joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140198e20
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
push rdi
sub rsp, 0x30
mov rbx, r8
mov dword [rax + 0x20], 1
mov rdi, rdx
lea r8, [rax + 0x20]
mov edx, 0x20001009
mov r9d, 2
mov ecx, 0x400
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
jg 0x140198e6a
call fcn.140020b4c
test eax, eax
js 0x140198eae
mov r8b, byte [rsp + 0x60]
movzx edx, word [rdi + 4]
call fcn.140198d9c
and qword [rsp + 0x28], 0
mov r8d, eax
mov edx, dword [rsp + 0x58]
mov r9, rbx
mov ecx, 0x400
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCalendarInfoW]
nop dword [rax + rax]
test eax, eax
jle 0x140198ea9
xor eax, eax
jmp 0x140198eae
call fcn.140020b4c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14019c1d4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov esi, r9d
mov rbp, r8
mov rdi, rcx
mov ebx, r14d
test rdx, rdx
je 0x14019c238
cmp word [rdx], r14w
je 0x14019c238
mov qword [r11 - 0x28], r14
lea rax, [r11 + 0x10]
mov qword [r11 - 0x30], rax
xor r9d, r9d
mov qword [r11 - 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov dword [r11 - 0x48], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
jmp 0x14019c23d
mov qword [rsp + 0x78], rcx
test ebx, ebx
jne 0x14019c286
mov eax, dword [rsp + 0x98]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rsp + 0x90]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
cmp rcx, rdi
je 0x14019c286
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14019df08
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov r9d, 4
test cl, cl
mov dword [rsp + 0x28], r9d
mov rcx, 0xffffffff80000001
setne al
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14019df50
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x14019df71
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuapinternal_shellincMobilityExperienceSettings.h
mov r9d, ebx
mov edx, PathIsExe
call fcn.14001e09c
mov eax, ebx
jmp 0x14019df73
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1401a29a4
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9d, 4
mov dword [rsp + 0x40], SafeArrayDestroy
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
lea r8, str.StartMenuInit
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
nop dword [rax + rax]
add rsp, 0x38
ret

Function at 0x1401a3338
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x40
and dword [r9], 0
lea rax, [r11 + 0x10]
and dword [rsp + 0x60], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
mov qword [r11 - 0x18], rax
mov rdi, r9
lea rax, [r11 + 0x18]
mov dword [rsp + 0x58], 4
mov r8, rcx
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1401a33b7
mov ecx, dword [rsp + 0x60]
call fcn.14009b240
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
cmp eax, 0x490
je 0x1401a33a9
cmp eax, 2
je 0x1401a33a9
test eax, eax
jle 0x1401a33d0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x1401a33ed
mov rcx, qword [rsp + 0x48]
lea r8, str.onecoreuapinternal_shellincCortanaRegistrySettings.h
mov r9d, ebx
mov edx, Ordinal_126
call fcn.14001e09c
mov eax, ebx
jmp 0x1401a33ab

Function at 0x1401a5ba8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
and dword [rdx], 0
lea rcx, [rsp + 0x48]
and qword [rsp + 0x48], 0
mov rbx, rdx
xor edx, edx
call fcn.14006e14c
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionCortana
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1401a5c02
mov edx, 0x44
jmp 0x1401a5c40
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.IsAvailable
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1401a5c58
mov edx, 0x4e
mov rcx, qword [rsp + 0x38]
lea r8, str.internal_shellcommonshellinccortanaCortanaAvailabilityHelpers.h
mov r9d, eax
call fcn.1401b3520
mov ebx, eax
jmp 0x1401a5c5a
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401a5c70
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1401a6b48
Capabilities:
Query or enumerate registry value

Disassembly:
mov byte [rsp + 8], cl
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x50], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea r8, str.IsAvailable
lea rax, [r11 + 8]
mov dword [rsp + 0x58], 4
mov qword [r11 - 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionCortana
and qword [r11 - 0x28], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp eax, 2
jne 0x1401a6ba5
xor al, al
jmp 0x1401a6bcc
test eax, eax
je 0x1401a6bc4
mov rcx, qword [rsp + 0x48]
lea r8, str.onecoreuapinternal_shellincCortanaCapabilities.h
mov r9d, eax
mov edx, 0x50
call fcn.140195f4c
jmp 0x1401a6ba1
cmp dword [rsp + 0x50], 1
sete al
add rsp, 0x48
ret

Function at 0x1401a6cdc
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax + rax]
xor ecx, ecx
test ax, ax
sets cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401a6d04
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x18], rax
lea r8, str.LatestShellPackageRegistered
xor ebx, ebx
lea rax, [r11 + 0x10]
mov qword [r11 - 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShellUpdate
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x28], rbx
lea r9d, [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401a6d62
cmp dword [rsp + 0x50], 4
jne 0x1401a6d62
cmp dword [rsp + 0x58], ebx
je 0x1401a6d62
mov bl, 1
mov al, bl
add rsp, 0x40
pop rbx
ret

Function at 0x1401a6d74
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor edx, edx
mov ecx, DAD_DragLeave
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
nop dword [rax + rax]
test eax, eax
je 0x1401a6dee
cmp dword [rsp + 0x30], ebx
je 0x1401a6dee
lea rcx, [0x140345648]
call qword [sym.imp.SHCORE.dll_Ordinal_190]
nop dword [rax + rax]
test eax, eax
jne 0x1401a6dee
xor r9d, r9d
lea rdx, str.DisallowShaking
xor r8d, r8d
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
call qword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401a6dee
call fcn.1401a6e00
test eax, eax
je 0x1401a6dee
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1401b29f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
lea rdx, str.location
mov r9d, 0x104
call fcn.1401b2a64
test al, al
je 0x1401b2a55
lea r8, str.msedge.exe
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
nop dword [rax + rax]
test eax, eax
jne 0x1401b2a55
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1401b2a55
test al, 0x10
jne 0x1401b2a55
mov al, 1
jmp 0x1401b2a57
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401b2a64
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
lea eax, [r9 + r9]
mov r9d, 2
mov dword [rsp + 0x78], eax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x30], r8
mov r8, rdx
xor edx, edx
mov qword [r11 - 0x38], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
sete al
add rsp, 0x58
ret

Function at 0x1401b5c18
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
mov edi, ebx
lea r9d, [rbx + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401b5ca6
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.DisableLockWorkstation
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401b5c96
cmp dword [rbp + 0x28], ebx
setne dil
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rbp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401b5d30
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.DisableLockWorkstation
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401b5d20
test edi, edi
jne 0x1401b5d1b
mov edi, ebx
cmp dword [rbp + 0x28], ebx
je 0x1401b5d20
mov edi, 1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
sete bl
mov eax, ebx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401b9198
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
sub rsp, 0x98
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140313ce0]
call qword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetKnownFolderIDList]
nop dword [rax + rax]
test eax, eax
js 0x1401b922c
xor edx, edx
mov dword [rsp + 0x20], Ordinal_113
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x20]
and qword [rsp + 0x28], 0
and qword [rsp + 0x30], 0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x24], 0x10000c
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
nop dword [rax + rax]
add rsp, 0x98
ret

Function at 0x1401b923c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
and qword [rbp + 0x77], 0
lea r8, [rbp + 0x77]
and qword [rsp + 0x20], 0
mov rbx, rcx
lea rcx, str.shell:::52205fd8_5dfb_447d_801a_d0b52f2e83e1
xor r9d, r9d
xor edx, edx
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHParseDisplayName]
nop dword [rax + rax]
test eax, eax
js 0x1401b92cc
xor edx, edx
mov dword [rbp - 0x19], Ordinal_113
lea rcx, [rbp - 0x15]
lea r8d, [rdx + 0x6c]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbp + 0x77]
lea rcx, [rbp - 0x19]
mov qword [rbp + 0x27], rax
lea rax, str.opennewwindow
mov qword [rbp - 9], rax
mov dword [rbp - 0x15], 0x10000c
mov dword [rbp + 0x17], 1
mov qword [rbp - 0x11], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x77]
and qword [rbp + 0x77], 0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x1401b93ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rcx
lea r8, [rax + 0x10]
lea rcx, [rax - 0x18]
call fcn.1401a3db8
nop
and dword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
test eax, eax
jns 0x1401b9469
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a4d
call fcn.14019c2a4
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x1401b9512
mov r8d, eax
shr r8, 1
lea rcx, [rsp + 0x48]
call fcn.1401a3b38
nop
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call fcn.14008e8b8
mov rcx, qword [rsp + 0x58]
test eax, eax
jns 0x1401b94cf
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a51
call fcn.14019c2a4
mov r8, rbx
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1401b9c38
mov bl, al
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401b94f8
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401b950e
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov al, bl
jmp 0x1401b952d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401b9529
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x1401b952b
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1401b95a4
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov rbx, r8
mov rdi, rcx
lea rdx, [rax + 0x10]
lea rcx, [rax - 0x18]
call fcn.1401a3d04
nop
and dword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x1401b9627
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a74
call fcn.14019c2a4
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x1401b972a
mov r8d, eax
shr r8, 1
lea rcx, [rsp + 0x48]
call fcn.1401a3b38
nop
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call fcn.14008e8b8
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x1401b9693
mov r9d, eax
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a78
call fcn.14019c2a4
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rax, rax
jne 0x1401b96cb
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a7c
call fcn.14019dc84
jmp 0x1401b9713
cmp dword [rsp + 0x40], 0
jle 0x1401b9713
mov r8, rbx
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1401b9c38
mov bl, al
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401b96f9
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401b970f
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov al, bl
jmp 0x1401b9745
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401b972a
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401b9741
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x1401b9743
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1401b97bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x460
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rbp, [0x14038c7f0]
mov esi, 1
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
je 0x1401b9848
mov ebx, 0x104
mov eax, esi
lea r8, str._s_d
mov r9, rbp
mov dword [rsp + 0x20], eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
inc esi
call fcn.14002d868
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1401b9811
jmp 0x1401b98bc
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1401b98cc
mov ebx, 0x104
lea rcx, [rsp + 0x240]
mov edx, ebx
mov r8, rax
call fcn.14003d070
mov word [rdi], r14w
mov eax, esi
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x28], rcx
lea r8, str._s_d_s
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, rbp
mov rdx, rbx
inc esi
call fcn.14002d868
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1401b987a
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rbp
call fcn.14003d070
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1401b9c38
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x90
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, Ordinal_113
mov r8d, ebp
lea rcx, [rax - 0x78]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140389668]
mov qword [rsp + 0x20], rbp
xor ebp, ebp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401b9cd3
mov rcx, qword [rsp + 0x98]
lea r8, str.pcshell_shellexplorer_tray.cpp
mov edx, 0x1a43
call fcn.14019dc84
jmp 0x1401b9cd6
mov bpl, 1
lea r11, [rsp + 0x90]
mov al, bpl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401b9ed8
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov r14d, edx
mov rsi, rcx
mov edi, ebx
cmp qword [rcx + 0x160], rbx
je 0x1401b9f78
mov r8d, dword [rcx + 0x58]
mov eax, ebx
shr r8d, 1
and r8d, 1
cmp qword [rcx + 0x208], rbx
setne al
cmp r8d, eax
jne 0x1401b9f78
lea ecx, [rbx + 0x38]
call fcn.140036464
mov rdi, rax
test rax, rax
je 0x1401b9f78
mov rax, qword [rsi + 0x160]
mov qword [rdi], rax
mov rax, qword [0x140389688]
mov qword [rdi + 8], rax
mov dword [rdi + 0x18], r14d
mov rax, qword [rsi + 8]
mov qword [rdi + 0x10], rax
mov eax, dword [rsi + 0x58]
mov dword [rdi + 0x1c], eax
mov rax, qword [rsi + 0x50]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x208]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rbp
mov qword [rsi + 0x160], rbx
mov dword [rsi + 0x58], ebx
test rdi, rdi
je 0x1401b9fd4
xor r9d, r9d
lea rcx, [0x1401b30f0]
mov r8d, 0x2000
mov rdx, rdi
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
je 0x1401b9faa
mov ebx, 1
jmp 0x1401b9fd4
mov rax, qword [rdi]
cmp qword [rsi + 0x160], rbx
je 0x1401b9fc0
mov rcx, rax
call fcn.1401b6808
jmp 0x1401b9fc7
mov qword [rsi + 0x160], rax
mov edx, RestartDialog
mov rcx, rdi
call fcn.1400a1c4c
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401b9ff8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9d, 1
mov rdi, rcx
test byte [0x14038bd80], r9b
je 0x1401ba046
lea rax, [rsp + 0x38]
lea rdx, [0x140335660]
mov qword [rsp + 0x20], rax
lea rcx, [0x140386800]
call fcn.140041cf0
mov rcx, qword [rdi + 8]
lea rdx, [0x140345658]
call fcn.140204518
test eax, eax
jne 0x1401ba15b
mov rcx, qword [0x140389668]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x2d2
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
nop dword [rax + rax]
lea rdx, [rsp + 0x50]
mov ecx, 0x8002
call qword [0x1403ad7b8]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1401ba0e9
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [0x1403ad6d0]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
cmp dword [rsp + 0x30], eax
jne 0x1401ba0e9
mov rcx, rbx
call qword [0x1403ad660]
nop dword [rax + rax]
test eax, eax
je 0x1401ba0e9
mov rcx, rbx
call qword [0x1403ad680]
nop dword [rax + rax]
jmp 0x1401ba15b
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140036464
mov rbx, rax
test rax, rax
je 0x1401ba15b
mov rcx, rax
call qword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
nop dword [rax + rax]
add dword [rbx + 8], 0x28
mov r9d, 2
add dword [rbx + 0xc], 0x28
mov r8, rbx
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [0x1403ad6a0]
nop dword [rax + rax]
xor r9d, r9d
lea rcx, [0x1401b37f0]
mov r8d, 0x2008
mov rdx, rbx
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
jne 0x1401ba15b
lea edx, [rax + 0x10]
mov rcx, rbx
call fcn.1400a1c4c
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret