Function at 0x1400ef864
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3100
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x30f0], rax
mov rbx, rcx
mov r14d, 1
mov cl, r14b
call fcn.14009d638
mov ecx, 0x8005
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x140180f10]
call fcn.1400695b4
xor edi, edi
mov byte [0x1401724ad], dil
mov dword [0x1401734d4], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401734d8], eax
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401734e0], rax
lea rcx, str.WMUser_DisplayError
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x1401734dc], eax
lea rcx, [0x14012b2a0]
call fcn.1400ac07c
test al, al
sete r13b
mov r8b, r14b
mov esi, 0x800
mov edx, esi
lea rcx, [rsp + 0x10f0]
call fcn.140086a38
mov edx, esi
lea rcx, [rsp + 0x10f0]
call fcn.140085ac8
mov r8d, esi
lea rdx, [rsp + 0x10f0]
lea rcx, [0x1401724c0]
call fcn.14009ccc8
mov r8d, esi
lea rdx, str.rar.log
lea rcx, [0x1401724c0]
call fcn.14009cca0
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1401af2e0]
call fcn.140096c30
lea rdx, str.winrar.lng
lea rcx, [0x1401af390]
call fcn.140095804
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
lea rax, [0x1400ed290]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rbx
lea edx, [rdi + 0x65]
mov rcx, qword [0x1401af2d0]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x90], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsp + 0x98], rax
movdqa xmm0, xmmword [0x1401421f0]
movdqa xmmword [rsp + 0xa0], xmm0
lea r15, str.WinRarWindow
mov qword [rsp + 0xb0], r15
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x1400f021a
lea rax, [0x1400bca70]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [reloc.OLEAUT32.dll_SysStringLen]
movdqa xmmword [rsp + 0xa0], xmm0
lea rax, str.RarTreeWindow
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x1400f021a
lea rax, [0x1400af080]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x1401421f0]
movdqa xmmword [rsp + 0xa0], xmm0
lea rax, str.RarReminder
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x1400f021a
lea rax, [0x1400f39c0]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [reloc.OLEAUT32.dll_SysStringLen]
movdqa xmmword [rsp + 0xa0], xmm0
lea r12d, [r14 + 0xf]
mov dword [rsp + 0x84], r12d
lea rax, str.RarViewWindow
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x1400f021a
lea rax, [0x1400e0eb0]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [reloc.OLEAUT32.dll_SysStringLen]
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x84], edi
lea rax, str.RarCmtWindow
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x1400f021a
lea rcx, [rsp + 0xc0]
call fcn.1400dfdec
nop
mov qword [0x1401af2d8], rbx
lea rcx, [0x14019de40]
call fcn.14000735c
call fcn.1400d0b80
call fcn.1400cb1f8
call fcn.1400ef4a4
lea r8, str.WinRAR_Busy
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1401724b0], rax
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_FindWindowW]
mov r15, rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov eax, 0x80000000
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, 0x6cf0000
lea r8, [0x14012f3e0]
lea rdx, str.WinRarWindow
mov ecx, r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x140172470], rax
test rax, rax
je 0x1400f01d2
mov rdx, rax
lea rcx, [0x1401af390]
call fcn.140096504
xor ecx, ecx
call fcn.1400ed1d0
call fcn.1400ef1e0
call fcn.1400491dc
test r13b, r13b
je 0x1400efc0e
call fcn.1400ae65c
test al, al
jne 0x1400efc0e
mov dl, r14b
xor ecx, ecx
call fcn.14000cd30
test al, al
mov r12b, r14b
je 0x1400efc11
mov r12b, dil
lea rcx, [rsp + 0xd0]
call fcn.14000c130
movzx ecx, word [rsp + 0xd0]
call fcn.14009fd48
mov ebx, eax
xor edx, edx
mov r8d, 0x460
lea rcx, [0x140173520]
call fcn.140108940
xor r9d, r9d
xor r8d, r8d
mov dl, r14b
lea rcx, [0x140180f10]
call fcn.140069ad8
call fcn.140013190
test bx, bx
je 0x1400efccd
mov al, byte [0x140182f2c]
test al, al
jne 0x1400efccd
movzx edx, bx
lea rcx, str.AFUMD
call fcn.140106f38
test rax, rax
jne 0x1400efcb5
cmp bx, 0x43
jne 0x1400efc8e
cmp word [rsp + 0xd2], di
je 0x1400efcb5
mov al, byte [0x140182f2c]
test al, al
jne 0x1400efccd
movzx edx, bx
lea rcx, [0x140142110]
call fcn.140106f38
test rax, rax
je 0x1400efccd
xor ecx, ecx
call fcn.1400df554
jmp 0x1400efcd4
call fcn.1400d46d4
sub bx, 0x43
cmp bx, r14w
ja 0x1400efcd4
mov word [0x140181f28], di
jmp 0x1400efcd4
xor ecx, ecx
call fcn.1400d0bbc
xor r9d, r9d
xor r8d, r8d
mov dl, r14b
lea rcx, [0x140180f10]
call fcn.140069ad8
lea rdx, [0x140180f10]
lea rcx, [0x140190860]
call fcn.140009e78
mov r8, rsi
lea rsi, [0x14018f49a]
mov rdx, rsi
lea rcx, [0x140171470]
call fcn.14009ccc8
mov word [0x14018f49a], di
mov ebx, 0x800
mov edx, ebx
lea rcx, [rsp + 0x20f0]
call fcn.1400d6b60
lea rdx, [rsp + 0x20f0]
lea rcx, [0x1401a0cb0]
call fcn.140050d5c
mov dword [0x1401724a4], edi
call fcn.14000bd6c
nop
mov rcx, qword [0x140172470]
call fcn.1400ef6f0
cmp word [0x140187046], di
je 0x1400efd93
lea rcx, [0x140187046]
call fcn.1400876ec
lea rdx, [0x140187046]
mov r8, rbx
lea rcx, [0x1401724c0]
cmp rax, rdx
jne 0x1400efd8e
call fcn.1400877f4
jmp 0x1400efd93
call fcn.14009ccc8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [0x140172470]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140172470]
test rcx, rcx
je 0x1400effff
cmp word [0x14018e47a], di
jne 0x1400f0185
cmp byte [0x1401880f0], dil
je 0x1400efddc
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
movzx ebx, dil
cmp word [0x14018f49a], di
je 0x1400effd9
mov rcx, rsi
call fcn.1400767a8
cmp eax, 0xffffffff
je 0x1400efe00
test al, 0x10
cmovne ebx, r14d
cmp word [0x14018f49a], di
je 0x1400effaf
test bl, bl
jne 0x1400effb3
xor r8d, r8d
lea rdx, str.ReuseWindow
lea rcx, [0x14012b2a0]
call fcn.1400add30
test eax, eax
je 0x1400eff8b
test r15, r15
je 0x1400eff8b
xor r8d, r8d
mov ebx, 0x800
mov edx, ebx
lea rcx, [rsp + 0xf0]
call fcn.1400d5878
mov edx, ebx
lea rcx, [rsp + 0xf0]
call fcn.140085ac8
mov r8d, ebx
lea rdx, str.Rar_
lea rcx, [rsp + 0xf0]
call fcn.14009cca0
lea rax, [rsp + 0xf0]
or rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], di
jne 0x1400efe88
lea rdx, [rsp + 0xf0]
lea rcx, [0x14018f49a]
call fcn.14009fe38
test eax, eax
je 0x1400eff50
lea rax, str.RarArchiveWideName
mov qword [rsp + 0x28], rax
mov ebx, 0x1000
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000004
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x1400eff4a
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov r9d, 0x800
mov r8, rax
lea rdx, [0x14018f49a]
lea rcx, [0x1401a0cb0]
call fcn.14004ca74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, 0x8001
mov r9d, 0x7ae964f1
mov r8d, 0xd489ac5e
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
jne 0x1400effa0
mov r14d, 1
lea rdx, [0x14018f49a]
lea rcx, [0x1401a0cb0]
call fcn.14004d308
test al, al
je 0x1400effa0
cmp byte [0x1401724a0], dil
jne 0x1400f0003
cmp qword [0x140172490], rdi
je 0x1400eff91
lea rcx, [0x1401a0cb0]
call fcn.140050570
jmp 0x1400f0003
or rsi, 0xffffffffffffffff
jmp 0x1400eff50
mov rcx, qword [0x140172470]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x1400f0003
call fcn.1400dc4d0
mov edi, 1
jmp 0x1400f01d2
test bl, bl
je 0x1400effd9
mov r8d, 0x800
mov rdx, rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov r8b, r14b
mov rdx, rsi
lea rcx, [0x1401a0cb0]
call fcn.14004a1d4
jmp 0x1400effe5
lea rcx, [0x1401a0cb0]
call fcn.14005078c
xor edx, edx
lea rcx, [0x1401a0cb0]
call fcn.14004f9d4
lea rcx, [0x1401a0858]
call fcn.14000205c
or rsi, 0xffffffffffffffff
mov r8, r15
mov edx, 0x10000
lea rcx, [0x1400e0c50]
call fcn.140112998
mov rcx, qword [0x140172470]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1400f0033
test r15, r15
setne cl
call fcn.1400ef2bc
mov rcx, qword [0x140172470]
call qword [sym.imp.USER32.dll_UpdateWindow]
test r12b, r12b
je 0x1400f0074
test r13b, r13b
je 0x1400f0074
lea rcx, [0x14012b238]
call fcn.1400ac07c
test al, al
jne 0x1400f0074
lea rcx, str..rar
call fcn.1400469d8
test al, al
jne 0x1400f0074
mov ecx, 6
call fcn.14000fc28
xor r8d, r8d
lea rdx, str.ExportedSettings
lea rcx, [0x14012ae60]
call fcn.1400add30
test eax, eax
je 0x1400f0093
call fcn.14000cc50
xor edx, edx
mov cl, r14b
call fcn.1400af7b8
xor r8d, r8d
lea rdx, str.WizardMode
lea rcx, [0x14012b2a0]
call fcn.1400add30
test eax, eax
je 0x1400f00dd
mov rcx, qword [0x140172470]
call fcn.1400f4a04
test al, al
je 0x1400f00dd
cmp qword [0x140172490], rdi
jne 0x1400f00dd
mov rcx, qword [0x140172470]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
xor ecx, ecx
call fcn.1400eec78
test al, al
jne 0x1400f00dd
mov r8b, r14b
xor edx, edx
xor ecx, ecx
call fcn.1400d62dc
lea rcx, [0x140173514]
call fcn.1400f0d38
call fcn.1400e0e90
mov byte [0x1401724ad], r14b
mov rcx, qword [0x1401734e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, edi
mov r15d, reloc.SHELL32.dll_SHRestricted
cmp dword [0x1401734d4], edi
jle 0x1400f013f
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, r14d
cmp ebx, 0xc8
jl 0x1400f0123
mov rcx, qword [0x1401734e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1401724a8], edi
je 0x1400f01e3
mov dword [0x1401724a8], esi
mov ebx, edi
test esi, esi
je 0x1400f0200
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r14d
cmp ebx, 0xa
jge 0x1400f0200
mov esi, dword [0x1401724a8]
jmp 0x1400f0160
lea rcx, [0x140173520]
call fcn.14000c208
call fcn.1400dc4d0
cmp dword [0x1401724a4], r14d
jne 0x1400effff
xor edx, edx
lea rcx, str.WinRarWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
sete dl
mov cl, r14b
call fcn.1400e0a6c
lea rcx, [0x1401af460]
call fcn.14007a620
mov edi, dword [0x1401af488]
lea rcx, [rsp + 0xc0]
call fcn.1400dfe64
mov eax, edi
jmp 0x1400f021c
xor edx, edx
lea rcx, str.WinRarWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
sete dl
mov cl, r14b
call fcn.1400e0a6c
lea rcx, [0x1401af460]
call fcn.14007a620
nop
lea rcx, [rsp + 0xc0]
call fcn.1400dfe64
xor eax, eax
mov rcx, qword [rsp + 0x30f0]
xor rcx, rsp
call fcn.140105c50
lea r11, [rsp + 0x3100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret