joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462ef4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0069ad68
mov eax, dword [ebp - 8]
call fcn.0069ad68
mov eax, dword [ebp + 8]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x46301f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00691af4
cmp dword [ebp - 0xc], 0
jne 0x462f51
lea eax, [ebp - 0xc]
call fcn.00691db4
lea eax, [ebp - 0x3fd]
push eax
push 0
push 0x463030
mov eax, dword [ebp - 0xc]
call fcn.0069ad78
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x3fd]
call fcn.006920b4
mov eax, dword [ebp - 0x10]
call fcn.006919a4
xor eax, eax
mov dword [ebp - 0x14], eax
cmp byte [ebp + 0x14], 0
je 0x462f95
mov dword [ebp - 0x14], 2
cmp byte [ebp + 0x10], 0
je 0x462fa2
mov dword [ebp - 0x14], 4
test esi, esi
je 0x462fa9
add dword [ebp - 0x14], esi
cmp dword [ebp + 8], 0
je 0x462fbf
lea eax, [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, 0x46303c
call fcn.0069ac00
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0x463044
lea eax, [ebx + 0xf8]
push eax
push 0
call fcn.0069b9e4
add esp, 0x20
mov eax, dword [ebp - 4]
call fcn.006919a4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.006919bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463026
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0069a958
lea eax, [ebp + 8]
call fcn.0069a934
ret

Function at 0x486a14
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, eax
lea edi, [ebp - 0x20]
push ecx
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x20]
call fcn.0069c8a0
mov eax, dword [ebp - 4]
call fcn.0069ad68
mov eax, dword [ebp - 8]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x486afe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, 0x486b18
call fcn.006925fc
xor eax, eax
push ebp
push 0x486abe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
lea eax, [ebp - 0x10]
push eax
push 0x486b40
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.0069b9e4
add esp, 0x14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x486acf
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486b05
lea eax, [ebp - 0x20]
call fcn.0069c898
lea eax, [ebp - 0x10]
call fcn.0069a934
lea eax, [ebp - 8]
mov edx, 2
call fcn.0069a958
ret
Function at 0x4a88b4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x4a8a19
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, 0x4a8a30
call fcn.0069aea0
test eax, eax
jne 0x4a8a03
mov dl, 1
mov eax, dword [0x6365a4]
call fcn.0063d2cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0063d838
mov ebx, eax
xor eax, eax
push ebp
push 0x4a89fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0061ef18
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0061ef18
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 0x14]
mov edx, 0x8080
call fcn.00637cf4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00681110
lea edx, [ebp - 0x17c]
mov eax, ebx
call fcn.0063842c
push 0x101
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0069ad78
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 3
push 0
push 0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 0x16c]
push eax
push 0
push 0
mov eax, ebx
call fcn.00638a38
push eax
call sub.USER32.DLL_DrawIconEx
mov edx, 0x8080
mov eax, dword [ebp - 0xc]
call fcn.0063ea04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8a03
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
call fcn.00699c7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8a20
lea eax, [ebp - 8]
call fcn.0069a934
ret
Function at 0x4ab7b0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x4ab915
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, 0x4ab92c
call fcn.0069aea0
test eax, eax
jne 0x4ab8ff
mov dl, 1
mov eax, dword [0x6365a4]
call fcn.0063d2cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0063d838
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab8f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0061ce84
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0061ce84
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 0x14]
mov edx, 0x8080
call fcn.00637cf4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00681110
lea edx, [ebp - 0x17c]
mov eax, ebx
call fcn.0063842c
push 0x101
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0069ad78
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 3
push 0
push 0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 0x16c]
push eax
push 0
push 0
mov eax, ebx
call fcn.00638a38
push eax
call sub.USER32.DLL_DrawIconEx
mov edx, 0x8080
mov eax, dword [ebp - 0xc]
call fcn.0063ea04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab8ff
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
call fcn.00699c7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab91c
lea eax, [ebp - 8]
call fcn.0069a934
ret
Function at 0x4ac77c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x234], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x235], 1
je 0x4ac7a9
mov eax, dword [ebp - 4]
call sym.MassSender.exe__Coolctrls_TCoolInplaceEdit_IsWallpaperAssigned_qqrv
test al, al
jne 0x4ac7b9
mov eax, dword [ebp - 4]
test byte [eax + 0x237], 0x10
je 0x4ac931
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ac92a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ac903
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00659228
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.006591e4
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ac8e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0065d9a8
mov eax, dword [ebp - 4]
test byte [eax + 0x237], 4
je 0x4ac857
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call sym.MassSender.exe__Coolctrls_DrawFlatBorder_qqruip20Controls_TWinControlo
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
push eax
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x264]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call sym.MassSender.exe__Coolctrls_DrawBorders_qqruip20Controls_TWinControl47System__Set_t19Toolwin_TEdgeBorder_iuc_0_iuc_3_p13Graphics
push 0xcc0020
push 1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00659228
push eax
mov eax, dword [ebp - 4]
call fcn.006591e4
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f4]
mov esi, dword [eax*4 + 0x7af1bc]
push esi
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f4]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac8ec
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_DeleteObject
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x234], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afdf8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x20c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x20d], 1
je 0x4afe25
mov eax, dword [ebp - 4]
call sym.MassSender.exe__Coolctrls_TCoolEdit_IsWallpaperAssigned_qqrv
test al, al
jne 0x4afe35
mov eax, dword [ebp - 4]
test byte [eax + 0x20f], 0x10
je 0x4affc4
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_HideCaret
xor eax, eax
push ebp
push 0x4affbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4aff9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4aff73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00659228
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.006591e4
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4aff55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0065d9a8
mov eax, dword [ebp - 4]
test byte [eax + 0x20f], 4
je 0x4afeef
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call sym.MassSender.exe__Coolctrls_DrawFlatBorder_qqruip20Controls_TWinControlo
push 0xcc0020
push 1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00659228
push eax
mov eax, dword [ebp - 4]
call fcn.006591e4
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f4]
mov esi, dword [eax*4 + 0x7af1f0]
push esi
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f4]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aff5c
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_DeleteObject
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x20c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1708
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x24c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x228], 1
je 0x4b1735
mov eax, dword [ebp - 4]
call sym.MassSender.exe__Coolctrls_TCoolMemo_IsWallpaperAssigned_qqrv
test al, al
jne 0x4b1745
mov eax, dword [ebp - 4]
test byte [eax + 0x22a], 0x10
je 0x4b18d4
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_HideCaret
xor eax, eax
push ebp
push 0x4b18cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b18aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b1883
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00659228
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.006591e4
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b1865
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0065d9a8
mov eax, dword [ebp - 4]
test byte [eax + 0x22a], 4
je 0x4b17ff
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call sym.MassSender.exe__Coolctrls_DrawFlatBorder_qqruip20Controls_TWinControlo
push 0xcc0020
push 1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00659228
push eax
mov eax, dword [ebp - 4]
call fcn.006591e4
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f4]
mov esi, dword [eax*4 + 0x7af204]
push esi
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f4]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b186c
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_DeleteObject
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x24c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8270
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp edx, dword [eax + 0x204]
je 0x4b8596
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fc]
cmp edx, eax
jge 0x4b82a1
mov edx, dword [ebp - 4]
mov dword [edx + 0x204], eax
jmp 0x4b82c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
cmp edx, eax
jle 0x4b82b9
mov edx, dword [ebp - 4]
mov dword [edx + 0x204], eax
jmp 0x4b82c2
mov eax, dword [ebp - 4]
mov dword [eax + 0x204], edx
mov eax, dword [ebp - 4]
cmp word [eax + 0x272], 0
je 0x4b82e1
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x274]
call dword [ebx + 0x270]
mov dl, 1
mov eax, dword [0x6365a4]
call fcn.0063d2cc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b858f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b8435
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b840e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b83f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0065d9a8
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0063d838
call fcn.00638a38
push eax
call sub.GDI32.DLL_BitBlt
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b83f7
mov eax, dword [ebp - 0x14]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51169c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov ebp, ecx
mov dword [esp], edx
mov ebx, eax
xor edi, edi
movzx edx, word [ebx + 0x21e4]
mov eax, ebp
xor ecx, ecx
call fcn.0069985c
movzx eax, word [ebx + 0x21e0]
test eax, eax
jle 0x511777
mov dword [esp + 4], eax
mov esi, 1
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0xfb
call fcn.0069985c
mov eax, dword [ebx + esi*4 + 0x11dc]
xor ecx, ecx
mov cl, byte [eax + 0x58]
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x5a]
add eax, dword [esp + 4]
inc eax
pop edx
call fcn.00699420
mov eax, dword [ebx + esi*4 + 0x11dc]
movzx eax, word [eax + 0x5a]
add eax, dword [esp]
mov al, byte [eax]
xor al, 1
xor al, 1
movzx edx, di
add edx, ebp
mov byte [edx], al
mov dl, byte [ebx + 0x21e2]
push edx
mov eax, dword [ebx + esi*4 + 0x11dc]
mov dl, byte [eax + 0xfd]
push edx
mov dx, word [ebx + 0x1a3]
push edx
mov dx, word [ebx + 0x1a5]
push edx
movzx ecx, di
add ecx, ebp
lea edx, [esp + 0x18]
push edx
pop edx
call sym.MassSender.exe__Dbisamen_PrepareDataForIndex_qqrrx25Dbisamcn_TFieldDefinitionpct2oousus
mov eax, dword [ebx + esi*4 + 0x11dc]
call sym.MassSender.exe__Dbisamen_GetIndexedSize_qqrrx25Dbisamcn_TFieldDefinition
and eax, 0xff
inc eax
add di, ax
inc esi
dec dword [esp + 4]
jne 0x5116d7
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0xfb
call fcn.0069985c
lea edx, [esp + 8]
mov eax, dword [esp]
inc eax
add eax, 4
mov ecx, 4
call fcn.00699420
movzx edx, di
add edx, ebp
lea eax, [esp + 8]
mov eax, dword [eax]
call sym.MassSender.exe__Dbisamlb_FlipIntegerBits_qqripc
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x520ac0
Capabilities:
Access peb ldr_data

Disassembly:
pop es
or eax, 0x706d4954
outsd dx, dword [esi]
jb 0x520b11
push eax
popal
jb 0x520b14
jb 0x520b20
or dl, byte [edx]
inc eax
jl 0x520b13
add byte [eax], al
add byte [eax], cl
bound ebp, qword fs:[ecx + 0x73]
popal
insd dword es:[edi], dx
insb byte es:[edi], dx
bound eax, qword [eax]
add byte [0x5f000000], ah
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x520b44
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0069ad78
mov byte [0xc88b0017], al
pop ss
add byte [ebx + 0x66f38bc8], cl
mov edx, dword [esi + 0x32]
inc esi
xor al, ch
pop ecx
js 0x520b26
add byte [ebx + 0x5ac033d8], cl
Function at 0x522b28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
fld qword [ebp + 8]
fcomp dword [0x522b88]
fnstsw ax
sahf
jae 0x522b5e
xor eax, eax
lea edx, [ebp + 8]
xor ecx, ecx
mov cl, al
mov ebx, 7
sub ebx, ecx
add ebx, esi
mov cl, byte [edx]
xor cl, 0xff
mov byte [ebx], cl
inc eax
inc edx
cmp al, 8
jne 0x522b42
jmp 0x522b81
mov al, byte [ebp + 0xf]
or al, 0x80
mov byte [esi], al
xor eax, eax
lea edx, [ebp + 8]
xor ecx, ecx
mov cl, al
mov ebx, 7
sub ebx, ecx
add ebx, esi
mov cl, byte [edx]
mov byte [ebx], cl
inc eax
inc edx
cmp al, 7
jne 0x522b6a
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5230bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
push edi
push ebx
xor ecx, ecx
mov ecx, dword [ebp - 4]
jcxz 0x5230f1
xor ebx, ebx
mov bl, byte [ebp - 5]
mov bh, byte [ebp + 8]
mov edi, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edi]
xor al, bl
xor al, bh
mov byte [edi], al
inc bl
dec bh
inc edi
loop 0x5230e0
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x5230fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
push edi
push ebx
xor ecx, ecx
mov ecx, dword [ebp - 4]
jcxz 0x523131
xor ebx, ebx
mov bl, byte [ebp - 5]
mov bh, byte [ebp + 8]
mov edi, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edi]
xor al, bh
xor al, bl
mov byte [edi], al
inc bl
dec bh
inc edi
loop 0x523120
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x5276bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52773d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.0069985c
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.006920b4
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0xff
call fcn.0069ab90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527744
lea eax, [ebp - 0x10c]
call fcn.0069a934
ret

Function at 0x52774c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5277cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.0069985c
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.006920b4
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0xff
call fcn.0069ab90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5277d4
lea eax, [ebp - 0x10c]
call fcn.0069a934
ret