Function at 0x4c6cf7
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push 0x1f4
mov eax, 0x511eca
call fcn.004f41e2
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x14]
push str._NetSchedulerTask_
mov dword [ebp - 0x1f0], edi
mov dword [ebp - 0x1e8], eax
call fcn.004f3dc9
push edi
lea ecx, [ebx + 0x10]
call fcn.004f3dc9
push dword [ebp - 0x1e8]
lea ecx, [ebx + 0x14]
call fcn.004f3dc9
push esi
lea ecx, [ebx + 0x18]
call fcn.004f3dc9
cmp byte [ebp + 8], 0
jne 0x4c6d63
push str.TaskScheduler_v1.0_must_not_be_user_to_run_process_demoted_
jmp 0x4c6fec
mov ecx, dword [0x5a23ec]
push 1
call fcn.004673c5
test eax, eax
je 0x4c6dd1
push 0x521e20
push esi
push str.__Dir:__
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x184]
push str.___Args:
push edi
push str.___Exe:__
push dword [ebp - 0x1ec]
push str.Scheduler:_Creating_Task:__
call fcn.004e2531
and dword [ebp - 4], 0
lea ecx, [ebp - 0x184]
push 1
push 1
call fcn.0044612f
push eax
call fcn.00421c79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x184]
add esp, 0xc
call fcn.004e25e0
push 8
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4c6df8
push str.Netapi32.dll
mov ecx, eax
call fcn.004e3fe7
jmp 0x4c6dfa
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx + 0x28], eax
test eax, eax
je 0x4c6fe7
lea ecx, [ebx + 0x2c]
push ecx
push str.NetScheduleJobAdd
mov ecx, eax
call fcn.00401080
test al, al
je 0x4c6fe7
mov ecx, dword [ebx + 0x28]
lea eax, [ebx + 0x30]
push eax
push str.NetScheduleJobDel
call fcn.00401080
test al, al
je 0x4c6fe7
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebx + 4], eax
test eax, eax
jns 0x4c6e55
push str.CoInitializeEx_failed.
jmp 0x4c6fec
lea esi, [ebx + 0x1c]
mov byte [ebx + 8], 1
push esi
push 0x562c6c
push 1
push 0
push 0x562c8c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebx + 4], eax
test eax, eax
jns 0x4c6e82
push str.Failed_to_CoCreate_an_instance_of_the_TaskService_class.
jmp 0x4c6fec
xor eax, eax
lea edi, [ebp - 0x200]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1e0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x1e8]
push 0x524d94
push dword [ebp - 0x1f0]
push 0x524d9c
call fcn.004e2531
mov eax, dword [ebp - 0x1e0]
or dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x1f4], eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x200]
mov dword [ebp - 4], 2
push eax
push edi
call dword [ebx + 0x2c]
test eax, eax
je 0x4c6f1d
push eax
lea eax, [ebp - 0x128]
push str.NetScheduleJobAdd_failed__rc_u
push eax
call fcn.00403213
add esp, 0xc
or dword [ebx + 4], 0xffffffff
lea eax, [ebp - 0x128]
mov ecx, ebx
push eax
call fcn.004c78a3
lea ecx, [ebp - 0x1e0]
call fcn.004e25e0
jmp 0x4c6ff3
push dword [ebp - 0x1e4]
lea eax, [ebp - 0x38]
push str.At_u
push eax
call fcn.004010d8
add esp, 0xc
lea eax, [ebp - 0x38]
lea ecx, [ebx + 0xc]
push eax
call fcn.004f3dc9
push dword [ebp - 0x1e4]
lea eax, [ebp - 0x128]
push str.Scheduler:_NetScheduleJobAdd_succeeded__jobId_u
push eax
call fcn.00403213
push 1
lea eax, [ebp - 0x128]
push 1
push eax
call fcn.00421c79
lea edi, [ebx + 0x20]
add esp, 0x18
mov ecx, dword [edi]
test ecx, ecx
je 0x4c6f7c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [edi], 0
mov esi, dword [esi]
test esi, esi
je 0x4c6f9b
mov esi, dword [esi]
lea ecx, [ebx + 0xc]
push edi
push 0x562c5c
call fcn.0044612f
push eax
push dword [ebx + 0x1c]
call dword [esi + 0x18]
jmp 0x4c6fa0
mov eax, 0x80004003
mov dword [ebx + 4], eax
test eax, eax
js 0x4c6fb0
cmp dword [edi], 0
jne 0x4c6f0d
push dword [ebp - 0x1e4]
lea eax, [ebp - 0x128]
push str.NetScheduleJobAdd_succeeded__jobId_u__but_ITask_is_not_found
push eax
call fcn.00403213
add esp, 0xc
push dword [ebp - 0x1e4]
push dword [ebp - 0x1e4]
push 0
call dword [ebx + 0x30]
or dword [ebp - 0x1e4], 0xffffffff
jmp 0x4c6eff
push str.Failed_to_initialize_Netapi32_library_
mov ecx, ebx
call fcn.004c78a3
mov eax, dword [ebx + 4]
call fcn.004f418c
ret 0x14