Function at 0x40a1c0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x11450
call fcn.00418790
sub rsp, rax
mov qword [rsp + 0x11430], 0xfffffffffffffffe
mov rax, qword [0x00423d58]
mov qword [rsp + 0x11448], rax
mov r8d, 0x320
xor edx, edx
lea rcx, [0x00423db0]
call sub.msvcrt.dll_memset
mov r8d, 0x320
xor edx, edx
lea rcx, [0x00424df0]
call sub.msvcrt.dll_memset
mov r8d, 0x320
xor edx, edx
lea rcx, [0x00425750]
call sub.msvcrt.dll_memset
mov r8d, 0x320
xor edx, edx
lea rcx, [0x00425110]
call sub.msvcrt.dll_memset
mov r8d, 0x320
xor edx, edx
lea rcx, [0x00425430]
call sub.msvcrt.dll_memset
mov r8d, 0x320
xor edx, edx
lea rcx, [0x00425a70]
call sub.msvcrt.dll_memset
mov r8d, 0xcf0
xor edx, edx
lea rcx, [0x00424100]
call sub.msvcrt.dll_memset
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x00424170], 1
cmp dword [rsp + 0x11460], 3
jl 0x40a2e1
lea rdx, [0x0041d140]
mov rax, qword [rsp + 0x11468]
mov rcx, qword [rax + 8]
call qword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
jne 0x40a2e1
mov rax, qword [rsp + 0x11468]
mov rcx, qword [rax + 0x10]
call fcn.00408c90
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
jmp 0x40bd8b
xor ecx, ecx
call fcn.004051e0
lea r8, [0x00424100]
mov rdx, qword [rsp + 0x11468]
mov ecx, dword [rsp + 0x11460]
call fcn.004082f0
test eax, eax
je 0x40a325
mov ecx, 1
call fcn.004051e0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
jmp 0x40bd8b
mov edx, 1
lea rcx, [0x00404ea0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
cmp dword [0x00424128], 1
jne 0x40a3a3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, [0x0042437c]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xfcb8], rax
cmp qword [rsp + 0xfcb8], 0xffffffffffffffff
je 0x40a3a3
mov rcx, qword [rsp + 0xfcb8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsp + 0xfcb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x21b0]
call fcn.00402f10
nop
mov dword [rsp + 0x2184], 2
mov dword [rsp + 0x98], 0x23
mov dword [rsp + 0xb0], 0
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, 0x20c8
rep stosb byte [rdi], al
cmp dword [0x00424100], 0
jne 0x40a400
mov eax, dword [rsp + 0x2184]
or eax, 1
mov dword [rsp + 0x2184], eax
cmp dword [0x00424144], 1
jne 0x40a41c
mov eax, dword [rsp + 0x2184]
or eax, 0x800
mov dword [rsp + 0x2184], eax
movzx eax, byte [0x00424b9c]
cmp eax, 1
jne 0x40a43b
mov eax, dword [rsp + 0x2184]
or eax, 0x1000
mov dword [rsp + 0x2184], eax
cmp dword [0x00424bb0], 1
jne 0x40a592
mov dword [rsp + 0xb0], 0x20d0
lea r8, [0x00424bbc]
mov edx, 0x208
lea rcx, [rsp + 0x2ea]
call fcn.0040beb0
mov eax, dword [0x00424bb4]
mov dword [rsp + 0x2e4], eax
movzx eax, word [0x00424bb8]
mov word [rsp + 0x2e8], ax
mov eax, dword [rsp + 0x2184]
or eax, 0x2000
mov dword [rsp + 0xd0], eax
cmp dword [0x00424130], 1
jne 0x40a568
mov r9d, dword [0x00424170]
lea r8, [rsp + 0xb0]
lea rdx, [0x00424174]
lea rcx, [rsp + 0x21b0]
call fcn.004033e0
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
jne 0x40a566
cmp dword [0x00424144], 1
jne 0x40a566
mov dword [rsp + 0xfcc0], 0
lea r8, [rsp + 0xfcc0]
mov edx, 0x700008
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
jne 0x40a529
cmp dword [rsp + 0xfcc0], 0
jne 0x40a566
lea rcx, [0x0041d150]
call fcn.00404ef0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x11408], 0xffffffff
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11408]
jmp 0x40bd8b
jmp 0x40a58d
mov r9d, dword [0x00424170]
lea r8, [rsp + 0xb0]
xor edx, edx
lea rcx, [rsp + 0x21b0]
call fcn.004033e0
mov dword [rsp + 0xfcb0], eax
jmp 0x40a6b1
mov dword [rsp + 0xb0], 0x20d0
mov eax, dword [rsp + 0x2184]
mov dword [rsp + 0xd0], eax
cmp dword [0x00424164], 1
jne 0x40a5bf
mov dword [rsp + 0xd8], 0x100
cmp dword [0x00424130], 1
jne 0x40a68c
mov r9d, dword [0x00424170]
lea r8, [rsp + 0xb0]
lea rdx, [0x00424174]
lea rcx, [rsp + 0x21b0]
call fcn.004033e0
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
jne 0x40a68a
cmp dword [0x00424144], 1
jne 0x40a68a
mov dword [rsp + 0xfcc4], 0
lea r8, [rsp + 0xfcc4]
mov edx, 0x700008
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
jne 0x40a64d
cmp dword [rsp + 0xfcc4], 0
jne 0x40a68a
lea rcx, [0x0041d1a0]
call fcn.00404ef0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x1140c], 0xffffffff
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x1140c]
jmp 0x40bd8b
jmp 0x40a6b1
mov r9d, dword [0x00424170]
lea r8, [rsp + 0xb0]
xor edx, edx
lea rcx, [rsp + 0x21b0]
call fcn.004033e0
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
je 0x40a6ff
mov edx, dword [rsp + 0xfcb0]
lea rcx, str.MeD_Engine_Initialize_Error___d_r_n
call fcn.00404ef0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x11410], 0xffffffff
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11410]
jmp 0x40bd8b
cmp dword [0x00424dc8], 1
jne 0x40a745
lea r8, [rsp + 0xfcc8]
mov edx, 0x710605
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
mov r8, qword [rsp + 0xfcc8]
mov rdx, qword [rsp + 0xfcc8]
lea rcx, str.PCID______________:__I64u__0x_I64x___r_n
call fcn.00404ef0
cmp dword [0x00424dcc], 1
jne 0x40a77b
lea rcx, [rsp + 0x21b0]
call fcn.00409ff0
mov dword [rsp + 0x11414], eax
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11414]
jmp 0x40bd8b
cmp qword [0x00424ba0], 0
je 0x40a8be
mov dword [rsp + 0xfcd8], 0
mov dword [rsp + 0x10300], 0
mov dword [rsp + 0x10304], 0
mov qword [rsp + 0xfcd0], 0
mov dword [rsp + 0xfce0], 6
mov dword [rsp + 0xfce4], 3
lea rax, [rsp + 0xfcf0]
mov qword [rsp + 0xfcd0], rax
mov rcx, qword [0x00424ba0]
call qword [sym.imp.msvcrt.dll_wcslen]
mov dword [rsp + 0x10308], eax
mov eax, dword [rsp + 0x10308]
cmp dword [rsp + 0x10300], eax
ja 0x40a8be
mov eax, dword [rsp + 0x10300]
mov rcx, qword [0x00424ba0]
movzx eax, word [rcx + rax*2]
cmp eax, 0x2c
je 0x40a831
mov eax, dword [rsp + 0x10300]
mov rcx, qword [0x00424ba0]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x40a874
mov eax, dword [rsp + 0xfcd8]
mov rcx, qword [rsp + 0xfcd0]
mov word [rcx + rax*2], 0
lea r8, [rsp + 0xfce0]
mov edx, 0x710104
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0x10304], eax
mov dword [rsp + 0xfcd8], 0
jmp 0x40a8a9
mov eax, dword [rsp + 0x10300]
mov ecx, dword [rsp + 0xfcd8]
mov rdx, qword [rsp + 0xfcd0]
mov rdi, qword [0x00424ba0]
movzx eax, word [rdi + rax*2]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0xfcd8]
inc eax
mov dword [rsp + 0xfcd8], eax
mov eax, dword [rsp + 0x10300]
inc eax
mov dword [rsp + 0x10300], eax
jmp 0x40a7f0
cmp qword [0x00424ba8], 0
je 0x40aa01
mov dword [rsp + 0x10318], 0
mov dword [rsp + 0x10940], 0
mov dword [rsp + 0x10944], 0
mov qword [rsp + 0x10310], 0
mov dword [rsp + 0x10320], 7
mov dword [rsp + 0x10324], 3
lea rax, [rsp + 0x10330]
mov qword [rsp + 0x10310], rax
mov rcx, qword [0x00424ba8]
call qword [sym.imp.msvcrt.dll_wcslen]
mov dword [rsp + 0x10948], eax
mov eax, dword [rsp + 0x10948]
cmp dword [rsp + 0x10940], eax
ja 0x40aa01
mov eax, dword [rsp + 0x10940]
mov rcx, qword [0x00424ba8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x2c
je 0x40a974
mov eax, dword [rsp + 0x10940]
mov rcx, qword [0x00424ba8]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x40a9b7
mov eax, dword [rsp + 0x10318]
mov rcx, qword [rsp + 0x10310]
mov word [rcx + rax*2], 0
lea r8, [rsp + 0x10320]
mov edx, 0x710104
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0x10944], eax
mov dword [rsp + 0x10318], 0
jmp 0x40a9ec
mov eax, dword [rsp + 0x10940]
mov ecx, dword [rsp + 0x10318]
mov rdx, qword [rsp + 0x10310]
mov rdi, qword [0x00424ba8]
movzx eax, word [rdi + rax*2]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0x10318]
inc eax
mov dword [rsp + 0x10318], eax
mov eax, dword [rsp + 0x10940]
inc eax
mov dword [rsp + 0x10940], eax
jmp 0x40a933
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x0042414c], 1
jne 0x40abcd
mov dword [rsp + 0x10954], 0
mov dword [rsp + 0x10950], 0
mov dword [rsp + 0x1094c], 0
lea r8, [rsp + 0x10954]
mov edx, 0x700008
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
je 0x40aaa2
lea rcx, [0x0041d290]
call fcn.00404ef0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x11418], 0xffffffff
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11418]
jmp 0x40bd8b
lea r8, [rsp + 0x10950]
mov edx, 0x70000a
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
je 0x40ab0a
lea rcx, str.MeD_Engine_DNA_Virus_Load_Error_r_n
call fcn.00404ef0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x1141c], 0xffffffff
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x1141c]
jmp 0x40bd8b
lea r8, [rsp + 0x1094c]
mov edx, 0x70000b
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
je 0x40ab41
lea rcx, str.MeD_Engine_DNA_CRC_Load_Error_r_n
call fcn.00404ef0
cmp dword [rsp + 0x10954], 0
je 0x40ab55
cmp dword [rsp + 0x10950], 0
jne 0x40ab94
lea rcx, str.MeD_Engine_DNA_Rule_Load_Error_r_n
call fcn.00404ef0
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x11420], 0xffffffff
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11420]
jmp 0x40bd8b
mov edx, dword [rsp + 0x10954]
lea rcx, str.DNA_Rule_Version__:__u_r_n
call fcn.00404ef0
mov edx, dword [rsp + 0x10950]
lea rcx, str.DNA_Virus_Version_:__u_r_n
call fcn.00404ef0
mov edx, dword [rsp + 0x1094c]
lea rcx, str.DNA_CRC_Version_:__u_r_n
call fcn.00404ef0
cmp dword [0x00424140], 1
jne 0x40abfb
mov eax, dword [rsp + 0x98]
and eax, 0xfffffffd
mov dword [rsp + 0x98], eax
mov dword [0x00424104], 0
mov dword [0x00424108], 0
cmp dword [0x00424144], 1
jne 0x40ac17
mov eax, dword [rsp + 0x98]
or eax, 0x200
mov dword [rsp + 0x98], eax
cmp dword [0x00424148], 1
jne 0x40ac33
mov eax, dword [rsp + 0x98]
or eax, 0x400
mov dword [rsp + 0x98], eax
cmp dword [0x00424104], 1
je 0x40ac49
cmp dword [0x00424108], 1
jne 0x40ace9
mov dword [rsp + 0x10958], 1
cmp dword [0x0042410c], 1
jne 0x40ac81
mov eax, dword [rsp + 0x10958]
or eax, 4
mov dword [rsp + 0x10958], eax
mov eax, dword [rsp + 0x98]
or eax, 0x100000
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x10958]
mov r8, rax
mov edx, 0x600001
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
cmp dword [0x00424110], 1
jne 0x40accd
lea r8, [0x0042478c]
mov edx, 0x600002
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
cmp dword [0x00424108], 1
jne 0x40ace7
mov eax, dword [rsp + 0x98]
or eax, 8
mov dword [rsp + 0x98], eax
jmp 0x40ad17
mov dword [rsp + 0x1095c], 0
mov eax, dword [rsp + 0x1095c]
mov r8, rax
mov edx, 0x600001
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
cmp dword [0x00424124], 1
jne 0x40ad31
mov eax, dword [rsp + 0x98]
or eax, 4
mov dword [rsp + 0x98], eax
cmp dword [0x00424150], 1
jne 0x40ad4f
mov eax, dword [rsp + 0x98]
or eax, 0x8000
mov dword [rsp + 0x98], eax
jmp 0x40ad62
mov eax, dword [rsp + 0x98]
or eax, 0x10000
mov dword [rsp + 0x98], eax
cmp dword [0x00424154], 1
jne 0x40ad7c
mov eax, dword [rsp + 0x98]
or eax, 0x10
mov dword [rsp + 0x98], eax
cmp dword [0x00424158], 1
jne 0x40addb
mov dword [rsp + 0x10960], 0
lea r8, [rsp + 0x10960]
mov edx, 0x600004
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
mov eax, dword [rsp + 0x10960]
or eax, 0x1000
mov eax, eax
mov r8, rax
mov edx, 0x600004
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
mov eax, dword [rsp + 0x98]
mov r8, rax
mov edx, 0x600003
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
cmp dword [0x00424dc4], 1
jne 0x40aea1
mov word [rsp + 0x10970], 0
lea r8, [rsp + 0x10970]
mov edx, 0x700305
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
jne 0x40aea1
movzx eax, word [rsp + 0x10970]
test eax, eax
je 0x40aea1
lea r8, [rsp + 0x10970]
mov edx, 0x700300
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
mov dword [rsp + 0x10b70], 0
jmp 0x40ae8a
mov eax, dword [rsp + 0x10b70]
inc eax
mov dword [rsp + 0x10b70], eax
cmp dword [rsp + 0x10b70], 0xa
jae 0x40aea1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40ae7a
mov eax, dword [0x0042413c]
mov r8, rax
mov edx, 0x600005
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
cmp dword [0x00424ddc], 1
jne 0x40af0d
mov r8d, 1
mov edx, 0x60011c
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
mov eax, dword [0x00424de0]
mov r8, rax
mov edx, 0x60011d
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov dword [rsp + 0xfcb0], eax
cmp dword [0x00424138], 1
je 0x40afb2
lea rcx, [rsp + 0x2198]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x21a4]
movzx ecx, word [rsp + 0x21a2]
movzx edx, word [rsp + 0x21a0]
movzx edi, word [rsp + 0x219e]
movzx r8d, word [rsp + 0x219a]
movzx r9d, word [rsp + 0x2198]
mov dword [rsp + 0x11438], r9d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, edi
mov eax, dword [rsp + 0x11438]
mov edx, eax
lea rcx, str.Scan_start________:__04d__02d__02d__02d:_02d:_02d_r_n_r_n
call fcn.00404ef0
cmp dword [0x00424138], 3
jne 0x40afb2
cmp dword [0x0042411c], 1
jne 0x40afa6
lea rcx, str.FileName_Ret_ScanResult_FileFormat_FileSize_Crc64_SeqNo_VirusName_Time_AhnLab_Symantec_TrendMicro_McAfee_Kaspersky_BitDefender_AntiVir_Avast_r_n
call fcn.00404ef0
jmp 0x40afb2
lea rcx, str.FileName_Ret_ScanResult_FileFormat_FileSize_Crc64_SeqNo_VirusName_Time_r_n
call fcn.00404ef0
lea rcx, [rsp + 0x70]
call fcn.00401250
nop
mov dword [rsp + 0x2188], 0
mov dword [rsp + 0x2194], 0
mov dword [rsp + 0x2190], 0
mov dword [rsp + 0x218c], 0
cmp dword [0x00424134], 1
jne 0x40b004
mov edx, 1
lea rcx, [rsp + 0x21b0]
call fcn.004049e0
cmp dword [0x00424dd4], 1
jne 0x40b01f
mov edx, 2
lea rcx, [rsp + 0x21b0]
call fcn.004049e0
cmp dword [0x00424dd8], 1
jne 0x40b03a
mov edx, 4
lea rcx, [rsp + 0x21b0]
call fcn.004049e0
lea rcx, [rsp + 0x70]
call fcn.004012c0
cmp dword [0x00424160], 0
jne 0x40b0b3
mov eax, dword [0x00423d80]
mov dword [rsp + 0x2180], eax
jmp 0x40b06c
mov eax, dword [rsp + 0x2180]
inc eax
mov dword [rsp + 0x2180], eax
mov eax, dword [rsp + 0x11460]
cmp dword [rsp + 0x2180], eax
jge 0x40b0ae
movsxd rax, dword [rsp + 0x2180]
lea r9, [rsp + 0x21b0]
lea r8, [0x004054c0]
mov rcx, qword [rsp + 0x11468]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x21b0]
call fcn.004047d0
jmp 0x40b05c
jmp 0x40b796
movzx eax, byte [0x0041d682]
mov byte [rsp + 0x10f80], al
lea rax, [rsp + 0x10f81]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
movzx eax, byte [0x0041d683]
mov byte [rsp + 0x10b80], al
lea rax, [rsp + 0x10b81]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
cmp dword [0x00424dd0], 1
jne 0x40b118
mov r8d, 1
mov edx, 0x60011a
lea rcx, [rsp + 0x21b0]
call fcn.00404a60
mov eax, dword [0x00423d80]
mov dword [rsp + 0x2180], eax
jmp 0x40b137
mov eax, dword [rsp + 0x2180]
inc eax
mov dword [rsp + 0x2180], eax
mov eax, dword [rsp + 0x11460]
cmp dword [rsp + 0x2180], eax
jge 0x40b796
mov byte [rsp + 0x10f80], 0
mov byte [rsp + 0x10b80], 0
movsxd rax, dword [rsp + 0x2180]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
lea rcx, [rsp + 0x10f80]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov rcx, qword [rsp + 0x11468]
mov r8, qword [rcx + rax*8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [0x0041d684]
lea rcx, [rsp + 0x10f80]
call qword [sym.imp.msvcrt.dll_strstr]
mov qword [rsp + 0x11380], rax
cmp qword [rsp + 0x11380], 0
je 0x40b231
mov rax, qword [rsp + 0x11380]
add rax, 3
mov qword [rsp + 0x11380], rax
lea rdx, [0x0041d688]
mov rcx, qword [rsp + 0x11380]
call qword [sym.imp.msvcrt.dll_strstr]
mov qword [rsp + 0x11380], rax
cmp qword [rsp + 0x11380], 0
je 0x40b22f
mov r8, qword [rsp + 0x11380]
mov edx, 0x400
lea rcx, [rsp + 0x10b80]
call fcn.0040bf10
mov rax, qword [rsp + 0x11380]
mov byte [rax], 0
jmp 0x40b27e
lea rdx, [0x0041d68c]
lea rcx, [rsp + 0x10f80]
call qword [sym.imp.msvcrt.dll_strstr]
mov qword [rsp + 0x11380], rax
cmp qword [rsp + 0x11380], 0
je 0x40b27e
mov r8, qword [rsp + 0x11380]
mov edx, 0x400
lea rcx, [rsp + 0x10b80]
call fcn.0040bf10
mov rax, qword [rsp + 0x11380]
mov byte [rax], 0
movsx eax, byte [rsp + 0x10b80]
test eax, eax
jne 0x40b29a
mov byte [rsp + 0x10b80], 0x2f
mov byte [rsp + 0x10b81], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11388]
lea r8, [rsp + 0x10b80]
lea rdx, [rsp + 0x10f80]
lea rcx, [rsp + 0x21b0]
call fcn.00404c90
mov dword [rsp + 0xfcb0], eax
movzx eax, byte [rsp + 0x113b5]
movzx ecx, byte [rsp + 0x113b4]
mov rdx, qword [rsp + 0x1138c]
and rdx, 0xff
shl rdx, 0x38
mov rdi, qword [rsp + 0x1138c]
and rdi, 0xff00
shl rdi, 0x28
or rdx, rdi
mov rdi, qword [rsp + 0x1138c]
and rdi, 0xff0000
shl rdi, 0x18
or rdx, rdi
mov edi, 0xff000000
mov r8, qword [rsp + 0x1138c]
and r8, rdi
mov rdi, r8
shl rdi, 8
or rdx, rdi
movabs rdi, 0xff00000000
mov r8, qword [rsp + 0x1138c]
and r8, rdi
mov rdi, r8
shr rdi, 8
or rdx, rdi
movabs rdi, 0xff0000000000
mov r8, qword [rsp + 0x1138c]
and r8, rdi
mov rdi, r8
shr rdi, 0x18
or rdx, rdi
movabs rdi, 0xff000000000000
mov r8, qword [rsp + 0x1138c]
and r8, rdi
mov rdi, r8
shr rdi, 0x28
or rdx, rdi
movabs rdi, 0xff00000000000000
mov r8, qword [rsp + 0x1138c]
and r8, rdi
mov rdi, r8
shr rdi, 0x38
or rdx, rdi
mov edi, dword [rsp + 0x113ac]
mov dword [rsp + 0x68], edi
mov edi, dword [rsp + 0x113b0]
mov dword [rsp + 0x60], edi
mov edi, dword [rsp + 0x113a8]
mov dword [rsp + 0x58], edi
mov rdi, qword [rsp + 0x1139c]
mov qword [rsp + 0x50], rdi
mov edi, dword [rsp + 0x113a4]
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x11388]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov rax, qword [rsp + 0x11394]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rsp + 0xfcb0]
lea r8, [rsp + 0x10b80]
lea rdx, [rsp + 0x10f80]
lea rcx, [0x0041d690]
call fcn.00404ef0
cmp dword [0x00424164], 1
jne 0x40b791
mov qword [rsp + 0x113b8], 0
mov ecx, 0x305
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x113b8], rax
cmp qword [rsp + 0x113b8], 0
jne 0x40b47d
mov dword [rsp + 0xfcb0], 8
jmp 0x40b778
mov r8d, 0x305
xor edx, edx
mov rcx, qword [rsp + 0x113b8]
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x10f80]
mov edx, 0x80
mov rcx, qword [rsp + 0x113b8]
call fcn.0040bf10
mov rax, qword [rsp + 0x113b8]
add rax, 0x80
lea r8, [rsp + 0x10b80]
mov edx, 0x200
mov rcx, rax
call fcn.0040bf10
mov rax, qword [rsp + 0x113b8]
mov word [rax + 0x280], 0x80
mov r8, qword [rsp + 0x113b8]
mov edx, 0x700014
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 8
jne 0x40b624
mov rax, qword [rsp + 0x113b8]
movzx eax, word [rax + 0x282]
test eax, eax
je 0x40b624
mov dword [rsp + 0x113c0], 0
mov rax, qword [rsp + 0x113b8]
movzx eax, word [rax + 0x282]
mov dword [rsp + 0x113c0], eax
mov rcx, qword [rsp + 0x113b8]
call qword [sym.imp.msvcrt.dll_free]
movsxd rax, dword [rsp + 0x113c0]
add rax, 0x285
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x113b8], rax
cmp qword [rsp + 0x113b8], 0
jne 0x40b58f
mov dword [rsp + 0xfcb0], 8
jmp 0x40b778
movsxd rax, dword [rsp + 0x113c0]
add rax, 0x285
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x113b8]
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x10f80]
mov edx, 0x80
mov rcx, qword [rsp + 0x113b8]
call fcn.0040bf10
mov rax, qword [rsp + 0x113b8]
add rax, 0x80
lea r8, [rsp + 0x10b80]
mov edx, 0x200
mov rcx, rax
call fcn.0040bf10
mov rax, qword [rsp + 0x113b8]
movzx ecx, word [rsp + 0x113c0]
mov word [rax + 0x280], cx
mov r8, qword [rsp + 0x113b8]
mov edx, 0x700014
lea rcx, [rsp + 0x21b0]
call fcn.00404b30
mov dword [rsp + 0xfcb0], eax
cmp dword [rsp + 0xfcb0], 0
jne 0x40b75b
mov rax, qword [rsp + 0x113b8]
movzx eax, word [rax + 0x282]
test eax, eax
jne 0x40b656
lea rcx, str.Get_UrlSourceInfo_Failed__no_UrlSource_r_n
call fcn.00404ef0
jmp 0x40b759
mov qword [rsp + 0x113c8], 0
mov rax, qword [rsp + 0x113b8]
movzx eax, word [rax + 0x282]
inc eax
cdqe
shl rax, 1
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x113c8], rax
cmp qword [rsp + 0x113c8], 0
jne 0x40b6a4
mov dword [rsp + 0xfcb0], 8
jmp 0x40b778
mov rax, qword [rsp + 0x113b8]
movzx eax, word [rax + 0x282]
inc eax
cdqe
shl rax, 1
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x113c8]
call sub.msvcrt.dll_memset
lea rdx, [0x0041d842]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_setlocale]
mov rax, qword [rsp + 0x113b8]
movzx eax, word [rax + 0x282]
mov rcx, qword [rsp + 0x113b8]
movzx ecx, word [rcx + 0x282]
mov rdx, qword [rsp + 0x113b8]
add rdx, 0x284
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x113c8]
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov r8, rdx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rsp + 0x113c8]
lea rcx, str.UrlSourceInfo___s_r_n
call fcn.00404ef0
cmp qword [rsp + 0x113c8], 0
je 0x40b759
mov rcx, qword [rsp + 0x113c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x40b76e
mov edx, dword [rsp + 0xfcb0]
lea rcx, str.Get_UrlSourceInfo_Failed__dwRtVal___d_r_n
call fcn.00404ef0
xor eax, eax
test eax, eax
jne 0x40b44f
cmp qword [rsp + 0x113b8], 0
je 0x40b791
mov rcx, qword [rsp + 0x113b8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x40b127
lea rcx, [rsp + 0x70]
call fcn.004012f0
lea rcx, [rsp + 0x70]
call fcn.00401320
cvttss2si rax, xmm0
mov dword [rsp + 0x218c], eax
xor edx, edx
mov eax, dword [rsp + 0x218c]
mov ecx, 0xe10
div ecx
mov dword [rsp + 0x2188], eax
xor edx, edx
mov eax, dword [rsp + 0x218c]
mov ecx, 0x3c
div ecx
xor edx, edx
mov ecx, 0x3c
div ecx
mov eax, edx
mov dword [rsp + 0x2194], eax
xor edx, edx
mov eax, dword [rsp + 0x218c]
mov ecx, 0x3c
div ecx
mov eax, edx
mov dword [rsp + 0x2190], eax
lea rcx, [rsp + 0x21b0]
call fcn.004037f0
cmp dword [0x00424160], 0
jne 0x40bc99
mov qword [rsp + 0x113d0], 0
mov qword [rsp + 0x113e0], 0
mov qword [rsp + 0x113f8], 0
mov qword [rsp + 0x113d8], 0
mov qword [rsp + 0x113e8], 0
mov qword [rsp + 0x113f0], 0
mov dword [rsp + 0x2180], 0
jmp 0x40b887
mov eax, dword [rsp + 0x2180]
inc eax
mov dword [rsp + 0x2180], eax
cmp dword [rsp + 0x2180], 0x64
jge 0x40b990
movsxd rax, dword [rsp + 0x2180]
lea rcx, [0x00423db0]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x113d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d0], rax
movsxd rax, dword [rsp + 0x2180]
lea rcx, [0x00424df0]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x113e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113e0], rax
movsxd rax, dword [rsp + 0x2180]
lea rcx, [0x00425750]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x113f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113f8], rax
movsxd rax, dword [rsp + 0x2180]
lea rcx, [0x00425110]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x113d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
movsxd rax, dword [rsp + 0x2180]
lea rcx, [0x00425430]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x113e8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113e8], rax
movsxd rax, dword [rsp + 0x2180]
lea rcx, [0x00425a70]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x113f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113f0], rax
jmp 0x40b877
cmp dword [0x00424138], 1
jne 0x40bab8
cmp dword [0x0042412c], 1
jne 0x40bab8
lea rdx, [0x0041d8d4]
lea rcx, [0x00424584]
call qword [sym.imp.msvcrt.dll__wfopen]
mov qword [rsp + 0x11400], rax
cmp qword [rsp + 0x11400], 0
jne 0x40b9e9
lea rdx, [0x00424584]
lea rcx, [0x0041d8d8]
call fcn.00404ef0
jmp 0x40bab8
mov r8, qword [rsp + 0x113d0]
lea rdx, str.Total_Files_:__I64u_n
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fprintf]
mov r8, qword [rsp + 0x113e0]
lea rdx, str.Number_of_Scans_:__I64u_n
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fprintf]
mov r8, qword [rsp + 0x113f8]
lea rdx, str.Number_of_Infections_:__I64u_n
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fprintf]
mov r8, qword [rsp + 0x113e8]
lea rdx, str.Number_of_Cleans_:__I64u_n
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fprintf]
mov r8, qword [rsp + 0x113d8]
lea rdx, str.Errors_:__I64u_n
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fprintf]
mov eax, dword [rsp + 0x2190]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x2194]
mov r8d, dword [rsp + 0x2188]
lea rdx, str.Scan_Time_:__02d:_02d:_02d_n
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, qword [rsp + 0x11400]
call qword [sym.imp.msvcrt.dll_fclose]
lea rcx, [0x0041d9bc]
call fcn.00404ef0
mov eax, dword [0x00423d80]
mov dword [rsp + 0x2180], eax
jmp 0x40bae3
mov eax, dword [rsp + 0x2180]
inc eax
mov dword [rsp + 0x2180], eax
mov eax, dword [rsp + 0x11460]
cmp dword [rsp + 0x2180], eax
jge 0x40bb46
mov eax, dword [0x00423d80]
cmp dword [rsp + 0x2180], eax
jne 0x40bb24
movsxd rax, dword [rsp + 0x2180]
mov rcx, qword [rsp + 0x11468]
mov rdx, qword [rcx + rax*8]
lea rcx, str.Scanned_Directory_:__s_r_n
call fcn.00404ef0
jmp 0x40bb44
movsxd rax, dword [rsp + 0x2180]
mov rcx, qword [rsp + 0x11468]
mov rdx, qword [rcx + rax*8]
lea rcx, str._____________________s_r_n
call fcn.00404ef0
jmp 0x40bad3
mov rdx, qword [rsp + 0x113d0]
lea rcx, str.Total_Files_______:__I64u_r_n
call fcn.00404ef0
mov rdx, qword [rsp + 0x113e0]
lea rcx, str.Scanned_Files_____:__I64u_r_n
call fcn.00404ef0
mov rdx, qword [rsp + 0x113f8]
lea rcx, str.Infected_Files____:__I64u_r_n
call fcn.00404ef0
mov rdx, qword [rsp + 0x113e8]
lea rcx, str.Cleaned_Files_____:__I64u_r_n
call fcn.00404ef0
mov rdx, qword [rsp + 0x113d8]
lea rcx, str.Errors____________:__I64u_r_n
call fcn.00404ef0
mov rdx, qword [rsp + 0x113f0]
lea rcx, str.Multi_Tagged______:__I64u_r_n
call fcn.00404ef0
mov r9d, dword [rsp + 0x2190]
mov r8d, dword [rsp + 0x2194]
mov edx, dword [rsp + 0x2188]
lea rcx, str.Elapsed_Time_sec__:__02d:_02d:_02d_r_n_r_n
call fcn.00404ef0
lea rcx, [rsp + 0x2198]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x21a4]
movzx ecx, word [rsp + 0x21a2]
movzx edx, word [rsp + 0x21a0]
movzx edi, word [rsp + 0x219e]
movzx r8d, word [rsp + 0x219a]
movzx r9d, word [rsp + 0x2198]
mov dword [rsp + 0x1143c], r9d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, edi
mov eax, dword [rsp + 0x1143c]
mov edx, eax
lea rcx, [0x0041dbe0]
call fcn.00404ef0
cmp qword [rsp + 0x113d8], 0
jbe 0x40bc94
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x11424], 0xffffffff
lea rcx, [rsp + 0x70]
call fcn.004013f0
nop
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11424]
jmp 0x40bd8b
jmp 0x40bd54
lea rcx, [0x0041dc4c]
call fcn.00404ef0
lea rcx, [rsp + 0x2198]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x21a4]
movzx ecx, word [rsp + 0x21a2]
movzx edx, word [rsp + 0x21a0]
movzx edi, word [rsp + 0x219e]
movzx r8d, word [rsp + 0x219a]
movzx r9d, word [rsp + 0x2198]
mov dword [rsp + 0x11440], r9d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, edi
mov eax, dword [rsp + 0x11440]
mov edx, eax
lea rcx, str.Scan_finished_____:__04d__02d__02d__02d:_02d:_02d_r_n_r_n
call fcn.00404ef0
cmp dword [rsp + 0xfcb0], 0
je 0x40bd54
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x11428], 0xffffffff
lea rcx, [rsp + 0x70]
call fcn.004013f0
nop
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x11428]
jmp 0x40bd8b
lea rcx, [0x004240d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [rsp + 0x1142c], 0
lea rcx, [rsp + 0x70]
call fcn.004013f0
nop
lea rcx, [rsp + 0x21b0]
call fcn.00402fa0
mov eax, dword [rsp + 0x1142c]
mov rcx, qword [rsp + 0x11448]
call fcn.00418760
add rsp, 0x11450
pop rdi
ret