Function at 0x140005300
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140053040]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r13d, r13d
lea rcx, str.Checking_for_3rd_Party_Anti_Viruses
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r8d, [r13 + 0x69]
lea rdx, str.WMIC__Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get_displayName__Format:List
lea rcx, [rbp - 0x30]
call fcn.140002430
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r13b
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
lea rdx, [0x14004aa5c]
call fcn.1400218b8
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x140005454
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea r8d, [r13 + 0x54]
lea rdx, str.__Failed_to_check_for_3rd_party_Anti_Viruses__manually_check_and_uninstall__Error_4_
lea rcx, [rsp + 0x70]
call fcn.140002430
nop
lea rcx, [0x140053cb0]
call fcn.14000b710
lea rdx, str._X_
call fcn.140002150
lea rcx, [0x140053d00]
call fcn.14000b710
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000fa40
mov rcx, rax
call fcn.14000d3c0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005dc4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000544a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e85
call fcn.140016554
jmp 0x140005dc4
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x10]
call fcn.1400239fc
test rax, rax
je 0x1400054a3
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.140001d90
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x10]
call fcn.1400239fc
test rax, rax
jne 0x140005480
mov rcx, rbx
call fcn.1400217e0
nop dword [rax + rax]
lea rdi, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
seta r12b
mov r15, qword [rbp - 0x70]
cmova rdi, r15
mov r14, qword [rbp - 0x60]
cmp r14, 1
jb 0x140005525
lea rsi, [r14 + rdi]
mov r8, r14
mov edx, 0xa
mov rcx, rdi
call fcn.14003ccb0
mov rbx, rax
test rax, rax
je 0x140005525
nop dword [rax + rax]
cmp byte [rbx], 0xa
jne 0x1400054fa
mov eax, r13d
jmp 0x1400054ff
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400055fa
inc rbx
mov r8, rsi
sub r8, rbx
mov edx, 0xa
mov rcx, rbx
call fcn.14003ccb0
mov rbx, rax
test rax, rax
jne 0x1400054f0
mov rbx, 0xffffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x140005a6f
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8, rbx
cmp r14, rbx
cmovb r8, r14
lea rdx, [rbp - 0x70]
test r12b, r12b
cmovne rdx, r15
lea rcx, [rsp + 0x50]
call fcn.140002430
nop
lea r14, [rsp + 0x50]
mov r12, qword [rsp + 0x68]
cmp r12, 0xf
seta cl
mov byte [rsp + 0x20], cl
mov r15, qword [rsp + 0x50]
cmova r14, r15
mov r13, qword [rsp + 0x60]
cmp r13, 0x10
jb 0x140005614
lea rsi, [r14 + r13]
lea r8, [rsi - 0xf]
sub r8, r14
mov edx, 0x57
mov rcx, r14
call fcn.14003ccb0
mov rdi, rax
test rax, rax
je 0x14000560f
nop word [rax + rax]
mov r8d, 0x10
lea rdx, str.Windows_Defender
mov rcx, rdi
call fcn.14003d110
test eax, eax
je 0x140005602
inc rdi
lea r8, [rsi - 0xf]
sub r8, rdi
mov edx, 0x57
mov rcx, rdi
call fcn.14003ccb0
mov rdi, rax
test rax, rax
jne 0x1400055c0
jmp 0x14000560f
sub rbx, rdi
jmp 0x14000552c
sub rdi, r14
cmp rdi, 0xffffffffffffffff
jne 0x14000594a
movzx ecx, byte [rsp + 0x20]
cmp r13, 0xc
jbe 0x14000594a
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea rax, [r13 - 0xc]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rsp + 0x50]
test cl, cl
cmovne rdx, r15
add rdx, 0xc
lea rcx, [rsp + 0x70]
call fcn.140002430
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140005698
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005693
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e8b
call fcn.140016554
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm1
movups xmm2, xmmword [rbp - 0x80]
movups xmmword [rsp + 0x60], xmm2
lea rsi, [rsp + 0x50]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
seta cl
movq r9, xmm1
cmova rsi, r9
movq rax, xmm2
add rsi, rax
lea rdx, [rsp + 0x50]
test cl, cl
je 0x1400056e5
lea rdi, [r9 + rax]
jmp 0x1400056ee
lea rdi, [rax + rdx]
lea r9, [rsp + 0x50]
mov r8b, 0xa
mov rdx, rdi
mov rcx, r9
call fcn.140015040
mov r10, rax
cmp rax, rdi
je 0x140005726
inc rax
cmp rax, rdi
je 0x140005726
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x14000571e
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x140005710
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta r8b
cmova rcx, qword [rsp + 0x50]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rsp + 0x60]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x50]
test r8b, r8b
cmovne rcx, qword [rsp + 0x50]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.14003c630
mov qword [rsp + 0x60], rdi
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta cl
mov r9, qword [rsp + 0x50]
cmova rsi, r9
add rsi, rdi
lea rax, [rsp + 0x50]
test cl, cl
je 0x1400057a9
add rdi, r9
jmp 0x1400057b1
add rdi, rax
lea r9, [rsp + 0x50]
mov r8b, 0xd
mov rdx, rdi
mov rcx, r9
call fcn.140015040
mov r10, rax
cmp rax, rdi
je 0x1400057e6
inc rax
cmp rax, rdi
je 0x1400057e6
nop
movzx ecx, byte [rax]
cmp cl, 0xd
je 0x1400057de
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x1400057d0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta r8b
cmova rcx, qword [rsp + 0x50]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rsp + 0x60]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x50]
test r8b, r8b
cmovne rcx, qword [rsp + 0x50]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.14003c630
mov qword [rsp + 0x60], rdi
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta cl
mov r9, qword [rsp + 0x50]
cmova rsi, r9
add rsi, rdi
lea rax, [rsp + 0x50]
test cl, cl
je 0x140005869
add rdi, r9
jmp 0x140005871
add rdi, rax
lea r9, [rsp + 0x50]
mov r8b, 8
mov rdx, rdi
mov rcx, r9
call fcn.140015040
mov r10, rax
cmp rax, rdi
je 0x1400058a6
inc rax
cmp rax, rdi
je 0x1400058a6
nop
movzx ecx, byte [rax]
cmp cl, 8
je 0x14000589e
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x140005890
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta r8b
cmova rcx, qword [rsp + 0x50]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rsp + 0x60]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x50]
test r8b, r8b
cmovne rcx, qword [rsp + 0x50]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.14003c630
mov qword [rsp + 0x60], rdi
cmp qword [rbp - 0x40], 0
je 0x140005923
mov r8d, 2
lea rdx, [0x14004aacc]
lea rcx, [rbp - 0x50]
call fcn.1400020c0
mov rdi, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, rdi
lea rcx, [rbp - 0x50]
call fcn.1400020c0
mov r12, qword [rsp + 0x68]
mov r15, qword [rsp + 0x50]
inc rbx
mov rax, qword [rbp - 0x60]
cmp rbx, rax
jae 0x140005a34
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor r13d, r13d
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
cmp rax, rbx
jb 0x140005e91
sub rax, rbx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
add rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002430
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400059dd
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e8b
call fcn.140016554
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x60], xmm1
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400054b0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e97
call fcn.140016554
jmp 0x1400054b0
cmp r12, 0xf
jbe 0x140005a6c
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140005a64
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e97
mov rcx, r15
call fcn.140016554
xor r13d, r13d
mov rsi, qword [rbp - 0x40]
test rsi, rsi
je 0x140005cca
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x47
jb 0x140005e9d
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r15, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea r14, [rsi + 0x47]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
cmp r14, rbx
jbe 0x140005b43
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140005b04
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016510
test rax, rax
je 0x140005ea3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140005b3e
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140005b2c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005e79
jmp 0x140005ae5
test rcx, rcx
je 0x140005b3b
call fcn.140016510
mov rdi, rax
jmp 0x140005b3e
mov rdi, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [str.__A_3rd_party_Anti_Virus_is_installed__please_uninstall_or_disable_it__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14004aaf0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14004ab00]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14004ab10]
movups xmmword [rdi + 0x30], xmm1
mov eax, dword [0x14004ab20]
mov dword [rdi + 0x40], eax
movzx eax, word [0x14004ab24]
mov word [rdi + 0x44], ax
movzx eax, byte [0x14004ab26]
mov byte [rdi + 0x46], al
lea rcx, [rdi + 0x47]
mov r8, rsi
mov rdx, r15
call fcn.14003c630
mov byte [rdi + r14], 0
mov r8d, 1
lea rdx, [0x14004aad0]
lea rcx, [rsp + 0x28]
call fcn.1400020c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140005c2d
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ea9
call fcn.140016554
movdqa xmm0, xmmword [0x14004bf50]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
lea rcx, [0x140053cb0]
call fcn.14000b710
lea rdx, str._X_
call fcn.140002150
lea rcx, [0x140053d00]
call fcn.14000b710
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000fa40
mov rcx, rax
call fcn.14000d3c0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005d79
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e7f
jmp 0x140005d73
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8d, 0x26
lea rdx, str.__No_3rd_party_Anti_Virus_was_detected
lea rcx, [rsp + 0x70]
call fcn.140002430
nop
lea rcx, [0x140053ca0]
call fcn.14000b710
lea rdx, str.__
call fcn.140002150
lea rcx, [0x140053d00]
call fcn.14000b710
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000fa40
lea rcx, [0x140054530]
call fcn.14000d3c0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005d79
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005eaf
call fcn.140016554
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140005db4
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005daf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005eb5
call fcn.140016554
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140005dff
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ebb
call fcn.140016554
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140005e46
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e73
call fcn.140016554
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400164f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001d508
nop
call fcn.140001250
nop
call fcn.14001d508
nop
call fcn.14001d508
nop
call fcn.14001d508
int3
call fcn.14000cf20
nop
call fcn.14001d508
int3
call fcn.1400012f0
int3
call fcn.14001d508
nop
call fcn.14001d508
nop
call fcn.14001d508
nop
call fcn.14001d508
nop
call fcn.14001d508
int3