Function at 0x41e482
Capabilities:
Resolve function by parsing pe exports
Schedule task via itaskscheduler

Disassembly:
push 0x2c
mov eax, 0x46bf51
call fcn.0042dc0b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
call fcn.0040699e
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push str.Creating_task_using_task_scheduler_1.0.
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
cmp dword [eax - 4], 1
jle 0x41e4d7
push dword [eax - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov eax, dword [ebp - 0x24]
push 1
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
lea eax, [ebp - 0x2c]
push eax
push 0x476558
push 1
push 0
push 0x476578
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x41e53f
push eax
lea eax, [ebp - 0x24]
push str.CoCreateInstance___failed._Error:_0x_x
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41e529
push dword [eax - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov eax, dword [ebp - 0x24]
push 7
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
and dword [ebp - 0x2c], 0
jmp 0x41e7e3
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push edx
push 0x476548
push 0x476568
push dword [ebp - 0x38]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x20]
test eax, eax
jns 0x41e59e
push eax
lea eax, [ebp - 0x24]
push str.ITaskScheduler::NewWorkItem___failed._Error:_0x_x
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41e586
push dword [eax - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov eax, dword [ebp - 0x24]
push 7
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
and dword [ebp - 0x28], 0
xor bl, bl
jmp 0x41e7f2
mov ecx, dword [ebp - 0x28]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x80]
cmp eax, 0x80070057
je 0x41e7ad
mov esi, 0x8007000e
cmp eax, esi
je 0x41e7ad
mov ecx, dword [ebp - 0x28]
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x88]
cmp eax, 0x80070057
je 0x41e7a5
cmp eax, esi
je 0x41e7a5
mov ecx, dword [ebp - 0x28]
push 0
push 0x486d10
push ecx
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
je 0x41e602
push eax
push str.ITask::SetAccountInformation___failed._Error:_0x_x
jmp 0x41e7b3
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x30]
and dword [ebp - 0x30], 0
push edx
push 0x479028
mov eax, dword [ecx]
push ecx
call dword [eax]
test eax, eax
jns 0x41e626
push eax
push str.ITask::QueryInterface___failed._Error:_0x_x
jmp 0x41e7b3
mov ecx, dword [ebp - 0x30]
xor edi, edi
inc edi
push edi
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x18]
mov ecx, dword [ebp - 0x30]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
jns 0x41e661
push esi
lea eax, [ebp - 0x24]
push str.IPersistFile::Save___failed._Error:_0x_x
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [eax - 4], edi
jmp 0x41e7c6
mov esi, 0x493f4c
push str.Created_task.
mov ecx, esi
call fcn.0040c5a7
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
jns 0x41e6e6
push eax
push str.ITask::Run___failed._Error:_0x_x
jmp 0x41e6fd
cmp dword [ebp - 0x34], 0x41301
je 0x41e6b1
cmp dword [ebp - 0x34], 0x41305
je 0x41e6b1
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x3c]
cmp eax, 0x41303
jne 0x41e76b
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
and dword [ebp - 0x28], 0
push edx
push 0x476548
push dword [ebp - 0x38]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x18]
test eax, eax
js 0x41e79a
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x34]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x40]
test eax, eax
jns 0x41e687
push eax
push str.ITask::GetStatus___failed._Error:_0x_x
lea eax, [ebp - 0x24]
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [eax - 4], edi
jle 0x41e71f
push dword [eax - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov eax, dword [ebp - 0x24]
push 7
push eax
mov ecx, esi
call fcn.0040c5b8
xor bl, bl
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x38]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
test eax, eax
jns 0x41e7e5
push eax
lea eax, [ebp - 0x24]
push str.ITaskScheduler::Delete___failed._Error:_0x_x
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [eax - 4], edi
jle 0x41e767
push dword [eax - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov eax, dword [ebp - 0x24]
mov ecx, esi
jmp 0x41e7db
test eax, eax
jne 0x41e78f
mov ecx, dword [ebp - 0x28]
push ebx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jns 0x41e788
push eax
push str.ITask::GetExitCode___failed._Error:_0x_x
jmp 0x41e6fd
xor edi, edi
mov bl, 1
inc edi
jmp 0x41e72b
push eax
push str.ITask::GetMostRecentRunTime___failed._Error__0x_x
jmp 0x41e6fd
push eax
push str.ITaskScheduler::Activate___failed._Error:_0x_x
jmp 0x41e6fd
push eax
push str.ITask::SetParameters___failed._Error:_0x_x
jmp 0x41e7b3
push eax
push str.ITask::SetApplicationName___failed._Error:_0x_x
lea eax, [ebp - 0x24]
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41e7d6
push dword [eax - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov eax, dword [ebp - 0x24]
mov ecx, 0x493f4c
push 7
push eax
call fcn.0040c5b8
xor bl, bl
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x41e7f2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41e7ff
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
movzx eax, bl
push eax
lea eax, [ebp - 0x24]
push str.RunTaskVersion1___returns__d
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x24]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x41e82b
push dword [esi - 0xc]
lea ecx, [ebp - 0x24]
call fcn.00406aae
mov esi, dword [ebp - 0x24]
push esi
mov ecx, 0x493f4c
call fcn.0040c5a7
lea ecx, [esi - 0x10]
call fcn.00406c57
mov al, bl
call fcn.0042dbb5
ret