Function at 0x14000b040
Capabilities:
Create process on windows
Schedule task via schtasks

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rbx, rdx
xor r13d, r13d
test cl, cl
je 0x14000b354
mov ecx, 0x800
call fcn.14000bca4
mov r15, rax
mov r8d, 0x7ff
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x19], r13
lea esi, [r13 + 0xf]
mov qword [rbp - 0x11], rsi
mov byte [rbp - 0x29], r13b
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [r15 + rdi], r13b
jne 0x14000b0ab
lea rcx, [rbp - 0x29]
cmp rdi, rsi
ja 0x14000b0d3
mov qword [rbp - 0x19], rdi
mov r8, rdi
mov rdx, r15
call fcn.14000fbe0
mov byte [rbp + rdi - 0x29], r13b
jmp 0x14000b0df
mov r9, r15
mov rdx, rdi
call fcn.14000269c
nop
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x22
jb 0x14000b4fb
mov rax, rbx
mov edi, 0x10
cmp qword [rbx + 0x18], rdi
jb 0x14000b10b
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.Register_ScheduledTask__TaskName__
lea rcx, [rbp - 0x49]
call fcn.140002b2c
nop
mov r8d, 0xd1
lea rdx, str.___trigger___New_ScheduledTaskTrigger__Atlogon___settings___New_ScheduledTaskSettingsSet__AllowStartIfOnBatteries__DontStopIfGoingOnBatteries__ExecutionTimeLimit_0___action___New_ScheduledTaskAction__Execute_
lea rcx, [rbp - 0x49]
call fcn.14000224c
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rsi
mov byte [rax], r13b
lea r8, [rbp - 0x29]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140002414
nop
mov r8d, 0x1b
lea rdx, str.___force__RunLevel_Highest
mov rcx, rax
call fcn.14000224c
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x69], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x59], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rsi
mov byte [rax], r13b
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], rdi
cmovae r9, qword [rbp - 0x69]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r8, str.powershell.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp rax, 0x20
seta r12b
mov r14d, 0x1000
mov rdx, qword [rbp - 0x51]
cmp rdx, rdi
jb 0x14000b211
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, r14
jb 0x14000b20c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b501
call fcn.14000bc60
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x51], rsi
mov byte [rbp - 0x69], r13b
mov rdx, qword [rbp + 0xf]
cmp rdx, rdi
jb 0x14000b253
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, r14
jb 0x14000b24e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b507
call fcn.14000bc60
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], rsi
mov byte [rbp - 9], r13b
mov rdx, qword [rbp + 0x2f]
cmp rdx, rdi
jb 0x14000b296
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, r14
jb 0x14000b290
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b50d
call fcn.14000bc60
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, rdi
jb 0x14000b2cc
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, r14
jb 0x14000b2c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b513
call fcn.14000bc60
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], rsi
mov byte [rbp - 0x49], r13b
mov rdx, qword [rbp - 0x11]
cmp rdx, rdi
jb 0x14000b30e
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, r14
jb 0x14000b309
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b519
call fcn.14000bc60
mov rcx, r15
call fcn.14000bc60
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, rdi
jb 0x14000b34c
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x14000b347
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b51f
mov rcx, r8
call fcn.14000bc60
mov al, r12b
jmp 0x14000b4c3
mov rcx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
mov edi, 0x10
cmp rax, rdi
jb 0x14000b525
mov rax, rbx
cmp qword [rdx + 0x18], rdi
jb 0x14000b37f
mov rax, qword [rdx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str._delete__F__TN__
lea rcx, [rbp - 0x49]
call fcn.140002b2c
nop
mov r8d, 1
lea rdx, [0x14002d8d0]
lea rcx, [rbp - 0x49]
call fcn.14000224c
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x69], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x59], xmm1
mov qword [rax + 0x10], r13
mov esi, 0xf
mov qword [rax + 0x18], rsi
mov byte [rax], r13b
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], rdi
cmovae r9, qword [rbp - 0x69]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r8, str.schtasks.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp rax, 0x20
seta r15b
mov r14d, 0x1000
mov rdx, qword [rbp - 0x51]
cmp rdx, rdi
jb 0x14000b445
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, r14
jb 0x14000b440
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b52b
call fcn.14000bc60
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x51], rsi
mov byte [rbp - 0x69], r13b
mov rdx, qword [rbp - 0x31]
cmp rdx, rdi
jb 0x14000b483
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, r14
jb 0x14000b47e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b4ef
call fcn.14000bc60
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], rsi
mov byte [rbp - 0x49], r13b
mov rdx, qword [rbx + 0x18]
cmp rdx, rdi
jb 0x14000b4c0
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x14000b4bb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b4f5
mov rcx, r8
call fcn.14000bc60
mov al, r15b
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], rsi
mov byte [rbx], r13b
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140016740
nop
call fcn.140016740
nop
call fcn.140001364
nop
call fcn.140016740
nop
call fcn.140016740
nop
call fcn.140016740
nop
call fcn.140016740
nop
call fcn.140016740
nop
call fcn.140016740
nop
call fcn.140001364
nop
call fcn.140016740
int3