joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c4130
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c4350
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800c4237
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800c4194
mov rax, qword [0x180119008]
cmp qword [rsp + 0x20], rax
ja 0x1800c4194
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c4156
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800c41c3
jmp 0x1800c4237
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c421a
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c421a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c4208
mov rax, qword [rsp + 0x28]
jmp 0x1800c4239
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c4232
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c4350
mov qword [rsp + 0x20], rax
jmp 0x1800c4156
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800c4240
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800c4390
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800c4343
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800c429b
mov rax, qword [0x180119008]
cmp qword [rsp + 0x20], rax
ja 0x1800c429b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c425d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800c42ca
jmp 0x1800c4343
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c4321
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c4321
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c430f
mov rax, qword [rsp + 0x28]
jmp 0x1800c4345
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c433e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800c4390
mov qword [rsp + 0x20], rax
jmp 0x1800c425d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800c43e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800c4970
mov qword [rsp + 0x28], 0
cmp qword [0x18011a438], 0
jne 0x1800c4428
cmp qword [0x18011a430], 0
je 0x1800c4428
mov rax, qword [0x18011a430]
mov qword [0x18011a438], rax
cmp qword [0x18011a438], 0
je 0x1800c44ce
mov rax, qword [0x18011a438]
cmp qword [rax + 0x10], 0
je 0x1800c44ce
mov rax, qword [0x18011a438]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800c44ce
mov rax, qword [0x18011a438]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800c44ce
mov rax, qword [0x18011a438]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800c4494
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800c449b
xor eax, eax
jmp 0x1800c4649
mov rax, qword [0x18011a438]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800c4649
mov rax, qword [0x18011a430]
mov qword [0x18011a438], rax
jmp 0x1800c44f0
mov rax, qword [0x18011a438]
mov rax, qword [rax + 8]
mov qword [0x18011a438], rax
cmp qword [0x18011a438], 0
je 0x1800c453d
cmp qword [0x18011a438], 0
je 0x1800c453b
mov rax, qword [0x18011a438]
cmp qword [rax + 0x10], 0
je 0x1800c453b
mov rax, qword [0x18011a438]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800c453b
mov rax, qword [0x18011a438]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800c453b
jmp 0x1800c446c
jmp 0x1800c44de
mov rcx, qword [rsp + 0x60]
call fcn.1800c65a0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800c4650
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800c4647
mov rax, qword [rsp + 0x48]
mov qword [0x18011a438], rax
mov rax, qword [0x18011a438]
mov dword [rax], 0x52727464
mov rax, qword [0x18011a438]
mov qword [rax + 0x10], 0
mov rax, qword [0x18011a438]
mov rcx, qword [0x18011a430]
mov qword [rax + 8], rcx
mov rax, qword [0x18011a438]
mov qword [0x18011a430], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18011a438]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800c45f8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800c4632
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800c45ee
mov rax, qword [0x18011a438]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800c446c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800c8088
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800c80c2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800c80c7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800c8110
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800ece70]
cmp byte [rcx + rax], 0
je 0x1800c8110
dec r8
sub rdx, 1
jne 0x1800c80f6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1401e6020
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401e602d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401e603d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401e6025
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1401e6055
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401e6042
sub eax, 3
jb 0x1401e606f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401e60a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1401e6096
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401e6094
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401e6083
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1401e5fe2
jmp 0x1401e602d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x9800
mov dl, 4
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401e60f2
cmp rsi, rcx
jae 0x1401e60fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401e60d9
cmp al, 0x8f
ja 0x1401e60d9
cmp byte [rsi - 2], 0xf
je 0x1401e60df
sub al, 0xe8
cmp al, 1
ja 0x1401e60c3
cmp rsi, rcx
jae 0x1401e60fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401e60c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401e60fa
lodsb al, byte [rsi]
jmp 0x1401e60d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1e3000]
mov eax, dword [rdi]
or eax, eax
je 0x1401e6157
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1e7e5c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401e6107
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401e6151
mov qword [rbx], rax
add rbx, 8
jmp 0x1401e6127
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x20f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401e61af
sub rsp, 0xffffffffffffff80
jmp 0x1400097f0
Function at 0x180001170
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1800011e4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001206
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001206
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180001206
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x18000124e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180001170
cmp byte [0x18003f0c0], 0
jne 0x180001299
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001289
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x18003f0c0], 1
mov qword [0x18003f0b8], rax
jmp 0x1800012a0
mov rax, qword [0x18003f0b8]
mov byte [0x18003f0c0], 1
jmp 0x1800012a0
mov rax, qword [0x18003f0b8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1800012bf
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
Function at 0x180001220
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1800011e4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001206
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001206
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180001206
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x18000124e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180001170
cmp byte [0x18003f0c0], 0
jne 0x180001299
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001289
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x18003f0c0], 1
mov qword [0x18003f0b8], rax
jmp 0x1800012a0
mov rax, qword [0x18003f0b8]
mov byte [0x18003f0c0], 1
jmp 0x1800012a0
mov rax, qword [0x18003f0b8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1800012bf
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
Function at 0x180002c20
Capabilities:
Find taskbar

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
test ecx, ecx
jne 0x180002d1d
cmp byte [section..SHARED], cl
jne 0x180002d1d
mov dword [rsp + 0x50], ecx
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x50], eax
jne 0x180002d1d
mov byte [section..SHARED], 1
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x18002c9f0]
xor edx, edx
lea r8d, [rbx + 0x17]
lea rcx, [0x18002f840]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180002d0d
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x18002c998]
xor edx, edx
lea r8d, [rbx + 0x17]
lea rcx, [0x18002e0c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x68]
call qword [rax + 0x18]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180002d0d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180002d1d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r9, rdi
mov r8, rsi
mov edx, ebx
mov rcx, qword [0x180045008]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.USER32.dll_CallNextHookEx]

Function at 0x180002d50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x60
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov r8, qword [0x18003f208]
xor r9d, r9d
lea ecx, [r9 + 4]
lea rdx, [sym.deskbar.dll_DBEHookProc]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, 0x9c4
mov qword [0x180045008], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor eax, eax
mov qword [rsp + 0x30], 0
cmp byte [section..SHARED], al
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
jne 0x180002e39
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jae 0x180002e39
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x180002e25
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x180002df0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [section..SHARED], 0
je 0x180002dc0
mov rcx, qword [0x180045008]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
add rsp, 0x60
pop rbx
ret
jmp 0x180002d50
Function at 0x180002e50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x60
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov r8, qword [0x18003f208]
xor r9d, r9d
lea ecx, [r9 + 4]
lea rdx, [sym.deskbar.dll_DBEHookProc]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, 0x9c4
mov qword [0x180045008], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor eax, eax
mov qword [rsp + 0x30], 0
cmp byte [section..SHARED], al
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
jne 0x180002e39
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jae 0x180002e39
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x180002e25
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x180002df0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [section..SHARED], 0
je 0x180002dc0
mov rcx, qword [0x180045008]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
add rsp, 0x60
pop rbx
ret
jmp 0x180002d50

Function at 0x180002e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180002e93
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180002ed6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x180002ed1
cmp rbx, r11
jae 0x180002ed6
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x180002ec0
cmp rbx, r11
jb 0x180002eda
xor eax, eax
jmp 0x180002ee6
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180003000
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call fcn.180002810
test al, al
jne 0x18000302c
xor eax, eax
lea r8, [0x180002fd0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret
Function at 0x180003990
Capabilities:
Create thread

Disassembly:
lea r8, [rcx + 0x38]
lea rcx, [0x180003960]
xor edx, edx
jmp 0x180019f08
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rbp, r8
mov r12d, edx
mov rsi, rcx
test rcx, rcx
jne 0x180019f46
call fcn.18001cf7c
mov dword [rax], 0x16
call fcn.18001d2a4
jmp 0x180019fcd
call fcn.18001717c
mov edx, 0x2c8
mov ecx, 1
call fcn.18001ff98
mov rdi, rax
test rax, rax
je 0x180019fba
call fcn.18001e010
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.18001ded4
lea r8, [0x180019e90]
mov rdx, r12
mov r9, rdi
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov qword [rdi + 8], rax
test rax, rax
jne 0x180019fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.180018b9c
test ebx, ebx
je 0x180019fcd
mov ecx, ebx
call fcn.18001cfbc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x180019fb2
mov rax, rbx
jmp 0x180019fd1
Function at 0x180004030
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rsi, rcx
lea rcx, [rbp + 0x28]
call fcn.180015810
nop
lea rcx, [rbp + 0x30]
call fcn.180015ac4
nop
mov rbx, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
mov edi, 1
mov r8d, edi
sub r8d, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, 0x104
or eax, r8d
jge 0x180004092
mov edx, 0x104
lea rcx, [rbp + 0x28]
call fcn.1800026b0
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, str.Discovery_Tools
lea rcx, [rbp - 0x10]
call fcn.180003f80
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.1800153cc
nop
mov rbx, qword [rax]
mov rcx, qword [rbp + 0x28]
mov r8d, edi
sub r8d, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, 0x104
or eax, r8d
jge 0x1800040e5
mov edx, 0x104
lea rcx, [rbp + 0x28]
call fcn.1800026b0
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004110
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x28]
sub edi, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, 0x104
or eax, edi
jge 0x180004135
mov edx, 0x104
lea rcx, [rbp + 0x28]
call fcn.1800026b0
mov rcx, qword [rbp + 0x28]
lea rdx, [0x18002ccd8]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [rbp + 0x28]
movsxd rdx, dword [rcx - 0xc]
call fcn.180019134
test eax, eax
js 0x180004202
mov rcx, qword [rbp + 0x28]
cmp eax, dword [rcx - 0xc]
jg 0x180004202
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp + 0x28]
mov byte [rcx + rax], 0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x18000418a
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.180003a90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1800041c2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800041e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1800041fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
jmp 0x18000420d
mov ecx, 0x80070057
call fcn.1800010d0
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret