Function at 0x1400d4c54
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push rbp
push r13
push r14
lea rbp, [rsp - 0x8540]
mov eax, 0x8640
call fcn.1400ec1b0
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x8660], rbx
mov qword [rsp + 0x8668], rsi
mov qword [rsp + 0x8670], rdi
mov qword [rsp + 0x8678], r12
mov rax, qword [0x14013b1d0]
xor rax, rsp
mov qword [rbp + 0x8530], rax
lea rax, [rbp + 0x1430]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d52d4]
mov r8, qword [0x140142ba0]
lea rdx, str.VIRSCAN
mov rcx, qword [0x1401790a0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r12d, r12d
test rax, rax
je 0x1400d52a2
lea rcx, [rsp + 0x50]
call fcn.14003d430
nop
lea esi, [r12 + 1]
mov r13d, 0x800
cmp byte [0x140142c44], r12b
je 0x1400d4d35
mov r8d, r13d
lea rdx, [rbp + 0x330]
lea rcx, [0x140165250]
call fcn.140004e60
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x50]
call fcn.14003da50
lea rcx, [rsp + 0x50]
call fcn.1400150dc
jmp 0x1400d4d90
lea rcx, [rbp - 0x50]
call fcn.14008c830
nop
mov r8b, sil
lea rdx, [rbp - 0x50]
lea rcx, [0x140168030]
call fcn.14003fccc
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], r12b
mov r9d, 0xa
lea r8, [rsp + 0x50]
lea edx, [r9 - 7]
lea rcx, [rbp - 0x50]
call fcn.1400a21b8
nop
test al, al
jne 0x1400d4d87
lea rcx, [rbp - 0x50]
call fcn.140003ee0
jmp 0x1400d5298
lea rcx, [rbp - 0x50]
call fcn.140003ee0
xor r9d, r9d
mov r8, r13
lea rdx, [rbp + 0x4530]
lea rcx, str.Rar_VR
call fcn.1400c2dc8
test al, al
je 0x1400d5298
mov rdx, r13
lea rcx, [rbp + 0x5530]
call fcn.1400c3acc
mov r14b, r12b
mov rdi, r12
cmp qword [rsp + 0x58], r12
jbe 0x1400d4f6a
cmp byte [0x140142c46], r12b
jne 0x1400d4f6a
lea rcx, [rbp + 0x4530]
call fcn.1400c3f5c
mov r8, rdi
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x50]
call fcn.14003d5f4
mov rcx, rax
call fcn.140078d7c
lea rdx, [rbp + 0x3530]
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400d4e10
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3530]
call fcn.140068e88
test eax, eax
je 0x1400d4e83
mov dl, sil
lea rcx, [rbp + 0x3530]
call fcn.140078abc
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3530]
call fcn.140068e88
test eax, eax
je 0x1400d4e83
mov ecx, 0x1f7
call fcn.1400868b8
mov rcx, rax
lea rdx, [rbp + 0x3530]
call fcn.1400cf438
lea rcx, [0x140179130]
call fcn.140062d54
jmp 0x1400d4f5c
lea rcx, [rbp + 0x3530]
call fcn.1400c3f5c
mov cl, sil
call fcn.1400bdf24
mov r8, rdi
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x50]
call fcn.14003d5f4
mov rcx, rax
mov r8, r13
lea rdx, [0x140159a62]
call fcn.140077434
cmp byte [0x140142c44], r12b
jne 0x1400d4edf
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140159a62]
lea rcx, [0x140165250]
call fcn.140005a94
cmp byte [0x1401656c0], r12b
jne 0x1400d4ef1
cmp byte [0x14016560b], r12b
je 0x1400d4ef4
mov r14b, sil
mov eax, dword [0x140165254]
mov dword [0x140156a00], eax
lea rcx, [0x14015aca8]
call fcn.14008ca28
lea rcx, [0x14015aa68]
call fcn.14008ca28
lea rdx, [0x14010a4a8]
lea rcx, [0x14015aa68]
call fcn.14008c86c
mov ebx, dword [0x1401a3fc4]
mov r8b, sil
xor edx, edx
lea rcx, [0x140165250]
call fcn.1400049dc
movzx eax, byte [0x140142c47]
cmp ebx, dword [0x1401a3fc4]
cmovne eax, esi
mov byte [0x140142c47], al
test al, al
jne 0x1400d4f6a
add rdi, rsi
cmp rdi, qword [rsp + 0x58]
jb 0x1400d4dd1
mov sil, r12b
cmp byte [0x140142c47], r12b
jne 0x1400d51f3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140159a62]
