Function at 0x140015940
Capabilities:
Create process on windows
Delete file
Get common file path
Schedule task via schtasks

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400691d8]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rsi, rdx
mov r15, rcx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
xor bl, bl
xor edi, edi
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], di
xor r8d, r8d
lea rdx, [0x14005a2c4]
lea rcx, [rbp + 0xe0]
call fcn.140006e00
nop
lea rcx, [rbp + 0xe0]
call fcn.140016cc0
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x110], rdi
mov eax, 7
mov qword [rbp + 0x118], rax
mov word [rbp + 0x100], di
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x140016389
movabs r13, 0x7ffffffffffffffe
mov rax, r13
sub rax, rcx
cmp rax, 7
jb 0x1400164fa
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r9, qword [rbp + 0xe0]
mov qword [rsp + 0x30], 7
lea rax, str.Config
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0xe0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x120]
call fcn.140010860
nop
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xc0]
call fcn.140009620
nop
mov rcx, qword [rsi + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 1
jb 0x140016500
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x140015a8f
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x14005b35c]
mov r8, rsi
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x60]
call fcn.140010860
nop
lea r9, [rbp + 0x60]
mov r14, qword [rbp + 0x60]
mov r12, qword [rbp + 0x78]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xd8]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp + 0x70]
cmp rdx, rax
ja 0x140015b24
lea rdi, [rdx + rcx]
mov qword [rbp + 0xd0], rdi
lea rbx, [rbp + 0xc0]
cmp r8, 8
cmovae rbx, qword [rbp + 0xc0]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.1400277f0
xor eax, eax
mov word [rbx + rdi*2], ax
xor edi, edi
jmp 0x140015b3d
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xc0]
call fcn.1400075a0
mov r12, qword [rbp + 0x78]
mov r14, qword [rbp + 0x60]
cmp r12, 8
jb 0x140015b78
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140015b70
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001651e
mov rcx, r14
call fcn.140025900
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], di
mov r8d, 0x12
lea rdx, str.AMDInstallLauncher
lea rcx, [rbp + 0x60]
call fcn.140006e00
nop
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.140020f70
test eax, eax
setne bl
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140015bf4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015bef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016506
call fcn.140025900
test bl, bl
je 0x140015fa1
lea rdx, [rbp + 0x140]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], di
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140015c30
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x60]
call fcn.140006e00
nop
mov rcx, qword [rsi + 0x10]
sub r13, rcx
cmp r13, 1
jb 0x14001650c
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x140015c6a
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x14005b35c]
mov r8, rsi
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.140010860
nop
lea r9, [rbp + 0xa0]
mov r14, qword [rbp + 0xa0]
mov r12, qword [rbp + 0xb8]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x78]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp + 0xb0]
cmp rdx, rax
ja 0x140015cff
lea rdi, [rdx + rcx]
mov qword [rbp + 0x70], rdi
lea rbx, [rbp + 0x60]
cmp r8, 8
cmovae rbx, qword [rbp + 0x60]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.1400277f0
xor eax, eax
mov word [rbx + rdi*2], ax
xor edi, edi
jmp 0x140015d1b
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x60]
call fcn.1400075a0
mov r12, qword [rbp + 0xb8]
mov r14, qword [rbp + 0xa0]
cmp r12, 8
jb 0x140015d56
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140015d4e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016512
mov rcx, r14
call fcn.140025900
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x100]
call fcn.1400154a0
mov r8d, 8
lea rdx, str.RunLevel
test al, al
je 0x140015e2b
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x78], rax
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], 7
lea rcx, [rbp + 0xa0]
call fcn.140006e00
nop
lea rax, [rbp - 0x68]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.140009620
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
mov r8d, 0x10
lea rdx, str.HighestAvailable
lea rcx, [rsp + 0x58]
call fcn.140006e00
nop
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x48]
call fcn.140009620
nop
lea r9, [rbp + 0xa0]
lea rdx, [rsp + 0x58]
jmp 0x140015ec5
lea rax, [rsp + 0x58]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
lea rcx, [rsp + 0x58]
call fcn.140006e00
nop
lea rax, [rbp - 0x48]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140009620
mov rbx, rax
lea rax, [rbp + 0xa0]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], 7
mov r8d, 0xe
lea rdx, str.LeastPrivilege
lea rcx, [rbp + 0xa0]
call fcn.140006e00
nop
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x68]
call fcn.140009620
nop
lea r9, [rsp + 0x58]
lea rdx, [rbp + 0xa0]
mov r8, rbx
mov rcx, rax
call fcn.140014ca0
lea rax, [rsp + 0x58]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
mov r8d, 6
lea rdx, str.UserId
lea rcx, [rsp + 0x58]
call fcn.140006e00
nop
lea rax, [rbp - 0x48]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140009620
mov rdi, rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x68]
call fcn.140009620
mov rbx, rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.140009620
nop
lea r9, [rsp + 0x58]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140014ca0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140015f9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015f9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016518
call fcn.140025900
xor edi, edi
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], di
mov r8d, 0x16
lea rdx, str.schtasks__Create__TN__
lea rcx, [rbp + 0x80]
call fcn.140006e00
nop
mov rdx, qword [r15 + 0x10]
mov r9, r15
cmp qword [r15 + 0x18], 8
jb 0x140015fec
mov r9, qword [r15]
mov rcx, qword [rbp + 0x90]
mov r8, qword [rbp + 0x98]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14001603d
lea rdi, [rdx + rcx]
mov qword [rbp + 0x90], rdi
lea rbx, [rbp + 0x80]
cmp r8, 8
cmovae rbx, qword [rbp + 0x80]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.1400277f0
xor r14d, r14d
mov word [rbx + rdi*2], r14w
jmp 0x140016051
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x80]
call fcn.1400075a0
xor r14d, r14d
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x98]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x1400160a6
lea rdi, [rcx + 8]
mov qword [rbp + 0x90], rdi
lea rbx, [rbp + 0x80]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x80]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.___XML__
call fcn.1400277f0
mov word [rbx + rdi*2], r14w
jmp 0x1400160c7
mov qword [rsp + 0x20], 8
lea r9, str.___XML__
mov edx, 8
lea rcx, [rbp + 0x80]
call fcn.1400075a0
mov rdi, qword [rbp + 0xd0]
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
mov r14, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x140016138
lea rax, [r14 + rdi]
mov qword [rbp + 0x90], rax
lea rbx, [rbp + 0x80]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x80]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.1400277f0
lea rax, [r14 + rdi]
xor edi, edi
mov word [rbx + rax*2], di
jmp 0x14001614e
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.1400075a0
xor edi, edi
mov rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0x98]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x140016197
lea rcx, [rdx + 1]
mov qword [rbp + 0x90], rcx
lea rax, [rbp + 0x80]
cmp r8, 8
cmovae rax, qword [rbp + 0x80]
mov r8d, 0x22
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], di
jmp 0x1400161b8
mov qword [rsp + 0x20], 1
lea r9, [0x14005bb24]
mov edx, 1
lea rcx, [rbp + 0x80]
call fcn.1400075a0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp + 0x44], eax
mov dword [rbp - 0x20], 0x68
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rax
lea rax, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rax, qword [rbp + 0x120]
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140016276
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x14001627e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x1400162c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400162bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001651e
call fcn.140025900
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], di
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x140016323
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001631e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016524
call fcn.140025900
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], di
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140016382
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001637d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001652a
call fcn.140025900
mov rax, qword [rbp + 0x118]
cmp rax, 8
jb 0x1400163c8
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400163c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016530
call fcn.140025900
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], di
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x140016428
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016422
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016536
call fcn.140025900
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x140016467
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140016462
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400164ee
mov rcx, r8
call fcn.140025900
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 7
mov word [r15], di
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1400164b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400164ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400164f4
mov rcx, r8
call fcn.140025900
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
movzx eax, bl
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400258e0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002e1d4
nop
call fcn.14002e1d4
nop
call fcn.1400036c0
nop
call fcn.1400036c0
int3
call fcn.14002e1d4
nop
call fcn.1400036c0
int3
call fcn.14002e1d4
nop
call fcn.14002e1d4
int3
call fcn.14002e1d4
nop
call fcn.14002e1d4
nop
call fcn.14002e1d4
nop
call fcn.14002e1d4
nop
call fcn.14002e1d4
int3