joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1150
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1f38]
mov eax, 0x2030
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x1f20], rax
mov rdi, rcx
call fcn.140062158
test al, al
je 0x1400e11d2
cmp byte [0x140179a24], 0
jne 0x1400e11d2
mov ecx, 0x5f0
call fcn.1400901c8
mov ecx, 0x5f1
mov rbx, rax
call fcn.1400901c8
mov rcx, qword [0x140166d18]
mov rdx, rax
mov r9d, 0x24
mov r8, rbx
call fcn.1400d0120
cmp eax, 6
jne 0x1400e1322
mov esi, 0x800
lea rdx, [rbp + 0xf20]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, esi
lea rdx, str.rarreg.key
lea rcx, [rbp + 0xf20]
call fcn.1400804ec
xor r8d, r8d
lea rdx, [rbp + 0xf20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8b, 1
lea rcx, [rsp + 0x20]
test eax, eax
mov edx, esi
setne bl
call fcn.14007f90c
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14007ea30
mov r8d, esi
lea rdx, str.rarreg.key
lea rcx, [rsp + 0x20]
call fcn.140096270
test bl, bl
je 0x1400e1256
lea rcx, [rsp + 0x20]
call fcn.14006f4ac
jmp 0x1400e127b
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf20]
call fcn.140096298
mov rcx, qword [0x140166d18]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x140166d18]
mov edx, 1
call qword [sym.imp.USER32.dll_FlashWindow]
mov dl, 1
lea rcx, [rbp + 0xf20]
call fcn.140061f88
mov cl, al
call fcn.1400622d8
mov rcx, qword [0x140166d18]
xor edx, edx
call qword [sym.imp.USER32.dll_FlashWindow]
lea rcx, [0x14018d510]
call fcn.140048730
call fcn.140062158
test al, al
je 0x1400e1304
mov ecx, 0x368
call fcn.1400901c8
mov ecx, 0x367
mov rbx, rax
call fcn.1400901c8
mov rcx, qword [0x140166d18]
mov rdx, rax
mov r9d, 0x40
mov r8, rbx
call fcn.1400d0120
jmp 0x1400e1322
lea rcx, [rbp + 0xf20]
call fcn.14006f4ac
mov ecx, 0x366
call fcn.1400901c8
mov rcx, rax
call fcn.1400d4974
mov rcx, qword [rbp + 0x1f20]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400e3410
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x2f88]
mov eax, 0x3080
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x2f70], rax
xor edi, edi
cmp byte [0x140166ce4], dil
je 0x1400e3628
mov esi, 0x800
lea rdx, [rbp + 0x1f70]
mov r8d, esi
lea rcx, [0x14018a710]
call fcn.140005f50
lea r8d, [rdi + 1]
lea rdx, [0x14011cd68]
lea rcx, [0x14011c730]
call fcn.1400a78ac
test eax, eax
setne bl
test bl, bl
je 0x1400e34b2
lea r9, [0x14011bd58]
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, str.InterfaceMisc
call fcn.1400a7a38
cmp word [rsp + 0x70], di
jne 0x1400e34c6
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.14003e728
lea rcx, [rbp + 0x1f70]
call fcn.1400803f0
mov rdx, rax
lea r8, [rbp + 0xf70]
mov r9, rsi
lea rcx, [rsp + 0x70]
call fcn.14007fe98
mov ecx, 0x5af
call fcn.1400901c8
mov rcx, qword [0x140166d18]
lea r8, [rbp + 0xf70]
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
call fcn.1400096a0
test al, al
je 0x1400e3628
mov r8, rsi
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xf70]
call fcn.14007f7a4
test bl, bl
je 0x1400e3549
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, str.InterfaceMisc
call fcn.1400a84d0
or rcx, 0xffffffffffffffff
lea rax, [rbp + 0x1f70]
mov rdx, rcx
inc rdx
cmp word [rax + rdx*2], di
jne 0x1400e3557
inc rdx
mov r8d, 0x7ff
cmp rdx, r8
mov eax, r8d
cmovb rax, rdx
mov edx, 0x1000
add rax, rax
cmp rax, rdx
jae 0x1400e3656
mov word [rbp + rax + 0x1f70], di
lea rax, [rbp + 0xf70]
inc rcx
cmp word [rax + rcx*2], di
jne 0x1400e3593
inc rcx
cmp rcx, r8
cmovb r8, rcx
add r8, r8
cmp r8, rdx
jae 0x1400e3650
xor edx, edx
mov word [rbp + r8 + 0xf70], di
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x38]
call fcn.1400fd700
lea rax, [rbp + 0x1f70]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
lea rax, [rbp + 0xf70]
mov qword [rsp + 0x48], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400e3628
cmp dword [rsp + 0x54], edi
jne 0x1400e3628
mov ecx, 0x5b0
call fcn.1400901c8
mov r8, qword [rsp + 0x48]
mov rcx, rax
mov rdx, qword [rsp + 0x40]
call fcn.1400d4974
lea rcx, [0x14019bd38]
call fcn.140069744
mov rcx, qword [rbp + 0x2f70]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x3080]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400fc254
int3
call fcn.1400fc254
int3
Function at 0x1400e4200
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, dword [rdx + 0x10]
mov eax, 0x10000
mov esi, dword [rdx + 0x14]
xor r8d, r8d
mov r10, rcx
mov dword [rbp - 0x21], eax
mov ecx, dword [rdx + 0x18]
mov rbx, rdx
mov qword [rbp - 0x19], rax
mov dword [rbp - 9], eax
mov dword [rbp - 5], eax
mov dword [rbp + 3], eax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
mov dword [rbp + 0x13], eax
mov dword [rbp + 0x17], eax
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], eax
lea eax, [rcx + 1]
mov dword [rdx + 0x18], eax
mov qword [rbp - 0x29], r8
mov dword [rbp - 0x1d], 0x38000
mov qword [rbp - 0x11], r8
mov dword [rbp - 1], 0x7c000
mov dword [rbp + 0x1b], 0xfe000
cmp ecx, 6
jb 0x1400e428c
mov dword [rdx], r8d
jmp 0x1400e42f6
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 3
jb 0x1400e42ab
mov eax, 5
sub eax, ecx
mov ecx, eax
mov byte [rsp + 0x50], r8b
mov r9d, 0xa
mov eax, ecx
lea rcx, [rbp - 0x29]
imul rdx, rax, 0x1c
mov al, byte [rbx + 6]
mov byte [rsp + 0x48], al
add rdx, rcx
mov al, byte [rbx + 5]
mov rcx, r10
mov byte [rsp + 0x40], al
mov al, byte [rbx + 4]
mov byte [rsp + 0x38], al
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 7
call fcn.1400e3958
mov dword [rbx + 0x10], edi
mov dword [rbx + 0x14], esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e545c
Capabilities:
Get file system object information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x3560]
mov eax, 0x3660
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x3550], rax
cmp dword [0x140160118], 0xffffffff
mov r14, r9
mov bl, r8b
mov rdi, rdx
mov rsi, rcx
mov r13d, 0x4001
mov r15d, 0x800
jne 0x1400e550e
mov r9d, 0x2b8
mov dword [rsp + 0x20], r13d
lea r8, [rbp - 0x30]
xor edx, edx
lea rcx, [0x14011c97c]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rbp - 0x28]
lea rdx, [rbp + 0x2550]
mov r8d, r15d
mov dword [0x1401cd25c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r13d
lea r8, [rbp - 0x30]
xor edx, edx
lea rcx, [rbp + 0x2550]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rbp - 0x28]
mov dword [0x140160118], eax
mov r8, r15
lea rcx, [rbp + 0x550]
mov rdx, rdi
call fcn.140096298
mov r8, r15
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x550]
call fcn.140080594
movzx edi, word [rsi]
lea rax, [rbp + 0x550]
mov qword [rsp + 0x48], rax
mov r9d, 0x2b8
mov dword [rsp + 0x30], 3
lea r8, [rbp + 0x290]
mov qword [rsp + 0x34], 0x40000000
lea rcx, [rbp + 0x550]
test di, di
je 0x1400e5580
neg bl
mov dword [rsp + 0x20], 0x4011
sbb edx, edx
and edx, 0x10
jmp 0x1400e5587
mov dword [rsp + 0x20], r13d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rbp + 0x298]
mov r8, r15
mov dword [rsp + 0x54], eax
lea rcx, [rbp + 0x1550]
test di, di
je 0x1400e55b0
mov rdx, rsi
call fcn.140096298
jmp 0x1400e55d9
lea rdx, [rbp + 0x550]
call fcn.140096298
lea rcx, [rbp + 0x1550]
call fcn.140080444
lea rcx, [rbp + 0x550]
call fcn.1400803f0
mov qword [rsp + 0x48], rax
mov rcx, qword [0x140167d30]
mov edx, 0x66
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, rax
mov edx, 0x104d
mov rsi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x1401cd25c]
lea r9, [rsp + 0x30]
mov rbx, rax
mov dword [rsp + 0x30], 3
lea rax, [rbp + 0x1550]
mov dword [rsp + 0x34], ebx
test di, di
mov qword [rsp + 0x48], rax
mov r15d, 1
mov edx, 0x104c
cmovne ecx, dword [0x140160118]
xor r8d, r8d
mov dword [rsp + 0x54], ecx
mov rcx, rsi
mov dword [rsp + 0x38], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea edi, [r15 + 1]
movsxd r8, ebx
lea r9, [rbp - 0x80]
mov dword [rbp - 0x78], edi
mov edx, 0x1074
mov qword [rbp - 0x68], r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
jne 0x1400e5695
lea r9, [rbp - 0x80]
mov dword [rbp - 0x70], r15d
xor r8d, r8d
mov dword [rbp - 0x74], r15d
mov edx, 0x102b
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1401c95f0]
add eax, r15d
mov dword [0x1401c95f0], eax
cmp eax, r15d
jne 0x1400e56c5
mov ecx, 0x4f5
call fcn.1400901c8
mov rcx, qword [0x140167d30]
mov r8, rax
mov edx, edi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rbp + 0x3550]
xor rcx, rsp
call fcn.1400fc4f0
add rsp, 0x3660
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400e768c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor r9d, r9d
mov dword [rsp + 0x20], 0x1000
lea r8, [rsp + 0x1030]
lea rdx, str.rarreg.key
lea rcx, [0x14011bd58]
call fcn.1400a78c4
movsxd rdi, eax
test eax, eax
je 0x1400e7744
mov r8d, 0x800
lea rdx, [rsp + 0x30]
lea rcx, str.Rar_RK
call fcn.1400cec44
mov rbx, rax
test rax, rax
je 0x1400e7731
mov r8, rdi
lea rcx, [rsp + 0x1030]
mov r9, rax
mov edx, 1
call fcn.140103d94
mov rcx, rbx
call fcn.1401039c8
lea rcx, [rsp + 0x30]
call fcn.1400e1150
lea rcx, [rsp + 0x30]
call fcn.14006f4ac
lea rdx, str.rarreg.key
lea rcx, [0x14011bd58]
call fcn.1400a7328
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret
Function at 0x1400e7850
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xf78]
mov eax, 0x1070
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0xf60], rax
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], 0x55b01
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, 0xc
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, str.VerInfo
lea rcx, [0x14011c730]
call fcn.1400a78c4
lea esi, [rdi - 0xb]
mov ebx, 0x800
mov r8b, sil
lea rcx, [rsp + 0x60]
mov edx, ebx
call fcn.14007f90c
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.14007ea30
mov r8d, ebx
lea rdx, str.version.dat
lea rcx, [rsp + 0x60]
call fcn.140096270
and dword [rsp + 0x40], 0
lea rdx, [0x140120cd8]
lea rcx, [rsp + 0x60]
call fcn.1400706c8
mov rbx, rax
test rax, rax
je 0x1400e792b
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, edi
mov edx, esi
call fcn.1401079a4
mov rcx, rbx
call fcn.1401039c8
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
je 0x1400e79dc
lea rdx, str.VerInfo
mov r9, rdi
lea rcx, [0x14011c730]
cmp dword [rsp + 0x40], eax
je 0x1400e79b4
lea r8, [rsp + 0x50]
call fcn.1400a8500
call fcn.1400a8204
test al, al
jne 0x1400e7997
lea rdx, [0x14011cb30]
lea rcx, [rsp + 0x60]
call fcn.1400706c8
mov rbx, rax
test rax, rax
je 0x1400e7997
mov r9, rax
lea rcx, [rsp + 0x50]
mov r8, rdi
mov rdx, rsi
call fcn.140103d94
mov rcx, rbx
call fcn.1401039c8
call fcn.1400a820c
neg al
mov edx, 0x168
sbb ecx, ecx
not ecx
and ecx, edx
mov dword [0x140167e44], ecx
jmp 0x1400e7a73
movsd xmm0, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
mov eax, dword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
call fcn.1400a8500
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
jne 0x1400e7a33
cmp dword [rsp + 0x40], eax
je 0x1400e7a33
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
call fcn.1400a8204
test al, al
jne 0x1400e7a33
lea rdx, [0x14011cb30]
lea rcx, [rsp + 0x60]
call fcn.1400706c8
mov rbx, rax
test rax, rax
je 0x1400e7a33
mov r9, rax
lea rcx, [rsp + 0x30]
mov r8, rdi
mov rdx, rsi
call fcn.140103d94
mov rcx, rbx
call fcn.1401039c8
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x58]
shl rax, 0x20
shl rcx, 0x20
sub rax, rcx
mov ecx, dword [rsp + 0x34]
sub rax, rcx
mov ecx, dword [rsp + 0x54]
add rax, rcx
movabs rcx, 0xc92a69c000
cqo
idiv rcx
mov edx, 0x168
test eax, eax
cmovs eax, edx
mov dword [0x140167e44], eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400e893c
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov bl, r8b
mov rdi, rdx
mov ecx, dword [0x1401fe980]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1401d5a60], eax
jle 0x1400e89b9
lea rcx, [0x1401d5a60]
call fcn.1400fcc28
cmp dword [0x1401d5a60], 0xffffffff
jne 0x1400e89b9
lea rcx, [0x1401d595e]
call fcn.140093560
nop
lea rcx, [0x1401197c0]
call fcn.1400fca34
nop
lea rcx, [0x1401d5a60]
call fcn.1400fcbc8
mov r8b, 1
mov rdx, rdi
lea rsi, [0x1401d1930]
mov rcx, rsi
call fcn.1400ea154
test bl, bl
sete al
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x20], al
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call fcn.1400eb2d8
test al, al
jne 0x1400e8a11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.1400e8dbc
cmp ebx, 0x4c7
sete al
jmp 0x1400e8a35
test bl, bl
je 0x1400e8a2b
mov r8, rsi
mov edx, 0x10000
lea rcx, [0x1400e90d0]
call fcn.14010415c
jmp 0x1400e8a33
mov rcx, rsi
call fcn.1400e8dbc
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e9878
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f60]
mov eax, 0x3060
call fcn.1400fc480
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x30a0], rbx
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x2f50], rax
mov r15b, r8b
mov r12, rdx
xor r13d, r13d
mov ebx, 0x800
test r9, r9
jne 0x1400e9918
mov dword [rsp + 0x20], ebx
lea r9, [0x14011bd58]
lea r8, [rsp + 0x50]
lea rdx, str.ExternalViewer
lea rcx, [0x14011d158]
call fcn.1400a7a38
mov r8d, ebx
lea rdx, [rbp + 0x1f50]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1400e9928
lea rdx, [rbp + 0x1f50]
jmp 0x1400e991b
mov rdx, r9
mov r8, rbx
lea rcx, [rsp + 0x50]
call fcn.140096298
cmp word [rsp + 0x50], r13w
jne 0x1400e9937
xor al, al
jmp 0x1400e9b29
mov r8, rbx
mov rdx, r12
lea rcx, [rbp + 0xf50]
call fcn.140096298
mov rdx, rbx
lea rcx, [rbp + 0xf50]
call fcn.1400b0750
lea rcx, [rsp + 0x50]
call fcn.14006f794
test al, al
jne 0x1400e9a4d
mov eax, 0x22
cmp word [rsp + 0x50], ax
jne 0x1400e9987
mov edx, eax
lea rcx, [rsp + 0x52]
call fcn.1400fd65c
jmp 0x1400e9a2c
lea rax, [rsp + 0x50]
jmp 0x1400e9a2c
lea rdx, [0x140136f08]
mov rcx, rax
call fcn.140108468
mov rdi, rax
test rax, rax
je 0x1400e9a4d
mov rsi, rax
movzx ecx, word [rax]
jmp 0x1400e99bb
add rsi, 2
movzx ecx, word [rsi]
call fcn.140095e80
test al, al
jne 0x1400e99b4
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x1f50]
call fcn.140096298
mov r8, rbx
lea rdx, [0x140120cb4]
lea rcx, [rbp + 0x1f50]
call fcn.140096270
mov r8, rbx
lea rdx, [rbp + 0xf50]
lea rcx, [rbp + 0x1f50]
call fcn.140096270
movzx r14d, word [rdi]
mov word [rdi], r13w
mov eax, 0x22
cmp word [rsp + 0x50], ax
je 0x1400e9a37
lea rcx, [rsp + 0x50]
call fcn.14006f794
test al, al
jne 0x1400e9a37
mov word [rdi], r14w
lea rax, [rsi + 2]
test rax, rax
jne 0x1400e9991
jmp 0x1400e9a4d
mov r8, rbx
lea rdx, [rbp + 0x1f50]
lea rcx, [rbp + 0xf50]
call fcn.140096298
mov ecx, dword [0x1401fe980]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1401d1920], ecx
jle 0x1400e9aab
lea rcx, [0x1401d1920]
call fcn.1400fcc28
cmp dword [0x1401d1920], 0xffffffff
jne 0x1400e9aab
lea rcx, [0x1401d181e]
call fcn.140093560
nop
lea rcx, [0x1401197e0]
call fcn.1400fca34
nop
lea rcx, [0x1401d1920]
call fcn.1400fcbc8
mov r8b, 1
mov rdx, r12
lea rbx, [0x1401cd7f0]
mov rcx, rbx
call fcn.1400ea154
test r15b, r15b
sete al
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x20], al
lea r9, [rbp + 0xf50]
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1400eb2d8
test al, al
jne 0x1400e9afb
mov rcx, rbx
call fcn.1400e8dbc
jmp 0x1400e9930
test r15b, r15b
je 0x1400e9b1f
cmp qword [0x1401cd7f0], r13
je 0x1400e9b1f
mov r8, rbx
mov edx, 0x10000
lea rcx, [0x1400e90d0]
call fcn.14010415c
jmp 0x1400e9b27
mov rcx, rbx
call fcn.1400e8dbc
mov al, 1
mov rcx, qword [rbp + 0x2f50]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x30a0]
add rsp, 0x3060
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9b54
Capabilities:
Create thread

Disassembly:
push rsi
mov eax, 0x1060
call fcn.1400fc480
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1070], rbx
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbx, rdx
mov rcx, rdx
call fcn.1400ea87c
test al, al
je 0x1400e9bc9
mov ecx, 0x65
call fcn.1400901c8
mov rbx, rax
mov ecx, 0x596
call fcn.1400901c8
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x140166d18]
call fcn.1400d0120
jmp 0x1400e9d40
cmp byte [0x140166ce4], 0
jne 0x1400e9c15
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.1400eb2d8
test al, al
jne 0x1400e9d40
mov ecx, 0x201
call fcn.1400901c8
mov rcx, rax
mov rdx, rbx
call fcn.1400d4974
jmp 0x1400e9d40
mov cl, 1
call fcn.1400c9cf4
mov r9b, 1
mov esi, 0x800
mov r8d, esi
lea rdx, [0x14017589e]
lea rcx, str.Rar_EX
call fcn.1400ced20
test al, al
je 0x1400e9d40
mov r8d, esi
lea rdx, [0x14017edfa]
lea rcx, [0x14018a710]
call fcn.140005f50
mov eax, dword [0x14018a714]
mov dword [0x14017bd98], eax
lea rdx, [0x14011c528]
lea rcx, [0x14017fe00]
call fcn.140096308
mov dword [0x14017ad84], 2
mov r9d, esi
lea r8, [rsp + 0x50]
mov rdx, rbx
lea rcx, [0x14017589e]
call fcn.14007fe98
xor r8d, r8d
xor edx, edx
lea rcx, [0x14018a710]
call fcn.140005aa0
cmp byte [0x140166ce7], 0
jne 0x1400e9d40
mov ecx, dword [0x1401fe980]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1401d9ba0], ecx
jle 0x1400e9d14
lea rcx, [0x1401d9ba0]
call fcn.1400fcc28
cmp dword [0x1401d9ba0], 0xffffffff
jne 0x1400e9d14
lea rcx, [0x1401d9a9e]
call fcn.140093560
nop
lea rcx, [0x140119800]
call fcn.1400fca34
nop
lea rcx, [0x1401d9ba0]
call fcn.1400fcbc8
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [0x1401d5a70]
call fcn.1400ea154
lea r8, [0x1401d5a70]
mov edx, 0x10000
lea rcx, [0x1400e90d0]
call fcn.14010415c
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1060
pop rsi
ret
Function at 0x1400e9f58
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x6010]
mov eax, 0x6110
call fcn.1400fc480
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x6000], rax
mov rdi, rdx
mov rsi, rcx
mov rcx, r8
call fcn.1400803f0
mov r10, rax
or rdx, 0xffffffffffffffff
mov r8, rdx
xor ebx, ebx
inc r8
cmp word [rdi + r8*2], bx
jne 0x1400e9fa8
inc rdx
cmp word [rax + rdx*2], bx
jne 0x1400e9fb2
lea rax, [rdx + 1]
add rax, r8
mov r14d, 0x1000
cmp rax, r14
jb 0x1400e9fd4
xor al, al
jmp 0x1400ea0eb
mov r9, r14
lea r8, [rbp + 0x4000]
mov rdx, r10
mov rcx, rdi
call fcn.14007fe98
lea rcx, [rsp + 0x40]
call fcn.1400962cc
nop
mov dword [rsp + 0x20], r14d
lea r9, [0x14011bd58]
lea r8, [rbp + 0x2000]
lea rdx, str.ViewerIgnoreModifications
lea rcx, [0x14011d158]
call fcn.1400a7a38
cmp word [rbp + 0x2000], bx
je 0x1400ea03a
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x2000]
call fcn.1400b0970
mov r14d, 0x800
mov r8, r14
lea rdx, [rbp + 0x1000]
lea rcx, [rsp + 0x40]
call fcn.1400963dc
test al, al
je 0x1400ea0df
mov r8d, r14d
lea rdx, [rbp]
lea rcx, [rbp + 0x1000]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1400ea040
lea rdx, [0x140136d8c]
lea rcx, [rbp + 2]
call fcn.1400fead8
mov rdi, rax
test rax, rax
je 0x1400ea0bc
mov word [rax], bx
add rdi, 4
cmp word [rdi], bx
jne 0x1400ea0a4
lea rdi, [0x14011c528]
mov r8d, 5
mov rdx, rsi
lea rcx, [rbp]
call fcn.140073988
test al, al
je 0x1400ea040
jmp 0x1400ea0c0
lea rdi, [rbp]
mov r8d, 5
lea rdx, [rbp + 0x4000]
mov rcx, rdi
call fcn.140073988
test al, al
je 0x1400ea040
mov bl, 1
lea rcx, [rsp + 0x40]
call fcn.140004acc
mov al, bl
mov rcx, qword [rbp + 0x6000]
xor rcx, rsp
call fcn.1400fc4f0
add rsp, 0x6110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret