Function at 0x14002df60
Capabilities:
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x230
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r12, rcx
cmp qword [0x1401791c8], 0
jne 0x14002ea6b
call fcn.140008c20
test al, al
je 0x14002dfbf
mov rcx, r12
call fcn.14002ead0
jmp 0x14002ea6b
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x58], rax
xor r13d, r13d
mov word [rax], r13w
lea ecx, [r13 + 2]
call fcn.1400e8270
mov qword [rbp + 0x70], rax
mov word [rax], r13w
lea ecx, [r13 + 2]
call fcn.1400e8270
mov qword [rbp + 0x68], rax
mov word [rax], r13w
mov qword [rbp + 8], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 8], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x10], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x18], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x18], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x20], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x28], r13
mov rax, qword [str.Task_Scheduler]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x30], r13
mov rax, qword [str.Task_Scheduler]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r13
lea rax, [rbp + 8]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], r13
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea edx, [r13 + 2]
lea r8d, [r13 - 1]
mov rcx, r12
call fcn.140005d90
mov r15d, eax
mov rcx, qword [rbp - 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x10]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 8]
call fcn.1400e825c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14002ea4e
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1401252c0]
xor edx, edx
lea r8d, [r13 + 1]
lea rcx, [0x1401252d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14002ea4e
mov qword [rbp - 0x60], r13
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
call qword [rax + 0x28]
test eax, eax
js 0x14002ea4e
mov dword [rbp - 0x7c], r13d
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea r9, [rbp - 0x7c]
lea r8, [rbp - 0x68]
lea edx, [r13 + 2]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x14002ea39
lea ebx, [r13 + 0x30]
nop
mov eax, dword [rbp - 0x7c]
test eax, eax
je 0x14002ea39
mov esi, r13d
nop
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
mov r10, qword [rax + 0x30]
mov eax, esi
lea r14, [rax*8]
lea r9, [rbp - 0x78]
lea r8, [0x1401252b0]
mov rdx, qword [rbp - 0x68]
mov rdx, qword [r14 + rdx]
call r10
test eax, eax
js 0x14002e9f3
mov word [rbp - 0x80], r13w
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax + 0x28]
cmp r13w, word [rbp - 0x80]
jae 0x14002e9f3
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
xor edx, edx
lea r8, [rbp + 0xb8]
call qword [rax + 0x30]
test eax, eax
js 0x14002e9f3
mov word [rbp + 0xe0], bx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe2], xmm0
movups xmmword [rbp + 0xf2], xmm0
mov qword [rbp + 0x102], rax
mov dword [rbp + 0x10a], eax
mov word [rbp + 0x10e], ax
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
call qword [rax + 0x20]
test eax, eax
js 0x14002e9f3
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp + 0x88]
call qword [rax + 0x108]
test eax, eax
js 0x14002e9f3
mov rdi, qword [rbp + 0x88]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rbx, rax
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x14002e369
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14002e36c
test rdi, rdi
jne 0x14002eaa6
jmp 0x14002e36c
mov rbx, r13
test rbx, rbx
je 0x14002eabc
mov rax, qword [rbx]
mov qword [rbp - 0x70], r13
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14002e3da
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002e3bb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002e3cd
call fcn.1400e0fb8
mov qword [rbx + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov rax, qword [rbp - 0x68]
mov rdi, qword [r14 + rax]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rbx, rax
mov qword [rbp + 0xd8], rax
test rax, rax
je 0x14002e422
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14002e425
test rdi, rdi
jne 0x14002eab1
jmp 0x14002e425
mov rbx, r13
test rbx, rbx
je 0x14002ea9b
mov rax, qword [rbx]
mov qword [rbp - 0x40], r13
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14002e493
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002e474
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002e486
call fcn.1400e0fb8
mov qword [rbx + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp + 0x90]
call qword [rax + 0x118]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x38]
call qword [rax + 0xe8]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp + 0xc8]
call qword [rax + 0x128]
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x48], rax
mov word [rax], r13w
mov rdi, qword [rbp + 0x90]
lea rcx, [0x140124a54]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
mov rax, qword [rbp - 0x70]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rbp + 0x78]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
mov rdi, qword [rbp + 0x78]
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov qword [rbp + 0x80], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp - 0x48]
call fcn.140005790
mov rcx, qword [rbp + 0x80]
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
mov ecx, 2
call fcn.1400e8270
mov qword [rbp + 0x98], rax
mov word [rax], r13w
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
lea rdx, [rbp + 0x98]
mov rcx, qword [rbp - 0x48]
call fcn.14000a050
xor r9d, r9d
lea r8, [rbp + 0x98]
mov rdx, r12
lea rcx, [rbp - 0x50]
call fcn.140007340
nop
lea r9, [rbp + 0x70]
lea r8, [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rcx, r12
call fcn.140007330
mov edi, eax
mov qword [rbp + 0x10], r13
mov rdx, qword [str.Task_Scheduler]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rbp + 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x40]
mov rcx, r12
call fcn.1400058c0
movzx ebx, al
mov rcx, qword [rbp + 0x10]
call fcn.1400e825c
test bl, bl
je 0x14002e90d
cmp r15d, 0xffffffff
jne 0x14002e85c
mov qword [rbp + 0x50], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x48], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x40], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x38], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x30], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x28], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x20], r13
mov rax, qword [str.Task_Scheduler]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp + 0x20], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x18], r13
mov rax, qword [str.Task_Scheduler]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp + 0x18], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r13
lea rax, [rbp + 0x50]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], r13
lea rax, [rbp + 0x48]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea edx, [r15 + 3]
mov r8d, r15d
mov rcx, r12
call fcn.140005d90
mov r15d, eax
mov rcx, qword [rbp + 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x50]
call fcn.1400e825c
mov qword [rbp + 0x58], r13
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x58], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov eax, dword [rbp - 0x38]
shr eax, 2
not eax
and eax, 1
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r13
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], eax
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 9
mov r8d, r15d
mov edx, edi
mov rcx, r12
call fcn.140005d90
nop
mov rcx, qword [rbp + 0x58]
call fcn.1400e825c
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400e825c
nop
mov rbx, qword [rbp + 0xa0]
test rbx, rbx
je 0x14002e9c4
mov rdi, qword [rbp + 0xa8]
cmp rbx, rdi
je 0x14002e96f
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rdi
jne 0x14002e957
mov rbx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xb0]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002e9aa
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002eac7
mov rcx, rbx
call fcn.1400e0fb8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov rcx, qword [rbp + 0x98]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
mov ebx, gethostbyaddr
mov rcx, qword [rbp - 0x68]
mov rcx, qword [r14 + rcx]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
inc esi
cmp esi, dword [rbp - 0x7c]
jb 0x14002e250
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [rbp - 0x7c], r13d
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea r9, [rbp - 0x7c]
lea r8, [rbp - 0x68]
mov edx, 2
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jns 0x14002e240
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp + 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x70]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400e825c
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400e0b70
nop
mov ecx, 0x8007000e
call fcn.1400e0b70
nop
mov ecx, 0x8007000e
call fcn.1400e0b70
nop
mov ecx, 0x8007000e
call fcn.1400e0b70
nop
call fcn.1400e8160
int3