Function at 0x140215d04
Capabilities:
Schedule task via itaskscheduler

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
mov rsi, rcx
xor edi, edi
and qword [r11 + 0x10], rdi
lea rax, [r11 + 0x10]
mov qword [r11 - 0x28], rax
lea r9, [0x140328e20]
xor edx, edx
lea r8d, [rdi + 1]
lea rcx, [0x140328e30]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test eax, eax
js 0x14021572d
test rcx, rcx
je 0x140215729
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1402156db
and qword [rsp + 0x60], rcx
jmp 0x1402156f6
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1402156f6
mov ecx, 0x8007000e
call fcn.14000cbb8
nop
lea rdx, str..job
lea rcx, [rsp + 0x60]
call fcn.14007586c
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x38]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x58]
test ebx, ebx
jns 0x140215739
mov edi, 6
test ebx, ebx
jns 0x140215739
movzx edi, bx
test rcx, rcx
je 0x140215744
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov qword [rbp + 7], 0xfffffffffffffffe
mov r12, rcx
mov esi, 0xd
cmp qword [rcx], 0
je 0x14021591c
xor esi, esi
and qword [rbp + 0x67], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [0x140328e90]
xor edx, edx
lea r8d, [rsi + 1]
lea rcx, [0x140328f10]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
mov rcx, qword [rbp + 0x67]
test eax, eax
js 0x140215905
test rcx, rcx
je 0x140215901
lea rcx, [rbp - 0x79]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm1, xmmword [rbp - 0x79]
movups xmmword [rbp - 0x59], xmm1
movsd xmm0, qword [rbp - 0x69]
movsd qword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm1
movsd qword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm1
movsd qword [rbp - 9], xmm0
movups xmmword [rbp + 0x17], xmm1
movsd qword [rbp + 0x27], xmm0
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0x17]
call qword [rax + 0x50]
mov edi, eax
test eax, eax
js 0x1402158f3
and qword [rbp + 0x6f], rsi
mov rdi, qword [rbp + 0x67]
mov rax, qword [r12]
mov rcx, qword [rax + 0x30]
test rcx, rcx
jne 0x14021584f
xor ebx, ebx
mov qword [rbp + 0x77], rbx
jmp 0x14021586c
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x77], rax
test rax, rax
jne 0x14021586c
mov ecx, 0x8007000e
call fcn.14000cbb8
nop
mov rax, qword [rdi]
lea r8, [rbp + 0x6f]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x6f]
test edi, edi
js 0x1402158e7
test rcx, rcx
je 0x1402158e7
lea rcx, [0x140352420]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x77], rax
test rax, rax
jne 0x1402158b5
mov ecx, 0x8007000e
call fcn.14000cbb8
nop
mov rax, qword [r12]
mov rdx, qword [rax + 8]
lea rcx, [rbp + 0x77]
call fcn.14007586c
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbp + 0x77]
call qword [rax + 0x78]
mov edi, eax
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1402158f3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rbp - 0x79]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x67]
test edi, edi
jns 0x140215911
mov esi, 6
test edi, edi
jns 0x140215911
movzx esi, di
test rcx, rcx
je 0x14021591c
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, esi
add rsp, 0xe0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14023e03c
mov rcx, rbx
test al, al
je 0x140215d23
add rsp, 0x20
pop rbx
jmp 0x140215764
add rsp, 0x20
pop rbx
jmp 0x140215674