Function at 0x140189098
Capabilities:
Get file system object information
Move file
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
lea ebx, [r12 + 7]
mov qword [rbp - 0x28], rbx
mov word [rbp - 0x40], r12w
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rbx
mov word [rbp - 0x20], r12w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140189c70]
mov r8, qword [0x140233a48]
lea rdx, str.VIRSCAN
mov rcx, qword [0x14023fc50]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
test rax, rax
je 0x140189bf4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
lea esi, [rbx + 3]
mov edi, 0x1000
lea r14d, [r12 + 1]
lea r13d, [r12 + 8]
cmp byte [0x140233a44], r12b
je 0x140189299
mov qword [rbp + 0x40], r12
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x50], xmm1
mov word [rbp + 0x40], r12w
mov qword [rbp + 0x60], r12
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x70], xmm1
mov word [rbp + 0x60], r12w
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
xor edx, edx
lea r8d, [r12 + 0x60]
lea rcx, [rbp + 0xa8]
call fcn.1401b2770
lea rdx, [rbp + 0x40]
lea rcx, [0x140236030]
call fcn.14000e854
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
cmp rdx, qword [rsp + 0x40]
je 0x1401891f3
lea rdx, [rbp + 0x40]
call fcn.14000a648
jmp 0x1401891fd
lea r8, [rbp + 0x40]
call fcn.14000a6c0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r13
jb 0x140189238
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, rdi
jb 0x140189233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140189c3d
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, r13
jb 0x140189285
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, rdi
jb 0x140189280
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140189c43
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
jmp 0x1401892ee
lea rcx, [rbp + 0x40]
call fcn.1400ff0e0
nop
mov r8b, r14b
lea rdx, [rbp + 0x40]
lea rcx, [0x140236e60]
call fcn.140088b10
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, esi
lea r8, [rsp + 0x30]
mov edx, 3
lea rcx, [rbp + 0x40]
call fcn.14011fd18
nop
lea rcx, [rbp + 0x40]
test al, al
jne 0x1401892e9
call fcn.14000bc68
jmp 0x140189be9
call fcn.14000bc68
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
jne 0x140189429
mov ecx, 0x35f
call fcn.1400f70b0
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r12w
jne 0x14018931c
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400041b8
nop
mov ecx, 0x35e
call fcn.1400f70b0
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x14018934c
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400041b8
nop
mov r9d, 0x30
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, qword [0x140233a48]
call fcn.1401635d0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
jb 0x1401893c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x1401893bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140189c49
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, r13
jb 0x140189411
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, rdi
jb 0x14018940c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140189c4f
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
jmp 0x140189be9
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x68], r12w
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r8d, 6
lea rdx, str.Rar_VR
lea rcx, [rsp + 0x78]
call fcn.1400041b8
nop
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.140161aec
mov bl, al
lea rcx, [rsp + 0x78]
call fcn.140006b94
test bl, bl
je 0x140189bdf
mov qword [rbp], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r12w
lea rcx, [rbp]
call fcn.1400e1888
mov r15b, r12b
mov rsi, r12
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140189690
mov rdi, r12
cmp byte [0x140233a46], r12b
jne 0x14018968b
lea rcx, [rbp - 0x68]
call fcn.1400e3b64
mov rdx, qword [rsp + 0x30]
add rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.1400e393c
nop
lea rcx, [rsp + 0x58]
call fcn.1400cb820
test al, al
jne 0x140189572
mov dl, r14b
lea rcx, [rsp + 0x58]
call fcn.1400e3354
lea rcx, [rsp + 0x58]
call fcn.1400cb820
test al, al
jne 0x140189572
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rbx, qword [rsp + 0x58]
mov ecx, 0x1f7
call fcn.1400f70b0
mov rdx, rbx
mov rcx, rax
call fcn.14016b72c
lea rcx, [0x14023fda0]
call fcn.1400c0818
jmp 0x14018963a
lea rcx, [rsp + 0x58]
call fcn.1400e3b64
mov cl, r14b
call fcn.1401544ac
mov rcx, qword [rsp + 0x30]
add rcx, rdi
lea rdx, [0x140234eb0]
call fcn.1400e01e4
cmp byte [0x140233a44], r12b
jne 0x1401895ba
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140234eb0]
lea rcx, [0x140236030]
call fcn.14000fe00
cmp byte [0x140236478], r12b
jne 0x1401895cc
cmp byte [0x14023641b], r12b
je 0x1401895cf
mov r15b, r14b
mov eax, dword [0x140236034]
mov dword [0x140234e30], eax
lea rcx, [0x140235200]
call fcn.1400ff2e4
lea rcx, [0x140234ff0]
call fcn.1400ff2e4
lea rdx, [0x1401dc2f0]
lea rcx, [0x140234ff0]
call fcn.1400ff124
call fcn.14016c7a0
mov ebx, eax
mov r8b, r14b
xor edx, edx
lea rcx, [0x140236030]
call fcn.14000de90
call fcn.14016c7a0
movzx ecx, byte [0x140233a47]
cmp ebx, eax
cmovne ecx, r14d
mov byte [0x140233a47], cl
test cl, cl
jne 0x140189681
lea rcx, [rsp + 0x58]
call fcn.140006b94
add rsi, r14
add rdi, 0xc8
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x1401894ea
jmp 0x14018968b
lea rcx, [rsp + 0x58]
call fcn.140006b94
mov edi, 0x1000
mov r14b, r12b
cmp byte [0x140233a47], r12b
jne 0x140189b08
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140234eb0]
lea ecx, [r9 + 0xa]
call fcn.140166950
mov r14b, al
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rdx, qword [rbp - 0x40]
lea rcx, [0x1401eed18]
call fcn.140164510
mov ecx, 0x543
call fcn.1400f70b0
mov rcx, rax
call fcn.140164510
lea rcx, [rbp - 0x68]
call fcn.1400e3b64
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x20]
call fcn.14017d464
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rcx, qword [rbp - 0x40]
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x40]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x140189902
mov ecx, 0x5a4d
cmp ax, cx
je 0x140189749
mov ecx, 0x4550
cmp ax, cx
jne 0x140189902
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400042c0
nop
lea rcx, [rsp + 0x78]
call fcn.1400e012c
call fcn.1401b6c64
mov r8d, eax
lea rdx, str.Rar_Scan_d.bat
lea rcx, [rbp + 0x20]
call fcn.1400ff0a0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], r13
jb 0x1401897a2
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140006c24
nop
lea rcx, [rbp + 0x20]
call fcn.140006b94
lea rdx, [0x1401dc934]
lea rcx, [rsp + 0x78]
call fcn.1400cdac4
mov rbx, rax
test rax, rax
je 0x1401898f8
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
mov r10, qword [rbp - 0x28]
cmp r10, r13
cmovae rcx, rdx
cmp word [rcx], 0x22
je 0x140189800
lea rcx, [rbp - 0x40]
call fcn.140129d58
mov r10, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x40]
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], r13
cmovae r9, qword [rbp - 0x20]
lea r8, [rbp - 0x40]
cmp r10, r13
cmovae r8, rdx
lea rdx, str.__s__s_r_n_echo._r_n_pause
lea rcx, [rbp + 0x20]
call fcn.1400ff0a0
nop
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r12
mov esi, 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r12b
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.1401057f4
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rcx, qword [rsp + 0x58]
mov r9, rbx
mov r8, qword [rsp + 0x68]
lea edx, [rsi - 0xe]
call fcn.1401bcb8c
mov rcx, rbx
call fcn.1401bc584
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.140004958
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], r13
cmovae rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], r12
mov word [rax], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1401898df
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x1401898da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140189c55
call fcn.1401af9bc
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r12b
lea rcx, [rbp + 0x20]
call fcn.140006b94
nop
lea rcx, [rsp + 0x78]
call fcn.140006b94
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
xor r8d, r8d
lea rdx, [0x1401dbff0]
lea rcx, [rsp + 0x78]
call fcn.1400041b8
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov rdi, qword [rbp - 0x30]
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rsi, qword [rbp - 0x40]
movabs rbx, 0x7ffffffffffffffe
cmp rdi, rbx
ja 0x140189c5b
mov qword [rsp + 0x70], 7
cmp rdi, r13
jae 0x14018998c
mov qword [rsp + 0x68], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1401b1b70
jmp 0x140189a13
mov rax, rdi
or rax, 7
cmp rax, rbx
jbe 0x1401899a8
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1401899da
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140189c61
add rcx, rcx
cmp rcx, 0x1000
jb 0x1401899e1
call fcn.14000417c
jmp 0x1401899f0
test rcx, rcx
je 0x1401899ed
call fcn.1401af980
jmp 0x1401899f0
mov rax, r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1401b1b70
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.140197e48
mov bl, al
mov rdx, qword [rbp - 0x70]
cmp rdx, r13
jb 0x140189a7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140189a79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140189c37
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
test bl, bl
je 0x140189ae6
mov edx, 0xc8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x102
jmp 0x140189ad5
cmp byte [0x140233a46], r12b
jne 0x140189ad9
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140095e34
mov edx, 0xc8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x140189aac
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140189b08
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], r13
cmovae rbx, qword [rbp - 0x40]
mov ecx, 0x201
call fcn.1400f70b0
mov rdx, rbx
mov rcx, rax
call fcn.14016b72c
lea rcx, [rbp]
call fcn.1400e3b64
test r15b, r15b
je 0x140189bc1
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.1400042c0
nop
lea rcx, [rsp + 0x58]
call fcn.1400e1b9c
add rax, 6
cmp rax, qword [rsp + 0x68]
jae 0x140189bb7
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rcx, qword [rsp + 0x58]
mov edx, SHRestricted
mov word [rcx + rax*2], dx
lea rcx, [rsp + 0x58]
call fcn.1400cbff4
test al, al
jne 0x140189bb7
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], r13
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], r13
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140189bb7
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.140004958
nop
lea rcx, [rsp + 0x58]
call fcn.140006b94
lea rcx, [rbp - 0x68]
call fcn.14016022c
test r14b, r14b
je 0x140189bd5
call fcn.140167730
nop
lea rcx, [rbp]
call fcn.140006b94
nop
lea rcx, [rbp - 0x68]
call fcn.140006b94
nop
lea rcx, [rsp + 0x30]
call fcn.140012e68
nop
lea rcx, [rbp - 0x20]
call fcn.140006b94
nop
lea rcx, [rbp - 0x40]
call fcn.140006b94
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1401afad0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
call fcn.140006bf8
int3
call fcn.140006b74
int3