Function at 0x140011c00
Capabilities:
Check mutex on windows
Copy file
Delete file
Move file
Set file attributes

Disassembly:
mov r11, rsp
push rbx
push rdi
push r13
sub rsp, 0x600
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x5d0], rax
xor eax, eax
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r12
xor r12d, r12d
mov rsi, rcx
mov byte [r11 - 0x388], r12b
mov rdi, rdx
xor r13d, r13d
lea rcx, [r11 - 0x157]
mov r8d, 0x103
xor edx, edx
mov dword [rsp + 0x291], eax
mov word [rsp + 0x295], ax
mov byte [rsp + 0x297], al
mov qword [rsp + 0x38], r12
lea ebp, [r13 + 5]
mov dword [rsp + 0x58], r12d
mov byte [rsp + 0x298], al
mov dword [rsp + 0x299], eax
mov word [rsp + 0x29d], ax
mov byte [rsp + 0x29f], al
mov byte [rsp + 0x4c0], al
call fcn.1400167a0
lea rcx, [rsp + 0x2a1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2a0], r12b
call fcn.1400167a0
test rdi, rdi
jne 0x140011cc7
lea ebx, [rbp + 3]
jmp 0x1400124fd
mov eax, dword [rdi + 0x18]
mov r13d, dword [rdi + 0xc]
mov ecx, dword [rdi]
mov r12d, dword [rdi + 4]
mov ebx, dword [rdi + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x1c]
mov qword [rsp + 0x5e8], r14
mov r14d, dword [rdi + 0x10]
mov dword [rsp + 0x40], eax
movzx eax, word [rdi + 0xa]
mov qword [rsp + 0x5e0], r15
movzx r15d, word [rdi + 8]
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x50], r12d
mov word [rsp + 0x48], ax
test r13d, r13d
je 0x1400124bd
test ecx, ecx
je 0x1400124bd
test r12d, r12d
je 0x1400124bd
test r15w, r15w
je 0x1400124bd
test ax, ax
je 0x1400124bd
cmp r15w, ax
je 0x1400124bd
cmp dword [rsi + 0xa4], 0
jne 0x140011d61
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
mov ebx, gethostbyaddr
jmp 0x1400124ed
cmp dword [rsi + 0xac], 0
je 0x140011d7e
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
mov ebx, gethostbyaddr
jmp 0x1400124ed
call fcn.1400087a0
test eax, eax
je 0x140011d9b
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
mov ebx, gethostbyaddr
jmp 0x1400124ed
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1400170d0
xor edi, edi
cmp r13d, 0x10040001
jne 0x140011dd4
mov byte [rsp + 0x34], 0x77
mov byte [rsp + 0x35], reloc.WS2_32.dll_socket
mov byte [rsp + 0x36], 0x2d
mov byte [rsp + 0x37], 0xce
cmp r12d, dword [rsp + 0x34]
mov eax, 0x4e20
cmove edi, eax
test ebx, ebx
je 0x140011de0
mov edi, ebx
imul edi, edi, 0x3e8
call fcn.140015c30
call fcn.140015db0
call fcn.140015f00
call fcn.1400164b0
test eax, eax
je 0x140011e08
xor r13d, r13d
mov ebx, gethostbyaddr
mov r12, r13
jmp 0x1400124ed
test edi, edi
jne 0x140011e2b
lea rdx, str.SYSTEMCurrentControlSetServicesRzxSvc
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.1400066c0
test eax, eax
je 0x140011e3c
mov edi, 0x2710
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x78]
call fcn.140008d60
lea rax, [rsp + 0x78]
lea rdx, [rsp + 0x2a0]
xor ecx, ecx
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 0x18
mov dword [rsp + 0x70], 1
call fcn.1400154b0
lea r8, [rsp + 0x2a0]
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r12, r12
je 0x1400124e8
cmp eax, 0xb7
jne 0x140011edf
mov edi, 0x78
nop dword [rax]
mov edx, 1
mov rcx, rsi
dec edi
call fcn.14000ffd0
test eax, eax
jne 0x140012133
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
jne 0x140011eb0
lea rcx, [rsi + 0xf4]
lea rdx, str._08X
mov r8d, r13d
xor ebx, ebx
mov dword [rsi + 0xc0], r13d
call fcn.140016e00
mov dword [rsi + 0xec], r14d
mov dword [rsi + 0xc4], r14d
test r14d, r14d
jne 0x140011f1b
mov dword [rsi + 0xec], reloc.WS2_32.dll_sendto
mov eax, dword [rsi + 0xec]
imul eax, eax, 0x3c
mov dword [rsi + 0xf0], eax
nop word [rax + rax]
xor eax, eax
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x290]
xor r9d, r9d
dec ebp
mov qword [rsp + 0x290], rax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x44], eax
call fcn.140016390
mov byte [rsp + 0x296], bl
mov byte [rsp + 0x297], bl
cmp byte [rsp + 0x290], bl
jne 0x140011fbe
cmp byte [rsp + 0x291], bl
jne 0x140011fbe
cmp byte [rsp + 0x292], bl
jne 0x140011fbe
cmp byte [rsp + 0x293], bl
jne 0x140011fbe
cmp byte [rsp + 0x294], bl
jne 0x140011fbe
cmp byte [rsp + 0x295], bl
jne 0x140011fbe
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xbb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test ebp, ebp
jne 0x140011f30
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x140011ff1
xor ecx, ecx
lea rdx, [rsp + 0x298]
mov qword [rsp + 0x298], rcx
mov ecx, eax
call fcn.140016490
mov eax, dword [rsp + 0x44]
mov byte [rsp + 0x29e], bl
mov byte [rsp + 0x29f], bl
mov ecx, dword [rsp + 0x4c]
mov dword [rsi + 0xcc], eax
mov rax, qword [rsp + 0x290]
mov qword [rsi + 0xd0], rax
mov rax, qword [rsp + 0x298]
mov dword [rsi + 0xc8], ecx
mov qword [rsi + 0xd8], rax
mov eax, dword [rsp + 0x54]
mov word [rsi + 0xe8], r15w
mov dword [rsi + 0xe0], eax
mov eax, dword [rsp + 0x50]
lea rcx, [rsi + 0x100]
mov dword [rsi + 0xe4], eax
mov ax, word [rsp + 0x48]
mov dword [rsp + 0x2a0], 0x252e7525
mov word [rsi + 0xea], ax
movzx edx, word [reloc.WS2_32.dll_socket]
movzx eax, word [0x1400bd9bc]
movzx r9d, word [reloc.WS2_32.dll_closesocket]
movzx r8d, word [reloc.WS2_32.dll_socket]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x2a0]
mov dword [rsp + 0x2a4], 0x75252e75
mov dword [rsp + 0x2a8], 0x75252e
call fcn.140016e00
mov edx, 1
mov rcx, rsi
call fcn.14000ffd0
test eax, eax
je 0x14001214e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
mov ecx, eax
call fcn.140001d54
xor edx, edx
lea rcx, [rsp + 0xa4]
lea r8d, [rdx + 0x5c]
mov dword [rsp + 0xa0], ebx
call fcn.1400167a0
lea rcx, [rsp + 0xa0]
mov edx, 0x60
call fcn.140001344
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x1400124e1
cmp edx, dword [rsi + 0xc0]
je 0x1400124da
mov r8d, dword [rsp + 0xc4]
lea rcx, [rsi + 0xc0]
call fcn.140014c10
mov r13d, dword [rsp + 0x30]
jmp 0x1400124ed
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, dword [rsp + 0x30]
xor r12d, r12d
mov ebx, 0xb7
jmp 0x1400124ed
mov eax, dword [rsp + 0x40]
lea rcx, [rsi + 0xc0]
xor edx, edx
mov dword [0x14014f448], eax
mov r9d, dword [rsi + 0x10]
mov r8d, dword [rsi + 0xc]
lea rax, [rsi + 0x31c]
mov qword [rsp + 0x28], rax
mov eax, dword [rsi + 0xa4]
mov dword [rsp + 0x20], eax
call fcn.140014940
lea rcx, [rsi + 0xc0]
mov edx, 0x10180000
call fcn.140001024
test eax, eax
je 0x140012220
xor eax, eax
lea rcx, [rsp + 0xa0]
lea edx, [rax + 0x40]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
call fcn.140015ff0
cmp byte [rsp + 0xa0], bl
jne 0x14001220c
lea rdx, str.99999999
lea rcx, [rsp + 0xa0]
call fcn.140009e70
lea rdx, [rsp + 0xa0]
lea rcx, [rsi + 0xc0]
call fcn.140015120
call fcn.140015c00
xor ebp, ebp
nop word [rax + rax]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140010010
mov r12, rax
test rax, rax
je 0x1400123ba
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1400170d0
call fcn.1400170e8
mov r14d, dword [rsp + 0x40]
mov r8d, eax
mov eax, 0x10624dd3
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], 0
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov rcx, r12
imul edx, edx, 0x3e8
sub r8d, edx
mov edx, r14d
inc r8d
call fcn.14000402c
mov r13, rax
test rax, rax
je 0x140012325
cmp dword [rsp + 0x34], 0
je 0x14001231d
mov r9d, ebp
lea rdx, [rsi + 0x870]
mov r8d, 0x104
and r9d, 1
mov rcx, rsi
mov dword [rsp + 0x20], r9d
call fcn.14000fb70
mov eax, dword [0x1400274e4]
lea rdi, [rsi + 0x974]
or rcx, 0xffffffffffffffff
mov dword [rdi], eax
movzx eax, byte [0x1400274e8]
mov byte [rdi + 4], al
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rsi + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400122f0
mov r8d, dword [rsp + 0x34]
mov rdx, r13
mov rcx, rsi
call fcn.140011980
mov ebx, eax
test eax, eax
je 0x1400123ca
mov rcx, r13
call fcn.1400168c0
mov edx, 1
mov rcx, rsi
call fcn.14000ffd0
test eax, eax
jne 0x1400123bf
mov r9d, ebp
lea rdx, [rsi + 0x870]
mov r8d, 0x104
and r9d, 1
mov rcx, rsi
mov dword [rsp + 0x20], r9d
call fcn.14000fb70
mov eax, dword [0x1400274e4]
lea rdi, [rsi + 0x974]
or rcx, 0xffffffffffffffff
mov dword [rdi], eax
movzx eax, byte [0x1400274e8]
mov byte [rdi + 4], al
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rsi + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140012380
mov r8d, r14d
mov rdx, r12
mov rcx, rsi
call fcn.140011980
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
je 0x1400123ca
jmp 0x1400123bf
mov ebx, 0x570
inc ebp
cmp ebp, 2
jl 0x140012230
mov edx, 2
mov rcx, rsi
call fcn.14000ffd0
test eax, eax
jne 0x1400123ec
lea r8d, [rax + 1]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140011470
mov edx, 1
mov rcx, rsi
call fcn.14000ffd0
test eax, eax
je 0x1400124ce
lea rcx, [rsp + 0x3b1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x3b0], 0
call fcn.1400167a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x3b0]
mov rcx, rax
mov r9d, 0x104
xor edx, edx
call sub.PSAPI.DLL_GetModuleBaseNameA
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x3b0]
mov ecx, eax
mov r8d, 1
call fcn.140001710
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
mov ecx, eax
call fcn.140001d54
lea rcx, [rsp + 0x100]
xor edx, edx
mov r8d, 0x184
call fcn.1400167a0
lea rcx, [rsp + 0x100]
xor edx, edx
call fcn.140001998
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x100]
mov edx, 1
mov dword [rsp + 0x104], eax
call fcn.140001998
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
jmp 0x1400124ed
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
mov ebx, 0x57
jmp 0x1400124ed
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
jmp 0x1400124ed
mov r13d, dword [rsp + 0x30]
jmp 0x1400124ed
mov r13d, dword [rsp + 0x30]
jmp 0x1400124ed
mov r13d, dword [rsp + 0x30]
mov r14, qword [rsp + 0x5e8]
mov r15, qword [rsp + 0x5e0]
call fcn.140005340
lea rcx, [rsi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbp, qword [rsp + 0x630]
test eax, eax
jne 0x14001260e
lea rdx, [rsi + 0x440]
lea rcx, [rsp + 0x2a0]
call fcn.140009e70
lea rdx, str.Temp_
lea rcx, [rsp + 0x2a0]
call fcn.140009e30
lea rcx, [rsp + 0x2a0]
mov edx, 0x5c
call fcn.140009f40
test rax, rax
je 0x140012571
mov byte [rax + 1], 0
call fcn.1400170e8
mov r8d, 0x104
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
lea rdx, [rsp + 0x4c0]
sub ecx, eax
add ecx, 7
call fcn.1400058a0
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0x2a0]
call fcn.140009e30
lea rdx, str..tmp
lea rcx, [rsp + 0x2a0]
call fcn.140009e30
lea rdx, [rsp + 0x2a0]
lea rcx, [rsi + 0x870]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
xor edx, edx
lea rcx, [rsp + 0x2a0]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rcx, [rsp + 0x2a0]
call fcn.140001fe4
lea rcx, [rsi + 0x870]
call fcn.140001fe4
lea rcx, [rsp + 0x2a0]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rdx, [rsp + 0x2a0]
xor r8d, r8d
mov rcx, rsi
call fcn.140010ca0
lea rdx, [rsi + 0x870]
lea rcx, [rsp + 0x2a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.140005490
test r12, r12
je 0x140012661
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
mov rcx, rsi
call fcn.14000ffd0
mov r12, qword [rsp + 0x5f0]
mov rsi, qword [rsp + 0x5f8]
test eax, eax
je 0x1400126cd
call fcn.140015770
lea r8, [0x140010470]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call fcn.140012710
mov rdi, rax
test rax, rax
je 0x1400126eb
test r13d, r13d
jne 0x1400126c4
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x5d0]
xor rcx, rsp
call fcn.1400168a0
add rsp, 0x600
pop r13
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400126cf