joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f87b8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
test rcx, rcx
mov bpl, dl
mov rbx, rcx
mov rsi, rcx
sete dil
mov r14d, 1
test rcx, rcx
jne 0x1400f8808
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400f8870
lea ecx, [r14 + 0xe]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x1400f8826
cmp qword [0x14018b7d0], 0
je 0x1400f8826
mov dl, dil
mov rcx, rbx
call fcn.1400f888c
test al, al
je 0x1400f8826
mov dil, r14b
jmp 0x1400f8829
xor dil, dil
test rsi, rsi
jne 0x1400f8836
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1400f883f
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_DragFinish]
test dil, dil
je 0x1400f8870
movzx eax, byte [0x1401a35d2]
test bpl, bpl
mov rcx, qword [0x14018b7d0]
mov edx, 0x800e
cmovne eax, r14d
xor r9d, r9d
xor r8d, r8d
mov byte [0x1401a35d2], al
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400f888c
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1040
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor ebx, ebx
mov bpl, dl
cmp dword [0x14018b800], ebx
mov rsi, rcx
jne 0x1400f898e
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov edi, eax
cmp eax, 1
jne 0x1400f89b9
mov r9d, 0x800
mov word [rsp + 0x30], bx
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x14018b804], bl
je 0x1400f8939
test bpl, bpl
jne 0x1400f8961
cmp rax, qword [0x1401be440]
je 0x1400f8961
cmp rax, qword [0x14019c518]
je 0x1400f8961
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1400f8961
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [0x1401be3f0]
call fcn.1400593d8
cmp eax, 1
je 0x1400f898e
lea rcx, [rsp + 0x30]
call fcn.14009702c
mov rcx, rax
lea rdx, str.rarreg.
mov r8d, 7
call fcn.1400afa78
test eax, eax
jne 0x1400f89b9
lea rcx, [rsp + 0x30]
call fcn.1400fbc8c
xor al, al
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14011a150
lea r11, [rsp + 0x1040]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor ecx, ecx
call fcn.1400e394c
lea rcx, [0x1401ab998]
call fcn.1400acb28
test edi, edi
je 0x1400f89fd
mov r9d, 0x800
lea r8, [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
lea rdx, [rsp + 0x30]
lea rcx, [0x1401ab998]
call fcn.1400ac96c
inc ebx
cmp ebx, edi
jb 0x1400f89d0
mov al, 1
jmp 0x1400f8990
Function at 0x1400fbc8c
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1f38]
mov eax, 0x2030
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0x1f20], rax
mov rdi, rcx
call fcn.140076eac
test al, al
je 0x1400fbd0e
cmp byte [0x1401a35b4], 0
jne 0x1400fbd0e
mov ecx, 0x5f0
call fcn.1400a685c
mov ecx, 0x5f1
mov rbx, rax
call fcn.1400a685c
mov rcx, qword [0x14018b7d0]
mov r9d, 0x24
mov r8, rbx
mov rdx, rax
call fcn.1400e9e04
cmp eax, 6
jne 0x1400fbe5b
mov esi, 0x800
lea rdx, [rbp + 0xf20]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, esi
lea rdx, str.rarreg.key
lea rcx, [rbp + 0xf20]
call fcn.140097134
xor r8d, r8d
lea rdx, [rbp + 0xf20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8b, 1
lea rcx, [rsp + 0x20]
mov edx, esi
mov ebx, eax
call fcn.14009638c
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.1400953f0
mov r8d, esi
lea rdx, str.rarreg.key
lea rcx, [rsp + 0x20]
call fcn.1400ac8e0
test ebx, ebx
je 0x1400fbd8f
lea rcx, [rsp + 0x20]
call fcn.14008579c
jmp 0x1400fbdb4
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf20]
call fcn.1400ac908
mov rcx, qword [0x14018b7d0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x14018b7d0]
mov edx, 1
call qword [sym.imp.USER32.dll_FlashWindow]
mov dl, 1
lea rcx, [rbp + 0xf20]
call fcn.140076cdc
mov cl, al
call fcn.140077014
mov rcx, qword [0x14018b7d0]
xor edx, edx
call qword [sym.imp.USER32.dll_FlashWindow]
lea rcx, [0x1401be3f0]
call fcn.14005c7bc
call fcn.140076eac
test al, al
je 0x1400fbe3d
mov ecx, 0x368
call fcn.1400a685c
mov ecx, 0x367
mov rbx, rax
call fcn.1400a685c
mov rcx, qword [0x14018b7d0]
mov r9d, 0x40
mov r8, rbx
mov rdx, rax
call fcn.1400e9e04
jmp 0x1400fbe5b
lea rcx, [rbp + 0xf20]
call fcn.14008579c
mov ecx, 0x366
call fcn.1400a685c
mov rcx, rax
call fcn.1400eea18
mov rcx, qword [rbp + 0x1f20]
xor rcx, rsp
call fcn.14011a150
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400fe300
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x2f88]
mov eax, 0x3080
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0x2f70], rax
xor edi, edi
cmp byte [0x14018b804], dil
je 0x1400fe521
mov esi, 0x800
lea rdx, [rbp + 0x1f70]
mov r8d, esi
lea rcx, [0x1401bb630]
call fcn.14000985c
lea r8d, [rdi + 1]
lea rdx, [0x140141758]
lea rcx, [0x140141310]
call fcn.1400bd490
test eax, eax
setne bl
test eax, eax
je 0x1400fe3a2
lea r9, [0x140140f10]
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, str.InterfaceMisc
call fcn.1400bd620
cmp word [rsp + 0x70], di
jne 0x1400fe3b6
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140052b40
lea rcx, [rbp + 0x1f70]
call fcn.14009702c
mov rdx, rax
lea r8, [rbp + 0xf70]
mov r9, rsi
lea rcx, [rsp + 0x70]
call fcn.1400968ec
mov ecx, 0x5af
call fcn.1400a685c
mov rcx, qword [0x14018b7d0]
lea r8, [rbp + 0xf70]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rdx, rax
call fcn.14000c788
test al, al
je 0x1400fe521
mov r8, rsi
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xf70]
call fcn.140096224
test bl, bl
je 0x1400fe439
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, str.InterfaceMisc
call fcn.1400be088
or rcx, 0xffffffffffffffff
lea rax, [rbp + 0x1f70]
mov rdx, rcx
inc rdx
cmp word [rax + rdx*2], di
jne 0x1400fe447
inc rdx
mov r8d, 0x7ff
cmp rdx, r8
mov eax, r8d
cmovb rax, rdx
mov edx, 0x1000
add rax, rax
cmp rax, rdx
jae 0x1400fe549
mov word [rbp + rax + 0x1f70], di
lea rax, [rbp + 0xf70]
inc rcx
cmp word [rax + rcx*2], di
jne 0x1400fe483
inc rcx
cmp rcx, r8
cmovb r8, rcx
add r8, r8
cmp r8, rdx
jae 0x1400fe549
xor eax, eax
mov word [rbp + r8 + 0xf70], di
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x40], xmm0
lea rax, [rbp + 0x1f70]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
lea rax, [rbp + 0xf70]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x38], 2
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400fe521
cmp dword [rsp + 0x54], edi
jne 0x1400fe521
mov ecx, 0x5b0
call fcn.1400a685c
mov r8, qword [rsp + 0x48]
mov rcx, rax
mov rdx, qword [rsp + 0x40]
call fcn.1400eea18
lea rcx, [0x1401cb7d8]
call fcn.14007e89c
mov rcx, qword [rbp + 0x2f70]
xor rcx, rsp
call fcn.14011a150
lea r11, [rsp + 0x3080]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140119e44
int3
Function at 0x1400ff1f4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, dword [rdx + 0x10]
mov eax, 0x10000
mov esi, dword [rdx + 0x14]
xor r8d, r8d
mov r10, rcx
mov dword [rbp - 0x21], eax
mov ecx, dword [rdx + 0x18]
mov rbx, rdx
mov qword [rbp - 0x19], rax
mov dword [rbp - 9], eax
mov dword [rbp - 5], eax
mov dword [rbp + 3], eax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
mov dword [rbp + 0x13], eax
mov dword [rbp + 0x17], eax
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], eax
lea eax, [rcx + 1]
mov dword [rdx + 0x18], eax
mov qword [rbp - 0x29], r8
mov dword [rbp - 0x1d], 0x38000
mov qword [rbp - 0x11], r8
mov dword [rbp - 1], 0x7c000
mov dword [rbp + 0x1b], 0xfe000
cmp ecx, 6
jb 0x1400ff280
mov dword [rdx], r8d
jmp 0x1400ff2e7
mov byte [rsp + 0x50], r8b
mov eax, 0xaaaaaaab
mul ecx
mov r9d, 0xa
shr edx, 2
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov eax, 5
sub eax, ecx
cmp ecx, 3
cmovb eax, ecx
lea rcx, [rbp - 0x29]
imul rdx, rax, 0x1c
mov al, byte [rbx + 6]
mov byte [rsp + 0x48], al
add rdx, rcx
mov al, byte [rbx + 5]
mov rcx, r10
mov byte [rsp + 0x40], al
mov al, byte [rbx + 4]
mov byte [rsp + 0x38], al
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 7
call fcn.1400fe850
mov dword [rbx + 0x10], edi
mov dword [rbx + 0x14], esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14011a150
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140102b94
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xf78]
mov eax, 0x1070
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0xf60], rax
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], 0x61800
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, 0xc
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, str.VerInfo
lea rcx, [0x140141310]
call fcn.1400bd4a8
lea esi, [rdi - 0xb]
mov ebx, 0x800
mov r8b, sil
lea rcx, [rsp + 0x60]
mov edx, ebx
call fcn.14009638c
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.1400953f0
mov r8d, ebx
lea rdx, str.version.dat
lea rcx, [rsp + 0x60]
call fcn.1400ac8e0
and dword [rsp + 0x40], 0
lea rdx, [0x140144da8]
lea rcx, [rsp + 0x60]
call fcn.140086b98
mov rbx, rax
test rax, rax
je 0x140102c6f
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, edi
mov edx, esi
call fcn.14012ab2c
mov rcx, rbx
call fcn.140126ac8
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
je 0x140102d20
lea rdx, str.VerInfo
mov r9, rdi
lea rcx, [0x140141310]
cmp dword [rsp + 0x40], eax
je 0x140102cf8
lea r8, [rsp + 0x50]
call fcn.1400be0b8
call fcn.1400bddbc
test al, al
jne 0x140102cdb
lea rdx, [0x1401415c0]
lea rcx, [rsp + 0x60]
call fcn.140086b98
mov rbx, rax
test rax, rax
je 0x140102cdb
mov r9, rax
lea rcx, [rsp + 0x50]
mov r8, rdi
mov rdx, rsi
call fcn.1401270b0
mov rcx, rbx
call fcn.140126ac8
call fcn.1400bddc4
neg al
mov edx, 0x168
sbb ecx, ecx
not ecx
and ecx, edx
mov dword [0x14018b828], ecx
jmp 0x140102db7
movsd xmm0, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
mov eax, dword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
call fcn.1400be0b8
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
jne 0x140102d77
cmp dword [rsp + 0x40], eax
je 0x140102d77
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
call fcn.1400bddbc
test al, al
jne 0x140102d77
lea rdx, [0x1401415c0]
lea rcx, [rsp + 0x60]
call fcn.140086b98
mov rbx, rax
test rax, rax
je 0x140102d77
mov r9, rax
lea rcx, [rsp + 0x30]
mov r8, rdi
mov rdx, rsi
call fcn.1401270b0
mov rcx, rbx
call fcn.140126ac8
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x58]
shl rax, 0x20
shl rcx, 0x20
sub rax, rcx
mov ecx, dword [rsp + 0x34]
sub rax, rcx
mov ecx, dword [rsp + 0x54]
add rax, rcx
movabs rcx, 0xc92a69c000
cqo
idiv rcx
mov edx, 0x168
test eax, eax
cmovs eax, edx
mov dword [0x14018b828], eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.14011a150
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140104098
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov bl, r8b
mov rdi, rdx
mov ecx, dword [0x14022e000]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140205050], eax
jg 0x140104160
mov r8b, 1
mov rdx, rdi
lea rsi, [0x140201000]
mov rcx, rsi
call fcn.1401058e0
mov al, bl
xor al, 1
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x20], al
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call fcn.140106acc
test al, al
jne 0x14010412c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.140104504
cmp ebx, 0x4c7
je 0x14010414e
xor al, al
jmp 0x140104150
test bl, bl
je 0x140104146
mov r8, rsi
mov edx, 0x10000
lea rcx, [0x1401047f0]
call fcn.140127728
jmp 0x14010414e
mov rcx, rsi
call fcn.140104504
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, [0x140205050]
call fcn.14011a758
cmp dword [0x140205050], 0xffffffff
jne 0x1401040d4
lea rcx, [0x140205030]
call fcn.1400a9b08
nop
lea rcx, [0x14013e5e0]
call fcn.14011a5ac
nop
lea rcx, [0x140205050]
call fcn.14011a6f8
jmp 0x1401040d4
Function at 0x14010501c
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f50]
mov eax, 0x3050
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0x2f40], rax
mov r15b, r8b
mov r12, rdx
xor r13d, r13d
mov ebx, 0x800
test r9, r9
jne 0x1401050af
mov dword [rsp + 0x20], ebx
lea r9, [0x140140f10]
lea r8, [rsp + 0x40]
lea rdx, str.ExternalViewer
lea rcx, [0x140141b48]
call fcn.1400bd620
mov r8d, ebx
lea rdx, [rbp + 0x1f40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1401050bf
lea rdx, [rbp + 0x1f40]
jmp 0x1401050b2
mov rdx, r9
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.1400ac908
cmp word [rsp + 0x40], r13w
jne 0x1401050ce
xor al, al
jmp 0x140105289
mov r8, rbx
mov rdx, r12
lea rcx, [rbp + 0xf40]
call fcn.1400ac908
mov rdx, rbx
lea rcx, [rbp + 0xf40]
call fcn.1400c6614
lea rcx, [rsp + 0x40]
call fcn.140085aac
test al, al
jne 0x1401051e5
mov eax, 0x22
cmp word [rsp + 0x40], ax
jne 0x140105124
mov edx, eax
lea rcx, [rsp + 0x42]
call fcn.14011b3d8
test rax, rax
je 0x1401051e5
jmp 0x140105129
lea rax, [rsp + 0x40]
lea rdx, [0x140158bf8]
mov rcx, rax
call fcn.14012b2f0
mov rdi, rax
test rax, rax
je 0x1401051e5
mov rsi, rax
movzx ecx, word [rax]
jmp 0x140105153
add rsi, 2
movzx ecx, word [rsi]
call fcn.1400ac4f0
test al, al
jne 0x14010514c
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x1f40]
call fcn.1400ac908
mov r8, rbx
lea rdx, [0x140144f44]
lea rcx, [rbp + 0x1f40]
call fcn.1400ac8e0
mov r8, rbx
lea rdx, [rbp + 0xf40]
lea rcx, [rbp + 0x1f40]
call fcn.1400ac8e0
movzx r14d, word [rdi]
mov word [rdi], r13w
mov eax, 0x22
cmp word [rsp + 0x40], ax
je 0x1401051cf
lea rcx, [rsp + 0x40]
call fcn.140085aac
test al, al
jne 0x1401051cf
mov word [rdi], r14w
lea rax, [rsi + 2]
test rax, rax
jne 0x140105129
jmp 0x1401051e5
mov r8, rbx
lea rdx, [rbp + 0x1f40]
lea rcx, [rbp + 0xf40]
call fcn.1400ac908
mov ecx, dword [0x14022e000]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140200ff0], ecx
jg 0x1401052b3
mov r8b, 1
mov rdx, r12
lea rbx, [0x1401fcfa0]
mov rcx, rbx
call fcn.1401058e0
mov al, r15b
xor al, 1
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x20], al
lea r9, [rbp + 0xf40]
xor r8d, r8d
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.140106acc
test al, al
jne 0x14010525b
mov rcx, rbx
call fcn.140104504
jmp 0x1401050c7
test r15b, r15b
je 0x14010527f
cmp qword [0x1401fcfa0], r13
je 0x14010527f
mov r8, rbx
mov edx, 0x10000
lea rcx, [0x1401047f0]
call fcn.140127728
jmp 0x140105287
mov rcx, rbx
call fcn.140104504
mov al, 1
mov rcx, qword [rbp + 0x2f40]
xor rcx, rsp
call fcn.14011a150
mov rbx, qword [rsp + 0x3090]
add rsp, 0x3050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140200ff0]
call fcn.14011a758
cmp dword [0x140200ff0], 0xffffffff
jne 0x14010520c
lea rcx, [0x140200fd0]
call fcn.1400a9b08
nop
lea rcx, [0x14013e5f0]
call fcn.14011a5ac
nop
lea rcx, [0x140200ff0]
call fcn.14011a6f8
jmp 0x14010520c
Function at 0x1401052f8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rsi
mov eax, 0x1050
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rbx, rdx
mov rcx, rdx
call fcn.14010607c
test al, al
je 0x140105360
mov ecx, 0x65
call fcn.1400a685c
mov rbx, rax
mov ecx, 0x596
call fcn.1400a685c
mov r9d, 0x30
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x14018b7d0]
call fcn.1400e9e04
jmp 0x140105498
cmp byte [0x14018b804], 0
jne 0x1401053ac
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.140106acc
test al, al
jne 0x140105498
mov ecx, 0x201
call fcn.1400a685c
mov rcx, rax
mov rdx, rbx
call fcn.1400eea18
jmp 0x140105498
mov cl, 1
call fcn.1400e381c
mov r9b, 1
mov esi, 0x800
mov r8d, esi
lea rdx, [0x14019e54e]
lea rcx, str.Rar_EX
call fcn.1400e8a74
test al, al
je 0x140105498
mov r8d, esi
lea rdx, [0x1401aa992]
lea rcx, [0x1401bb630]
call fcn.14000985c
mov eax, dword [0x1401bb634]
mov dword [0x1401a5928], eax
lea rdx, [0x140141330]
lea rcx, [0x1401ab998]
call fcn.1400ac96c
mov dword [0x1401a4914], 2
mov r9d, esi
lea r8, [rsp + 0x40]
mov rdx, rbx
lea rcx, [0x14019e54e]
call fcn.1400968ec
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401bb630]
call fcn.140009304
cmp byte [0x14018b807], 0
jne 0x140105498
mov ecx, dword [0x14022e000]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1402090b0], ecx
jg 0x1401054b9
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [0x140205060]
call fcn.1401058e0
lea r8, [0x140205060]
mov edx, 0x10000
lea rcx, [0x1401047f0]
call fcn.140127728
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14011a150
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1050
pop rsi
ret
lea rcx, [0x1402090b0]
call fcn.14011a758
cmp dword [0x1402090b0], 0xffffffff
jne 0x14010546c
lea rcx, [0x140209090]
call fcn.1400a9b08
nop
lea rcx, [0x14013e600]
call fcn.14011a5ac
nop
lea rcx, [0x1402090b0]
call fcn.14011a6f8
jmp 0x14010546c
Function at 0x1401056e0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x6000]
mov eax, 0x6100
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0x5ff0], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, r8
call fcn.14009702c
mov r10, rax
or rdx, 0xffffffffffffffff
mov r8, rdx
xor esi, esi
inc r8
cmp word [rbx + r8*2], si
jne 0x140105727
inc rdx
cmp word [rax + rdx*2], si
jne 0x140105731
lea rax, [rdx + 1]
add rax, r8
mov r14d, 0x1000
cmp rax, r14
jb 0x140105753
xor al, al
jmp 0x140105873
mov r9, r14
lea r8, [rbp + 0x3ff0]
mov rdx, r10
mov rcx, rbx
call fcn.1400968ec
lea rcx, [rsp + 0x30]
call fcn.1400ac93c
nop
mov dword [rsp + 0x20], r14d
lea r9, [0x140140f10]
lea r8, [rbp + 0x1ff0]
lea rdx, str.ViewerIgnoreModifications
lea rcx, [0x140141b48]
call fcn.1400bd620
cmp word [rbp + 0x1ff0], si
je 0x1401057b9
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1ff0]
call fcn.1400c6da0
mov r14d, 0x800
mov r8, r14
lea rdx, [rbp + 0xff0]
lea rcx, [rsp + 0x30]
call fcn.1400aca40
test al, al
je 0x14010585f
mov r8d, r14d
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xff0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1401057bf
lea rdx, [0x140158a34]
lea rcx, [rbp - 0xe]
call fcn.14011d378
test rax, rax
je 0x14010583a
mov word [rax], si
add rax, 4
lea rbx, [0x140141330]
cmp word [rax], si
cmovne rbx, rax
mov r8d, 5
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.14008a1f8
test al, al
je 0x1401057bf
jmp 0x14010583e
lea rbx, [rbp - 0x10]
mov r8d, 5
lea rdx, [rbp + 0x3ff0]
mov rcx, rbx
call fcn.14008a1f8
test al, al
je 0x1401057bf
mov bl, 1
jmp 0x140105862
mov bl, sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140105871
call fcn.140125bf8
mov al, bl
mov rcx, qword [rbp + 0x5ff0]
xor rcx, rsp
call fcn.14011a150
add rsp, 0x6100
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140107280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14018b830]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1401072cf
mov ecx, 0x2bc
call fcn.1400a685c
mov ecx, 0x2bd
mov rbx, rax
call fcn.1400a685c
mov rcx, qword [0x14018b7d0]
mov r9d, 0x40
mov r8, rbx
mov rdx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400e9e04
xor r8d, r8d
lea rdx, [0x14018b830]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140105abc
Function at 0x14010a960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd r13, dword [rdx + 0x1c]
lea r11, [0x140000000]
mov r14, qword [rdx]
xor r9d, r9d
mov rbx, qword [rdx + 8]
or esi, 0xffffffff
mov dword [0x14020c08c], r9d
mov r12d, 0x23d
mov dword [0x14020c9a4], r12d
mov r15, rdx
mov rbp, rcx
mov edi, r9d
lea r10d, [rsi + 2]
mov edx, r9d
test r13d, r13d
jle 0x14010aa07
mov ecx, r9d
cmp word [r14 + rcx*4], r9w
je 0x14010a9ed
add edi, r10d
mov esi, edx
movsxd rax, edi
mov dword [0x14020c08c], edi
mov dword [r11 + rax*4 + 0x20c0b0], edx
cmp rcx, r12
jae 0x14010ac01
mov byte [rcx + r11 + 0x20c9b0], r9b
jmp 0x14010a9f3
mov word [r14 + rcx*4 + 2], r9w
add edx, r10d
add rcx, r10
cmp rcx, r13
jl 0x14010a9bd
cmp edi, 2
jge 0x14010aab5
mov r9d, dword [0x14020cf68]
mov r8d, dword [0x14020cfe8]
movsxd r11, esi
cmp esi, 2
lea rdx, [r11 + 1]
lea ecx, [rsi + 1]
mov rax, rdx
cmovge rax, r11
lea r15, [0x140000000]
mov r10d, ecx
mov r11, rax
cmovge r10d, esi
mov eax, 0
inc edi
cmp esi, 2
mov dword [0x14020c08c], edi
cmovge ecx, eax
movsxd rax, edi
mov dword [r15 + rax*4 + 0x20c0b0], ecx
mov eax, 0
mov r15, qword [rsp + 0x68]
cmovge rdx, rax
lea ecx, [rax + 1]
mov word [r14 + rdx*4], cx
cmp rdx, r12
jae 0x14010ac01
dec r9d
lea rcx, [0x140000000]
mov byte [rdx + rcx + 0x20c9b0], al
mov dword [0x14020cf68], r9d
test rbx, rbx
je 0x14010aaa3
movzx eax, word [rbx + rdx*4 + 2]
sub r8d, eax
mov dword [0x14020cfe8], r8d
mov esi, r10d
cmp edi, 2
jl 0x14010aa18
mov r10d, 1
mov eax, edi
mov dword [r15 + 0x24], esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
cmp eax, r10d
jl 0x14010aae3
mov r8d, ebx
mov rdx, r14
mov rcx, rbp
call fcn.14010bdec
mov r10d, 1
sub ebx, r10d
cmp ebx, r10d
jge 0x14010aac7
lea r15, [0x140000000]
movsxd rbx, dword [0x14020c0b4]
mov r8d, r10d
movsxd rax, edi
mov rdx, r14
sub edi, r10d
mov dword [0x14020c08c], edi
mov ecx, dword [r15 + rax*4 + 0x20c0b0]
mov dword [0x14020c0b4], ecx
mov rcx, rbp
call fcn.14010bdec
movsxd rcx, dword [0x14020c0b4]
lea eax, [r12 - 1]
movsxd rdx, eax
mov r9, rcx
dec eax
mov qword [rsp + 0x78], rdx
mov r12d, eax
mov r10d, 1
movzx eax, word [r14 + rcx*4]
mov r8d, r10d
add ax, word [r14 + rbx*4]
mov dword [r15 + rdx*4 + 0x20c0b0], ebx
mov dword [r15 + rdx*4 + 0x20c0ac], ecx
movzx ecx, byte [rbx + r15 + 0x20c9b0]
movsxd rdx, r13d
mov word [r14 + rdx*4], ax
movzx eax, byte [r9 + r15 + 0x20c9b0]
cmp cl, al
mov word [r14 + r9*4 + 2], r13w
mov word [r14 + rbx*4 + 2], r13w
cmovbe ecx, eax
mov eax, r13d
add cl, r10b
mov dword [0x14020c0b4], eax
mov byte [rdx + r15 + 0x20c9b0], cl
add r13d, r10d
mov rdx, r14
mov rcx, rbp
call fcn.14010bdec
mov r10d, 1
cmp edi, 2
jge 0x14010aaea
mov rcx, qword [rsp + 0x78]
mov eax, r12d
mov rdx, qword [rsp + 0x68]
dec eax
mov dword [0x14020c9a4], eax
mov eax, dword [0x14020c0b4]
mov dword [r15 + rcx*4 + 0x20c0a8], eax
mov rcx, rbp
call fcn.14010ba88
mov r8d, esi
mov rdx, r14
mov rcx, rbp
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14010bcc8
call fcn.140119e44
int3