Function at 0x18002b238
Capabilities:
Create thread
Move file
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x180058020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
and dword [rbp - 0x39], 0
cmp edx, 1
jne 0x18002b7bf
mov dword [rbp - 0x11], 0x407af639
mov dword [rbp - 0xd], 0x1ba7b6d4
mov dword [rbp - 9], 0xcb60debc
lea ebx, [rdx + 0xb]
mov r8d, 0x401d7701
mov edx, ebx
lea rcx, [rbp - 0x11]
call fcn.1800146c4
nop
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18002b76e
cmp byte [0x18005cab0], 0
jne 0x18002b7bf
mov byte [0x18005cab0], 1
mov dword [rbp - 0x11], 0x56da2855
mov dword [rbp - 0xd], 0x14a4454d
mov dword [rbp - 9], 0x241b7953
mov dword [rbp - 5], 0x557661b7
mov dword [rbp - 1], 0x158900b8
mov dword [rbp + 3], 0x2bab5038
mov edi, 0x5af15e95
mov r8d, edi
mov edx, ebx
lea rcx, [rbp - 0x11]
call fcn.18002c9f4
nop
lea r8, [rbp - 0x11]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x18002b7bf
mov dword [rbp + 7], 0x56da2855
mov dword [rbp + 0xb], 0x14a4454d
mov dword [rbp + 0xf], 0x241b7953
mov dword [rbp + 0x13], 0x557661b7
mov dword [rbp + 0x17], 0x158900b8
mov dword [rbp + 0x1b], 0x2bab5038
mov r8d, edi
mov edx, ebx
lea rcx, [rbp + 7]
call fcn.18002c9f4
nop
lea r8, [rbp + 7]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x18002b380
cmp eax, 0xb7
jne 0x18002b389
mov rcx, rdi
jmp 0x18002b382
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp - 0x31], 0xb958050b
mov dword [rbp - 0x2d], 0xbb27559f
mov dword [rbp - 0x29], 0x1632d7e1
mov dword [rbp - 0x25], 0x477dcf94
mov dword [rbp - 0x21], 0x874d1427
mov dword [rbp - 0x1d], 0xacb43963
mov dword [rbp - 0x19], 0xe2493908
mov dword [rbp - 0x15], 0x2aa4082b
mov edx, 0x20
mov r8d, 0xf1af6a51
lea rcx, [rbp - 0x31]
call fcn.1800146c4
nop
lea rcx, [rbp - 0x31]
call fcn.18002d1a4
mov rsi, rax
and qword [rbp - 0x31], 0
and qword [rbp - 0x21], 0
mov r12d, 0xf
mov qword [rbp - 0x19], r12
mov byte [rbp - 0x31], 0
mov dword [rbp - 0x39], 2
lea edx, [r12 + 5]
lea rcx, [rbp - 0x31]
call fcn.18002bda0
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
mov dword [rcx], 0xeab54ebb
mov dword [rcx + 4], 0x3bd757be
mov dword [rcx + 8], 0xf994f204
mov dword [rcx + 0xc], 0x5b3b03d6
mov dword [rcx + 0x10], 0x4a4d4b6c
mov byte [rcx + 0x14], 0x81
lea edx, [r12 + 6]
mov r8d, 0x6c0ba50a
call fcn.1800146c4
nop
lea rdx, [rbp - 0x31]
lea rbx, [0x180059110]
mov rcx, rbx
call fcn.18002bbe4
mov r15d, 0x1000
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x18002b4a7
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r15
jb 0x18002b4a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b4a2
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004975c
lea rcx, [rbp + 0x1f]
call fcn.18002b154
nop
mov rdx, rax
mov rcx, rbx
call fcn.18002bb54
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x18002b4f8
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, r15
jb 0x18002b4f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b4f2
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004975c
nop
and qword [rbp - 0x31], 0
and qword [rbp - 0x21], 0
mov qword [rbp - 0x19], r12
mov byte [rbp - 0x31], 0
mov dword [rbp - 0x39], 9
mov edx, 4
lea rcx, [rbp - 0x31]
call fcn.18002bda0
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
mov dword [rcx], 0x59959167
mov byte [rcx + 4], 0x92
mov edx, 5
mov r8d, 0x5e9e9af2
call fcn.1800146c4
nop
lea rdx, [rbp - 0x31]
mov rcx, rbx
call fcn.18002bb54
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x18002b58f
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r15
jb 0x18002b58a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b58a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004975c
cmp qword [0x180059128], 0x10
cmovae rbx, qword [0x180059110]
mov qword [0x180058050], rbx
lea rdx, [rbp - 0x31]
call fcn.18002b7f4
nop
mov rdx, rax
lea rbx, [0x180059130]
mov rcx, rbx
call fcn.18002bb54
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x18002b5fd
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r15
jb 0x18002b5f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b5f8
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004975c
and qword [rbp - 0x21], 0
mov qword [rbp - 0x19], r12
mov byte [rbp - 0x31], 0
cmp qword [0x180059148], 0x10
cmovae rbx, qword [0x180059130]
mov qword [0x180058058], rbx
mov rdx, qword [0x180058050]
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_rename]
call fcn.180028ea8
test rsi, rsi
je 0x18002b7bf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x1f]
call fcn.18002b7f4
nop
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x31]
call fcn.18002bf80
nop
lea rcx, [rbp - 0x31]
call fcn.180028dc0
mov bl, al
lea rcx, [rbp - 0x31]
call fcn.1800023ac
test bl, bl
je 0x18002b683
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
nop
mov dword [rbp - 0x31], 0x841deb5f
mov dword [rbp - 0x2d], 0xed228f2c
mov dword [rbp - 0x29], 0x8baa1f36
mov dword [rbp - 0x25], 0x78234008
mov dword [rbp - 0x21], 0xa4858790
mov dword [rbp - 0x1d], 0x4d5d1d0e
mov word [rbp - 0x19], 0xb0d9
mov byte [rbp - 0x17], 0x96
mov edx, 0x1b
mov r8d, 0xce5e3370
lea rcx, [rbp - 0x31]
call fcn.1800146c4
nop
mov dword [rbp - 0x11], 0xd9b2caf0
mov dword [rbp - 0xd], 0xd4fae023
mov word [rbp - 9], 0xeb10
mov edx, 0xa
mov r8d, 0x4411190c
lea rcx, [rbp - 0x11]
call fcn.1800146c4
nop
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [rax + 4]
inc eax
mov qword [0x18005a2a8], rax
lea rcx, [0x18002a620]
call fcn.18002a538
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x18002b7bf
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, r15
jb 0x18002b767
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b767
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004975c
jmp 0x18002b7bf
mov dword [rbp - 0x11], 0xc2a341eb
mov dword [rbp - 0xd], 0x8d58cdcf
mov dword [rbp - 9], 0xda238e69
mov word [rbp - 5], 0xbf3c
mov edx, 0xe
mov r8d, 0x218911cc
lea rcx, [rbp - 0x11]
call fcn.1800146c4
nop
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18002b7bf
xor r8d, r8d
xor edx, edx
lea rcx, [0x18002ad00]
call qword [sym.imp.ucrtbase.dll__beginthread]
mov eax, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1800492b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret