Function at 0x140043530
Capabilities:
Check mutex on windows
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r12, rcx
lea rdx, [rsp + 0x30]
xor r13d, r13d
lea rcx, str.6VVYqCAosWjD4erSfQbAx58PyBy3nBJ7_HJ5MS7YssM
mov qword [rsp + 0x30], r13
call fcn.140036bf0
mov r14, qword [rsp + 0x30]
lea r15d, [r13 + 1]
test r14, r14
je 0x14004370e
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r13
call fcn.140040790
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x14004370e
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rsi + rax], r13b
jne 0x1400435c0
test rax, rax
je 0x14004370e
mov rcx, rsi
call fcn.140040940
test eax, eax
jne 0x14004370e
mov rax, rdi
inc rax
cmp byte [rsi + rax], r13b
jne 0x1400435e5
mov rcx, rdi
cmp byte [r14 + rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x1400435f1
lea r15, [rcx + 2]
add r15, rax
mov rcx, r15
call fcn.1400462e4
mov rbx, rax
test rax, rax
je 0x1400436c6
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.1400466e0
lea r8, [0x14006d030]
mov rdx, r15
mov rcx, rbx
call fcn.140046b08
mov r8, r14
mov rdx, r15
mov rcx, rbx
call fcn.140046b08
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], r13b
jne 0x140043650
test rax, rax
je 0x14004369c
lea r8, [0x14006d81c]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14004cd44
test eax, eax
jne 0x14004369c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140043685
call fcn.14004c82c
mov rcx, rbx
call fcn.14003dda0
cmp eax, 0x3e8
jae 0x1400436c6
mov rcx, rbx
call fcn.140046a28
mov r8d, 0x104
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r15d, 1
lea rcx, [rbp - 0x60]
mov r8d, r15d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x1400436cc
mov r15d, 1
mov r8, rdi
nop
inc r8
cmp byte [rsi + r8], r13b
jne 0x1400436d0
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
test rbx, rbx
je 0x14004370e
inc rdi
cmp byte [rbx + rdi], r13b
jne 0x1400436f0
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov rcx, r14
call fcn.1400462d0
cmp dword [0x140073b00], 1
jne 0x14004376b
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], r13
call fcn.140003510
mov rcx, qword [rsp + 0x40]
call fcn.14003dda0
cmp eax, 0x46
jbe 0x14004375a
mov ecx, 5
mov dword [0x140074e1c], r15d
call fcn.140040b00
test eax, eax
je 0x14004375a
mov ecx, r15d
call fcn.1400360f0
mov rcx, qword [rsp + 0x40]
call fcn.1400462d0
mov dword [0x140073b00], r13d
mov eax, dword [0x140074e24]
add eax, 0xffffffc4
cmp eax, 0xa
ja 0x140043796
mov ecx, 5
call fcn.140040b00
test eax, eax
je 0x14004378f
mov ecx, r15d
call fcn.1400360f0
mov dword [0x140074e24], r13d
call fcn.1400428e0
lea rdx, [0x14006ce2d]
mov ecx, 0x11
call fcn.140004b50
mov rdx, qword [0x140074e30]
test rdx, rdx
je 0x1400437c2
mov ecx, SafeArrayCopy
call fcn.140004b50
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140043cdb
mov rax, qword [0x140074e28]
test rax, rax
je 0x1400438cb
cmp qword [rax + 8], r13
jbe 0x1400438cb
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], r13
lea rcx, str.6VVYqCAosWjD4erSfQbAxz6Ux6r0Ayh2PjEMjttsIQ
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x30], r13
call fcn.14003aa30
mov r14, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rdx, r14
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.14003b3c0
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140043891
cmp dword [rsp + 0x40], r13d
je 0x140043891
mov rdi, qword [rsi]
call fcn.140035b20
test eax, eax
lea rcx, [rsp + 0x50]
mov ebx, r13d
cmovne ebx, r15d
call fcn.1400467d4
test ebx, ebx
mov eax, 0x1c20
mov ecx, 0x93a80
cmove eax, ecx
add rax, rdi
cmp qword [rsp + 0x50], rax
jg 0x140043891
mov rcx, rsi
call fcn.1400462d0
mov rcx, r14
call fcn.1400462d0
mov rcx, qword [rsp + 0x30]
call fcn.1400462d0
jmp 0x1400438cb
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call fcn.14003c2d0
mov rcx, rsi
call fcn.1400462d0
mov rcx, r14
call fcn.1400462d0
mov rcx, qword [rsp + 0x30]
call fcn.1400462d0
mov ecx, 7
call fcn.140040b00
test eax, eax
je 0x1400438cb
call fcn.14003a2a0
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140043cdb
lea rcx, [rsp + 0x60]
call fcn.140003030
cmp dword [rbp - 0x70], r13d
je 0x1400438fe
cmp dword [rbp - 0x64], r13d
je 0x1400438fe
call fcn.1400411f0
jmp 0x140043cdb
mov rax, qword [0x140074e28]
test rax, rax
je 0x140043a8f
cmp qword [rax + 8], r13
jbe 0x140043a8f
call fcn.140036b70
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], r13
lea rcx, str.6VVYqCAosWjD4erSfQbAx91EFQc26S_xXK4ucMY5S8k
mov rdi, rax
call fcn.1400366c0
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.140037070
mov rcx, rbx
mov rsi, rax
call fcn.1400462d0
mov r15, qword [rsp + 0x48]
test r15, r15
je 0x140043967
mov byte [rsi + r15], r13b
mov rcx, rdi
call fcn.1400462d0
test r15, r15
je 0x140043a8f
mov r9, qword [0x140074e28]
mov r14d, r13d
cmp qword [r9 + 8], r13
jbe 0x140043a87
mov rsi, r13
nop
cmp dword [0x140074e20], 1
jne 0x1400439cb
mov rax, qword [r9]
mov r8, r15
mov rcx, qword [rsi + rax]
mov rax, qword [rcx]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400439c3
inc rax
test ecx, ecx
jne 0x1400439b0
test edx, edx
jne 0x140043a73
mov rax, qword [r9]
mov rcx, qword [rsi + rax]
mov rcx, qword [rcx]
call fcn.140004150
mov rax, qword [0x140074e28]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov rcx, qword [rax]
mov rcx, qword [rcx + rsi]
mov rcx, qword [rcx + 8]
call fcn.140037870
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, rbx
lea edx, [r9 + 1]
call fcn.140039a80
cmp eax, 1
jne 0x140043a23
xor ecx, ecx
call fcn.1400360f0
test rbx, rbx
je 0x140043a64
mov rdi, r13
cmp qword [rbx + 8], r13
jbe 0x140043a4d
mov rcx, qword [rbx]
mov rcx, qword [rcx + rdi*8]
call fcn.1400462d0
mov rax, qword [rbx]
mov qword [rax + rdi*8], r13
inc rdi
cmp rdi, qword [rbx + 8]
jb 0x140043a31
mov rcx, qword [rbx]
call fcn.1400462d0
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov dword [rbx + 0x18], r13d
mov rcx, rbx
call fcn.1400462d0
mov r9, qword [0x140074e28]
inc r14d
add rsi, 8
movsxd rax, r14d
cmp rax, qword [r9 + 8]
jb 0x140043990
mov rcx, r15
call fcn.1400462d0
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140043cdb
lea rcx, [rsp + 0x60]
call fcn.140003030
cmp dword [rbp - 0x70], r13d
je 0x140043abc
cmp dword [rbp - 0x64], r13d
jne 0x1400438f4
lea rax, str.6VVYqCAosWjD4erSfQbAx16KIjxemLh2gnZYXMLombOc07K5JzzLjE5uY7mGjvf
mov qword [rsp + 0x30], r13
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x50], rax
lea rcx, str.6VVYqCAosWjD4erSfQbAx7q1qQTxd3XDToam9OOsLicpoZjCoF9xZhybX9E32bCM
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
call fcn.140036bf0
lea rdx, [rsp + 0x48]
lea rcx, str.6VVYqCAosWjD4erSfQbAx7LRjJQTLKFnWbDBB3B8fmA
call fcn.140036bf0
mov rdi, qword [rsp + 0x48]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
call fcn.14003ed60
cmp eax, 1
jne 0x140043b3a
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r13
call fcn.140038720
mov rdx, qword [rsp + 0x48]
call fcn.14003f580
mov rcx, qword [rsp + 0x48]
call fcn.1400462d0
mov rcx, qword [rsp + 0x38]
call fcn.1400462d0
mov rcx, rdi
call fcn.1400462d0
mov rcx, qword [rsp + 0x30]
call fcn.1400462d0
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140043cdb
lea rcx, [rsp + 0x60]
call fcn.140003030
cmp dword [rbp - 0x70], r13d
je 0x140043b83
cmp dword [rbp - 0x64], r13d
jne 0x1400438f4
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], r13
lea rcx, str.6VVYqCAosWjD4erSfQbAxL0CZGEiNeiwQ1s8vuzgk
call fcn.14003aa30
mov r14, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov rdx, r14
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], r13
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], r13d
call fcn.14003b3c0
test eax, eax
jne 0x140043c16
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140043c16
mov rdi, qword [rsi]
call fcn.140035b20
test eax, eax
lea rcx, [rsp + 0x48]
mov eax, 1
mov ebx, r13d
cmovne ebx, eax
call fcn.1400467d4
test ebx, ebx
mov eax, 0x384
mov ecx, 0x93a80
cmove eax, ecx
add rax, rdi
cmp qword [rsp + 0x48], rax
jle 0x140043cd3
mov rcx, rsi
call fcn.1400462d0
mov ecx, 4
call fcn.140040b00
test eax, eax
je 0x140043cd3
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], r13
lea rcx, str.6VVYqCAosWjD4erSfQbAx2kWkrB7JCTey9TyZVmYfEoVUGdyEAkKAEzWjZWqNd58
call fcn.140036bf0
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x140043cd3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
jne 0x140043cca
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], r13
lea rcx, str.6VVYqCAosWjD4erSfQbAx7q1qQTxd3XDToam9OOsLicpoZjCoF9xZhybX9E32bCM
mov qword [rsp + 0x48], r13
call fcn.140036bf0
lea rdx, [rsp + 0x48]
lea rcx, str.6VVYqCAosWjD4erSfQbAx7TuMEJukscDsoJ7uzQdUo
call fcn.140036bf0
mov rdi, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov r9, r14
mov qword [rsp + 0x20], rdi
call fcn.14003ffc0
mov rcx, qword [rsp + 0x38]
call fcn.1400462d0
mov rcx, rdi
call fcn.1400462d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.1400462d0
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140043fc0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret