joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29a94c90
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
cmp dword [eax + 8], 1
je 0x29a94ca2
call fcn.29a9f890
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x29a94cc2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x29a94cb8
mov dword [eax], 0
mov eax, 1
pop edi
pop ecx
ret 0xc
mov edx, dword [esp + 0xc]
push ebx
push ebp
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edi + 0x218]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [edi + 0x220]
mov ecx, dword [esp + 0xc]
mov ebx, dword [edi + 0x224]
mov edx, dword [esp + 0x1c]
add ebp, ecx
adc ebx, 0
test edx, edx
mov dword [esp + 0x18], eax
mov dword [edi + 0x220], ebp
mov dword [edi + 0x224], ebx
je 0x29a94d0d
mov dword [edx], ecx
test eax, eax
jne 0x29a94dc6
mov eax, dword [edi + 8]
mov edx, dword [eax + 8]
mov ecx, 3
cmp edx, ecx
je 0x29a94d27
mov dword [eax + 8], ecx
push esi
mov esi, dword [edi + 8]
mov edx, dword [esi]
lea ebx, [esi + 0x1c]
push ebx
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
lea ebp, [esi + 0x20]
push ebp
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x29b42294]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebp
mov ecx, esi
call dword [edx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [edi + 8]
call fcn.29a96dd0
mov ecx, dword [edi + 0x218]
mov edx, dword [edi + 8]
push ecx
push str._IXStream__Handle__p_
call fcn.29a9fd50
mov edx, dword [edi + 0x230]
push edx
mov edx, dword [edi + 8]
push str._IXStream__Access__x_
call fcn.29a9fd50
mov eax, dword [edi + 0x234]
mov ecx, dword [edi + 8]
push eax
push 0x6d68
push 0x29b42288
push ecx
call fcn.29a9faa0
mov edx, dword [edi + 0x234]
mov ecx, dword [edi + 8]
add esp, 0x20
push edx
push 1
call fcn.29a9ff10
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret 0xc
Function at 0x29a95f30
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov esi, eax
call edi
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esp + 0x14], eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x29a95fe9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.29a9f890
test ebp, ebp
jne 0x29a95fe9
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a95f8e
mov dword [esi + 8], eax
mov eax, edi
call fcn.29a96dd0
mov edx, dword [esi]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
lea ebx, [esi + 0x20]
push ebx
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x29b42294]
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
mov edi, dword [esp + 0x18]
push edi
push 0x6ddb
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0x10
push edi
push 1
mov ecx, esi
call fcn.29a9ff10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret

Function at 0x29a96000
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
push 1
mov esi, eax
call ebp
push ebx
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x29a96093
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x29a96093
push ebx
mov eax, esi
lea edi, [esp + 0x14]
call fcn.29a965e0
add esp, 4
test eax, eax
je 0x29a9608a
mov eax, dword [esp + 0x10]
and eax, 0xfffffffe
push eax
push ebx
mov eax, esi
call fcn.29a966c0
add esp, 8
test eax, eax
je 0x29a9608a
push ebx
mov eax, esi
call fcn.29a95f30
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
test esi, esi
je 0x29a96114
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, esi
call fcn.29a9f890
test edi, edi
jne 0x29a96114
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a960b9
mov dword [esi + 8], eax
mov eax, ebp
call fcn.29a96dd0
mov edx, dword [esi]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
lea ebp, [esi + 0x20]
push ebp
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x29b42294]
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebp
mov ecx, esi
call dword [edx + 8]
push ebx
push 0x6ddb
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0x10
push ebx
push 1
mov ecx, esi
call fcn.29a9ff10
mov edi, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x29a96120
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov esi, eax
call edi
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esp + 0x14], eax
call edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x29a961f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.29a9f890
test ebp, ebp
jne 0x29a961f4
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a96189
mov dword [esi + 8], eax
mov eax, edi
call fcn.29a96dd0
mov eax, dword [esi]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call dword [eax + 0x18]
mov edx, dword [esi]
lea ebx, [esi + 0x20]
push ebx
mov ecx, esi
call dword [edx + 0x18]
mov ecx, dword [0x29b42294]
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push edi
push ebx
push 0x6ddd
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0x14
push edi
push 1
mov ecx, esi
call fcn.29a9ff10
push ebx
push 2
mov ecx, esi
call fcn.29a9ff10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x29a965e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
push esi
push 1
mov esi, eax
call ebx
mov ebp, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov dword [esp + 0x10], eax
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [edi]
xor ebx, ebx
cmp ecx, 0xffffffff
setne bl
test esi, esi
je 0x29a966a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, esi
call fcn.29a9f890
test ebx, ebx
jne 0x29a966a9
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a9664b
mov dword [esi + 8], eax
mov eax, ebp
call fcn.29a96dd0
mov edx, dword [esi]
lea ebx, [esi + 0x1c]
push ebx
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
lea ebp, [esi + 0x20]
push ebp
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x29b42294]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebp
mov ecx, esi
call dword [edx + 8]
mov ebx, dword [esp + 0x14]
mov ecx, dword [edi]
push ebx
push ecx
push 0x6de2
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0x14
push ebx
push 1
mov ecx, esi
call fcn.29a9ff10
mov ecx, dword [edi]
pop esi
xor eax, eax
cmp ecx, 0xffffffff
pop ebp
setne al
pop ebx
pop ecx
ret

Function at 0x29a966c0
Capabilities:
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov esi, eax
call edi
mov ecx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esp + 0x14], eax
call edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x29a96788
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.29a9f890
test ebp, ebp
jne 0x29a96788
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a96727
mov dword [esi + 8], eax
mov eax, edi
call fcn.29a96dd0
mov eax, dword [esi]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call dword [eax + 0x18]
mov edx, dword [esi]
lea ebx, [esi + 0x20]
push ebx
mov ecx, esi
call dword [edx + 0x18]
mov ecx, dword [0x29b42294]
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push 0x6de2
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0x14
push edi
push 1
mov ecx, esi
call fcn.29a9ff10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x29a96790
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
push esi
push edi
push 1
mov esi, eax
call ebx
mov ebp, eax
mov eax, dword [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov dword [esp + 0x14], eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x29a96847
test esi, esi
je 0x29a9683f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.29a9f890
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a967f3
mov dword [esi + 8], eax
mov eax, edi
call fcn.29a96dd0
mov edx, dword [esi]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
lea ebx, [esi + 0x20]
push ebx
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x29b42294]
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
push 0x6de5
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, 0x104
cmp ecx, edi
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
pop ecx
ret
Function at 0x29a96860
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push edi
push 1
mov esi, eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [esp + 0x130]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x138]
push 0
push eax
push ecx
call ebp
mov edi, eax
test edi, edi
jne 0x29a9690c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x29a9690c
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x1c], 4
jne 0x29a9690c
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x29a9690c
cmp dword [esp + 0x28], 2
jne 0x29a9690c
mov dword [esp + 0x10], 0x64
jmp 0x29a968e0
mov eax, dword [esp + 0x134]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x130]
push ebx
push 0
push eax
dec edx
push ecx
mov dword [esp + 0x20], edx
call ebp
mov edi, eax
test edi, edi
je 0x29a9690c
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x29a968e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edx, dword [esp + 0x14]
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test edi, edi
setne al
test esi, esi
mov ebp, eax
je 0x29a969af
call ebx
mov edi, eax
mov eax, esi
call fcn.29a9f890
test ebp, ebp
jne 0x29a969af
mov ecx, dword [esi + 8]
mov eax, 3
cmp ecx, eax
je 0x29a96953
mov dword [esi + 8], eax
mov eax, edi
call fcn.29a96dd0
mov edx, dword [esi]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
lea ebx, [esi + 0x20]
push ebx
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x29b42294]
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x29b42298]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 8]
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x130]
push ecx
push edx
push 0x6de6
push 0x29b42288
push esi
call fcn.29a9fa70
add esp, 0x14
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x11c
ret
Function at 0x29a96d20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
mov esi, eax
push edi
push esi
call ebx
add esp, 4
inc eax
cmp eax, 0x105
jbe 0x29a96d4a
mov eax, 0x105
lea ecx, [eax + eax - 2]
mov edx, ecx
shr ecx, 2
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
mov word [esp + eax*2 + 0xe], 0
call fcn.29a9b650
mov eax, edi
push eax
call ebx
add esp, 4
test eax, eax
jbe 0x29a96d95
cmp word [esp + eax*2 + 0xe], 0x5c
je 0x29a96d95
mov ecx, edi
push 0x29b4ac94
push ecx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
lea edx, [esp + 0x10]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esp + 0x10], eax
call esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x29a99100
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x29b27461
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [edi + 0x14], 1
mov dword [edi + 0x18], 0x1e
mov dword [edi + 8], 4
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 4], 0x29b4ae6c
mov dword [edi + 0x20], ebx
lea ebp, [edi + 0x24]
mov dword [ebp], 0x29b4b5a0
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], 0x60
mov dword [edi + 0x38], ebx
mov dword [edi + 0xfc], ebx
mov dword [esp + 0x1c], ebx
mov dword [edi], 0x29b4aeb8
mov dword [edi + 0x108], ebx
push 0x20
mov byte [esp + 0x20], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
je 0x29a991a2
mov esi, eax
call fcn.29a7c9a0
mov esi, eax
jmp 0x29a991a4
xor esi, esi
mov byte [esp + 0x1c], 1
mov dword [edi + 0x100], esi
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x74]
cmp esi, ebx
mov dword [ebp + 4], esi
je 0x29a991c1
inc dword [esi + 4]
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x104], ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x29a9fe70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x29b28018
push eax
mov dword fs:[0], esp
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0
mov edi, dword [eax]
push edi
mov eax, ebx
call fcn.29a9b910
inc eax
lea ecx, [eax + eax + 2]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
push edi
mov esi, eax
push ebx
push esi
mov dword [esp + 0x30], esi
call dword [sym.imp.MSVCRT.dll_vswprintf]
add esp, 0x14
test esi, esi
je 0x29a9fefa
cmp word [esi], 0
je 0x29a9fef0
mov eax, dword [ebp + 0x14]
test eax, eax
lea edi, [ebp + 0x14]
je 0x29a9fee6
mov edx, dword [ebp]
push 0x29b46bcc
push edi
mov ecx, ebp
call dword [edx + 0x14]
test eax, eax
je 0x29a9fef0
mov eax, dword [ebp]
push esi
push edi
mov ecx, ebp
call dword [eax + 0x14]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 8
Function at 0x29aa3280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x24]
push esi
push edi
mov dword [esp + 0x14], eax
jmp 0x29aa3295
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0x6c]
mov ebx, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x64]
sub ebx, edx
mov edx, dword [ebp + 0x24]
lea edx, [eax + edx - 0x106]
sub ebx, ecx
cmp ecx, edx
jb 0x29aa331f
mov edi, dword [ebp + 0x30]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea esi, [edi + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x68]
mov edx, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x54]
sub esi, eax
sub edx, eax
sub ecx, eax
mov dword [ebp + 0x68], esi
mov esi, dword [ebp + 0x44]
mov dword [ebp + 0x54], ecx
mov ecx, dword [ebp + 0x3c]
mov dword [ebp + 0x64], edx
lea edx, [ecx + esi*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x29aa32f6
sub ecx, eax
jmp 0x29aa32f8
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x29aa32e7
mov edx, dword [ebp + 0x38]
mov esi, eax
lea edx, [edx + eax*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x29aa3315
sub ecx, eax
jmp 0x29aa3317
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x29aa3306
add ebx, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x29aa3388
mov ecx, dword [ebp + 0x6c]
mov edx, dword [ebp + 0x64]
mov edi, dword [ebp + 0x30]
add ecx, edx
add ecx, edi
push ecx
mov ecx, ebx
mov ebx, eax
call fcn.29aa2f40
mov ecx, dword [ebp + 0x6c]
add ecx, eax
mov edx, ecx
add esp, 4
cmp edx, 3
mov dword [ebp + 0x6c], ecx
jb 0x29aa3372
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebp + 0x50]
mov dword [ebp + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebp + 0x4c]
mov dword [ebp + 0x40], eax
cmp edx, 0x106
jae 0x29aa3388
mov edx, dword [ebp]
mov eax, dword [edx + 4]
test eax, eax
jne 0x29aa3291
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x29aa6160
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push edi
xor edi, edi
xor eax, eax
lea ecx, [ecx]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x29aa6170
mov eax, 1
sub eax, esi
mov dword [esp + 0x10], eax
mov eax, 2
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, 3
sub eax, esi
mov dword [esp + 0xc], edi
mov ecx, esi
mov dword [esp + 0x18], eax
mov al, byte [ecx]
mov byte [esp + 0xb], al
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
xor eax, eax
mov al, byte [esp + 0xb]
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
mov al, byte [esp + 0xb]
and edx, 0xff
mov edi, edx
mov dl, byte [edi + esi]
mov byte [ecx], dl
mov byte [edi + esi], al
mov dl, byte [ecx + 1]
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb], dl
add eax, ecx
xor edx, edx
div ebp
xor eax, eax
mov al, byte [esp + 0xb]
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
mov al, byte [esp + 0xb]
and edx, 0xff
mov edi, edx
mov dl, byte [edi + esi]
mov byte [ecx + 1], dl
mov byte [edi + esi], al
mov dl, byte [ecx + 2]
mov eax, dword [esp + 0x14]
mov byte [esp + 0xb], dl
add eax, ecx
xor edx, edx
div ebp
xor eax, eax
mov al, byte [esp + 0xb]
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
mov al, byte [esp + 0xb]
and edx, 0xff
mov edi, edx
mov dl, byte [edi + esi]
mov byte [ecx + 2], dl
mov byte [edi + esi], al
mov dl, byte [ecx + 3]
mov eax, dword [esp + 0x18]
mov byte [esp + 0xb], dl
add eax, ecx
xor edx, edx
div ebp
xor eax, eax
mov al, byte [esp + 0xb]
add ecx, 4
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
mov al, byte [esp + 0xb]
and edx, 0xff
mov edi, edx
mov dl, byte [edi + esi]
mov byte [ecx - 1], dl
mov byte [edi + esi], al
mov eax, dword [esp + 0xc]
add eax, 4
cmp eax, 0x100
mov dword [esp + 0xc], eax
jl 0x29aa61a2
xor eax, eax
pop edi
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], eax
pop ebp
add esp, 0x14
ret

Function at 0x29aa62a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
test ecx, ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [eax + 0x100]
push edi
mov edi, dword [eax + 0x104]
jbe 0x29aa6304
mov dword [esp + 0xc], ecx
push ebx
lea ecx, [ecx]
xor ebx, ebx
inc esi
and esi, 0xff
mov cl, byte [esi + eax]
mov bl, cl
add ebx, edi
and ebx, 0xff
mov edi, ebx
mov bl, byte [edi + eax]
mov byte [esi + eax], bl
mov byte [edi + eax], cl
xor ebx, ebx
mov bl, byte [esi + eax]
add ebx, ecx
and ebx, 0xff
mov cl, byte [ebx + eax]
xor cl, byte [edx]
mov byte [ebp], cl
mov ecx, dword [esp + 0x10]
inc ebp
inc edx
dec ecx
mov dword [esp + 0x10], ecx
jne 0x29aa62c0
pop ebx
mov dword [eax + 0x104], edi
pop edi
mov dword [eax + 0x100], esi
pop esi
pop ebp
pop ecx
ret
Function at 0x29aabb70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
test eax, eax
je 0x29aabb8c
lea edx, [esp]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x29aabb80
jmp 0x29aabbbd
mov eax, dword [str.C:TEMPFONTE.TTF]
mov ecx, dword [0x29b4b980]
mov edx, dword [0x29b4b984]
mov dword [esp], eax
mov eax, dword [0x29b4b988]
mov dword [esp + 4], ecx
mov cx, word [0x29b4b98c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov word [esp + 0x10], cx
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
push edi
push edx
mov edx, dword [esp + 0x11c]
push eax
push ecx
push edx
mov edx, dword [esp + 0x11c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x11c]
xor ecx, ecx
call fcn.29aaba10
lea ecx, [esp + 0x18]
push 0x29b48308
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x29aabc19
pop edi
add esp, 0x100
ret
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 2
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push edi
mov esi, eax
call ebx
mov edx, dword [esp + 0x138]
mov ebx, dword [esp + 0x134]
add esp, 0x1c
test esi, esi
mov dword [edx], esi
jbe 0x29aabc78
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
cmp esi, 0xffff
mov eax, esi
jbe 0x29aabc65
mov eax, 0xffff
push edi
push eax
push 1
push ebx
call ebp
sub esi, eax
add esp, 0x10
add ebx, eax
test esi, esi
ja 0x29aabc56
pop ebp
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 8
pop esi
pop ebx
mov eax, 1
pop edi
add esp, 0x100
ret

Function at 0x29aad120
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
test eax, eax
jne 0x29aad130
mov eax, 1
add esp, 8
ret
push edi
push 0x29b4bfa0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x29aad150
mov eax, 1
pop edi
add esp, 8
ret
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push eax
call fcn.29aacdc0
add esp, 0x10
test eax, eax
jne 0x29aad1a7
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebx
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov esi, eax
sub esi, ebx
neg esi
sbb esi, esi
push edi
and esi, 2
call dword [sym.imp.MSVCRT.dll_fclose]
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x18
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret