Function at 0x14019ec10
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
xor r15d, r15d
mov qword [rsp + 0x48], r15
lea edx, [r15 + 0x13]
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x13]
lea r8, str.Labels_FilesScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
lea edx, [r15 + 0x13]
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x138]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x140]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x138]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x138]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], r15d
jle 0x14019ecf7
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019ed08
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x16
lea r8, str.Labels_ThreatsDetected
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x148]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x150]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x148]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x148]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019edad
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019edbe
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0x15
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x15
lea r8, str.Labels_ThreatsRemoved
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0x15
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x158]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x160]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x158]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x158]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019ee63
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019ee74
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x1a
lea r8, str.Labels_TotalObjectsScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x168]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x170]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x168]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x168]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019ef19
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019ef2a
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x1a
lea r8, str.Labels_RemnantFilesScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x178]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x180]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x178]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x178]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019efcf
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019efe0
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x19
lea r8, str.Labels_RemnantKeysScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x188]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x190]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x188]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x188]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019f085
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019f096
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, str.Labels_ScanTime
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x198]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x1a0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x198]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x198]
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019f13b
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019f14c
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
mov rax, qword [rsi]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [rax + 0x70]
nop
mov ecx, 0xb0
call fcn.1402b6dbc
test rax, rax
je 0x14019f176
mov rcx, rax
call fcn.140200240
mov rcx, rax
jmp 0x14019f179
mov rcx, r15
mov qword [rsi + 0xb0], rcx
mov qword [rsp + 0x40], 0x15
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xa0]
mov dword [rsp + 0x40], 0x296
mov dword [rsp + 0x44], 0x18
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xc0]
mov rbx, qword [rsi + 0xb0]
mov rdi, qword [rbx]
mov edx, 0xffffff
lea rcx, [rsp + 0x40]
call fcn.140003760
mov rdx, rax
mov rcx, rbx
call qword [rdi + 0x88]
movss xmm2, dword [0x140372108]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.1400037a0
nop
mov rcx, qword [rsi + 0xb0]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 0x78]
nop
cmp dword [rbp + 0x198], 0
jle 0x14019f221
mov rcx, qword [rbp + 0x190]
call fcn.1402b7350
mov qword [rsp + 0x48], r15
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, str.Captions_Finish
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
nop
mov rdx, rax
mov rcx, qword [rsi + 0xb0]
call fcn.1401f9c60
nop
cmp dword [rsp + 0x58], 0
jle 0x14019f297
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019f2a8
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
mov r9d, 0x10
mov r12d, 1
mov r8d, r12d
lea edx, [r9 + 0x70]
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rsi + 0xd8], rax
mov qword [rsp + 0x48], r15
lea edx, [r12 + 0x12]
lea rcx, [rsp + 0x40]
call fcn.1401fcb40
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [r12 + 0x12]
lea r8, str.Captions_MustReboot
mov rcx, qword [rsp + 0x40]
call fcn.1402ba94c
lea edx, [r12 + 0x12]
lea rcx, [rsp + 0x40]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f4800
mov rdi, rax
lea rbx, [rsi + 0xb8]
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbx + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.1401fde50
nop
cmp dword [rsp + 0x58], 0
jle 0x14019f37c
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x14019f38d
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
movd xmm2, dword [rbp - 0x20]
cvtdq2ps xmm2, xmm2
mulss xmm2, dword [0x140372250]
divss xmm2, dword [0x140372184]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.1400037a0
nop
movss xmm2, dword [0x1403720ec]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.1400037a0
nop
movd xmm8, dword [rbp - 0x20]
cvtdq2ps xmm8, xmm8
mulss xmm8, dword [0x140372250]
divss xmm8, dword [0x140372184]
lea rax, [0x140346ce0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x79], 1
mov qword [rsp + 0x74], r15
mov word [rbp - 0x7c], 0
mov byte [rbp - 0x75], 0
mov byte [rbp - 0x7a], 0
mov dword [rbp - 0x80], 0x190
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mulss xmm8, dword [0x140372254]
divss xmm8, dword [0x140372180]
cvttss2si ecx, xmm8
mov dword [rsp + 0x70], ecx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r8, qword [rbp + 0x40]
mov edx, 0x20
lea rcx, [rbp - 0x74]
call fcn.1402b6e28
mov dword [rbp - 0x80], 0x2bc
mov edx, dword [rbp + 0x4c]
lea rcx, [rbp - 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x4c]
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x40]
mov rcx, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, dword [rbp + 0x4c]
lea rcx, [rbp - 0x30]
call fcn.1401fde50
nop
lea rcx, [rbp + 0xc0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xe0], rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xe8], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xf0], rax
mov bl, 1
mov rax, qword [rsi + 0xa8]
mov rcx, qword [rax + 0x298]
test rcx, rcx
je 0x14019f4ea
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete bl
mov rcx, qword [rsi + 0xa8]
call fcn.14010f330
test al, al
jne 0x14019f632
call fcn.140111f80
test al, al
jne 0x14019f632
test bl, bl
je 0x14019f632
xor ecx, ecx
call fcn.1400f1cf0
mov rdi, rax
test rax, rax
je 0x14019f632
lea r8, [rsi + 0x118]
lea rdx, str.BannerURL
mov rcx, rax
call fcn.1400d8ae0
test al, al
je 0x14019f627
mov rcx, rsi
call fcn.14019eab0
lea rdx, str.Banner.bin
lea rcx, [rsp + 0x50]
call fcn.1400f1930
nop
xor bl, bl
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r12d
mov edx, 0x80000000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14019f5f4
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14019f5d4
cmp dword [rsp + 0x40], 4
jne 0x14019f5d4
cmp byte [rsp + 0x61], 0x50
jne 0x14019f5d4
cmp byte [rsp + 0x62], 0x4e
jne 0x14019f5d4
movzx ebx, bl
cmp byte [rsp + 0x63], 0x47
cmove ebx, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14019f5f4
mov rcx, qword [rsp + 0x50]
call fcn.140147420
mov qword [rsi + 0xf8], rax
jmp 0x14019f60c
lea r8, [rsi + 0x108]
lea rdx, [rsi + 0x100]
lea rcx, [rsp + 0x50]
call fcn.14019e900
mov dword [rsi + 0x12c], 0xa
cmp dword [rsp + 0x58], 0
jle 0x14019f627
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax]
mov rax, qword [rsi + 0xb0]
mov qword [rsp + 0x40], rax
mov rcx, rsi
call fcn.1401f9110
mov rbx, rax
lea rcx, [rax + 0x10]
mov r8, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [r8]
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x18], rax
cmp qword [rax + 8], 0
je 0x14019f671
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
call fcn.14019f730
nop
cmp dword [rbp - 0x28], 0
jle 0x14019f68a
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
nop
cmp dword [rbp + 0xb8], 0
jle 0x14019f6a0
mov rcx, qword [rbp + 0xb0]
call fcn.1402b7350
nop
cmp dword [rbp + 0x128], 0
jle 0x14019f6b6
mov rcx, qword [rbp + 0x120]
call fcn.1402b7350
nop
cmp dword [rbp + 0x48], 0
jle 0x14019f6c5
mov rcx, qword [rbp + 0x40]
call fcn.1402b7350
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm8, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret