joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7052c0
Capabilities:
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7053c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
call fcn.00704e60
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
je 0x7053ab
test bl, bl
je 0x70530a
mov byte [ebp - 5], 1
jmp 0x7053ab
call fcn.00704d68
fcomp dword [0x7053dc]
wait
fnstsw ax
sahf
jne 0x70532b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x705342
call fcn.00704d68
add esp, 0xfffffff8
fstp qword [esp]
wait
call sub.rtl120.bpl__Dateutils_DateTimeToUnix_qqrx16System_TDateTime
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
mov edx, 0x7053ec
mov eax, dword [ebp - 4]
call fcn.007051ec
cmp edx, dword [ebp - 0xc]
jne 0x70537b
cmp eax, dword [ebp - 0x10]
jne 0x70537b
mov byte [ebp - 5], 1
jmp 0x7053ab
xor eax, eax
push ebp
push 0x7053a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7053ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7053d0
lea eax, [ebp - 0x14]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x705c54
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x705cae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00704e60
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
je 0x705c93
lea eax, [ebp - 8]
call fcn.00704e60
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x705cb5
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x707cd8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffec0
xor ebx, ebx
mov eax, esp
mov edx, 0x11c
call fcn.00402518
lea eax, [esp + 0x11c]
mov edx, 0x24
call fcn.00402518
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x707e0b
mov eax, dword [esp + 4]
cmp eax, 3
jne 0x707d26
mov bl, 1
jmp 0x707e0b
cmp eax, 4
jne 0x707d32
mov bl, 1
jmp 0x707e0b
cmp eax, 5
jne 0x707dd0
mov eax, dword [esp + 8]
sub eax, 1
jb 0x707d4e
je 0x707d55
dec eax
je 0x707d5c
jmp 0x707e0b
mov bl, 2
jmp 0x707e0b
mov bl, 3
jmp 0x707e0b
push 0x707e18
push 0x707e40
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401bd0
test eax, eax
je 0x707d81
lea edx, [esp + 0x11c]
push edx
call eax
jmp 0x707d8e
lea eax, [esp + 0x11c]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp byte [esp + 0x11a], 1
jne 0x707da7
cmp word [esp + 0x11c], 9
jne 0x707da7
mov bl, 3
jmp 0x707e0b
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x707db6
mov bl, 6
jmp 0x707e0b
movzx eax, word [esp + 0x118]
and ax, 0x8000
cmp ax, 0x8000
jne 0x707dcc
mov bl, 5
jmp 0x707e0b
mov bl, 4
jmp 0x707e0b
cmp eax, 6
jne 0x707e0b
mov eax, dword [esp + 8]
sub eax, 1
jb 0x707de5
je 0x707df7
dec eax
je 0x707e09
jmp 0x707e0b
cmp byte [esp + 0x11a], 1
je 0x707df3
mov bl, 8
jmp 0x707e0b
mov bl, 7
jmp 0x707e0b
cmp byte [esp + 0x11a], 1
je 0x707e05
mov bl, 9
jmp 0x707e0b
mov bl, 0xa
jmp 0x707e0b
mov bl, 0xb
mov eax, ebx
add esp, 0x140
pop ebx
ret
Function at 0x713c54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x713cae
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00713c48
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0065cba0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0065c704
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x713cb5
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x726d0c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x726dab
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x726d8b
push 4
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
jbe 0x726d81
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x726d7b
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
jmp 0x726d90
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x726db2
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x726e24
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x726f2c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x726f0a
push 0x14
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x726f04
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x726efe
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x726efe
xor edi, edi
jmp 0x726ef8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp edi, 0x1f4
ja 0x726efe
cmp dword [ebp - 0x14], 0x64
jbe 0x726ed0
push 0x64
call sub.kernel32.dll_Sleep_1
add edi, 0x64
jmp 0x726edc
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_Sleep_1
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x726efe
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x726efe
cmp dword [ebp - 0x18], 0
je 0x726efe
cmp dword [ebp - 0x28], 4
jne 0x726eb0
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x28], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x726f33
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x726f3c
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x727034
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x727012
push 0x24
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x72700c
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x727006
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x727006
xor edi, edi
jmp 0x727000
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp edi, 0x1f4
ja 0x727006
cmp dword [ebp - 0x10], 0x64
jbe 0x726fde
push 0x64
call sub.kernel32.dll_Sleep_1
add edi, 0x64
jmp 0x726fea
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_Sleep_1
add edi, dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x727006
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jbe 0x727006
cmp dword [ebp - 0x24], 1
jne 0x726fbe
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x24], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72703b
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x72ac54
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, edi
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
mov ebx, eax
inc ebx
mov eax, ebx
call sub.rtl120.bpl__Sysutils_StrAlloc_qqrui
mov dword [ebp - 0xc], eax
mov edx, ebx
add edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00402518
mov ecx, ebx
mov edx, edi
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_StrPLCopy_qqrpbx20System_UnicodeStringui
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00402518
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.00402518
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
movzx eax, word [ebp - 4]
mov word [ebp - 0x28], ax
xor edx, edx
push ebp
push 0x72addf
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x72ad14
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x72ade6
cmp dword [ebp + 0xc], 0
je 0x72ad22
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
test esi, esi
jbe 0x72ad86
cmp byte [ebp + 0x10], 0
je 0x72ad71
call sub.kernel32.dll_GetTickCount
mov edi, eax
push 0
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
cmp ebx, 0xffffffff
jne 0x72ad5c
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp esi, eax
jbe 0x72ad86
cmp ebx, 0x102
je 0x72ad33
jmp 0x72ad86
push esi
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x72ad86
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72ade6
cmp byte [ebp - 0xd], 0
jne 0x72ada1
call sub.kernel32.dll_GetLastError
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x72adbc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x72adc9
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x72add6
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_StrDispose_qqrpb
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x72b534
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffadc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x518], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x72b6e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x112]
push eax
push 0x102
call sub.kernel32.dll_GetLogicalDriveStringsW
test eax, eax
je 0x72b6bc
cmp eax, 0x102
jbe 0x72b5cd
lea edx, [ebp - 0x518]
mov eax, 0xe
call sub.rtl120.bpl__Sysutils_SysErrorMessage_qqrui
mov ecx, dword [ebp - 0x518]
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Exception_]
call sub.rtl120.bpl__Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl120.bpl__System__RaiseExcept_qqrv
lea ebx, [ebp - 0x112]
jmp 0x72b6b2
lea eax, [ebp - 0x514]
mov edx, 0x400
call fcn.00402518
lea eax, [ebp - 8]
push eax
mov eax, ebx
call sub.rtl120.bpl__System__PWCharLen_qqrpb
dec eax
push eax
lea eax, [ebp - 0x51c]
mov edx, ebx
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x51c]
mov edx, 1
pop ecx
call sub.rtl120.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
push 0x200
lea eax, [ebp - 0x514]
push eax
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_QueryDosDeviceW
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x514]
call sub.rtl120.bpl__Sysutils_StrPas_qqrpxb
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_CompareText_qqrx20System_UnicodeStringt1
test eax, eax
jne 0x72b6af
lea eax, [ebp - 0x520]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
add edx, 2
mov eax, dword [ebp - 4]
pop ecx
call sub.rtl120.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 0x520]
push eax
lea eax, [ebp - 0x524]
mov edx, ebx
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x524]
mov eax, esi
pop ecx
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
jmp 0x72b6bc
add ebx, 8
cmp word [ebx], 0
jne 0x72b5d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72b6ee
lea eax, [ebp - 0x524]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x10]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x72c15c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x72c16e
add esp, 0xfffffff0
call sub.rtl120.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp + 0xc]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp + 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x72c2aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00708e08
xor eax, eax
mov dword [0x83ad28], eax
lea eax, [esi + 0x3c]
mov edx, 0x72c2dc
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [esi + 0x40]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [esi + 0x4c]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [esi + 0x50]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [esi + 0x54]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TList_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [esi + 0x28], eax
lea eax, [esi + 0x90]
push eax
call sub.kernel32.dll_InitializeCriticalSection
xor eax, eax
mov dword [esi + 0x34], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [esi + 0x20], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [esi + 0x24], eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [esi + 0x38], eax
mov eax, 0x72c2f4
mov dl, 1
call fcn.0072b4a8
push 0x72c318
call sub.kernel32.dll_LoadLibraryW
mov dword [0x83ad2c], eax
cmp dword [0x83ad2c], 0
je 0x72c280
push 0x72c32c
mov eax, dword [0x83ad2c]
push eax
call fcn.00401bd0
mov dword [0x83ad28], eax
mov eax, esi
call fcn.0072d504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72c2b1
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp + 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x72c7f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x72c99f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x72c977
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x72c970
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x72c89d
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x72c977
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x72c9b0
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
cmp eax, 1
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], 0
je 0x72c8c3
test al, al
jne 0x72c8cd
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x72c977
push 0x72c9f0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call sub.rtl120.bpl__Sysutils_IntToHex_qqrii
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.00402500
movzx eax, ax
lea ecx, [ebp - 0x28]
mov edx, 4
call sub.rtl120.bpl__Sysutils_IntToHex_qqrii
push dword [ebp - 0x28]
push 0x72ca20
lea eax, [ebp - 0xc]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x2c]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x72c950
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x72c977
mov eax, ebx
mov edx, dword [ebp - 0x18]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72c977
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__FreeMem_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72c9a6
lea eax, [ebp - 0x2c]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x72cbf4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, edx
lea eax, [esp + 4]
mov edx, 0x400
call fcn.00402518
mov dword [esp], 0x200
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
mov edx, ebx
lea eax, [esp + 4]
call sub.rtl120.bpl__Sysutils_StrPas_qqrpxb
add esp, 0x408
pop ebx
ret

Function at 0x72dc70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
xor eax, eax
push ebp
push 0x72dd29
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push edi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
cmp esi, 0xffffffff
je 0x72dd0e
test esi, esi
je 0x72dd0e
push 1
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0x72dd48
lea edx, [ebp - 8]
mov eax, edi
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
push dword [ebp - 8]
push 0x72dd7c
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call sub.rtl120.bpl__Sysutils_BoolToStr_qqroo
push dword [ebp - 0xc]
push 0x72dd7c
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 6
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 4]
call fcn.0070b06c
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72dd30
lea eax, [ebp - 0x10]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x72de1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x72de8b
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x72de98
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x72de9c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72de92
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret