joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45995c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor ecx, 0x41435333
cmp edx, 4
jl 0x459974
xor dword [eax], ecx
sub edx, 4
add eax, 4
cmp edx, 4
jge 0x459967
ret

Function at 0x4ad59c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x3d4], eax
push 0
mov eax, ebx
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4ad5b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov ebx, edx
mov esi, eax
mov dword [esi + 0x3d4], ebx
mov eax, dword [esi + 0x3e0]
xor edx, edx
call sub.AIMP.Runtime.dll__Acl_Classes_Timer_TACLTimer_SetEnabled_qqro
push 0
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
call sub.AIMP.Runtime.dll__Acl_Utils_Desktop_MonitorGet_qqrui
call sub.AIMP.Runtime.dll__Acl_Utils_Desktop_MonitorIsFullScreenApplicationRunning_qqrp29Acl_Utils_Desktop_TACLMonitor
test al, al
jne 0x4ad6d9
call fcn.004dec48
mov eax, dword [eax + 0x6c]
mov edx, ebx
call fcn.0049f6c0
mov edx, eax
mov eax, dword [esi + 0x3dc]
call sub.AIMP.Runtime.dll__Acl_Graphics_Skinimage_TACLSkinImage_Assign_qqrp14System_TObject
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0x3dc]
call sub.AIMP.Runtime.dll__Acl_Graphics_Skinimage_TACLSkinImage_GetFrameSize_qqrv
lea eax, [esp + 0x1c]
push eax
mov eax, ebx
call sub.AIMP.Runtime.dll__Vcl_Forms_TCustomForm_GetPixelsPerInch_qqrv
mov edx, eax
mov eax, dword [esi + 0x3dc]
mov ecx, dword [eax + 0x80]
pop eax
call sub.AIMP.Runtime.dll__Acl_Geometry_acSizeScale_qqrrx18System_Types_TSizeii
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x20]
call sub.AIMP.Runtime.dll__Acl_Utils_Desktop_MouseCursorPos_qqrv
lea edx, [esp + 0x20]
mov eax, dword [esi + 0x3d4]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x24]
lea ecx, [eax + 0x28]
mov eax, dword [0x4ab2bc]
call fcn.004ad0d4
mov edx, esp
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TControl_SetBoundsRect_qqrrx18System_Types_TRect
mov eax, dword [0x6d3598]
cmp byte [eax], 0
je 0x4ad6c1
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SetWindowPos
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xb8]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc4]
jmp 0x4ad6d9
call sub.kernel32.dll_GetTickCount
mov dword [esi + 0x3d8], eax
mov eax, dword [esi + 0x3e0]
mov dl, 1
call sub.AIMP.Runtime.dll__Acl_Classes_Timer_TACLTimer_SetEnabled_qqro
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x4b3b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
push ebx
push edi
movzx eax, byte [ebp - 1]
push eax
mov ecx, esi
mov dl, 1
mov eax, dword [0x4b39e8]
call fcn.004b8098
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b3c67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov byte [eax + 0x28], 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b8120
test bl, bl
je 0x4b3c07
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4b3c07
push 5
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, esi
call fcn.004e560c
test edi, edi
jbe 0x4b3c24
cmp dword [esi + 0x40], 0
jne 0x4b3c24
call fcn.004dec48
cmp byte [eax + 0x58], 0
je 0x4b3c24
mov eax, dword [ebp - 8]
call sub.AIMP.Runtime.dll__Acl_Ui_Animation_TACLAnimation_RunImmediate_qqrv
push 0x42c80000
mov eax, dword [ebp - 8]
call fcn.004b8120
test bl, bl
jne 0x4b3c44
push 0
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov edx, dword [sym.imp.AIMP.Runtime.dll__Acl_Utils_Common_NullPoint]
mov eax, esi
call fcn.004e5da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3c6e
mov eax, dword [ebp - 8]
call sub.AIMP.Runtime.dll__System_TObject_Free_qqrv
ret
Function at 0x544640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x544748
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x30]
mov edx, edi
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
test esi, esi
sete al
mov byte [ebx + 0x20], al
lea eax, [ebx + 0xc]
mov edx, esi
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
cmp byte [ebx + 0x20], 0
je 0x54469a
lea eax, [ebp - 4]
call sub.AIMP.Runtime.dll__Acl_Utils_Common_aclGenerateGUID_qqrv
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00547b1c
jmp 0x5446f6
call sub.AIMP.Shared.dll__Aimp_Playlists_Formats_PlaylistFormatManager_qqrv
lea ecx, [ebx + 0x40]
mov edx, esi
call sub.AIMP.Shared.dll__Aimp_Playlists_Formats_TAIMPPlaylistFormatManager_LoadSummary_qqrx20System_UnicodeStringr41Aimp_Playlists
movzx eax, byte [ebx + 0x70]
mov byte [ebx + 0x38], al
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x60]
mov eax, dword [ebx + 0x30]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_IfThenW_qqrx20System_UnicodeStringt1
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x30]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea edx, [ebp - 0x10]
mov eax, esi
call sub.AIMP.Runtime.dll__Acl_Utils_Filesystem_WideExtractFileNameWithoutExt_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x30]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_IfThenW_qqrx20System_UnicodeStringt1
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x30]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, dword [ebx + 0x5c]
mov eax, ebx
call fcn.00547b1c
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0x30]
mov edx, 0x544764
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_IfThenW_qqrx20System_UnicodeStringt1
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x30]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, ebx
call fcn.00545f4c
movzx edx, word [0x54477c]
mov eax, ebx
call fcn.00545ea4
mov eax, ebx
call fcn.00546a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54474f
lea eax, [ebp - 0x14]
mov edx, 5
call sub.AIMP.Runtime.dll__System__UStrArrayClr_qqrpvi
ret
Function at 0x564548
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5645d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push 0
mov edx, dword [ebx + 0x30]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
call sub.AIMP.Runtime.dll__Acl_Ui_Popupmenu_TMenuItemHelper_AddItem_qqrx20System_UnicodeStringiynpqqrp14System_TObject_vus
mov esi, eax
mov eax, ebx
call fcn.00544d20
mov edx, eax
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Menus_TMenuItem_SetEnabled_qqro
cmp byte [ebx + 0x38], 0
je 0x5645bd
push dword [esi + 0x40]
push 0x5645f0
mov eax, dword [0x6d3444]
push dword [eax]
push 0x564604
lea eax, [ebp - 4]
mov edx, 4
call sub.AIMP.Runtime.dll__System__UStrCatN_qqrv
mov edx, dword [ebp - 4]
mov eax, esi
call sub.AIMP.Runtime.dll__Vcl_Menus_TMenuItem_SetCaption_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5645da
lea eax, [ebp - 4]
call sub.AIMP.Runtime.dll__System__UStrClr_qqrpv
ret
Function at 0x63120c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x631338
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call sub.AIMP.Runtime.dll__Acl_Threading_TACLCriticalSection_Enter_qqrv
xor eax, eax
push ebp
push 0x631316
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [sym.imp.AIMP.Runtime.dll__Acl_Classes_Stringlist_TACLStringList_]
call sub.AIMP.Runtime.dll__Acl_Classes_Stringlist_TACLStringList__bctr_qqrv
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6312e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call sub.AIMP.Runtime.dll__Acl_Fileformats_Ini_TACLIniFile_ReadKeys_qqrx20System_UnicodeStringp37Acl_Classes_Stringlist_TACLStringL
mov eax, dword [ebp - 0x10]
call sub.AIMP.Runtime.dll__Acl_Classes_Stringlist_TACLStringList_GetCount_qqrv
mov esi, eax
dec esi
test esi, esi
jl 0x6312d3
inc esi
xor ebx, ebx
push 0
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0x10]
call sub.AIMP.Runtime.dll__Acl_Classes_Stringlist_TACLStringList_GetString_qqri
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
push eax
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0x10]
call sub.AIMP.Runtime.dll__Acl_Classes_Stringlist_TACLStringList_GetString_qqri
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
pop ecx
call sub.AIMP.Runtime.dll__Acl_Classes_Stringlist_TACLStringList_Add_qqrx20System_UnicodeStringxi
inc ebx
dec esi
jne 0x631295
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6312f0
mov eax, dword [ebp - 0x10]
call sub.AIMP.Runtime.dll__System_TObject_Free_qqrv
ret
Function at 0x66f0d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.0066e084
test al, al
je 0x66f0f8
mov eax, esi
call fcn.0066e084
test al, al
jne 0x66f0fc
xor ebx, ebx
jmp 0x66f0fe
mov bl, 1
test bl, bl
je 0x66f1cc
xor eax, eax
push ebp
push 0x66f1c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [edi + 0x28]
mov edx, dword [esi + 0x40]
mov eax, dword [edi + 0x40]
call fcn.0066f1d4
mov eax, dword [esi + 0x2c]
push eax
mov ecx, dword [edi + 0x2c]
mov edx, dword [esi + 0x44]
mov eax, dword [edi + 0x44]
call fcn.0066f1d4
mov eax, dword [esi + 0x30]
push eax
mov ecx, dword [edi + 0x30]
mov edx, dword [esi + 0x48]
mov eax, dword [edi + 0x48]
call fcn.0066f1d4
mov eax, dword [esi + 0x34]
push eax
mov ecx, dword [edi + 0x34]
mov edx, dword [esi + 0x4c]
mov eax, dword [edi + 0x4c]
call fcn.0066f1d4
mov eax, dword [esi + 0x38]
push eax
mov ecx, dword [edi + 0x38]
mov edx, dword [esi + 0x50]
mov eax, dword [edi + 0x50]
call fcn.0066f1d4
mov eax, dword [esi + 0x3c]
push eax
mov ecx, dword [edi + 0x3c]
mov edx, dword [esi + 0x54]
mov eax, dword [edi + 0x54]
call fcn.0066f1d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66f1cc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x686574
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x6866ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0066e084
mov ebx, eax
test bl, bl
je 0x6866d3
xor eax, eax
push ebp
push 0x6866c7
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 8]
call sub.AIMP.Shared.dll__Aimp_Filemanager_FileMarkToInteger_qqrf
mov dword [edi + 0x1c], eax
cmp byte [ebp - 1], 1
cmc
sbb eax, eax
mov dword [edi + 4], eax
mov eax, dword [esi + 0x96]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x9a]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0xa2]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0xa6]
mov dword [edi + 0x20], eax
lea edx, [ebp - 8]
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetTrackNumber_qqrv
mov eax, dword [ebp - 8]
xor edx, edx
call sub.AIMP.Runtime.dll__System_Sysutils_StrToIntDef_qqrx20System_UnicodeStringi
mov dword [edi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0xc]
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x40]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x10]
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x44]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x14]
mov edx, 6
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x14]
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x48]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
mov ecx, dword [edi + 0x34]
mov edx, dword [esi + 0x90]
mov eax, dword [edi + 0x4c]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x18]
mov edx, 8
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x18]
mov ecx, dword [edi + 0x38]
mov eax, dword [edi + 0x50]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
lea ecx, [ebp - 0x1c]
mov edx, 0xc
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_GetString_qqri
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + 0x54]
call sub.AIMP.Runtime.dll__Acl_Utils_Strings_WideStrLCopy_qqrpbx20System_UnicodeStringi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6866d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6866f5
lea eax, [ebp - 0x1c]
mov edx, 6
call sub.AIMP.Runtime.dll__System__UStrArrayClr_qqrpvi
ret
Function at 0x68673c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6868d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0066e084
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x6868b8
xor eax, eax
push ebp
push 0x6868aa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x6867a7
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x4c]
call fcn.00686700
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x40]
call fcn.00686700
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x44]
call fcn.00686700
mov ecx, dword [ebp - 0x10]
mov edx, 2
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x48]
call fcn.00686700
mov ecx, dword [ebp - 0x14]
mov edx, 6
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x50]
call fcn.00686700
mov ecx, dword [ebp - 0x18]
mov edx, 8
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x54]
call fcn.00686700
mov ecx, dword [ebp - 0x1c]
mov edx, 0xc
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetString_qqri20System_UnicodeString
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x24]
call sub.AIMP.Runtime.dll__Acl_Utils_Common_TrackFormat_qqri
mov edx, dword [ebp - 0x20]
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetTrackNumber_qqrx20System_UnicodeString
mov eax, dword [ebx + 8]
mov dword [esi + 0x96], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x9a], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0xa2], eax
mov eax, dword [ebx + 0x20]
mov dword [esi + 0xa6], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0xaa], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0xae], eax
push dword [ebx + 0x18]
push dword [ebx + 0x14]
mov eax, esi
call sub.AIMP.Runtime.dll__Abl_Fileinfo_TABLCustomFileInfo_SetFileSize_qqrxj
cmp dword [ebx + 4], 1
sbb ecx, ecx
inc ecx
mov edx, 1
mov eax, esi
call sub.AIMP.Shared.dll__Aimp_Playlists_Types_TAIMPPlaylistCustomItem_SetFlag_qqrio
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6868b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6868da
lea eax, [ebp - 0x20]
mov edx, 7
call sub.AIMP.Runtime.dll__System__UStrArrayClr_qqrpvi
ret
Function at 0x68b094
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
cmp edi, 0x400
jne 0x68b0c0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.0068b020
mov esi, eax
jmp 0x68b1ff
mov eax, ebx
call fcn.0068ae60
test eax, eax
je 0x68b0d5
mov eax, dword [0x6d3488]
cmp byte [eax], 0
je 0x68b0ee
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DefWindowProcW
mov esi, eax
jmp 0x68b1ff
mov eax, edi
cmp eax, 0x100
jg 0x68b111
je 0x68b1a0
sub eax, 0x10
je 0x68b14d
sub eax, 8
je 0x68b16f
sub eax, 0x32
je 0x68b183
jmp 0x68b1eb
sub eax, 0x111
je 0x68b18f
dec eax
je 0x68b1ac
sub eax, 0x207
jne 0x68b1eb
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
mov eax, dword [sym.imp.AIMP.Runtime.dll__Vcl_Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SendMessageW
mov esi, eax
jmp 0x68b1ff
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
mov eax, dword [0x6d3498]
mov eax, dword [eax]
call sub.AIMP.Runtime.dll__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SendMessageW
mov esi, eax
jmp 0x68b1ff
mov eax, dword [ebp + 8]
push eax
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DefWindowProcW
mov esi, eax
jmp 0x68b1ff
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.0068b268
jmp 0x68b1ff
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.0068b2f0
mov esi, eax
jmp 0x68b1ff
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.0068afc8
jmp 0x68b1ff
cmp dword [ebp + 0xc], 0xf120
je 0x68b1be
cmp dword [ebp + 0xc], 0xf020
jne 0x68b1d5
mov eax, 0x1019
call sub.AIMP.Shared.dll__Aimp_Core_Messages_CorePropertyToggle_qqrui
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
jmp 0x68b1ff
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DefWindowProcW
mov esi, eax
jmp 0x68b1ff
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DefWindowProcW
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x6ba068
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call 0x6b8088
test al, al
je 0x6ba076
mov bl, 1
jmp 0x6ba093
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x6d42b8]
cmp eax, 0x3e8
seta bl
call sub.kernel32.dll_GetTickCount
mov dword [0x6d42b8], eax
mov eax, ebx
pop ebx
ret
Function at 0x44a410
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [esp + 8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test esi, esi
mov edi, eax
je 0x44a44b
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test edi, edi
pop edi
pop esi
je 0x44a463
mov edx, dword [0x64fcf4]
push 0x64fa28
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp]
add esp, 8
ret

Function at 0x4910c4
Capabilities:
Encode data using xor

Disassembly:
bound ebx, qword [ebp - 0x23b659ca]
cmp al, 0x56
or dword [ebx - 0x3e79671c], esi
aas
xor eax, 0x98b88797
cmp al, 0xd
cmp dword [edi], eax
fbstp tbyte [esi]
cdq
invalid