Function at 0x1401874a8
Capabilities:
Get file system object information
Move file
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
lea ebx, [r12 + 7]
mov qword [rbp - 0x28], rbx
mov word [rbp - 0x40], r12w
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rbx
mov word [rbp - 0x20], r12w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140188080]
mov r8, qword [0x140231ad8]
lea rdx, str.VIRSCAN
mov rcx, qword [0x14023bc40]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
test rax, rax
je 0x140188004
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
lea esi, [rbx + 3]
mov edi, 0x1000
lea r14d, [r12 + 1]
lea r13d, [r12 + 8]
cmp byte [0x140231ad4], r12b
je 0x1401876a9
mov qword [rbp + 0x40], r12
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x1401da070]
movdqa xmmword [rbp + 0x50], xmm1
mov word [rbp + 0x40], r12w
mov qword [rbp + 0x60], r12
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x70], xmm1
mov word [rbp + 0x60], r12w
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
xor edx, edx
lea r8d, [r12 + 0x60]
lea rcx, [rbp + 0xa8]
call fcn.1401b0b80
lea rdx, [rbp + 0x40]
lea rcx, [0x140234020]
call fcn.14000e804
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
cmp rdx, qword [rsp + 0x40]
je 0x140187603
lea rdx, [rbp + 0x40]
call fcn.14000a638
jmp 0x14018760d
lea r8, [rbp + 0x40]
call fcn.14000a6b0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r13
jb 0x140187648
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, rdi
jb 0x140187643
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018804d
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqa xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, r13
jb 0x140187695
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, rdi
jb 0x140187690
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140188053
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqa xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
jmp 0x1401876fe
lea rcx, [rbp + 0x40]
call fcn.1400fdffc
nop
mov r8b, r14b
lea rdx, [rbp + 0x40]
lea rcx, [0x140234e50]
call fcn.140088400
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, esi
lea r8, [rsp + 0x30]
mov edx, 3
lea rcx, [rbp + 0x40]
call fcn.14011ea88
nop
lea rcx, [rbp + 0x40]
test al, al
jne 0x1401876f9
call fcn.14000bc58
jmp 0x140187ff9
call fcn.14000bc58
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
jne 0x140187839
mov ecx, 0x35f
call fcn.1400f5fe0
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r12w
jne 0x14018772c
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400041a8
nop
mov ecx, 0x35e
call fcn.1400f5fe0
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x14018775c
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400041a8
nop
mov r9d, 0x30
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, qword [0x140231ad8]
call fcn.140161ea0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
jb 0x1401877d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x1401877cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140188059
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, r13
jb 0x140187821
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, rdi
jb 0x14018781c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018805f
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
jmp 0x140187ff9
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x68], r12w
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r8d, 6
lea rdx, str.Rar_VR
lea rcx, [rsp + 0x78]
call fcn.1400041a8
nop
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.1401603bc
mov bl, al
lea rcx, [rsp + 0x78]
call fcn.140006b84
test bl, bl
je 0x140187fef
mov qword [rbp], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1401da070]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r12w
lea rcx, [rbp]
call fcn.1400e0838
mov r15b, r12b
mov rsi, r12
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140187aa0
mov rdi, r12
cmp byte [0x140231ad6], r12b
jne 0x140187a9b
lea rcx, [rbp - 0x68]
call fcn.1400e2aa8
mov rdx, qword [rsp + 0x30]
add rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.1400e2880
nop
lea rcx, [rsp + 0x58]
call fcn.1400caaf0
test al, al
jne 0x140187982
mov dl, r14b
lea rcx, [rsp + 0x58]
call fcn.1400e2298
lea rcx, [rsp + 0x58]
call fcn.1400caaf0
test al, al
jne 0x140187982
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rbx, qword [rsp + 0x58]
mov ecx, 0x1f7
call fcn.1400f5fe0
mov rdx, rbx
mov rcx, rax
call fcn.1401687cc
lea rcx, [0x14023bd90]
call fcn.1400bfa88
jmp 0x140187a4a
lea rcx, [rsp + 0x58]
call fcn.1400e2aa8
mov cl, r14b
call fcn.140152fb4
mov rcx, qword [rsp + 0x30]
add rcx, rdi
lea rdx, [0x140232ee0]
call fcn.1400df1b4
cmp byte [0x140231ad4], r12b
jne 0x1401879ca
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140232ee0]
lea rcx, [0x140234020]
call fcn.14000fdb0
cmp byte [0x140234468], r12b
jne 0x1401879dc
cmp byte [0x14023440b], r12b
je 0x1401879df
mov r15b, r14b
mov eax, dword [0x140234024]
mov dword [0x140232e60], eax
lea rcx, [0x140233230]
call fcn.1400fe200
lea rcx, [0x140233020]
call fcn.1400fe200
lea rdx, [0x1401da2d0]
lea rcx, [0x140233020]
call fcn.1400fe040
call fcn.140169840
mov ebx, eax
mov r8b, r14b
xor edx, edx
lea rcx, [0x140234020]
call fcn.14000de50
call fcn.140169840
movzx ecx, byte [0x140231ad7]
cmp ebx, eax
cmovne ecx, r14d
mov byte [0x140231ad7], cl
test cl, cl
jne 0x140187a91
lea rcx, [rsp + 0x58]
call fcn.140006b84
add rsi, r14
add rdi, 0xc8
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x1401878fa
jmp 0x140187a9b
lea rcx, [rsp + 0x58]
call fcn.140006b84
mov edi, 0x1000
mov r14b, r12b
cmp byte [0x140231ad7], r12b
jne 0x140187f18
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140232ee0]
lea ecx, [r9 + 0xa]
call fcn.1401651c0
mov r14b, al
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rdx, qword [rbp - 0x40]
lea rcx, [0x1401ecc88]
call fcn.140162de0
mov ecx, 0x543
call fcn.1400f5fe0
mov rcx, rax
call fcn.140162de0
lea rcx, [rbp - 0x68]
call fcn.1400e2aa8
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x20]
call fcn.14017af04
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rcx, qword [rbp - 0x40]
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x40]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x140187d12
mov ecx, 0x5a4d
cmp ax, cx
je 0x140187b59
mov ecx, 0x4550
cmp ax, cx
jne 0x140187d12
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400042b0
nop
lea rcx, [rsp + 0x78]
call fcn.1400df0fc
call fcn.1401b5074
mov r8d, eax
lea rdx, str.Rar_Scan_d.bat
lea rcx, [rbp + 0x20]
call fcn.1400fdfbc
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], r13
jb 0x140187bb2
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140006c14
nop
lea rcx, [rbp + 0x20]
call fcn.140006b84
lea rdx, [0x1401da924]
lea rcx, [rsp + 0x78]
call fcn.1400ccd94
mov rbx, rax
test rax, rax
je 0x140187d08
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
mov r10, qword [rbp - 0x28]
cmp r10, r13
cmovae rcx, rdx
cmp word [rcx], 0x22
je 0x140187c10
lea rcx, [rbp - 0x40]
call fcn.140128ac8
mov r10, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x40]
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], r13
cmovae r9, qword [rbp - 0x20]
lea r8, [rbp - 0x40]
cmp r10, r13
cmovae r8, rdx
lea rdx, str.__s__s_r_n_echo._r_n_pause
lea rcx, [rbp + 0x20]
call fcn.1400fdfbc
nop
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r12
mov esi, 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r12b
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.1401045c0
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rcx, qword [rsp + 0x58]
mov r9, rbx
mov r8, qword [rsp + 0x68]
lea edx, [rsi - 0xe]
call fcn.1401baf9c
mov rcx, rbx
call fcn.1401ba994
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.140004948
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], r13
cmovae rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], r12
mov word [rax], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140187cef
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x140187cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140188065
call fcn.1401addcc
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r12b
lea rcx, [rbp + 0x20]
call fcn.140006b84
nop
lea rcx, [rsp + 0x78]
call fcn.140006b84
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
xor r8d, r8d
lea rdx, [0x1401d9fd0]
lea rcx, [rsp + 0x78]
call fcn.1400041a8
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov rdi, qword [rbp - 0x30]
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rsi, qword [rbp - 0x40]
movabs rbx, 0x7ffffffffffffffe
cmp rdi, rbx
ja 0x14018806b
mov qword [rsp + 0x70], 7
cmp rdi, r13
jae 0x140187d9c
mov qword [rsp + 0x68], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1401aff80
jmp 0x140187e23
mov rax, rdi
or rax, 7
cmp rax, rbx
jbe 0x140187db8
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140187dea
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140188071
add rcx, rcx
cmp rcx, 0x1000
jb 0x140187df1
call fcn.14000416c
jmp 0x140187e00
test rcx, rcx
je 0x140187dfd
call fcn.1401add90
jmp 0x140187e00
mov rax, r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1401aff80
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.140196178
mov bl, al
mov rdx, qword [rbp - 0x70]
cmp rdx, r13
jb 0x140187e8e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140187e89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140188047
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
test bl, bl
je 0x140187ef6
mov edx, 0xc8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x102
jmp 0x140187ee5
cmp byte [0x140231ad6], r12b
jne 0x140187ee9
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140095524
mov edx, 0xc8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x140187ebc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140187f18
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rbx, qword [rbp - 0x40]
mov ecx, 0x201
call fcn.1400f5fe0
mov rdx, rbx
mov rcx, rax
call fcn.1401687cc
lea rcx, [rbp]
call fcn.1400e2aa8
test r15b, r15b
je 0x140187fd1
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.1400042b0
nop
lea rcx, [rsp + 0x58]
call fcn.1400e0b4c
add rax, 6
cmp rax, qword [rsp + 0x68]
jae 0x140187fc7
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rcx, qword [rsp + 0x58]
mov edx, SHRestricted
mov word [rcx + rax*2], dx
lea rcx, [rsp + 0x58]
call fcn.1400cb2c4
test al, al
jne 0x140187fc7
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140187fc7
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.140004948
nop
lea rcx, [rsp + 0x58]
call fcn.140006b84
lea rcx, [rbp - 0x68]
call fcn.14015eafc
test r14b, r14b
je 0x140187fe5
call fcn.140165fa0
nop
lea rcx, [rbp]
call fcn.140006b84
nop
lea rcx, [rbp - 0x68]
call fcn.140006b84
nop
lea rcx, [rsp + 0x30]
call fcn.140012e14
nop
lea rcx, [rbp - 0x20]
call fcn.140006b84
nop
lea rcx, [rbp - 0x40]
call fcn.140006b84
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1401adee0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
call fcn.140006be8
int3
call fcn.140006b64
int3