Function at 0x1000b89f
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push 0x6c
mov eax, 0x10078add
call fcn.1005f56c
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
push ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
push ecx
push 0xffffffffffffffff
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push 0xfde9
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x78], ecx
call edi
xor ecx, ecx
push 2
pop edx
mov esi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005f209
pop ecx
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x70]
mov esi, 0xfde9
push 0
push esi
mov dword [ebp - 0x68], eax
call edi
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x48]
push eax
push esi
call edi
xor ecx, ecx
push 2
pop edx
mov esi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005f209
pop ecx
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x48]
mov esi, 0xfde9
push 0
push esi
mov dword [ebp - 0x5c], eax
call edi
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x54]
push eax
push esi
call edi
push 2
xor ecx, ecx
pop edx
mov esi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005f209
pop ecx
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x54]
mov esi, 0xfde9
push 0
push esi
mov dword [ebp - 0x6c], eax
call edi
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push esi
call edi
xor ecx, ecx
push 2
pop edx
mov esi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005f209
pop ecx
push esi
push eax
push 0xffffffffffffffff
push ebx
push 0
mov esi, 0xfde9
push esi
mov dword [ebp - 0x74], eax
call edi
push 0x100b0b80
lea ecx, [ebp - 0x60]
call fcn.10001898
mov eax, dword [ebp - 0x70]
mov ebx, dword [ebp - 0x54]
push eax
push eax
push ebx
push dword [ebp - 0x48]
lea eax, [ebp - 0x60]
push str.csInstallPath___s__csParameters___s__csTaskName___s__csAccount___s_
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1000b7ae
add esp, 0x18
lea eax, [ebp - 0x4c]
push eax
push 0x1007b10c
xor eax, eax
inc eax
push eax
push edi
push 0x1007b12c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x68]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x44]
mov ecx, dword [eax]
push edx
push 0x1007b0fc
push 0x1007b11c
push esi
push eax
call dword [ecx + 0x20]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
push ebx
call fcn.1005f2a0
mov esi, dword [ebp - 0x6c]
pop ecx
test eax, eax
je 0x1000ba44
mov eax, dword [ebp - 0x44]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x44]
push edi
mov edi, dword [ebp - 0x74]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x44]
push 0x2000
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
mov eax, dword [ebp - 0x44]
push 0xfffffffffffffffe
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x64]
mov ecx, dword [eax]
push edx
push 0x100a1c14
push eax
call dword [ecx]
mov eax, dword [ebp - 0x64]
push 1
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x78]
push edx
push eax
call dword [ecx + 0xc]
push 0x30
pop ebx
push ebx
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.1005fb70
mov word [ebp - 0x40], bx
mov eax, 0x7dc
add esp, 0xc
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x58]
xor ebx, ebx
inc ebx
lea edx, [ebp - 0x40]
mov word [ebp - 0x3a], bx
mov word [ebp - 0x38], bx
mov dword [ebp - 0x20], 7
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x50]
mov ecx, dword [eax]
push edx
push 0x100a1c14
push eax
call dword [ecx]
mov eax, dword [ebp - 0x50]
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 0x68]
call fcn.1005f212
push dword [ebp - 0x5c]
call fcn.1005f212
push esi
call fcn.1005f212
push edi
call fcn.1005f212
mov ecx, dword [ebp - 0x60]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.10001743
mov al, bl
call fcn.1005f51b
ret