joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40608f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a74], 0
push esi
jne 0x4060c6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4060a0
mov dword [ecx*4 + 0x422a70], eax
inc ecx
cmp ecx, 0x100
jl 0x40609b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4060f7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a70]
xor eax, esi
inc ecx
dec edx
jne 0x4060d9
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..idata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x575e31ac
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4c0c2eea
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x408866
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410204
push 0x4101fc
push str.FlsGetValue
push 0x21
call fcn.00408723
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40889d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4088a5
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41020c
push 0x410204
push str.FlsSetValue
push 0x22
call fcn.00408723
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4088df
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x40928a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x409147
cmp dword [eax + 0xc], ebx
je 0x4091ea
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00408ba2
aas
insb byte es:[edi], dx
mov word [ebx + 0x750c5d39], cs
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov dword [ebp + 0xc], eax
je 0x409391
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x40918a
mov dword [ebp + 0x10], edi
jmp 0x40918f
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.00408ba2
sub byte [eax + 0x458b7e06], bl
adc byte [ebx + 0x74c33b00], cl
aaa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x4091d8
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x4091b3
and eax, 0xffff
push eax
jmp 0x4091b7
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408b67
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x409391
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x409198
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x409139
invalid
call fcn.00408ba2
nop
ja 0x4091e7
std
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x409256
add eax, esi
cmp dword [eax], ebx
je 0x409256
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x409251
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40923b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x409243
cmp edx, ebx
jne 0x409391
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x409212
add eax, dword [eax + 4]
jmp 0x4091ff
mov dword [ebp + 0xc], ebx
jmp 0x409261
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x409279
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x409297
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
Function at 0xdcda34
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
jmp 0xdcda4b
push edx
lea esp, [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
jmp 0xdcd9eb
pushfd
lea esp, [esp + 4]
lea esp, [esp + 4]
jmp 0xdcda13
ret
Function at 0xdce209
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0xdce21b
mov eax, dword [esp + 4]
push edi
pushal
not bx
mov dword [esp], ecx
pushfd
lea esp, [esp + 4]
popal
test eax, eax
je 0xe153bb
jmp 0xe1539c

Function at 0xde032a
Capabilities:
Parse pe header

Disassembly:
setno al
not al
bswap ax
mov al, bl
lea eax, [eax + eax]
jmp 0xde038b
lea eax, [ecx + edi]
mov ah, bh
mov al, 0x21
mov ax, word [esp]
jmp 0xde030e
mov eax, dword [esp + 2]
lea eax, [esp + edi]
jmp 0xde036e
mov eax, dword [esp + 2]
lea eax, [esp + edi]
jmp 0xde04d0
mov ah, bh
lea eax, [0x5efb1e96]
not eax
push dword [esp + 3]
jnp 0xde0367
jp 0xde034a
sub dl, bl
lea ebx, [ecx + ebp]

Function at 0xdf3a81
Capabilities:
Encode data using xor

Disassembly:
pushal
mov word [esp + 0x19], ax
mov dword [esp + 0x14], edi
pushfd
lea esp, [esp + 0x14]
mov byte [esp + 0xb], ah
mov dword [esp + 0xb], ebp

Function at 0xdfd912
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00dce209
push eax
pop word [esp]
lea esp, [esp + 2]
push di
lea esp, [esp + 1]
jmp 0xdfda50
lea esp, [esp + 1]
jmp 0xdce244

Function at 0xdfdb3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00dce1d9
jmp 0xdce204

Function at 0xdfdd4f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushfd
lea esp, [esp + 4]
pushfd
lea esp, [esp + 4]
jmp fcn.00dcc2ab

Function at 0xdffa7d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ax
lea esp, [esp + 2]
pushal
lea esp, [esp + 0x20]
jmp fcn.00dce1d4

Function at 0xdffb26
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push si
lea esp, [esp + 2]
push di
lea esp, [esp + 2]
jmp fcn.00dce1d4
Function at 0x401900
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40190a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret 0xc

Function at 0x401930
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40193a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret 0xc
Function at 0x403598
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x554680
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 4]
mov ecx, esi
push eax
push 0x3ef
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CWnd::GetDlgItemTextA
push 0x5841ac
push 0x5841a8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Replace
add esi, 0x34c
lea ecx, [esp + 8]
push esi
call sub.MFC42.DLL_CString::operator
push 0
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
mov ecx, esi
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0xc]
push eax
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 8]
push 1
push 0
push 0
push 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x403a20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5546a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b0
push ebx
push esi
push edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], esp
push 0
push 0
push 0
push 0
push 0
push str.Minipage.exe
call sub.MFC42.DLL_CInternetSession::CInternetSession
mov eax, dword [ebp + 8]
mov ebx, 1
push 0
push 0
mov eax, dword [eax]
push ebx
push ebx
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CInternetSession::OpenURL
mov esi, eax
test esi, esi
je 0x403b70
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CFile::CFile
mov ecx, dword [ebp + 0xc]
push 0
push 0x1001
mov byte [ebp - 4], 2
mov eax, dword [ecx]
lea ecx, [ebp - 0x24]
push eax
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x403add
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00406370
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040636a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x2bc]
rep stosd dword es:[edi], eax
mov edx, dword [esi]
lea eax, [ebp - 0x2bc]
push 0x200
push eax
mov ecx, esi
call dword [edx + 0x3c]
test eax, eax
jle 0x403b15
lea ecx, [ebp - 0x2bc]
push eax
push ecx
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CFile::Write
jmp 0x403aec
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CFile::Close
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x54]
test esi, esi
je 0x403b30
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00406370
jmp 0x403b70
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CInternetSession::Close
test ebx, ebx
jne 0x403b8f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040636a
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4042d0
Capabilities:
Capture screenshot

Disassembly:
push ecx
mov eax, dword [ecx + 4]
mov dword [esp], ecx
test eax, eax
jne 0x4043a1
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
test ebp, ebp
push edi
jne 0x4042f0
xor eax, eax
jmp 0x4042f3
mov eax, dword [ebp + 0x20]
mov esi, dword [esp + 0x20]
push 2
push esi
push eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [ebp + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov edi, eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov ebx, eax
mov eax, dword [esi + 4]
sub ecx, eax
mov eax, dword [edi + 4]
push ecx
mov ecx, dword [esi]
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ebx
mov dword [ecx + 4], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi]
mov edx, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [esi + 0xc]
sub edx, eax
mov eax, dword [esi + 8]
sub eax, ecx
push edx
push eax
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [edi + 4]
mov eax, dword [ebp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x404e40
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x5c]
test eax, eax
jne 0x404f3e
mov ecx, dword [ebp + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ebx, eax
test ebx, ebx
je 0x404f3e
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404f3e
mov edx, dword [ebx + 0x20]
mov eax, dword [ebp + 0x20]
push esi
push edi
lea ecx, [esp + 0x14]
push 2
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebx + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov esi, eax
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x20]
sub eax, edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x18]
sub ecx, eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp + 0x5c], eax
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [esp + 0x30]
sub edx, eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
push edx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x10]
push ecx
push edi
call ebp
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esi + 4]
mov eax, dword [ebx + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x409b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x554af8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x40]
push esi
mov ebx, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409b92
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x409bb7
push ebp
push eax
lea ecx, [esp + 0x18]
call fcn.004067a0
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x38], 0
call fcn.00409c90
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.004067d0
mov al, bl
jmp 0x409bb9
mov edi, str.Unable_to_load_resource_
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor al, al
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x412060
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
cmp eax, 0x9ac6cdd7
jne 0x4120a2
mov dword [esp + 8], eax
lea ecx, [esi + 2]
mov edx, 9
xor ax, word [ecx]
add ecx, 2
dec edx
jne 0x41207a
cmp ax, word [esi + 0x14]
jne 0x4120a2
mov si, word [esi + 0xe]
test si, si
jbe 0x4120a2
cmp si, 0x9ec
ja 0x4120a2
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x413840
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20c]
mov dword [esi], 0x55683c
test eax, eax
je 0x413880
push eax
mov byte [esi + 0x223], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x20c]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x204]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_free]
test eax, eax
je 0x413897
push eax
call edi
add esp, 4
mov eax, dword [esi + 0x208]
test eax, eax
je 0x4138a7
push eax
call edi
add esp, 4
mov ecx, dword [esi + 0x1fc]
lea eax, [esi + 0x1fc]
test ecx, ecx
pop edi
je 0x4138c1
push eax
call fcn.0042df00
add esp, 4
mov ecx, esi
mov dword [esi], sym.MiniPage.exe_const_CxImage::vftable
call fcn.00406cb0
mov ecx, esi
call fcn.00406c00
pop esi
ret

Function at 0x416080
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.0040b2d0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x4160b2
mov dword [esp + 0x2c], 0
jmp 0x4160cd
mov ecx, ebp
call fcn.0040b2d0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.0040b2d0
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.0040b2e0
cmp eax, esi
jae 0x41610d
mov ecx, ebp
call fcn.0040b2e0
mov dword [esp + 0x10], eax
jmp 0x416111
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.0040b120
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x41617d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x416178
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.0040c540
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x41616b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.0040c9b0
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x416138
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x416126
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x41b060
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x41b090
push esi
call fcn.0041b730
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x41b089
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x41b113
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x41b0ff
mov eax, dword [esi + 8]
test eax, eax
je 0x41b0b4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x41b0fb
cmp eax, 2
je 0x41b0ff
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41b0a7
cmp eax, 3
je 0x41b0da
cmp eax, 1
jne 0x41b0a7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x41b0a7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x41b0a7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0041b140
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x41b133
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0041b140
add esp, 4
pop esi
ret
Function at 0x41e920
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.00426a40
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.00426a00
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x41e964
push edi
call fcn.00426a50
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.0041ea60
mov dword [esi + 4], fcn.0041ebb0
mov dword [esi + 8], fcn.0041ec60
mov dword [esi + 0xc], fcn.0041ed10
mov dword [esi + 0x10], 0x41edc0
mov dword [esi + 0x14], 0x41ee30
mov dword [esi + 0x18], 0x41eea0
mov dword [esi + 0x1c], 0x41f020
mov dword [esi + 0x20], 0x41f210
mov dword [esi + 0x24], fcn.0041f400
mov dword [esi + 0x28], 0x41f500
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x41e9c6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
cmp eax, ebx
je 0x41ea58
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x41ea58
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x41ea21
cmp al, 0x4d
jne 0x41ea45
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x452e90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov al, byte [edi + 0xe48]
test al, al
jne 0x452ead
push edi
call fcn.00452ef0
add esp, 4
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
jle 0x452ee4
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor edx, edx
mov ebx, esi
mov dl, byte [eax + ebp]
and ebx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edi + edx*4 + 0xa48]
xor esi, edx
inc eax
cmp eax, ecx
jl 0x452ebd
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x452ef0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor ecx, ecx
lea edx, [edi + 0xa48]
mov eax, ecx
mov esi, 8
test al, 1
je 0x452f12
shr eax, 1
xor eax, 0xedb88320
jmp 0x452f14
shr eax, 1
dec esi
jne 0x452f05
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x100
jl 0x452efe
mov byte [edi + 0xe48], 1
pop edi
pop esi
ret