Function at 0x1400c87ec
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push r12
push r13
push r14
mov eax, 0x86f0
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x8710], rbx
mov qword [rsp + 0x8718], rbp
mov qword [rsp + 0x8720], rsi
mov qword [rsp + 0x8728], rdi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x86e0], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2f20]
mov r8, qword [0x140158350]
lea rdx, str.VIRSCAN
mov rcx, qword [0x140149f18]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r12d, r12d
cmp rax, r12
je 0x1400c8f40
lea rcx, [rsp + 0x60]
call fcn.14008e61c
nop
mov r14d, 0x800
lea rbp, [0x140164e70]
lea r13d, [r12 + 1]
cmp byte [0x1401561c5], r12b
je 0x1400c88cf
mov r8, r14
lea rdx, [rsp + 0x45f0]
mov rcx, rbp
call fcn.14007858c
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x60]
call fcn.14008e858
lea rcx, [rsp + 0x60]
call fcn.14008e4cc
jmp 0x1400c898e
lea rcx, [rsp + 0x170]
call fcn.140066320
nop
mov r8b, r13b
lea rdx, [rsp + 0x170]
lea rcx, [0x140162be0]
call fcn.140092ce8
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x38], r12b
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], r13b
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [r9 + 3]
lea rcx, [rsp + 0x170]
call fcn.14009fa98
cmp al, r12b
jne 0x1400c897c
mov rcx, qword [rsp + 0x170]
cmp rcx, r12
je 0x1400c893e
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x140]
cmp rcx, r12
je 0x1400c8951
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r12
je 0x1400c8964
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400c8f40
call fcn.1400ea2a8
jmp 0x1400c8f40
mov rcx, qword [rsp + 0x170]
cmp rcx, r12
je 0x1400c898e
call fcn.1400ea2a8
xor r9d, r9d
mov r8, r14
lea rdx, [rsp + 0x35f0]
lea rcx, str.Rar_VR
call fcn.1400b5d70
cmp al, r12b
jne 0x1400c89eb
mov rcx, qword [rsp + 0x140]
cmp rcx, r12
je 0x1400c89c0
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r12
je 0x1400c89d3
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400c8f40
call fcn.1400ea2a8
jmp 0x1400c8f40
mov rdx, r14
lea rcx, [rsp + 0x76e0]
call fcn.1400b6784
mov sil, r12b
mov rbx, r12
cmp qword [rsp + 0x138], r12
jbe 0x1400c8bb1
cmp byte [0x1401572a1], r12b
jne 0x1400c8bb1
lea rcx, [rsp + 0x35f0]
call fcn.1400b6720
mov r8, rbx
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x60]
call fcn.14008e734
mov rcx, rax
call fcn.140050ce8
lea rdx, [rsp + 0x25f0]
movzx ecx, word [rax]
mov word [rdx], cx
add rax, 2
add rdx, 2
cmp cx, r12w
jne 0x1400c8a4e
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x25f0]
call fcn.140042a08
cmp eax, r12d
je 0x1400c8acb
mov dl, r13b
lea rcx, [rsp + 0x25f0]
call fcn.14005071c
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x25f0]
call fcn.140042a08
cmp eax, r12d
je 0x1400c8acb
mov ecx, 0x1f7
call fcn.14005fad8
mov rcx, rax
lea rdx, [rsp + 0x25f0]
call fcn.1400c5814
lea rcx, [0x140149f20]
call fcn.14003c59c
jmp 0x1400c8ba0
lea rcx, [rsp + 0x25f0]
call fcn.1400b6720
mov cl, r13b
call fcn.1400b1510
mov r8, rbx
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x60]
call fcn.14008e734
mov rcx, rax
mov r8, r14
lea rdx, [0x140173f4a]
call fcn.140051560
cmp byte [0x1401561c5], r12b
jne 0x1400c8b25
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140173f4a]
mov rcx, rbp
call fcn.140079b04
cmp byte [0x140165390], r12b
jne 0x1400c8b37
cmp byte [0x1401652db], r12b
je 0x1400c8b3a
mov sil, r13b
mov eax, dword [0x140164e74]
mov dword [0x140170ee8], eax
lea rcx, [0x140175178]
call fcn.140066150
lea rcx, [0x140174f50]
call fcn.140066150
lea rdx, [0x14010be18]
lea rcx, [0x140174f50]
call fcn.140066178
mov edi, dword [0x14018f638]
mov r8b, r13b
xor edx, edx
mov rcx, rbp
call fcn.14007a77c
movzx edx, byte [0x1401561c4]
cmp edi, dword [0x14018f638]
cmovne edx, r13d
mov byte [0x1401561c4], dl
cmp dl, r12b
jne 0x1400c8bb1
add rbx, r13
cmp rbx, qword [rsp + 0x138]
jb 0x1400c8a0f
mov bl, r12b
cmp byte [0x1401561c4], r12b
jne 0x1400c8e5c
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140173f4a]
lea ecx, [r9 + 0xa]
call fcn.1400b9a04
mov bl, al
lea rdx, [rsp + 0x4f0]
lea rcx, [0x14010e5b8]
call fcn.1400b7148
mov ecx, 0x543
call fcn.14005fad8
mov rcx, rax
call fcn.1400b7148
lea rcx, [rsp + 0x35f0]
call fcn.1400b6720
lea rdx, [rsp + 0x35f0]
lea rcx, [rsp + 0x14f0]
call fcn.1400be0c4
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rsp + 0x230]
xor edx, edx
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
cmp cx, r12w
jne 0x1400c8dba
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400c8c70
mov ecx, 0x4550
cmp ax, cx
jne 0x1400c8dba
mov rcx, r12
movzx eax, word [rsp + rcx + 0x35f0]
mov word [rsp + rcx + 0x25f0], ax
add rcx, 2
cmp ax, r12w
jne 0x1400c8c73
mov rdx, r14
lea rcx, [rsp + 0x25f0]
call fcn.1400504dc
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x25f0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
mov rdi, rcx
call fcn.1400ee424
mov r9d, eax
mov rdx, r14
sub rdx, rdi
lea rcx, [rsp + rdi*2 + 0x25f0]
lea r8, str.Rar_Scan_d.bat
call fcn.1400e0c0c
lea rdx, [0x14010ee80]
lea rcx, [rsp + 0x25f0]
call fcn.1400423bc
mov rbp, rax
cmp rax, r12
je 0x1400c8dba
cmp word [rsp + 0x4f0], 0x22
je 0x1400c8d14
mov rdx, r14
lea rcx, [rsp + 0x4f0]
call fcn.1400a3f28
lea rax, [rsp + 0x14f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f0]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edi, 0x1000
mov rdx, rdi
lea rcx, [rsp + 0x56e0]
call fcn.1400e0c0c
mov r8, rdi
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0x56e0]
call fcn.1400688e8
mov byte [rsp + 0x55ef], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x45f0]
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
mov r8, rcx
mov r9, rbp
mov rdx, r13
lea rcx, [rsp + 0x45f0]
call fcn.1400ef054
mov rcx, rbp
call fcn.1400eee40
mov r8, r14
lea rdx, [rsp + 0x25f0]
lea rcx, [rsp + 0x4f0]
call fcn.140065d00
mov word [rsp + 0x14f0], r12w
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r12b
lea r9, [rsp + 0x14f0]
lea r8, [rsp + 0x35f0]
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call fcn.1400cd064
cmp al, r12b
je 0x1400c8e42
mov edi, 0xc8
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ebp, [rdi + 0x3a]
cmp eax, ebp
jne 0x1400c8e35
cmp byte [0x1401572a1], r12b
jne 0x1400c8e35
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140096a78
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebp
je 0x1400c8e0b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c8e5c
mov ecx, 0x201
call fcn.14005fad8
mov rcx, rax
lea rdx, [rsp + 0x4f0]
call fcn.1400c5814
lea rcx, [rsp + 0x76e0]
call fcn.1400b6720
cmp sil, r12b
je 0x1400c8eeb
mov rcx, r12
movzx eax, word [rsp + rcx + 0x35f0]
mov word [rsp + rcx + 0x25f0], ax
add rcx, 2
cmp ax, r12w
jne 0x1400c8e71
lea rcx, [rsp + 0x25f0]
call fcn.140050ce8
mov ecx, SHRestricted
mov word [rax + 0xc], cx
lea rcx, [rsp + 0x25f0]
call fcn.14004258c
cmp al, r12b
jne 0x1400c8eeb
lea rdx, [rsp + 0x25f0]
lea rcx, [rsp + 0x35f0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r12d
je 0x1400c8eeb
mov rcx, r12
movzx eax, word [rsp + rcx + 0x25f0]
mov word [rsp + rcx + 0x35f0], ax
add rcx, 2
cmp ax, r12w
jne 0x1400c8ed1
lea rcx, [rsp + 0x35f0]
call fcn.1400b6388
cmp bl, r12b
je 0x1400c8f0b
mov rcx, qword [0x1401561c8]
call qword [sym.imp.USER32.dll_DestroyWindow]
nop
mov rcx, qword [rsp + 0x140]
cmp rcx, r12
je 0x1400c8f1e
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r12
je 0x1400c8f31
call fcn.1400ea2a8
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400c8f40
call fcn.1400ea2a8
mov rcx, qword [rsp + 0x86e0]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x86f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret