Function at 0x140188a18
Capabilities:
Get file system object information
Move file
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
mov rax, qword [0x140231eb8]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
lea ebx, [r12 + 7]
mov qword [rbp - 0x28], rbx
mov word [rbp - 0x40], r12w
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rbx
mov word [rbp - 0x20], r12w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1401895f0]
mov r8, qword [0x140233a38]
lea rdx, str.VIRSCAN
mov rcx, qword [0x14023fc40]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
test rax, rax
je 0x140189574
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
lea esi, [rbx + 3]
mov edi, 0x1000
lea r14d, [r12 + 1]
lea r13d, [r12 + 8]
cmp byte [0x140233a34], r12b
je 0x140188c19
mov qword [rbp + 0x40], r12
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x50], xmm1
mov word [rbp + 0x40], r12w
mov qword [rbp + 0x60], r12
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x70], xmm1
mov word [rbp + 0x60], r12w
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
xor edx, edx
lea r8d, [r12 + 0x60]
lea rcx, [rbp + 0xa8]
call fcn.1401b2120
lea rdx, [rbp + 0x40]
lea rcx, [0x140236020]
call fcn.14000e854
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
cmp rdx, qword [rsp + 0x40]
je 0x140188b73
lea rdx, [rbp + 0x40]
call fcn.14000a648
jmp 0x140188b7d
lea r8, [rbp + 0x40]
call fcn.14000a6c0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r13
jb 0x140188bb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, rdi
jb 0x140188bb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401895bd
call fcn.1401af36c
movdqa xmm0, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, r13
jb 0x140188c05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, rdi
jb 0x140188c00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401895c3
call fcn.1401af36c
movdqa xmm0, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
jmp 0x140188c6e
lea rcx, [rbp + 0x40]
call fcn.1400fea8c
nop
mov r8b, r14b
lea rdx, [rbp + 0x40]
lea rcx, [0x140236e50]
call fcn.140088500
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, esi
lea r8, [rsp + 0x30]
mov edx, 3
lea rcx, [rbp + 0x40]
call fcn.14011f6b8
nop
lea rcx, [rbp + 0x40]
test al, al
jne 0x140188c69
call fcn.14000bc68
jmp 0x140189569
call fcn.14000bc68
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
jne 0x140188da9
mov ecx, 0x35f
call fcn.1400f6aa0
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r12w
jne 0x140188c9c
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400041b8
nop
mov ecx, 0x35e
call fcn.1400f6aa0
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140188ccc
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400041b8
nop
mov r9d, 0x30
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, qword [0x140233a38]
call fcn.140162f50
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
jb 0x140188d41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x140188d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401895c9
call fcn.1401af36c
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, r13
jb 0x140188d91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, rdi
jb 0x140188d8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401895cf
call fcn.1401af36c
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
jmp 0x140189569
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x68], r12w
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r8d, 6
lea rdx, str.Rar_VR
lea rcx, [rsp + 0x78]
call fcn.1400041b8
nop
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.14016146c
mov bl, al
lea rcx, [rsp + 0x78]
call fcn.140006b94
test bl, bl
je 0x14018955f
mov qword [rbp], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r12w
lea rcx, [rbp]
call fcn.1400e1288
mov r15b, r12b
mov rsi, r12
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140189010
mov rdi, r12
cmp byte [0x140233a36], r12b
jne 0x14018900b
lea rcx, [rbp - 0x68]
call fcn.1400e3564
mov rdx, qword [rsp + 0x30]
add rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.1400e333c
nop
lea rcx, [rsp + 0x58]
call fcn.1400cb220
test al, al
jne 0x140188ef2
mov dl, r14b
lea rcx, [rsp + 0x58]
call fcn.1400e2d54
lea rcx, [rsp + 0x58]
call fcn.1400cb220
test al, al
jne 0x140188ef2
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rbx, qword [rsp + 0x58]
mov ecx, 0x1f7
call fcn.1400f6aa0
mov rdx, rbx
mov rcx, rax
call fcn.14016b0ac
lea rcx, [0x14023fd90]
call fcn.1400c0218
jmp 0x140188fba
lea rcx, [rsp + 0x58]
call fcn.1400e3564
mov cl, r14b
call fcn.140153e2c
mov rcx, qword [rsp + 0x30]
add rcx, rdi
lea rdx, [0x140234ea0]
call fcn.1400dfbe4
cmp byte [0x140233a34], r12b
jne 0x140188f3a
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140234ea0]
lea rcx, [0x140236020]
call fcn.14000fe00
cmp byte [0x140236468], r12b
jne 0x140188f4c
cmp byte [0x14023640b], r12b
je 0x140188f4f
mov r15b, r14b
mov eax, dword [0x140236024]
mov dword [0x140234e20], eax
lea rcx, [0x1402351f0]
call fcn.1400fec90
lea rcx, [0x140234fe0]
call fcn.1400fec90
lea rdx, [0x1401dc2f0]
lea rcx, [0x140234fe0]
call fcn.1400fead0
call fcn.14016c120
mov ebx, eax
mov r8b, r14b
xor edx, edx
lea rcx, [0x140236020]
call fcn.14000de90
call fcn.14016c120
movzx ecx, byte [0x140233a37]
cmp ebx, eax
cmovne ecx, r14d
mov byte [0x140233a37], cl
test cl, cl
jne 0x140189001
lea rcx, [rsp + 0x58]
call fcn.140006b94
add rsi, r14
add rdi, 0xc8
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x140188e6a
jmp 0x14018900b
lea rcx, [rsp + 0x58]
call fcn.140006b94
mov edi, 0x1000
mov r14b, r12b
cmp byte [0x140233a37], r12b
jne 0x140189488
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140234ea0]
lea ecx, [r9 + 0xa]
call fcn.1401662d0
mov r14b, al
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rdx, qword [rbp - 0x40]
lea rcx, [0x1401eed28]
call fcn.140163e90
mov ecx, 0x543
call fcn.1400f6aa0
mov rcx, rax
call fcn.140163e90
lea rcx, [rbp - 0x68]
call fcn.1400e3564
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x20]
call fcn.14017cde4
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rcx, qword [rbp - 0x40]
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x40]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x140189282
mov ecx, 0x5a4d
cmp ax, cx
je 0x1401890c9
mov ecx, 0x4550
cmp ax, cx
jne 0x140189282
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400042c0
nop
lea rcx, [rsp + 0x78]
call fcn.1400dfb2c
call fcn.1401b6614
mov r8d, eax
lea rdx, str.Rar_Scan_d.bat
lea rcx, [rbp + 0x20]
call fcn.1400fea4c
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], r13
jb 0x140189122
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140006c24
nop
lea rcx, [rbp + 0x20]
call fcn.140006b94
lea rdx, [0x1401dc934]
lea rcx, [rsp + 0x78]
call fcn.1400cd4c4
mov rbx, rax
test rax, rax
je 0x140189278
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
mov r10, qword [rbp - 0x28]
cmp r10, r13
cmovae rcx, rdx
cmp word [rcx], 0x22
je 0x140189180
lea rcx, [rbp - 0x40]
call fcn.1401296f8
mov r10, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x40]
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], r13
cmovae r9, qword [rbp - 0x20]
lea r8, [rbp - 0x40]
cmp r10, r13
cmovae r8, rdx
lea rdx, str.__s__s_r_n_echo._r_n_pause
lea rcx, [rbp + 0x20]
call fcn.1400fea4c
nop
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r12
mov esi, 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r12b
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.1401051a4
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rcx, qword [rsp + 0x58]
mov r9, rbx
mov r8, qword [rsp + 0x68]
lea edx, [rsi - 0xe]
call fcn.1401bc53c
mov rcx, rbx
call fcn.1401bbf34
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.140004958
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], r13
cmovae rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], r12
mov word [rax], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14018925f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x14018925a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401895d5
call fcn.1401af36c
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r12b
lea rcx, [rbp + 0x20]
call fcn.140006b94
nop
lea rcx, [rsp + 0x78]
call fcn.140006b94
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
xor r8d, r8d
lea rdx, [0x1401dbff0]
lea rcx, [rsp + 0x78]
call fcn.1400041b8
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov rdi, qword [rbp - 0x30]
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rsi, qword [rbp - 0x40]
movabs rbx, 0x7ffffffffffffffe
cmp rdi, rbx
ja 0x1401895db
mov qword [rsp + 0x70], 7
cmp rdi, r13
jae 0x14018930c
mov qword [rsp + 0x68], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1401b1520
jmp 0x140189393
mov rax, rdi
or rax, 7
cmp rax, rbx
jbe 0x140189328
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14018935a
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1401895e1
add rcx, rcx
cmp rcx, 0x1000
jb 0x140189361
call fcn.14000417c
jmp 0x140189370
test rcx, rcx
je 0x14018936d
call fcn.1401af330
jmp 0x140189370
mov rax, r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1401b1520
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.1401977f8
mov bl, al
mov rdx, qword [rbp - 0x70]
cmp rdx, r13
jb 0x1401893fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401893f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401895b7
call fcn.1401af36c
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
test bl, bl
je 0x140189466
mov edx, 0xc8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x102
jmp 0x140189455
cmp byte [0x140233a36], r12b
jne 0x140189459
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140095834
mov edx, 0xc8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x14018942c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140189488
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rbx, qword [rbp - 0x40]
mov ecx, 0x201
call fcn.1400f6aa0
mov rdx, rbx
mov rcx, rax
call fcn.14016b0ac
lea rcx, [rbp]
call fcn.1400e3564
test r15b, r15b
je 0x140189541
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.1400042c0
nop
lea rcx, [rsp + 0x58]
call fcn.1400e159c
add rax, 6
cmp rax, qword [rsp + 0x68]
jae 0x140189537
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rcx, qword [rsp + 0x58]
mov edx, SHRestricted
mov word [rcx + rax*2], dx
lea rcx, [rsp + 0x58]
call fcn.1400cb9f4
test al, al
jne 0x140189537
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140189537
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.140004958
nop
lea rcx, [rsp + 0x58]
call fcn.140006b94
lea rcx, [rbp - 0x68]
call fcn.14015fbac
test r14b, r14b
je 0x140189555
call fcn.1401670b0
nop
lea rcx, [rbp]
call fcn.140006b94
nop
lea rcx, [rbp - 0x68]
call fcn.140006b94
nop
lea rcx, [rsp + 0x30]
call fcn.140012e68
nop
lea rcx, [rbp - 0x20]
call fcn.140006b94
nop
lea rcx, [rbp - 0x40]
call fcn.140006b94
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1401af480
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401b6544
nop
call fcn.1401b6544
nop
call fcn.1401b6544
nop
call fcn.1401b6544
nop
call fcn.1401b6544
nop
call fcn.1401b6544
nop
call fcn.140006bf8
int3
call fcn.140006b74
int3