lea ecx, [r9 + 0xb]
call fcn.1400c535c
mov sil, al
lea rdx, [rbp + 0x1430]
lea rcx, [0x140113a30]
call fcn.1400c3ff4
mov ecx, 0x543
call fcn.1400868b8
mov rcx, rax
call fcn.1400c3ff4
lea rcx, [rbp + 0x4530]
call fcn.1400c3f5c
lea rdx, [rbp + 0x4530]
lea rcx, [rbp + 0x2430]
call fcn.1400cf8f4
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x2b8
lea r8, [rbp + 0x70]
xor edx, edx
lea rcx, [rbp + 0x1430]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rax
shr rcx, 0x10
test cx, cx
jne 0x1400d5158
mov ecx, 0x4550
cmp ax, cx
je 0x1400d5020
mov ecx, 0x5a4d
cmp ax, cx
jne 0x1400d5158
mov rcx, r12
movzx eax, word [rbp + rcx + 0x4530]
mov word [rbp + rcx + 0x3530], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400d5023
mov rdx, r13
lea rcx, [rbp + 0x3530]
call fcn.1400773b8
lea rax, [rbp + 0x3530]
or rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1400d5059
call fcn.1400f2fbc
mov r9d, eax
mov rdx, r13
sub rdx, rbx
lea rcx, [rbp + 0x3530]
lea rcx, [rcx + rbx*2]
lea r8, str.Rar_Scan_d.bat
call fcn.1400026d0
lea rdx, [0x14010aa38]
lea rcx, [rbp + 0x3530]
call fcn.1400699dc
mov rbx, rax
test rax, rax
je 0x1400d5158
cmp word [rbp + 0x1430], 0x22
je 0x1400d50c0
mov rdx, r13
lea rcx, [rbp + 0x1430]
call fcn.1400a6508
lea rax, [rbp + 0x2430]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1430]
lea r8, str.__s__s_r_n_echo._r_n_pause
mov edx, 0x1000
lea rcx, [rbp + 0x6530]
call fcn.1400026d0
mov r8d, 0x1000
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x6530]
call fcn.14008f58c
mov byte [rbp + 0x132f], r12b
lea rax, [rbp + 0x330]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1400d5112
mov r8, rdi
mov r9, rbx
mov edx, 1
lea rcx, [rbp + 0x330]
call fcn.1400f390c
mov rcx, rbx
call fcn.1400f3540
mov r8, r13
lea rdx, [rbp + 0x3530]
lea rcx, [rbp + 0x1430]
call fcn.14008c7ec
mov word [rbp + 0x2430], r12w
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r12b
lea r9, [rbp + 0x2430]
lea r8, [rbp + 0x4530]
lea rdx, [rbp + 0x1430]
xor ecx, ecx
call fcn.1400dbc48
test al, al
je 0x1400d51da
mov ebx, 0xc8
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edi, [rbx + 0x3a]
jmp 0x1400d51c9
cmp byte [0x140142c46], r12b
jne 0x1400d51cd
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140045d24
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x1400d51a3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d51f3
mov ecx, 0x201
call fcn.1400868b8
mov rcx, rax
lea rdx, [rbp + 0x1430]
call fcn.1400cf438
lea rcx, [rbp + 0x5530]
call fcn.1400c3f5c
test r14b, r14b
je 0x1400d5279
mov rcx, r12
movzx eax, word [rbp + rcx + 0x4530]
mov word [rbp + rcx + 0x3530], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400d5207
lea rcx, [rbp + 0x3530]
call fcn.140078d7c
mov ecx, SHRestricted
mov word [rax + 0xc], cx
lea rcx, [rbp + 0x3530]
call fcn.140068a84
test al, al
jne 0x1400d5279
lea rdx, [rbp + 0x3530]
lea rcx, [rbp + 0x4530]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400d5279
mov rcx, r12
movzx eax, word [rbp + rcx + 0x3530]
mov word [rbp + rcx + 0x4530], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400d5260
lea rcx, [rbp + 0x4530]
call fcn.1400c21d4
test sil, sil
je 0x1400d5298
mov rcx, qword [0x140142bb8]
call qword [sym.imp.USER32.dll_DestroyWindow]
nop
lea rcx, [rsp + 0x50]
call fcn.14003d580
mov rcx, qword [rbp + 0x8530]
xor rcx, rsp
call fcn.1400ec220
lea r11, [rsp + 0x8640]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret