Function at 0x1401a1cc0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
xor r15d, r15d
mov qword [rsp + 0x48], r15
lea edx, [r15 + 0x13]
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x13]
lea r8, str.Labels_FilesScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
lea edx, [r15 + 0x13]
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x138]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x140]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x138]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x138]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], r15d
jle 0x1401a1da7
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a1db8
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x16
lea r8, str.Labels_ThreatsDetected
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x148]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x150]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x148]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x148]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a1e5d
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a1e6e
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0x15
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x15
lea r8, str.Labels_ThreatsRemoved
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0x15
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x158]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x160]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x158]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x158]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a1f13
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a1f24
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x1a
lea r8, str.Labels_TotalObjectsScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x168]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x170]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x168]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x168]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a1fc9
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a1fda
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x1a
lea r8, str.Labels_RemnantFilesScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x178]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x180]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x178]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x178]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a207f
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a2090
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x19
lea r8, str.Labels_RemnantKeysScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x188]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x190]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x188]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x188]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a2135
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a2146
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, str.Labels_ScanTime
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x198]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x1a0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x198]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x198]
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a21eb
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a21fc
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
mov rax, qword [rsi]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [rax + 0x70]
nop
mov ecx, 0xb0
call fcn.1402bcb4c
test rax, rax
je 0x1401a2226
mov rcx, rax
call fcn.140205fa0
mov rcx, rax
jmp 0x1401a2229
mov rcx, r15
mov qword [rsi + 0xb0], rcx
mov qword [rsp + 0x40], 0x15
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xa0]
mov dword [rsp + 0x40], 0x296
mov dword [rsp + 0x44], 0x18
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xc0]
mov rbx, qword [rsi + 0xb0]
mov rdi, qword [rbx]
mov edx, 0xffffff
lea rcx, [rsp + 0x40]
call fcn.140003760
mov rdx, rax
mov rcx, rbx
call qword [rdi + 0x88]
movss xmm2, dword [0x1403794e8]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.1400037a0
nop
mov rcx, qword [rsi + 0xb0]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 0x78]
nop
cmp dword [rbp + 0x198], 0
jle 0x1401a22d1
mov rcx, qword [rbp + 0x190]
call fcn.1402bd0e0
mov qword [rsp + 0x48], r15
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, str.Captions_Finish
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
nop
mov rdx, rax
mov rcx, qword [rsi + 0xb0]
call fcn.1401ff9c0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a2347
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a2358
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
mov r9d, 0x10
mov r12d, 1
mov r8d, r12d
lea edx, [r9 + 0x70]
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rsi + 0xd8], rax
mov qword [rsp + 0x48], r15
lea edx, [r12 + 0x12]
lea rcx, [rsp + 0x40]
call fcn.1402028a0
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [r12 + 0x12]
lea r8, str.Captions_MustReboot
mov rcx, qword [rsp + 0x40]
call fcn.1402c06dc
lea edx, [r12 + 0x12]
lea rcx, [rsp + 0x40]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f6d90
mov rdi, rax
lea rbx, [rsi + 0xb8]
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbx + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.140203bb0
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a242c
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a243d
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
movd xmm2, dword [rbp - 0x20]
cvtdq2ps xmm2, xmm2
mulss xmm2, dword [0x140379630]
divss xmm2, dword [0x140379564]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.1400037a0
nop
movss xmm2, dword [0x1403794cc]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.1400037a0
nop
movd xmm8, dword [rbp - 0x20]
cvtdq2ps xmm8, xmm8
mulss xmm8, dword [0x140379630]
divss xmm8, dword [0x140379564]
lea rax, [0x14034d1a0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x79], 1
mov qword [rsp + 0x74], r15
mov word [rbp - 0x7c], 0
mov byte [rbp - 0x75], 0
mov byte [rbp - 0x7a], 0
mov dword [rbp - 0x80], 0x190
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mulss xmm8, dword [0x140379634]
divss xmm8, dword [0x140379560]
cvttss2si ecx, xmm8
mov dword [rsp + 0x70], ecx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r8, qword [rbp + 0x40]
mov edx, 0x20
lea rcx, [rbp - 0x74]
call fcn.1402bcbb8
mov dword [rbp - 0x80], 0x2bc
mov edx, dword [rbp + 0x4c]
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x4c]
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x40]
mov rcx, qword [rbp - 0x30]
call fcn.1402c06dc
mov edx, dword [rbp + 0x4c]
lea rcx, [rbp - 0x30]
call fcn.140203bb0
nop
lea rcx, [rbp + 0xc0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xe0], rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xe8], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xf0], rax
mov bl, 1
mov rax, qword [rsi + 0xa8]
mov rcx, qword [rax + 0x2a0]
test rcx, rcx
je 0x1401a259a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete bl
mov rcx, qword [rsi + 0xa8]
call fcn.140111fb0
test al, al
jne 0x1401a26e2
call fcn.140114bf0
test al, al
jne 0x1401a26e2
test bl, bl
je 0x1401a26e2
xor ecx, ecx
call fcn.1400f4570
mov rdi, rax
test rax, rax
je 0x1401a26e2
lea r8, [rsi + 0x118]
lea rdx, str.BannerURL
mov rcx, rax
call fcn.1400d9fd0
test al, al
je 0x1401a26d7
mov rcx, rsi
call fcn.1401a1b60
lea rdx, str.Banner.bin
lea rcx, [rsp + 0x50]
call fcn.1400f41b0
nop
xor bl, bl
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r12d
mov edx, 0x80000000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401a26a4
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a2684
cmp dword [rsp + 0x40], 4
jne 0x1401a2684
cmp byte [rsp + 0x61], 0x50
jne 0x1401a2684
cmp byte [rsp + 0x62], 0x4e
jne 0x1401a2684
movzx ebx, bl
cmp byte [rsp + 0x63], 0x47
cmove ebx, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1401a26a4
mov rcx, qword [rsp + 0x50]
call fcn.14014a130
mov qword [rsi + 0xf8], rax
jmp 0x1401a26bc
lea r8, [rsi + 0x108]
lea rdx, [rsi + 0x100]
lea rcx, [rsp + 0x50]
call fcn.1401a19b0
mov dword [rsi + 0x12c], 0xa
cmp dword [rsp + 0x58], 0
jle 0x1401a26d7
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax]
mov rax, qword [rsi + 0xb0]
mov qword [rsp + 0x40], rax
mov rcx, rsi
call fcn.1401fee70
mov rbx, rax
lea rcx, [rax + 0x10]
mov r8, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [r8]
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x18], rax
cmp qword [rax + 8], 0
je 0x1401a2721
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
call fcn.1401a27e0
nop
cmp dword [rbp - 0x28], 0
jle 0x1401a273a
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0xb8], 0
jle 0x1401a2750
mov rcx, qword [rbp + 0xb0]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x128], 0
jle 0x1401a2766
mov rcx, qword [rbp + 0x120]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x48], 0
jle 0x1401a2775
mov rcx, qword [rbp + 0x40]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm8, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret