Function at 0x14002d810
Capabilities:
Create process on windows
Get common file path
Schedule task via schtasks
Self delete
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x568]
sub rsp, 0x650
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140132280]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov r15, rcx
mov rax, qword [0x1401319e0]
mov qword [rbp - 0x80], rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0xb0]
or rdi, 0xffffffffffffffff
mov rax, rdi
nop
inc rax
cmp byte [rdx + rax + 0x2414], 0
jne 0x14002d870
cmp rax, 0xa
jae 0x14002d88b
xor r14d, r14d
jmp 0x14002e0e4
mov edx, 0x104
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0xf0]
call fcn.140045f40
lea rcx, [rbp - 0x30]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, dword [rbp - 0x30]
mov edx, ecx
shr edx, 0x10
movzx r10d, byte [rbp - 0x22]
movzx r11d, byte [rbp - 0x23]
movzx ebx, byte [rbp - 0x24]
movzx esi, byte [rbp - 0x25]
movzx r14d, byte [rbp - 0x26]
movzx r12d, byte [rbp - 0x27]
movzx r13d, byte [rbp - 0x28]
movzx eax, word [rbp - 0x2a]
movzx r9d, al
shr ax, 8
movzx eax, al
mov dword [rbp - 0x60], eax
movzx eax, word [rbp - 0x2c]
movzx r8d, al
mov dword [rbp - 0x5c], r8d
shr ax, 8
movzx eax, al
mov dword [rbp - 0x58], eax
movzx eax, cl
mov dword [rbp - 0x54], eax
shr cx, 8
movzx eax, cl
mov dword [rbp - 0x78], eax
movzx eax, dl
mov dword [rbp - 0x70], eax
shr dx, 8
movzx edx, dl
lea rcx, [rbp + 0xf0]
mov rax, rdi
movzx r8d, byte [rbp - 0x21]
inc rax
cmp byte [rcx + rax], 0
jne 0x14002d930
lea rcx, [rbp + 0xf0]
add rcx, rax
mov dword [rsp + 0x88], r8d
mov dword [rsp + 0x80], r10d
mov dword [rsp + 0x78], r11d
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r9d
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x5c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x70]
mov r8d, edx
lea rdx, str.x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x.cmd
call qword [sym.imp.USER32.dll_wsprintfA]
mov rax, qword [0x1401319e0]
mov qword [rbp - 0x68], rax
movzx eax, byte [rbp - 0x21]
movzx ecx, byte [rbp - 0x22]
movzx r9d, byte [rbp - 0x23]
movzx r8d, byte [rbp - 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.x_02x_02x_02x_02x
lea rcx, [rbp - 0x68]
call fcn.140044e20
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14002e0ad
mov rax, qword [r15 + 0x10]
mov r9, qword [rax + 0xb0]
add r9, 0x2414
mov r8, qword [rbp - 0x68]
lea rdx, str.SCHTASKS__DELETE__F__TN__s_r_nRD__S__Q___s__r_n
lea rcx, [rbp - 0x80]
call fcn.140044e20
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2eac
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x14c8
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x15cc
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x488
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x690
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x898
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x99c
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xaa0
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xba4
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xca8
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xdac
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xeb0
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x1cc
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x13c4
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x34c4
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xa87c
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x33c0
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x35c8
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x36cc
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x37d0
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2da8
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2fb0
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x9808
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x30b4
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xa980
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2a9c
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xab88
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xac8c
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xad90
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xae94
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xaf98
lea rcx, [rbp - 0x80]
call fcn.14002d040
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x200]
call fcn.140065dd0
mov rax, qword [r15 + 0x10]
mov r8, qword [rax + 0xb0]
add r8, 0x2da8
mov edx, 0x104
lea rcx, [rbp + 0x200]
call fcn.14006f110
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x310]
call fcn.140065dd0
lea r9, str.clntprxy.dll
lea r8, [rbp + 0x200]
lea rdx, [0x1400b8c04]
lea rcx, [rbp + 0x310]
call fcn.140027490
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x80]
call fcn.14002d040
lea r9, str.clntprxyio.dll
lea r8, [rbp + 0x200]
lea rdx, [0x1400b8c04]
lea rcx, [rbp + 0x310]
call fcn.140027490
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xcbb4
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xccb8
lea rcx, [rbp - 0x80]
call fcn.14002d040
mov rcx, qword [r15 + 0x38]
call fcn.140029460
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14002cc20
nop
mov r12, qword [rbp - 0x50]
mov rbx, r12
mov rsi, qword [rbp - 0x48]
cmp r12, rsi
je 0x14002debd
nop dword [rax + rax]
mov rcx, rbx
call fcn.140002720
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14002d040
add rbx, 0x20
cmp rbx, rsi
jne 0x14002dea0
mov rax, qword [r15 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x38d4
lea rcx, [rbp - 0x80]
call fcn.14002d040
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rbp - 0x78]
mov rcx, qword [r15 + 0x10]
call fcn.14002ff30
nop
mov rcx, qword [rax]
lea rdx, [rbp - 0x20]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x14002df10
lea rcx, [rbp - 0x78]
call fcn.1400446d0
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.140064f8c
test rax, rax
je 0x14002df8a
mov byte [rax], 0
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x20]
call fcn.14006f224
test eax, eax
je 0x14002df8a
mov rax, qword [0x1401319e0]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x20]
lea rdx, str.RD__Q___s__r_n
lea rcx, [rbp - 0x78]
call fcn.140044e20
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.140044950
nop
lea rcx, [rbp - 0x78]
call fcn.1400446d0
mov rax, qword [r15 + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
lea r8, [rbp - 0x20]
movzx eax, byte [rcx]
mov byte [r8], al
lea rcx, [rcx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x14002dfa0
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.140064f8c
test rax, rax
je 0x14002e012
mov byte [rax], 0
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x20]
call fcn.14006f224
test eax, eax
je 0x14002e012
mov rax, qword [0x1401319e0]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x20]
lea rdx, str.RD__Q___s__r_n
lea rcx, [rbp - 0x78]
call fcn.140044e20
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.140044950
nop
lea rcx, [rbp - 0x78]
call fcn.1400446d0
lea rdx, str.DEL__0
lea rcx, [rbp - 0x80]
call fcn.1400449b0
mov dword [rbp - 0x70], r14d
mov rdx, qword [rbp - 0x80]
nop word [rax + rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x14002e030
mov r8, rdi
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xf0]
call fcn.1400479a0
nop
test r12, r12
je 0x14002e0ad
mov rbx, r12
mov qword [rbp - 0x78], rbx
cmp r12, rsi
je 0x14002e08a
mov rcx, rbx
call fcn.1400036b0
add rbx, 0x20
mov qword [rbp - 0x78], rbx
cmp rbx, rsi
jne 0x14002e075
mov r8, qword [rbp - 0x40]
sub r8, r12
sar r8, 5
mov rdx, r12
lea rcx, [rbp - 0x50]
call fcn.140006bb0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
lea r9, [rbp + 0xf0]
mov r8, qword [rbp - 0x68]
lea rdx, str.SCHTASKS__CREATE__SC_ONSTART__RU_SYSTEM__TN__s__TR___s_
lea rcx, [rbp - 0x80]
call fcn.140044e20
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r14d, 1
lea rcx, [rbp - 0x68]
call fcn.1400446d0
nop
lea rcx, [rbp - 0x80]
call fcn.1400446d0
mov eax, r14d
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.140063ed0
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret