Function at 0x419ac0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1bfc
call fcn.004479f0
mov eax, dword [0x47b660]
xor eax, esp
mov dword [esp + 0x1bf8], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.00446a60
push str._______________Add_Task________________
call fcn.00444866
add esp, 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x41a0ca
push str.CoInitialize_Succeed
call fcn.00444866
add esp, 4
lea edx, [esp + 8]
push edx
push 0x46838c
push 1
push 0
push 0x4683ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x419b4d
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.Failed_CoCreateInstance
jmp 0x41a0cf
push str.CoCreateInstance_Succeed
call fcn.00444866
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
add esp, 4
lea edx, [esp + 4]
push edx
push 0x46837c
push 0x46839c
push str.NPArcBkp
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test esi, esi
jge 0x419bd1
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
push str.NewWorkItem_error__0x_x_n
lea eax, [esp + 0x68]
push 0x104
push eax
call fcn.00442ff8
lea ecx, [esp + 0x70]
push ecx
push 0x46771c
call fcn.00444866
add esp, 0x18
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bf8]
xor ecx, esp
call fcn.00442896
mov esp, ebp
pop ebp
ret
push str.NewWorkItem_succeed
call fcn.00444866
mov eax, dword [esp + 8]
mov edx, dword [eax]
add esp, 4
push str.This_is_a_npav_architect_backup_task
push eax
mov eax, dword [edx + 0x48]
call eax
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0xc02]
push edx
mov word [esp + 0xc04], cx
call fcn.00446a60
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x140e]
push ecx
mov word [esp + 0x1410], ax
call fcn.00446a60
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x41a]
push eax
mov word [esp + 0x41c], dx
call fcn.00446a60
add esp, 0x24
push 0x400
lea ecx, [esp + 0x3fc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x3f8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x3f8]
push eax
lea ecx, [esp + 0xbfc]
push 0x400
push ecx
call fcn.00442f44
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x90]
add esp, 0xc
lea ecx, [esp + 0xbf8]
push ecx
push eax
call edx
lea eax, [esp + 0x3f8]
push eax
push str._s_nparcbkp.exe
lea ecx, [esp + 0x1400]
push 0x400
push ecx
call fcn.00442ff8
lea edx, [esp + 0x1408]
push edx
lea eax, [esp + 0xc0c]
push 0x400
push eax
call fcn.00442f44
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
add esp, 0x1c
lea edx, [esp + 0xbf8]
push edx
push eax
mov eax, dword [ecx + 0x80]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push str._AUTOARCBKP
push eax
call edx
xor eax, eax
push 0xc6
push eax
lea ecx, [esp + 0x33a]
push ecx
mov word [esp + 0x33c], ax
call fcn.00446a60
xor edx, edx
push 0xc6
push edx
lea eax, [esp + 0x27e]
push eax
mov word [esp + 0x280], dx
call fcn.00446a60
add esp, 0x18
push 0x64
lea ecx, [esp + 0x26c]
push ecx
push 0x42c
mov ecx, edi
call fcn.0042c489
mov ecx, eax
call fcn.0042cbd8
push 0x64
lea edx, [esp + 0x334]
push edx
push 0x42d
mov ecx, edi
call fcn.0042c489
mov ecx, eax
call fcn.0042cbd8
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x330]
push edx
lea edx, [esp + 0x26c]
push edx
push eax
mov eax, dword [ecx + 0x78]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
test esi, esi
jge 0x419e1c
push esi
push str.CreatTrigger_error__0x_x_n
lea ecx, [esp + 0x68]
push 0x104
push ecx
call fcn.00442ff8
lea edx, [esp + 0x70]
push edx
push 0x46771c
call fcn.00444866
push str.Failed_calling_ITask::CreatTrigger:
call fcn.00444866
push esi
push str.error__0x_x_n
call fcn.00444866
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 0x24
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bf8]
xor ecx, esp
call fcn.00442896
mov esp, ebp
pop ebp
ret
push str._nCreatTrigger_succeed
call fcn.00444866
push 0x30
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00446a60
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp + 0x14]
push edx
lea ecx, [edi + 0x681c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00431b40
lea ecx, [esp + 0x14]
call fcn.004145c0
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.004145f0
test esi, esi
jne 0x419e7f
mov esi, 5
test eax, eax
jne 0x419e83
movzx edx, word [esp + 0x26]
mov word [esp + 0x38], dx
movzx edx, word [esp + 0x20]
mov word [esp + 0x42], ax
mov ecx, 0x30
mov word [esp + 0x30], cx
mov cx, word [esp + 0x22]
mov word [esp + 0x34], dx
mov eax, 1
mov word [esp + 0x54], ax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x30]
mov word [esp + 0x36], cx
mov word [esp + 0x40], si
mov dword [esp + 0x44], 0x2d0
mov dword [esp + 0x48], 0x78
mov dword [esp + 0x50], 1
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
test esi, esi
jge 0x419f57
push str.Failed_calling_ITaskTrigger::SetTrigger:
call fcn.00444866
push esi
push str.error__0x_x_n
call fcn.00444866
push esi
push str.SetTrigger_error__0x_x_n
lea ecx, [esp + 0x74]
push 0x104
push ecx
call fcn.00442ff8
lea edx, [esp + 0x7c]
push edx
push 0x46c9c8
call fcn.00444866
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 0x24
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0041a0f0
push str._nFailed_to_start__please_try_again.
jmp 0x41a0cf
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x466b88
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jge 0x419fb7
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
push str._nFailed_calling_QueryInterface__error__0x_x_n
lea ecx, [esp + 0x68]
push 0x104
push ecx
call fcn.00442ff8
lea edx, [esp + 0x70]
push edx
push 0x46771c
call fcn.00444866
add esp, 0x18
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bf8]
xor ecx, esp
call fcn.00442896
mov esp, ebp
pop ebp
ret
push str._nQueryInterface_succeed
call fcn.00444866
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
add esp, 4
push 1
push 0
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test esi, esi
jge 0x41a050
call dword [sym.imp.ole32.dll_CoUninitialize]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_calling_Save__error__0x_x_d_n
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.00442ff8
lea ecx, [esp + 0x74]
push ecx
push 0x46771c
call fcn.00444866
add esp, 0x1c
cmp esi, 0x80070005
jne 0x41a0d7
push str.Please_run_as_Admin_or_login_Admin_account
call fcn.00444866
add esp, 4
call fcn.0041a0f0
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bf8]
xor ecx, esp
call fcn.00442896
mov esp, ebp
pop ebp
ret
push str.Save_succeed
call fcn.00444866
mov eax, dword [esp + 8]
mov edx, dword [eax]
add esp, 4
push eax
mov eax, dword [edx + 0x30]
call eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Run_error:_d
lea ecx, [esp + 0x68]
push 0x104
push ecx
call fcn.00442ff8
lea edx, [esp + 0x70]
push edx
push 0x46771c
call fcn.00444866
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 0x18
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.________________Task_Created________________
call fcn.00444866
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1bf8]
xor ecx, esp
call fcn.00442896
mov esp, ebp
pop ebp
ret
push str.Failed_CoInitialize
call fcn.00444866
add esp, 4
mov ecx, dword [esp + 0x1bfc]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00442896
mov esp, ebp
pop ebp
ret