Function at 0x1400e65a8
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push rbp
push r13
push r14
lea rbp, [rsp - 0x8550]
mov eax, 0x8650
call fcn.140101610
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x8670], rbx
mov qword [rsp + 0x8678], rsi
mov qword [rsp + 0x8680], rdi
mov qword [rsp + 0x8688], r12
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x8540], rax
lea rax, [rbp + 0x1440]
mov qword [rsp + 0x20], rax
lea r9, [0x1400e6c40]
mov r8, qword [0x14019b6f0]
lea rdx, str.VIRSCAN
mov rcx, qword [0x1401d5590]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r12d, r12d
test rax, rax
je 0x1400e6c0e
lea rcx, [rsp + 0x50]
call fcn.140041150
nop
lea esi, [r12 + 1]
mov r13d, 0x800
cmp byte [0x14019b720], r12b
je 0x1400e667e
mov r8d, r13d
lea rdx, [rbp + 0x340]
lea rcx, [0x1401c40e0]
call fcn.1400065fc
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x50]
call fcn.140041770
jmp 0x1400e66d9
lea rcx, [rbp - 0x40]
call fcn.140096f24
nop
mov r8b, sil
lea rdx, [rbp - 0x40]
lea rcx, [0x1401c6f50]
call fcn.140044938
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, 0xa
lea r8, [rsp + 0x50]
lea edx, [r9 - 7]
lea rcx, [rbp - 0x40]
call fcn.1400acf6c
nop
test al, al
jne 0x1400e66d0
lea rcx, [rbp - 0x40]
call fcn.140004f48
jmp 0x1400e6c04
lea rcx, [rbp - 0x40]
call fcn.140004f48
cmp qword [rsp + 0x58], r12
jne 0x1400e6714
mov ecx, 0x35f
call fcn.140090e20
mov rbx, rax
mov ecx, 0x35e
call fcn.140090e20
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x14019b6f0]
call fcn.1400d19e0
jmp 0x1400e6c04
xor r9d, r9d
mov r8, r13
lea rdx, [rbp + 0x4540]
lea rcx, str.Rar_VR
call fcn.1400d04f0
test al, al
je 0x1400e6c04
mov rdx, r13
lea rcx, [rbp + 0x5540]
call fcn.1400d15b8
mov r14b, r12b
mov rdi, r12
cmp qword [rsp + 0x58], r12
jbe 0x1400e68e8
cmp byte [0x14019b722], r12b
jne 0x1400e68e8
lea rcx, [rbp + 0x4540]
call fcn.1400d1f40
mov r8, rdi
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x50]
call fcn.140041340
mov rcx, rax
call fcn.1400810ec
mov rdx, rax
mov r8, r13
lea rcx, [rbp + 0x3540]
call fcn.140096ef0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3540]
call fcn.14007084c
test eax, eax
je 0x1400e67ff
mov dl, sil
lea rcx, [rbp + 0x3540]
call fcn.140080df0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3540]
call fcn.14007084c
test eax, eax
je 0x1400e67ff
mov ecx, 0x1f7
call fcn.140090e20
mov rcx, rax
lea rdx, [rbp + 0x3540]
call fcn.1400d63e4
lea rcx, [0x1401d5778]
call fcn.140069ec0
jmp 0x1400e68da
lea rcx, [rbp + 0x3540]
call fcn.1400d1f40
mov cl, sil
call fcn.1400cb40c
mov r8, rdi
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x50]
call fcn.140041340
mov rcx, rax
mov r8, r13
lea rdx, [0x1401b6732]
call fcn.14007f780
cmp byte [0x14019b720], r12b
jne 0x1400e685b
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401b6732]
lea rcx, [0x1401c40e0]
call fcn.140007460
cmp byte [0x1401c4560], r12b
jne 0x1400e686d
cmp byte [0x1401c44ab], r12b
je 0x1400e6870
mov r14b, sil
mov eax, dword [0x1401c40e4]
mov dword [0x1401b16c8], eax
lea rcx, [0x1401b7978]
call fcn.14009711c
lea rcx, [0x1401b7738]
call fcn.14009711c
lea rdx, [0x140142bd8]
lea rcx, [0x1401b7738]
call fcn.140096f60
call fcn.1400d6bb4
mov ebx, eax
mov r8b, sil
xor edx, edx
lea rcx, [0x1401c40e0]
call fcn.1400060f4
call fcn.1400d6bb4
movzx ecx, byte [0x14019b723]
cmp ebx, eax
cmovne ecx, esi
mov byte [0x14019b723], cl
test cl, cl
jne 0x1400e68e8
add rdi, rsi
cmp rdi, qword [rsp + 0x58]
jb 0x1400e6755
mov sil, r12b
cmp byte [0x14019b723], r12b
jne 0x1400e6b73
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401b6732]
lea ecx, [r9 + 0xb]
call fcn.1400d3978
mov sil, al
lea rdx, [rbp + 0x1440]
lea rcx, [0x140157720]
call fcn.1400d2034
mov ecx, 0x543
call fcn.140090e20
mov rcx, rax
call fcn.1400d2034
lea rcx, [rbp + 0x4540]
call fcn.1400d1f40
lea r8, [rbp + 0x4540]
mov edx, 0x880
lea rcx, [rbp + 0x2440]
call fcn.1400e0198
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x80]
xor edx, edx
lea rcx, [rbp + 0x1440]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x1400e6ad8
mov ecx, 0x4550
cmp ax, cx
je 0x1400e69a6
mov ecx, 0x5a4d
cmp ax, cx
jne 0x1400e6ad8
mov r8, r13
lea rdx, [rbp + 0x4540]
lea rcx, [rbp + 0x3540]
call fcn.140096ef0
mov rdx, r13
lea rcx, [rbp + 0x3540]
call fcn.14007f710
lea rax, [rbp + 0x3540]
or rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1400e69d9
call fcn.140126d74
mov r9d, eax
mov rdx, r13
sub rdx, rbx
lea rcx, [rbp + 0x3540]
lea rcx, [rcx + rbx*2]
lea r8, str.Rar_Scan_d.bat
call fcn.140002910
lea rdx, [0x140143210]
lea rcx, [rbp + 0x3540]
call fcn.14007137c
mov rbx, rax
test rax, rax
je 0x1400e6ad8
cmp word [rbp + 0x1440], 0x22
je 0x1400e6a40
mov rdx, r13
lea rcx, [rbp + 0x1440]
call fcn.1400b1850
lea rax, [rbp + 0x2440]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1440]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edx, 0x1000
lea rcx, [rbp + 0x6540]
call fcn.140002910
mov r8d, 0x1000
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x6540]
call fcn.140099cbc
mov byte [rbp + 0x133f], r12b
lea rax, [rbp + 0x340]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1400e6a92
mov r8, rdi
mov r9, rbx
mov edx, 1
lea rcx, [rbp + 0x340]
call fcn.140128494
mov rcx, rbx
call fcn.1401280c8
mov r8, r13
lea rdx, [rbp + 0x3540]
lea rcx, [rbp + 0x1440]
call fcn.140096ef0
mov word [rbp + 0x2440], r12w
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r12b
lea r9, [rbp + 0x2440]
lea r8, [rbp + 0x4540]
lea rdx, [rbp + 0x1440]
xor ecx, ecx
call fcn.1400edbb8
test al, al
je 0x1400e6b5a
mov ebx, 0xc8
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edi, [rbx + 0x3a]
jmp 0x1400e6b49
cmp byte [0x14019b722], r12b
jne 0x1400e6b4d
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004b530
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x1400e6b23
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400e6b73
mov ecx, 0x201
call fcn.140090e20
mov rcx, rax
lea rdx, [rbp + 0x1440]
call fcn.1400d63e4
lea rcx, [rbp + 0x5540]
call fcn.1400d1f40
test r14b, r14b
je 0x1400e6bed
mov r8, r13
lea rdx, [rbp + 0x4540]
lea rcx, [rbp + 0x3540]
call fcn.140096ef0
lea rcx, [rbp + 0x3540]
call fcn.1400810ec
mov ecx, SHRestricted
mov word [rax + 0xc], cx
lea rcx, [rbp + 0x3540]
call fcn.140070448
test al, al
jne 0x1400e6bed
lea rdx, [rbp + 0x3540]
lea rcx, [rbp + 0x4540]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400e6bed
mov r8, r13
lea rdx, [rbp + 0x3540]
lea rcx, [rbp + 0x4540]
call fcn.140096ef0
lea rcx, [rbp + 0x4540]
call fcn.1400cf89c
test sil, sil
je 0x1400e6c04
call fcn.1400d40fc
nop
lea rcx, [rsp + 0x50]
call fcn.1400412e0
mov rcx, qword [rbp + 0x8540]
xor rcx, rsp
call fcn.140101680
lea r11, [rsp + 0x8650]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret