], edi
push edi
mov eax, dword [ecx]
push ecx
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x260]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x10002385
push esi
push str._nCannot_create_action:__x
jmp 0x100025b6
mov ecx, dword [ebp - 0x264]
lea edx, [ebp - 0x24c]
push edx
mov dword [ebp - 0x24c], edi
push str.MbLk
mov eax, dword [ecx]
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x264]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x100023bf
push esi
push str._nQueryInterface_call_failed_for_IExecAction:__x
jmp 0x100025b6
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x26c]
cmp dword [ebp - 0x224], 7
mov eax, dword [eax]
mov esi, dword [eax + 0x2c]
lea eax, [ebp - 0x238]
cmova eax, dword [ebp - 0x238]
push eax
call fcn.100011c4
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
test eax, eax
je 0x100023f8
mov eax, dword [eax]
jmp 0x100023fa
mov eax, edi
push eax
push dword [ebp - 0x24c]
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.10001230
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x26c]
cmp dword [ebx + 0x34], 7
mov eax, dword [eax]
mov esi, dword [eax + 0x34]
lea eax, [ebx + 0x20]
cmova eax, dword [ebx + 0x20]
push eax
call fcn.100011c4
mov byte [ebp - 4], 0xd
mov eax, dword [eax]
test eax, eax
je 0x10002442
mov eax, dword [eax]
jmp 0x10002444
mov eax, edi
push eax
push dword [ebp - 0x24c]
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.10001230
mov ecx, dword [ebp - 0x24c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x10002479
push esi
push str._nCannot_put_the_action_executable_path:__x
jmp 0x100025b6
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x268], edi
push 8
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x270], eax
pop eax
push 0x10021238
mov word [ebp - 0x288], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x280], eax
test eax, eax
je 0x10002641
lea esi, [ebp - 0x288]
lea edi, [ebp - 0x2d8]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x298]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [ebp - 0x298]
lea edi, [ebp - 0x2c8]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2a8]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x2a8]
mov eax, dword [ebp - 0x23c]
lea edi, [ebp - 0x2b8]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x274]
push str.CLIManagementTask
mov dword [ebp - 0x26c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100011c4
mov byte [ebp - 4], 0x11
mov eax, dword [eax]
test eax, eax
je 0x1000252b
mov eax, dword [eax]
jmp 0x1000252f
xor esi, esi
mov eax, esi
lea ecx, [ebp - 0x268]
push ecx
sub esp, 0x10
lea esi, [ebp - 0x2d8]
mov edi, esp
push 3
movsd dword es:[edi], dword [esi]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x2c8]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x2b8]
push 6
push dword [ebp - 0x26c]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x240]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x270]
lea ecx, [ebp - 0x274]
mov esi, eax
call fcn.10001230
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x2a8]
push eax
call edi
lea eax, [ebp - 0x298]
push eax
call edi
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 3
push eax
call edi
test esi, esi
jns 0x100025e0
push esi
push str._nError_saving_the_Task_:__x
call fcn.1000105f
mov eax, dword [ebp - 0x240]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
inc esi
jmp 0x10002613
push str._n_Success__Task_successfully_registered.
call fcn.1000105f
mov eax, dword [ebp - 0x240]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x268]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov esi, eax
lea ecx, [ebp - 0x238]
call fcn.100027ab
lea ecx, [ebx + 8]
call fcn.100027ab
lea ecx, [ebx + 0x20]
call fcn.100027ab
lea ecx, [ebx + 0x38]
call fcn.100027ab
mov eax, esi
mov ecx, dword [ebp - 0x14]
call fcn.1001aab8
ret
push 0x8007000e
call fcn.10003000
int3