Function at 0x1400052f0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r13d, r13d
lea rcx, str.Checking_for_3rd_Party_Anti_Viruses
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r8d, [r13 + 0x69]
lea rdx, str.WMIC__Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get_displayName__Format:List
lea rcx, [rbp - 0x30]
call fcn.140002420
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r13b
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
lea rdx, [0x14004ba8c]
call fcn.140021d38
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x140005444
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea r8d, [r13 + 0x54]
lea rdx, str.__Failed_to_check_for_3rd_party_Anti_Viruses__manually_check_and_uninstall__Error_4_
lea rcx, [rsp + 0x70]
call fcn.140002420
nop
lea rcx, [0x140055cb0]
call fcn.14000bb90
lea rdx, str._X_
call fcn.140002140
lea rcx, [0x140055d00]
call fcn.14000bb90
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000fec0
mov rcx, rax
call fcn.14000d840
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005db4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000543a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e75
call fcn.1400169d4
jmp 0x140005db4
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x10]
call fcn.140023fc4
test rax, rax
je 0x140005493
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.140001d80
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x10]
call fcn.140023fc4
test rax, rax
jne 0x140005470
mov rcx, rbx
call fcn.140021c60
nop dword [rax + rax]
lea rdi, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
seta r12b
mov r15, qword [rbp - 0x70]
cmova rdi, r15
mov r14, qword [rbp - 0x60]
cmp r14, 1
jb 0x140005515
lea rsi, [r14 + rdi]
mov r8, r14
mov edx, 0xa
mov rcx, rdi
call fcn.14003d5f0
mov rbx, rax
test rax, rax
je 0x140005515
nop dword [rax + rax]
cmp byte [rbx], 0xa
jne 0x1400054ea
mov eax, r13d
jmp 0x1400054ef
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400055ea
inc rbx
mov r8, rsi
sub r8, rbx
mov edx, 0xa
mov rcx, rbx
call fcn.14003d5f0
mov rbx, rax
test rax, rax
jne 0x1400054e0
mov rbx, 0xffffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x140005a5f
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8, rbx
cmp r14, rbx
cmovb r8, r14
lea rdx, [rbp - 0x70]
test r12b, r12b
cmovne rdx, r15
lea rcx, [rsp + 0x50]
call fcn.140002420
nop
lea r14, [rsp + 0x50]
mov r12, qword [rsp + 0x68]
cmp r12, 0xf
seta cl
mov byte [rsp + 0x20], cl
mov r15, qword [rsp + 0x50]
cmova r14, r15
mov r13, qword [rsp + 0x60]
cmp r13, 0x10
jb 0x140005604
lea rsi, [r14 + r13]
lea r8, [rsi - 0xf]
sub r8, r14
mov edx, 0x57
mov rcx, r14
call fcn.14003d5f0
mov rdi, rax
test rax, rax
je 0x1400055ff
nop word [rax + rax]
mov r8d, 0x10
lea rdx, str.Windows_Defender
mov rcx, rdi
call fcn.14003da50
test eax, eax
je 0x1400055f2
inc rdi
lea r8, [rsi - 0xf]
sub r8, rdi
mov edx, 0x57
mov rcx, rdi
call fcn.14003d5f0
mov rdi, rax
test rax, rax
jne 0x1400055b0
jmp 0x1400055ff
sub rbx, rdi
jmp 0x14000551c
sub rdi, r14
cmp rdi, 0xffffffffffffffff
jne 0x14000593a
movzx ecx, byte [rsp + 0x20]
cmp r13, 0xc
jbe 0x14000593a
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea rax, [r13 - 0xc]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rsp + 0x50]
test cl, cl
cmovne rdx, r15
add rdx, 0xc
lea rcx, [rsp + 0x70]
call fcn.140002420
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140005688
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005683
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e7b
call fcn.1400169d4
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm1
movups xmm2, xmmword [rbp - 0x80]
movups xmmword [rsp + 0x60], xmm2
lea rsi, [rsp + 0x50]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
seta cl
movq r9, xmm1
cmova rsi, r9
movq rax, xmm2
add rsi, rax
lea rdx, [rsp + 0x50]
test cl, cl
je 0x1400056d5
lea rdi, [r9 + rax]
jmp 0x1400056de
lea rdi, [rax + rdx]
lea r9, [rsp + 0x50]
mov r8b, 0xa
mov rdx, rdi
mov rcx, r9
call fcn.1400154c0
mov r10, rax
cmp rax, rdi
je 0x140005716
inc rax
cmp rax, rdi
je 0x140005716
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x14000570e
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x140005700
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta r8b
cmova rcx, qword [rsp + 0x50]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rsp + 0x60]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x50]
test r8b, r8b
cmovne rcx, qword [rsp + 0x50]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.14003cf70
mov qword [rsp + 0x60], rdi
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta cl
mov r9, qword [rsp + 0x50]
cmova rsi, r9
add rsi, rdi
lea rax, [rsp + 0x50]
test cl, cl
je 0x140005799
add rdi, r9
jmp 0x1400057a1
add rdi, rax
lea r9, [rsp + 0x50]
mov r8b, 0xd
mov rdx, rdi
mov rcx, r9
call fcn.1400154c0
mov r10, rax
cmp rax, rdi
je 0x1400057d6
inc rax
cmp rax, rdi
je 0x1400057d6
nop
movzx ecx, byte [rax]
cmp cl, 0xd
je 0x1400057ce
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x1400057c0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta r8b
cmova rcx, qword [rsp + 0x50]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rsp + 0x60]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x50]
test r8b, r8b
cmovne rcx, qword [rsp + 0x50]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.14003cf70
mov qword [rsp + 0x60], rdi
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta cl
mov r9, qword [rsp + 0x50]
cmova rsi, r9
add rsi, rdi
lea rax, [rsp + 0x50]
test cl, cl
je 0x140005859
add rdi, r9
jmp 0x140005861
add rdi, rax
lea r9, [rsp + 0x50]
mov r8b, 8
mov rdx, rdi
mov rcx, r9
call fcn.1400154c0
mov r10, rax
cmp rax, rdi
je 0x140005896
inc rax
cmp rax, rdi
je 0x140005896
nop
movzx ecx, byte [rax]
cmp cl, 8
je 0x14000588e
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x140005880
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
seta r8b
cmova rcx, qword [rsp + 0x50]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rsp + 0x60]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x50]
test r8b, r8b
cmovne rcx, qword [rsp + 0x50]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.14003cf70
mov qword [rsp + 0x60], rdi
cmp qword [rbp - 0x40], 0
je 0x140005913
mov r8d, 2
lea rdx, [0x14004bafc]
lea rcx, [rbp - 0x50]
call fcn.1400020b0
mov rdi, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, rdi
lea rcx, [rbp - 0x50]
call fcn.1400020b0
mov r12, qword [rsp + 0x68]
mov r15, qword [rsp + 0x50]
inc rbx
mov rax, qword [rbp - 0x60]
cmp rbx, rax
jae 0x140005a24
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor r13d, r13d
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
cmp rax, rbx
jb 0x140005e81
sub rax, rbx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
add rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002420
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400059cd
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e7b
call fcn.1400169d4
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x60], xmm1
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400054a0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e87
call fcn.1400169d4
jmp 0x1400054a0
cmp r12, 0xf
jbe 0x140005a5c
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140005a54
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e87
mov rcx, r15
call fcn.1400169d4
xor r13d, r13d
mov rsi, qword [rbp - 0x40]
test rsi, rsi
je 0x140005cba
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x47
jb 0x140005e8d
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r15, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea r14, [rsi + 0x47]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
cmp r14, rbx
jbe 0x140005b33
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140005af4
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016990
test rax, rax
je 0x140005e93
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140005b2e
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140005b1c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005e69
jmp 0x140005ad5
test rcx, rcx
je 0x140005b2b
call fcn.140016990
mov rdi, rax
jmp 0x140005b2e
mov rdi, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [str.__A_3rd_party_Anti_Virus_is_installed__please_uninstall_or_disable_it__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14004bb20]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14004bb30]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14004bb40]
movups xmmword [rdi + 0x30], xmm1
mov eax, dword [0x14004bb50]
mov dword [rdi + 0x40], eax
movzx eax, word [0x14004bb54]
mov word [rdi + 0x44], ax
movzx eax, byte [0x14004bb56]
mov byte [rdi + 0x46], al
lea rcx, [rdi + 0x47]
mov r8, rsi
mov rdx, r15
call fcn.14003cf70
mov byte [rdi + r14], 0
mov r8d, 1
lea rdx, [0x14004bb00]
lea rcx, [rsp + 0x28]
call fcn.1400020b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140005c1d
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e99
call fcn.1400169d4
movdqa xmm0, xmmword [0x14004d940]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
lea rcx, [0x140055cb0]
call fcn.14000bb90
lea rdx, str._X_
call fcn.140002140
lea rcx, [0x140055d00]
call fcn.14000bb90
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000fec0
mov rcx, rax
call fcn.14000d840
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005d69
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e6f
jmp 0x140005d63
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8d, 0x26
lea rdx, str.__No_3rd_party_Anti_Virus_was_detected
lea rcx, [rsp + 0x70]
call fcn.140002420
nop
lea rcx, [0x140055ca0]
call fcn.14000bb90
lea rdx, str.__
call fcn.140002140
lea rcx, [0x140055d00]
call fcn.14000bb90
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000fec0
lea rcx, [0x140056530]
call fcn.14000d840
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005d69
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e9f
call fcn.1400169d4
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140005da4
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ea5
call fcn.1400169d4
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140005def
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005eab
call fcn.1400169d4
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140005e36
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e63
call fcn.1400169d4
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140016970
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001d988
nop
call fcn.140001250
nop
call fcn.14001d988
nop
call fcn.14001d988
nop
call fcn.14001d988
int3
call fcn.14000d3a0
nop
call fcn.14001d988
int3
call fcn.1400012f0
int3
call fcn.14001d988
nop
call fcn.14001d988
nop
call fcn.14001d988
nop
call fcn.14001d988
nop
call fcn.14001d988
int3