Function at 0x14000a8e0
Capabilities:
Check mutex on windows
Create thread
Get common file path
Move file
Set file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10b0
lea rax, [0x14001c4e4]
mov qword [rsp + 0x110], rax
mov dword [rsp + 0xa8], 8
cmp dword [rsp + 0xa8], 1
jne 0x14000a922
jmp 0x14000a93d
mov dword [rsp + 0x58], 2
cmp dword [rsp + 0x58], 0xa
jge 0x14000a93d
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
jmp 0x14000a92a
lea rax, [0x14001c3f4]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x450]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
lea rax, [rsp + 0xa80]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x660]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x870]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
call fcn.14000b660
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x100], 0
mov qword [rsp + 0xc8], 0
mov edx, 0x90
lea rcx, [rsp + 0x1b0]
call fcn.140005a10
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x64]
call fcn.140007740
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
jne 0x14000aa65
xor eax, eax
jmp 0x14000b220
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jge 0x14000aa7f
xor eax, eax
jmp 0x14000b220
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jge 0x14000aa99
xor eax, eax
jmp 0x14000b220
mov rcx, qword [rsp + 0xd0]
call fcn.14000b6f0
cmp eax, 1
je 0x14000aab2
xor eax, eax
jmp 0x14000b220
mov r8d, 0x104
lea rdx, [rsp + 0x660]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000aad3
xor eax, eax
jmp 0x14000b220
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x870]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x660]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x660]
lea r8, [0x14001c520]
mov edx, 0x104
lea rcx, [rsp + 0x870]
call fcn.14000bea0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x870]
lea r8, [0x14000b960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0xa80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x104
ja 0x14000ab8a
cmp dword [rsp + 0x5c], 0
jne 0x14000ab96
xor eax, eax
jmp 0x14000b220
mov r8d, 0x104
lea rdx, [rsp + 0x450]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000abb7
xor eax, eax
jmp 0x14000b220
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x240]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa80]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa80]
lea r8, [0x14001c530]
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.14000bea0
mov r8d, 1
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000accd
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x240]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x450]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x450]
lea r8, str._ws_ws
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.14000bea0
mov r8d, 0x104
lea rdx, [rsp + 0x450]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000ac9e
xor eax, eax
jmp 0x14000b220
mov r8d, 1
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, 6
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x80], 0
lea r8, str.Globale_Open_Lock
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ad3f
cmp qword [rsp + 0x80], 0
je 0x14000ad18
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x7d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x14000b220
mov dword [rsp + 0x60], 0x82
call fcn.14000b3f0
test eax, eax
je 0x14000ad54
jmp 0x14000adce
call fcn.1400049f0
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x104], 4
mov qword [rsp + 0xe0], 0xa
imul eax, dword [rsp + 0xe0], 3
imul eax, eax, 0x64
mov dword [rsp + 0xac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [rsp + 0xac]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1400049f0
sub rax, qword [rsp + 0x108]
cmp rax, qword [rsp + 0xe0]
jb 0x14000ad78
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x14000ad47
call fcn.14000b840
test eax, eax
je 0x14000adde
xor eax, eax
jmp 0x14000b220
call fcn.1400020e0
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
jne 0x14000adfd
xor eax, eax
jmp 0x14000b220
mov edx, 0x75e9d52
mov rcx, qword [rsp + 0x90]
call fcn.140005e50
mov qword [rsp + 0xf8], rax
mov edx, 0x5f582dc
mov rcx, qword [rsp + 0x90]
call fcn.140005e50
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0xf8], 0
je 0x14000ae47
cmp qword [rsp + 0x98], 0
jne 0x14000ae4e
xor eax, eax
jmp 0x14000b220
lea rax, [rsp + 0xea0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0xb0], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0xea0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov dx, 0x5c
lea rcx, [rsp + 0xea0]
call sub.msvcrt.dll_wcsrchr
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
add rax, 2
mov rdx, qword [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000aedb
xor eax, eax
jmp 0x14000b220
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x68], rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14000af1a
xor eax, eax
jmp 0x14000b220
mov r8, qword [rsp + 0x68]
mov edx, 0x90
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_memset
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_memcpy
lea r9, [rsp + 0x70]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x98]
cmp qword [rsp + 0x88], 0
je 0x14000af8d
mov edx, 0x1388
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x104
lea rcx, [rsp + 0xc90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0
jne 0x14000afca
lea r8, str....._
mov edx, 0x104
lea rcx, [rsp + 0xc90]
call fcn.140011590
cmp qword [rsp + 0x78], 0
je 0x14000b0d4
mov rcx, qword [rsp + 0x78]
call fcn.140006190
cmp eax, 3
jbe 0x14000b0d4
mov rcx, qword [rsp + 0x78]
call fcn.140002790
test eax, eax
je 0x14000b0d4
mov edx, 0x68
lea rcx, [rsp + 0x140]
call fcn.140005a10
mov edx, 0x18
lea rcx, [rsp + 0x120]
call fcn.140005a10
mov dword [rsp + 0x17c], 1
xor eax, eax
mov word [rsp + 0x180], ax
mov edx, 0x7a24c98
mov rcx, qword [rsp + 0x90]
call fcn.140005e50
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
jne 0x14000b060
xor eax, eax
jmp 0x14000b220
mov dword [rsp + 0x140], 0x68
mov dword [rsp + 0xb8], 0x8000000
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [rsp + 0xf0]
mov dword [rsp + 0xbc], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [rsp + 0xf8]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x14000b205
mov ecx, 0x20
call fcn.14000b3a0
lea r9, [rsp + 0x70]
mov r8d, 4
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x98]
cmp dword [rsp + 0x1bc], 0
jne 0x14000b172
mov dword [rsp + 0x20], 1
mov r9d, 0x80
lea r8, [rsp + 0x1c0]
mov edx, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x50]
call fcn.140005b10
test eax, eax
jne 0x14000b172
mov dword [0], 0
mov edx, 0x90
lea rcx, [rsp + 0x1b0]
call fcn.140005a10
lea r9, [rsp + 0x70]
mov r8d, 0x10
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x98]
test eax, eax
je 0x14000b1f7
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14000b1f7
cmp dword [0x14001c3f0], 0
jne 0x14000b1c5
call fcn.1400024a0
lea rcx, [0x14001c578]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14000b1e4
lea rcx, [rsp + 0xc90]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test eax, eax
je 0x14000b21e
xor r8d, r8d
mov edx, 0x64
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x10b0
pop rdi
ret