Function at 0x140001a80
Capabilities:
Execute command
Schedule task via schtasks

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov rsi, rcx
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
lea r8d, [rax + 7]
lea rdx, str.trading
lea rcx, [rbp - 8]
call fcn.1400047a0
nop
lea rcx, [rbp + 0x58]
call fcn.140001290
nop
movabs rax, 0x7fffffffffffffff
mov r15, rax
mov rdx, qword [rbp + 8]
sub r15, rdx
cmp r15, 0x15
jb 0x1400024a4
lea r12, [rbp - 8]
mov r13, qword [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova r12, r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r14, [rdx + 0x15]
mov ebx, 0xf
lea rdi, [rbp - 0x70]
movabs rcx, 0x8000000000000000
lea r8d, [rbx + 7]
cmp r14, rbx
jbe 0x140001bc5
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x140001b82
mov rbx, rax
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140004db0
test rax, rax
je 0x140001ba5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rbp + 8]
jmp 0x140001bc1
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001bac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002492
jmp 0x140001b63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001bbf
call fcn.140004db0
mov rdi, rax
mov rdx, qword [rbp + 8]
jmp 0x140001bc1
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [str.schtasks__create__tn]
movups xmmword [rdi], xmm0
mov eax, dword [0x140006618]
mov dword [rdi + 0x10], eax
movzx eax, byte [0x14000661c]
mov byte [rdi + 0x14], al
lea rcx, [rdi + 0x15]
mov r8, rdx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 5
lea rdx, str.__tr
lea rcx, [rbp - 0x70]
call fcn.1400041e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140001c53
mov r9, qword [rsi]
mov rdi, qword [rsi + 0x10]
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140001c9d
lea rax, [rcx + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x70]
jmp 0x140001caf
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140004a00
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0xe
lea rdx, str.__sc_once__st
lea rcx, [rsp + 0x30]
call fcn.1400041e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova r9, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140001d83
lea rax, [rcx + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x50]
jmp 0x140001d95
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140004a00
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x1400065e8]
lea rcx, [rbp - 0x30]
call fcn.1400041e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001e43
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001e94
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001ee7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ee2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ee2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001f39
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001f89
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp r15, 0x25
jb 0x1400024aa
lea r14, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova r14, r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r15, qword [rbp + 8]
lea rsi, [r15 + 0x25]
mov ebx, 0xf
lea rdi, [rbp - 0x50]
cmp rsi, rbx
jbe 0x140002076
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140002030
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004db0
test rax, rax
je 0x140002059
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002072
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002060
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002498
jmp 0x140002015
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000206f
call fcn.140004db0
mov rdi, rax
jmp 0x140002072
mov rdi, r12
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rbx
movups xmm0, xmmword [str._task__Get_ScheduledTask__TaskName_]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400066e8]
movups xmmword [rdi + 0x10], xmm1
mov eax, dword [0x1400066f8]
mov dword [rdi + 0x20], eax
movzx eax, byte [0x1400066fc]
mov byte [rdi + 0x24], al
lea rcx, [rdi + 0x25]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 0xb6
lea rdx, str.___task.Settings.StartWhenAvailable___true___task.Settings.DisallowStartIfOnBatteries___false___task.Settings.StopIfGoingOnBatteries___false__Set_ScheduledTask__InputObject__task
lea rcx, [rbp - 0x50]
call fcn.1400041e0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x78], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14000212e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002129
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002129
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r15, xmm6
sub rax, r15
cmp rax, 0x15
jb 0x14000248c
lea r13, [rbp + 0x78]
movq rsi, xmm7
psrldq xmm6, 8
movq r14, xmm6
cmp r14, 0xf
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r12, [r15 + 0x15]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp r12, rbx
jbe 0x140002218
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400021d9
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004db0
test rax, rax
je 0x1400022cc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002213
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002202
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000249e
jmp 0x1400021ba
test rcx, rcx
je 0x140002211
call fcn.140004db0
mov rdi, rax
jmp 0x140002213
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.powershell__Command__]
movups xmmword [rdi], xmm0
mov eax, dword [0x140006718]
mov dword [rdi + 0x10], eax
movzx eax, byte [0x14000671c]
mov byte [rdi + 0x14], al
lea rcx, [rdi + 0x15]
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov r8d, 1
lea rdx, [0x140006700]
lea rcx, [rsp + 0x30]
call fcn.1400041e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400022d8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14000232a
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002325
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002325
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
cmp r14, 0xf
jbe 0x140002376
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000236d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000236d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140004dec
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x1400023b4
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
movdqa xmm0, xmmword [0x1400068f0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x140002403
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov rax, qword [rbp + 0x10]
cmp rax, 0xf
jbe 0x140002452
lea rdx, [rax + 1]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000244d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000244d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004dec
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.140004d90
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3