joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6199b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.0050de20
mov eax, dword [0x6b6538]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x619a10
push 0x4d4
push 0x69ede4
push str.assertion_failed:_rec__orig_len___md_size
call fcn.0056a2d0
add esp, 0xc
cmp ebx, 0x40
jbe 0x619a2c
push 0x4d5
push 0x69ede4
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.0056a2d0
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x619a5a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.00526600
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x619b0d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x619a95
xor edx, edx
test ebx, ebx
je 0x619b41
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x619b17
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0050ce82
add esp, 0xa8
ret
Function at 0x61a680
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0050de20
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x61a6cd
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x61a6bd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x61a6d2
cmp edi, dword [esi + 8]
ja 0x61a6b4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.005576f0
push eax
call fcn.00553c20
add esp, 8
test eax, 0x200000
je 0x61a718
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x61a7a4
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x61a760
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x61f2b0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x61f2cb
push eax
push esi
call fcn.0061f8f0
add esp, 8
test eax, eax
jle 0x61f313
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.005539d0
add esp, 8
test edi, edi
jg 0x61f310
push edi
call fcn.0059bc50
add esp, 4
test eax, eax
je 0x61f310
push 0xa
push esi
call fcn.00554130
add esp, 8
mov eax, edi
pop edi
pop esi
ret

Function at 0x469dba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x469dba
lcall 0x5de5, 0x8b10c483
jmp loc.009b2608
Function at 0x47675c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor ecx, 0x41435333
cmp edx, 4
jl 0x476774
xor dword [eax], ecx
sub edx, 4
add eax, 4
cmp edx, 4
jge 0x476767
ret

Function at 0x4d0ed8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x3d4], eax
push 0
mov eax, ebx
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4d0ef4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov ebx, edx
mov esi, eax
mov dword [esi + 0x3d4], ebx
mov eax, dword [esi + 0x3e0]
xor edx, edx
call sub.AIMP.Runtime.dll__Acl_Classes_Timer_TACLTimer_SetEnabled_qqro
push 0
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
call sub.AIMP.Runtime.dll__Acl_Utils_Desktop_MonitorGet_qqrui
call sub.AIMP.Runtime.dll__Acl_Utils_Desktop_MonitorIsFullScreenApplicationRunning_qqrp29Acl_Utils_Desktop_TACLMonitor
test al, al
jne 0x4d1015
call fcn.00512060
mov eax, dword [eax + 0x78]
mov edx, ebx
call fcn.004be358
mov edx, eax
mov eax, dword [esi + 0x3dc]
call sub.AIMP.Runtime.dll__Acl_Graphics_Skinimage_TACLSkinImage_Assign_qqrp14System_TObject
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0x3dc]
call sub.AIMP.Runtime.dll__Acl_Graphics_Skinimage_TACLSkinImage_GetFrameSize_qqrv
lea eax, [esp + 0x1c]
push eax
mov eax, ebx
call sub.AIMP.Runtime.dll__Vcl_Forms_TCustomForm_GetPixelsPerInch_qqrv
mov edx, eax
mov eax, dword [esi + 0x3dc]
mov ecx, dword [eax + 0x80]
pop eax
call sub.AIMP.Runtime.dll__Acl_Geometry_acSizeScale_qqrrx18System_Types_TSizeii
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x20]
call sub.AIMP.Runtime.dll__Acl_Utils_Desktop_MouseCursorPos_qqrv
lea edx, [esp + 0x20]
mov eax, dword [esi + 0x3d4]
mov eax, dword [eax + 0x44c]
mov eax, dword [eax + 0x24]
lea ecx, [eax + 0x28]
mov eax, dword [0x4ce64c]
call fcn.004d0a04
mov edx, esp
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TControl_SetBoundsRect_qqrrx18System_Types_TRect
mov eax, dword [0x775598]
cmp byte [eax], 0
je 0x4d0ffd
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SetWindowPos
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xb8]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc4]
jmp 0x4d1015
call sub.kernel32.dll_GetTickCount
mov dword [esi + 0x3d8], eax
mov eax, dword [esi + 0x3e0]
mov dl, 1
call sub.AIMP.Runtime.dll__Acl_Classes_Timer_TACLTimer_SetEnabled_qqro
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x4d9e48
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
push ebx
push edi
movzx eax, byte [ebp - 1]
push eax
mov ecx, esi
mov dl, 1
mov eax, dword [0x4d9ca0]
call fcn.004de628
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d9f1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov byte [eax + 0x28], 0
push 0
mov eax, dword [ebp - 8]
call fcn.004de6b0
test bl, bl
je 0x4d9ebf
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4d9ebf
push 5
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, esi
call fcn.0051b3d8
test edi, edi
jbe 0x4d9edc
cmp dword [esi + 0x40], 0
jne 0x4d9edc
mov eax, esi
call fcn.0051afc0
test al, al
je 0x4d9edc
mov eax, dword [ebp - 8]
call sub.AIMP.Runtime.dll__Acl_Ui_Animation_TACLAnimation_RunImmediate_qqrv
push 0x42c80000
mov eax, dword [ebp - 8]
call fcn.004de6b0
test bl, bl
jne 0x4d9efc
push 0
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov edx, dword [sym.imp.AIMP.Runtime.dll__Acl_Utils_Common_NullPoint]
mov eax, esi
call fcn.0051bb88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9f26
mov eax, dword [ebp - 8]
call sub.AIMP.Runtime.dll__System_TObject_Free_qqrv
ret
Function at 0x5804b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58054a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x414]
call sub.AIMP.Runtime.dll__Acl_Ui_Controls_Buttons_TACLCustomCheckBox_GetChecked_qqrv
mov byte [esi + 0x29], al
mov eax, dword [ebx + 0x430]
call sub.AIMP.Runtime.dll__Acl_Ui_Controls_Buttons_TACLCustomCheckBox_GetChecked_qqrv
mov edx, eax
mov eax, esi
call fcn.0059f468
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0x418]
call sub.AIMP.Runtime.dll__Acl_Ui_Controls_Buttons_TACLCustomCheckBox_GetChecked_qqrv
mov edx, dword [ebx + 0x424]
mov edx, dword [edx + 0x348]
xor ecx, ecx
call sub.AIMP.Runtime.dll__System_Strutils_IfThen_qqrox20System_UnicodeString20System_UnicodeString
mov edx, dword [ebp - 4]
lea eax, [esi + 0xc]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [esi + 0x30]
mov edx, dword [ebx + 0x420]
mov edx, dword [edx + 0x348]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580551
lea eax, [ebp - 4]
call sub.AIMP.Runtime.dll__System__UStrClr_qqrpv
ret
Function at 0x5969a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x596aa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x30]
mov edx, edi
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
test esi, esi
sete al
mov byte [ebx + 0x20], al
lea eax, [ebx + 0xc]
mov edx, esi
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
cmp byte [ebx + 0x20], 0
je 0x5969fa
lea eax, [ebp - 4]
call sub.AIMP.Runtime.dll__Acl_Utils_Common_aclGenerateGUID_qqrv
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0059a0a0
jmp 0x596a56
call sub.AIMP.Shared.dll__Aimp_Playlists_Formats_PlaylistFormatManager_qqrv
lea ecx, [ebx + 0x40]
mov edx, esi
call sub.AIMP.Shared.dll__Aimp_Playlists_Formats_TAIMPPlaylistFormatManager_LoadSummary_qqrx20System_UnicodeStringr41Aimp_Playlists
movzx eax, byte [ebx + 0x70]
mov byte [ebx + 0x38], al
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x60]
mov eax, dword [ebx + 0x30]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_IfThenW_qqrx20System_UnicodeStringt1
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x30]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea edx, [ebp - 0x10]
mov eax, esi
call sub.AIMP.Runtime.dll__Acl_Utils_Filesystem_WideExtractFileNameWithoutExt_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x30]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_IfThenW_qqrx20System_UnicodeStringt1
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x30]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, dword [ebx + 0x5c]
mov eax, ebx
call fcn.0059a0a0
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0x30]
mov edx, 0x596ac4
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_IfThenW_qqrx20System_UnicodeStringt1
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x30]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, ebx
call fcn.005983c8
movzx edx, word [0x596adc]
mov eax, ebx
call fcn.0059831c
mov eax, ebx
call fcn.00598f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x596aaf
lea eax, [ebp - 0x14]
mov edx, 5
call sub.AIMP.Runtime.dll__System__UStrArrayClr_qqrpvi
ret
Function at 0x5bed3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5bedc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push 0
mov edx, dword [ebx + 0x30]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
call sub.AIMP.Runtime.dll__Acl_Ui_Popupmenu_TMenuItemHelper_AddItem_qqrx20System_UnicodeStringiynpqqrp14System_TObject_vus
mov esi, eax
mov eax, ebx
call fcn.0059710c
mov edx, eax
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Menus_TMenuItem_SetEnabled_qqro
cmp byte [ebx + 0x38], 0
je 0x5bedb1
push dword [esi + 0x40]
push 0x5bede4
mov eax, dword [0x775430]
push dword [eax]
push 0x5bedf8
lea eax, [ebp - 4]
mov edx, 4
call sub.AIMP.Runtime.dll__System__UStrCatN_qqrv
mov edx, dword [ebp - 4]
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Menus_TMenuItem_SetCaption_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bedce
lea eax, [ebp - 4]
call sub.AIMP.Runtime.dll__System__UStrClr_qqrpv
ret
Function at 0x700090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.006ff03c
test al, al
je 0x7000b0
mov eax, esi
call fcn.006ff03c
test al, al
jne 0x7000b4
xor ebx, ebx
jmp 0x7000b6
mov bl, 1
test bl, bl
je 0x700184
xor eax, eax
push ebp
push 0x700178
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [edi + 0x28]
mov edx, dword [esi + 0x40]
mov eax, dword [edi + 0x40]
call fcn.0070018c
mov eax, dword [esi + 0x2c]
push eax
mov ecx, dword [edi + 0x2c]
mov edx, dword [esi + 0x44]
mov eax, dword [edi + 0x44]
call fcn.0070018c
mov eax, dword [esi + 0x30]
push eax
mov ecx, dword [edi + 0x30]
mov edx, dword [esi + 0x48]
mov eax, dword [edi + 0x48]
call fcn.0070018c
mov eax, dword [esi + 0x34]
push eax
mov ecx, dword [edi + 0x34]
mov edx, dword [esi + 0x4c]
mov eax, dword [edi + 0x4c]
call fcn.0070018c
mov eax, dword [esi + 0x38]
push eax
mov ecx, dword [edi + 0x38]
mov edx, dword [esi + 0x50]
mov eax, dword [edi + 0x50]
call fcn.0070018c
mov eax, dword [esi + 0x3c]
push eax
mov ecx, dword [edi + 0x3c]
mov edx, dword [esi + 0x54]
mov eax, dword [edi + 0x54]
call fcn.0070018c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x700184
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x719c2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x719da6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.006ff03c
mov ebx, eax
test bl, bl
je 0x719d8b
xor eax, eax
push ebp
push 0x719d7f
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 8]
call sub.AIMP.Shared.dll__Aimp_Filemanager_FileMarkToInteger_qqrf
mov dword [edi + 0x1c], eax
cmp byte [ebp - 1], 1
cmc
sbb eax, eax
mov dword [edi + 4], eax
mov eax, dword [esi + 0x96]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x9a]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0xa2]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0xa6]
mov dword [edi + 0x20], eax
lea edx, [ebp - 8]
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetTrackNumber_qqrv
mov eax, dword [ebp - 8]
xor edx, edx
call sub.AIMP.Runtime.dll__System_Sysutils_StrToIntDef_qqrx20System_UnicodeStringi
mov dword [edi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0xc]
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x40]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x10]
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x44]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x14]
mov edx, 6
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x14]
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x48]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
mov ecx, dword [edi + 0x34]
mov edx, dword [esi + 0x90]
mov eax, dword [edi + 0x4c]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x18]
mov edx, 8
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x18]
mov ecx, dword [edi + 0x38]
mov eax, dword [edi + 0x50]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x1c]
mov edx, 0xc
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + 0x54]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x719d8b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x719dad
lea eax, [ebp - 0x1c]
mov edx, 6
call sub.AIMP.Runtime.dll__System__UStrArrayClr_qqrpvi
ret
Function at 0x719df4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x719f8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.006ff03c
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x719f70
xor eax, eax
push ebp
push 0x719f62
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x719e5f
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x4c]
call fcn.00719db8
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x40]
call fcn.00719db8
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x44]
call fcn.00719db8
mov ecx, dword [ebp - 0x10]
mov edx, 2
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x48]
call fcn.00719db8
mov ecx, dword [ebp - 0x14]
mov edx, 6
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x50]
call fcn.00719db8
mov ecx, dword [ebp - 0x18]
mov edx, 8
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x54]
call fcn.00719db8
mov ecx, dword [ebp - 0x1c]
mov edx, 0xc
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x24]
call sub.AIMP.Runtime.dll__Acl_Utils_Common_TrackFormat_qqri
mov edx, dword [ebp - 0x20]
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetTrackNumber_qqrx20System_UnicodeString
mov eax, dword [ebx + 8]
mov dword [esi + 0x96], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x9a], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0xa2], eax
mov eax, dword [ebx + 0x20]
mov dword [esi + 0xa6], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0xaa], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0xae], eax
push dword [ebx + 0x18]
push dword [ebx + 0x14]
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetFileSize_qqrxj
cmp dword [ebx + 4], 1
sbb ecx, ecx
inc ecx
mov edx, 1
mov eax, esi
call sub.AIMP.Shared.dll__Aimp_Playlists_Types_TAIMPPlaylistCustomItem_SetFlag_qqrio
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x719f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x719f92
lea eax, [ebp - 0x20]
mov edx, 7
call sub.AIMP.Runtime.dll__System__UStrArrayClr_qqrpvi
ret