joyce8/EMBER2024-capa huggingface dataset:
Function at 0x154dab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdee000]
push edi
jmp 0x154daca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x154dad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x154dac0
mov eax, 1
add ebx, ebx
jne 0x154dae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x154daf4
jne 0x154db13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x154db13
dec eax
add ebx, ebx
jne 0x154db00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x154dad8
add ebx, ebx
jne 0x154db0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x154db65
xor ecx, ecx
sub eax, 3
jb 0x154db2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x154db9a
sar eax, 1
mov ebp, eax
jmp 0x154db36
add ebx, ebx
jne 0x154db36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x154db04
inc ecx
add ebx, ebx
jne 0x154db44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x154db04
add ebx, ebx
jne 0x154db51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x154db46
jne 0x154db62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x154db46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x154db84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x154db76
jmp 0x154dac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x154db84
add edi, ecx
jmp 0x154dac6
pop esi
mov edi, esi
mov ecx, 0x5f08
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x154dba2
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x154dba7
lea edi, [esi + 0x114b000]
mov eax, dword [edi]
or eax, eax
je 0x154dc18
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x114dc28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x114dc64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x154dbcd
mov ecx, edi
jns 0x154dbfc
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x114dc6c]
or eax, eax
je 0x154dc12
mov dword [ebx], eax
add ebx, 4
jmp 0x154dbea
call dword [esi + 0x114dc68]
mov ebp, dword [esi + 0x114dc70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x154dc4c
sub esp, 0xffffff80
jmp 0x401470
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x401005
push ds
jmp 0x40100a
pushfd
jmp 0x40100f
jmp 0x401013
pushal
popal
popfd
pop ds
jmp fcn.004b932d
Function at 0x10029019
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x1002903d
cmp word [eax], 0x5a4d
jne 0x1002903d
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x1002903d
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x10029045
mov esp, ebp
pop ebp
ret 4

Function at 0x1002af12
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x1002afc5
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x10032ce1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x50
call fcn.10059a09
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x14
rep stosd dword es:[edi], eax
push 0x100832e3
mov ebx, dword [ebp + 0x14]
push dword [ebx]
call fcn.10001deb
add esp, 8
cmp eax, 0
jne 0x10032db7
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x1008760d
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x10032d55
mov eax, 0x100832e3
push eax
push 4
mov ebx, 0x14c
call fcn.1005d620
add esp, 0x34
push 0x80000301
push 0
push eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x10032d85
mov eax, 0x100832e3
push eax
push 2
mov ebx, 0x134
call fcn.1005afe0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10032db1
push ebx
call fcn.10059a03
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0x1c]
push dword [ebx]
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10032e10
push 0x8e
push 0x402300b
push 6
call fcn.10059a0f
add esp, 0xc
cmp dword [ebp + 0x20], 0
jne 0x10032e89
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10032e50
push 0x11e
push 0x402300b
push 6
call fcn.10059a0f
add esp, 0xc
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10032e89
push 0x141
push 0x402300b
push 6
call fcn.10059a0f
add esp, 0xc
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
jmp 0x10032e9e
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.10059a03
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10032eb2
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
push 0x1008
call fcn.10059a09
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x10150ac9
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x10032f0f
mov eax, 0
jmp 0x1003309d
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0xc]
push eax
push 0x800
mov ebx, dword [ebp - 8]
call fcn.10002376
push ebx
xor eax, eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10032f4a
push 0x80
push 0x4022fad
push 6
call fcn.10059a0f
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10033095
fild dword [ebp - 0xc]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fdiv qword [0x100841cf]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x2c], 1
fld qword [ebp - 0x24]
call fcn.1000222b
cmp eax, 0
jge 0x10032f94
push 0xe4
push 0x4022fad
push 0xa
call fcn.10059a0f
add esp, 0xc
mov dword [ebp - 0x28], eax
lea ebx, [ebp - 0x2c]
call fcn.10002376
push ecx
shl ecx, 2
add ecx, 8
push ecx
call fcn.10059a09
add esp, 4
mov edi, eax
mov dword [edi], 1
add edi, 4
pop ecx
push eax
push ecx
lea esi, [ebp - 0x28]
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ebx, dword [ebp - 8]
call fcn.10002376
pop edx
mov eax, ecx
cmp ecx, edx
jle 0x10032fd3
mov ecx, edx
sub eax, ecx
sub edx, ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
test edx, edx
je 0x10032fe9
mov ecx, edx
xor eax, eax
rep stosd dword es:[edi], eax
push dword [ebp - 8]
call fcn.10059a03
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
call fcn.1000235d
xor ecx, ecx
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x10033092
mov ebx, dword [ebp - 8]
call fcn.10002376
push ebx
push ecx
mov eax, dword [ebp - 0x10]
dec eax
jns 0x1003303e
push 0x14e
push 0x4022fad
push 4
call fcn.10059a0f
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x1003305b
push 0x14e
push 0x4022fad
push 1
call fcn.10059a0f
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
cmp dword [ebx], eax
jne 0x10033078
mov dword [ebp - 0x14], 1
push 0
mov ebx, 0x350
call fcn.1005b090
add esp, 4
pop eax
pop ebx
pop ecx
jmp 0x10033009
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x1003309d
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.10059a03
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100330b1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
cmp dword [ebp - 4], esp
je 0x100330e8
push 0x24
push 0x4023007
push 6
call fcn.10059a0f
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x100330fc
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e188
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov edi, eax
mov eax, dword [esi + 4]
bswap eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebx + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x1003e1a7
mov ebx, dword [ebp + 8]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x1003e1c3
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10040ae5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x10040b02
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x10]
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x10040b19
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10045110
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
mov eax, dword [edx]
push ebx
mov dword [esp + 0x14], ecx
mov ebx, 0x10
mov ecx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [edx + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 0xc], edx
mov edx, dword [ecx]
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
push edi
bswap esi
bswap eax
mov edi, 0x9e3779b9
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
add edx, ebp
add ecx, dword [esp + 0x14]
xor edx, ecx
lea ecx, [esi + edi]
xor edx, ecx
add eax, edx
mov edx, eax
mov ecx, eax
shl edx, 4
add edx, dword [esp + 0x18]
shr ecx, 5
add ecx, dword [esp + 0x1c]
xor edx, ecx
lea ecx, [eax + edi]
xor edx, ecx
lea edi, [edi - 0x61c88647]
add esi, edx
dec ebx
jne 0x10045151
mov ebp, dword [esp + 0x20]
bswap esi
pop edi
bswap eax
mov dword [ebp + 4], esi
mov dword [ebp], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x1004fe79
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x1004fe96
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x20]
mov ecx, ebx
lea edx, [edx + 0x57e89147]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x1004fead
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1005e6a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1005e6be
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1005e6b3
pop esi
ret

Function at 0x1005e6c0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.1007403d
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1005e72a
push esi
lea edi, [eax + 0x400]
call fcn.10074066
push edi
call fcn.1007403d
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1005e6fa
push esi
xor edi, edi
call dword [0x10155264]
add esp, 4
test eax, eax
je 0x1005e746
push eax
push esi
call fcn.1005ff80
add esp, 8
mov edi, eax
push esi
call fcn.10074066
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1005e760
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x1005e7c9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10059f70
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x1005ea20
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x1005ebb0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x1005ebc6
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
ret
or eax, 0xffffffff
ret

Function at 0x1005ebd0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x1005ec21
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.1005ebb0
add esp, 4
cmp eax, 0xffffffff
je 0x1005ec1c
push eax
call sub.WS2_32.dll_inet_ntoa
mov esi, eax
push esi
call dword [0x10155264]
push eax
push esi
call fcn.1005ff80
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x1005f800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x1005f821
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1005f87b
inc edi
cmp edi, esi
jl 0x1005f815
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x1005f8b0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1005f86a
cmp byte [eax], bl
je 0x1005f885
cmp byte [eax + 1], bl
je 0x1005f88e
cmp byte [eax + 2], bl
je 0x1005f898
cmp byte [eax + 3], bl
je 0x1005f8a4
add eax, 4
cmp eax, edi
jb 0x1005f841
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x1007761d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1007765f
call fcn.1007a0e0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1007765f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10077656
xor eax, eax
jmp 0x10077667
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1007766d
pop edi
pop esi
pop ebx
ret 4
Function at 0x420d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00420d80
add esp, 0xc
push 1
call dword [sym.imp.MSVCR100.dll_exit]
pop ebp
ret
Function at 0x42c100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x1f5
mov eax, dword [ebp - 4]
sub eax, 1
cmp eax, 0x1f4
je 0x42c13f
push 0x1f4
mov ecx, dword [ebp - 4]
sub ecx, 1
push ecx
push str._RCSfile:_outilparutils.cxx_v__
push str.file__s_:_internal_error__size_mismatch:_._noutilpar.inc_size_d__dtbmax.inc_size_d_nAborting._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x433db0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
xor bl, bl
push esi
cmp byte [esp + 0x34], bl
je 0x433e4b
fld qword [0x4a4e28]
cmp byte [0x73b890], bl
je 0x433dd5
fdiv qword [0x4adf68]
mov esi, dword [0x73b8a8]
fst qword [esp + 0x24]
cmp esi, 0x1e
jle 0x433e0c
fmul qword [0x4a4e20]
fstp qword [esp + 8]
fild dword [0x73b8a8]
call sub.libmmd.dll__CIlog
call sub.libmmd.dll__CIlog
fdivr qword [esp + 8]
fst qword [esp + 0x2c]
fld qword [esp + 0x24]
jmp 0x433e1a
fld qword [0x4a4e20]
fmul st(1)
fst qword [esp + 0x2c]
fxch st(1)
fld st(0)
fld qword [0x4a4e18]
fmul st(1), st(0)
fxch st(3)
fcom st(1)
fnstsw ax
test ah, 5
jp 0x433e37
fstp st(0)
fst qword [esp + 0x2c]
jmp 0x433e39
fstp st(1)
cmp esi, 0x3d090
jle 0x433e51
fmulp st(2)
fxch st(1)
fstp qword [esp + 0x2c]
jmp 0x433e55
fld qword [esp + 0x24]
jmp 0x433e55
fstp st(0)
fstp st(1)
fcomp qword [0x4a4cd0]
fnstsw ax
test ah, 0x41
jnp 0x433f29
cmp byte [esp + 0x38], bl
je 0x433e7a
cmp byte [esp + 0x3c], bl
je 0x433e7a
mov byte [esp + 0x3c], bl
mov byte [esp + 0x38], bl
call fcn.00434160
test al, al
jne 0x433ee0
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x4ada54
push 0x4ada84
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.API_ComputeOff:_VD_not_known_or_not_up_to_date_
push 0x4adac4
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
mov eax, dword [esp + 0x3c]
fld qword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x24]
sub esp, 0x10
fstp qword [esp + 8]
mov byte [0x4b041c], 1
fld qword [esp + 0x40]
fstp qword [esp]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
push 0x7fffffff
call fcn.00433330
add esp, 0x30
pop esi
pop ebx
add esp, 8
ret
Function at 0x43b0e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
test eax, eax
jne 0x43b158
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x4aee14
push 0x4aee44
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.vd_OpenFile_____I_O_file_could_not_be_opened__n
push 0x4aee84
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
pop ebx
ret
Function at 0x43b370
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4ae834
push eax
mov dword [esp + 0x28], 0
call fcn.0043b0e0
lea ecx, [esp + 0x28]
mov esi, eax
push ecx
push esi
call fcn.0044f730
add esp, 0x10
test al, al
jne 0x43b401
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4ae838
push 0x4ae860
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPoly_____premature_end_of_file__n
push 0x4ae898
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x43b422
add eax, 0xa
push eax
call fcn.00435d10
mov edx, dword [esp + 0x24]
add edx, 0xa
push edx
call fcn.00435de0
add esp, 8
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
call fcn.0044f7c0
add esp, 0x10
test al, al
jne 0x43b483
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4ae8a8
push 0x4ae8d0
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadContour_____premature_end_of_file__n
push 0x4ae908
jmp 0x43b3e6
mov eax, dword [0x4a4dfc]
fld qword [esp + 0x30]
push eax
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00436210
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x48]
mov dword [esp + 0x40], eax
mov edi, eax
push edx
lea eax, [esp + 0x54]
push eax
push esi
call fcn.0044f7c0
add esp, 0x24
test al, al
je 0x43b4ff
mov ecx, dword [esp + 0x24]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
lea edx, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push edx
call fcn.00436290
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x58]
push edx
push esi
call fcn.0044f7c0
add esp, 0x28
test al, al
jne 0x43b4c2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push edi
push ecx
call fcn.004363f0
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp edi, 0xffffffff
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret