Function at 0x140062c60
Capabilities:
Copy file
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x109d0
call fcn.140030eb0
sub rsp, rax
xor ebp, ebp
mov rsi, rcx
lea rcx, [rsp + 0x4d0]
mov r14, r8
mov rdi, rdx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x78], bp
mov word [rsp + 0x282], bp
mov qword [rsp + 0x4b0], rbp
call fcn.14004f480
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
lea r12d, [rbp + 1]
mov ebx, r12d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call fcn.140019f9c
lea r8, [rsp + 0x7c0]
mov rdx, rdi
mov rcx, rsi
call fcn.140062830
cmp eax, ebp
je 0x140062d0f
lea eax, [rbp + 6]
jmp 0x140062fc1
mov r9, qword [rsi]
lea rcx, [rsp + 0x10a10]
mov r8, r12
mov rdx, r12
call fcn.14001a708
mov r9, qword [rsi]
mov edi, 4
lea rcx, [rsp + 0x10a28]
mov rdx, rdi
mov r8, r12
call fcn.14001a708
mov r13d, dword [rsp + 0x10a28]
mov r9, qword [rsi]
lea rcx, [rsp + 0x10a28]
mov r8, r12
mov rdx, rdi
xor r13d, 0x87bc
call fcn.14001a708
mov r9, qword [rsi]
lea rcx, [rsp + 0x10a28]
mov r8, r12
mov rdx, rdi
call fcn.14001a708
mov eax, dword [rsp + 0x10a28]
mov r9, qword [rsi]
xor eax, 0xa685
lea rcx, [rsp + 0x34]
mov r8, r12
mov rdx, rdi
mov dword [rsp + 0x24], eax
call fcn.14001a708
mov r9, qword [rsi]
lea rcx, [rsp + 0x30]
mov r8, r12
mov rdx, rdi
call fcn.14001a708
mov r9, qword [rsi]
lea rcx, [rsp + 0x2c]
mov r8, r12
mov rdx, rdi
call fcn.14001a708
mov r9, qword [rsi]
lea rcx, [rsp + 0x28]
mov r8, r12
mov rdx, rdi
call fcn.14001a708
lea rdx, [rsp + 0x5b0]
mov rcx, rsi
call fcn.14003fbb0
lea rdx, [0x140098300]
lea rcx, [rsp + 0x5b0]
call fcn.140019edc
mov r15, rax
cmp rax, rbp
jne 0x140062e0b
lea eax, [rdi + 5]
jmp 0x140062fc1
mov edx, dword [rsi + 0xc]
lea rcx, [rsp + 0x4d0]
add edx, 0x2477
call fcn.14004f3b0
cmp r13d, ebp
mov edi, ebp
jle 0x140062ed7
xor r14d, r14d
lea eax, [rdi + 0x10000]
cmp eax, r13d
jle 0x140062e41
mov ebx, r13d
sub ebx, edi
jmp 0x140062e46
mov ebx, 0x10000
mov r9, qword [rsi]
movsxd r12, ebx
lea rcx, [rsp + 0x9d0]
mov r8, r12
mov edx, 1
add edi, ebx
call fcn.14001a708
cmp r12, r14
mov rbp, r14
jle 0x140062e8f
lea rcx, [rsp + 0x4d0]
xor edx, edx
mov r8d, 0xff
call fcn.14004f440
inc rbp
xor byte [rsp + rbp + 0x9cf], al
cmp rbp, r12
jl 0x140062e6b
lea rdx, [rsp + 0x9d0]
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.14003ffd0
mov r8, r12
mov r12d, 1
lea rcx, [rsp + 0x9d0]
mov r9, r15
mov rdx, r12
call fcn.14001a244
cmp edi, r13d
jl 0x140062e2f
mov ebx, dword [rsp + 0x20]
mov r14, qword [rsp + 0x10a20]
xor ebp, ebp
mov rcx, r15
call fcn.14001a374
cmp dword [rsp + 0x24], ebx
je 0x140062eef
mov ebx, 0xa
jmp 0x140062f8a
cmp byte [rsp + 0x10a10], r12b
jne 0x140062f6d
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x78], bp
mov word [rsp + 0x282], bp
mov qword [rsp + 0x4b0], rbp
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], ebp
call fcn.140018140
lea rcx, [rsp + 0x282]
mov rdx, r14
call fcn.140018140
lea rcx, [rsp + 0x40]
call fcn.140058810
cmp eax, ebp
je 0x140062f9c
mov ebx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x140062f8a
lea rcx, [rsp + 0x5b0]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebp
jne 0x140062f9c
mov ebx, 7
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x140062fc1
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, rsi
call fcn.14003fb30
xor eax, eax
mov rbx, qword [rsp + 0x10a18]
add rsp, 0x109d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret