Function at 0x1400629a0
Capabilities:
Copy file
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x109d0
call fcn.140030df0
sub rsp, rax
xor ebp, ebp
mov rsi, rcx
lea rcx, [rsp + 0x4d0]
mov r14, r8
mov rdi, rdx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x78], bp
mov word [rsp + 0x282], bp
mov qword [rsp + 0x4b0], rbp
call fcn.14004f4c0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
lea r12d, [rbp + 1]
mov ebx, r12d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call fcn.140019f7c
lea r8, [rsp + 0x7c0]
mov rdx, rdi
mov rcx, rsi
call fcn.140062570
cmp eax, ebp
je 0x140062a4f
lea eax, [rbp + 6]
jmp 0x140062d01
mov r9, qword [rsi]
lea rcx, [rsp + 0x10a10]
mov r8, r12
mov rdx, r12
call fcn.14001a6e8
mov r9, qword [rsi]
mov edi, 4
lea rcx, [rsp + 0x10a28]
mov rdx, rdi
mov r8, r12
call fcn.14001a6e8
mov r13d, dword [rsp + 0x10a28]
mov r9, qword [rsi]
lea rcx, [rsp + 0x10a28]
mov r8, r12
mov rdx, rdi
xor r13d, 0x87bc
call fcn.14001a6e8
mov r9, qword [rsi]
lea rcx, [rsp + 0x10a28]
mov r8, r12
mov rdx, rdi
call fcn.14001a6e8
mov eax, dword [rsp + 0x10a28]
mov r9, qword [rsi]
xor eax, 0xa685
lea rcx, [rsp + 0x34]
mov r8, r12
mov rdx, rdi
mov dword [rsp + 0x24], eax
call fcn.14001a6e8
mov r9, qword [rsi]
lea rcx, [rsp + 0x30]
mov r8, r12
mov rdx, rdi
call fcn.14001a6e8
mov r9, qword [rsi]
lea rcx, [rsp + 0x2c]
mov r8, r12
mov rdx, rdi
call fcn.14001a6e8
mov r9, qword [rsi]
lea rcx, [rsp + 0x28]
mov r8, r12
mov rdx, rdi
call fcn.14001a6e8
lea rdx, [rsp + 0x5b0]
mov rcx, rsi
call fcn.14003fa10
lea rdx, [0x140099400]
lea rcx, [rsp + 0x5b0]
call fcn.140019ebc
mov r15, rax
cmp rax, rbp
jne 0x140062b4b
lea eax, [rdi + 5]
jmp 0x140062d01
mov edx, dword [rsi + 0xc]
lea rcx, [rsp + 0x4d0]
add edx, 0x2477
call fcn.14004f3f0
cmp r13d, ebp
mov edi, ebp
jle 0x140062c17
xor r14d, r14d
lea eax, [rdi + 0x10000]
cmp eax, r13d
jle 0x140062b81
mov ebx, r13d
sub ebx, edi
jmp 0x140062b86
mov ebx, 0x10000
mov r9, qword [rsi]
movsxd r12, ebx
lea rcx, [rsp + 0x9d0]
mov r8, r12
mov edx, 1
add edi, ebx
call fcn.14001a6e8
cmp r12, r14
mov rbp, r14
jle 0x140062bcf
lea rcx, [rsp + 0x4d0]
xor edx, edx
mov r8d, 0xff
call fcn.14004f480
inc rbp
xor byte [rsp + rbp + 0x9cf], al
cmp rbp, r12
jl 0x140062bab
lea rdx, [rsp + 0x9d0]
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.14003fe30
mov r8, r12
mov r12d, 1
lea rcx, [rsp + 0x9d0]
mov r9, r15
mov rdx, r12
call fcn.14001a224
cmp edi, r13d
jl 0x140062b6f
mov ebx, dword [rsp + 0x20]
mov r14, qword [rsp + 0x10a20]
xor ebp, ebp
mov rcx, r15
call fcn.14001a354
cmp dword [rsp + 0x24], ebx
je 0x140062c2f
mov ebx, 0xa
jmp 0x140062cca
cmp byte [rsp + 0x10a10], r12b
jne 0x140062cad
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x78], bp
mov word [rsp + 0x282], bp
mov qword [rsp + 0x4b0], rbp
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], ebp
call fcn.140018120
lea rcx, [rsp + 0x282]
mov rdx, r14
call fcn.140018120
lea rcx, [rsp + 0x40]
call fcn.1400589c0
cmp eax, ebp
je 0x140062cdc
mov ebx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x140062cca
lea rcx, [rsp + 0x5b0]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebp
jne 0x140062cdc
mov ebx, 7
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x140062d01
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, rsi
call fcn.14003f990
xor eax, eax
mov rbx, qword [rsp + 0x10a18]
add rsp, 0x109d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret