Function at 0x200004f40
Capabilities:
Check if file exists
Create thread
Delete file
Get common file path
Get file attributes
Read file on windows
Terminate thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push r13
push r14
push r15
mov eax, 0x1248
call fcn.200014ce0
sub rsp, rax
xor eax, eax
mov rsi, r8
lea rcx, [rsp + 0x231]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov byte [rsp + 0x50], al
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov byte [rsp + 0x230], al
call fcn.20000d940
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x450], 0
call fcn.20000d940
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xa0], 0
call fcn.20000d940
xor ebx, ebx
xor ecx, ecx
mov ebp, ebx
mov r13, rbx
mov r14d, ebx
mov dword [rsp + 0x40], ebx
mov r15w, bx
call fcn.200009080
mov rcx, rax
call fcn.2000086d0
call fcn.200005a30
test eax, eax
je 0x20000502a
xor eax, eax
add rsp, 0x1248
pop r15
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x1288], rdi
test rsi, rsi
je 0x200005070
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x200005070
lea rdx, [rsp + 0xa0]
mov rcx, rsi
sub rdx, rsi
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x200005060
jmp 0x200005077
mov byte [rsp + 0xa0], bl
mov qword [rsp + 0x1240], r12
test rsi, rsi
je 0x20000528f
mov edx, 0x5c
mov rcx, rsi
call fcn.200008954
test rax, rax
je 0x200005207
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x5c
mov rcx, rsi
call fcn.200008954
lea rdx, [rsp + 0xa0]
lea rcx, [rax + 1]
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x2000050d0
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
test eax, eax
je 0x2000050f7
mov r15d, 1
jmp 0x2000050fb
mov r15w, bx
lea rdx, [rsp + 0x230]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x200017b68]
lea rcx, [rsp + 0xa0]
call section..text
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xa0]
mov r12d, 1
lea rbp, [rsp + 0x230]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x230]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub r12d, edx
mov edi, ebx
not rcx
dec rcx
add r12d, ecx
test r12d, r12d
jle 0x2000051f7
movsxd r14, edx
lea rdx, [rsp + 0xa0]
mov r8, r14
mov rcx, rbp
call fcn.200009e8c
test eax, eax
je 0x20000519a
inc edi
inc rbp
cmp edi, r12d
jl 0x200005172
mov ebp, ebx
mov r14d, ebx
jmp 0x200005207
test rbp, rbp
je 0x200005202
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x2000051e5
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x2000051fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [rsi], bl
mov ebp, ebx
mov r14d, ebx
jmp 0x200005207
mov ebp, eax
jmp 0x200005207
mov ebp, ebx
mov r14d, ebx
jmp 0x200005207
mov ebp, ebx
mov r14d, ebx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x20000528f
lea rdx, [0x200017b80]
lea rcx, [rsp + 0xa0]
call section..text
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.200007cc4
test eax, eax
jne 0x20000525e
lea rdx, [rsp + 0x230]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x2000053a8
lea rcx, [rsp + 0x230]
sub rcx, rsi
nop dword [rax]
movzx eax, byte [rsi]
inc rsi
mov byte [rcx + rsi - 1], al
test al, al
jne 0x200005270
mov ebp, 1
mov r14d, ebp
mov dword [rsp + 0x40], ebp
jmp 0x2000053a8
lea rcx, [0x200017b90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.CreateMutexA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x1b1]
lea r8d, [rdx + 0x7f]
mov rsi, rax
call fcn.20000d940
lea r10, [0x200000000]
lea rdx, [rsp + 0x1b0]
mov rax, qword [r10 + 0x17c68]
mov r8d, ebx
mov rdi, rbx
mov qword [rdx], rax
movzx eax, word [r10 + 0x17c70]
mov word [rdx + 8], ax
movzx eax, byte [r10 + 0x17c72]
mov byte [rdx + 0xa], al
nop dword [rax + rax]
movzx r9d, byte [rdi + r10 + 0x17bb0]
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x1b0]
cmp r9b, cl
je 0x200005340
xor cl, r9b
mov byte [rsp + rdi + 0xa0], cl
jmp 0x200005348
mov byte [rsp + rdi + 0xa0], r9b
inc rdi
inc r8d
cmp rdi, 0x1a
jl 0x200005300
movsxd rax, r8d
lea r8, [rsp + 0xa0]
xor edx, edx
xor ecx, ecx
mov byte [rsp + rax + 0xa0], bl
call rsi
mov r13, rax
test rax, rax
je 0x200005392
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x200005392
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x200005a08
lea rdx, [rsp + 0x230]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, ebx
mov r12d, ebx
test r14d, r14d
jne 0x200005634
lea rdx, [0x20001bc7c]
lea rcx, [rsp + 0xa0]
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001bec8]
lea rcx, [rsp + 0xa0]
mov edi, eax
mov dword [rsp + 0x44], eax
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001be20]
lea rcx, [rsp + 0xa0]
mov esi, eax
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001be74]
lea rcx, [rsp + 0xa0]
mov r14d, eax
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001bcd0]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x48], eax
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001bd24]
lea rcx, [rsp + 0xa0]
mov r12d, eax
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001bbd4]
lea rcx, [rsp + 0xa0]
mov ebp, eax
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
lea rdx, [0x20001bc28]
lea rcx, [rsp + 0xa0]
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
mov dword [rsp + 0x4c], eax
test r12d, r12d
jne 0x2000054e3
test esi, esi
je 0x2000055e2
mov rdi, qword [rsp + 0x1280]
lea rax, [0x200004e90]
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x1b8], rax
lea rax, [0x200017b38]
mov dword [rsp + 0x1b0], 0x50
mov dword [rsp + 0x1b4], 3
mov dword [rsp + 0x1c0], ebx
mov dword [rsp + 0x1c4], ebx
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1c8], rdi
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e0], 6
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f8], rbx
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov edx, dword [rsp + 0x1298]
mov rcx, rdi
call fcn.200004ea0
test eax, eax
je 0x20000538a
lea r8, [0x200004e30]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x20000538a
lea r8, str.BitDefenderCheckAgent
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [rsp + 0x44]
mov eax, dword [rsp + 0x4c]
test ebp, ebp
je 0x200005607
lea r8, [0x200017be8]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x450]
call fcn.2000047c0
jmp 0x2000059fd
test esi, esi
jne 0x20000562d
test r14d, r14d
jne 0x20000562d
test edi, edi
jne 0x20000562d
cmp dword [rsp + 0x48], ebx
jne 0x20000562d
test r12d, r12d
jne 0x20000562d
test eax, eax
jne 0x20000562d
mov r14d, dword [rsp + 0x40]
lea ebp, [rsi + 1]
jmp 0x200005634
mov r14d, dword [rsp + 0x40]
mov ebp, ebx
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasb al, byte [rdi]
mov eax, 1
not rcx
dec rcx
cmp ecx, eax
lea rdx, [rsp + rcx + 0x22f]
jle 0x200005673
nop dword [rax + rax]
cmp byte [rdx], 0x5c
je 0x200005670
inc eax
dec rdx
cmp eax, ecx
jl 0x200005660
jmp 0x200005673
inc rdx
lea rcx, [rsp + 0x450]
sub rcx, rdx
nop
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x200005680
call fcn.200004b50
test eax, eax
je 0x2000056ae
test r14d, r14d
jne 0x2000056ae
lea rcx, [rsp + 0x230]
call fcn.200004060
jmp 0x2000059fd
test ebp, ebp
je 0x200005803
test r14d, r14d
je 0x2000056c1
inc r15w
jmp 0x2000056ca
call fcn.200005ba0
add r15w, ax
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0xbd0]
call fcn.200004950
lea rcx, [rsp + 0x560]
lea rdx, [rsp + 0xbd0]
mov r8d, 0x670
call fcn.20000e2d0
lea rcx, [rsp + 0x560]
call fcn.200002fa0
cmp r15w, 1
jne 0x200005a06
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov byte [rsp + 0x68], bl
call fcn.2000018f0
lea rcx, [rsp + 0x560]
lea rdx, [rsp + 0xbd0]
mov r8d, 0x670
call fcn.20000e2d0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x560]
call fcn.2000034b0
test ax, ax
js 0x2000057b1
nop
movzx eax, byte [rsp + rbx + 0x230]
inc rbx
mov byte [rsp + rbx + 0x9f], al
test al, al
jne 0x200005760
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
repne scasb al, byte [rdi]
movzx eax, word [0x200017b8c]
lea rcx, [rsp + 0xa0]
mov word [rdi - 1], ax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x230]
call fcn.200004060
jmp 0x2000059f8
lea rdx, str.vDBerA:A
lea rcx, [rsp + 0xa0]
call section..text
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
test eax, eax
jne 0x2000059f8
test esi, esi
jne 0x2000059f8
lea r8, str.CheckSystem
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x450]
call fcn.2000047c0
jmp 0x2000059f8
lea rdx, [0x200017bf4]
lea rcx, [rsp + 0x230]
call fcn.200008388
mov rsi, rax
test rax, rax
je 0x2000059fd
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.200008fd0
mov rcx, rsi
call fcn.200008eb4
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov edi, eax
call fcn.200008fd0
mov rcx, rdi
call fcn.200007ec8
mov rbp, rax
test rax, rax
je 0x200005870
mov r9, rsi
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.2000086b0
cmp rax, rdi
je 0x200005886
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.200008c78
jmp 0x200005a06
mov rcx, rsi
call fcn.200008c78
test r12d, r12d
je 0x2000058f1
lea rdx, [0x200017c38]
lea rcx, [rsp + 0x340]
call section..text
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x340]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x2000058e0
jmp 0x200005900
lea rcx, [rsp + 0xa0]
call fcn.200002840
nop
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0xa0]
mov rdx, rbp
call fcn.200001dc0
test rax, rax
jne 0x2000059f8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 1
jne 0x200005994
lea rdx, [0x200017c48]
lea rcx, [rsp + 0x340]
call section..text
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x340]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200005980
jmp 0x200005900
lea rdx, [0x200017c58]
lea rcx, [rsp + 0x340]
call section..text
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x340]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x2000059e0
cmp ebx, 3
jl 0x200005900
test r13, r13
je 0x200005a06
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r12, qword [rsp + 0x1240]
mov rdi, qword [rsp + 0x1288]
add rsp, 0x1248
pop r15
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret