joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448f8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44901d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.rtl70.bpl__Sysutils_Win32Platform]
cmp dword [eax], 2
jne 0x448fcc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x448fff
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl70.bpl__System__WStrFromPWChar_qqrr17System_WideStringpb
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrFromWStr_qqrr17System_AnsiStringx17System_WideString
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449024
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x449030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4490c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.rtl70.bpl__Sysutils_Win32Platform]
cmp dword [eax], 2
jne 0x449073
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
jmp 0x4490a6
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl70.bpl__System__WStrFromPWChar_qqrr17System_WideStringpb
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrFromWStr_qqrr17System_AnsiStringx17System_WideString
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4490cb
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x449ba8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
xor eax, eax
mov dword [esp], eax
push 2
lea eax, [esp + 4]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, esi
call fcn.00448ce0
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00448f34
test eax, eax
jne 0x449c11
mov eax, ebp
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
jne 0x449c1a
mov ecx, ebp
mov edx, edi
mov eax, esi
call fcn.00448a98
jmp 0x449c1a
mov edx, edi
mov eax, esi
call fcn.00448a1c
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x449c24
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x449d78
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0xf003f
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, esi
call fcn.00448ce0
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00448f34
test eax, eax
sete bl
test bl, bl
je 0x449d53
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp dword [ebp - 0x10], 0
je 0x449d27
mov edi, dword [ebp - 0x10]
dec edi
cmp edi, 0
jb 0x449d27
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x18]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
call sub.rtl70.bpl__Sysutils_StrLen_qqrpxc
mov edx, eax
lea eax, [ebp - 0x18]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
push dword [ebp - 4]
push 0x449d90
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, 3
call sub.rtl70.bpl__System__LStrCatN_qqrv
mov edx, dword [ebp - 0x1c]
mov eax, esi
call sym.P_Interface.bpl__Jclregistry_RegDeleteKeyTree_qqrxuix17System_AnsiString
mov ebx, eax
test bl, bl
je 0x449d27
dec edi
cmp edi, 0xffffffff
jne 0x449cb1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
je 0x449d5d
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, esi
call fcn.00448ce0
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
jmp 0x449d5d
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00448a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449d7f
lea eax, [ebp - 0x1c]
mov edx, 2
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x449d94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.00448ce0
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448f34
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x449e06
push esi
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x449e14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.00448ce0
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448f34
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x449e86
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x44c364
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c4b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_BeginUpdate_qqrv
xor eax, eax
push ebp
push 0x44c497
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.00448ce0
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448f34
test eax, eax
jne 0x44c478
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x44c46d
mov edx, dword [ebp - 0x1c]
inc edx
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
cmp dword [ebp - 0x18], 0
je 0x44c469
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jb 0x44c469
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0x20]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
lea eax, [ebp - 0x24]
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x44c422
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x44c481
mov edx, esi
mov eax, ebx
call fcn.004489a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c49e
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_EndUpdate_qqrv
ret
Function at 0x44c4cc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c61f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_BeginUpdate_qqrv
xor eax, eax
push ebp
push 0x44c5fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.00448ce0
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448f34
test eax, eax
jne 0x44c5de
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x44c5d3
mov edx, dword [ebp - 0x18]
inc edx
lea eax, [ebp - 0x1c]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
cmp dword [ebp - 0x14], 0
je 0x44c5cf
mov ebx, dword [ebp - 0x14]
dec ebx
test ebx, ebx
jb 0x44c5cf
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x1c]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x44c588
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x44c5e7
mov edx, esi
mov eax, ebx
call fcn.004489a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c604
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_EndUpdate_qqrv
ret
Function at 0x44e544
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x44e559
add esp, 0xfffffff0
call sub.rtl70.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call sub.rtl70.bpl__System_TObject__bctr_qqrv
lea eax, [ebx + 0xc]
mov edx, esi
call sub.rtl70.bpl__System__LStrAsg_qqrpvpxv
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x44e5ae
mov ecx, dword [sym.P_Interface.bpl__Jclresources__RsSynchCreateMutex]
mov dl, 1
mov eax, dword [sym.P_Interface.bpl__Jclsynch_EJclMutexError_]
call sym.P_Interface.bpl__Jclwin32_EJclWin32Error__bctr_qqrp20System_TResStringRec
call sub.rtl70.bpl__System__RaiseExcept_qqrv
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44e5d5
call sub.rtl70.bpl__System__AfterConstruction_qqrp14System_TObject
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4515e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [eax + 4]
dec edi
test edi, edi
jl 0x451616
inc edi
xor ebx, ebx
mov edx, ebx
mov ebp, dword [esi + 4]
mov eax, ebp
call sub.rtl70.bpl__Classes_TBits_GetBit_qqri
mov ecx, eax
xor cl, 1
mov edx, ebx
mov eax, ebp
call sub.rtl70.bpl__Classes_TBits_SetBit_qqrio
inc ebx
dec edi
jne 0x4515f8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x453174
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 2
movzx ebx, dx
shr ebx, 8
mov bx, word [eax + ebx*2]
shl edx, 8
xor bx, dx
mov edx, ebx
dec esi
jne 0x45317b
or esi, 0xffffffff
inc esi
test dl, 1
je 0x4531a9
xor dx, word [eax + 2]
movzx edx, dx
shr edx, 1
or dx, 0x8000
jmp 0x4531b3
movzx edx, dx
shr edx, 1
and dx, 0x7fff
cmp dx, 0x8000
je 0x4531c4
lea ebx, [ecx + 2]
shl ebx, 3
cmp esi, ebx
jne 0x453193
cmp dx, 0x8000
je 0x4531d3
mov eax, 0xfffffc18
pop esi
pop ebx
ret
mov eax, esi
sub eax, 0x10
pop esi
pop ebx
ret

Function at 0x4531dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov bx, word [sym.P_Interface.bpl__Jclmath_Crc16DefaultStart]
mov edx, ecx
dec edx
test edx, edx
jl 0x453216
inc edx
xor ecx, ecx
movzx esi, bx
shr esi, 8
mov si, word [eax + esi*2]
shl ebx, 8
xor si, bx
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx]
xor si, bx
mov ebx, esi
inc ecx
dec edx
jne 0x4531f6
mov ecx, 2
movzx edx, bx
shr edx, 8
mov dx, word [eax + edx*2]
shl ebx, 8
xor dx, bx
movzx ebx, word [ebp + 8]
shr ebx, 8
xor dx, bx
mov ebx, edx
shl word [ebp + 8], 8
dec ecx
jne 0x45321b
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x45345c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 4
mov ebx, edx
shr ebx, 0x18
mov ebx, dword [eax + ebx*4]
shl edx, 8
xor ebx, edx
mov edx, ebx
dec esi
jne 0x453463
or esi, 0xffffffff
inc esi
test dl, 1
je 0x45348b
xor edx, dword [eax + 4]
shr edx, 1
or edx, 0x80000000
jmp 0x453493
shr edx, 1
and edx, 0x7fffffff
cmp edx, 0x80000000
je 0x4534a5
lea ebx, [ecx + 4]
shl ebx, 3
cmp esi, ebx
jne 0x453478
cmp edx, 0x80000000
je 0x4534b5
mov eax, 0xfffffc18
pop esi
pop ebx
ret
mov eax, esi
sub eax, 0x20
pop esi
pop ebx
ret

Function at 0x4534c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, dword [sym.P_Interface.bpl__Jclmath_Crc32DefaultStart]
mov edx, ecx
dec edx
test edx, edx
jl 0x4534f5
inc edx
xor ecx, ecx
mov esi, ebx
shr esi, 0x18
mov esi, dword [eax + esi*4]
shl ebx, 8
xor esi, ebx
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx]
xor esi, ebx
mov ebx, esi
inc ecx
dec edx
jne 0x4534d9
mov ecx, 4
mov edx, ebx
shr edx, 0x18
mov edx, dword [eax + edx*4]
shl ebx, 8
xor edx, ebx
mov ebx, dword [ebp + 8]
shr ebx, 0x18
xor edx, ebx
mov ebx, edx
shl dword [ebp + 8], 8
dec ecx
jne 0x4534fa
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x466364
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4663c8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call sub.rtl70.bpl__Sysutils_StrToIntDef_qqrx17System_AnsiStringi
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4663cf
lea eax, [ebp - 0xc]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x46b4f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call sub.rtl70.bpl__System__WStrToPWChar_qqrx17System_WideString
push eax
call 0x401af4
cmp eax, 0xffffffff
je 0x46b511
test al, 0x10
jne 0x46b515
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x46f428
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
jmp 0x46f4bc
mov eax, dword [edi + 0xc]
add eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
mov ebx, dword [edi + 0x10]
add ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [edi + 4], 0xffffffff
jne 0x46f4b4
mov ebx, dword [edi]
add ebx, dword [ebp + 8]
jmp 0x46f4b4
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x46f4ae
test byte [ebx + 3], 0x80
je 0x46f48a
mov eax, dword [ebx]
and eax, 0xffff
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esi], eax
jmp 0x46f49e
mov eax, dword [ebp + 8]
add eax, dword [ebx]
add eax, 2
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
add ebx, 4
add esi, 4
cmp dword [ebx], 0
jne 0x46f45d
add edi, 0x14
cmp dword [edi + 0x10], 0
je 0x46f4cc
cmp dword [edi + 0xc], 0
jne 0x46f439
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x46f4d8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [ebp - 4]
push 0x40
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x46f631
cmp word [edi], 0x5a4d
jne 0x46f631
mov esi, dword [edi + 0x3c]
add esi, dword [ebp - 4]
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x46f631
cmp dword [esi], 0x4550
jne 0x46f631
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, esi
add ebx, 0xf8
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46f631
push 0x40
push 0x3000
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x46f631
movzx eax, word [esi + 6]
mov dword [ebp - 0xc], eax
mov ecx, ebx
sub ecx, edi
mov eax, dword [ebp - 0xc]
shl eax, 3
lea eax, [eax + eax*4]
add ecx, eax
mov edx, edi
mov eax, dword [ebp - 0x18]
call fcn.004021b8
mov ecx, dword [ebp - 0x10]
dec ecx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
xor edx, edx
call fcn.004021b8
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jl 0x46f5bf
inc edi
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
add edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 0x18]
call fcn.004021b8
add ebx, 0x28
dec edi
jne 0x46f5a5
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x46f5e0
mov edx, dword [esi + 0xa4]
push edx
mov ecx, eax
add ecx, dword [ebp - 0x18]
mov eax, dword [esi + 0x34]
mov edx, dword [ebp - 0x18]
call fcn.0046f3b8
mov eax, dword [esi + 0x80]
mov ebx, dword [ebp - 0x18]
add eax, ebx
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046f428
mov eax, dword [esi + 0x28]
mov edi, eax
add edi, ebx
mov edx, edi
test eax, eax
je 0x46f62b
xor eax, eax
push ebp
push 0x46f621
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push ebx
call edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46f62b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479410
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x47955e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call sym.P_Interface.bpl__Md5_MD5Init_qqrr15Md5_TMD5Context
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x47953d
xor eax, eax
push ebp
push 0x479536
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47951f
xor eax, eax
push ebp
push 0x479518
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x479501
xor eax, eax
push ebp
push 0x4794fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x6c]
call sym.P_Interface.bpl__Md5_MD5Update_qqrr15Md5_TMD5Contextpxvui
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479501
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47951f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47953d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call sym.P_Interface.bpl__Md5_MD5Final_qqrr15Md5_TMD5Context
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479565
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x47961c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret