Function at 0x140003df0
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xcd0
mov rax, qword [0x14001d138]
xor rax, rsp
mov qword [rsp + 0xcc0], rax
xor r13d, r13d
mov qword [rsp + 0x70], r13
call fcn.140001f80
mov r12d, 1
lea rdx, [0x140012440]
mov ecx, r12d
mov edi, eax
call fcn.1400031e0
lea r8, section..bldvar
lea rdx, str.CommonShell_Command_Line_Scanner_Lite___hs_
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
cmp byte [0x14001f53a], r13b
je 0x140003f50
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [0x14001f568]
mov rcx, qword [0x14001f560]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov ebp, eax
call sub.mytilus3_worker.dll_GetEngineVersion
mov rdx, qword [0x14001f568]
mov rcx, qword [0x14001f560]
movzx edi, al
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8w, 2
mov qword [rsp + 0x20], rax
call sub.mytilus3_worker.dll_GetDATVersion
movzx esi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test dil, dil
mov ebx, eax
jne 0x140003eef
lea rdx, str.Error_returned_from_CommonShell::GetEngineVersion_n
mov ecx, r12d
call fcn.1400031e0
jmp 0x140003f08
mov r9d, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x58]
lea rdx, str.____Engine_version:__d._d_n
mov ecx, r12d
call fcn.1400031e0
test sil, sil
jne 0x140003f1e
lea rdx, str.Error_returned_from_CommonShell::GetDATVersion_n
mov ecx, r12d
call fcn.1400031e0
jmp 0x140003f37
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
lea rdx, str.____DAT_version:_____d._d_n
mov ecx, r12d
call fcn.1400031e0
sub ebx, ebp
lea rdx, str.____Time_required:___d_milliseconds_n
mov ecx, r12d
mov r8d, ebx
call fcn.1400031e0
jmp 0x140005d97
cmp byte [0x14001f53b], r13b
je 0x140004085
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x40], r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [0x14001f568]
mov rcx, qword [0x14001f560]
mov esi, eax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x54]
mov r8w, 6
mov qword [rsp + 0x20], rax
call sub.mytilus3_worker.dll_GetDATVersion
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test dil, dil
mov ebx, eax
jne 0x140003fb7
lea rdx, str.Error_returned_from_CommonShell::GetDATVersion_n
mov ecx, r12d
call fcn.1400031e0
jmp 0x140003fd0
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x54]
lea rdx, str.____GetDATVersion:_____d._d_n
mov ecx, r12d
call fcn.1400031e0
sub ebx, esi
lea rdx, str.____GetDATVersion_time_required:___d_milliseconds_n
mov ecx, r12d
mov r8d, ebx
call fcn.1400031e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [0x14001f568]
mov rcx, qword [0x14001f560]
mov esi, eax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8w, 6
mov qword [rsp + 0x20], rax
call sub.mytilus3_worker.dll_GetDATInfo
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test dil, dil
mov ebx, eax
jne 0x14000404b
lea rdx, str.Error_returned_from_CommonShell::GetDATVersion_n
mov ecx, r12d
call fcn.1400031e0
jmp 0x14000406c
mov eax, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x54]
lea rdx, str.____GetDATInfo:_____d._d__detections:__d_n
mov ecx, r12d
mov dword [rsp + 0x20], eax
call fcn.1400031e0
sub ebx, esi
lea rdx, str.____GetDATInfo_time_required:___d_milliseconds_n
mov ecx, r12d
mov r8d, ebx
call fcn.1400031e0
jmp 0x140005d97
cmp word [0x14001f570], r13w
je 0x1400040cf
lea rax, [0x140021030]
lea rcx, [0x14001f570]
mov r9d, 3
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call sub.mytilus3_worker.dll_GetLogger
test eax, eax
je 0x1400040cf
lea r8, [0x14001f570]
lea rdx, str.Couldnt_make_logfile___s__error___lu
mov r9d, eax
mov ecx, r12d
call fcn.1400031e0
test edi, edi
jne 0x140005d97
mov rcx, qword [0x140020bf8]
test rcx, rcx
je 0x1400040fe
call sub.mytilus3_worker.dll_SetDebugFlags
cmp word [0x140020c00], r13w
je 0x1400040fe
lea rcx, [0x140020c00]
call sub.mytilus3_worker.dll_SetDebugFile
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001f090]
call fcn.14000a7d0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
test rax, rax
mov ecx, 0xfde9
mov edi, r13d
cmove edi, ecx
lea rcx, [0x14001d8f0]
call fcn.14000a7d0
test rax, rax
je 0x140004164
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d8f0]
call fcn.14000a7d0
mov rcx, rax
call fcn.140008430
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e728]
call fcn.14000a7d0
test rax, rax
je 0x1400041a3
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e728]
call fcn.14000a7d0
mov rcx, rax
call fcn.140008ae0
lea r8, [rsp + 0x70]
lea rdx, [0x140021020]
lea rcx, [0x14001f528]
mov r9d, edi
call fcn.140006740
test eax, eax
jne 0x140005d99
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400041e9
mov rax, qword [rcx]
movzx edx, r12b
call qword [rax + 0xa0]
mov rdx, qword [rsp + 0x70]
mov qword [0x140021038], rdx
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d880]
call fcn.14000a7d0
test rax, rax
jne 0x140004283
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d688]
call fcn.14000a7d0
test rax, rax
jne 0x140004283
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e958]
call fcn.14000a7d0
test rax, rax
jne 0x140004283
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e568]
call fcn.14000a7d0
test rax, rax
jne 0x140004283
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001efe8]
call fcn.14000a7d0
test rax, rax
je 0x140004479
mov rcx, qword [0x14001f528]
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], r13d
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call qword [rax + 0x30]
mov rcx, qword [0x14001f528]
lea r8, [rsp + 0x54]
mov rax, qword [rcx]
xor r9d, r9d
mov dx, 2
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [rax + 0x28]
mov rcx, qword [0x14001f528]
lea r8, [rsp + 0x60]
xor r9d, r9d
mov rax, qword [rcx]
mov dx, 5
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [rax + 0x28]
mov rcx, qword [0x14001f528]
mov rax, qword [rcx]
lea r8, [rsp + 0x5c]
xor r9d, r9d
mov dx, 3
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004338
mov qword [0x140021038], r13
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rsp + 0x70], r13
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [0x14001f528]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d880]
call fcn.14000a7d0
test rax, rax
je 0x14000438d
mov r8d, dword [rsp + 0x48]
lea rdx, str.EngMaj___lu
mov ecx, r12d
call fcn.1400031e0
mov eax, dword [rsp + 0x48]
jmp 0x140005d99
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d688]
call fcn.14000a7d0
test rax, rax
je 0x1400043c8
mov r8d, dword [rsp + 0x40]
lea rdx, str.EngMin___lu
mov ecx, r12d
call fcn.1400031e0
mov eax, dword [rsp + 0x40]
jmp 0x140005d99
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e958]
call fcn.14000a7d0
test rax, rax
je 0x140004403
mov r8d, dword [rsp + 0x54]
lea rdx, str.AvvVer___lu
mov ecx, r12d
call fcn.1400031e0
mov eax, dword [rsp + 0x54]
jmp 0x140005d99
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e568]
call fcn.14000a7d0
test rax, rax
je 0x14000443e
mov r8d, dword [rsp + 0x5c]
lea rdx, str.PupVer___lu
mov ecx, r12d
call fcn.1400031e0
mov eax, dword [rsp + 0x5c]
jmp 0x140005d99
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001efe8]
call fcn.14000a7d0
test rax, rax
je 0x140004479
mov r8d, dword [rsp + 0x60]
lea rdx, str.TrojVer___lu
mov ecx, r12d
call fcn.1400031e0
mov eax, dword [rsp + 0x60]
jmp 0x140005d99
cmp word [0x14001f778], r13w
je 0x140004521
lea rcx, [0x14001f4c0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [0x14001f4d8]
lea rcx, [0x14001f778]
mov qword [rsp + 0x20], rdx
mov r9d, 3
xor r8d, r8d
xor edx, edx
call sub.mytilus3_worker.dll_GetLogger
test eax, eax
jne 0x140004508
mov rcx, qword [0x14001f4d8]
lea rdx, str.Type_tName_tNumber_of_Files_tTicks_t
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x28]
mov r8, qword [0x14001f4c0]
lea rdx, str.Frequency_of_timer__ticks_per_second__t_I64d_r_n
lea rcx, [rsp + 0x590]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [0x14001f4d8]
lea rdx, [rsp + 0x590]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x28]
jmp 0x140004521
lea r8, [0x14001f778]
lea rdx, str.Couldnt_make_timefile___s__error___lu
mov r9d, eax
mov ecx, r12d
call fcn.1400031e0
lea rcx, [0x1400037c0]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
cmp qword [rsp + 0x70], r13
je 0x140004562
lea rcx, [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x158]
mov rax, qword [rcx]
mov r8d, 0x4b2
call qword [rax + 0x88]
lea rcx, [rsp + 0x138]
mov qword [rsp + 0xd00], r14
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e878]
call fcn.14000a7d0
test rax, rax
je 0x1400047d3
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e878]
call fcn.14000a7d0
mov rcx, rax
call fcn.14000b726
mov rcx, qword [0x14001f528]
mov qword [rsp + 0x68], r13
mov edi, eax
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov edx, edi
call qword [rax + 0x70]
mov r11, qword [rsp + 0x68]
test r11, r11
jne 0x1400045fa
lea rdx, str.There_is_no_data_in_the_DATs_for_product__lu
mov r8d, edi
mov ecx, r12d
call fcn.1400031e0
jmp 0x1400047d3
lea rdx, str.There_are__lu_bytes_of_data_in_the_DATs_for_product__lu_:
mov r9d, edi
mov r8d, r11d
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_malloc
mov rcx, qword [0x14001f528]
lea r8, [rsp + 0x68]
mov rbp, rax
mov rax, qword [rcx]
mov edx, edi
mov r9, rbp
call qword [rax + 0x70]
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d5a8]
call fcn.14000a7d0
test rax, rax
mov rbx, rax
je 0x1400046db
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x1400046b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_dump_the_data_into_file___s_._Error___d_n
mov r8, rbx
mov r9d, eax
mov ecx, r12d
call fcn.1400031e0
jmp 0x1400047cb
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x7c]
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400047cb
mov r14, r13
nop
mov r8d, r14d
lea rdx, str._04lx:
xor ecx, ecx
shl r8d, 4
call fcn.1400031e0
xor edi, edi
mov rbx, r13
nop
nop
cmp rbx, qword [rsp + 0x68]
jae 0x140004721
lea rax, [r13 + rdi]
lea rdx, str._02x
xor ecx, ecx
movzx r8d, byte [rax + rbp]
call fcn.1400031e0
jmp 0x14000472f
lea rdx, [0x140018378]
xor ecx, ecx
call fcn.1400031e0
add rdi, 1
add rbx, 1
cmp rdi, 0x10
jb 0x140004700
lea rdx, [0x140018370]
xor ecx, ecx
call fcn.1400031e0
xor edi, edi
mov rsi, r13
cmp rsi, qword [rsp + 0x68]
jae 0x14000478d
lea r12, [r13 + rdi]
movzx ecx, byte [r12 + rbp]
call sub.msvcrt.dll_isprint
test eax, eax
je 0x14000477f
movzx r8d, byte [r12 + rbp]
lea rdx, [0x140018368]
xor ecx, ecx
call fcn.1400031e0
jmp 0x14000478d
lea rdx, [0x140018364]
xor ecx, ecx
call fcn.1400031e0
add rdi, 1
add rsi, 1
cmp rdi, 0x10
jb 0x140004750
mov r12d, 1
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov rax, qword [rsp + 0x68]
add r14, r12
shr rax, 4
mov r13, rbx
cmp r14, rax
jbe 0x1400046e0
xor r13d, r13d
mov rcx, rbp
call sub.msvcrt.dll_free
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e060]
call fcn.14000a7d0
or rdi, 0xffffffffffffffff
test rax, rax
je 0x1400049bf
lea r8d, [rdi + 0x59]
lea rcx, [rsp + 0xd8]
xor edx, edx
mov qword [rsp + 0xd0], r13
call sub.msvcrt.dll_memset
mov rcx, qword [0x14001f528]
mov rax, qword [rcx]
lea rdx, [rsp + 0xd0]
call qword [rax + 0x20]
mov eax, 2
mul qword [rsp + 0xf8]
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
mov qword [rsp + 0xd0], rax
mov eax, 2
mul qword [rsp + 0x100]
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
mov qword [rsp + 0xd8], rax
mov eax, 2
mul qword [rsp + 0x108]
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
mov qword [rsp + 0xe0], rax
mov eax, 2
mul qword [rsp + 0x110]
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
mov qword [rsp + 0xe8], rax
mov eax, 2
mul qword [rsp + 0x118]
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
mov rcx, qword [0x14001f528]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0xf0], rax
mov rax, qword [rcx]
call qword [rax + 0x20]
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
movzx edx, word [rsp + 0x120]
mov r8, qword [rsp + 0xd0]
lea rcx, str.Executable_Extension_List
call fcn.1400036f0
movzx edx, word [rsp + 0x122]
mov r8, qword [rsp + 0xd8]
lea rcx, str.Macro_Extension_List
call fcn.1400036f0
movzx edx, word [rsp + 0x124]
mov r8, qword [rsp + 0xe0]
lea rcx, str.Compressed_Files_Extension_List
call fcn.1400036f0
movzx edx, word [rsp + 0x126]
mov r8, qword [rsp + 0xe8]
lea rcx, str.Archive_Extension_List
call fcn.1400036f0
movzx edx, word [rsp + 0x128]
mov r8, qword [rsp + 0xf0]
lea rcx, str.Merged_Extension_List
call fcn.1400036f0
mov rcx, qword [rsp + 0xd0]
call fcn.14000a820
mov rcx, qword [rsp + 0xd8]
call fcn.14000a820
mov rcx, qword [rsp + 0xe0]
call fcn.14000a820
mov rcx, qword [rsp + 0xe8]
call fcn.14000a820
mov rcx, qword [rsp + 0xf0]
call fcn.14000a820
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001da40]
call fcn.14000a7d0
test rax, rax
je 0x1400049f5
lea rdx, str.Please_wait_..._retrieving_list_of_names_from_the_Anti_Virus_DAT
mov ecx, r12d
call fcn.1400031e0
mov cx, 2
call fcn.140003cc0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ee28]
call fcn.14000a7d0
test rax, rax
je 0x140004a2b
lea rdx, str.Please_wait_..._retrieving_list_of_names_from_the_Anti_Trojan_DAT
mov ecx, r12d
call fcn.1400031e0
mov cx, 5
call fcn.140003cc0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ddc0]
call fcn.14000a7d0
test rax, rax
je 0x140004a61
lea rdx, str.Please_wait_..._retrieving_list_of_names_from_the_Anti_PUP_DAT
mov ecx, r12d
call fcn.1400031e0
mov cx, 3
call fcn.140003cc0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d7a0]
call fcn.14000a7d0
test rax, rax
je 0x140004a97
lea rdx, str.Please_wait_..._retrieving_list_of_names_from_the_Extra_DAT
mov ecx, r12d
call fcn.1400031e0
mov cx, 4
call fcn.140003cc0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ed80]
mov qword [rsp + 0xd08], r15
mov byte [rsp + 0x4c], 0
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x44], 0
call fcn.14000a7d0
lea rbx, [0x1400201a0]
test rax, rax
je 0x140004af3
lea rdx, str.Restoring_backups_from__s
mov r8, rbx
mov ecx, r12d
mov byte [rsp + 0x4c], 1
lea r15, str.RestoreBackup
call fcn.1400031e0
jmp 0x140004b71
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001db90]
call fcn.14000a7d0
test rax, rax
je 0x140004b31
lea rdx, str.Deleting_backups_from__s
mov r8, rbx
mov ecx, r12d
mov byte [rsp + 0x45], 1
lea r15, str.DeleteBackup
call fcn.1400031e0
jmp 0x140004b71
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001eae0]
call fcn.14000a7d0
test rax, rax
je 0x140005207
lea rdx, str.Listing_backups_in__s
mov r8, rbx
mov ecx, r12d
mov byte [rsp + 0x44], 1
lea r15, str.ListBackup
call fcn.1400031e0
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x58], r13d
call sub.mytilus3_worker.dll_GetBackedUpDetections
mov edx, dword [rsp + 0x58]
test edx, edx
mov dword [rsp + 0x48], edx
je 0x1400051f5
mov eax, 8
mul rdx
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov r8, rax
mov rcx, rbx
mov rdi, rax
mov qword [rsp + 0x170], rax
call sub.mytilus3_worker.dll_GetBackedUpDetections
mov r9d, dword [rsp + 0x48]
test r9d, r9d
mov esi, r13d
mov dword [rsp + 0x40], r13d
je 0x1400051b2
mov rbx, rdi
nop
nop
mov rcx, qword [rbx]
xor eax, eax
lea rdx, [rsp + 0xa4]
mov word [rsp + 0x90], 0
mov qword [rsp + 0x92], rax
mov dword [rsp + 0x9a], eax
mov word [rsp + 0x9e], ax
mov dword [rsp + 0xa4], 0x104
mov dword [rsp + 0x7c], r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0xa8], r13d
mov word [rsp + 0x5c], ax
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x180]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x90]
mov r14d, r13d
call qword [rax + 0x18]
mov rcx, qword [rbx]
mov rax, qword [rcx]
lea rdx, [rsp + 0x5c]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0xa8]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x7c]
call qword [rax + 0x10]
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e098]
mov r12d, r13d
xor dil, dil
xor r13b, r13b
call fcn.14000a7d0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
test rax, rax
mov eax, 1
lea rcx, [0x14001e5a0]
movzx ebp, dil
cmovne ebp, eax
call fcn.14000a7d0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
test rax, rax
mov eax, 1
lea rcx, [0x14001e0d0]
movzx edi, r13b
cmovne edi, eax
call fcn.14000a7d0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
xor cl, cl
test rax, rax
movzx r13d, cl
mov eax, 1
lea rcx, [0x14001eb50]
cmovne r13d, eax
call fcn.14000a7d0
test rax, rax
je 0x140004d48
lea rcx, [0x1400203a8]
call fcn.14000b726
mov r12d, eax
cmp byte [rsp + 0x4c], 0
je 0x140004f9f
test dil, dil
mov sil, 1
je 0x140004e21
xor eax, eax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x64], eax
lea rax, [rsp + 0x64]
lea rdx, str._d__d__d
lea rcx, [0x1400207b8]
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll_swscanf
movzx r8d, word [rsp + 0x90]
mov r9d, dword [rsp + 0xa0]
cmp r8d, r9d
jae 0x140004dc9
lea rdx, str.BUP_was_created_in_year__d__where_as_the_given_year_is__d._Backup_is_not_restored.
mov ecx, 1
call fcn.1400031e0
xor sil, sil
jmp 0x140004f4b
movzx r8d, word [rsp + 0x92]
mov r9d, dword [rsp + 0x78]
cmp r8d, r9d
jae 0x140004df5
lea rdx, str.BUP_was_created_in_month__d__where_as_the_given_month_is__d._Backup_is_not_restored.
mov ecx, 1
call fcn.1400031e0
xor sil, sil
jmp 0x140004f4b
movzx r8d, word [rsp + 0x96]
mov r9d, dword [rsp + 0x64]
cmp r8d, r9d
jae 0x140004e21
lea rdx, str.BUP_was_created_on_day__d__where_as_the_given_day_is__d._Backup_is_not_restored.
mov ecx, 1
call fcn.1400031e0
xor sil, sil
jmp 0x140004f4b
test bpl, bpl
je 0x140004e51
movzx r8d, word [rsp + 0x60]
mov r9d, dword [0x1400209c0]
cmp r9d, r8d
je 0x140004e51
lea rdx, str.Bup_virus_type___d__did_not_match_the_mentioned_type___d_._Backup_is_not_restored
mov ecx, 1
call fcn.1400031e0
xor sil, sil
jmp 0x140004f4b
test r13b, r13b
je 0x140004f4b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400205b0]
repne scasw ax, word [rdi]
lea rax, [0x1400205ae]
xor r13b, r13b
not rcx
xor bpl, bpl
cmp word [rax + rcx*2 - 2], 0x2a
lea rdi, [rcx - 1]
jne 0x140004e8b
mov r13b, 1
jmp 0x140004e9f
cmp word [0x1400205b0], 0x2a
movzx ebp, bpl
mov eax, 1
cmove ebp, eax
lea rcx, [rsp + 0x180]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rcx, [0x1400205b0]
call qword [sym.imp.USER32.dll_CharUpperW]
test bpl, bpl
je 0x140004edd
lea rdx, [0x1400205b2]
lea rcx, [rsp + 0x180]
call sub.msvcrt.dll_wcsstr
test rax, rax
jne 0x140004f4b
xor sil, sil
jmp 0x140004f2b
test r13b, r13b
je 0x140004f0f
lea rcx, [0x1400205b0]
call sub.msvcrt.dll__wcsdup
lea rcx, [rsp + 0x180]
mov rdx, rax
mov word [rax + rdi*2 - 2], 0
call sub.msvcrt.dll_wcsstr
test rax, rax
jne 0x140004f4b
xor sil, sil
jmp 0x140004f2b
lea rdx, [0x1400205b0]
lea rcx, [rsp + 0x180]
call sub.msvcrt.dll_wcsstr
test rax, rax
jne 0x140004f4b
xor sil, sil
lea r9, [0x1400205b0]
lea r8, [rsp + 0x180]
lea rdx, str.detection_name_of_the_bup___s__did_not_match_the_given_name___s_._Backup_is_not_restored.
mov ecx, 1
call fcn.1400031e0
test r12d, r12d
je 0x140004f7b
mov r8d, dword [rsp + 0x50]
cmp r12d, r8d
je 0x140004f7b
mov r9d, r12d
mov r12d, 1
lea rdx, str.DAT_version___d__contained_in_the_BUP_did_not_match_the_given_DAT_version___d_._Backup_is_not_restored.
mov ecx, r12d
call fcn.1400031e0
mov esi, dword [rsp + 0x40]
jmp 0x140005109
test sil, sil
je 0x1400050f9
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov esi, dword [rsp + 0x40]
mov r12d, 1
mov r14d, eax
jmp 0x140005109
cmp byte [rsp + 0x45], 0
je 0x140004fbd
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov r12d, 1
mov r14d, eax
jmp 0x140005109
cmp byte [rsp + 0x44], 0
je 0x14000515b
movzx ecx, word [rsp + 0x60]
lea rdx, [rsp + 0x8a0]
mov dword [rsp + 0x64], 0x104
call fcn.140003810
mov rcx, qword [rbx]
lea r8, [rsp + 0x64]
mov rax, qword [rcx]
lea rdx, [rsp + 0x690]
call qword [rax + 0x78]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r12d, 1
lea r8, [rsp + 0x690]
lea rdx, str._____s_contains__lu_objects
mov ecx, r12d
mov r9d, eax
mov esi, eax
call fcn.1400031e0
lea r9, [rsp + 0x8a0]
lea r8, [rsp + 0x180]
lea rdx, str._____s___s_
mov ecx, r12d
call fcn.1400031e0
movzx r9d, word [rsp + 0x5c]
mov r8d, dword [rsp + 0x50]
lea rdx, str.____Dat_Version__d__Dat_Set_Type__d
mov ecx, r12d
call fcn.1400031e0
movzx edx, word [rsp + 0x96]
movzx r9d, word [rsp + 0x92]
movzx r8d, word [rsp + 0x90]
mov dword [rsp + 0x20], edx
lea rdx, str.____Created_date:__04d__02d__02d
mov ecx, r12d
call fcn.1400031e0
xor edi, edi
test esi, esi
je 0x140005105
nop
mov rcx, qword [rbx]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], 0x104
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xab0]
lea r8, [rsp + 0x54]
mov edx, edi
call qword [rax + 0x50]
test eax, eax
jne 0x1400050d7
lea r8, [rsp + 0xab0]
lea rdx, str._________s
mov ecx, r12d
call fcn.1400031e0
jmp 0x1400050ec
lea rdx, str.________Error_number__d_on_object_number__d
mov r9d, edi
mov r8d, eax
mov ecx, r12d
call fcn.1400031e0
add edi, r12d
cmp edi, esi
jb 0x140005090
mov esi, dword [rsp + 0x40]
jmp 0x140005109
mov esi, dword [rsp + 0x40]
mov r12d, 1
jmp 0x140005109
mov esi, dword [rsp + 0x40]
cmp byte [rsp + 0x44], 0
jne 0x14000517b
test r14d, r14d
je 0x140005161
cmp r14d, 0x12f
jne 0x140005137
lea r8, [rsp + 0x180]
lea rdx, str.Delete_pending_on__s
mov ecx, r12d
call fcn.1400031e0
jmp 0x14000517b
lea rax, [rsp + 0x180]
lea rdx, str.Error__d_from__s_on__s
mov r9, r15
mov r8d, r14d
mov ecx, r12d
mov qword [rsp + 0x20], rax
call fcn.1400031e0
jmp 0x14000517b
mov r12d, 1
lea r9, [rsp + 0x180]
lea rdx, str._s_succeeded_for_infection__s
mov r8, r15
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r9d, dword [rsp + 0x48]
add esi, 1
add rbx, 8
cmp esi, r9d
mov dword [rsp + 0x40], esi
mov r13d, 0
jb 0x140004bf0
mov rdi, qword [rsp + 0x170]
lea rbx, [0x1400201a0]
lea rdx, str._s_called_for_a_total_of__lu_files_in__s
mov r8, r15
mov ecx, r12d
mov qword [rsp + 0x20], rbx
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov rcx, rdi
call fcn.14000a820
or rdi, 0xffffffffffffffff
jmp 0x140005207
lea rdx, str.There_are_no_backups_in__s
mov r8, rbx
mov ecx, r12d
call fcn.1400031e0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e6f0]
call fcn.14000a7d0
mov r15, qword [rsp + 0xd08]
mov r14, qword [rsp + 0xd00]
test rax, rax
je 0x14000532b
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x50], r13d
call sub.mytilus3_worker.dll_GetBackupFileNames
mov r8d, dword [rsp + 0x50]
test r8d, r8d
mov dword [rsp + 0x40], r8d
jne 0x14000527b
lea rdx, str.There_are_no_backups_in__s
mov r8, rbx
mov ecx, r12d
call fcn.1400031e0
jmp 0x14000532b
lea rdx, str.There_are__lu_backups_in__s
mov r9, rbx
mov ecx, r12d
call fcn.1400031e0
mov edx, dword [rsp + 0x40]
mov eax, 8
mul rdx
cmovo rax, rdi
mov rcx, rax
call fcn.14000a810
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r8, rax
mov rcx, rbx
mov rsi, rax
call sub.mytilus3_worker.dll_GetBackupFileNames
cmp dword [rsp + 0x40], 0
mov ebx, r13d
jbe 0x140005323
mov rdi, rsi
nop
nop
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e6f0]
call fcn.14000a7d0
test rax, rax
je 0x140005316
mov rcx, qword [0x140021020]
mov rdx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x130]
mov r8, qword [rdi]
lea rdx, str.ScanBackup:_scanned__s:__u
mov r9d, eax
mov ecx, r12d
call fcn.1400031e0
add ebx, 1
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jb 0x1400052d0
mov rcx, rsi
call fcn.14000a820
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e9c8]
call fcn.14000a7d0
test rax, rax
je 0x1400053a5
lea rdx, str.Scanning_for_rootkits_using_engine.
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [0x140021020]
mov rdx, qword [0x14001f540]
mov rax, qword [rcx]
bts rdx, 7
call qword [rax + 0x78]
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov rcx, qword [0x140021020]
mov rdx, qword [0x14001f540]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + 0x78]
lea rcx, str.Stealthscan
mov edx, edi
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d768]
call fcn.14000a7d0
test rax, rax
je 0x140005406
lea rdx, str.Requerying_cached_Artemis_entries.
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 0x188]
test al, al
je 0x1400053f7
lea rdx, str.RequeryCache_succeeded.
mov ecx, r12d
call fcn.1400031e0
jmp 0x140005406
lea rdx, str.RequeryCache_failed.
mov ecx, r12d
call fcn.1400031e0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001edf0]
call fcn.14000a7d0
test rax, rax
je 0x140005443
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 0x190]
lea rdx, str.Cache_Reset
mov ecx, r12d
call fcn.1400031e0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ea38]
call fcn.14000a7d0
test rax, rax
je 0x140005481
mov rcx, qword [0x140021020]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x128]
lea rcx, [0x1400128d8]
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e808]
call fcn.14000a7d0
test rax, rax
je 0x1400054f4
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e808]
call fcn.14000a7d0
mov rcx, rax
call sub.msvcrt.dll__wtoi
lea rdx, str.Scanning_Process__d
mov ecx, r12d
mov r8d, eax
mov edi, eax
call fcn.1400031e0
mov rcx, qword [0x140021020]
mov edx, edi
mov rax, qword [rcx]
call qword [rax + 0x128]
lea rcx, [0x140012900]
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ed48]
call fcn.14000a7d0
test rax, rax
je 0x14000553f
lea rdx, str.Please_wait_..._building_list_of_critical_files_to_scan_r
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 0x100]
lea rcx, str.Critical
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001eed0]
call fcn.14000a7d0
test rax, rax
je 0x14000558c
lea rdx, str.Scanning_the_computers_cookie_directories
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [0x140021020]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0xf0]
lea rcx, str.Cookies
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e300]
call fcn.14000a7d0
test rax, rax
je 0x1400055fa
lea rdx, str.Scanning_the_specified_cookie_directory
mov ecx, r12d
call fcn.1400031e0
mov rdx, qword [0x140021020]
mov r8, qword [0x14001f4d0]
mov rdi, qword [rdx]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e300]
call fcn.14000a7d0
mov rcx, qword [0x140021020]
mov rdx, rax
call qword [rdi + 0xf0]
lea rcx, str.Cookies
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e6b8]
call fcn.14000a7d0
test rax, rax
je 0x140005668
lea rdx, str.Scanning_the_specified_cookie_file
mov ecx, r12d
call fcn.1400031e0
mov rdx, qword [0x140021020]
mov r8, qword [0x14001f4d0]
mov rdi, qword [rdx]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e6b8]
call fcn.14000a7d0
mov rcx, qword [0x140021020]
mov rdx, rax
call qword [rdi + 0xf8]
lea rcx, [0x140017468]
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ddf8]
call fcn.14000a7d0
test rax, rax
je 0x1400056cb
lea rdx, str.Scanning_the_specified_event_file
mov ecx, r12d
call fcn.1400031e0
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001ddf8]
call fcn.14000a7d0
mov rcx, qword [0x140021020]
mov rdx, rax
call fcn.140009990
lea rcx, str.Event
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d618]
call fcn.14000a7d0
test rax, rax
je 0x14000570a
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001d618]
call fcn.14000a7d0
mov rcx, rax
call fcn.140008870
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e920]
call fcn.14000a7d0
test rax, rax
je 0x14000573c
lea rdx, str.Press_enter_to_continue
mov ecx, r12d
call fcn.1400031e0
call sub.msvcrt.dll_getchar
call fcn.140001e20
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e028]
call fcn.14000a7d0
test rax, rax
je 0x1400057af
lea rdx, str.Scanning_the_specified_registry_object
mov ecx, r12d
call fcn.1400031e0
mov rdx, qword [0x140021020]
mov r8, qword [0x14001f4d0]
mov rdi, qword [rdx]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001e028]
call fcn.14000a7d0
mov rcx, qword [0x140021020]
mov rdx, rax
call qword [rdi + pe_nt_image_headers64]
lea rcx, [0x140012948]
mov edx, eax
call fcn.140003b70
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001edb8]
call fcn.14000a7d0
test rax, rax
je 0x1400057fa
lea rdx, str.Scanning_the_registry
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 0x108]
lea rcx, [0x140012948]
mov edx, eax
call fcn.140003b70
lea rcx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp qword [rsp + 0x70], 0
je 0x14000584a
lea rcx, [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x158]
mov rax, qword [rcx]
mov r8d, 0x4b3
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000584a
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [0x14001f4d8]
test rcx, rcx
je 0x14000585c
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 0x170]
mov rcx, qword [0x140021020]
mov dword [rsp + 0x84], r13d
mov rbx, rax
mov dword [rsp + 0x80], r13d
mov dword [rsp + 0x88], r13d
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x84]
call qword [rax + 0x1b8]
mov rcx, qword [0x140021020]
lea rdx, [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x1c0]
mov rcx, qword [0x140021020]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [0x14001f528]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [0x1400172e0]
lea rdx, str._75.75s
mov ecx, r12d
call fcn.1400031e0
lea rdx, str.Summary_:_
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4e0]
lea rdx, str._tFilesFound_______:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4e4]
lea rdx, str._tFilesScanned_____:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4e8]
lea rdx, str._tFilesNotScanned__:__8d
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4fc]
lea rdx, str._tObjectsFound_____:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f500]
lea rdx, str._tObjectsInfected__:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f504]
lea rdx, str._tObjectsCleaned___:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f508]
lea rdx, str._tObjectsDeleted___:__8d
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4ec]
lea rdx, str._tFilesInfected____:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4f0]
lea rdx, str._tFilesCleaned_____:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4f4]
lea rdx, str._tFilesMoved_______:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f4f8]
lea rdx, str._tFilesDeleted_____:__8d
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f510]
lea rdx, str._tArtemisReportMode_Detections_At_VeryLow_Level_:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f514]
lea rdx, str._tArtemisReportMode_Detections_At_Low_Level_____:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f518]
lea rdx, str._tArtemisReportMode_Detections_At_Medium_Level__:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f51c]
lea rdx, str._tArtemisReportMode_Detections_At_High_Level____:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [0x14001f520]
lea rdx, str._tArtemisReportMode_Detections_At_VeryHigh_Level:__8d
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [rsp + 0x84]
lea rdx, str._tFiles_Scanned_by_Artemis__________:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [rsp + 0x80]
lea rdx, str._tFiles_found_clean_by_Artemis______:__8d
mov ecx, r12d
call fcn.1400031e0
mov r8d, dword [rsp + 0x88]
lea rdx, str._tDNS_queries_found_in_ReportMode___:__8d
mov ecx, r12d
call fcn.1400031e0
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
xor r9d, r9d
lea rax, [rsp + 0x390]
lea r8, [rsp + 0x138]
lea edx, [r9 + 2]
mov ecx, 0x400
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea rax, [rsp + 0x490]
lea r8, [rsp + 0x138]
xor r9d, r9d
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
lea rdx, [0x140012440]
mov ecx, r12d
call fcn.1400031e0
lea r9, [rsp + 0x390]
lea r8, [rsp + 0x490]
lea rdx, str.Started_at_:__s__s
mov ecx, r12d
call fcn.1400031e0
xor r9d, r9d
lea rax, [rsp + 0x390]
lea r8, [rsp + 0x148]
lea edx, [r9 + 2]
mov ecx, 0x400
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea rax, [rsp + 0x490]
lea r8, [rsp + 0x148]
xor r9d, r9d
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
lea r9, [rsp + 0x390]
lea r8, [rsp + 0x490]
lea rdx, str.Ended_at___:__s__s
mov ecx, r12d
call fcn.1400031e0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0xb0]
sub rdx, qword [rsp + 0x130]
mov qword [rsp + 0xb0], rdx
lea rdx, [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, str.Duration___:
xor ecx, ecx
call fcn.1400031e0
movzx edx, word [rsp + 0xc0]
test dx, dx
je 0x140005c8f
movzx r8d, dx
lea rdx, str._lu_hours
xor ecx, ecx
call fcn.1400031e0
cmp word [rsp + 0xc0], 0
je 0x140005c8f
movzx eax, word [rsp + 0xc2]
jmp 0x140005c9c
mov ax, word [rsp + 0xc2]
test ax, ax
je 0x140005cae
lea rdx, str._lu_minutes
movzx r8d, ax
xor ecx, ecx
call fcn.1400031e0
movzx r8d, word [rsp + 0xc4]
lea rdx, str._lu_seconds
mov ecx, r12d
call fcn.1400031e0
mov rcx, qword [rsp + 0xb0]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
lea rdi, [rcx + rdx]
sar rdi, 0x17
mov rax, rdi
shr rax, 0x3f
add rdi, rax
je 0x140005d97
cmp rbx, 0x200000
jbe 0x140005d16
mov r8, rbx
lea rdx, str._I64u_MB_scanned_in__I64u_seconds_
mov r9, rdi
shr r8, 0x14
xor ecx, ecx
call fcn.1400031e0
jmp 0x140005d4d
cmp rbx, 0xc800
jbe 0x140005d39
mov r8, rbx
lea rdx, str._I64u_KB_scanned_in__I64u_seconds_
mov r9, rdi
shr r8, 0xa
xor ecx, ecx
call fcn.1400031e0
jmp 0x140005d4d
lea rdx, str._I64u_bytes_scanned_in__I64u_seconds_
mov r9, rdi
mov r8, rbx
xor ecx, ecx
call fcn.1400031e0
xor edx, edx
mov rax, rbx
div rdi
cmp rax, 0x200000
jbe 0x140005d6d
shr rax, 0x14
lea rdx, str._I64u_MB_s
mov ecx, r12d
jmp 0x140005d8f
cmp rbx, 0xc800
jbe 0x140005d86
shr rax, 0xa
lea rdx, str._I64u_KB_s
mov ecx, r12d
jmp 0x140005d8f
lea rdx, str._I64u_bytes_s
xor ecx, ecx
mov r8, rax
call fcn.1400031e0
xor eax, eax
mov rcx, qword [rsp + 0xcc0]
xor rcx, rsp
call fcn.14000b700
mov rbx, qword [rsp + 0xd10]
add rsp, 0xcd0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edi, ecx
mov dword [0x14001f4c8], ecx
mov qword [0x14001f4d0], rdx
call fcn.14000b2f0
mov rdx, rbx
mov ecx, edi
call fcn.140003360
cmp al, 1
jne 0x140005e08
lea rcx, str.Event_has_been_set__csscan_is_exiting._n
call sub.msvcrt.dll_wprintf
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov ecx, edi
call fcn.1400035e0
cmp al, 1
je 0x140005dfb
lea rcx, [0x14001e4f8]
call fcn.14000a800
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.LockDown.dll_LockDownProtectProcessByHandle]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140003df0