Function at 0x1400b7cd0
Capabilities:
Create process on windows
Get common file path
Schedule task via schtasks
Self delete
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x568]
sub rsp, 0x650
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov r13, rcx
mov rax, qword [0x14030b570]
mov qword [rbp - 0x80], rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0xb0]
or rdi, 0xffffffffffffffff
mov rax, rdi
nop
inc rax
cmp byte [rdx + rax + 0x247c], 0
jne 0x1400b7d30
cmp rax, 0xa
jae 0x1400b7d4b
xor r14d, r14d
jmp 0x1400b8584
mov edx, 0x104
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0xf0]
call fcn.1400f7c20
lea rcx, [rbp - 0x30]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, dword [rbp - 0x30]
mov edx, ecx
shr edx, 0x10
movzx r10d, byte [rbp - 0x22]
movzx r11d, byte [rbp - 0x23]
movzx ebx, byte [rbp - 0x24]
movzx esi, byte [rbp - 0x25]
movzx r14d, byte [rbp - 0x26]
movzx r15d, byte [rbp - 0x27]
movzx r12d, byte [rbp - 0x28]
movzx eax, word [rbp - 0x2a]
movzx r9d, al
shr ax, 8
movzx eax, al
mov dword [rbp - 0x60], eax
movzx eax, word [rbp - 0x2c]
movzx r8d, al
mov dword [rbp - 0x5c], r8d
shr ax, 8
movzx eax, al
mov dword [rbp - 0x58], eax
movzx eax, cl
mov dword [rbp - 0x54], eax
shr cx, 8
movzx eax, cl
mov dword [rbp - 0x78], eax
movzx eax, dl
mov dword [rbp - 0x70], eax
shr dx, 8
movzx edx, dl
lea rcx, [rbp + 0xf0]
mov rax, rdi
movzx r8d, byte [rbp - 0x21]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400b7df0
lea rcx, [rbp + 0xf0]
add rcx, rax
mov dword [rsp + 0x88], r8d
mov dword [rsp + 0x80], r10d
mov dword [rsp + 0x78], r11d
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r9d
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x5c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x70]
mov r8d, edx
lea rdx, str.x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x.cmd
call qword [sym.imp.USER32.dll_wsprintfA]
mov rax, qword [0x14030b570]
mov qword [rbp - 0x68], rax
movzx eax, byte [rbp - 0x21]
movzx ecx, byte [rbp - 0x22]
movzx r9d, byte [rbp - 0x23]
movzx r8d, byte [rbp - 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.x_02x_02x_02x_02x
lea rcx, [rbp - 0x68]
call fcn.1400f88e0
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400b854d
mov rax, qword [r13 + 0x10]
mov r9, qword [rax + 0xb0]
add r9, 0x247c
mov r8, qword [rbp - 0x68]
lea rdx, str.SCHTASKS__DELETE__F__TN__s_r_nRD__S__Q___s__r_n
lea rcx, [rbp - 0x80]
call fcn.1400f88e0
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2f14
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x1428
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x152c
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x3e8
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x5f0
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x7f8
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x8fc
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xa00
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xb04
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xc08
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xd0c
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xe10
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x134
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x1324
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x352c
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xa7cc
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x3428
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x3630
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x3734
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x3838
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2e10
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x3018
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x9758
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x311c
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xa8d0
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0x2b04
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xaad8
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xabdc
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xace0
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xade4
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xaee8
lea rcx, [rbp - 0x80]
call fcn.1400b7420
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x200]
call fcn.140141ad0
mov rax, qword [r13 + 0x10]
mov r8, qword [rax + 0xb0]
add r8, 0x2e10
mov edx, 0x104
lea rcx, [rbp + 0x200]
call fcn.140156f18
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x310]
call fcn.140141ad0
lea r9, str.clntprxy.dll
lea r8, [rbp + 0x200]
lea rdx, [0x140213910]
lea rcx, [rbp + 0x310]
call fcn.1400a61e0
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x80]
call fcn.1400b7420
lea r9, str.clntprxyio.dll
lea r8, [rbp + 0x200]
lea rdx, [0x140213910]
lea rcx, [rbp + 0x310]
call fcn.1400a61e0
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xcaf8
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rax, qword [r13 + 0x10]
mov rdx, qword [rax + 0xb0]
add rdx, 0xcbfc
lea rcx, [rbp - 0x80]
call fcn.1400b7420
mov rcx, qword [r13 + 0x38]
call fcn.1400a4e50
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400b7050
nop
mov r15, qword [rbp - 0x50]
mov rbx, r15
mov rsi, qword [rbp - 0x48]
cmp r15, rsi
je 0x1400b837d
nop dword [rax + rax]
mov rcx, rbx
call fcn.140022a60
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400b7420
add rbx, 0x20
cmp rbx, rsi
jne 0x1400b8360
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rbp - 0x78]
mov rcx, qword [r13 + 0x10]
call fcn.1400ba380
nop
mov rcx, qword [rax]
lea rdx, [rbp - 0x20]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x1400b83b0
lea rcx, [rbp - 0x78]
call fcn.1400f81a0
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.1401421b8
test rax, rax
je 0x1400b842a
mov byte [rax], 0
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x20]
call fcn.140156fb4
test eax, eax
je 0x1400b842a
mov rax, qword [0x14030b570]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x20]
lea rdx, str.RD__Q___s__r_n
lea rcx, [rbp - 0x78]
call fcn.1400f88e0
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.1400f8420
nop
lea rcx, [rbp - 0x78]
call fcn.1400f81a0
mov rax, qword [r13 + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
lea r8, [rbp - 0x20]
movzx eax, byte [rcx]
mov byte [r8], al
lea rcx, [rcx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x1400b8440
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.1401421b8
test rax, rax
je 0x1400b84b2
mov byte [rax], 0
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x20]
call fcn.140156fb4
test eax, eax
je 0x1400b84b2
mov rax, qword [0x14030b570]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x20]
lea rdx, str.RD__Q___s__r_n
lea rcx, [rbp - 0x78]
call fcn.1400f88e0
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.1400f8420
nop
lea rcx, [rbp - 0x78]
call fcn.1400f81a0
lea rdx, str.DEL__0
lea rcx, [rbp - 0x80]
call fcn.1400f8480
mov dword [rbp - 0x70], r14d
mov rdx, qword [rbp - 0x80]
nop word [rax + rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400b84d0
mov r8, rdi
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xf0]
call fcn.1400fd6a0
nop
test r15, r15
je 0x1400b854d
mov rbx, r15
mov qword [rbp - 0x78], rbx
cmp r15, rsi
je 0x1400b852a
mov rcx, rbx
call fcn.1400091f0
add rbx, 0x20
mov qword [rbp - 0x78], rbx
cmp rbx, rsi
jne 0x1400b8515
mov r8, qword [rbp - 0x40]
sub r8, r15
sar r8, 5
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.14002a420
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
lea r9, [rbp + 0xf0]
mov r8, qword [rbp - 0x68]
lea rdx, str.SCHTASKS__CREATE__SC_ONSTART__RU_SYSTEM__TN__s__TR___s_
lea rcx, [rbp - 0x80]
call fcn.1400f88e0
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r14d, 1
lea rcx, [rbp - 0x68]
call fcn.1400f81a0
nop
lea rcx, [rbp - 0x80]
call fcn.1400f81a0
mov eax, r14d
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret