joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ff44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x40f8c4]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x4700b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x49], 0
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.00414de0
cmp byte [ebp - 0x40], 0
je 0x470098
mov eax, dword [ebp - 0x20]
call sub.rtl250.bpl__System__DynArrayHigh_qqrpxv
test eax, eax
jl 0x470098
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x44]
jne 0x470090
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp byte [eax], 0xe8
jne 0x470032
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x470098
mov eax, dword [ebx + 0x14]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebx + 8]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [ebp - 0x49], 1
jmp 0x470098
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp word [eax], 0x15ff
jne 0x470098
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x470098
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [ebp - 0x49], 1
jmp 0x470098
inc esi
dec eax
jne 0x46ffb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4700bb
lea eax, [ebp - 0x40]
mov edx, dword [0x40f8c4]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x470324
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov byte [0x53eff0], 0
cmp dword [0x53eff4], 0
je 0x47036b
push esp
push 0x40
push 4
mov eax, dword [0x53eff4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4703c1
mov eax, dword [0x53eff4]
mov edx, dword [0x53eff8]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x53eff4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x4703c1
cmp dword [0x53effc], 0
je 0x4703aa
push esp
push 0x40
push 4
mov eax, dword [0x53effc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4703c1
mov eax, dword [0x53effc]
mov edx, dword [0x53f000]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x53effc]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x4703c1
push 0
mov ecx, 0x46fc60
mov eax, sub.kernel32.dll_CreateThread
mov edx, dword [0x53efe8]
call fcn.0046f63c
push 0
mov ecx, 0x46ff18
mov edx, dword [0x53efec]
xor eax, eax
call fcn.0046f63c
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
ret

Function at 0x4709e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x470878]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x470abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x470acc
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x470a96
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.004089b4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x470ae4
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00409d88
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
lea eax, [ebp - 4]
mov edx, 0x470b0c
call sub.rtl250.bpl__System__LStrCat_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
cmp eax, 0x104
jge 0x470a88
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call sub.rtl250.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
lea eax, [ebp - 8]
push eax
push 0x4708e8
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470ac6
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, dword [0x470878]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x4713dc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4714b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.004089b4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x4714cc
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x471496
mov byte [0x53e59c], 1
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x471490
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x471478
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
mov edx, 0x53e6a8
lea eax, [esi + 8]
mov ecx, 0x50
call sub.rtl250.bpl__System_Move_qqrpxvpvi
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4714b8
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x4719e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x471b61
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, 0x471b70
mov ecx, 0x471b84
mov eax, ebx
call fcn.0040ec68
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
cmp eax, 0x14
jne 0x471b4b
cmp ebx, dword [0x53e64c]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x471b4b
mov eax, ebx
call fcn.0040e400
mov esi, eax
cmp word [esi + 0x18], 0x20b
jne 0x471abe
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x53e64c]
jne 0x471a84
mov eax, 0x4330ec
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
jmp 0x471a91
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x471b3c
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x53e64c]
jne 0x471af8
mov edx, 0x4330ec
mov eax, dword [ebp - 4]
sub edx, dword [eax]
sub edx, ebx
mov dword [esi + 0x2c], edx
mov edx, 0x53e5c4
sub edx, dword [eax + 4]
sub edx, ebx
mov dword [esi + 0x30], edx
jmp 0x471b11
mov eax, dword [ebp - 4]
mov edx, dword [eax]
and edx, 0x7fffffff
mov dword [esi + 0x2c], edx
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471b68
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x471c88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471e5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x471e44
xor eax, eax
push ebp
push 0x471e3a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
jmp 0x471e1b
cmp dword [ebp - 0x1c], 0x1000
jne 0x471e13
cmp dword [ebp - 0x18], 1
je 0x471e13
cmp esi, dword [ebp - 0x28]
je 0x471e13
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x471e13
push 0x104
lea eax, [ebp - 0x236]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jbe 0x471e13
mov eax, dword [ebp - 0x28]
call fcn.00438850
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x471e13
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x471e13
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x471e13
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x53fae8]
mov esi, dword [esi]
mov eax, 0x471e68
mov ecx, 0xe
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471dd4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x53fae8]
mov esi, dword [esi]
mov eax, 0x471e78
mov ecx, 0x10
mov edx, dword [ebp - 0x10]
call esi
inc eax
sete dl
mov eax, dword [ebp - 0x28]
call fcn.00471394
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x53fae8]
mov esi, dword [esi]
mov eax, 0x471e8c
mov ecx, 0xc
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471e13
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004711b4
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add ebx, eax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
je 0x471cd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471e61
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x4740a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x474165
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0xc], 0
je 0x47415c
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x474156
cmp dword [ebp - 0x10], 1
jne 0x474148
mov eax, ebx
mov edx, esi
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
jmp 0x474156
push 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl250.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x481978
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
lea eax, [ebp - 8]
mov edx, dword [0x48052c]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x4819e5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x48178c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x4819c9
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4819ec
lea eax, [ebp - 8]
mov edx, dword [0x48052c]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret

Function at 0x4940b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x494217
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
cmp word [ebp + 0x12], 0
je 0x4940ee
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
call dword [ebp + 0x10]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x494201
test esi, esi
jne 0x494103
call sub.rtl250.bpl__System_Sysutils_TEncoding_GetUTF8_qqrv
mov esi, eax
xor edx, edx
push ebp
push 0x4941e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Classes_TStringList_]
call sub.rtl250.bpl__System_Classes_TStringList__bctr_qqrv
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4941d6
push dword fs:[eax]
mov dword fs:[eax], esp
movzx edx, byte [ebp + 8]
mov eax, dword [ebp - 0xc]
call sub.rtl250.bpl__System_Classes_TStrings_SetWriteBOM_qqrxo
lea ecx, [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.00494b0c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 0xc]
add eax, 0xc
mov edx, 0x494238
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0xff20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Classes_TFileStream_]
call sub.rtl250.bpl__System_Classes_TFileStream__bctr_qqrx20System_UnicodeStringus
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4941b9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
call sub.rtl250.bpl__System_Classes_TStream_SetPosition_qqrxj
mov ecx, esi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4941c0
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49421e
lea eax, [ebp - 0x14]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x4e07c0
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x4e07f8
test edx, 0x40000000
je 0x4e07e4
test edx, 0x80000000
je 0x4e07df
or eax, 0x40
jmp 0x4e0822
or eax, 0x20
jmp 0x4e0822
test edx, 0x80000000
je 0x4e07f3
or eax, 0x80
jmp 0x4e0822
or eax, 0x10
jmp 0x4e0822
test edx, 0x40000000
je 0x4e0812
test edx, 0x80000000
je 0x4e080d
or eax, 4
jmp 0x4e0822
or eax, 2
jmp 0x4e0822
test edx, 0x80000000
je 0x4e081f
or eax, 8
jmp 0x4e0822
or eax, 1
test edx, 0x4000000
je 0x4e082f
or eax, 0x200
ret

Function at 0x4e0944
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.00403dc4
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov eax, dword [ebx + 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x4e09d0
cmp dword [ebx + 0x44], 0x4550
jne 0x4e09d0
cmp word [ebx + 0x48], 0x14c
je 0x4e09e6
mov ecx, 0x4e09f8
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_Exception_]
call sub.rtl250.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl250.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret
Function at 0x4e1ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e1ffb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
push 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x4dbc74]
call fcn.004dc054
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e1fd1
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x4e1f36
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xc], 0
jne 0x4e1f36
lea eax, [ebp - 4]
mov edx, dword [0x53fbfc]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x4e1f62
mov eax, dword [ebp - 0xc]
call fcn.004dc2ec
test al, al
je 0x4e1f52
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x14]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x4e1f62
lea eax, [ebp - 4]
mov edx, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov esi, 0x11
mov ebx, dword [0x53fbfc]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x10]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
xor edi, eax
mov eax, edi
xor edx, edx
push edx
push eax
call sub.rtl250.bpl__System_Math_Min_qqrxjxj
mov dword [ebp - 8], eax
add ebx, 8
dec esi
jne 0x4e1f6d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1fd8
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
Function at 0x4e647c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e6593
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4e7704]
call fcn.004e8f58
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4e6560
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x4e6528
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x41]
call sub.rtl250.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x4e65b0
call sub.rtl250.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.AxComponentsRTL.bpl__Axrtl_System_Ioutils_TFileHelper_GetDriveType_qqrx20System_UnicodeString
cmp eax, 3
jne 0x4e6528
mov eax, ebx
inc eax
call sub.rtl250.bpl__System_Sysutils_DiskFree_qqruc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4e495c]
call fcn.004e6710
mov edx, eax
mov eax, dword [ebp - 0x14]
call fcn.004e9228
inc ebx
cmp ebx, 0x1b
jne 0x4e64c6
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.004e97bc
mov edx, dword [ebp - 0x1c]
lea eax, [edi + 0x28]
mov ecx, dword [0x4e6168]
call sub.rtl250.bpl__System__DynArrayAsg_qqrrpvpvt2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6567
lea eax, [ebp - 0x14]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret

Function at 0x4e6624
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4e6693
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa]
mov edx, 0xa
call fcn.00403dc4
push 4
lea eax, [ebp - 0xa]
push eax
push 3
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xa]
mov ecx, 5
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov edx, dword [ebp - 0x10]
mov ecx, esi
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Strutils_StrUtils_]
call sub.AxComponentsRTL.bpl__Axrtl_System_Strutils_StrUtils_LowerCase_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e669a
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret