Function at 0x14019ffb0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
xor r15d, r15d
mov qword [rsp + 0x48], r15
lea edx, [r15 + 0x13]
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x13]
lea r8, str.Labels_FilesScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
lea edx, [r15 + 0x13]
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x138]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x140]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x138]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x138]
call fcn.140200570
nop
cmp dword [rsp + 0x58], r15d
jle 0x1401a0097
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a00a8
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x16
lea r8, str.Labels_ThreatsDetected
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x148]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x150]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x148]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x148]
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a014d
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a015e
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0x15
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x15
lea r8, str.Labels_ThreatsRemoved
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0x15
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x158]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x160]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x158]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x158]
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a0203
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a0214
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x1a
lea r8, str.Labels_TotalObjectsScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x168]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x170]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x168]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x168]
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a02b9
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a02ca
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x1a
lea r8, str.Labels_RemnantFilesScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0x1a
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x178]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x180]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x178]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x178]
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a036f
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a0380
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0x19
lea r8, str.Labels_RemnantKeysScanned
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x188]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x190]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x188]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x188]
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a0425
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a0436
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, str.Labels_ScanTime
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsi + 0x198]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rsi + 0x1a0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x198]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
lea rcx, [rsi + 0x198]
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a04db
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a04ec
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
mov rax, qword [rsi]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [rax + 0x70]
nop
mov ecx, 0xb0
call fcn.1402b968c
test rax, rax
je 0x1401a0516
mov rcx, rax
call fcn.140202960
mov rcx, rax
jmp 0x1401a0519
mov rcx, r15
mov qword [rsi + 0xb0], rcx
mov qword [rsp + 0x40], 0x15
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xa0]
mov dword [rsp + 0x40], 0x296
mov dword [rsp + 0x44], 0x18
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xc0]
mov rbx, qword [rsi + 0xb0]
mov rdi, qword [rbx]
mov edx, 0xffffff
lea rcx, [rsp + 0x40]
call fcn.140003760
mov rdx, rax
mov rcx, rbx
call qword [rdi + 0x88]
movss xmm2, dword [0x140374918]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.1400037a0
nop
mov rcx, qword [rsi + 0xb0]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 0x78]
nop
cmp dword [rbp + 0x198], 0
jle 0x1401a05c1
mov rcx, qword [rbp + 0x190]
call fcn.1402b9c20
mov qword [rsp + 0x48], r15
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, str.Captions_Finish
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
mov edx, 0xf
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
nop
mov rdx, rax
mov rcx, qword [rsi + 0xb0]
call fcn.1401fc380
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a0637
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a0648
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
mov r9d, 0x10
mov r12d, 1
mov r8d, r12d
lea edx, [r9 + 0x70]
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rsi + 0xd8], rax
mov qword [rsp + 0x48], r15
lea edx, [r12 + 0x12]
lea rcx, [rsp + 0x40]
call fcn.1401ff260
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [r12 + 0x12]
lea r8, str.Captions_MustReboot
mov rcx, qword [rsp + 0x40]
call fcn.1402bd21c
lea edx, [r12 + 0x12]
lea rcx, [rsp + 0x40]
call fcn.140200570
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400f57b0
mov rdi, rax
lea rbx, [rsi + 0xb8]
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbx + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.140200570
nop
cmp dword [rsp + 0x58], 0
jle 0x1401a071c
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x1401a072d
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
movd xmm2, dword [rbp - 0x20]
cvtdq2ps xmm2, xmm2
mulss xmm2, dword [0x140374a60]
divss xmm2, dword [0x140374994]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.1400037a0
nop
movss xmm2, dword [0x1403748fc]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.1400037a0
nop
movd xmm8, dword [rbp - 0x20]
cvtdq2ps xmm8, xmm8
mulss xmm8, dword [0x140374a60]
divss xmm8, dword [0x140374994]
lea rax, [0x140348ca0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x79], 1
mov qword [rsp + 0x74], r15
mov word [rbp - 0x7c], 0
mov byte [rbp - 0x75], 0
mov byte [rbp - 0x7a], 0
mov dword [rbp - 0x80], 0x190
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mulss xmm8, dword [0x140374a64]
divss xmm8, dword [0x140374990]
cvttss2si ecx, xmm8
mov dword [rsp + 0x70], ecx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r8, qword [rbp + 0x40]
mov edx, 0x20
lea rcx, [rbp - 0x74]
call fcn.1402b96f8
mov dword [rbp - 0x80], 0x2bc
mov edx, dword [rbp + 0x4c]
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x4c]
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x40]
mov rcx, qword [rbp - 0x30]
call fcn.1402bd21c
mov edx, dword [rbp + 0x4c]
lea rcx, [rbp - 0x30]
call fcn.140200570
nop
lea rcx, [rbp + 0xc0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xe0], rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xe8], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsi + 0xf0], rax
mov bl, 1
mov rax, qword [rsi + 0xa8]
mov rcx, qword [rax + 0x298]
test rcx, rcx
je 0x1401a088a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete bl
mov rcx, qword [rsi + 0xa8]
call fcn.1401105c0
test al, al
jne 0x1401a09d2
call fcn.140113200
test al, al
jne 0x1401a09d2
test bl, bl
je 0x1401a09d2
xor ecx, ecx
call fcn.1400f2f90
mov rdi, rax
test rax, rax
je 0x1401a09d2
lea r8, [rsi + 0x118]
lea rdx, str.BannerURL
mov rcx, rax
call fcn.1400d8b50
test al, al
je 0x1401a09c7
mov rcx, rsi
call fcn.14019fe50
lea rdx, str.Banner.bin
lea rcx, [rsp + 0x50]
call fcn.1400f2bd0
nop
xor bl, bl
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r12d
mov edx, 0x80000000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401a0994
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a0974
cmp dword [rsp + 0x40], 4
jne 0x1401a0974
cmp byte [rsp + 0x61], 0x50
jne 0x1401a0974
cmp byte [rsp + 0x62], 0x4e
jne 0x1401a0974
movzx ebx, bl
cmp byte [rsp + 0x63], 0x47
cmove ebx, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1401a0994
mov rcx, qword [rsp + 0x50]
call fcn.1401486e0
mov qword [rsi + 0xf8], rax
jmp 0x1401a09ac
lea r8, [rsi + 0x108]
lea rdx, [rsi + 0x100]
lea rcx, [rsp + 0x50]
call fcn.14019fca0
mov dword [rsi + 0x12c], 0xa
cmp dword [rsp + 0x58], 0
jle 0x1401a09c7
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax]
mov rax, qword [rsi + 0xb0]
mov qword [rsp + 0x40], rax
mov rcx, rsi
call fcn.1401fb830
mov rbx, rax
lea rcx, [rax + 0x10]
mov r8, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [r8]
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x18], rax
cmp qword [rax + 8], 0
je 0x1401a0a11
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
call fcn.1401a0ad0
nop
cmp dword [rbp - 0x28], 0
jle 0x1401a0a2a
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
nop
cmp dword [rbp + 0xb8], 0
jle 0x1401a0a40
mov rcx, qword [rbp + 0xb0]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x128], 0
jle 0x1401a0a56
mov rcx, qword [rbp + 0x120]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x48], 0
jle 0x1401a0a65
mov rcx, qword [rbp + 0x40]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm8, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret