Function at 0x14005a9a0
Capabilities:
Create process on windows
Get common file path
Schedule task via schtasks

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rbp + 0x220]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14005ae40
lea r8, [rbp + 0x220]
mov edx, 0x104
lea rcx, [rbp + 0x110]
call fcn.14009a15c
lea rdx, str.ServiceHub.bat
lea rcx, [rbp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor r14d, r14d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], r14b
lea rax, [rbp + 0x110]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14005aa40
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x28]
call fcn.1400218a0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp]
call fcn.140088260
mov r15d, 2
mov r8d, r15d
lea rdx, [rbp - 0x28]
lea rcx, [rbp]
call fcn.14001ce80
nop
lea rdx, str._echo_off__n
lea rcx, [rbp]
call fcn.140026050
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x14005aab0
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.1400218a0
nop
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14005aae0
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1400218a0
nop
mov r9d, 0x22
lea r8, str.SCHTASKS__CREATE__SC_ONLOGON__TN__
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14002d980
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 7
lea rdx, str.___TR__
lea rcx, [rsp + 0x38]
call fcn.140021a00
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x68]
lea r8, [rbp - 0x48]
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140039af0
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rbp]
call fcn.14002fa00
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14005abe9
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005abe4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ae6c
call fcn.140080f50
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14005ac36
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ac30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ae72
call fcn.140080f50
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14005ac73
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ac6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ae78
call fcn.140080f50
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14005acc3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005acbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ae7e
call fcn.140080f50
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14005ad11
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ad0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ae84
call fcn.140080f50
lea rdx, [0x1400d3e54]
lea rcx, [rbp]
call fcn.140026050
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.14002fa00
lea rcx, [rbp + 8]
call fcn.140020d50
test rax, rax
jne 0x14005ad71
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, r15d
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140003a40
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r8, qword [rbp - 0x28]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.14001db60
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 4], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400838c0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14005ae40
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ae3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ae66
call fcn.140080f50
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.140080f30
mov rbx, qword [rsp + 0x480]
add rsp, 0x440
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3