Function at 0x140098e64
Capabilities:
Get file system object information
Parse pe header
Write file on windows

Disassembly:
push r12
mov eax, 0x5f00
call fcn.1400ba8b0
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x5f10], rbx
mov qword [rsp + 0x5f18], rbp
mov qword [rsp + 0x5f20], rsi
mov qword [rsp + 0x5f28], rdi
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x5ef0], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [0x1400950d4]
mov r8, qword [0x1400ffd80]
lea rdx, str.VIRSCAN
mov rcx, qword [0x1400ec660]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor ebp, ebp
cmp rax, rbp
je 0x140099550
lea rcx, [rsp + 0x50]
call fcn.14003f1d0
nop
lea rsi, [0x140105fb0]
lea r12d, [rbp + 1]
cmp byte [0x1400fec05], bpl
je 0x140098f3e
mov r8d, 0x400
lea rdx, [rsp + 0x16f0]
mov rcx, rsi
call fcn.1400129d4
lea rdx, [rsp + 0x16f0]
lea rcx, [rsp + 0x50]
call fcn.14003ef38
lea rcx, [rsp + 0x50]
call fcn.14003f05c
jmp 0x14009902e
lea rcx, [rsp + 0x1e0]
call fcn.14006ba08
nop
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
lea rcx, [0x140105570]
call fcn.140040774
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r12d
mov byte [rsp + 0x28], bpl
mov byte [rsp + 0x20], r12b
xor r9d, r9d
lea r8, [rsp + 0x50]
lea edx, [r9 + 3]
lea rcx, [rsp + 0x1e0]
call fcn.140063edc
cmp al, bpl
jne 0x140099009
mov rcx, qword [rsp + 0x200]
cmp rcx, rbp
je 0x140098fa8
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x1e0]
cmp rcx, rbp
je 0x140098fbb
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x1c0]
cmp rcx, rbp
je 0x140098fce
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rbp
je 0x140098fe1
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x140098ff1
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x140099550
call fcn.1400a86a4
jmp 0x140099550
mov rcx, qword [rsp + 0x200]
cmp rcx, rbp
je 0x14009901c
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x1e0]
cmp rcx, rbp
je 0x14009902e
call fcn.1400a86a4
lea rdx, [rsp + 0x1ef0]
lea rcx, str.Rar_VRXXXXXX
call fcn.140086c74
cmp al, bpl
jne 0x140099095
mov rcx, qword [rsp + 0x1c0]
cmp rcx, rbp
je 0x14009905a
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rbp
je 0x14009906d
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x14009907d
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x140099550
call fcn.1400a86a4
jmp 0x140099550
mov edx, 0x400
lea rcx, [rsp + 0x36f0]
call fcn.140087408
mov rbx, rbp
cmp qword [rsp + 0x1b8], rbp
jbe 0x140099242
cmp byte [0x1400ffcf0], bpl
jne 0x140099242
lea rcx, [rsp + 0x1ef0]
call fcn.1400873f0
mov r8, rbx
lea rdx, [rsp + 0x26f0]
lea rcx, [rsp + 0x50]
call fcn.14003efb8
mov rcx, rax
call fcn.140052abc
lea rdx, [rsp + 0x16f0]
movzx ecx, word [rax]
mov word [rdx], cx
add rax, 2
add rdx, 2
cmp cx, bp
jne 0x1400990f7
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x16f0]
xor ecx, ecx
call fcn.1400319d4
cmp eax, ebp
je 0x140099177
mov dl, r12b
lea rcx, [rsp + 0x16f0]
call fcn.14005258c
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x16f0]
xor ecx, ecx
call fcn.1400319d4
cmp eax, ebp
je 0x140099177
mov ecx, 0x1f7
call fcn.140061d2c
mov rcx, rax
lea rdx, [rsp + 0x16f0]
call fcn.140095e68
lea rcx, [0x1400ec668]
call fcn.1400286c0
jmp 0x140099231
lea rcx, [rsp + 0x16f0]
call fcn.1400873f0
call fcn.140082880
mov r8, rbx
lea rdx, [rsp + 0x26f0]
lea rcx, [rsp + 0x50]
call fcn.14003efb8
mov rcx, rax
lea rdx, [0x14010e6bc]
call fcn.140052780
cmp byte [0x1400fec05], bpl
jne 0x1400991cb
xor r9d, r9d
mov r8b, r12b
lea rdx, [0x14010e6bc]
mov rcx, rsi
call fcn.140015af0
mov eax, dword [0x1401063c4]
mov dword [0x14010c654], eax
mov rcx, qword [0x14010eed8]
call fcn.14006b784
mov rcx, qword [0x14010eec0]
call fcn.14006b784
lea rdx, [0x1400c3120]
mov rcx, qword [0x14010eec0]
call fcn.14006ba48
mov edi, dword [0x1401290f0]
mov r8b, r12b
xor edx, edx
mov rcx, rsi
call fcn.14001731c
movzx edx, byte [0x1400fec04]
cmp edi, dword [0x1401290f0]
cmovne edx, r12d
mov byte [0x1400fec04], dl
cmp dl, bpl
jne 0x140099242
add rbx, r12
cmp rbx, qword [rsp + 0x1b8]
jb 0x1400990b8
mov bl, bpl
cmp byte [0x1400fec04], bpl
jne 0x1400994de
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14010e6bc]
lea ecx, [r9 + 9]
call fcn.14008a020
mov bl, al
lea rcx, [rsp + 0x330]
call fcn.140087804
mov ecx, 0x543
call fcn.140061d2c
mov rcx, rax
call fcn.140087804
lea rcx, [rsp + 0x1ef0]
call fcn.1400873f0
lea rdx, [rsp + 0x1ef0]
lea rcx, [rsp + 0xb30]
call fcn.14008eadc
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rsp + 0x1430]
xor edx, edx
lea rcx, [rsp + 0x330]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
cmp cx, bp
jne 0x14009943e
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400992f9
mov ecx, 0x4550
cmp ax, cx
jne 0x14009943e
mov rcx, rbp
movzx eax, word [rsp + rcx + 0x1ef0]
mov word [rsp + rcx + 0x16f0], ax
add rcx, 2
cmp ax, bp
jne 0x1400992fc
lea rcx, [rsp + 0x16f0]
call fcn.14005254c
call fcn.1400a95fc
mov r9d, eax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x16f0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
lea rcx, [rsp + rcx*2 + 0x16f0]
lea r8, str.__rar_scan_d.bat
mov edx, 0x400
call fcn.14005b860
xor r8d, r8d
lea rdx, [0x1400c40f8]
lea rcx, [rsp + 0x16f0]
call fcn.1400319b0
mov rsi, rax
cmp rax, rbp
je 0x14009943e
cmp word [rsp + 0x330], 0x22
je 0x140099395
lea rcx, [rsp + 0x330]
call fcn.14004757c
lea rax, [rsp + 0xb30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x330]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edi, 0x1000
mov rdx, rdi
lea rcx, [rsp + 0x3ef0]
call fcn.14005b860
mov r8, rdi
lea rdx, [rsp + 0x26f0]
lea rcx, [rsp + 0x3ef0]
call fcn.140073a88
mov byte [rsp + 0x36ef], bpl
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x26f0]
repne scasb al, byte [rdi]
not rcx
sub rcx, r12
mov r8, rcx
mov r9, rsi
mov rdx, r12
lea rcx, [rsp + 0x26f0]
call fcn.1400aa698
mov rcx, rsi
call fcn.1400aa410
mov rdx, rbp
movzx eax, word [rsp + rdx + 0x16f0]
mov word [rsp + rdx + 0x330], ax
add rdx, 2
cmp ax, bp
jne 0x14009941d
mov word [rsp + 0xb30], bp
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bpl
lea r9, [rsp + 0xb30]
lea r8, [rsp + 0x1ef0]
lea rdx, [rsp + 0x330]
xor ecx, ecx
call fcn.14009fb5c
cmp al, bpl
jne 0x140099490
mov ecx, 0x201
call fcn.140061d2c
mov rcx, rax
lea rdx, [rsp + 0x330]
call fcn.140095e68
mov edi, 0xc8
mov edx, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [rdi + 0x3a]
cmp eax, esi
jne 0x1400994d3
cmp byte [0x1400ffcf0], bpl
jne 0x1400994d3
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400474ec
mov edx, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x1400994a9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x36f0]
call fcn.1400873f0
lea rcx, [rsp + 0x1ef0]
call fcn.14008710c
cmp bl, bpl
je 0x14009950b
mov rcx, qword [0x1400fec08]
call qword [sym.imp.USER32.dll_DestroyWindow]
nop
mov rcx, qword [rsp + 0x1c0]
cmp rcx, rbp
je 0x14009951e
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rbp
je 0x140099531
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x140099541
call fcn.1400a86a4
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x140099550
call fcn.1400a86a4
mov rcx, qword [rsp + 0x5ef0]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x5f00]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret