Function at 0x1400fd430
Capabilities:
Get file system object information
Move file
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x91c8]
mov eax, 0x92b0
call fcn.140117f40
sub rsp, rax
mov rax, qword [0x140181c48]
xor rax, rsp
mov qword [rbp + 0x91a0], rax
lea rax, [rbp + 0x10a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fdac0]
mov r8, qword [0x1401897d0]
lea rdx, str.VIRSCAN
mov rcx, qword [0x1401c9660]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r12d, r12d
test rax, rax
je 0x1400fda87
lea rcx, [rsp + 0x50]
call fcn.140053840
nop
lea esi, [r12 + 1]
mov r13d, 0x800
cmp byte [0x140189804], r12b
je 0x1400fd4e9
mov r8d, r13d
lea rdx, [rbp - 0x60]
lea rcx, [0x1401b9630]
call fcn.1400097e8
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.140053c20
jmp 0x1400fd561
lea rcx, [rbp + 0x31a0]
call fcn.1400aaa18
nop
mov r8b, sil
lea rdx, [rbp + 0x31a0]
lea rcx, [0x1401bc3f0]
call fcn.1400569f0
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, 0xa
lea r8, [rsp + 0x50]
lea edx, [r9 - 7]
lea rcx, [rbp + 0x31a0]
call fcn.1400bfe08
nop
test al, al
jne 0x1400fd550
mov rcx, qword [rbp + 0x31a0]
test rcx, rcx
je 0x1400fda7d
call fcn.140123a48
jmp 0x1400fda7d
mov rcx, qword [rbp + 0x31a0]
test rcx, rcx
je 0x1400fd561
call fcn.140123a48
cmp qword [rsp + 0x58], r12
jne 0x1400fd59c
mov ecx, 0x35f
call fcn.1400a493c
mov rbx, rax
mov ecx, 0x35e
call fcn.1400a493c
mov r9d, 0x30
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x1401897d0]
call fcn.1400e7c84
jmp 0x1400fda7d
xor r9d, r9d
mov r8, r13
lea rdx, [rbp + 0x41a0]
lea rcx, str.Rar_VR
call fcn.1400e68f4
test al, al
je 0x1400fda7d
mov rdx, r13
lea rcx, [rbp + 0x61a0]
call fcn.1400e77e0
mov r14b, r12b
mov rdi, r12
cmp qword [rsp + 0x58], r12
jbe 0x1400fd76a
cmp byte [0x140189806], r12b
jne 0x1400fd76a
lea rcx, [rbp + 0x41a0]
call fcn.1400e8148
mov r8, rdi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400538e8
mov rcx, rax
call fcn.140095154
mov rdx, rax
mov r8, r13
lea rcx, [rbp + 0x31a0]
call fcn.1400aa9e4
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x31a0]
call fcn.140084194
test eax, eax
je 0x1400fd684
mov dl, sil
lea rcx, [rbp + 0x31a0]
call fcn.140094e24
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x31a0]
call fcn.140084194
test eax, eax
je 0x1400fd684
mov ecx, 0x1f7
call fcn.1400a493c
mov rcx, rax
lea rdx, [rbp + 0x31a0]
call fcn.1400ec898
lea rcx, [0x1401c97d8]
call fcn.14007cb90
jmp 0x1400fd75c
lea rcx, [rbp + 0x31a0]
call fcn.1400e8148
mov cl, sil
call fcn.1400e169c
mov r8, rdi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400538e8
mov rcx, rax
mov r8, r13
lea rdx, [0x1401a8992]
call fcn.1400935bc
cmp byte [0x140189804], r12b
jne 0x1400fd6dd
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401a8992]
lea rcx, [0x1401b9630]
call fcn.14000a674
cmp byte [0x1401b9ad0], r12b
jne 0x1400fd6ef
cmp byte [0x1401b9a1b], r12b
je 0x1400fd6f2
mov r14b, sil
mov eax, dword [0x1401b9634]
mov dword [0x1401a3928], eax
lea rcx, [0x1401a9bc0]
call fcn.1400aac04
lea rcx, [0x1401a9998]
call fcn.1400aac04
lea rdx, [0x14013f330]
lea rcx, [0x1401a9998]
call fcn.1400aaa48
call fcn.1400ed050
mov ebx, eax
mov r8b, sil
xor edx, edx
lea rcx, [0x1401b9630]
call fcn.140009290
call fcn.1400ed050
movzx ecx, byte [0x140189807]
cmp ebx, eax
cmovne ecx, esi
mov byte [0x140189807], cl
test cl, cl
jne 0x1400fd76a
add rdi, rsi
cmp rdi, qword [rsp + 0x58]
jb 0x1400fd5dd
mov sil, r12b
cmp byte [0x140189807], r12b
jne 0x1400fd9ec
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401a8992]
lea ecx, [r9 + 0xb]
call fcn.1400e9d7c
mov sil, al
lea rdx, [rbp + 0x10a0]
lea rcx, [0x140151120]
call fcn.1400e8488
mov ecx, 0x543
call fcn.1400a493c
mov rcx, rax
call fcn.1400e8488
lea rcx, [rbp + 0x41a0]
call fcn.1400e8148
lea r8, [rbp + 0x41a0]
mov edx, 0x880
lea rcx, [rbp + 0x20a0]
call fcn.1400f6964
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x31a0]
xor edx, edx
lea rcx, [rbp + 0x10a0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x1400fd951
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400fd828
mov ecx, 0x4550
cmp ax, cx
jne 0x1400fd951
mov r8, r13
lea rdx, [rbp + 0x41a0]
lea rcx, [rbp + 0x51a0]
call fcn.1400aa9e4
mov rdx, r13
lea rcx, [rbp + 0x51a0]
call fcn.140093540
lea rax, [rbp + 0x51a0]
or rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1400fd85b
call fcn.1401239e4
mov r9d, eax
mov rdx, r13
sub rdx, rbx
lea rcx, [rbp + 0x51a0]
lea rcx, [rcx + rbx*2]
lea r8, str.Rar_Scan_d.bat
call fcn.140004dcc
lea rdx, [0x14013f5b0]
lea rcx, [rbp + 0x51a0]
call fcn.140084ce0
mov rbx, rax
test rax, rax
je 0x1400fd951
cmp word [rbp + 0x10a0], 0x22
je 0x1400fd8c2
mov rdx, r13
lea rcx, [rbp + 0x10a0]
call fcn.1400c46b8
lea rax, [rbp + 0x20a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10a0]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edx, 0x1000
lea rcx, [rbp + 0x71a0]
call fcn.140004dcc
mov r8d, 0x1000
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x71a0]
call fcn.1400ad7e4
mov byte [rbp + 0xf9f], r12b
lea rax, [rbp - 0x60]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1400fd90e
mov r8, rdi
mov r9, rbx
mov edx, 1
lea rcx, [rbp - 0x60]
call fcn.140124f00
mov rcx, rbx
call fcn.140124918
mov r8, r13
lea rdx, [rbp + 0x51a0]
lea rcx, [rbp + 0x10a0]
call fcn.1400aa9e4
mov word [rbp + 0x20a0], r12w
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r12b
lea r9, [rbp + 0x20a0]
lea r8, [rbp + 0x41a0]
lea rdx, [rbp + 0x10a0]
xor ecx, ecx
call fcn.140104a1c
test al, al
je 0x1400fd9d3
mov ebx, 0xc8
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edi, [rbx + 0x3a]
jmp 0x1400fd9c2
cmp byte [0x140189806], r12b
jne 0x1400fd9c6
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14005cd24
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x1400fd99c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400fd9ec
mov ecx, 0x201
call fcn.1400a493c
mov rcx, rax
lea rdx, [rbp + 0x10a0]
call fcn.1400ec898
lea rcx, [rbp + 0x61a0]
call fcn.1400e8148
test r14b, r14b
je 0x1400fda66
mov r8, r13
lea rdx, [rbp + 0x41a0]
lea rcx, [rbp + 0x51a0]
call fcn.1400aa9e4
lea rcx, [rbp + 0x51a0]
call fcn.140095154
mov ecx, SHRestricted
mov word [rax + 0xc], cx
lea rcx, [rbp + 0x51a0]
call fcn.140083dd0
test al, al
jne 0x1400fda66
lea rdx, [rbp + 0x51a0]
lea rcx, [rbp + 0x41a0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400fda66
mov r8, r13
lea rdx, [rbp + 0x51a0]
lea rcx, [rbp + 0x41a0]
call fcn.1400aa9e4
lea rcx, [rbp + 0x41a0]
call fcn.1400e5c00
test sil, sil
je 0x1400fda7d
call fcn.1400ea5b8
nop
lea rcx, [rsp + 0x50]
call fcn.1400538b0
mov rcx, qword [rbp + 0x91a0]
xor rcx, rsp
call fcn.140117fa0
lea r11, [rsp + 0x92b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret