Function at 0x1400fecf0
Capabilities:
Get file system object information
Move file
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x91c8]
mov eax, 0x92b0
call fcn.140119910
sub rsp, rax
mov rax, qword [0x140182c48]
xor rax, rsp
mov qword [rbp + 0x91a0], rax
lea rax, [rbp + 0x10a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ff380]
mov r8, qword [0x14018a7d0]
lea rdx, str.VIRSCAN
mov rcx, qword [0x1401ca660]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r12d, r12d
test rax, rax
je 0x1400ff347
lea rcx, [rsp + 0x50]
call fcn.140055040
nop
lea esi, [r12 + 1]
mov r13d, 0x800
cmp byte [0x14018a804], r12b
je 0x1400feda9
mov r8d, r13d
lea rdx, [rbp - 0x60]
lea rcx, [0x1401ba630]
call fcn.140009848
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.140055420
jmp 0x1400fee21
lea rcx, [rbp + 0x31a0]
call fcn.1400ac25c
nop
mov r8b, sil
lea rdx, [rbp + 0x31a0]
lea rcx, [0x1401bd3f0]
call fcn.140058200
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, 0xa
lea r8, [rsp + 0x50]
lea edx, [r9 - 7]
lea rcx, [rbp + 0x31a0]
call fcn.1400c1648
nop
test al, al
jne 0x1400fee10
mov rcx, qword [rbp + 0x31a0]
test rcx, rcx
je 0x1400ff33d
call fcn.140125418
jmp 0x1400ff33d
mov rcx, qword [rbp + 0x31a0]
test rcx, rcx
je 0x1400fee21
call fcn.140125418
cmp qword [rsp + 0x58], r12
jne 0x1400fee5c
mov ecx, 0x35f
call fcn.1400a617c
mov rbx, rax
mov ecx, 0x35e
call fcn.1400a617c
mov r9d, 0x30
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x14018a7d0]
call fcn.1400e9514
jmp 0x1400ff33d
xor r9d, r9d
mov r8, r13
lea rdx, [rbp + 0x41a0]
lea rcx, str.Rar_VR
call fcn.1400e8184
test al, al
je 0x1400ff33d
mov rdx, r13
lea rcx, [rbp + 0x61a0]
call fcn.1400e9070
mov r14b, r12b
mov rdi, r12
cmp qword [rsp + 0x58], r12
jbe 0x1400ff02a
cmp byte [0x14018a806], r12b
jne 0x1400ff02a
lea rcx, [rbp + 0x41a0]
call fcn.1400e99d8
mov r8, rdi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400550e8
mov rcx, rax
call fcn.14009694c
mov rdx, rax
mov r8, r13
lea rcx, [rbp + 0x31a0]
call fcn.1400ac228
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x31a0]
call fcn.140085964
test eax, eax
je 0x1400fef44
mov dl, sil
lea rcx, [rbp + 0x31a0]
call fcn.14009661c
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x31a0]
call fcn.140085964
test eax, eax
je 0x1400fef44
mov ecx, 0x1f7
call fcn.1400a617c
mov rcx, rax
lea rdx, [rbp + 0x31a0]
call fcn.1400ee128
lea rcx, [0x1401ca7d8]
call fcn.14007e310
jmp 0x1400ff01c
lea rcx, [rbp + 0x31a0]
call fcn.1400e99d8
mov cl, sil
call fcn.1400e2f2c
mov r8, rdi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400550e8
mov rcx, rax
mov r8, r13
lea rdx, [0x1401a9992]
call fcn.140094d8c
cmp byte [0x14018a804], r12b
jne 0x1400fef9d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401a9992]
lea rcx, [0x1401ba630]
call fcn.14000a6d4
cmp byte [0x1401baad0], r12b
jne 0x1400fefaf
cmp byte [0x1401baa1b], r12b
je 0x1400fefb2
mov r14b, sil
mov eax, dword [0x1401ba634]
mov dword [0x1401a4928], eax
lea rcx, [0x1401aabc0]
call fcn.1400ac448
lea rcx, [0x1401aa998]
call fcn.1400ac448
lea rdx, [0x140140330]
lea rcx, [0x1401aa998]
call fcn.1400ac28c
call fcn.1400ee8e0
mov ebx, eax
mov r8b, sil
xor edx, edx
lea rcx, [0x1401ba630]
call fcn.1400092f0
call fcn.1400ee8e0
movzx ecx, byte [0x14018a807]
cmp ebx, eax
cmovne ecx, esi
mov byte [0x14018a807], cl
test cl, cl
jne 0x1400ff02a
add rdi, rsi
cmp rdi, qword [rsp + 0x58]
jb 0x1400fee9d
mov sil, r12b
cmp byte [0x14018a807], r12b
jne 0x1400ff2ac
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401a9992]
lea ecx, [r9 + 0xb]
call fcn.1400eb60c
mov sil, al
lea rdx, [rbp + 0x10a0]
lea rcx, [0x140152120]
call fcn.1400e9d18
mov ecx, 0x543
call fcn.1400a617c
mov rcx, rax
call fcn.1400e9d18
lea rcx, [rbp + 0x41a0]
call fcn.1400e99d8
lea r8, [rbp + 0x41a0]
mov edx, 0x880
lea rcx, [rbp + 0x20a0]
call fcn.1400f8224
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x31a0]
xor edx, edx
lea rcx, [rbp + 0x10a0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x1400ff211
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400ff0e8
mov ecx, 0x4550
cmp ax, cx
jne 0x1400ff211
mov r8, r13
lea rdx, [rbp + 0x41a0]
lea rcx, [rbp + 0x51a0]
call fcn.1400ac228
mov rdx, r13
lea rcx, [rbp + 0x51a0]
call fcn.140094d10
lea rax, [rbp + 0x51a0]
or rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1400ff11b
call fcn.1401253b4
mov r9d, eax
mov rdx, r13
sub rdx, rbx
lea rcx, [rbp + 0x51a0]
lea rcx, [rcx + rbx*2]
lea r8, str.Rar_Scan_d.bat
call fcn.140004dcc
lea rdx, [0x1401405c0]
lea rcx, [rbp + 0x51a0]
call fcn.1400864b0
mov rbx, rax
test rax, rax
je 0x1400ff211
cmp word [rbp + 0x10a0], 0x22
je 0x1400ff182
mov rdx, r13
lea rcx, [rbp + 0x10a0]
call fcn.1400c5f34
lea rax, [rbp + 0x20a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10a0]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edx, 0x1000
lea rcx, [rbp + 0x71a0]
call fcn.140004dcc
mov r8d, 0x1000
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x71a0]
call fcn.1400af024
mov byte [rbp + 0xf9f], r12b
lea rax, [rbp - 0x60]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1400ff1ce
mov r8, rdi
mov r9, rbx
mov edx, 1
lea rcx, [rbp - 0x60]
call fcn.1401268d0
mov rcx, rbx
call fcn.1401262e8
mov r8, r13
lea rdx, [rbp + 0x51a0]
lea rcx, [rbp + 0x10a0]
call fcn.1400ac228
mov word [rbp + 0x20a0], r12w
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r12b
lea r9, [rbp + 0x20a0]
lea r8, [rbp + 0x41a0]
lea rdx, [rbp + 0x10a0]
xor ecx, ecx
call fcn.1401062ec
test al, al
je 0x1400ff293
mov ebx, 0xc8
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edi, [rbx + 0x3a]
jmp 0x1400ff282
cmp byte [0x14018a806], r12b
jne 0x1400ff286
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14005e564
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x1400ff25c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ff2ac
mov ecx, 0x201
call fcn.1400a617c
mov rcx, rax
lea rdx, [rbp + 0x10a0]
call fcn.1400ee128
lea rcx, [rbp + 0x61a0]
call fcn.1400e99d8
test r14b, r14b
je 0x1400ff326
mov r8, r13
lea rdx, [rbp + 0x41a0]
lea rcx, [rbp + 0x51a0]
call fcn.1400ac228
lea rcx, [rbp + 0x51a0]
call fcn.14009694c
mov ecx, SHRestricted
mov word [rax + 0xc], cx
lea rcx, [rbp + 0x51a0]
call fcn.1400855a0
test al, al
jne 0x1400ff326
lea rdx, [rbp + 0x51a0]
lea rcx, [rbp + 0x41a0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400ff326
mov r8, r13
lea rdx, [rbp + 0x51a0]
lea rcx, [rbp + 0x41a0]
call fcn.1400ac228
lea rcx, [rbp + 0x41a0]
call fcn.1400e7490
test sil, sil
je 0x1400ff33d
call fcn.1400ebe48
nop
lea rcx, [rsp + 0x50]
call fcn.1400550b0
mov rcx, qword [rbp + 0x91a0]
xor rcx, rsp
call fcn.140119970
lea r11, [rsp + 0x92b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret