Function at 0x101415e
Capabilities:
Schedule task via itaskservice

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 1
push 0x19a
push 0x1002c00
lea ecx, [ebp - 0x64]
call fcn.01055826
xor eax, eax
inc eax
mov word [ebp - 0x40], ax
xor eax, eax
lea edi, [ebp - 0x3e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1002b90
mov esi, 0x80000002
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
call edi
cmp eax, ebx
jle 0x10141de
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x1014224
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x1001b4c
push dword [ebp - 4]
call fcn.01057f3b
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
push 0x1001b34
push dword [ebp - 4]
call fcn.0105d92e
cmp eax, ebx
jl 0x1014277
cmp dword [ebp - 0x30], ebx
jl 0x1014224
push 0x1002b88
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1014277
lea eax, [ebp - 0xc]
push eax
push 0x100ec94
push 1
push ebx
push 0x100ed04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1bf
jge 0x1014250
mov word [ebp - 0x5e], ax
jmp 0x1014536
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push 0x11
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov dword [ebp - 0x64], eax
jge 0x101426d
mov eax, 0x1c1
jmp 0x1014247
mov eax, 0x1c2
jmp 0x101452f
cmp dword [ebp - 4], ebx
je 0x101428b
cmp dword [ebp - 4], 0xffffffff
je 0x101428b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1001ca8
push esi
mov dword [ebp - 4], ebx
call edi
cmp eax, 2
je 0x101442f
cmp eax, ebx
jle 0x10142b7
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1cf
jl 0x1014247
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x14]
push eax
push 0x100a594
push 3
push ebx
push 0x100a7a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1d0
jl 0x1014247
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1d1
jl 0x1014247
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
mov word [ebp - 0x60], ax
call esi
push 0x1001814
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.0101333a
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1d4
jl 0x1014247
lea edx, [ebp - 0x24]
push edx
push dword [ebp - 8]
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1d5
jl 0x1014247
push 0x1001fe0
lea ecx, [ebp - 8]
mov word [ebp - 0x60], ax
call fcn.0101333a
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1d7
jl 0x1014247
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 8]
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
jge 0x10143cf
mov eax, 0x1db
jmp 0x101452f
push ebx
call esi
push 0x1002070
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.0101333a
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1df
jl 0x1014247
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x10]
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
test eax, eax
jl 0x1014425
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
cmp eax, ebx
mov dword [ebp - 0x64], eax
jge 0x1014425
mov eax, 0x1e3
jmp 0x1014247
mov eax, 0x1e6
jmp 0x101452f
lea eax, [ebp - 0xc]
push eax
push 0x100ec94
push 1
push ebx
push 0x100ed04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1ed
jl 0x1014247
mov word [ebp - 0x60], ax
cmp dword [ebp - 4], ebx
je 0x1014471
cmp dword [ebp - 4], 0xffffffff
je 0x1014471
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x10019f0
push esi
call edi
cmp eax, ebx
jle 0x1014491
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x64], eax
cmp eax, ebx
mov eax, 0x1f2
jl 0x1014247
push 1
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x28]
push eax
push 0x1001b10
push dword [ebp - 4]
call fcn.0105d92e
cmp eax, ebx
mov dword [ebp - 0x64], eax
jge 0x10144c9
mov eax, 0x1f3
jmp 0x1014247
mov ecx, 0x1f3
mov word [ebp - 0x60], cx
cmp eax, ebx
jne 0x10144db
cmp dword [ebp - 0x28], ebx
jne 0x10144eb
cmp dword [0x1077430], ebx
je 0x101450e
cmp dword [0x1077438], ebx
je 0x101450e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push 0xf
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov dword [ebp - 0x64], eax
jge 0x1014507
mov eax, 0x200
jmp 0x1014247
mov eax, 0x201
jmp 0x101452f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov dword [ebp - 0x64], eax
jge 0x101452a
mov eax, 0x207
jmp 0x1014247
mov eax, 0x208
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x18]
push eax
call fcn.01013001
push dword [ebp - 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x64]
call edi
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x101455f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x101456c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x1014579
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1014586
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x1014593
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 4], ebx
je 0x10145aa
cmp dword [ebp - 4], 0xffffffff
je 0x10145aa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x64]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret