Function at 0x1402229d0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov qword [rsp + 0x40], 0xfffffffffffffffe
lea rdx, [rsp + 0x30]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
mov r9, qword [rsp + 0x30]
mov r8, qword [str.SUPERAntiSpyware_Scheduled_Task__s]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14000b150
lea rcx, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop word [rax + rax]
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x140222a30
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x60]
mov r15, rbx
inc r15
cmp word [rax + r15*2], 0
jne 0x140222a65
lea rax, vtable.CTaskScheduler.0
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140222680
mov r14d, eax
xor r12d, r12d
mov r13d, r12d
test eax, eax
jne 0x140222c96
mov rdi, qword [rbp + 0x2c0]
mov esi, r12d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 1
ja 0x140222c06
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x20], rax
lea r9, [0x1402c2e20]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1402c2e40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140222c00
mov rcx, qword [rbp + 0x2d8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x2d0]
call qword [rax + 0x28]
test eax, eax
js 0x140222bf3
mov qword [rbp + 0x2c8], r12
mov dword [rbp + 0x2c0], r12d
mov rcx, qword [rbp + 0x2d0]
mov rax, qword [rcx]
lea edx, [r13 + 1]
lea r9, [rbp + 0x2c0]
lea r8, [rbp + 0x2c8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x140222be6
mov rdx, qword [rbp + 0x2c8]
test rdx, rdx
je 0x140222be6
mov eax, dword [rbp + 0x2c0]
cmp eax, r13d
jbe 0x140222bb3
mov eax, r13d
lea rsi, [rax*8]
mov rax, qword [rsi + rdx]
nop
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140222b60
inc rbx
mov eax, 2
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rdi, rax
mov r8, qword [rbp + 0x2c8]
mov r8, qword [rsi + r8]
mov rdx, rbx
mov rcx, rax
call fcn.140251ec0
mov esi, 1
mov rdx, qword [rbp + 0x2c8]
mov eax, dword [rbp + 0x2c0]
mov ebx, r12d
test eax, eax
je 0x140222bdd
nop word [rax + rax]
mov ecx, ebx
mov rcx, qword [rdx + rcx*8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
inc ebx
mov rdx, qword [rbp + 0x2c8]
cmp ebx, dword [rbp + 0x2c0]
jb 0x140222bc0
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x2d0]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp + 0x2d8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
inc r13d
test esi, esi
je 0x140222c91
mov edx, 0x2e
mov rcx, rdi
call fcn.140249e3c
mov rbx, rax
test rax, rax
je 0x140222c39
lea rdx, [0x1402d2db8]
mov rcx, rax
call fcn.140252b94
test eax, eax
je 0x140222c4f
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rdi + rax*2], r12w
jne 0x140222c40
lea rbx, [rdi + rax*2]
sub rbx, rdi
sar rbx, 1
cmp r15, rbx
jne 0x140222c74
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.140252d0c
test eax, eax
mov eax, 1
cmove r14d, eax
mov edx, 2
mov rcx, rdi
call fcn.140247060
test r14d, r14d
mov rbx, 0xffffffffffffffff
je 0x140222aa2
mov eax, r14d
jmp 0x140222c96
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret