Function at 0x140216ea4
Capabilities:
Schedule task via itaskscheduler

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x3f], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rcx
and qword [rbp - 0x21], 0
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r9, [0x140328e20]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140328e30]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140217320
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140217324
and qword [rbp - 0x19], 0
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
call qword [rax + 0x28]
test eax, eax
js 0x140217311
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140217315
and dword [rbp + 0x6f], 0
mov rax, qword [rcx]
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x11]
mov edx, 1
call qword [rax + 0x18]
test eax, eax
js 0x140217311
or r12, 0xffffffffffffffff
cmp dword [rbp + 0x6f], 0
je 0x140217311
mov rdx, qword [rbp - 0x11]
mov rdx, qword [rdx]
lea rcx, [rbp - 0x29]
call fcn.14000cb18
nop
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp + 0x7f], 0
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
lea r9, [rbp + 0x7f]
lea r8, [0x140328e40]
mov rdx, qword [rbp - 0x29]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0x7f]
test eax, eax
js 0x1402172c6
test rcx, rcx
je 0x1402172c6
mov rax, qword [rbp - 0x29]
cmp dword [rax - 0x10], 0
jl 0x140216fd3
lea rdx, [0x140365340]
mov rcx, rax
call fcn.1400bee84
test rax, rax
je 0x140216fcf
sub rax, qword [rbp - 0x29]
sar rax, 1
cmp eax, r12d
jne 0x1402172c2
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp + 0x77]
call qword [rax + 0xe8]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 9], rax
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp + 0x2f]
call qword [rax + 0x108]
test eax, eax
js 0x140217042
mov rdx, qword [rbp + 0x2f]
test rdx, rdx
jne 0x14021701b
xor ecx, ecx
jmp 0x14021702c
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp - 9]
call fcn.14000c9f8
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x17], rax
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1f]
call qword [rax + 0xf8]
test eax, eax
js 0x1402170a4
mov rdx, qword [rbp + 0x1f]
test rdx, rdx
jne 0x14021707d
xor ecx, ecx
jmp 0x14021708e
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp + 0x17]
call fcn.14000c9f8
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 1], rax
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp + 0x37]
call qword [rax + pe_nt_image_headers64]
test eax, eax
js 0x140217106
mov rdx, qword [rbp + 0x37]
test rdx, rdx
jne 0x1402170df
xor ecx, ecx
jmp 0x1402170f0
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp - 1]
call fcn.14000c9f8
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x29]
cmp dword [rcx - 0x10], 0
jl 0x140217196
lea rdx, str..job
call fcn.1400bee84
test rax, rax
je 0x140217196
mov rcx, qword [rbp - 0x29]
sub rax, rcx
sar rax, 1
cmp eax, r12d
je 0x140217196
cmp dword [rcx - 0x10], 0
jl 0x14021714b
lea rdx, str..job
call fcn.1400bee84
test rax, rax
jne 0x140217150
mov eax, r12d
jmp 0x140217157
sub rax, qword [rbp - 0x29]
sar rax, 1
mov r8d, eax
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x29]
call fcn.140024c5c
nop
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x29]
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x27]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140217196
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, 0x38
call fcn.1400be454
test rax, rax
je 0x1402171ad
mov rcx, rax
call fcn.1400755f4
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140075698
nop
mov rcx, qword [rbp + 7]
add rcx, 8
lea rdx, [rbp - 0x29]
call fcn.14000c244
mov edx, dword [rbp + 0x77]
shr edx, 2
not dl
and dl, 1
mov rax, qword [rbp + 7]
mov byte [rax], dl
mov rcx, qword [rbp + 7]
add rcx, 0x10
lea rdx, [rbp - 9]
call fcn.14000c244
mov rcx, qword [rbp + 7]
add rcx, 0x20
lea rdx, [rbp + 0x17]
call fcn.14000c244
mov r8, qword [rbp - 1]
cmp dword [r8 - 0x10], 0
je 0x14021721d
mov rcx, qword [rbp + 7]
add rcx, 0x10
lea rdx, [0x14035b7d8]
call fcn.14000d638
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.1400356a4
nop
mov rdi, qword [rbp + 0xf]
test rdi, rdi
je 0x140217260
mov eax, r12d
lock xadd dword [rdi + 8], eax
add eax, r12d
jne 0x140217260
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
lock xadd dword [rdi + 0xc], eax
add eax, r12d
jne 0x140217260
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140217281
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1402172a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1402172c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1402172d2
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1402172f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x11]
mov edx, 1
call qword [rax + 0x18]
test eax, eax
jns 0x140216f49
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140217320
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14021732f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop r12
pop rdi
pop rbp
ret