Function at 0x1400c87e4
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push r12
push r13
push r14
mov eax, 0x86f0
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x8710], rbx
mov qword [rsp + 0x8718], rbp
mov qword [rsp + 0x8720], rsi
mov qword [rsp + 0x8728], rdi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x86e0], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2f10]
mov r8, qword [0x140158330]
lea rdx, str.VIRSCAN
mov rcx, qword [0x140149ef8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r12d, r12d
cmp rax, r12
je 0x1400c8f38
lea rcx, [rsp + 0x60]
call fcn.14008e5a0
nop
mov r14d, 0x800
lea rbp, [0x140164e50]
lea r13d, [r12 + 1]
cmp byte [0x1401561a5], r12b
je 0x1400c88c7
mov r8, r14
lea rdx, [rsp + 0x45f0]
mov rcx, rbp
call fcn.140078534
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x60]
call fcn.14008e7dc
lea rcx, [rsp + 0x60]
call fcn.14008e450
jmp 0x1400c8986
lea rcx, [rsp + 0x170]
call fcn.14006634c
nop
mov r8b, r13b
lea rdx, [rsp + 0x170]
lea rcx, [0x140162bc0]
call fcn.140092c70
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x38], r12b
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], r13b
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [r9 + 3]
lea rcx, [rsp + 0x170]
call fcn.14009fa04
cmp al, r12b
jne 0x1400c8974
mov rcx, qword [rsp + 0x170]
cmp rcx, r12
je 0x1400c8936
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x140]
cmp rcx, r12
je 0x1400c8949
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r12
je 0x1400c895c
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400c8f38
call fcn.1400e9aa4
jmp 0x1400c8f38
mov rcx, qword [rsp + 0x170]
cmp rcx, r12
je 0x1400c8986
call fcn.1400e9aa4
xor r9d, r9d
mov r8, r14
lea rdx, [rsp + 0x35f0]
lea rcx, str.Rar_VR
call fcn.1400b5d58
cmp al, r12b
jne 0x1400c89e3
mov rcx, qword [rsp + 0x140]
cmp rcx, r12
je 0x1400c89b8
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r12
je 0x1400c89cb
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400c8f38
call fcn.1400e9aa4
jmp 0x1400c8f38
mov rdx, r14
lea rcx, [rsp + 0x76e0]
call fcn.1400b676c
mov sil, r12b
mov rbx, r12
cmp qword [rsp + 0x138], r12
jbe 0x1400c8ba9
cmp byte [0x140157281], r12b
jne 0x1400c8ba9
lea rcx, [rsp + 0x35f0]
call fcn.1400b6708
mov r8, rbx
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x60]
call fcn.14008e6b8
mov rcx, rax
call fcn.140050ce0
lea rdx, [rsp + 0x25f0]
movzx ecx, word [rax]
mov word [rdx], cx
add rax, 2
add rdx, 2
cmp cx, r12w
jne 0x1400c8a46
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x25f0]
call fcn.140042a00
cmp eax, r12d
je 0x1400c8ac3
mov dl, r13b
lea rcx, [rsp + 0x25f0]
call fcn.140050714
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x25f0]
call fcn.140042a00
cmp eax, r12d
je 0x1400c8ac3
mov ecx, 0x1f7
call fcn.14005fad0
mov rcx, rax
lea rdx, [rsp + 0x25f0]
call fcn.1400c5808
lea rcx, [0x140149f00]
call fcn.14003c5cc
jmp 0x1400c8b98
lea rcx, [rsp + 0x25f0]
call fcn.1400b6708
mov cl, r13b
call fcn.1400b1468
mov r8, rbx
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x60]
call fcn.14008e6b8
mov rcx, rax
mov r8, r14
lea rdx, [0x140173f2a]
call fcn.140051558
cmp byte [0x1401561a5], r12b
jne 0x1400c8b1d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140173f2a]
mov rcx, rbp
call fcn.140079aac
cmp byte [0x140165370], r12b
jne 0x1400c8b2f
cmp byte [0x1401652bb], r12b
je 0x1400c8b32
mov sil, r13b
mov eax, dword [0x140164e54]
mov dword [0x140170ec8], eax
lea rcx, [0x140175158]
call fcn.14006617c
lea rcx, [0x140174f30]
call fcn.14006617c
lea rdx, [0x14010be18]
lea rcx, [0x140174f30]
call fcn.1400661a4
mov edi, dword [0x14018f618]
mov r8b, r13b
xor edx, edx
mov rcx, rbp
call fcn.14007a724
movzx edx, byte [0x1401561a4]
cmp edi, dword [0x14018f618]
cmovne edx, r13d
mov byte [0x1401561a4], dl
cmp dl, r12b
jne 0x1400c8ba9
add rbx, r13
cmp rbx, qword [rsp + 0x138]
jb 0x1400c8a07
mov bl, r12b
cmp byte [0x1401561a4], r12b
jne 0x1400c8e54
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140173f2a]
lea ecx, [r9 + 0xa]
call fcn.1400b99d4
mov bl, al
lea rdx, [rsp + 0x4f0]
lea rcx, [0x14010e578]
call fcn.1400b7118
mov ecx, 0x543
call fcn.14005fad0
mov rcx, rax
call fcn.1400b7118
lea rcx, [rsp + 0x35f0]
call fcn.1400b6708
lea rdx, [rsp + 0x35f0]
lea rcx, [rsp + 0x14f0]
call fcn.1400be0a8
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rsp + 0x230]
xor edx, edx
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
cmp cx, r12w
jne 0x1400c8db2
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400c8c68
mov ecx, 0x4550
cmp ax, cx
jne 0x1400c8db2
mov rcx, r12
movzx eax, word [rsp + rcx + 0x35f0]
mov word [rsp + rcx + 0x25f0], ax
add rcx, 2
cmp ax, r12w
jne 0x1400c8c6b
mov rdx, r14
lea rcx, [rsp + 0x25f0]
call fcn.1400504d4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x25f0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
mov rdi, rcx
call fcn.1400ee424
mov r9d, eax
mov rdx, r14
sub rdx, rdi
lea rcx, [rsp + rdi*2 + 0x25f0]
lea r8, str.Rar_Scan_d.bat
call fcn.140057264
lea rdx, [0x14010ee70]
lea rcx, [rsp + 0x25f0]
call fcn.1400423b4
mov rbp, rax
cmp rax, r12
je 0x1400c8db2
cmp word [rsp + 0x4f0], 0x22
je 0x1400c8d0c
mov rdx, r14
lea rcx, [rsp + 0x4f0]
call fcn.1400a3e94
lea rax, [rsp + 0x14f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f0]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edi, 0x1000
mov rdx, rdi
lea rcx, [rsp + 0x56e0]
call fcn.140057264
mov r8, rdi
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x56e0]
call fcn.14006885c
mov byte [rsp + 0x55ef], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x45f0]
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
mov r8, rcx
mov r9, rbp
mov rdx, r13
lea rcx, [rsp + 0x45f0]
call fcn.1400ef054
mov rcx, rbp
call fcn.1400eee40
mov r8, r14
lea rdx, [rsp + 0x25f0]
lea rcx, [rsp + 0x4f0]
call fcn.140065d2c
mov word [rsp + 0x14f0], r12w
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r12b
lea r9, [rsp + 0x14f0]
lea r8, [rsp + 0x35f0]
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call fcn.1400cd058
cmp al, r12b
je 0x1400c8e3a
mov edi, 0xc8
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ebp, [rdi + 0x3a]
cmp eax, ebp
jne 0x1400c8e2d
cmp byte [0x140157281], r12b
jne 0x1400c8e2d
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140096a14
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebp
je 0x1400c8e03
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c8e54
mov ecx, 0x201
call fcn.14005fad0
mov rcx, rax
lea rdx, [rsp + 0x4f0]
call fcn.1400c5808
lea rcx, [rsp + 0x76e0]
call fcn.1400b6708
cmp sil, r12b
je 0x1400c8ee3
mov rcx, r12
movzx eax, word [rsp + rcx + 0x35f0]
mov word [rsp + rcx + 0x25f0], ax
add rcx, 2
cmp ax, r12w
jne 0x1400c8e69
lea rcx, [rsp + 0x25f0]
call fcn.140050ce0
mov ecx, SHRestricted
mov word [rax + 0xc], cx
lea rcx, [rsp + 0x25f0]
call fcn.140042584
cmp al, r12b
jne 0x1400c8ee3
lea rdx, [rsp + 0x25f0]
lea rcx, [rsp + 0x35f0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r12d
je 0x1400c8ee3
mov rcx, r12
movzx eax, word [rsp + rcx + 0x25f0]
mov word [rsp + rcx + 0x35f0], ax
add rcx, 2
cmp ax, r12w
jne 0x1400c8ec9
lea rcx, [rsp + 0x35f0]
call fcn.1400b6370
cmp bl, r12b
je 0x1400c8f03
mov rcx, qword [0x1401561a8]
call qword [sym.imp.USER32.dll_DestroyWindow]
nop
mov rcx, qword [rsp + 0x140]
cmp rcx, r12
je 0x1400c8f16
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r12
je 0x1400c8f29
call fcn.1400e9aa4
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400c8f38
call fcn.1400e9aa4
mov rcx, qword [rsp + 0x86e0]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x86f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret