Function at 0x42e8c0
Capabilities:
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x180
mov dword [esp + 4], edx
mov ebx, ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [esp + 0x178], eax
lea esi, [esp + 0x144]
xor edi, edi
mov ecx, esi
xor edx, edx
push 0
push 0x48ed9e
call fcn.0042b0f0
add esp, 8
cmp dword [esi + 0x1c], 0
je 0x42eafb
mov ecx, ebx
xor edx, edx
call fcn.0042fcf0
lea eax, [esp + 0x120]
mov dword [eax], edi
push eax
push 0x45d020
push 1
push edi
push 0x45d030
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x42eb82
mov esi, dword [esp + 0x120]
xorps xmm0, xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
call dword [section..00cfg]
sub esp, 0x44
movaps xmm0, xmmword [esp + 0x114]
movups xmmword [esp + 0x34], xmm0
movaps xmm0, xmmword [esp + 0x104]
movups xmmword [esp + 0x24], xmm0
movaps xmm0, xmmword [esp + 0xf4]
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [esp + 0xe4]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call ecx
test eax, eax
js 0x42eb8f
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x100], ebx
push 0x490144
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x100]
mov dword [esp + 0x100], ebx
test edi, edi
je 0x42e9f2
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
lea eax, [esp + 0x100]
push eax
push dword [esp + 0x1c]
push esi
call ecx
mov edi, eax
test eax, eax
js 0x42eba7
mov dword [esp + 0x14], edi
xor edi, edi
mov dword [esp + 0x9c], edi
push 0x4900e8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 8], eax
mov esi, dword [esp + 0x100]
mov ebx, dword [esp + 0x9c]
mov dword [esp + 0x9c], edi
test ebx, ebx
je 0x42ea59
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x24]
call dword [section..00cfg]
lea ebx, [esp + 0x9c]
push ebx
push dword [esp + 0xc]
push esi
call ecx
xor edx, edx
mov ecx, 0
test eax, eax
jns 0x42ed00
mov edi, dword [esp + 0x100]
mov esi, dword [esp + 0x9c]
mov dword [esp + 0x9c], 0
test esi, esi
je 0x42eaad
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
mov eax, dword [edi]
mov ecx, dword [eax + 0x2c]
call dword [section..00cfg]
sub esp, 0x1c
movaps xmm0, xmmword [esp + 0x9c]
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], edi
call ecx
mov edi, eax
mov cl, 1
test eax, eax
js 0x42ece5
mov dword [esp + 0x14], edi
xor edx, edx
jmp 0x42ed00
cmp byte [esp + 0x15c], 0
mov esi, 0
je 0x42f189
movsd xmm0, qword [esp + 0x154]
movsd qword [esp + 0x130], xmm0
movups xmm0, xmmword [esp + 0x144]
movaps xmmword [esp + 0x120], xmm0
mov byte [esp + 0x138], 1
xor eax, eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], 0xf
mov byte [esp + 0x144], al
mov byte [esp + 0x15c], al
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov esi, dword [esp + 0x130]
cmp dword [esp + 0x134], 0xf
jbe 0x42ebbd
mov edi, dword [esp + 0x120]
jmp 0x42ebc4
mov edi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x5e
jmp 0x42eb9a
mov edi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x60
call fcn.0042bc70
add esp, 4
jmp 0x42f52e
mov ecx, edi
mov edx, str.RegisterTask
push 0x65
call fcn.0042bc70
add esp, 4
jmp 0x42f506
lea edi, [esp + 0x120]
mov dword [esp], ebx
cmp esi, 0xf
ja 0x42f55f
movups xmm0, xmmword [edi]
movaps xmmword [esp + 0x100], xmm0
mov ebx, 0xf
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], ebx
mov edi, 0x48ed9e
lea ecx, [esp + 0xe0]
xor edx, edx
push edi
call fcn.0042bb00
add esp, 4
lea esi, [esp + 0xe0]
xor edx, edx
inc edx
mov ecx, esi
push 0
push edi
call fcn.0042b0f0
add esp, 8
lea ecx, [esp + 0x144]
mov edx, esi
call fcn.00437ce0
cmp dword [esi + 0x1c], 0
mov edi, 0
jne 0x42ec6b
cmp byte [esp + 0xf8], 0
je 0x42ec6b
mov eax, dword [esp + 0xf4]
cmp eax, 0x10
jb 0x42ec6b
mov ecx, dword [esp + 0xe0]
lea esi, [eax + 1]
cmp esi, 0x1000
jae 0x42fc71
push esi
push ecx
call fcn.0044fbc2
add esp, 8
mov esi, dword [esp + 0x160]
test esi, esi
jne 0x42f124
cmp byte [esp + 0x15c], 0
je 0x42f0b0
mov eax, dword [esp + 0x144]
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x154], 0
mov dword [esp + 0x158], 0xf
xor edx, edx
mov byte [esp + 0x144], dl
mov byte [esp + 0x15c], dl
cmp ecx, 0x10
jb 0x42f124
lea edi, [ecx + 1]
cmp edi, 0x1000
jae 0x42fc8c
push edi
push eax
call fcn.0044fbc2
add esp, 8
xor edi, edi
jmp 0x42f124
cmp edi, 0x800700b7
mov edx, 0
jne 0x42f0ce
mov dword [esp + 0x14], 0x800700b7
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0x120]
lea edi, [esp + 0x7c]
mov dword [edi], edx
mov eax, dword [esi]
mov ecx, dword [eax + 0x24]
xor ebx, ebx
call dword [section..00cfg]
push edi
push ebx
push esi
call ecx
test eax, eax
js 0x42f098
xor ebx, ebx
mov dword [esp + 0x78], ebx
lea eax, [esp + 0xe0]
mov dword [eax], ebx
push eax
call fcn.004510d0
add esp, 4
test al, al
jne 0x42f1e7
push 0x33
push str.GetTaskDescription
push str.Failed_to_get_install_directory
call fcn.00429d90
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0xe0]
mov dword [esp + 0xe0], 0
test eax, eax
je 0x42ed80
push eax
call fcn.0044fc0e
add esp, 4
mov esi, 0x80004005
test bl, bl
je 0x42f47a
push dword [esp + 0x78]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov esi, dword [esp + 0x7c]
lea edi, [esp + 0x74]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
mov dword [esp + 0x10], ebx
js 0x42f0be
mov esi, dword [esp + 0x74]
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
call dword [section..00cfg]
push ebx
push esi
call ecx
test eax, eax
js 0x42f0e4
mov esi, dword [esp + 0x7c]
lea edi, [esp + 0x70]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x42f1d4
mov esi, dword [esp + 0x70]
mov eax, dword [esi]
mov ecx, dword [eax + 0x48]
call dword [section..00cfg]
push 0
push esi
call ecx
test eax, eax
js 0x42f3f9
mov esi, dword [esp + 0x70]
mov eax, dword [esi]
mov ecx, dword [eax + 0x38]
call dword [section..00cfg]
push 2
push esi
call ecx
test eax, eax
js 0x42f409
mov esi, dword [esp + 0x70]
mov eax, dword [esi]
mov ecx, dword [eax + 0x58]
call dword [section..00cfg]
push 0xffffffffffffffff
push esi
call ecx
test eax, eax
js 0x42f419
mov esi, dword [esp + 0x70]
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
call dword [section..00cfg]
push 0
push esi
call ecx
test eax, eax
js 0x42f429
push str.PT35M
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov esi, dword [esp + 0x70]
mov eax, dword [esi]
mov ecx, dword [eax + 0x70]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x42f5a0
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x7c]
lea edi, [esp + 0x6c]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x42f5bb
mov esi, dword [esp + 0x6c]
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
call dword [section..00cfg]
push dword [esp + 8]
push esi
call ecx
test eax, eax
js 0x42f5cb
mov esi, dword [esp + 0x7c]
lea edi, [esp + 0x68]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x24]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x42f5ea
mov esi, dword [esp + 0x68]
lea edi, [esp + 0x64]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
call dword [section..00cfg]
push edi
push 2
push esi
call ecx
test eax, eax
js 0x42f609
mov esi, dword [esp + 0x64]
lea edi, [esp + 0x60]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [section..00cfg]
push edi
push 0x45d010
push esi
call ecx
test eax, eax
js 0x42f628
mov edi, dword [esp + 4]
test edi, edi
je 0x42f638
mov esi, dword [esp + 0x60]
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x42f68e
mov esi, dword [esp + 0x60]
mov eax, dword [esi]
mov ecx, dword [eax + 0x54]
call dword [section..00cfg]
push 1
push esi
call ecx
test eax, eax
js 0x42f69e
mov esi, dword [esp + 0x7c]
lea edi, [esp + 0x5c]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x42f7b1
mov esi, dword [esp + 0x5c]
xor edi, edi
lea ebx, [esp + 0x58]
mov dword [ebx], edi
mov eax, dword [esi]
mov ecx, dword [eax + 0x30]
call dword [section..00cfg]
push ebx
push edi
push esi
call ecx
test eax, eax
js 0x42f7cc
mov esi, dword [esp + 0x58]
lea edi, [esp + 0x54]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [section..00cfg]
push edi
push str.MbLk
push esi
call ecx
test eax, eax
js 0x42f819
xor esi, esi
push esi
lea eax, [esp + 0x148]
push eax
call fcn.00401df0
add esp, 8
push dword [esp + 0x144]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0x144], esi
test eax, eax
je 0x42f04a
push eax
call fcn.0044fc0e
add esp, 4
mov esi, dword [esp + 0x54]
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
call dword [section..00cfg]
push dword [esp + 4]
push esi
call ecx
test eax, eax
jns 0x42f896
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xe1
call fcn.0042bc70
add esp, 4
cmp dword [esp + 4], 0
je 0x42f82f
push dword [esp + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x42f82f
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x80
call fcn.0042bc70
jmp 0x42f490
cmp ebx, 0xf
jbe 0x42f0ff
mov eax, dword [esp + 0x100]
jmp 0x42f106
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x89
jmp 0x42f0f2
mov ecx, edi
mov edx, str.RegisterTask
push 0x71
call fcn.0042bc70
add esp, 4
jmp 0x42f4de
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x8a
call fcn.0042bc70
add esp, 4
jmp 0x42f455
lea eax, [esp + 0x100]
lea ecx, [esp + 0xe0]
mov edx, 0x48ed9e
push 0
push eax
call fcn.0042a9a0
add esp, 8
mov ebx, dword [esp + 0x114]
cmp ebx, 0x10
jb 0x42f149
mov eax, dword [esp + 0x100]
lea edx, [ebx + 1]
cmp edx, 0x1000
jae 0x42fc17
push edx
push eax
call fcn.0044fbc2
add esp, 8
cmp byte [esp + 0x138], 0
je 0x42f186
mov eax, dword [esp + 0x134]
cmp eax, 0x10
mov ebx, dword [esp]
jb 0x42f189
mov ecx, dword [esp + 0x120]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x42fc55
push edi
push ecx
call fcn.0044fbc2
add esp, 8
xor edi, edi
jmp 0x42f189
mov ebx, dword [esp]
test esi, esi
jne 0x42e909
cmp byte [esp + 0x15c], 0
je 0x42e909
mov eax, dword [esp + 0x158]
cmp eax, 0x10
jb 0x42e909
mov ecx, dword [esp + 0x144]
lea esi, [eax + 1]
cmp esi, 0x1000
jae 0x42fc36
push esi
push ecx
call fcn.0044fbc2
add esp, 8
jmp 0x42e909
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x8d
jmp 0x42f437
mov eax, str._sdefaultagent_localized.ini
push dword [esp + 0xe0]
push eax
call fcn.00451240
add esp, 8
mov edi, eax
inc edi
xor eax, eax
dec eax
mov esi, edi
add esi, edi
cmovb esi, eax
push esi
call fcn.0044fc05
add esp, 4
push esi
push ebx
push eax
mov esi, eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [esp + 0xe0]
mov eax, str._sdefaultagent_localized.ini
push eax
push 0xffffffffffffffff
push edi
mov edi, esi
push esi
call fcn.004512a0
add esp, 0x14
lea esi, [esp + 0x144]
mov ecx, esi
push ebx
mov dword [esp + 0x14], edi
push edi
call fcn.004285e0
lea eax, [esp + 0x78]
mov ecx, esi
push eax
push str.DefaultBrowserAgentTaskDescription
call fcn.004286d0
mov ecx, esi
call fcn.00428a90
test eax, eax
sete bl
je 0x42f282
push eax
push 0x42
push str.GetTaskDescription
push str.Failed_to_read_task_description:__d
call fcn.00429d90
add esp, 0x10
mov ecx, dword [esp + 0x164]
test ecx, ecx
je 0x42f2d4
mov eax, dword [esp + 0x16c]
sub eax, ecx
cmp eax, 0x1000
jb 0x42f2b3
mov edx, dword [ecx - 4]
sub ecx, edx
add ecx, 0xfffffffc
cmp ecx, 0x20
jae 0x42fcdb
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.0044fbc2
add esp, 8
xor eax, eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov ecx, dword [esp + 0x158]
test ecx, ecx
je 0x42f326
mov eax, dword [esp + 0x160]
sub eax, ecx
cmp eax, 0x1000
jb 0x42f305
mov edx, dword [ecx - 4]
sub ecx, edx
add ecx, 0xfffffffc
cmp ecx, 0x20
jae 0x42fcdb
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.0044fbc2
add esp, 8
xor eax, eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov esi, dword [esp + 0x14c]
test esi, esi
je 0x42f3aa
mov edi, ebx
mov ebx, dword [esp + 0x150]
cmp esi, ebx
je 0x42f361
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x42f353
push eax
call fcn.0044fc0e
add esp, 4
add esi, 4
cmp ebx, esi
jne 0x42f33e
mov esi, dword [esp + 0x14c]
mov eax, dword [esp + 0x154]
sub eax, esi
cmp eax, 0x1000
mov ebx, edi
jb 0x42f389
mov ecx, dword [esi - 4]
add esi, 0xfffffffc
sub esi, ecx
cmp esi, 0x20
jae 0x42fcdb
add eax, 0x23
mov esi, ecx
push eax
push esi
call fcn.0044fbc2
add esp, 8
xor eax, eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x148]
mov dword [esp + 0x148], 0
test eax, eax
je 0x42f3c9
push eax
call fcn.0044fc0e
add esp, 4
mov eax, dword [esp + 0x144]
mov dword [esp + 0x144], 0
test eax, eax
je 0x42f3e8
push eax
call fcn.0044fc0e
add esp, 4
push dword [esp + 0x10]
call fcn.0044fc0e
add esp, 4
jmp 0x42ed61
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x8e
jmp 0x42f437
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x8f
jmp 0x42f437
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x90
jmp 0x42f437
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x91
call fcn.0042bc70
add esp, 4
mov ebx, dword [esp + 0x70]
test ebx, ebx
je 0x42f455
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x74]
test ebx, ebx
je 0x42f46b
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42f47a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x78]
mov dword [esp + 0x78], 0
test eax, eax
je 0x42f493
push eax
call fcn.0044fc0e
add esp, 4
mov ebx, dword [esp + 0x7c]
test ebx, ebx
je 0x42f4a9
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
cmp dword [esp + 0x14], 0
setns al
mov ecx, dword [esp + 0x1c]
xor cl, 1
or cl, al
jne 0x42f4dc
mov edi, dword [esp + 0x100]
mov eax, dword [edi]
mov ecx, dword [eax + 0x30]
call dword [section..00cfg]
push 0
mov ebx, dword [esp + 0xc]
push ebx
push edi
call ecx
mov edi, esi
jmp 0x42f4e2
mov edi, esi
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x42f4ed
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esp + 0x9c]
test esi, esi
je 0x42f506
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42f515
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esp + 0x100]
test esi, esi
je 0x42f52e
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov esi, dword [esp + 0x120]
test esi, esi
je 0x42f547
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov ecx, dword [esp + 0x178]
xor ecx, ebp
call fcn.004503b0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, esi
or ebx, 0xf
mov eax, SysReAllocString
cmp ebx, eax
cmovae ebx, eax
cmp ebx, 0xfff
jae 0x42f87a
lea eax, [ebx + 1]
push eax
call fcn.0044fbd0
add esp, 4
mov dword [esp + 0x100], eax
lea ecx, [esi + 1]
push ecx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x42ebe0
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x95
call fcn.0042bc70
add esp, 4
jmp 0x42f710
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x98
jmp 0x42f5d9
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x9a
call fcn.0042bc70
add esp, 4
mov edi, dword [esp + 0xc]
jmp 0x42f6fa
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0x9d
call fcn.0042bc70
add esp, 4
mov edi, dword [esp + 0xc]
jmp 0x42f6e4
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xa0
call fcn.0042bc70
add esp, 4
mov edi, dword [esp + 0xc]
jmp 0x42f6ce
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xa4
jmp 0x42f6ac
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
add eax, 0xffffffc4
adc edx, 0xffffffff
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], edx
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
add esp, 8
test eax, eax
je 0x42f724
mov esi, 0x8007076d
mov ecx, 0x8007076d
mov edx, str.RegisterTask
push 0xc2
jmp 0x42f6ac
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xa7
jmp 0x42f6ac
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xd4
call fcn.0042bc70
add esp, 4
mov ebx, dword [esp + 0x60]
test ebx, ebx
mov edi, dword [esp + 0xc]
je 0x42f6ce
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x64]
test ebx, ebx
je 0x42f6e4
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x68]
test ebx, ebx
je 0x42f6fa
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x42f710
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
test edi, edi
je 0x42f43f
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x42f43f
push 0x2a
call fcn.0044fc05
add esp, 4
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax + 0x1a], xmm0
lea eax, [esp + 0x144]
push eax
push str._Y__m__dT_H:_M:_SZ
push 0x15
push edi
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
add esp, 0x10
test eax, eax
je 0x42f7e4
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov esi, dword [esp + 0x60]
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
call dword [section..00cfg]
mov dword [esp + 4], ebx
push ebx
push esi
call ecx
mov esi, eax
xor ebx, ebx
test eax, eax
jns 0x42f79e
mov ecx, esi
mov edx, str.RegisterTask
push 0xd1
call fcn.0042bc70
add esp, 4
xor ebx, ebx
inc ebx
cmp dword [esp + 4], 0
je 0x42f803
push dword [esp + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x42f803
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xd7
call fcn.0042bc70
add esp, 4
jmp 0x42f85b
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xda
call fcn.0042bc70
add esp, 4
jmp 0x42f845
mov esi, 0x8007007a
mov ecx, 0x8007007a
mov edx, str.RegisterTask
push 0xcc
call fcn.0042bc70
add esp, 4
xor ebx, ebx
inc ebx
push edi
call fcn.0044fc0e
add esp, 4
test ebx, ebx
jne 0x42f6b4
jmp 0x42ef7d
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xdd
call fcn.0042bc70
add esp, 4
mov ebx, dword [esp + 0x54]
test ebx, ebx
je 0x42f845
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x58]
test ebx, ebx
je 0x42f85b
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x5c]
test ebx, ebx
je 0x42f6b4
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
jmp 0x42f6b4
lea eax, [ebx + 0x24]
push eax
call fcn.0044fbd0
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x42f586
lea esi, [esp + 0x144]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], 0
sub esp, 0xc
mov al, byte [esp + 0xec]
mov byte [esp + 4], al
mov dword [esp + 8], str.do_task__
mov dword [esp], 9
mov ecx, esi
call fcn.00452270
push dword [esp]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x42f91e
lea ebx, [ecx + eax]
mov dword [esp + 0x154], ebx
cmp edx, 7
jbe 0x42f903
mov esi, dword [esp + 0x144]
lea ecx, [esi + ecx*2]
add eax, eax
push eax
push dword [esp + 4]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [esi + ebx*2], 0
jmp 0x42f947
sub esp, 0x10
mov cl, byte [esp + 0xf0]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [esp + 0x154]
call fcn.004520d0
mov eax, dword [esp + 0x154]
mov ecx, dword [esp + 0x158]
cmp ecx, eax
je 0x42f987
lea edx, [eax + 1]
mov dword [esp + 0x154], edx
cmp ecx, 7
jbe 0x42f971
mov ecx, dword [esp + 0x144]
jmp 0x42f978
lea ecx, [esp + 0x144]
mov word [ecx + eax*2], 0x22
mov word [ecx + eax*2 + 2], 0
jmp 0x42f9b3
sub esp, 0x10
mov al, byte [esp + 0xf0]
mov byte [esp + 4], al
xor eax, eax
inc eax
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], 0x490c76
lea ecx, [esp + 0x154]
call fcn.004520d0
cmp dword [esp + 0x158], 7
jbe 0x42f9c6
mov eax, dword [esp + 0x144]
jmp 0x42f9cd
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov esi, dword [esp + 0x54]
mov eax, dword [esi]
mov ecx, dword [eax + 0x34]
call dword [section..00cfg]
mov ebx, edi
push edi
push esi
call ecx
test eax, eax
jns 0x42fa48
mov esi, eax
mov ecx, eax
mov edx, str.RegisterTask
push 0xe7
call fcn.0042bc70
add esp, 4
test ebx, ebx
je 0x42fa10
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x158]
cmp ecx, 8
jb 0x42f07e
mov eax, dword [esp + 0x144]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42fca5
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42f07e
mov eax, 7
lea esi, [esp + 0xe0]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
mov word [esi], 0
sub esp, 0xc
mov al, byte [esp + 0x5c]
mov byte [esp + 4], al
mov dword [esp + 8], 0x490c7a
mov dword [esp], 0x1e
mov ecx, esi
call fcn.00452270
push dword [esp]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x42face
lea edi, [ecx + eax]
mov dword [esp + 0xf0], edi
cmp edx, 7
jbe 0x42fab3
mov esi, dword [esp + 0xe0]
lea ecx, [esi + ecx*2]
add eax, eax
push eax
push dword [esp + 4]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [esi + edi*2], 0
jmp 0x42faf4
sub esp, 0x10
mov cl, byte [esp + 0x60]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [esp + 0xf0]
call fcn.004520d0
cmp dword [esp + 0xf4], 7
jbe 0x42fb07
mov eax, dword [esp + 0xe0]
jmp 0x42fb0e
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov esi, dword [esp + 0x9c]
lea eax, [esp + 0x50]
mov dword [eax], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
call dword [section..00cfg]
sub esp, 0x48
movaps xmm0, xmmword [esp + 0x88]
movups xmmword [esp + 0x34], xmm0
movaps xmm0, xmmword [esp + 0x78]
movups xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [esp + 0x68]
movups xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x98]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov dword [esp + 0x48], edi
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x30], 3
mov dword [esp + 0xc], 6
call ecx
mov esi, eax
test eax, eax
jns 0x42fbba
mov ecx, esi
mov edx, str.RegisterTask
push 0xf0
call fcn.0042bc70
add esp, 4
mov edi, dword [esp + 0x50]
test edi, edi
je 0x42fbd0
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
cmp dword [esp], 0
je 0x42fbdf
push dword [esp]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0xf4]
cmp ecx, 8
jb 0x42fa05
mov eax, dword [esp + 0xe0]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42fcc0
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42fa05
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x42fcdb
add ebx, 0x24
mov edx, ebx
mov eax, ecx
xor edi, edi
jmp 0x42f13f
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fcdb
add eax, 0x24
mov esi, eax
mov ecx, edx
xor edi, edi
jmp 0x42f1c5
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fcdb
add eax, 0x24
mov edi, eax
mov ecx, edx
mov ebx, dword [esp]
jmp 0x42f178
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fcdb
add eax, 0x24
mov esi, eax
mov ecx, edx
xor edi, edi
jmp 0x42ec61
mov edx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, edx
cmp eax, 0x20
jae 0x42fcdb
add ecx, 0x24
mov edi, ecx
mov eax, edx
jmp 0x42ecd4
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42fcdb
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42fa39
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42fcdb
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42fc08
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3