joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49eb6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b60
xor eax, eax
push ebp
push 0x49eca8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004054e4
mov eax, dword [ebp - 4]
test eax, eax
je 0x49ebb8
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x49ebb8
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004056e4
test eax, eax
je 0x49ebc1
sub eax, 4
mov eax, dword [eax]
mov esi, eax
call fcn.004034d4
mov eax, 4
call fcn.004034fc
mov ebx, eax
lea eax, [ebx + 4]
mov dword [ebp - 0x18], eax
add esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
call fcn.00403094
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea edi, [eax + 1]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx + 1]
mov dword [ebp - 0x10], eax
mov eax, 0x20
call fcn.004034fc
add eax, eax
add eax, eax
or al, bl
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov esi, dword [ebp - 0x18]
dec esi
test esi, esi
jl 0x49ec30
inc esi
xor ebx, ebx
mov eax, 0x80
call fcn.004034fc
mov byte [edi + ebx], al
inc ebx
dec esi
jne 0x49ec1f
mov eax, dword [ebp - 4]
test eax, eax
je 0x49ec4f
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x49ec4f
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004056e4
test eax, eax
je 0x49ec58
sub eax, 4
mov eax, dword [eax]
mov esi, eax
dec esi
test esi, esi
jl 0x49ec7c
inc esi
xor ebx, ebx
mov eax, ebx
cdq
idiv dword [ebp - 0x18]
movzx eax, byte [edi + edx]
mov edx, dword [ebp - 4]
xor al, byte [edx + ebx]
mov edx, dword [ebp - 0x10]
mov byte [edx + ebx], al
inc ebx
dec esi
jne 0x49ec62
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0049e8f8
mov eax, dword [ebp - 0xc]
call fcn.004030b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ecaf
lea eax, [ebp - 4]
call fcn.004054e4
ret
Function at 0x49f9a8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x294], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49fa79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00406330
lea eax, [ebp - 0x290]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x49fa60
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x100]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x49fa19
push 0x7f000001
call sub.wsock32.dll_htonl
mov ebx, eax
jmp 0x49fa20
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
push ebx
call sub.wsock32.dll_ntohl
mov ebx, eax
xor ebx, 0xd7f34afc
mov esi, 6
lea eax, [ebp - 0x294]
mov edx, ebx
and edx, 0x3f
movzx edx, word [edx*2 + 0x4beff4]
call fcn.0040649c
mov edx, dword [ebp - 0x294]
mov ecx, dword [edi]
mov eax, edi
call fcn.004066d4
shr ebx, 6
dec esi
jne 0x49fa33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fa80
lea eax, [ebp - 0x294]
call fcn.00406320
ret

Function at 0x49fbdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406318
xor eax, eax
push ebp
push 0x49fc2e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004063bc
push eax
push 0x49fc38
mov eax, dword [0x4c5964]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fc35
lea eax, [ebp - 4]
call fcn.00406320
ret

Function at 0x49fc44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406318
mov eax, dword [ebp - 8]
call fcn.00406318
xor eax, eax
push ebp
push 0x49fd3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040cc14
test al, al
je 0x49fd22
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403ad8
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, 0x49fd48
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00406384
cmp dword [ebp - 8], 0
je 0x49fce8
push dword [ebp - 4]
push 0x49fd60
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004067a4
mov eax, dword [ebp - 0xc]
call fcn.0040cbcc
test al, al
jne 0x49fce8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00406384
mov eax, dword [ebp - 0xc]
call fcn.004063bc
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.004063bc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49fd22
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fd44
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406328
ret
Function at 0x4a0e1c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, ebx
mov eax, esp
call fcn.0040d7f0
add esp, 0x20c
pop ebx
ret

Function at 0x4a152c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a15ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.0040d81c
mov ebx, eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [0x4bf498]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x4a1587
mov eax, edi
mov edx, ebx
call fcn.004064ac
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
mov eax, ebx
call fcn.0040d85c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15c1
lea eax, [ebp - 4]
call fcn.00408168
ret

Function at 0x4a5010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4a50c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4bf5fc]
mov eax, dword [eax]
call fcn.0040c4f8
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 4]
mov eax, dword [0x4c59a0]
call fcn.00420a68
cmp dword [ebp - 4], 0
jne 0x4a505e
lea ecx, [ebp - 4]
mov edx, 0x4a50e0
mov eax, dword [0x4c59a0]
call fcn.00420a68
lea edx, [ebp - 0x10]
mov eax, 0x4a50f0
call fcn.00494f18
push dword [ebp - 0x10]
push 0x4a5120
push dword [ebp - 4]
push 0x4a513c
push dword [0x4c594c]
lea eax, [ebp - 8]
mov edx, 5
call fcn.004067a4
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004063bc
push eax
push 0x4a5148
mov eax, dword [0x4c5964]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a50cf
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406328
ret
Function at 0x4a7c38
Capabilities:
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4a7c41
mov eax, dword [ebp - 4]
add esp, 0xfffffddc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x4220], eax
mov dword [ebp - 0x4224], eax
mov dword [ebp - 0x4228], eax
xor eax, eax
push ebp
push 0x4a7e8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
lea eax, [ebp - 0x4010]
mov edx, 0x4000
call fcn.0049e450
mov edi, dword [ebp - 4]
shr edi, 2
dec edi
test edi, edi
jb 0x4a7d54
inc edi
lea ebx, [ebp - 0x4010]
mov eax, dword [ebx]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
jbe 0x4a7d4a
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, esi
call fcn.0049e474
push 0x104
lea ecx, [ebp - 0x421a]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0049e4a4
push esi
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x4228]
lea edx, [ebp - 0x421a]
call fcn.004064ac
mov eax, dword [ebp - 0x4228]
lea edx, [ebp - 0x4224]
call fcn.0040d140
mov eax, dword [ebp - 0x4224]
lea edx, [ebp - 0x4220]
call fcn.0040bb80
mov eax, dword [ebp - 0x4220]
mov edx, 0x4a7ea8
call fcn.0040694c
jne 0x4a7d4a
mov eax, dword [ebx]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
add ebx, 4
dec edi
jne 0x4a7ca2
mov dl, 1
mov eax, dword [0x42a514]
call fcn.0042a680
mov dword [ebp - 0x10], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.0042a720
xor eax, eax
push ebp
push 0x4a7d95
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4a7ed4
mov eax, dword [ebp - 0x10]
call fcn.0042aa84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a7d9f
xor ecx, ecx
mov edx, 0x4a7f10
mov eax, dword [ebp - 0x10]
call fcn.0042a788
xor eax, eax
push ebp
push 0x4a7dd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4a7f78
mov eax, dword [ebp - 0x10]
call fcn.0042abfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a7ddd
mov eax, dword [ebp - 0x10]
call fcn.0042a6f0
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.0042a720
xor eax, eax
push ebp
push 0x4a7e17
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4a7ed4
mov eax, dword [ebp - 0x10]
call fcn.0042aa84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a7e21
xor ecx, ecx
mov edx, 0x4a7f10
mov eax, dword [ebp - 0x10]
call fcn.0042a788
xor eax, eax
push ebp
push 0x4a7e55
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4a7f78
mov eax, dword [ebp - 0x10]
call fcn.0042abfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a7e5f
mov eax, dword [ebp - 0x10]
call fcn.0042a6f0
mov eax, dword [ebp - 0x10]
call fcn.00404318
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7e94
lea eax, [ebp - 0x4228]
mov edx, 3
call fcn.00406328
ret
Function at 0x4a965c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a97d4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4c5a00], 0
je 0x4a97b1
mov edx, dword [0x4c5a44]
cmp byte [edx + 0x40], 0
je 0x4a97b1
mov eax, dword [0x4c5a44]
mov eax, dword [eax + 0x44]
mov edx, dword [eax + 0x1c]
mov edx, dword [edx + 0x10]
cmp edx, dword [eax + 0x10]
jne 0x4a97b1
push 0
lea eax, [ebp - 0x50]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x4a97ec
call fcn.00496a6c
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.0040651c
cmp dword [ebp - 4], 0
jne 0x4a96e8
lea eax, [ebp - 4]
mov edx, 0x4a9828
call fcn.00406384
push 0x4a9844
push dword [ebp - 4]
push 0x4a985c
push 0x4a98a0
push 0x4a9934
push dword [0x4c594c]
lea eax, [ebp - 8]
mov edx, 6
call fcn.004067a4
lea eax, [ebp - 0xc]
call fcn.004a0e1c
lea eax, [ebp - 0x10]
mov ecx, 0x4a9970
mov edx, dword [ebp - 0xc]
call fcn.004066d4
mov eax, dword [0x4c5a44]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x10]
call fcn.00495784
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403ad8
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov eax, 0x4a998c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
call fcn.004063bc
mov ebx, eax
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 8]
call fcn.004063bc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.004063bc
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4a97b1
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp byte [0x4c59ff], 0
jne 0x4a97b1
push ebx
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a97db
lea eax, [ebp - 0x50]
call fcn.004054e4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406328
ret
Function at 0x4a9ee0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406318
mov eax, dword [ebp - 8]
call fcn.00406318
xor eax, eax
push ebp
push 0x4aa033
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040cbcc
test al, al
je 0x4aa010
mov dl, 1
mov eax, dword [0x41d890]
call fcn.00421de8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4aa009
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x14]
mov edx, 0x4aa050
mov eax, dword [ebp - 0xc]
call fcn.004a9af4
test al, al
je 0x4a9ff3
lea ecx, [ebp - 0x14]
mov edx, 0x4aa074
mov eax, dword [ebp - 0xc]
call fcn.004a9b8c
test al, al
je 0x4a9ff3
push 0x22
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.004a9dd4
xor eax, eax
push ebp
push 0x4a9fe9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov ecx, 0x4aa084
mov edx, dword [ebp - 4]
call fcn.004066d4
mov eax, dword [ebp - 0x18]
call fcn.004063bc
push eax
mov eax, dword [ebp - 4]
call fcn.004063bc
push eax
call sub.kernel32.dll_MoveFileW
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a9ff3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa010
mov eax, dword [ebp - 0x10]
call fcn.00404318
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa03a
lea eax, [ebp - 0x18]
call fcn.00406320
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406328
ret
Function at 0x4aa3c4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406318
xor eax, eax
push ebp
push 0x4aa53e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, 0x1a
call fcn.004a152c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0x4aa558
call fcn.004066d4
mov eax, dword [ebp - 0xc]
call fcn.0040cbcc
test al, al
je 0x4aa516
mov dl, 1
mov eax, dword [0x41d890]
call fcn.00421de8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4aa50f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x14]
mov edx, 0x4aa59c
mov eax, dword [ebp - 8]
call fcn.004a9af4
test al, al
je 0x4aa4f9
lea ecx, [ebp - 0x14]
mov edx, 0x4aa5bc
mov eax, dword [ebp - 8]
call fcn.004a9b8c
test al, al
je 0x4aa4f9
lea edx, [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.004a9cb0
xor edx, edx
push ebp
push 0x4aa4ef
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x1c]
mov edx, 0x4aa5cc
mov eax, dword [ebp - 0xc]
call fcn.0040d030
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
call fcn.004063bc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004063bc
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aa4f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa516
mov eax, dword [ebp - 0x10]
call fcn.00404318
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa545
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406328
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406328
ret
Function at 0x4aa5d8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406318
mov eax, dword [ebp - 8]
call fcn.00406318
xor eax, eax
push ebp
push 0x4aa79b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040cbcc
test al, al
je 0x4aa778
mov dl, 1
mov eax, dword [0x41d890]
call fcn.00421de8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4aa771
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x14]
mov edx, 0x4aa7b8
mov eax, dword [ebp - 0xc]
call fcn.004a9af4
test al, al
je 0x4aa75b
lea ecx, [ebp - 0x14]
mov edx, 0x4aa7fc
mov eax, dword [ebp - 0xc]
call fcn.004a9b8c
test al, al
je 0x4aa75b
push 0x22
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.004a9dd4
lea ecx, [ebp - 0x14]
mov edx, 0x4aa80c
mov eax, dword [ebp - 0xc]
call fcn.004a9af4
test al, al
je 0x4aa6c8
lea ecx, [ebp - 0x14]
mov edx, 0x4aa7fc
mov eax, dword [ebp - 0xc]
call fcn.004a9b8c
test al, al
je 0x4aa6c8
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4aa848
call fcn.004a9cb0
lea ecx, [ebp - 0x14]
mov edx, 0x4aa7b8
mov eax, dword [ebp - 0xc]
call fcn.004a9af4
test al, al
je 0x4aa75b
lea ecx, [ebp - 0x14]
mov edx, 0x4aa7fc
mov eax, dword [ebp - 0xc]
call fcn.004a9b8c
test al, al
je 0x4aa75b
xor edx, edx
push ebp
push 0x4aa751
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x18]
mov edx, 0x4aa858
mov eax, dword [ebp - 4]
call fcn.0040d030
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
call fcn.004063bc
push eax
mov eax, dword [ebp - 4]
call fcn.004063bc
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aa75b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa778
mov eax, dword [ebp - 0x10]
call fcn.00404318
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa7a2
lea eax, [ebp - 0x18]
call fcn.00406320
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406328
ret

Function at 0x4aace0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, ebx
mov eax, esp
call fcn.0040d7f0
add esp, 0x20c
pop ebx
ret
Function at 0x4aad08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4aad8c
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
sub edi, ebx
push 4
push 0xff
imul eax, esi, 0x3e8
sub eax, edi
push eax
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjectsEx
mov ebp, eax
test ebp, ebp
jne 0x4aad8c
jmp 0x4aad76
cmp dword [esp + 4], 0x12
jne 0x4aad57
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_PostQuitMessage
jmp 0x4aadb9
push 0x5300
lea eax, [esp + 4]
push eax
call sub.user32.dll_CallMsgFilterW
test eax, eax
jne 0x4aad76
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageW
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x4aad44
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
xor edx, edx
push edx
push eax
imul eax, esi, 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x4aadb1
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4aad1a
jmp 0x4aadb9
pop edx
pop eax
jg 0x4aad1a
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x168c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x168c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x168c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x168c06a
add dl, dl
jne 0x168c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x168c0dc
xor eax, eax
add dl, dl
jne 0x168c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x168c17d
add dl, dl
jne 0x168c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x168c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x168c075
mov eax, 1
add dl, dl
jne 0x168c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x168c0e1
sub eax, ebx
mov ebx, 1
jne 0x168c128
mov ecx, 1
add dl, dl
jne 0x168c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x168c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x168c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x168c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x168c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x168c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x168c136
cmp eax, 0x7d00
jae 0x168c16d
cmp eax, 0x500
jb 0x168c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x168c075
cmp eax, 0x7f
ja 0x168c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x168c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x168c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x168c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10