Function at 0x10020270
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x11a8
call fcn.10044fd0
sub rsp, rax
mov rax, qword [0x1005d650]
mov qword [rsp + 0x1170], rax
cmp ecx, dword [reloc.WS2_32.dll_connect]
mov qword [rsp + 0x1188], rdi
mov edi, ecx
jb 0x10020513
test rdx, rdx
je 0x10020513
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x1198], rbp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x870]
xor edx, edx
mov r8d, 0x900
call sub.msvcrt.dll_memset
xor ebp, ebp
lea rcx, [rsp + 0x58]
cmp edi, 8
cmova edi, ebp
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x62]
movzx edx, word [rsp + 0x60]
movzx r9d, word [rsp + 0x5a]
lea rax, [0x1005d8a0]
mov r11d, edi
movzx edi, word [rsp + 0x5e]
lea r8, str.GWCLI
mov qword [rsp + 0x48], r8
shl r11, 4
lea r8, str.__02d__02d__02d:_02d:_02d___s___s_
add r11, rax
movzx eax, word [rsp + 0x64]
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rcx, [rsp + 0x70]
mov edx, 0x800
mov dword [rsp + 0x20], edi
call fcn.1001ff70
mov r8, qword [rsp + 0x11b8]
lea r9, [rsp + 0x11c0]
lea rcx, [rsp + 0x870]
mov edx, 0x800
call qword [sym.imp.msvcrt.dll__vsnprintf]
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x70]
mov r8d, 0x7ff
call qword [sym.imp.msvcrt.dll_strncat]
lea rdx, [0x1004b3dc]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x86f], bpl
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
lea rdx, [0x1004b3e0]
lea rcx, [rsp + 0x70]
mov r8d, 0x7ff
call qword [sym.imp.msvcrt.dll_strncat]
mov eax, dword [reloc.WS2_32.dll_accept]
mov byte [rsp + 0x86f], bpl
test al, 1
je 0x100203ef
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [reloc.WS2_32.dll_accept]
test al, 2
je 0x1002050b
mov qword [rsp + 0x30], rbp
lea rcx, str.c:gwlog.txt
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x11a0], rbx
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x10020503
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x1190], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 1
mov esi, ebp
cmp eax, 0x400000
lea r9d, [rcx + 1]
cmova esi, ecx
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x500000
jbe 0x1002049b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
not rcx
mov qword [rsp + 0x20], rbp
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov rsi, qword [rsp + 0x1190]
je 0x10020503
lea rdx, str.c:gwlogbk.txt
lea rcx, str.c:gwlog.txt
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, str.c:gwlog.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbx, qword [rsp + 0x11a0]
mov rbp, qword [rsp + 0x1198]
mov rdi, qword [rsp + 0x1188]
mov rcx, qword [rsp + 0x1170]
call fcn.10044fa0
add rsp, 0x11a8
ret