joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467a70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x467bb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x467bcc
call sub.rtl250.bpl__System__LStrEqual_qqrv
je 0x467b7d
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x467ae5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov ecx, 0x467bdc
mov edx, ebx
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 0x2c]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call eax
jmp 0x467b39
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov ecx, 0x467bdc
mov edx, ebx
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 0x30]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x467b39
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call sub.rtl250.bpl__System___llmul_qqrv
call sub.rtl250.bpl__System___llmul_qqrv
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x467bec
mov edi, dword [0x603a78]
mov edi, dword [edi]
lea edx, [ebp - 0x38]
mov eax, ebx
call edi
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call sub.rtl250.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
push dword [ebp - 0x34]
push 0x467bfc
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.00409b30
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call sub.rtl250.bpl__System__UStrCatN_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467bb7
lea eax, [ebp - 0x3c]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x38]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x34]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x30]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x46aca8
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId
cmp esi, eax
je 0x46acd2
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x46acd2
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x46f650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x46f760
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x46f740
mov eax, ebx
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0040eec4
mov dword [edi], eax
test esi, esi
je 0x46f6ae
cmp word [esi], 0x25ff
jne 0x46f6ae
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x46f6b0
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x46f6ce
push 0
call sub.kernel32.dll_GetModuleHandleW
cmp eax, dword [0x5fb60c]
je 0x46f6ce
cmp byte [0x5fb618], 0
je 0x46f6e5
lea eax, [ebp - 0x10]
call fcn.00434b00
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
call fcn.00434f54
jmp 0x46f6f4
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x5fb60c]
call fcn.00434e9c
test ebx, ebx
je 0x46f703
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x46f707
xor eax, eax
jmp 0x46f709
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46f744
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x46f744
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x46f744
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f767
lea eax, [ebp - 0x10]
mov edx, dword [0x434ad0]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x46f774
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46f84f
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x46f833
test esi, esi
je 0x46f7b5
cmp word [esi], 0x25ff
jne 0x46f7b5
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x46f7b7
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x46f7d5
push 0
call sub.kernel32.dll_GetModuleHandleW
cmp eax, dword [0x5fb60c]
je 0x46f7d5
cmp byte [0x5fb618], 0
je 0x46f7ec
lea eax, [ebp - 0xc]
call fcn.00434b00
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.00434f54
jmp 0x46f7fb
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x5fb60c]
call fcn.00434e9c
test ebx, ebx
je 0x46f833
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x46f833
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x46f833
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f856
lea eax, [ebp - 0xc]
mov edx, dword [0x434ad0]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x47007c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x4100ac]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x4701ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x49], 0
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.004155c8
cmp byte [ebp - 0x40], 0
je 0x4701d0
mov eax, dword [ebp - 0x20]
call sub.rtl250.bpl__System__DynArrayHigh_qqrpxv
test eax, eax
jl 0x4701d0
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x44]
jne 0x4701c8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp byte [eax], 0xe8
jne 0x47016a
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4701d0
mov eax, dword [ebx + 0x14]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebx + 8]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [ebp - 0x49], 1
jmp 0x4701d0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp word [eax], 0x15ff
jne 0x4701d0
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4701d0
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [ebp - 0x49], 1
jmp 0x4701d0
inc esi
dec eax
jne 0x4700ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4701f3
lea eax, [ebp - 0x40]
mov edx, dword [0x4100ac]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x47045c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov byte [0x5fbfb0], 0
cmp dword [0x5fbfb4], 0
je 0x4704a3
push esp
push 0x40
push 4
mov eax, dword [0x5fbfb4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4704f9
mov eax, dword [0x5fbfb4]
mov edx, dword [0x5fbfb8]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x5fbfb4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x4704f9
cmp dword [0x5fbfbc], 0
je 0x4704e2
push esp
push 0x40
push 4
mov eax, dword [0x5fbfbc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4704f9
mov eax, dword [0x5fbfbc]
mov edx, dword [0x5fbfc0]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x5fbfbc]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x4704f9
push 0
mov ecx, 0x46fd98
mov eax, sub.kernel32.dll_CreateThread
mov edx, dword [0x5fbfa8]
call fcn.0046f774
push 0
mov ecx, 0x470050
mov edx, dword [0x5fbfac]
xor eax, eax
call fcn.0046f774
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
ret

Function at 0x470b18
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x4709b0]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x470bf7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x470c04
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x470bce
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.00408ff8
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x470c1c
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040a3cc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
lea eax, [ebp - 4]
mov edx, 0x470c44
call sub.rtl250.bpl__System__LStrCat_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
cmp eax, 0x104
jge 0x470bc0
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call sub.rtl250.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
lea eax, [ebp - 8]
push eax
push 0x470a20
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470bfe
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, dword [0x4709b0]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x471514
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4715e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00408ff8
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x471604
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x4715ce
mov byte [0x5fb55c], 1
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x4715c8
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4715b0
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
mov edx, 0x5fb668
lea eax, [esi + 8]
mov ecx, 0x50
call sub.rtl250.bpl__System_Move_qqrpxvpvi
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4715f0
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x471b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x471c99
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, 0x471ca8
mov ecx, 0x471cbc
mov eax, ebx
call fcn.0040f450
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
cmp eax, 0x14
jne 0x471c83
cmp ebx, dword [0x5fb60c]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x471c83
mov eax, ebx
call fcn.0040ebe8
mov esi, eax
cmp word [esi + 0x18], 0x20b
jne 0x471bf6
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x5fb60c]
jne 0x471bbc
mov eax, 0x433224
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
jmp 0x471bc9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x471c74
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x5fb60c]
jne 0x471c30
mov edx, 0x433224
mov eax, dword [ebp - 4]
sub edx, dword [eax]
sub edx, ebx
mov dword [esi + 0x2c], edx
mov edx, 0x5fb584
sub edx, dword [eax + 4]
sub edx, ebx
mov dword [esi + 0x30], edx
jmp 0x471c49
mov eax, dword [ebp - 4]
mov edx, dword [eax]
and edx, 0x7fffffff
mov dword [esi + 0x2c], edx
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471ca0
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x471dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471f92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x471f7c
xor eax, eax
push ebp
push 0x471f72
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
jmp 0x471f53
cmp dword [ebp - 0x1c], 0x1000
jne 0x471f4b
cmp dword [ebp - 0x18], 1
je 0x471f4b
cmp esi, dword [ebp - 0x28]
je 0x471f4b
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x471f4b
push 0x104
lea eax, [ebp - 0x236]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jbe 0x471f4b
mov eax, dword [ebp - 0x28]
call fcn.00438988
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x471f4b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x471f4b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x471f4b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x603808]
mov esi, dword [esi]
mov eax, 0x471fa0
mov ecx, 0xe
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471f0c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x603808]
mov esi, dword [esi]
mov eax, 0x471fb0
mov ecx, 0x10
mov edx, dword [ebp - 0x10]
call esi
inc eax
sete dl
mov eax, dword [ebp - 0x28]
call fcn.004714cc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x603808]
mov esi, dword [esi]
mov eax, 0x471fc4
mov ecx, 0xc
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471f4b
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004712ec
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add ebx, eax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
je 0x471e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471f99
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x4741d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x47429d
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0xc], 0
je 0x474294
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x47428e
cmp dword [ebp - 0x10], 1
jne 0x474280
mov eax, ebx
mov edx, esi
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
jmp 0x47428e
push 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl250.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47fbe0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
lea eax, [ebp - 8]
mov edx, dword [0x47e7a4]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x47fc4d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x47f9f4
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x47fc31
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fc54
lea eax, [ebp - 8]
mov edx, dword [0x47e7a4]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret

Function at 0x483a10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebx*4 + 0x60759c]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
test eax, eax
jg 0x483a92
lea eax, [ebp - 0xa0]
mov edx, 0xa0
call fcn.0040437c
push 0x50
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebx + 0x2a]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x483a81
push 1
lea eax, [ebp - 0xa0]
push eax
call sub.user32.dll_CharUpperBuffW
lea eax, [ebx*4 + 0x60759c]
lea edx, [ebp - 0xa0]
mov ecx, 0x50
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x483a92
lea eax, [ebx*4 + 0x60759c]
mov edx, 0x483ab4
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, esi
mov edx, dword [ebx*4 + 0x60759c]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48d5c8
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x48d600
test edx, 0x40000000
je 0x48d5ec
test edx, 0x80000000
je 0x48d5e7
or eax, 0x40
jmp 0x48d62a
or eax, 0x20
jmp 0x48d62a
test edx, 0x80000000
je 0x48d5fb
or eax, 0x80
jmp 0x48d62a
or eax, 0x10
jmp 0x48d62a
test edx, 0x40000000
je 0x48d61a
test edx, 0x80000000
je 0x48d615
or eax, 4
jmp 0x48d62a
or eax, 2
jmp 0x48d62a
test edx, 0x80000000
je 0x48d627
or eax, 8
jmp 0x48d62a
or eax, 1
test edx, 0x4000000
je 0x48d637
or eax, 0x200
ret
Function at 0x48d74c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.0040437c
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov eax, dword [ebx + 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x48d7d8
cmp dword [ebx + 0x44], 0x4550
jne 0x48d7d8
cmp word [ebx + 0x48], 0x14c
je 0x48d7ee
mov ecx, 0x48d800
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_Exception_]
call sub.rtl250.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl250.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret