joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f7dd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0052a2e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0052f064
dec eax
test eax, eax
jl 0x5f7f45
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.0052f028
cmp eax, dword [ebp - 4]
je 0x5f7f39
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.0052f028
mov ebx, eax
cmp byte [ebx + 0x57], 0
jne 0x5f7e42
test byte [ebx + 0x1c], 0x10
je 0x5f7f39
test byte [ebx + 0x50], 0x40
je 0x5f7f39
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0052a2e0
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x24]
call fcn.004a7b9c
test al, al
jne 0x5f7e78
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x24]
call fcn.004a7b9c
test al, al
je 0x5f7f39
mov eax, dword [ebp - 8]
call fcn.004fdd24
push eax
call sub.GDI32.DLL_SaveDC
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5f7f32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004fd650
movzx eax, word [ebx + 0x54]
or ax, word [0x5f7f4c]
mov word [ebx + 0x54], ax
mov eax, dword [ebp - 8]
call fcn.004fdd24
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x24]
call fcn.00528f2c
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004fdd24
push eax
call sub.GDI32.DLL_IntersectClipRect
push 0
mov eax, dword [ebp - 8]
call fcn.004fdd24
mov ecx, eax
mov edx, 0xf
mov eax, ebx
call fcn.0052bdd4
movzx eax, word [0x5f7f4c]
not eax
and ax, word [ebx + 0x54]
mov word [ebx + 0x54], ax
mov eax, dword [ebp - 8]
call fcn.004fdbf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f7f39
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004fdd24
push eax
call sub.GDI32.DLL_RestoreDC
ret
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x5f7e0b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x616ee0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, eax
mov eax, dword [edi + 0x284]
mov ebp, dword [eax + 0x394]
test ebp, ebp
je 0x616ffc
cmp dword [ebp + 0x390], 0
jge 0x616f11
mov eax, ebp
mov edx, dword [eax]
call dword [edx + 0x174]
test al, al
jne 0x616f23
mov eax, ebp
mov edx, dword [eax]
call dword [edx + 0x120]
test al, al
jne 0x616f23
xor ebx, ebx
jmp 0x616f25
mov bl, 1
call sym.StartupControl.exe__Acpopupcontroller_GetIntController_qqrv
mov edx, dword [edi + 0x284]
call sym.StartupControl.exe__Acpopupcontroller_TsPopupController_ClosingForbide_qqrp11Forms_TForm
push 0
mov eax, dword [edi + 0x284]
call fcn.005333f8
push eax
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 0x2bc]
call sym.StartupControl.exe__Scommondata_StopTimer_qqrp24Scommondata_TsCommonData
mov eax, dword [ebp + 0x2bc]
add eax, 0xa0
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.004c09bc
mov eax, dword [ebp + 0x2bc]
or dword [eax + 0xa8], 0x100000
mov edx, dword [edi + 0xc]
mov eax, ebp
mov ecx, dword [eax]
call dword [ecx + 0x18c]
mov eax, dword [ebp + 0x2bc]
and dword [eax + 0xa8], 0xffefffff
mov eax, ebp
mov si, 0xffae
call fcn.004c0c04
mov esi, dword [edi + 0x284]
test byte [esi + 0x1c], 8
jne 0x616fc5
push 0
push 0
push 0xb021
mov eax, esi
call fcn.005333f8
push eax
call sub.USER32.DLL_PostMessageW
call sym.StartupControl.exe__Acpopupcontroller_GetIntController_qqrv
mov edx, dword [edi + 0x284]
call sym.StartupControl.exe__Acpopupcontroller_TsPopupController_ClosingAllow_qqrp11Forms_TForm
test byte [ebp + 0x2d8], bl
je 0x616ffc
xor eax, eax
mov dword [ebp + 0x350], eax
mov ecx, dword [ebp + 0x28c]
mov edx, dword [ebp + 0x2b4]
mov eax, dword [ebp + 0x2bc]
call sym.StartupControl.exe__Acanimation_MakeLabelTextHint_qqrp24Scommondata_TsCommonDatap24Scommondata_TsBoundLabel20System_UnicodeStr
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6190e0
Capabilities:
Encode data using xor

Disassembly:
adc byte [ecx + 0x53], al
add byte [eax + 0x5c0052f6], dh
pop esp
dec ecx
add byte [ebx + edx*8 + 0x52], bh
add ah, al
invalid
Function at 0x6202b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x6202f0]
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x6202cb
or bl, 1
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x6202da
or bl, 4
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x6202e9
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x6202f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff824
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7dc], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x6203d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004c25d0
mov eax, dword [0x7b9350]
cmp dword [eax], 2
jne 0x62038a
push edi
call sub.USER32.DLL_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004c2944
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov esi, dword [ebp - 0x7d8]
test esi, esi
je 0x620356
sub esi, 4
mov eax, dword [esi]
shr eax, 1
mov esi, eax
push esi
mov eax, dword [ebx]
call fcn.004c27ac
push eax
push edi
call sub.USER32.DLL_GetWindowTextW
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
test eax, eax
je 0x62037e
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
dec edx
mov eax, ebx
call fcn.004c2944
jmp 0x6203bc
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push edi
call sub.USER32.DLL_SendMessageW
lea edx, [ebp - 0x7dc]
lea eax, [ebp - 0x7d2]
call fcn.004abfd8
mov edx, dword [ebp - 0x7dc]
mov eax, ebx
call fcn.004c2c84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6203dc
lea eax, [ebp - 0x7dc]
call fcn.004c29e8
ret

Function at 0x620ad8
Capabilities:
Encode data using xor

Disassembly:
adc byte [ecx + 0x53], al
add byte [eax + 0x5c0052f6], dh
pop esp
dec ecx
add ah, bl
sbb al, 0x62
add byte [eax + 0x60006221], dl
fst qword [edx]
cmp al, 0xa8
add byte [eax - 0x23], ah
push edx
add byte [eax + ebp*4], bh
push edx
add byte [eax], dh
dec edx
add byte [ebp + edi*8 + 0x49], al
add byte [edi*8 + 0x780049], bh
dec edx
add byte [ecx + edx + 0x3b340062], al
push ebx
add byte [eax + 0x41], al
push ebx
add byte [eax + eax*2 - 0x65c7ffad], cl
push edx
add byte [eax + 0x35], al
push ebx
add byte [eax + 0x35], ah
push ebx
add ah, cl
xor dword [ebx], edx
sbb byte [ecx - 0x2ab3ffae], 0x52
add byte [eax - 0x2b], bh
push edx
add ah, al
pop ss
push ebx
add byte [eax + ebp*4], ah
push edx
add byte [ebx + ebx*4 - 0x5653ffae], dh
push edx
add byte [eax + 0x5c00534a], cl
lodsb al, byte [esi]
push edx
add al, cl
stosb byte es:[edi], al
push edx
add byte [edi + ebp], dh
bound eax, qword [eax]
jl 0x620aeb
push edx
add ah, bh
aad 0x52
add byte [esp + ebx + 0x32e00062], dh
push ebx
add byte [ebp + ebp + 0x53], al
add ah, al
xor dl, byte [ebx]
fcomp st(5)
push edx
add byte [ecx + ebp*8], dl
push edx
add byte [eax + ebp*4], cl
dec esp
add byte [eax], bh
test al, 0x4c
add al, dh
hlt
Function at 0x63ba3c
Capabilities:
Capture screenshot

Disassembly:
add edx, dword [edx]
push esp
popal
arpl word [ebx + 0x69], dx
push ebx
push 0x776f6461
push ebx
je 0x63bac7
insb byte es:[edi], dx
add dword gs:[eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bh
mov edx, 0x73090063
jae 0x63bad4
dec esp
imul ebp, dword [esi + 0x65], 0x73097261
inc edi
jb 0x63bacd
imul esp, dword fs:[ebp + 0x6e], 0x90909074

Function at 0x63ba74
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
push 0xcc0020
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
mov eax, dword [edi]
call fcn.00502d6c
call fcn.004fdd24
push eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
push 0
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, dword [ebp + 8]
sub eax, dword [edx - 8]
push eax
mov eax, dword [edi]
call fcn.00502d6c
call fcn.004fdd24
push eax
call sub.GDI32.DLL_BitBlt
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
dec ebx
test ebx, ebx
jl 0x63bb22
inc ebx
xor esi, esi
push 0xcc0020
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [edi]
call fcn.00502d6c
call fcn.004fdd24
push eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
push 1
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, esi
inc eax
push eax
mov eax, dword [edi]
call fcn.00502d6c
call fcn.004fdd24
push eax
call sub.GDI32.DLL_BitBlt
inc esi
dec ebx
jne 0x63badb
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x66fffc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6700dc
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xe]
lea eax, [ebp - 0xa]
call fcn.004ad8a4
movzx eax, word [ebp - 0xa]
mov word [ebp - 0x1e], ax
movzx eax, word [ebp - 0xe]
mov word [ebp - 0x1c], ax
movzx eax, word [ebp - 0xc]
mov word [ebp - 0x18], ax
mov ebx, dword [0x7b9364]
mov ebx, dword [ebx]
lea eax, [ebp - 8]
mov edx, 0x80
call fcn.004c2d84
push 0x80
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
push 0x20
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jne 0x670089
lea eax, [ebp - 4]
mov edx, dword [0x7b935c]
mov edx, dword [edx]
call fcn.004c2a4c
jmp 0x670094
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0066ff0c
push 0x80
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
lea eax, [ebp - 0x1e]
push eax
push 0
push ebx
call sub.KERNEL32.DLL_GetDateFormatW
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004c29f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6700e3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004c29f0
ret
Function at 0x67a7e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acsbutils_GetScrollMetric_qqrp22Acsbutils_TacScrollBario
mov ebx, eax
lea eax, [ebp - 0x28]
xor edx, edx
call sym.StartupControl.exe__Acntutils_WidthOf_qqrrx11Types_TRectxo
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp - 0x24]
jl 0x67a924
cmp edi, dword [ebp - 0x1c]
jge 0x67a924
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00678310
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x67a860
mov ebx, esi
sar ebx, 1
jns 0x67a860
adc ebx, 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
jg 0x67a879
add eax, ebx
cmp eax, dword [ebp - 8]
jle 0x67a879
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x67a924
mov eax, dword [ebp - 0x20]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp - 8]
jg 0x67a896
cmp eax, dword [ebp - 8]
jle 0x67a896
mov dword [ebp - 0xc], 1
jmp 0x67a924
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x67a8a7
mov dword [ebp - 0xc], 0xffffffff
jmp 0x67a924
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x67a8c3
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x67a8c3
mov dword [ebp - 0xc], 5
jmp 0x67a924
mov eax, dword [ebp - 0x28]
add eax, ebx
cmp eax, dword [ebp - 8]
jg 0x67a8f3
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x67a8f3
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x67a8ea
mov dword [ebp - 0xc], 4
jmp 0x67a924
mov dword [ebp - 0xc], 2
jmp 0x67a924
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jg 0x67a924
mov eax, dword [ebp - 0x20]
sub eax, ebx
cmp eax, dword [ebp - 8]
jle 0x67a924
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x67a91d
mov dword [ebp - 0xc], 4
jmp 0x67a924
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x67a930
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acsbutils_GetScrollMetric_qqrp22Acsbutils_TacScrollBario
mov ebx, eax
lea eax, [ebp - 0x24]
xor edx, edx
call sym.StartupControl.exe__Acntutils_HeightOf_qqrrx11Types_TRectxo
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], edx
cmp edi, dword [ebp - 0x24]
jl 0x67aa6c
cmp edi, dword [ebp - 0x1c]
jge 0x67aa6c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00678310
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x67a9a8
mov ebx, esi
sar ebx, 1
jns 0x67a9a8
adc ebx, 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jg 0x67a9c1
add eax, ebx
cmp eax, dword [ebp + 8]
jle 0x67a9c1
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x67aa6c
mov eax, dword [ebp - 0x18]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp + 8]
jg 0x67a9de
cmp eax, dword [ebp + 8]
jle 0x67a9de
mov dword [ebp - 8], 1
jmp 0x67aa6c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x67a9ef
mov dword [ebp - 8], 0xffffffff
jmp 0x67aa6c
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jl 0x67aa0b
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jle 0x67aa0b
mov dword [ebp - 8], 5
jmp 0x67aa6c
mov eax, dword [ebp - 0x20]
add eax, ebx
cmp eax, dword [ebp + 8]
jg 0x67aa3b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jge 0x67aa3b
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x67aa32
mov dword [ebp - 8], 4
jmp 0x67aa6c
mov dword [ebp - 8], 2
jmp 0x67aa6c
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jg 0x67aa6c
mov eax, dword [ebp - 0x18]
sub eax, ebx
cmp eax, dword [ebp + 8]
jle 0x67aa6c
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x67aa65
mov dword [ebp - 8], 4
jmp 0x67aa6c
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x68cf60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffb8
mov ebx, eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebx + 0x44]
push eax
lea ecx, [ebx + 0xc]
lea edx, [ebx + 0x34]
mov eax, dword [ebx + 0x38]
call sym.StartupControl.exe__Acsbutils_InitCtrlData_qqrp6HWND__rp6HWND__r11Types_TRectt3r7tagSIZEr12Types_TPoint
mov eax, dword [ebx + 0x68]
call sym.StartupControl.exe__Scommondata_InitCacheBmp_qqrpx24Scommondata_TsCommonData
cmp byte [ebx + 0x78], 0
jne 0x68d097
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x5c]
mov edx, dword [ebx + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x5c]
mov edx, dword [ebx + 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [esp + 0x14]
mov eax, dword [ebx + 0x38]
call sym.StartupControl.exe__Scommondata_GetParentCacheHwnd_qqrxp6HWND__
mov esi, dword [ebx + 0x68]
mov eax, esi
call sym.StartupControl.exe__Scommondata_ControlIsActive_qqrpx24Scommondata_TsCommonData
and eax, 0x7f
push eax
lea edx, [esp + 0x3c]
lea eax, [ebx + 0x3c]
call sym.StartupControl.exe__Acntutils_MkRect_qqrrx7tagSIZE
lea eax, [esp + 0x3c]
push eax
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x5c]
push eax
push 0
push 0
push 0
mov cl, 1
lea edx, [esp + 0x30]
mov eax, esi
call sym.StartupControl.exe__Sgraphutils_PaintItem_qqrp24Scommondata_TsCommonDatarx17Sconst_TCacheInfooirx11Types_TRectrx12Types_TPoint
mov eax, ebx
call sym.StartupControl.exe__Acsbutils_TacCheckBoxWnd_DrawCheckText_qqrv
mov eax, ebx
call sym.StartupControl.exe__Acsbutils_TacCheckBoxWnd_State_qqrv
mov edx, eax
mov eax, ebx
call sym.StartupControl.exe__Acsbutils_TacCheckBoxWnd_GlyphMaskIndex_qqrx23Stdctrls_TCheckBoxState
movsx edx, ax
mov eax, ebx
call sym.StartupControl.exe__Acsbutils_TacCheckBoxWnd_DrawSkinGlyph_qqrxi
mov eax, dword [ebx + 0x38]
push eax
call sub.USER32.DLL_IsWindowEnabled
test eax, eax
jne 0x68d097
cmp byte [esp + 0x34], 0
je 0x68d079
lea edx, [esp + 4]
lea eax, [ebx + 0x3c]
call sym.StartupControl.exe__Acntutils_MkRect_qqrrx7tagSIZE
mov ecx, dword [esp + 0x1c]
add ecx, dword [ebx + 0x48]
mov edx, dword [esp + 0x18]
add edx, dword [ebx + 0x44]
lea eax, [esp + 4]
call fcn.004a7ca8
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [sym.StartupControl.exe__Sdefaults_DefBlendDisabled]
movzx eax, byte [eax]
push eax
push 0xff00ff
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
xor edx, edx
call sym.StartupControl.exe__Sgraphutils_BlendTransRectangle_qqrp16Graphics_TBitmapiit1rx11Types_TRectuc15Graphics_TColor
jmp 0x68d097
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov edx, dword [sym.StartupControl.exe__Sdefaults_DefBlendDisabled]
movzx edx, byte [edx]
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x5c]
mov ecx, dword [esp]
call sym.StartupControl.exe__Sgraphutils_BlendTransBitmap_qqrp16Graphics_TBitmapucx14Sconst_TsColor
add esp, 0x48
pop esi
pop ebx
ret
Function at 0x6adf30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x7bf750
test esi, esi
jne 0x6adf4a
xor eax, eax
jmp 0x6ae03b
cmp dword [ebp], 0
jne 0x6adf55
call fcn.006adec0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x6ae015
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x6adf61
test edi, edi
jbe 0x6ae036
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x6ae019
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6c29a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00510ebc
push 0
mov eax, ebx
call fcn.005333f8
push eax
call sub.USER32.DLL_ShowWindow
mov byte [ebx + 0x398], 1
pop ebx
ret
Function at 0x6ce34c
Capabilities:
Encode data using xor

Disassembly:
pop es
adc edx, dword [ecx + 0x63]
inc ebx
jne 0x6ce3c7
je 0x6ce3c5
insd dword es:[edi], dx
dec eax
imul ebp, dword [esi + 0x74], 0x646e6957
outsd dx, dword [esi]
ja 0x6ce36e
loop 0x6ce3d0
add byte [eax + 0x63], ah
push edx
add byte [edi], cl
add byte [ecx], cl
arpl word [ecx + 0x6c], ax
inc ecx
insb byte es:[edi], dx
jo 0x6ce3da
popal
dec eax
imul ebp, dword [esi + 0x74], 0x90000073
nop
aam 0xe3
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, ch
in al, 0x6c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, dl
in al, 0x6c
add byte [edx + eax - 0x1e4c0000], ch
insb byte es:[edi], dx
add byte [eax + 0xa], bh
dec esp
add byte [eax + 0x58004c0a], al
or al, 0x4c
add byte [eax], bl
dec edx
add byte [eax + 0xc], dh
dec esp
add byte [ecx + edi*8 + 0x49], dh
add byte [eax + 0xc], bh
dec esp
add byte [eax], cl
pop es
push ebx
add byte [ecx + ecx + 0x4c], dl
add byte [eax + 9], dh
dec esp
add byte [eax + 0x10006d1b], ah
mov al, byte [0x10006d1b]
inc ecx
push ebx
add byte [eax + 0x5c0052f6], dh
pop esp
dec ecx
push edx
add byte [esp + ebx*2 + 0x49], bl
add byte [ebx + edx*8 + 0x52], bh
add ah, al
invalid
Function at 0x6dbfac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6dc01d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [sym.StartupControl.exe__Acshellctrls_nFolder]
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x6dc007
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call sym.StartupControl.exe__Acshellctrls_DesktopShellFolder_qqrv
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6d8df4]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder__bctr_qqrp27Acshellctrls_TacShellFolderp11_ITEMIDLIST40System__DelphiInterface
mov dword [0x7b2374], eax
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_DisposePIDL_qqrp11_ITEMIDLIST
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6dc024
lea eax, [ebp - 8]
call fcn.004c4fac
ret