joyce8/EMBER2024-capa huggingface dataset:
Function at 0x602cac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x602d6b
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x602d62
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x602d5b
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x602d44
sub eax, 4
jne 0x602d4f
mov eax, ebx
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
jmp 0x602d5b
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov eax, esi
call sub.rtl120.bpl__System__FreeMem_qqrpv
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x607718
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6077a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6077bc
call fcn.0051a0b0
push 0x6077e4
lea ecx, [ebp - 8]
mov edx, 4
xor eax, eax
call fcn.0040ba0c
mov eax, dword [ebp - 8]
mov ecx, 0x607840
mov edx, 0x607858
call fcn.0051a3d0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x60769c
push 0
push 0
call sub.kernel32.dll_CreateThread
mov ebx, eax
push 0xbb8
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6077a8
lea eax, [ebp - 8]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x608fb8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop ebx
ret
Function at 0x6092f0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x60936c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__WStrSetLength_qqrr17System_WideStringi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__WStrToPWChar_qqrx17System_WideString
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x60934d
mov edx, dword [ebp - 8]
dec edx
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__WStrSetLength_qqrr17System_WideStringi
mov eax, ebx
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrFromWStr_qqrr20System_UnicodeStringx17System_WideString
jmp 0x609356
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x609373
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__WStrClr_qqrpv
ret
Function at 0x609898
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop ebx
ret

Function at 0x6098c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop ebx
ret
Function at 0x60ae80
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x60b009
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.00407fb4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x60afeb
xor eax, eax
push ebp
push 0x60afe4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call sub.rtl120.bpl__System__FillChar_qqrpvib
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00407fd4
mov ebx, eax
jmp 0x60afc5
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call sub.rtl120.bpl__Sysutils_ExtractFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x244]
mov eax, 0x60b024
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x60afb5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x60afb5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x78bdc0]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x60afb5
xor eax, eax
push ebp
push 0x60afae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x60af97
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x60afeb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60afb5
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00407ff4
mov ebx, eax
test ebx, ebx
jne 0x60af03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60afeb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b010
lea eax, [ebp - 0x248]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x60b440
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x60b5dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, dword [ebp - 4]
mov eax, 0x60b5f8
call fcn.0060b1e8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x60b4d5
xor eax, eax
push ebp
push 0x60b4ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.0060b614
test al, al
je 0x60b4ad
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x60b5c7
mov eax, dword [ebp - 8]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b4d5
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov dword [ebp - 0x10], 0x802
lea eax, [ebp - 0x822]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call sub.rtl120.bpl__System__FillChar_qqrpvib
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x822]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov ebx, eax
push ebx
push 0
call sub.advapi32.dll_LookupAccountNameW
cmp dword [ebp - 0x14], 0
jbe 0x60b5c7
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__GetMem_qqri
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x60b5c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call sub.rtl120.bpl__System__FillChar_qqrpvib
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x822]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x60b582
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__FreeMem_qqrpv
xor eax, eax
mov dword [ebp - 0x1c], eax
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x60b5c7
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ConvertSidToStringSidW
test eax, eax
je 0x60b5a7
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b5c7
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__FreeMem_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b5e4
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x60b934
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
cmp byte [0x7d47e8], 0
je 0x60b96b
xor eax, eax
call fcn.0060b3c8
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x60b9da
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0060b9fc
jmp 0x60b9da
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.0060b040
push eax
mov eax, dword [0x78bdc0]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x60b9b8
mov eax, ebx
mov edx, dword [esp]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebx]
mov edx, 0x60b9ec
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x60b9af
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x60b9da
xor eax, eax
call fcn.0060b3c8
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x60b9da
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0060b9fc
pop ecx
pop edx
pop ebx
ret
Function at 0x60bbfc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x60bd2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x60bd07
mov eax, ebx
call sub.rtl120.bpl__System__GetMem_qqri
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x60bd38
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x14]
push 0x60bd48
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x18]
push 0x60bd48
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x1c]
push 0x60bd48
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x20]
mov eax, edi
mov edx, 7
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, esi
call sub.rtl120.bpl__System__FreeMem_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bd31
lea eax, [ebp - 0x20]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x6134e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x61353c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6132d0
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x613543
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x613650
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6136c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 4]
call fcn.0060b934
lea eax, [ebp - 8]
lea edx, [ebp - 0x214]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrEqual_qqrv
je 0x6136ae
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6136d0
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x616d38
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x616d40
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x616fcf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
xor ecx, ecx
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringStream_]
call sub.rtl120.bpl__Classes_TStringStream__bctr_qqrx20System_UnicodeString
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x563cf8]
call fcn.0053b2e0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00566a74
add eax, 0x40
mov edx, 0x616fec
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x616fa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dx, 0x26
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Classes_TStrings_SetDelimiter_qqrxb
mov dl, 1
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Classes_TStrings_SetStrictDelimiter_qqrxo
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Classes_TStrings_SetDelimitedText_qqrx20System_UnicodeString
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
push ebp
push 0x616e79
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x616e68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax + 0x68], 0
je 0x616e1c
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x5c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00564374
jmp 0x616e31
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x5c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.005648f0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__Classes_TStringStream_GetDataString_qqrv
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x61703c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x616e6f
ret
Function at 0x617f4c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x61800d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetSystemDefaultLangID
mov esi, eax
lea edx, [ebp - 8]
movzx eax, si
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x618028
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp si, 0x409
je 0x617ff0
cmp si, 0x809
je 0x617ff0
cmp si, 0x40c
je 0x617ff0
cmp si, 0x407
je 0x617ff0
cmp si, 0x410
je 0x617ff0
cmp si, 0x1009
je 0x617ff0
cmp si, 0xc0c
je 0x617ff0
cmp si, 0xc09
je 0x617ff0
cmp si, 0x411
je 0x617ff0
cmp si, 0xc0a
je 0x617ff0
cmp si, 0x1409
je 0x617ff0
cmp si, 0x413
je 0x617ff0
cmp si, 0x462
jne 0x617ff2
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618014
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x61831c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x618437
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x618414
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x61840d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6183ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov ecx, eax
mov edx, 0x618448
mov eax, 0x618468
call sub.rtl120.bpl__Classes_ExtractStrings_qqrrx29System__Set_tc_iuc_0_iuc_255_t1pbp16Classes_TStrings
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Sysutils_StrToInt_qqrx20System_UnicodeString
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x618494
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6183f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618414
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_TObject_Free_qqrv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61843e
lea eax, [ebp - 0x18]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x619650
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push 0x6196b8
push 0x6196e4
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401b80
test eax, eax
je 0x61967e
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x619699
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call sub.rtl120.bpl__System___lldiv_qqrv
mov esp, ebp
pop ebp
ret
Function at 0x619700
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x18]
xor eax, eax
push ebp
push 0x6197b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.00619300
test al, al
jne 0x619794
call fcn.00619574
cmp eax, 0x7d0
jl 0x619794
call fcn.00619650
cmp eax, 0x5dc
jl 0x619794
mov dword [esi], 0
mov dword [esi + 4], 0
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
call fcn.0040b4f4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
cmp dword [esi + 4], 0
jne 0x619790
cmp dword [esi], 0x1f400000
jae 0x619792
jmp 0x619794
jl 0x619794
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6197b9
lea eax, [ebp - 0x20]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x1c]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret