joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e2b8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x45e3c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x45e3a8
mov eax, ebx
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00412614
mov dword [edi], eax
test esi, esi
je 0x45e316
cmp word [esi], 0x25ff
jne 0x45e316
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x45e318
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x45e336
push 0
call sub.kernel32.dll_GetModuleHandleW_1
cmp eax, dword [0x597e98]
je 0x45e336
cmp byte [0x597ea4], 0
je 0x45e34d
lea eax, [ebp - 0x10]
call fcn.0042d710
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
call fcn.0042db64
jmp 0x45e35c
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x597e98]
call fcn.0042daac
test ebx, ebx
je 0x45e36b
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x45e36f
xor eax, eax
jmp 0x45e371
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x45e3ac
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x45e3ac
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x45e3ac
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e3cf
lea eax, [ebp - 0x10]
mov edx, dword [0x42d6e4]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x45e3dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45e4b7
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x45e49b
test esi, esi
je 0x45e41d
cmp word [esi], 0x25ff
jne 0x45e41d
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x45e41f
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x45e43d
push 0
call sub.kernel32.dll_GetModuleHandleW_1
cmp eax, dword [0x597e98]
je 0x45e43d
cmp byte [0x597ea4], 0
je 0x45e454
lea eax, [ebp - 0xc]
call fcn.0042d710
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.0042db64
jmp 0x45e463
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x597e98]
call fcn.0042daac
test ebx, ebx
je 0x45e49b
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x45e49b
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x45e49b
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e4be
lea eax, [ebp - 0xc]
mov edx, dword [0x42d6e4]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x45ecd4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x414128]
call sub.rtl120.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x45ee44
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x49], 0
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.00419530
cmp byte [ebp - 0x40], 0
je 0x45ee28
mov eax, dword [ebp - 0x20]
call sub.rtl120.bpl__System__DynArrayHigh_qqrv
test eax, eax
jl 0x45ee28
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x44]
jne 0x45ee20
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp byte [eax], 0xe8
jne 0x45edc2
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x45ee28
mov edx, dword [ebp + 0x14]
mov eax, dword [ebx + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebx + 8]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov byte [ebp - 0x49], 1
jmp 0x45ee28
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp word [eax], 0x15ff
jne 0x45ee28
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x45ee28
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov byte [ebp - 0x49], 1
jmp 0x45ee28
inc esi
dec eax
jne 0x45ed47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ee4b
lea eax, [ebp - 0x40]
mov edx, dword [0x414128]
call sub.rtl120.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x45f0b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov byte [0x598840], 0
cmp dword [0x598844], 0
je 0x45f0fb
push esp
push 0x40
push 4
mov eax, dword [0x598844]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x45f151
mov eax, dword [0x598844]
mov edx, dword [0x598848]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x598844]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x45f151
cmp dword [0x59884c], 0
je 0x45f13a
push esp
push 0x40
push 4
mov eax, dword [0x59884c]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x45f151
mov eax, dword [0x59884c]
mov edx, dword [0x598850]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x59884c]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x45f151
push 0
mov ecx, 0x45e9ec
mov eax, sub.kernel32.dll_CreateThread
mov edx, dword [0x598838]
call fcn.0045e3dc
push 0
mov ecx, 0x45eca8
mov edx, dword [0x59883c]
xor eax, eax
call fcn.0045e3dc
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
ret

Function at 0x45f744
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x45f614]
call sub.rtl120.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x45f823
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x45f830
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x45f7fa
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040585c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x45f848
call sub.rtl120.bpl__System__LStrCat3_qqrv
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00406e1c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrLAsg_qqrpvpxv
lea eax, [ebp - 4]
mov edx, 0x45f870
call sub.rtl120.bpl__System__LStrCat_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
cmp eax, 0x104
jge 0x45f7ec
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call sub.rtl120.bpl__System__LStrSetLength_qqrv
lea eax, [ebp - 8]
push eax
push 0x45f64c
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f82a
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, dword [0x45f614]
call sub.rtl120.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x46013c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x460211
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040585c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x46022c
call sub.rtl120.bpl__System__LStrCat3_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x4601f6
mov byte [0x597dd8], 1
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x4601f0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4601d8
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
mov edx, 0x597ef8
lea eax, [esi + 8]
mov ecx, 0x50
call sub.rtl120.bpl__System_Move_qqrpxvpvi
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460218
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x460748
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4608dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, 0x4608ec
mov ecx, 0x460900
mov eax, ebx
call fcn.00412b30
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
cmp eax, 0x14
jne 0x4608c6
cmp ebx, dword [0x597e98]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x4608c6
mov eax, ebx
call fcn.0041233c
mov esi, eax
cmp word [esi + 0x18], 0x20b
jne 0x46082e
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x597e98]
jne 0x4607eb
mov eax, 0x42c068
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
jmp 0x4607f8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x4608b7
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x597e98]
jne 0x46086b
mov eax, 0x42c068
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
mov eax, 0x597e08
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
sub eax, ebx
mov dword [esi + 0x30], eax
jmp 0x460886
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4608e3
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret
Function at 0x460a04
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x460be3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x460c00
call sub.rtl120.bpl__System__LStrLAsg_qqrpvpxv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x460bcd
xor eax, eax
push ebp
push 0x460bc3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
jmp 0x460ba4
cmp dword [ebp - 0x1c], 0x1000
jne 0x460b9c
cmp dword [ebp - 0x18], 1
je 0x460b9c
cmp esi, dword [ebp - 0x28]
je 0x460b9c
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x460b9c
push 0x104
lea eax, [ebp - 0x236]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jbe 0x460b9c
mov eax, dword [ebp - 0x28]
call fcn.00431590
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x460b9c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x460b9c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x460b9c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x5a73f4]
mov esi, dword [esi]
mov eax, 0x460c10
mov ecx, 0xe
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x460b5d
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x5a73f4]
mov esi, dword [esi]
mov eax, 0x460c20
mov ecx, 0x10
mov edx, dword [ebp - 0x10]
call esi
inc eax
sete dl
mov eax, dword [ebp - 0x28]
call fcn.004600f4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x5a73f4]
mov esi, dword [esi]
mov eax, 0x460c34
mov ecx, 0xc
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x460b9c
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.0045ff10
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add ebx, eax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
je 0x460a5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460bcd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460bea
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret
Function at 0x462d18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x462ddd
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0xc], 0
je 0x462dd4
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x462dce
cmp dword [ebp - 0x10], 1
jne 0x462dc0
mov eax, ebx
mov edx, esi
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
jmp 0x462dce
push 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl120.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x468f48
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x468f4e
ret
Function at 0x4751fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x47521d
test edi, 0x40000
je 0x475237
test bl, bl
jne 0x4752b8
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4752b8
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x47526a
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x47527f
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x47528e
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x47529f
cmp byte [esp + 2], 0
je 0x4752b8
cmp byte [esp + 2], 0
je 0x4752b0
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4752b8
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x475560
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x475586
mov eax, esp
push eax
push 0x475528
call sub.user32.dll_EnumWindows
jmp 0x475599
mov eax, esp
push eax
push 0x475508
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x47565c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4756b0]
test si, 4
je 0x475671
or bl, 1
test si, 8
je 0x47567b
or bl, 4
test si, 1
je 0x475685
or bl, 8
test si, 2
je 0x47568f
or bl, 0x10
test si, 0x10
je 0x475699
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4756a8
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4756b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4756f0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4756ce
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4756dd
or bl, 4
test esi, 0x20000000
je 0x4756e8
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x47da28
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x47da3a
add esp, 0xfffffff0
call sub.rtl120.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call sub.rtl120.bpl__Classes_TComponent__bctr_qqrp18Classes_TComponent
mov eax, dword [sym.imp.rtl120.bpl__Classes_AddDataModule]
mov dword [eax + 4], ebx
mov dword [eax], 0x47de3c
mov eax, dword [sym.imp.rtl120.bpl__Classes_RemoveDataModule]
mov dword [eax + 4], ebx
mov dword [eax], 0x47de48
mov eax, ebx
call fcn.0047de54
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TList_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TList_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TList_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TList_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TList_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x478e78
push eax
push 0
push 0
mov eax, dword [sym.imp.rtl120.bpl__Multimon_EnumDisplayMonitors]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x468500]
call fcn.00469f80
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x468500]
call fcn.00469f80
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x468500]
call fcn.00469f80
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x468500]
call fcn.00469f80
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.0047e34c
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47e224
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47e224
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47e224
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47e224
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47db8d
call sub.rtl120.bpl__System__AfterConstruction_qqrp14System_TObject
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret