joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5200
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor ebp, ebp
mov sil, r8b
mov rdi, rdx
mov rbx, rcx
cmp word [0x140175308], bp
je 0x1400b524f
mov r8, rdx
lea rdx, [0x140175308]
call fcn.140065d00
jmp 0x1400b52f6
mov dword [rsp + 0x20], edx
mov r8, rcx
lea r9, [0x140109540]
lea rdx, str.TempFolder
lea rcx, [0x14010ea58]
call fcn.14009b8dc
movzx eax, word [rbx]
mov word [rsp + 0x30], bp
cmp ax, bp
je 0x1400b52ad
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x1400b52a5
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
call fcn.140065d00
mov ax, word [rbx]
cmp ax, bp
jne 0x1400b52b7
cmp sil, bpl
je 0x1400b52c5
cmp ax, bp
je 0x1400b52f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b52f6
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x1400b52d9
cmp word [rbx], bp
jne 0x1400b52f6
lea rcx, str._rartemp
mov rdx, rbx
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, bp
jne 0x1400b52e6
mov rdx, rdi
mov rcx, rbx
call fcn.1400504dc
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400e9d80
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b5324
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rdx, str.NoDrives
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
xor r8d, r8d
mov ebx, eax
call fcn.14009b908
not eax
and eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400b5d70
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rbx, rdx
mov rdx, rcx
mov rsi, r8
lea rcx, [rsp + 0x1020]
mov r8d, 0x7ff
mov dil, r9b
call fcn.140065d00
test dil, dil
je 0x1400b5e0a
cmp byte [0x140165390], 0
jne 0x1400b5dcd
cmp byte [0x1401652db], 0
jne 0x1400b5dcd
xor eax, eax
jmp 0x1400b5dd2
mov eax, 1
xor r9d, r9d
test al, al
lea rdi, [rsp + 0x1020]
setne r9b
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
lea r8, [0x140115090]
lea edx, [rax + 2]
not rcx
add r9d, 0x61
lea rcx, [rsp + rcx*2 + 0x101e]
call fcn.1400e0c0c
mov edi, 0x800
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
call fcn.1400b5200
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400504dc
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.140065d80
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140042dbc
test rax, rax
je 0x1400b5e78
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400b5e78
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.140065d00
mov al, 1
jmp 0x1400b5e9d
mov ecx, 0x1f7
call fcn.14005fad8
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400c5814
lea rcx, [0x140149f20]
call fcn.14003c59c
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x2030
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400b6720
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x1400b6738
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x1400b6775
mov ecx, 0x627
call fcn.14005fad8
mov rdx, rdi
mov rcx, rax
call fcn.1400c5814
lea rcx, [0x140149f20]
call fcn.14003c59c
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b6784
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x1400b743c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1430
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1420], rax
mov rbx, rdx
mov edx, ecx
mov rcx, qword [0x1401561c8]
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x20]
mov r8d, 0xa00
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r9, [rsp + 0x20]
mov r11, rbx
sub r9, rbx
movzx ecx, word [r11]
movzx r8d, word [r11 + r9]
sub ecx, r8d
jne 0x1400b74ac
add r11, 2
test r8d, r8d
jne 0x1400b7495
test ecx, ecx
je 0x1400b74bc
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x1420]
xor rcx, rsp
call fcn.1400e9d80
mov rbx, qword [rsp + 0x1450]
add rsp, 0x1430
pop rdi
ret
Function at 0x1400b77d8
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x448
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rcx, qword [0x1401561c8]
test rcx, rcx
je 0x1400b78e0
mov r8d, 0x200
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x14018798c]
cmp eax, 9
je 0x1400b7867
lea rcx, [rsp + 0x30]
lea rdx, [0x140187f80]
mov r9, rdx
sub r9, rcx
movzx r8d, word [rcx]
movzx r10d, word [rcx + r9]
sub r8d, r10d
jne 0x1400b784f
add rcx, 2
test r10d, r10d
jne 0x1400b7838
test r8d, r8d
je 0x1400b7867
mov rcx, qword [0x1401561c8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x14018798c]
test eax, eax
je 0x1400b787a
cmp eax, 1
je 0x1400b787a
cmp eax, 2
je 0x1400b787a
cmp eax, 9
jne 0x1400b78a4
lea rdx, [0x140187e80]
mov ecx, 0x9c
call fcn.1400b743c
lea rcx, [0x140189080]
call fcn.140050ce8
mov rdx, rax
mov ecx, 0x9b
call fcn.1400b743c
mov eax, dword [0x14018a08c]
test al, 1
jne 0x1400b78be
or eax, 1
mov dword [0x14018a08c], eax
and dword [0x14018a088], 0
mov edx, reloc.SHELL32.dll_SHRestricted
lea rcx, [0x14018a088]
call fcn.140096300
test al, al
je 0x1400b78e0
mov rcx, qword [0x1401561c8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x448
ret

Function at 0x1400b7ccc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov dword [rcx], 0x3c8
mov rcx, qword [rcx + 8]
mov ebp, edx
mov esi, 0x200
lea rdx, [rsp + 0x30]
mov r8d, esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.14009662c
or r12, 0xffffffffffffffff
cmp word [0x140187990], 0
je 0x1400b7d97
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x14010d2d8]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x14010d2dc]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x5aa
call fcn.14005fad8
mov rdx, rsi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9, rax
lea rax, [0x140187990]
lea r8, str._s:__s
sub rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400e0c0c
cmp byte [0x14018775c], 0
je 0x1400b7df5
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x14010d2d8]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x14010d2dc]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x2fd
call fcn.14005fad8
sub rsi, rdi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9d, ebp
mov rdx, rsi
mov r8, rax
call fcn.1400e0c0c
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x30]
mov r8d, 0x80
call fcn.140065d00
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ba328
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x14016ec4c]
lea rdi, str.ExtractionProfile
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016ec70]
lea rdx, [0x140112ef8]
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016ec6f]
lea rdx, str.Fresh
mov rcx, rdi
call fcn.14009b8a0
mov r8d, dword [0x14016ec4c]
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016fed0]
lea rdx, str.UnpToSubfolders
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016ecc4]
lea rdx, str.KeepBroken
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14018b358]
lea rdx, str.ShowExplorer
mov rcx, rdi
call fcn.14009b8a0
mov r8d, dword [0x14016fed4]
lea rdx, str.mtime
mov rcx, rdi
call fcn.14009b8a0
mov r8d, dword [0x14016fed8]
lea rdx, str.ctime
mov rcx, rdi
call fcn.14009b8a0
mov r8d, dword [0x14016fedc]
lea rdx, str.atime
mov rcx, rdi
call fcn.14009b8a0
xor ebx, ebx
cmp dword [0x14016ec74], 2
mov r8d, ebx
lea rdx, str.PathsRel
mov rcx, rdi
sete r8b
call fcn.14009b8a0
cmp dword [0x14016ec74], ebx
mov r8d, ebx
lea rdx, str.PathsFull
mov rcx, rdi
sete r8b
call fcn.14009b8a0
cmp dword [0x14016ec74], 1
mov r8d, ebx
lea rdx, str.PathsNone
mov rcx, rdi
sete r8b
call fcn.14009b8a0
cmp dword [0x14016ec74], 4
lea rdx, str.PathsAbsDrive
sete bl
mov rcx, rdi
mov r8d, ebx
call fcn.14009b8a0
movzx r8d, byte [0x14016ec6c]
lea rdx, str.ClearArc
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016ecb8]
lea rdx, str.ProcessOwners
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016ede5]
lea rdx, str.SetCompressedAttr
mov rcx, rdi
call fcn.14009b8a0
mov r8d, dword [0x140172f14]
lea rdx, str.ExtrDelArc
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x140172efb]
lea rdx, [0x140114828]
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x140172efc]
lea rdx, str.WaitForOther
mov rcx, rdi
call fcn.14009b8a0
movzx r8d, byte [0x14016ecbb]
lea rdx, str.AbsoluteLinks
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14009b8a0
Function at 0x1400bafcc
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x1048
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor r12d, r12d
mov rsi, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
mov r13d, 0x800
cmp byte [rsp + 0x10b0], r12b
je 0x1400bb077
mov r8, rcx
lea rdx, str.DefFolder
lea rcx, str.Extraction
mov r9, rbx
mov dword [rsp + 0x20], r13d
call fcn.14009b8dc
mov rcx, rdi
cmp word [rdi], r12w
jne 0x1400bb050
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
add rbx, 2
cmp ax, r12w
jne 0x1400bb03d
jmp 0x1400bb077
lea rdx, [rsp + 0x30]
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x30]
mov r8, rbp
mov rcx, rdi
mov word [rsp + 0x102e], r12w
call fcn.140065d00
cmp word [rdi], r12w
setne bl
cmp word [rdi], r12w
jne 0x1400bb096
lea rcx, [0x140162be0]
mov r8, rbp
mov rdx, rdi
call fcn.14008eb6c
mov rdx, rbp
mov rcx, rdi
call fcn.1400504dc
cmp byte [rsp + 0x10a0], r12b
jne 0x1400bb0b4
cmp bl, r12b
je 0x1400bb1d1
lea rdx, str.AppendName
lea rcx, str.Extraction
mov r8d, 1
call fcn.14009b908
cmp eax, r12d
je 0x1400bb1d1
lea rcx, [rsp + 0x30]
mov r8, r13
mov rdx, rsi
call fcn.140065d00
mov rsi, r12
cmp word [rsp + 0x30], r12w
je 0x1400bb131
mov rax, r12
lea rbx, [rsp + 0x30]
mov r13d, 0x25
cmp word [rbx], r13w
jne 0x1400bb11f
lea rcx, [rsp + rax + 0x32]
mov edx, r13d
call fcn.1400ed378
cmp rax, r12
je 0x1400bb11f
mov eax, 0x5f
mov word [rbx], ax
inc rsi
lea rax, [rsi + rsi]
lea rbx, [rsp + rax + 0x30]
cmp word [rbx], r12w
jne 0x1400bb0ff
lea rcx, [rsp + 0x30]
call fcn.140050ce8
mov r8, rbp
mov rcx, rdi
mov rdx, rax
call fcn.140065d80
mov rcx, rdi
call fcn.140050f04
mov rbx, rax
cmp rax, r12
je 0x1400bb1d1
cmp rax, rdi
jbe 0x1400bb1d1
mov rcx, rdi
mov word [rax], r12w
call fcn.140050f04
mov rsi, rax
cmp rax, r12
je 0x1400bb1c8
cmp rax, rdi
jbe 0x1400bb1c8
cmp byte [rsp + 0x10a8], r12b
je 0x1400bb1a4
cmp word [rbx + 2], r12w
je 0x1400bb1a4
movzx ecx, word [rbx + 4]
call fcn.1400659dc
cmp al, r12b
jne 0x1400bb1a4
movzx ecx, word [rbx - 2]
call fcn.1400659dc
cmp al, r12b
jne 0x1400bb1b8
lea rdx, str..tar
mov rcx, rsi
call fcn.140068d30
cmp eax, r12d
jne 0x1400bb1c8
mov word [rsi], r12w
jmp 0x1400bb1c8
cmp word [rbx], 0x2e
jne 0x1400bb1d1
mov word [rbx], r12w
sub rbx, 2
cmp rbx, rdi
ja 0x1400bb1be
mov rcx, rdi
call fcn.1400b53c4
xor edx, edx
mov rcx, rdi
call fcn.14005071c
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x1048
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bb204
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1058
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, rcx
lea r8, [rsp + 0x30]
lea rcx, [0x140162be0]
mov r9d, 0x800
call fcn.14008eba0
lea rcx, [rsp + 0x30]
mov edx, 0x802
call fcn.1400504dc
lea rdx, [0x140109750]
lea rcx, [rsp + 0x30]
mov r8d, 0x802
call fcn.140065d80
lea rax, [0x140109540]
lea r8, [rsp + 0x30]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x1058
ret

Function at 0x1400bcfa8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
mov byte [rdx], bl
call fcn.140050ce8
lea r12d, [rbx + 3]
lea rdx, [0x140115648]
mov r8, r12
mov rcx, rax
mov rdi, rax
call fcn.140068d60
cmp eax, ebx
je 0x1400bd003
lea rdx, [0x140115640]
mov r8, r12
mov rcx, rdi
call fcn.140068d60
cmp eax, ebx
jne 0x1400bd025
movzx ecx, word [rdi + 6]
call fcn.1400efc80
cmp eax, ebx
je 0x1400bd025
cmp word [rdi + 8], 0x2e
je 0x1400bd0ab
cmp word [rdi + 8], bx
je 0x1400bd0ab
lea rdx, [0x140115638]
mov r8, r12
mov rcx, rdi
call fcn.140068d60
cmp eax, ebx
je 0x1400bd07d
lea rdx, [0x140115630]
mov r8, r12
mov rcx, rdi
call fcn.140068d60
cmp eax, ebx
je 0x1400bd07d
lea rdx, [0x140115628]
mov r8, r12
mov rcx, rdi
call fcn.140068d60
cmp eax, ebx
je 0x1400bd07d
lea rdx, [0x14010c948]
mov r8, r12
mov rcx, rdi
call fcn.140068d60
cmp eax, ebx
jne 0x1400bd08a
cmp word [rdi + 6], 0x2e
je 0x1400bd0ab
cmp word [rdi + 6], bx
je 0x1400bd0ab
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400bd0b2
mov rcx, rbp
call fcn.14004258c
cmp al, bl
je 0x1400bd0b2
mov ebx, 1
jmp 0x1400bd0b2
mov ebx, 1
mov byte [rsi], bl
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1400bd0d0
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x3668
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x3650], rax
cmp dword [0x140131018], 0xffffffff
mov rbp, r9
mov bl, r8b
mov rdi, rdx
mov rsi, rcx
mov r12d, 0x800
jne 0x1400bd18f
lea r8, [rsp + 0xd0]
lea rcx, [0x140109750]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0xd8]
lea rdx, [rsp + 0x2650]
mov r8d, r12d
xor ecx, ecx
mov dword [0x14018f650], r11d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0xd0]
lea rcx, [rsp + 0x2650]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0xd8]
mov dword [0x140131018], r11d
lea rcx, [rsp + 0x650]
mov r8, r12
mov rdx, rdi
call fcn.140065d00
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x650]
mov r8, r12
call fcn.140050838
xor r13d, r13d
lea rax, [rsp + 0x650]
cmp word [rsi], r13w
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x34], 0x40000000
setne dil
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x48], rax
mov r9d, 0x2b8
lea r8, [rsp + 0x390]
lea rcx, [rsp + 0x650]
cmp dil, r13b
je 0x1400bd213
neg bl
mov dword [rsp + 0x20], 0x4011
sbb edx, edx
and edx, 0x10
jmp 0x1400bd21d
mov dword [rsp + 0x20], 0x4001
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x398]
mov r8, r12
lea rcx, [rsp + 0x1650]
mov dword [rsp + 0x54], eax
cmp dil, r13b
je 0x1400bd248
mov rdx, rsi
call fcn.140065d00
jmp 0x1400bd274
lea rdx, [rsp + 0x650]
call fcn.140065d00
lea rcx, [rsp + 0x1650]
call fcn.140050fc8
lea rcx, [rsp + 0x650]
call fcn.140050ce8
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1401561c8]
mov edx, 0x66
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, rax
mov edx, 0x104d
mov rsi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x14018f650]
cmp dil, r13b
cmovne edx, dword [0x140131018]
mov rbx, rax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x1650]
mov dword [rsp + 0x54], edx
lea r9, [rsp + 0x30]
mov r12d, 1
mov edx, 0x104c
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbp
mov dword [rsp + 0x88], 2
call fcn.140065eb4
lea r9, [rsp + 0x80]
movsxd r8, ebx
mov edx, 0x1074
mov rcx, rsi
mov qword [rsp + 0x98], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, r13d
jne 0x1400bd352
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x102b
mov rcx, rsi
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x8c], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x3650]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x3668
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400beae4
Capabilities:
Get file system object information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x340
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x338], rax
mov r9, qword [rcx + 0x38]
mov rbp, rcx
lea r8, str._c:_
lea rcx, [r11 - 0x38]
mov edx, 0xa
add r9, 0x41
call fcn.1400e0c0c
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x320]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x301
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [rbp + 0x10], 1
je 0x1400beb90
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x20]
mov edx, eax
call qword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, 0xe
mov r12d, eax
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x20]
mov edx, eax
call qword [sym.imp.GDI32.dll_SetTextColor]
mov r13d, eax
jmp 0x1400beb9a
mov r12d, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x50]
mov r8d, dword [rbp + 0x2c]
mov rcx, qword [rbp + 0x20]
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rsi, [rbp + 0x28]
lea rax, [0x140109540]
mov edx, dword [rsi]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 2]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.GDI32.dll_ExtTextOutW]
lea ecx, [rdi + 0x31]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rdi + 0x32]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9, qword [rsp + 0x60]
mov r8d, dword [rbp + 0x2c]
mov edx, dword [rsi]
mov rcx, qword [rbp + 0x20]
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_DrawIconEx]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_DestroyIcon]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.1400b6d3c
mov r8d, dword [rbp + 0x2c]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
lea r9, [rsp + 0x70]
repne scasw ax, word [rdi]
mov eax, dword [rsi]
add r8d, 2
not rcx
lea edx, [rbx + rax + 7]
dec rcx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.GDI32.dll_TextOutW]
test byte [rbp + 0x10], 1
je 0x1400bec7f
mov rcx, qword [rbp + 0x20]
mov edx, r12d
call qword [sym.imp.GDI32.dll_SetBkColor]
mov rcx, qword [rbp + 0x20]
mov edx, r13d
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400c0884
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x3290
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x3280], rax
mov bl, cl
mov dword [0x1401561d4], 1
test dl, dl
je 0x1400c0a07
mov r12d, 0x800
lea rcx, [rsp + 0x1280]
xor r8d, r8d
mov rdx, r12
call fcn.1400b5200
lea rcx, [rsp + 0x1280]
mov rdx, r12
call fcn.1400504dc
lea r9, [rsp + 0x1280]
lea r8, str._sRar_
lea rcx, [rsp + 0x2280]
mov rdx, r12
call fcn.1400e0c0c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c09fe
cmp dword [0x1401561d4], 1
jne 0x1400c09fe
mov ecx, dword [rsp + 0x24]
lea rdx, [rsp + 0x1280]
mov r8, r12
sub ecx, dword [rsp + 0x38]
cmp ecx, 8
lea rcx, [rsp + 0x280]
setae bpl
call fcn.140065d00
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x280]
mov r8, r12
call fcn.140065d80
test byte [rsp + 0x30], 0x10
je 0x1400c09db
lea rdx, str.Rar_DI
lea rcx, [rsp + 0x5c]
mov r8d, 6
call fcn.1400ee530
lea rcx, [rsp + 0x280]
test eax, eax
sete sil
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400c09e8
test bpl, bpl
je 0x1400c09c7
test bl, bl
je 0x1400c09cc
test sil, sil
je 0x1400c09e8
lea rcx, [rsp + 0x280]
call fcn.1400b6388
jmp 0x1400c09e8
lea rcx, [rsp + 0x280]
call fcn.1400b5f98
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c093f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test bl, bl
jne 0x1400c0a31
cmp byte [0x1401410c0], bl
je 0x1400c0a31
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov cl, 1
call fcn.1400be7d8
mov byte [0x1401410c0], al
and dword [0x1401561d4], 0
mov rcx, qword [rsp + 0x3280]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x3290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret