joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013aa54
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
rdtsc
shl rdx, 0x20
or rax, rdx
cdqe
mov qword [0x1004c43a0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
and eax, 0x80000000
lea rbp, [0x100000000]
mov dword [0x1004c4dd0], eax
cmp dword [0x1004c3558], ebx
jne 0x10013aab2
lea rcx, [0x1004c63c0]
call fcn.100573000
cmp eax, ebx
jl 0x10013aca1
mov dword [0x1004c3558], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rsp + 0x28]
mov r8d, 0x80000000
lea rcx, [0x100000000]
movsxd rdx, dword [0x10000003c]
mov edx, dword [rdx + rbp + 0x50]
add rdx, rcx
lea rax, [rdi + r8]
cmp rdx, rax
jb 0x10013aaed
lea rdi, [rdx - 0x80000000]
lea rdx, [rdi + 0xffff]
and rdx, 0xffffffffffff0000
mov rdi, qword [rsp + 0x30]
lea rax, [rdi - 0x80000000]
mov qword [0x1004c4308], rdx
cmp rcx, rax
jbe 0x10013ab1c
mov qword [0x1004c6150], rdi
jmp 0x10013ab26
add rcx, r8
mov qword [0x1004c6150], rcx
mov word [0x1004c6150], bx
mov rax, qword [0x1004c6150]
sub rax, rdx
shr rax, 0x10
mov qword [0x1004c4380], rax
mov eax, ebx
cmp eax, ebx
jl 0x10013aca1
mov rax, qword [0x1004c4328]
cmp rax, 1
jae 0x10013ab92
lea rax, [rax + rax*4]
lea rcx, [rbp + rax*8 + 0x4c3568]
call fcn.100075ab8
cmp eax, ebx
mov edx, eax
jl 0x10013ab8b
mov rax, qword [0x1004c4328]
inc rax
cmp rax, 1
mov qword [0x1004c4328], rax
jb 0x10013ab59
cmp edx, ebx
jge 0x10013ab92
mov eax, edx
jmp 0x10013aca1
mov eax, dword [0x1002a02b4]
cmp eax, ebx
je 0x10013ac2c
lea rsi, section..data
mov eax, dword [0x1002a02b4]
lea r9, [rsp + 0x78]
mov edx, dword [0x1002f8888]
mov r8d, 0x40
imul edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
jne 0x10013abee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov ecx, 0x54f
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x10013ac2e
mov eax, dword [0x1002a02b4]
mov r8, rbx
cmp eax, ebx
jbe 0x10013ac2c
mov edi, dword [0x1002f8888]
mov ecx, dword [0x1002f8888]
mov dword [rbp + r8*4 + 0x4c5a60], 0x3bd7
xor eax, eax
imul rdi, r8
add rdi, rsi
rep stosb byte [rdi], al
inc r8
mov eax, dword [0x1002a02b4]
cmp r8, rax
jb 0x10013abfb
mov ecx, ebx
cmp ecx, ebx
jge 0x10013ac36
mov eax, ecx
jmp 0x10013aca1
mov ecx, dword [0x1004c5db0]
cmp ecx, ebx
je 0x10013ac88
mov edx, dword [0x1004c5da8]
lea rdi, [0x1004c5dd8]
lea rax, [rdx + rbp + 0x4c5dd8]
mov qword [0x1004c5db8], rdi
mov qword [0x1004c5dc0], rax
mov eax, dword [0x1004c5dac]
add rdx, rax
lea rax, [rdx + rbp + 0x4c5dd8]
mov qword [0x1004c5dc8], rax
add rcx, rdx
add rcx, rdi
mov qword [0x1004c5dd0], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov eax, 0x2705d437
cmp dword [rsp + 0x70], ebx
cmovl ebx, dword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001000
Capabilities:
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
mov esi, edx
mov r11, rcx
cmp dword [rax + rcx], 0x4550
jne 0x140001094
mov eax, dword [rax + rcx + 0x88]
xor r8d, r8d
add rax, rcx
mov ebp, dword [rax + 0x1c]
mov r9d, dword [rax + 0x20]
add rbp, rcx
mov r10d, dword [rax + 0x24]
add r9, rcx
mov edi, dword [rax + 0x14]
add r10, rcx
test edi, edi
je 0x140001094
nop
movzx eax, word [r10]
mov ecx, dword [r9]
add rcx, r11
mov ebx, dword [rbp + rax*4]
mov eax, 0x1505
add rbx, r11
movsx edx, byte [rcx]
test edx, edx
je 0x140001080
nop dword [rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140001070
cmp esi, eax
je 0x1400010ab
inc r8d
add r10, 2
add r9, 4
cmp r8d, edi
jb 0x140001050
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov rax, rbx
jmp 0x140001096
Function at 0x1400014e0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rsi, rcx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov r9, qword [rax + 0x10]
mov r8, r9
nop word [rax + rax]
mov rdx, qword [r8 + 0x60]
xor edi, edi
mov eax, 0x1505
movzx ecx, word [rdx]
test ecx, ecx
je 0x14000153d
imul eax, eax, 0x21
lea rdx, [rdx + 2]
add eax, ecx
movzx ecx, word [rdx]
test ecx, ecx
jne 0x140001522
cmp eax, 0x6ddb9555
je 0x140001621
mov r8, qword [r8]
cmp qword [r8], r9
jne 0x140001510
mov rbx, rdi
mov edx, 0x5fbff0fb
mov qword [rsi + 0x40], rbx
mov rcx, rbx
call section..text
mov edx, 0xe19e5fe
mov qword [rsi + 0x50], rax
mov rcx, rbx
call section..text
mov edx, 0x382c0f97
mov qword [rsi + 0x48], rax
mov rcx, rbx
call section..text
mov qword [rsi + 0x58], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r9, qword [rax + 0x10]
mov r8, r9
nop word [rax + rax]
mov rcx, qword [r8 + 0x60]
mov eax, 0x1505
movzx edx, word [rcx]
test edx, edx
je 0x1400015c7
imul eax, eax, 0x21
lea rcx, [rcx + 2]
add eax, edx
movzx edx, word [rcx]
test edx, edx
jne 0x1400015b0
cmp eax, 0x6ddb9555
je 0x14000162a
mov r8, qword [r8]
cmp qword [r8], r9
jne 0x1400015a0
mov rbx, rdi
mov qword [rsi], rbx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov r9, qword [rax + 0x10]
mov r8, r9
nop dword [rax]
mov rcx, qword [r8 + 0x60]
mov eax, 0x1505
movzx edx, word [rcx]
test edx, edx
je 0x140001617
imul eax, eax, 0x21
lea rcx, [rcx + 2]
add eax, edx
movzx edx, word [rcx]
test edx, edx
jne 0x140001600
cmp eax, 0x22d3b5ed
je 0x140001630
mov r8, qword [r8]
cmp qword [r8], r9
jne 0x1400015f0
jmp 0x140001634
mov rbx, qword [r8 + 0x30]
jmp 0x140001548
mov rbx, qword [r8 + 0x30]
jmp 0x1400015d2
mov rdi, qword [r8 + 0x30]
mov edx, 0xeb96c5fa
mov qword [rsi + 8], rdi
mov rcx, rbx
call section..text
mov edx, 0x7891c520
mov qword [rsi + 0x10], rax
mov rcx, rbx
call section..text
mov edx, 0x71019921
mov qword [rsi + 0x18], rax
mov rcx, rbx
call section..text
mov edx, 0x3870ca07
mov qword [rsi + 0x20], rax
mov rcx, rbx
call section..text
mov edx, 0xe03908c0
mov qword [rsi + 0x28], rax
mov rcx, rbx
call section..text
mov edx, 0x554bafa9
mov qword [rsi + 0x38], rax
mov rcx, rdi
call section..text
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 0x30], rax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002170
Capabilities:
Access peb ldr_data
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140006018]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword gs:[0x30]
mov rdi, rcx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov r9, qword [rax + 0x10]
mov r8, r9
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r8 + 0x60]
xor ebp, ebp
mov eax, 0x1505
movzx edx, word [rcx]
test edx, edx
je 0x1400021ed
imul eax, eax, 0x21
lea rcx, [rcx + 2]
add eax, edx
movzx edx, word [rcx]
test edx, edx
jne 0x1400021d2
cmp eax, 0x22d3b5ed
je 0x14000230c
mov r8, qword [r8]
cmp qword [r8], r9
jne 0x1400021c0
mov rbx, rbp
mov edx, 0x307db23
mov rcx, rbx
call section..text
mov edx, 0xaadebf7a
mov rcx, rbx
mov rsi, rax
call section..text
mov edx, ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x80], rdi
cmp byte [rdi], dl
je 0x140002238
nop dword [rax + rax]
inc edx
cmp byte [rdx + rdi], bpl
jne 0x140002230
mov dword [rsp + 0x58], ebp
lea r8, [rsp + 0x78]
mov dword [rsp + 0x50], ebp
xorps xmm0, xmm0
mov dword [rsp + 0x48], ebp
mov r9d, 1
mov qword [rsp + 0x40], rbp
mov rcx, rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov word [rsp + 0x7a], dx
mov word [rsp + 0x78], dx
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
movups xmmword [rsp + 0x88], xmm0
call fcn.140002de0
mov dword [rsp + 0x60], ebp
lea rax, [rsp + 0x70]
mov dword [rsp + 0x58], ebp
lea r9, [rsp + 0x88]
mov dword [rsp + 0x50], ebp
xor r8d, r8d
mov dword [rsp + 0x48], ebp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov rcx, rsi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], rbp
call fcn.140002de0
mov rcx, qword [rsp + 0x70]
test eax, eax
cmovne rcx, rbp
mov rax, rcx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140003080
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rbx, qword [r8 + 0x30]
jmp 0x1400021f8
Function at 0x140002de0
Capabilities:
Access peb ldr_data
Hash data using djb2

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140006018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword gs:[0x30]
mov r11, rdx
mov rsi, qword [rsp + 0xd0]
mov rdi, r9
mov rbp, qword [rsp + 0xd8]
mov rbx, r8
mov r14, qword [rsp + 0xe0]
mov r10, rcx
mov rdx, qword [rax + 0x60]
mov r15, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rax, qword [rdx + 0x18]
mov r9, qword [rax + 0x10]
mov r8, r9
nop word [rax + rax]
mov rcx, qword [r8 + 0x60]
mov eax, 0x1505
movzx edx, word [rcx]
test edx, edx
je 0x140002e77
imul eax, eax, 0x21
lea rcx, [rcx + 2]
add eax, edx
movzx edx, word [rcx]
test edx, edx
jne 0x140002e60
cmp eax, 0x6ddb9555
je 0x140002e99
mov r8, qword [r8]
cmp qword [r8], r9
jne 0x140002e50
xor r9d, r9d
xor edx, edx
mov rcx, r9
cmp byte [rcx], 0xff
jne 0x140002e92
cmp byte [rcx + 1], 0x23
je 0x140002e9f
inc rcx
inc edx
jmp 0x140002e87
mov r9, qword [r8 + 0x30]
jmp 0x140002e82
mov qword [rsp + 0x48], r12
mov r8, rdi
mov qword [rsp + 0x40], r15
mov rcx, r11
movsxd rax, edx
mov rdx, rbx
add rax, r9
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x50], rax
mov r9, rsi
xor eax, eax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], r10
call fcn.140003000
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140003080
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140003954
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000399e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000399e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000399e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000399e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000399e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400039a0
xor al, al
add rsp, 0x28
ret
Function at 0x410350
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00410340
mov ebx, eax
test ebx, ebx
je 0x41039b
cmp dword [0x004836f8], 0xffffffff
jne 0x410374
mov ecx, 0xe2
call fcn.0040ab60
mov ecx, ebx
call fcn.00410320
test rax, rax
jne 0x41038d
mov ecx, 0xe2
call fcn.0040ab60
jmp 0x41039b
mov ecx, dword [0x004836f8]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x4103b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00492d64], 0
je 0x4103eb
mov ecx, dword [0x004836f8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4103ff
call fcn.00410350
mov ecx, dword [0x004836f8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4103ff
mov rax, qword [0x00492d98]
jmp 0x4103ff
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x004836f8]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x429cb0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x429cd7
movzx rax, word [rbp + 0x2c]
jmp 0x429cd9
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x42af70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.0042ad20
mov ebx, eax
mov rax, qword [0x0048d7c0]
cmp byte [rax], 0
je 0x42b0a8
mov rcx, qword [0x0048d488]
call fcn.00407100
call fcn.00405cb0
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0042af28]
mov r8d, 1
movsxd r9, esi
call fcn.0040da10
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x0042b144]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x42b0ee
mov rcx, qword [0x00492d68]
call fcn.0040db70
mov rcx, rax
mov rax, qword [0x0048d400]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0042af28]
call fcn.0040da50
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x46cb20
Capabilities:
Set registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rsp
mov rbx, rdx
mov rsi, r8
mov rdi, r9
call fcn.0040c260
mov rcx, rdi
mov rdx, rax
xor r8, r8
lea r9, [0x0046cbf8]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x54]
mov qword [rsp + 0x40], rax
call sub.advapi32.dll_RegCreateKeyExW
mov edi, eax
test edi, edi
jne 0x46cbcc
xor rdi, rdi
test rsi, rsi
je 0x46cb8a
mov edi, dword [rsi - 4]
mov rcx, rbx
call fcn.0040c260
mov rbx, rax
mov rcx, rsi
call fcn.0040c260
mov rcx, qword [rbp + 0x58]
mov rdx, rbx
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add edi, 1
add edi, edi
mov dword [rsp + 0x28], edi
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
mov rcx, qword [rbp + 0x58]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
je 0x46cbed
mov rcx, qword [0x004698a8]
mov dl, 1
mov r8, qword [0x0048d4b0]
call fcn.0042b2e0
mov rcx, rax
call fcn.0040a090
lea rsp, [rbp + 0x68]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x46cc00
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.0040c260
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
add rsp, 0x20
pop rbx
ret

Function at 0x4761d0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], r8
mov qword [rbp + 0x88], r9
mov rcx, qword [rbp + 0x70]
call fcn.0040aeb0
nop
mov byte [rbp + 0x53], 0
mov rcx, qword [rbp + 0x70]
call fcn.0040c260
mov rcx, rax
lea rdx, [rbp + 0x3c]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], 0
je 0x4762c4
mov ecx, dword [rbp + 0x4c]
call fcn.00405980
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040c260
mov rcx, rax
xor rdx, rdx
mov r8d, dword [rbp + 0x4c]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
mov rcx, qword [rbp + 0x58]
lea rdx, [0x00476350]
lea r8, [rbp + 0x40]
lea r9, [rbp + 0x54]
call sub.version.dll_VerQueryValueW
mov rax, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 8]
shr ecx, 0x10
mov dword [rax], ecx
mov rax, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 8]
and ecx, 0xffff
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 0xc]
shr ecx, 0x10
mov dword [rax], ecx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 0xc]
and ecx, 0xffff
mov dword [rax], ecx
nop
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
call fcn.004059b0
mov byte [rbp + 0x53], 1
nop
lea rcx, [rbp + 0x70]
call fcn.0040ad20
movzx rax, byte [rbp + 0x53]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x478f90
Capabilities:
Encode data using xor

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov eax, dword [0x0049753c]
sub dword [rbx + 8], eax
mov eax, dword [0x00497538]
sub dword [rbx], eax
mov esi, 0x14
mov eax, dword [rbx + 0xc]
mov ecx, dword [rbx + 8]
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 4]
mov dword [rbx + 8], ecx
mov ecx, dword [rbx]
mov dword [rbx + 4], ecx
mov dword [rbx], eax
mov eax, dword [rbx + 0xc]
add eax, eax
add eax, 1
mov ecx, dword [rbx + 0xc]
imul ecx, eax
mov edx, 5
call fcn.00478c60
mov r13d, eax
mov eax, dword [rbx + 4]
add eax, eax
add eax, 1
mov ecx, dword [rbx + 4]
imul ecx, eax
mov edx, 5
call fcn.00478c60
mov edi, eax
lea rax, [0x00497494]
mov ecx, esi
add ecx, ecx
movsxd rcx, ecx
mov edx, dword [rbx + 8]
sub edx, dword [rax + rcx*4]
mov ecx, edx
mov edx, edi
call fcn.00478c80
xor eax, r13d
mov dword [rbx + 8], eax
lea rax, [0x00497490]
mov ecx, esi
add ecx, ecx
movsxd rcx, ecx
mov edx, dword [rbx]
sub edx, dword [rax + rcx*4]
mov ecx, edx
mov edx, r13d
call fcn.00478c80
xor eax, edi
mov dword [rbx], eax
sub esi, 1
test esi, esi
jne 0x478fb3
nop
lea rax, [rbx + 0xc]
mov ecx, dword [0x00497494]
sub dword [rax], ecx
lea rax, [rbx + 4]
mov ecx, dword [0x00497490]
sub dword [rax], ecx
mov al, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x1406f3108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406f328f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406f3139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f311f
add dl, dl
jne 0x1406f3146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f31a6
xor eax, eax
add dl, dl
jne 0x1406f3155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f325d
add dl, dl
jne 0x1406f3166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f3173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f3180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f318d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406f319a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406f312e
mov eax, 1
add dl, dl
jne 0x1406f31b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f31c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f31ab
sub eax, ebx
mov ebx, 1
jne 0x1406f31fc
mov ecx, 1
add dl, dl
jne 0x1406f31de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f31eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f31d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f312e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406f3218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f3225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f320d
cmp eax, 0x7d00
jae 0x1406f324b
cmp eax, 0x500
jb 0x1406f3246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f312e
cmp eax, 0x7f
ja 0x1406f324e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f312e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406f3282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406f312e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140b06058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b061df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b06089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b0606f
add dl, dl
jne 0x140b06096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b060f6
xor eax, eax
add dl, dl
jne 0x140b060a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b061ad
add dl, dl
jne 0x140b060b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b060c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b060d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b060dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b060ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b0607e
mov eax, 1
add dl, dl
jne 0x140b06106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b06113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b060fb
sub eax, ebx
mov ebx, 1
jne 0x140b0614c
mov ecx, 1
add dl, dl
jne 0x140b0612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b0613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b06123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b0607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b06168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b06175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b0615d
cmp eax, 0x7d00
jae 0x140b0619b
cmp eax, 0x500
jb 0x140b06196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b0607e
cmp eax, 0x7f
ja 0x140b0619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b0607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b061d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b0607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20