joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400036cc
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r13, r13
je 0x1400035fb
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, rbx
call fcn.140002ca4
test al, al
jne 0x140003668
mov rdx, qword [rdi]
mov rcx, r13
mov r8, rsi
mov r9, r12
call fcn.1400031fe
jmp 0x1400036a6
test rsi, rsi
je 0x14000366c
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003699
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400036c8
call fcn.1401b5c70
cmp eax, 1
jmp 0x14000369e
xor esi, esi
jmp 0x1400036a9
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401adee0
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1400036cc
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401adee0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400036a1
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.1401b0b80
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x14000375d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140002aee
mov rcx, rdi
call fcn.140002ce4
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401adee0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000382d
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400038a3
mov rdi, rax
lea rdx, str.CreateWebViewEnvironmentWithOptionsInternal
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000393d
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov ecx, r14d
mov edx, ebp
mov r8, rsi
call qword [case.0x1400f0cf3.0]
mov esi, eax
jmp 0x1400039c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401f2770]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400029f0
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rdi
call fcn.140003784
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
mov r14, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call r14
mov rcx, rdi
call fcn.140002ce4
mov rcx, rax
call r14
lea rcx, str._path
call r14
mov rcx, rbx
call r14
lea rcx, [0x1401f3416]
call r14
mov rcx, rdi
call fcn.140002a02
jmp 0x1400039e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401f2770]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400029f0
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rbx
call fcn.140003784
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
mov r14, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call r14
mov rcx, rbx
call fcn.140002ce4
mov rcx, rax
call r14
lea rcx, [0x1401f3416]
call r14
mov rcx, rbx
call fcn.140002a02
lea rdx, str.DllCanUnloadNow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400039e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401adee0
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140003a4c
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140003aa0
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.140002a5e
test al, al
je 0x140003aa0
mov rcx, rsi
call fcn.140002ce4
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140002bac
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140005470
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movsxd rdi, r8d
mov rcx, qword [rcx]
mov rsi, rdx
test rcx, rcx
je 0x140005496
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rsp + 0x58], 0
lea rdx, str.ComboBoxEx32
or qword [rbx + 8], 0xffffffffffffffff
mov r9d, 0x44200046
mov rax, qword [0x14023bc48]
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 0xdc
mov dword [rsp + 0x30], 0x3c
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
mov edx, 0x408
mov rcx, rax
mov qword [rbx], rax
lea r8d, [r9 + 4]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x407
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140005522
mov rcx, rax
call fcn.14016293c
mov rcx, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp fcn.14000553c
Function at 0x14000588c
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov r12, rcx
mov rdi, qword [rbp + 0x2a8]
mov ecx, 0x30
call fcn.1401add90
mov rbx, rax
mov qword [rsp + 0x68], rax
xor r13d, r13d
test rax, rax
je 0x140005900
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], 7
mov word [rax + 0x10], r13w
jmp 0x140005903
mov rbx, r13
mov dword [rbx], r14d
mov qword [rbx + 8], r15
lea rcx, [rbx + 0x10]
mov rdx, rsi
call fcn.140004948
mov ecx, dword [rbp + 0x2a0]
cmp byte [rbp + 0x2c0], r13b
jne 0x140005961
cmp ecx, 0xffffffff
jne 0x140005961
mov eax, 0x4003
lea ecx, [rax - 2]
cmp r14d, 2
cmovne eax, ecx
cmp qword [rsi + 0x18], 8
jb 0x140005943
mov rsi, qword [rsi]
mov dword [rsp + 0x20], eax
mov r9d, 0x2b8
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x30], 0x37
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x5c], r13d
cmp qword [rdi + 0x10], r13
jne 0x140005987
or qword [rsp + 0x40], 0xffffffffffffffff
jmp 0x140005996
cmp qword [rdi + 0x18], 8
jb 0x140005991
mov rdi, qword [rdi]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x60], rbx
mov rax, qword [rbp + 0x2b8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x50], ecx
mov eax, dword [rbp + 0x2b0]
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [r12]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.1401adee0
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005b98
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, qword [rsp + 0x340]
mov r11, r9
mov eax, r8d
mov r10, rdx
cmp r8d, 0x4e
jne 0x140005ca2
cmp dword [rbx + 0x10], 0xfffffcd9
je 0x140005c02
cmp dword [rbx + 0x10], 0xfffffcda
jne 0x140005bfb
cmp dword [rbx + 0x228], 2
jne 0x140005bfb
lea rcx, [0x1402349f8]
call fcn.140005cd8
xor eax, eax
jmp 0x140005cb3
mov rdi, qword [rbx + 0x48]
mov esi, dword [rbx + 0x18]
mov ebp, dword [rdi]
cmp ebp, 4
jne 0x140005c16
mov rdi, qword [rdi + 8]
jmp 0x140005c24
add rdi, 0x10
cmp qword [rdi + 0x18], 8
jb 0x140005c24
mov rdi, qword [rdi]
test sil, 1
je 0x140005c60
mov eax, 0x200
lea r8, [rsp + 0x30]
cmp ebp, 4
mov r9d, 0x2b8
lea ecx, [rax + 8]
cmove eax, ecx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140005c60
lea rax, [rsp + 0x40]
mov qword [rbx + 0x28], rax
test sil, 6
je 0x140005c98
mov eax, 0x4001
lea r8, [rsp + 0x30]
cmp ebp, 4
mov r9d, 0x2b8
lea ecx, [rax + 8]
cmove eax, ecx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x38], eax
mov dword [rbx + 0x34], eax
bts dword [rbx + 0x18], 0x1c
jmp 0x140005bfb
mov r9, rbx
mov r8, r11
mov edx, eax
mov rcx, r10
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401adee0
mov rbx, qword [rsp + 0x320]
add rsp, 0x300
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012bc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x140012da0
lea rax, [rdx - 1]
or rax, 1
bsr rcx, rax
inc ecx
mov ebx, 1
shl rbx, cl
mov rbp, qword [rdi + 8]
lea r12, [rdi + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.140012944
lea rax, [rbx - 1]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rbx
mov qword [rsp + 0x68], rdi
mov rbx, qword [rdi + 8]
mov rbx, qword [rbx]
mov rsi, rbx
cmp rbx, rbp
je 0x140012d85
mov rsi, qword [rsi]
xor edx, edx
mov r13, qword [rbx + 0x10]
mov r15, qword [rbx + 0x18]
mov r8, r13
cmp r13, r15
je 0x140012c83
rol rdx, 0xc
movzx eax, byte [r8]
imul rcx, rax, 0x2773
xor rdx, rcx
inc r8
cmp r8, r15
jne 0x140012c69
mov r14, qword [rdi + 0x30]
and r14, rdx
add r14, r14
mov r12, qword [r12]
cmp qword [r12 + r14*8], rbp
jne 0x140012ca5
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x140012d75
mov rdi, qword [r12 + r14*8 + 8]
sub r15, r13
mov rdx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
sub rax, rdx
cmp r15, rax
jne 0x140012cfc
mov r8, r15
mov rcx, r13
call fcn.1401b0a80
test eax, eax
jne 0x140012cfc
mov rax, qword [rdi]
cmp rax, rbx
je 0x140012cf5
mov r8, qword [rbx + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rbx + 8], rcx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x140012d70
cmp qword [r12 + r14*8], rdi
je 0x140012d4b
mov rdi, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
sub rax, rdx
cmp r15, rax
jne 0x140012cfc
mov r8, r15
mov rcx, r13
call fcn.1401b0a80
test eax, eax
jne 0x140012cfc
mov rax, qword [rdi]
mov r8, qword [rbx + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rbx + 8], rcx
jmp 0x140012d70
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov qword [rdi + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rdi, qword [rsp + 0x60]
mov rbx, rsi
cmp rsi, rbp
lea r12, [rdi + 0x18]
jne 0x140012c54
and qword [rsp + 0x68], 0
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1401aca94
int3
Function at 0x14001a778
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001a7af
mov rax, qword [rcx]
lea rsi, [rcx + 0x10]
xor r14d, r14d
mov qword [rsi], r14
mov word [rax], r14w
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp - 0x28], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x14001a7d3
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400041a8
nop
mov qword [rbp - 0x50], r14
mov edi, r14d
mov r15d, 7
mov r12d, 0x1000
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov word [rbp - 0x48], r14w
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.1400fcec8
test al, al
je 0x14001a8bf
test edi, edi
jne 0x14001a886
mov edi, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14001a874
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
cmp rdx, r12
mov rax, rcx
jb 0x14001a86f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a993
call fcn.1401addcc
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov word [rbp - 0x48], r14w
jmp 0x14001a7fd
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rax, qword [rbp - 0x48]
movzx edx, word [rax]
lea rcx, [0x140232a60]
call fcn.1400b7810
test al, al
jne 0x14001a838
cmp edi, 1
jne 0x14001a8b8
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.140004948
inc edi
jmp 0x14001a838
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14001a8fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, r12
jb 0x14001a8f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a993
call fcn.1401addcc
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov word [rbp - 0x48], r14w
cmp edi, 2
jne 0x14001a91e
cmp qword [rbx + 0x18], 8
jb 0x14001a917
mov rbx, qword [rbx]
mov qword [rsi], r14
mov word [rbx], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14001a956
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, r12
jb 0x14001a951
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a98d
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r14w
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401adee0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
int3
Function at 0x140027a8c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor esi, esi
mov dword [rbp - 0x50], esi
mov qword [rbp - 0x28], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x18], xmm1
mov word [rbp - 0x28], si
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdx, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rsi
inc rdx
lea rcx, [rbp - 0x48]
call fcn.14000a438
nop
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x48]
sub r8, rdx
sar r8, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rdx, qword [rbp - 0x48]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x140027b24
mov rcx, rdi
call fcn.1400041a8
mov dword [rbp - 0x50], 1
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140027b86
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027b75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027bb6
call fcn.1401addcc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rsi
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], si
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401adee0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.1401b4fa4
int3
Function at 0x140029af8
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov bpl, cl
cmp dword [0x140231ad0], 0
jne 0x140029cad
lea r8, str.WinRAR_DragDrop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140029b63
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5b9
call fcn.1400f5fe0
mov rcx, rax
call fcn.1401687cc
jmp 0x140029cad
mov ebx, 0x10
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [0x140230e12], al
mov ecx, ebx
call fcn.1401add90
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140029ba2
lea rax, [0x1401dbab0]
mov qword [rbx], rax
mov dword [rbx + 8], 1
jmp 0x140029ba4
xor ebx, ebx
mov ecx, 0xad8
call fcn.1401add90
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140029bce
xor r9d, r9d
mov r8, rsi
mov dl, bpl
mov rcx, rax
call fcn.1400283bc
mov rsi, rax
jmp 0x140029bd0
xor esi, esi
mov qword [0x140230e18], rsi
mov byte [0x140230e11], 0
mov byte [0x140230e10], 1
mov byte [0x140230e13], 0
lea r9, [rsp + 0x50]
mov r8d, 3
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ole32.dll_DoDragDrop]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov byte [0x140230e10], 0
mov rdx, qword [rsi]
mov rcx, rsi
mov rax, qword [rdx + 0x10]
call qword [case.0x1400f0cf3.0]
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 0x10]
call qword [case.0x1400f0cf3.0]
cmp byte [0x140230e12], 0
je 0x140029c60
cmp byte [0x140231ad4], 0
je 0x140029c60
cmp ebp, 0x40100
jne 0x140029c60
call fcn.140178ea0
lea rcx, [0x140234e50]
call fcn.140090918
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbp - 0x40100]
cmp eax, 1
jbe 0x140029cad
cmp byte [0x140230e13], 0
jne 0x140029cad
cmp r14d, 0x3f0
je 0x140029cad
mov ecx, 0x53c
call fcn.1400f5fe0
mov rcx, rax
call fcn.1401687cc
lea rcx, [0x14023bd90]
call fcn.1400bfa88
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14002c50c
Capabilities:
Delete file
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test rax, rax
je 0x14002c6aa
mov dword [rbp - 9], 4
mov qword [rbp - 1], rax
lea r9, [rbp - 9]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14002c6aa
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x14002c6aa
mov qword [rbp + 0x2f], rdi
mov qword [rbp + 0x3f], rdi
mov qword [rbp + 0x47], rdi
mov qword [rbp + 0x3f], rdi
mov qword [rbp + 0x47], 7
mov word [rbp + 0x2f], di
lea rdx, [rbp + 0x2f]
mov rcx, qword [rcx + 0x10]
call fcn.1400e29f8
test al, al
je 0x14002c65e
mov rcx, qword [rbp + 0x3f]
lea r14d, [rdi + 1]
cmp rcx, qword [rbp + 0x47]
jae 0x14002c5e7
lea rax, [rcx + 1]
mov qword [rbp + 0x3f], rax
lea rax, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rax, qword [rbp + 0x2f]
mov dword [rax + rcx*2], edi
jmp 0x14002c5fa
xor r9d, r9d
mov r8b, byte [rbp - 0x49]
mov rdx, r14
lea rcx, [rbp + 0x2f]
call fcn.140014b08
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
shr edx, 0xf
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x41], xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rax
mov dword [rbp - 0x39], 3
not dx
and dx, r14w
shl dx, 6
mov word [rbp - 0x21], dx
lea rax, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rax, qword [rbp + 0x2f]
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x41]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.14002f1a0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14002c69a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c695
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c6cf
call fcn.1401addcc
mov qword [rbp + 0x3f], rdi
mov qword [rbp + 0x47], 7
mov word [rbp + 0x2f], di
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1401adee0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1401b4fa4
int3
Function at 0x14002d0a0
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x300
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0x4009
mov rdi, r8
mov rcx, rbx
mov r9d, 0x2b8
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
mov dword [rdi + 0x24], eax
xor edx, edx
mov dword [rsp + 0x20], 0x400b
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x28], eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401adee0
mov rbx, qword [rsp + 0x310]
add rsp, 0x300
pop rdi
ret