Function at 0x140004640
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140051080]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r13d, r13d
lea rcx, str.Checking_for_3rd_Party_Anti_Viruses
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov r8d, 0x69
lea rdx, str.WMIC__Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get_displayName__Format:List
lea rcx, [rbp - 0x38]
call fcn.1400026b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], r13b
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
lea rdx, [0x140048aec]
call fcn.14001ed3c
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x14000479a
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov r8d, 0x54
lea rdx, str.__Failed_to_check_for_3rd_party_Anti_Viruses__manually_check_and_uninstall__Error_4_
lea rcx, [rsp + 0x68]
call fcn.1400026b0
nop
lea rcx, [0x140051d00]
call fcn.14000a2d0
lea rdx, str._X_
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
call fcn.14000e090
mov rcx, rax
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400050fc
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004790
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051bd
call fcn.140014944
jmp 0x1400050fc
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x10]
call fcn.140020f70
test rax, rax
je 0x1400047f3
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x78]
call fcn.140002030
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x10]
call fcn.140020f70
test rax, rax
jne 0x1400047d0
mov rcx, rbx
call fcn.14001ec64
nop dword [rax + rax]
lea rbx, [rbp - 0x78]
mov r15, qword [rbp - 0x78]
mov r12, qword [rbp - 0x60]
cmp r12, 0xf
cmova rbx, r15
mov rsi, qword [rbp - 0x68]
cmp rsi, 1
jb 0x140004867
lea r14, [rsi + rbx]
mov r8, rsi
mov edx, 0xa
mov rcx, rbx
call fcn.14003a3d0
mov rdi, rax
test rax, rax
je 0x140004867
nop word [rax + rax]
cmp byte [rdi], 0xa
je 0x14000492d
inc rdi
mov r8, r14
sub r8, rdi
mov edx, 0xa
mov rcx, rdi
call fcn.14003a3d0
mov rdi, rax
test rax, rax
jne 0x140004840
mov rdi, 0xffffffffffffffff
cmp rdi, 0xffffffffffffffff
je 0x140004da2
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov r8, rdi
cmp rsi, rdi
cmovb r8, rsi
lea rdx, [rbp - 0x78]
cmp r12, 0xf
cmova rdx, r15
lea rcx, [rsp + 0x48]
call fcn.1400026b0
nop
lea rbx, [rsp + 0x48]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x60]
cmp r13, 0xf
cmova rbx, r14
mov r15, qword [rsp + 0x58]
cmp r15, 0x10
jb 0x140004942
lea rsi, [r15 + rbx]
lea r8, [rsi - 0xf]
sub r8, rbx
mov edx, 0x57
mov rcx, rbx
call fcn.14003a3d0
test rax, rax
je 0x140004942
nop word [rax + rax]
movabs rcx, 0x2073776f646e6957
cmp qword [rax], rcx
jne 0x14000490f
movabs rcx, 0x7265646e65666544
cmp qword [rax + 8], rcx
je 0x140004935
inc rax
lea r8, [rsi - 0xf]
sub r8, rax
mov edx, 0x57
mov rcx, rax
call fcn.14003a3d0
test rax, rax
jne 0x1400048f0
jmp 0x140004942
sub rdi, rbx
jmp 0x14000486e
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140004c7c
cmp r15, 0xc
jbe 0x140004c7c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea rax, [r15 - 0xc]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rsp + 0x48]
cmp r13, 0xf
cmova rdx, r14
add rdx, 0xc
lea rcx, [rsp + 0x68]
call fcn.1400026b0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400049c9
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051c3
call fcn.140014944
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x58], xmm1
lea rsi, [rsp + 0x48]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdx, xmm0
cmp rdx, 0xf
cmova rsi, r8
movq rcx, xmm1
add rsi, rcx
lea rbx, [rsp + 0x48]
cmp rdx, 0xf
cmova rbx, r8
add rbx, rcx
lea rcx, [rsp + 0x48]
cmp rdx, 0xf
cmova rcx, r8
mov r8b, 0xa
mov rdx, rbx
call fcn.1400132a0
mov r8, rax
cmp rax, rbx
je 0x140004a55
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x140004a55
nop
movzx eax, byte [rcx]
cmp al, 0xa
je 0x140004a4d
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x140004a40
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rax, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rsp + 0x58]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.140039d50
mov qword [rsp + 0x58], rbx
lea rsi, [rsp + 0x48]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
cmova rsi, r8
add rsi, rbx
lea rax, [rsp + 0x48]
cmp rdx, 0xf
cmova rax, r8
add rbx, rax
lea rcx, [rsp + 0x48]
cmp rdx, 0xf
cmova rcx, r8
mov r8b, 0xd
mov rdx, rbx
call fcn.1400132a0
mov r8, rax
cmp rax, rbx
je 0x140004b17
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x140004b17
movzx eax, byte [rcx]
cmp al, 0xd
je 0x140004b0f
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x140004b02
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rax, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rsp + 0x58]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.140039d50
mov qword [rsp + 0x58], rbx
lea rsi, [rsp + 0x48]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
cmova rsi, r8
add rsi, rbx
lea rax, [rsp + 0x48]
cmp rdx, 0xf
cmova rax, r8
add rbx, rax
lea rcx, [rsp + 0x48]
cmp rdx, 0xf
cmova rcx, r8
mov r8b, 8
mov rdx, rbx
call fcn.1400132a0
mov r8, rax
cmp rax, rbx
je 0x140004bd9
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x140004bd9
movzx eax, byte [rcx]
cmp al, 8
je 0x140004bd1
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x140004bc4
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rax, qword [rsp + 0x48]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rsp + 0x58]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.140039d50
mov qword [rsp + 0x58], rbx
cmp qword [rbp - 0x48], 0
je 0x140004c55
mov r8d, 2
lea rdx, [0x140048b48]
lea rcx, [rbp - 0x58]
call fcn.140002340
mov rbx, qword [rsp + 0x58]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
mov r8, rbx
lea rcx, [rbp - 0x58]
call fcn.140002340
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x48]
inc rdi
mov rax, qword [rbp - 0x68]
cmp rdi, rax
jae 0x140004d68
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xor r13d, r13d
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
cmp rax, rdi
jb 0x1400051c9
sub rax, rdi
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rdx, qword [rbp - 0x78]
add rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400026b0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140004d10
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051c3
call fcn.140014944
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbp - 0x68], xmm1
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140004800
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051cf
call fcn.140014944
jmp 0x140004800
cmp r13, 0xf
jbe 0x140004d9f
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140004d97
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051cf
mov rcx, r14
call fcn.140014944
xor r13d, r13d
mov rsi, qword [rbp - 0x48]
test rsi, rsi
je 0x140005000
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x47
jb 0x1400051d5
lea r15, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova r15, qword [rbp - 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, [rsi + 0x47]
mov edi, 0xf
lea rbx, [rsp + 0x20]
cmp r14, rdi
jbe 0x140004e76
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140004e37
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140014900
test rax, rax
je 0x1400051db
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140004e71
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140004e51
mov rbx, r13
jmp 0x140004e71
cmp rcx, 0x1000
jb 0x140004e69
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400051b1
jmp 0x140004e18
call fcn.140014900
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
movaps xmm0, xmmword [str.__A_3rd_party_Anti_Virus_is_installed__please_uninstall_or_disable_it__]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140048b60]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140048b70]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140048b80]
movups xmmword [rbx + 0x30], xmm1
mov eax, dword [0x140048b90]
mov dword [rbx + 0x40], eax
movzx eax, word [0x140048b94]
mov word [rbx + 0x44], ax
movzx eax, byte [0x140048b96]
mov byte [rbx + 0x46], al
lea rcx, [rbx + 0x47]
mov r8, rsi
mov rdx, r15
call fcn.140039d50
mov byte [rbx + r14], 0
mov r8d, 1
lea rdx, [0x140048b4c]
lea rcx, [rsp + 0x20]
call fcn.140002340
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140004f62
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051e1
call fcn.140014944
movdqa xmm0, xmmword [0x140049f50]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [0x140051d00]
call fcn.14000a2d0
lea rdx, str._X_
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
call fcn.14000e090
mov rcx, rax
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400050b1
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051b7
jmp 0x1400050ab
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov r8d, 0x26
lea rdx, str.__No_3rd_party_Anti_Virus_was_detected
lea rcx, [rsp + 0x68]
call fcn.1400026b0
nop
lea rcx, [0x140051cf0]
call fcn.14000a2d0
lea rdx, str.__
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
call fcn.14000e090
lea rcx, [0x140052500]
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400050b1
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051e7
call fcn.140014944
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1400050ec
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051ed
call fcn.140014944
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140005137
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005132
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051f3
call fcn.140014944
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14000517e
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005179
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051ab
call fcn.140014944
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400148e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001aa40
nop
call fcn.140001250
nop
call fcn.14001aa40
nop
call fcn.14001aa40
nop
call fcn.14001aa40
int3
call fcn.14000bb00
nop
call fcn.14001aa40
int3
call fcn.1400012f0
int3
call fcn.14001aa40
nop
call fcn.14001aa40
nop
call fcn.14001aa40
nop
call fcn.14001aa40
nop
call fcn.14001aa40
int3