joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a5a48
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
lea rdx, str.location
mov r9d, 0x104
call fcn.1401a5ab4
test al, al
je 0x1401a5aa5
lea r8, str.msedge.exe
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
nop dword [rax + rax]
test eax, eax
jne 0x1401a5aa5
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1401a5aa5
test al, 0x10
jne 0x1401a5aa5
mov al, 1
jmp 0x1401a5aa7
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401a5ab4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
lea eax, [r9 + r9]
mov r9d, 2
mov dword [rsp + 0x78], eax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x30], r8
mov r8, rdx
xor edx, edx
mov qword [r11 - 0x38], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
sete al
add rsp, 0x58
ret

Function at 0x1401a8c08
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
mov edi, ebx
lea r9d, [rbx + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401a8c96
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.DisableLockWorkstation
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401a8c86
cmp dword [rbp + 0x28], ebx
setne dil
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rbp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401a8d20
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.DisableLockWorkstation
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401a8d10
test edi, edi
jne 0x1401a8d0b
mov edi, ebx
cmp dword [rbp + 0x28], ebx
je 0x1401a8d10
mov edi, 1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
sete bl
mov eax, ebx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401ac11c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
sub rsp, 0x98
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140306c30]
call qword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetKnownFolderIDList]
nop dword [rax + rax]
test eax, eax
js 0x1401ac1b0
xor edx, edx
mov dword [rsp + 0x20], Ordinal_113
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x20]
and qword [rsp + 0x28], 0
and qword [rsp + 0x30], 0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x24], 0x10000c
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
nop dword [rax + rax]
add rsp, 0x98
ret

Function at 0x1401ac1c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
and qword [rbp + 0x77], 0
lea r8, [rbp + 0x77]
and qword [rsp + 0x20], 0
mov rbx, rcx
lea rcx, str.shell:::52205fd8_5dfb_447d_801a_d0b52f2e83e1
xor r9d, r9d
xor edx, edx
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHParseDisplayName]
nop dword [rax + rax]
test eax, eax
js 0x1401ac250
xor edx, edx
mov dword [rbp - 0x19], Ordinal_113
lea rcx, [rbp - 0x15]
lea r8d, [rdx + 0x6c]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbp + 0x77]
lea rcx, [rbp - 0x19]
mov qword [rbp + 0x27], rax
lea rax, str.opennewwindow
mov qword [rbp - 9], rax
mov dword [rbp - 0x15], 0x10000c
mov dword [rbp + 0x17], 1
mov qword [rbp - 0x11], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x77]
and qword [rbp + 0x77], 0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x1401ac370
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rcx
lea r8, [rax + 0x10]
lea rcx, [rax - 0x18]
call fcn.140196df8
nop
and dword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
test eax, eax
jns 0x1401ac3ed
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a47
call fcn.14018f2c4
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x1401ac496
mov r8d, eax
shr r8, 1
lea rcx, [rsp + 0x48]
call fcn.140196b78
nop
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call fcn.14008f3a8
mov rcx, qword [rsp + 0x58]
test eax, eax
jns 0x1401ac453
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a4b
call fcn.14018f2c4
mov r8, rbx
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1401acbbc
mov bl, al
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401ac47c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401ac492
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov al, bl
jmp 0x1401ac4b1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401ac4ad
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x1401ac4af
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1401ac528
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov rbx, r8
mov rdi, rcx
lea rdx, [rax + 0x10]
lea rcx, [rax - 0x18]
call fcn.140196d44
nop
and dword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x1401ac5ab
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a6e
call fcn.14018f2c4
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x1401ac6ae
mov r8d, eax
shr r8, 1
lea rcx, [rsp + 0x48]
call fcn.140196b78
nop
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call fcn.14008f3a8
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x1401ac617
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a72
call fcn.14018f2c4
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rax, rax
jne 0x1401ac64f
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a76
call fcn.140190ca4
jmp 0x1401ac697
cmp dword [rsp + 0x40], 0
jle 0x1401ac697
mov r8, rbx
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1401acbbc
mov bl, al
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401ac67d
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401ac693
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov al, bl
jmp 0x1401ac6c9
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401ac6ae
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401ac6c5
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x1401ac6c7
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1401ac740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x460
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rbp, [0x14037e6f0]
mov esi, 1
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
je 0x1401ac7cc
mov ebx, 0x104
mov eax, esi
lea r8, str._s_d
mov r9, rbp
mov dword [rsp + 0x20], eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
inc esi
call fcn.14002e4b8
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1401ac795
jmp 0x1401ac840
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1401ac850
mov ebx, 0x104
lea rcx, [rsp + 0x240]
mov edx, ebx
mov r8, rax
call fcn.14003dd20
mov word [rdi], r14w
mov eax, esi
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x28], rcx
lea r8, str._s_d_s
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, rbp
mov rdx, rbx
inc esi
call fcn.14002e4b8
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1401ac7fe
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rbp
call fcn.14003dd20
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400a2260
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1401acbbc
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x90
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, Ordinal_113
mov r8d, ebp
lea rcx, [rax - 0x78]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [0x14037b618]
mov qword [rsp + 0x20], rbp
xor ebp, ebp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401acc57
mov rcx, qword [rsp + 0x98]
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a3d
call fcn.140190ca4
jmp 0x1401acc5a
mov bpl, 1
lea r11, [rsp + 0x90]
mov al, bpl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401ace5c
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov r14d, edx
mov rsi, rcx
mov edi, ebx
cmp qword [rcx + 0x160], rbx
je 0x1401acefc
mov r8d, dword [rcx + 0x58]
mov eax, ebx
shr r8d, 1
and r8d, 1
cmp qword [rcx + 0x208], rbx
setne al
cmp r8d, eax
jne 0x1401acefc
lea ecx, [rbx + 0x38]
call fcn.140037114
mov rdi, rax
test rax, rax
je 0x1401acefc
mov rax, qword [rsi + 0x160]
mov qword [rdi], rax
mov rax, qword [0x14037b638]
mov qword [rdi + 8], rax
mov dword [rdi + 0x18], r14d
mov rax, qword [rsi + 8]
mov qword [rdi + 0x10], rax
mov eax, dword [rsi + 0x58]
mov dword [rdi + 0x1c], eax
mov rax, qword [rsi + 0x50]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x208]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rbp
mov qword [rsi + 0x160], rbx
mov dword [rsi + 0x58], ebx
test rdi, rdi
je 0x1401acf58
xor r9d, r9d
lea rcx, [0x1401a6140]
mov r8d, 0x2000
mov rdx, rdi
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
je 0x1401acf2e
mov ebx, 1
jmp 0x1401acf58
mov rax, qword [rdi]
cmp qword [rsi + 0x160], rbx
je 0x1401acf44
mov rcx, rax
call fcn.1401a97f8
jmp 0x1401acf4b
mov qword [rsi + 0x160], rax
mov edx, RestartDialog
mov rcx, rdi
call fcn.1400a290c
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401acf7c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9d, 1
mov rdi, rcx
test byte [0x14037dc80], r9b
je 0x1401acfca
lea rax, [rsp + 0x38]
lea rdx, [0x140327780]
mov qword [rsp + 0x20], rax
lea rcx, [0x1403787c0]
call fcn.1400429a0
mov rcx, qword [rdi + 8]
lea rdx, [0x1403378e8]
call fcn.1401f7c18
test eax, eax
jne 0x1401ad0df
mov rcx, qword [0x14037b618]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x2d2
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
nop dword [rax + rax]
lea rdx, [rsp + 0x50]
mov ecx, 0x8002
call qword [case.0x14004551b.2]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1401ad06d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [0x14039e7b8]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
cmp dword [rsp + 0x30], eax
jne 0x1401ad06d
mov rcx, rbx
call qword [0x14039e6e8]
nop dword [rax + rax]
test eax, eax
je 0x1401ad06d
mov rcx, rbx
call qword [0x14039e708]
nop dword [rax + rax]
jmp 0x1401ad0df
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140037114
mov rbx, rax
test rax, rax
je 0x1401ad0df
mov rcx, rax
call qword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
nop dword [rax + rax]
add dword [rbx + 8], 0x28
mov r9d, 2
add dword [rbx + 0xc], 0x28
mov r8, rbx
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [0x14039e750]
nop dword [rax + rax]
xor r9d, r9d
lea rcx, [0x1401a6840]
mov r8d, 0x2008
mov rdx, rbx
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
jne 0x1401ad0df
lea edx, [rax + 0x10]
mov rcx, rbx
call fcn.1400a290c
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a2260
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x1401ad4fc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rbx, rcx
mov word [rsp + 0x30], di
test r8, r8
je 0x1401ad5a1
lea rdx, [rsp + 0x30]
mov rcx, r8
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
nop dword [rax + rax]
test eax, eax
je 0x1401ad5a1
cmp word [rsp + 0x30], di
je 0x1401ad58c
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetDriveNumberW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1401ad58c
mov ecx, eax
call qword [sym.imp.SHCORE.dll_Ordinal_174]
nop dword [rax + rax]
cmp eax, 2
je 0x1401ad577
cmp eax, 5
jne 0x1401ad58c
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
je 0x1401ad5a1
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x1401ad5bc
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 + 0x10]
call qword [0x14039e840]
nop dword [rax + rax]
mov rcx, qword [0x14037b618]
lea r8, [rsp + 0x240]
mov r9d, 0x100
mov edx, 0x2d2
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
nop dword [rax + rax]
lea r9, [rsp + 0x240]
mov dword [rsp + 0x28], 0x104
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_Ordinal_61]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400a2260
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret

Function at 0x1401b4bec
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x100
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rcx + 0x28]
test rbx, rbx
je 0x1401b4cad
xor edx, edx
lea rcx, [r11 - 0x68]
lea r8d, [rdx + 0x4e]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.14003cc98
mov rcx, rax
lea rdx, [rsp + 0xa0]
mov r8d, PathIsExe
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
nop dword [rax + rax]
test eax, eax
jle 0x1401b4cad
mov ebx, Ordinal_113
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
and qword [rsp + 0x28], 0
lea rax, [0x1403092b8]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
lea rax, str.ms_settings:notifications
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x24], 0x100
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400a2260
add rsp, 0x100
pop rbx
ret
Function at 0x1401b50cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rcx + 0x28]
mov edi, r8d
mov rbx, rcx
test rax, rax
je 0x1401b5139
lea r9, [rax + 0x230]
test rdx, rdx
jne 0x1401b5121
mov eax, dword [rax + 0x530]
mov ecx, eax
and ecx, 0xf
test al, 0x20
lea r8d, [rcx + 3]
cmove r8d, ecx
mov rcx, qword [rbx + 0x10]
jmp 0x1401b5128
mov rcx, qword [rcx + 0x10]
mov r8, rdx
mov edx, 0x421
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x1401b5173
test byte [rax + 0x530], 0x10
jne 0x1401b5173
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
sub eax, edi
cmp eax, 0x1388
jb 0x1401b5173
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov edi, eax
call fcn.14029d6ec
mov rcx, rbx
call fcn.1401b4cd0
mov rcx, qword [rbx + 0x58]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x118]
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [case.0x14006c37f.0]
xor edx, edx
mov dword [rsp + 0x30], 0x48
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x44]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x1401b51ec
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x30]
add rax, 0x330
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov edx, 0x439
mov qword [rsp + 0x60], rax
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov rax, qword [rbx + 0x28]
mov dword [rbx + 0x48], 1
test rax, rax
je 0x1401b52eb
xor r9d, r9d
lea r8, [rsp + 0x20]
xor edx, edx
mov ecx, 0x2016
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
nop dword [rax + rax]
test eax, eax
je 0x1401b523b
imul r8d, dword [rsp + 0x20], 0x3e8
mov dword [rsp + 0x20], r8d
cmp r8d, 0x2328
jb 0x1401b523b
add r8d, 0xffffe890
jmp 0x1401b5241
mov r8d, 0xbb8
add r8d, 0x3e8
mov edx, SafeArrayDestroy
mov rcx, rbx
call fcn.1401b506c
test al, al
je 0x1401b52eb
mov byte [rbx + 0x51], 0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov edx, 0x403
mov r8d, 4
mov dword [rbx + 0x4c], eax
lea r9d, [rdx - 0x1b]
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov edx, 0x403
mov r9d, 0x1388
mov r8d, 5
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x411
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov edx, 0x411
mov r8d, 1
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a2260
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
Function at 0x1401b5ef8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rax, [0x1402f01b8]
mov qword [rcx], rax
lea rax, [0x1402f0210]
mov qword [rcx + 8], rax
lea rax, [0x1402f01f0]
mov qword [rcx + 0x10], rax
lea rax, [0x1402f0198]
mov qword [rcx + 0x18], rax
add rcx, 0x574
xor edi, edi
cmp word [rcx], di
je 0x1401b5f66
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
nop
test eax, eax
jne 0x1401b5f66
mov rcx, qword [rsp + 0x28]
lea r8, str.pcshell_shellexplorer_trayinfotiptoastmanager.cpp
mov edx, 0x91
call fcn.140190ca4
nop
mov rcx, rbx
call fcn.1401b959c
nop
lea rcx, [rbx + 0x7a8]
call fcn.140082784
nop
lea rcx, [rbx + 0x7a0]
call fcn.14000bb34
nop
lea rcx, [rbx + 0x798]
call fcn.14000bb34
nop
lea rcx, [rbx + 0x790]
call fcn.14000bb34
nop
mov dword [rbx + 0x24], 0xc0000001
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401b8e58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rdi, rdx
xor esi, esi
mov word [rdx], si
mov ecx, 0x104
lea rdx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
jne 0x1401b8ecf
call fcn.14002154c
mov ebx, eax
test eax, eax
jns 0x1401b8ecf
mov edx, 0x2be
mov rcx, qword [rsp + 0x2b8]
lea r8, str.pcshell_shellexplorer_trayinfotiptoastmanager.cpp
mov r9d, ebx
call fcn.14001eb0c
mov eax, ebx
jmp 0x1401b8f5d
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateGuid]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1401b8eed
mov edx, 0x2c1
jmp 0x1401b8eb1
mov r8d, PathIsExe
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
nop dword [rax + rax]
test eax, eax
jg 0x1401b8f19
mov ebx, 0x80004005
mov edx, Ordinal_711
jmp 0x1401b8eb1
lea rax, str..png
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x90]
lea rax, [rsp + 0x40]
mov rcx, rdi
lea r8, [0x14032a110]
mov qword [rsp + 0x20], rax
call fcn.14002e4b8
mov ebx, eax
test eax, eax
jns 0x1401b8f5b
mov edx, Ordinal_711
jmp 0x1401b8eb1
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400a2260
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret