joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502203ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call sym.vcl120.bpl__Olectrls_TOleControl_CreateControl_qqrv
test byte [ebx + 0x295], 4
jne 0x50220441
mov edx, esp
mov eax, ebx
call sym.vcl120.bpl__Controls_TControl_GetBoundsRect_qqrv
push esp
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_GetParentHandle_qqrv
push eax
push 0
mov eax, ebx
test eax, eax
je 0x502203e1
sub eax, 0xfffffd24
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x270]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x284], 0
jne 0x50220412
mov ecx, dword [sym.vcl120.bpl__Oleconst__SCannotActivate]
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Comobj_EOleError_]
call sub.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRec
call sub.rtl120.bpl__System__RaiseExcept_qqrv
mov eax, ebx
call sym.vcl120.bpl__Olectrls_TOleControl_HookControlWndProc_qqrv
cmp byte [ebx + 0x57], 0
jne 0x50220448
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50220448
push 0
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
jmp 0x50220448
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_CreateWnd_qqrv
add esp, 0x10
pop ebx
ret

Function at 0x502241fc
Capabilities:
Packed with generic packer

Disassembly:
xor al, 0x19
adc dl, byte [eax + 0x3c]
sbb dword [edx], edx
push eax
inc esp
sbb dword [edx], edx
push eax
adc al, 0x19
adc dl, byte [eax + 0x1c]
sbb dword [edx], edx
push eax
int3
pop es
or eax, 0x70654454
outsb dx, byte gs:[esi]
outsb dx, byte gs:[esi]
arpl word [ecx + 0x65], bp
jae 0x502241c4
inc ecx
and dl, byte [eax + 0x14]
and dword [eax + edx*2], 0x53060000
jbe 0x5022427c
dec ebp
jb 0x5022421d
add byte [ebx + 0x224278c0], cl
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x22], 0x50
dec esp
add byte [eax], al
add al, bl
and byte [eax + edx*2], 0xe0
adc byte [edx], dl
push eax
call 0x80725465
adc dword [edx], edx
push eax
sub byte [ecx], dl
adc dl, byte [eax - 0x6c]
sbb al, 0x12
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x8c501210
sbb al, 0x12
push eax

Function at 0x50224278
Capabilities:
Packed with generic packer

Disassembly:
pushfd
sbb al, 0x12
push eax
mov ah, 0x4c
and dl, byte [eax + 0xe]
push esp
push ebx
jb 0x502242fc
imul esp, dword [ebx + 0x65], 0x65726854
popal
nop
xchg esp, eax
inc edx
and dl, byte [eax + 7]
pop es
add byte [ebx + 0x22], al
push eax
Function at 0x50224294
Capabilities:
Packed with generic packer

Disassembly:
pop es
push cs
push esp
push ebx
jb 0x50224311
imul esp, dword [ebx + 0x65], 0x65726854
popal
js 0x502242e8
and dl, byte [eax - 0x2c]
and byte [eax + edx*2], 0
add byte [esi], al
push ebx
jbe 0x50224315
dec ebp
jb 0x502242b6
add byte [eax + sym.vcl120.bpl___xp_19Svcmgr_TServiceType], dl
or al, 0x73
je 0x50224332

Function at 0x502242bc
Capabilities:
Packed with generic packer

Disassembly:
add ecx, dword [esp + edx*2]
push ebx
jb 0x50224339
imul esp, dword [ebx + 0x65], 0x65707954
add dword [eax], eax
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax + 0x7502242], bh
jae 0x5022434e
push edi
imul ebp, dword [esi + 0x33], 0x74730832
inc esp
jbe 0x5022434f
arpl word [ebp + 0xc], sp
jae 0x5022435f
inc esi
imul ebp, dword [ebp + 0x53], 0x65747379
insd dword es:[edi], dx
push es
push ebx
jbe 0x5022435c
dec ebp
jb 0x502242fd
inc ebx
and dl, byte [eax + 3]
add ecx, dword [esi]
push ebx
adc dword [ebx + 0x73], esp
inc ebx
arpl word [ebx + 0x43], si

Function at 0x50224300
Capabilities:
Packed with generic packer

Disassembly:
add ecx, dword [esi]
push esp
inc ebx
jne 0x50224378
jb 0x5022436d
outsb dx, byte [esi]
je 0x5022435e
je 0x5022436e
je sym.vcl120.bpl___xp_21Svcmgr_TErrorSeverity
jae 0x50224312
add byte [eax], al
add byte [eax], al
push es
outsb dx, byte [esi]
push cs
arpl word [ebx + 0x50], si
outsb dx, byte [esi]
or byte [bp + di + 0x73], ah
push eax
push es

Function at 0x50224384
Capabilities:
Packed with generic packer

Disassembly:
add ecx, dword [esi]
push esp
inc ebp
jb 0x502243fc
outsd dx, dword [esi]
jb 0x502243e0
jbe 0x502243f5
add dword [eax], eax
Function at 0x502243d4
Capabilities:
Packed with generic packer

Disassembly:
add dword [eax], eax
add byte [eax], al
add byte [esi], al
add byte [eax], al
add ah, bh
inc edx
and dl, byte [eax + 9]
arpl word [ebx + 0x53], si
je 0x50224392
jo 0x50224395
push cs
arpl word [ebx + 0x53], si
je 0x5022438e
jb 0x502243a3
push eax
outsb dx, byte gs:[esi]
imul ebp, dword fs:[esi + 0x67], 0x5373630d
je 0x502243ab
jo 0x5022438e
outsb dx, byte gs:[esi]
imul ebp, dword fs:[esi + 0x67], 0x52736309
jne 0x502243b8
outsb dx, byte [esi]
imul ebp, dword [esi + 0x67], 0x43736311
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x502243bf
outsb dx, byte [esi]
jne 0x502243be
push eax
outsb dx, byte gs:[esi]
imul ebp, dword fs:[esi + 0x67], 0x5073630e
popal
jne 0x502243da
push eax
outsb dx, byte gs:[esi]
imul ebp, dword fs:[esi + 0x67], 0x50736308
popal
jne 0x502243e9
push es
push ebx
jbe 0x502243df
dec ebp
jb 0x50224310
test byte [ebx + 0x22], al
push eax
jbe 0x502243f5
jb 0x502243fb
je 0x5022440d
add dword [eax], eax
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add byte [eax + 0x8502243], al
jae 0x502243ee
add byte [eax], al
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
add byte [ebx + 0x22], 0x50
or byte [ebp + 0x73], ah
dec ecx
jae 0x502243ee
outsb dx, byte [si]
outsd dx, dword [esi]
jb 0x5022440f
or byte [ebp + 0x73], ah
dec esi
jae 0x502243fc
outsd dx, dword [esi]
jb 0x5022441e
insd dword es:[edi], dx
popal
insb byte es:[edi], dx
or byte [ebp + 0x73], ah
push ebx
jbe 0x5022441f
jbe 0x5022441f
jb 0x50224421
or ah, byte [ebp + 0x73]
jae 0x50224403
inc ebx
jb 0x5022442b
je 0x5022442d
arpl word [ecx + 0x6c], sp
push es
push ebx
jbe 0x5022442e
dec ebp
jb 0x5022435a
rcl ah, 0x43
and dl, byte [eax + 3]
add ecx, dword [edx]
push esp
push ebx
je 0x5022443b
add ecx, dword [edx]
push esp
push ebx
je 0x5022443b
jb sym.vcl120.bpl___xp_21Svcmgr_TContinueEvent
push esp
jns 0x5022444f
add dword gs:[eax], eax
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
rol byte [ebx + 0x22], 1
push eax
push es
jae 0x50224464
inc edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x502243fd
jae 0x5022446b
push ebx
jns 0x5022446d
je 0x50224461
insd dword es:[edi], dx
insd dword es:[edi], dx
push es
jae 0x50224474
inc ecx
jne 0x50224477
outsd dx, dword [esi]
or byte [ebx + 0x74], dh
dec ebp
popal
outsb dx, byte [esi]
jne 0x5022446d
insb byte es:[edi], dx
or dh, byte [ebx + 0x74]
inc esp
je 0x50224455
imul esi, dword [ebx + 0x61], 0x64656c62
push es
push ebx
jbe 0x5022447f
dec ebp
jb 0x502243b0
jb 0x502243b0
nop
and al, 0x44
inc esp
and dl, byte [eax + 8]
or eax, 0x72655354
imul esp, dword [ebx + 0x65], 0x6e657645
inc ebp
inc ebp
jb 0x50224446
push eax
or dword [ebx + 0x6f], eax
Function at 0x50224424
Capabilities:
Packed with generic packer

Disassembly:
or byte [0x72655354], cl
jbe 0x50224495
arpl word [ebp + 0x45], sp
jbe 0x50224496
outsb dx, byte [esi]
je 0x50224434
add dword [eax], ecx
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x50224446
push esp
push ebx
jb 0x502244b9
imul esp, dword [ebx + 0x65], 0x22463800
push eax
nop
add byte [eax], bh
inc esi
and dl, byte [eax - 0x70]
push eax
inc esp
and dl, byte [eax + 8]
or byte [esi], cl
jae 0x50224520
pop es
add byte [edx], al
or byte [esi], al

Function at 0x50224450
Capabilities:
Packed with generic packer

Disassembly:
or byte [esi], cl
push esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x502244c1
outsb dx, byte [esi]
jne 0x502244c0
inc ebp
jbe 0x502244c3
outsb dx, byte [esi]
je 0x50224461
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x50224473
push esp
push ebx
jb 0x502244e6
imul esp, dword [ebx + 0x65], 0x6f430901
add dword [ecx], ecx
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x502244e3
outsb dx, byte [esi]
jne 0x502244e2
pop es
inc edx
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
popal
outsb dx, byte [esi]
add byte [eax], bh
inc esi
and dl, byte [eax + 0x44]
jl 0x502244b2
push eax
nop
xchg esp, eax
inc esp
and dl, byte [eax + 8]
invalid
or edx, dword [eax + edx*2 + 0x61]
arpl word [ebp + 1], sp
push es
or byte [esi], al

Function at 0x50224494
Capabilities:
Packed with generic packer

Disassembly:
or byte [ebx], cl
push esp
push eax
popal
jne 0x5022450e
inc ebp
jbe 0x50224504
outsb dx, byte [esi]
je 0x502244a2
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x502244b4
push esp
push ebx
jb 0x50224527
imul esp, dword [ebx + 0x65], 0x61500601
add dword [esi], eax
push eax
popal
jne 0x5022452d
pop es
inc edx
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
popal
outsb dx, byte [esi]
add byte [eax], bh
inc esi
and dl, byte [eax + 0x44]
jl 0x502244f0
push eax
lea eax, [eax]
aam 0x44
and dl, byte [eax + 8]
or byte [ebx], cl
push esp
push ebx
je 0x5022453b
jbe 0x5022455b
arpl word [ebp + 1], sp
pop es

Function at 0x502244d4
Capabilities:
Packed with generic packer

Disassembly:
or byte [ebx], cl
push esp
push ebx
je 0x5022453b
jb 0x50224550
inc ebp
jbe 0x50224544
outsb dx, byte [esi]
je 0x502244e2
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x502244f4
push esp
push ebx
jb 0x50224567
imul esp, dword [ebx + 0x65], 0x74530701
popal
add dword [edi], eax
push ebx
je 0x5022455a
jb 0x5022456f
pop es
inc edx
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
popal
outsb dx, byte [esi]
add byte [eax], bh
inc esi
and dl, byte [eax + 0x44]
jl 0x50224531
push eax
mov eax, eax
adc al, 0x45
and dl, byte [eax + 8]
or byte [edx], cl
push esp
push ebx
je 0x50224589
arpl word [ebp + 1], sp
pop es
pop es
add byte [eax], al
add al, 0x46
Function at 0x50224514
Capabilities:
Packed with generic packer

Disassembly:
or byte [edx], cl
push esp
push ebx
je 0x50224589
jo 0x50224561
jbe 0x50224583
outsb dx, byte [esi]
je 0x50224521
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x50224533
push esp
push ebx
jb 0x502245a6
imul esp, dword [ebx + 0x65], 0x74530701
outsd dx, dword [esi]
add dword [edi], eax
push ebx
je 0x502245a7
jo 0x502245aa
pop es
inc edx
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
popal
outsb dx, byte [esi]
add byte [eax], bh
inc esi
and dl, byte [eax + 0x44]
jl 0x50224570
push eax
lea eax, [eax]
test al, 0x45
and dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + eax*2], al
and dl, byte [eax + 0x3c]
inc esi
and dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], ch
inc esi
inc esi
and dl, byte [eax - 0xc]
add byte [eax], al
add byte [eax + eax*4 + 0x10e05024], dh
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x1e5c5012
adc dl, byte [eax + 0x6c]
push ds
adc dl, byte [eax + 0x50]
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xc4501210
push ecx
and dl, byte [eax + 0x1c]
sbb byte [edx], dl
push eax
mov word [esi], ds
push eax

Function at 0x502245a8
Capabilities:
Packed with generic packer

Disassembly:
sbb al, 0x18
adc dl, byte [eax - 0x74]
push ds
adc dl, byte [eax + 0x14]
sbb byte [edx], dl
push eax
sub al, 0x1d
adc dl, byte [eax + 0xc]
sbb eax, 0x1e945012
adc dl, byte [eax + 0x5c]
sbb eax, 0x1d945012
adc dl, byte [eax + 0x44]
sbb eax, 0x1d3c5012
adc dl, byte [eax - 0x64]
sbb eax, 0x1e545012
adc dl, byte [eax + 0x7c]
push ds
adc dl, byte [eax - 0x7c]
push ds
adc dl, byte [eax + 0x34]
push ecx
and dl, byte [eax + 0x5c]
push edi
and dl, byte [eax - 0x48]
pop eax
and dl, byte [eax - 4]
pop eax
and dl, byte [eax + 0x48]
pop ecx
and dl, byte [eax - 0x74]
pop ecx
and dl, byte [eax - 0x6c]
pop ecx
and dl, byte [eax - 4]
pop ecx
and dl, byte [eax + 0x68]
adc byte [edx], dl
push eax
push cs
add byte [eax], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
and al, 0x7c
and al, 0x50
pushal
add byte [eax], al
add byte [esp + edi*2], ah
and al, 0x50
je 0x5022461c
add byte [eax], al
and al, 0x7c
and al, 0x50
jl 0x50224624
add byte [eax], al
and al, 0x7c
and al, 0x50
add byte [eax], 0
add byte [eax], cl
push esp
push ebx
jb 0x502246aa
imul esp, dword [ebx + 0x65], 0x22463c90
push eax
mov ah, 0x52
and dl, byte [eax - 0x3c]
push edx
Function at 0x50224b60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x50224bde
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x50224ba9
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceW
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50224be5
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x50225d10
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50225eb5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
cmp word [ebx + 0xa2], 0
je 0x50225d59
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x50225d6d
lea esi, [ebp - 0xc]
jmp 0x50225d6f
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x50225d7c
xor edi, edi
jmp 0x50225d89
mov eax, dword [ebx + 0x80]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
mov eax, dword [ebx + 0x7c]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call sym.vcl120.bpl__Svcmgr_TService_GetNTDependencies_qqrv
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
mov eax, dword [ebx + 0x74]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, ebx
call sym.vcl120.bpl__Svcmgr_TService_GetNTErrorSeverity_qqrv
push eax
mov eax, ebx
call sym.vcl120.bpl__Svcmgr_TService_GetNTStartType_qqrv
push eax
mov eax, ebx
call sym.vcl120.bpl__Svcmgr_TService_GetNTServiceType_qqrv
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call sym.vcl120.bpl__Svcmgr_TService_GetDisplayName_qqrv
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x50225e12
call sub.rtl120.bpl__Sysutils_RaiseLastOSError_qqrv
xor edx, edx
push ebp
push 0x50225e8b
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x50225e50
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x50225e46
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50225e74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50225e92
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x50225ec4
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x50225ef0
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x50225f15
call sub.rtl120.bpl__Sysutils_RaiseLastOSError_qqrv
xor eax, eax
push ebp
push 0x50225f4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x50225f35
call sub.rtl120.bpl__Sysutils_RaiseLastOSError_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50225f53
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x502285e4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x5022851c
call sub.user32.dll_EnumWindows
ret

Function at 0x50228708
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x50228787
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.5022813c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x5022872d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.50227cec
cmp dword [ebp - 4], 0
je 0x50228771
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, eax
push 0
push 9
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.user32.dll_WinHelpW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5022878e
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x5022f520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test byte [ebx + 0x2cc], 1
je 0x5022f5fd
cmp ebx, esi
je 0x5022f55e
mov eax, esi
mov edx, dword [sym.vcl120.bpl__Controls_TBaseDragControlObject_]
call sub.rtl120.bpl__System__IsClass_qqrp14System_TObjectp17System_TMetaClass
test al, al
je 0x5022f5fd
cmp ebx, dword [esi + 0x40]
jne 0x5022f5fd
mov eax, ebx
call sym.vcl120.bpl__Categorybuttons_TCategoryButtons_RemoveInsertionPoints_qqrv
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, ebx
call sym.vcl120.bpl__Categorybuttons_TCategoryButtons_GetTargetAt_qqriirp27Categorybuttons_TButtonItemrp31Categorybuttons_TButtonCatego
cmp dword [ebp - 8], 0
je 0x5022f5d1
cmp dword [ebx + 0x274], 0
je 0x5022f5d1
test byte [ebx + 0x2cc], 2
je 0x5022f5b7
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5022f5b7
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x274]
mov eax, ebx
mov si, 0xffb0
call sub.rtl120.bpl__System__CallDynaInst_qqrv
jmp 0x5022f5eb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x274]
mov eax, ebx
mov si, 0xffae
call sub.rtl120.bpl__System__CallDynaInst_qqrv
jmp 0x5022f5eb
mov esi, dword [ebx + 0x278]
test esi, esi
je 0x5022f5eb
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, ebx
mov si, 0xffad
call sub.rtl120.bpl__System__CallDynaInst_qqrv
xor eax, eax
mov dword [ebx + 0x274], eax
xor eax, eax
mov dword [ebx + 0x278], eax
jmp 0x5022f60c
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call sym.vcl120.bpl__Controls_TControl_DragDrop_qqrp14System_TObjectii
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x50232c6c
Capabilities:
Packed with generic packer

Disassembly:
add eax, dword [edx]
cmp dh, byte [ecx]
add dword [eax], eax
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add byte [eax + 0x2c], ch
and edx, dword [eax + 0xf]
bound ebp, qword [bx + 0x41]
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
ja 0x50232cd9
outsd dx, dword gs:[esi]
jb 0x50232cef
jb 0x50232c99
bound ebp, qword [bx + 0x46]
jne 0x50232d00
insb byte es:[edi], dx
push ebx
imul edi, dword [edx + 0x65], 0x6f62670d
inc edi
or eax, 0x476f6267
jb 0x50232d0f
jne 0x50232d12
push ebx
je 0x50232d1e
insb byte es:[edi], dx
packuswb mm4, qword gs:[edx + 0x6f]
push ebx
push 0x6143776f
jo 0x50232d27
imul ebp, dword [edi + 0x6e], 0x75420b73
je 0x50232d30
outsd dx, dword [esi]
outsb dx, byte [esi]
inc edi
jb 0x50232d30
jne 0x50232d33
nop
enter 0x232c, 0x50
outsb dx, byte [esi]
jae 0x50232cdd
push 0xe450232c
sub al, 0x23
push eax
in al, 0x2c
and edx, dword [eax + 8]
or byte [edi], cl
push esp
inc edi
jb 0x50232d5a
inc edx
jb 0x50232d17
push eax

Function at 0x50232cc8
Capabilities:
Packed with generic packer

Disassembly:
push es
adc dword [edi + eax*2 + 0x72], edx
jo 0x50232d11
jne 0x50232d45
je 0x50232d42
outsb dx, byte [esi]
dec edi
jo 0x50232d4b
imul ebp, dword [edi + 0x6e], 0x2c680173
and edx, dword [eax - 0x1c]
sub al, 0x23
push eax
jb 0x50232d4b

Function at 0x50232ce4
Capabilities:
Packed with generic packer

Disassembly:
or byte [edi], cl
push esp
inc edi
jb 0x50232d5a
inc edx
jne 0x50232d61
je 0x50232d5e
outsb dx, byte [esi]
inc ebp
jbe 0x50232d58
outsb dx, byte [esi]
je 0x50232cf6
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x50232d07
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 5], si
dec ecx
outsb dx, byte [esi]
js 0x50232d16
add byte [0x65646e49], al
js 0x50232d16
dec ecx
outsb dx, byte [esi]
je 0x50232d78
jb 0x50232d17
add byte [esp + edi*2], cl
or al, 0x7c
and al, 0x50
cmp byte [esp + 0x50], bh
nop
and al, 0x2d
and edx, dword [eax + 8]
or byte [ebx], dl
push esp
inc edi
jb 0x50232d9a
inc edx
jb 0x50232d63