Function at 0x42fcf0
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [esp + 0xb8], eax
mov esi, 0x80070057
test ecx, ecx
je 0x42ff0f
mov ebx, ecx
cmp word [ecx], 0
je 0x42ff0f
mov edi, edx
xor eax, eax
lea ecx, [esp + 0x9c]
mov dword [ecx], eax
push ecx
push 0x45d020
push 1
push eax
push 0x45d030
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x42fe75
mov esi, dword [esp + 0x9c]
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
call dword [section..00cfg]
sub esp, 0x44
movaps xmm0, xmmword [esp + 0xc4]
movups xmmword [esp + 0x34], xmm0
movaps xmm0, xmmword [esp + 0xb4]
movups xmmword [esp + 0x24], xmm0
movaps xmm0, xmmword [esp + 0xa4]
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [esp + 0x94]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call ecx
test eax, eax
js 0x42fe85
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x4c], ebx
push 0x4900e8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov esi, dword [esp + 0x9c]
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x4c], ebx
test edi, edi
je 0x42fdfd
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
lea eax, [esp + 0x4c]
push eax
mov ebx, dword [esp + 8]
push ebx
push esi
call ecx
test eax, eax
js 0x42fe9d
mov esi, dword [esp + 0x4c]
lea edi, [esp + 0x48]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x38]
call dword [section..00cfg]
push edi
push 1
push esi
call ecx
test eax, eax
js 0x42fea9
lea esi, [esp + 0x44]
mov dword [esi], 0
mov edi, dword [esp + 0x48]
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
push esi
push edi
call ecx
test eax, eax
jns 0x42ff27
mov esi, eax
mov ecx, eax
mov edx, str.RemoveTasks
push 0x159
jmp 0x42feb7
mov esi, eax
mov ecx, eax
mov edx, str.RemoveTasks
push 0x143
jmp 0x42fe93
mov esi, eax
mov ecx, eax
mov edx, str.RemoveTasks
push 0x145
call fcn.0042bc70
add esp, 4
jmp 0x42fef6
xor esi, esi
cmp eax, 0x80070002
cmovne esi, eax
jmp 0x42fed5
mov esi, eax
mov ecx, eax
mov edx, str.RemoveTasks
push 0x156
call fcn.0042bc70
add esp, 4
mov edi, dword [esp + 0x48]
test edi, edi
je 0x42fed5
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
test ebx, ebx
je 0x42fee0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x42fef6
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
mov edi, dword [esp + 0x9c]
test edi, edi
je 0x42ff0f
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 0xa0]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], 0
sub esp, 0xc
mov al, byte [esp + 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], 0x490c7a
mov dword [esp], 0x1e
mov ecx, esi
call fcn.00452270
push dword [esp + 0xc]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x42ffad
lea edi, [ecx + eax]
mov dword [esp + 0xb0], edi
cmp edx, 7
jbe 0x42ff92
mov esi, dword [esp + 0xa0]
lea ecx, [esi + ecx*2]
add eax, eax
push eax
push dword [esp + 0x10]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [esi + edi*2], 0
jmp 0x42ffd3
sub esp, 0x10
mov cl, byte [esp + 0x30]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [esp + 0xb0]
call fcn.004520d0
cmp dword [esp + 0x44], 0
jle 0x430153
xor eax, eax
mov dword [esp + 0x10], 0
xor edi, edi
mov ebx, edi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x40], 0
inc eax
mov word [esp + 0x20], 3
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
movups xmm0, xmmword [esp + 0x20]
movaps xmmword [esp + 0x30], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
call dword [section..00cfg]
sub esp, 0x18
movaps xmm0, xmmword [esp + 0x48]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x58]
mov dword [esp + 0x14], eax
mov dword [esp], esi
call ecx
mov esi, eax
lea edi, [esp + 0x20]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x4300a2
mov esi, dword [esp + 0x40]
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x4300a6
mov dword [esp + 8], ebx
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
je 0x430137
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov esi, eax
mov edi, dword [esp + 0xc]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
cmp eax, esi
mov ebx, dword [esp + 4]
jbe 0x4300b2
mov al, 1
mov dword [esp + 0x10], eax
mov edi, dword [esp + 8]
jmp 0x4300fe
mov edi, esi
jmp 0x4300a8
mov edi, eax
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 4]
jmp 0x430111
mov edx, dword [esp + 0x18]
lea ecx, [edx + esi*2]
mov esi, edx
add eax, eax
sub ecx, eax
push edi
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4300dc
mov ecx, esi
mov al, 1
mov dword [esp + 0x10], eax
mov edi, dword [esp + 8]
jmp 0x430102
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x4c]
mov eax, dword [edi]
mov ecx, dword [eax + 0x3c]
call dword [section..00cfg]
push 0
push esi
push edi
call ecx
test eax, eax
mov edi, dword [esp + 8]
cmovs edi, eax
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x43010d
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x40]
test esi, esi
je 0x43012b
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x44]
jl 0x42ffea
jmp 0x43015d
lea ecx, [esp + 0xa0]
mov edx, esi
call fcn.0045a1c0
test eax, eax
mov ebx, dword [esp + 4]
jne 0x430096
jmp 0x4300e0
xor edi, edi
mov dword [esp + 0x10], 0
test edi, edi
js 0x430226
mov eax, dword [esp + 0x10]
and al, 1
jne 0x430226
mov dword [esp + 8], edi
xor eax, eax
lea ebx, [esp + 0x20]
mov dword [ebx], eax
push 0x490144
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov edi, dword [esp + 0x9c]
xor eax, eax
mov dword [ebx], eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
push ebx
mov dword [esp + 0x10], esi
push esi
push edi
call ecx
test eax, eax
js 0x4301cd
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
mov ecx, dword [eax + 0x30]
call dword [section..00cfg]
push 0
push dword [esp + 8]
push esi
call ecx
test eax, eax
js 0x4301dd
mov bl, 1
jmp 0x4301f5
mov esi, eax
mov ecx, eax
mov edx, str.RemoveTasks
push 0x18f
jmp 0x4301eb
mov esi, eax
mov ecx, eax
mov edx, str.RemoveTasks
push 0x190
call fcn.0042bc70
add esp, 4
xor ebx, ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x430204
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [esp + 0x20]
test edi, edi
je 0x43021a
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
test bl, bl
mov ebx, dword [esp + 4]
mov edi, dword [esp + 8]
je 0x430228
mov esi, edi
mov ecx, dword [esp + 0xb4]
cmp ecx, 8
jb 0x42febf
mov eax, dword [esp + 0xa0]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x43025c
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42febf
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x430278
add ecx, ecx
add ecx, 0x25
mov edx, ecx
mov ebx, dword [esp + 4]
jmp 0x43024d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3