joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b28cc
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x560278
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4b28eb
mov esi, 1
mov edx, 0x560380
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4b2964
dec ebx
je 0x4b2986
dec ebx
je 0x4b29a8
dec ebx
je 0x4b29c9
jmp 0x4b29e3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b29e3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b29e3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b29e3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4b2954
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4b2907
mov esi, 0x20
mov eax, 0x5602a8
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4b2a08
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b2a44
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x56032f]
test bl, bl
jbe 0x4b2a75
lea eax, [esi + 0x3e0]
call fcn.004b2a20
lea eax, [esi + 0x3fc]
call fcn.004b2a20
dec bl
jne 0x4b2a5b
mov cl, 0x30
mov edi, 0x560300
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x4b2a96
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4b2aa3
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4b2a7f
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b2ab0
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004b2864
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4b2acc
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004b2864
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004b2864
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4b2ae8
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004b2a44
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4b2b12
mov bl, 1
mov eax, 0x5601f8
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4b2b4b
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4b2b58
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4b2b37
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4b2b82
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004b28cc
jmp 0x4b2ba9
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004b28cc
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4b2bb1
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4b2b6a
mov bl, 0x40
mov esi, 0x560238
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x4b2c17
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4b2c24
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4b2c00
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004b288c
inc ebx
inc esi
cmp bl, 0x41
jne 0x4b2c32
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b2dd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4b2e81
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x4b2e7c
mov eax, edi
xor ecx, ecx
mov edx, 8
call sub.rtl120.bpl__System__LStrSetLength_qqrv
push 1
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004b2ab0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x500fe4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x50100a
shr edx, 1
xor edx, eax
jmp 0x50100c
shr edx, 1
inc ecx
jne 0x500ffc
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x500ff5
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x501024
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x50102d
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407210
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x5010da
cmp dword [ebp - 0xc], 0x2800
jl 0x501088
mov dword [ebp - 8], 0x2800
jmp 0x50108e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x5010d2
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x5ac8f0]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x5010a9
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x501070
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5061a8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x506242
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5061c7
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x506258
dec edx
je 0x50628d
jmp 0x5062de
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5062de
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x506384
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x5063a3
add edx, 3
sar edx, 2
test edx, edx
jle 0x5064b1
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x5063d8
je 0x50641b
sub ecx, 0x2b
je 0x506411
sub ecx, 4
je 0x506416
dec ecx
sub ecx, 0xa
jb 0x506403
jmp 0x50641e
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x5063ea
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x5063f5
jmp 0x50641e
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x50641e
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x50641e
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x50641e
mov byte [eax], 0x3e
jmp 0x50641e
mov byte [eax], 0x3f
jmp 0x50641e
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x5063bb
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x50646f
cmp byte [esp + 7], 0xff
jne 0x50646f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5064a6
cmp dl, 0xff
je 0x5064a6
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x5063b2
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x5071c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x5071e1
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x5071ce
pop edi
pop esi
pop ebx
ret

Function at 0x508208
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x50825c
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x568f40]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x569340]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x569740]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x569b40]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x508216
pop edi
pop esi
pop ebx
ret
Function at 0x50d448
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
test dl, dl
je 0x50d467
add esp, 0xfffffff0
call sub.rtl120.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x50d50b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, esi
call fcn.0050d5c0
mov dword [esi + 0x18], 0xf003f
mov byte [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 5
jne 0x50d4bd
call fcn.00411688
test al, al
jne 0x50d4eb
cmp dword [ebp - 0x110], 5
ja 0x50d4eb
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.0040efb4
mov eax, dword [ebp - 0x118]
mov edx, 0x50d53c
call fcn.00407720
test al, al
jne 0x50d4eb
xor eax, eax
jmp 0x50d4ed
mov al, 1
mov byte [0x5acd14], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d512
lea eax, [ebp - 0x118]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x50d944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x50da75
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [edi]
call fcn.0050d3f0
mov dword [ebp - 0x10], eax
mov eax, esi
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x50d99a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x50d99d
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x50d910]
call sub.rtl120.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00402094
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test ebx, ebx
jne 0x50d9f2
mov eax, esi
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [esi]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
cmp eax, 0x802
jle 0x50da42
push 0x50da94
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00407760
push dword [ebp - 0x1c]
push 0x50dad4
mov eax, dword [esi]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
lea edx, [ebp - 0x20]
call fcn.00407760
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.0050d340
mov eax, dword [ebp - 0x10]
call fcn.0050d420
mov byte [edi], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50da7c
lea eax, [ebp - 0x20]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
mov edx, dword [0x50d910]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x50f558
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x50f5f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x50f5d7
push 4
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
jbe 0x50f5cd
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x50f5c7
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
jmp 0x50f5dc
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f5fe
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x50f670
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x50f754
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, 0xfffffffe
push 0xf003f
push 0
push 0x50f764
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x50f73e
push 0x23
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x50f738
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.advapi32.dll_QueryServiceConfigW
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x50f70f
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.advapi32.dll_QueryServiceConfigW
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__FreeMem_qqrpv
cmp edi, 4
jne 0x50f732
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f75b
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x50f768
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x50f870
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x50f84e
push 0x14
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x50f848
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x50f842
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x50f842
xor edi, edi
jmp 0x50f83c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp edi, 0xc8
ja 0x50f842
cmp dword [ebp - 0x14], 0x64
jbe 0x50f814
push 0x32
call sub.kernel32.dll_Sleep
add edi, 0x32
jmp 0x50f820
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_Sleep
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x50f842
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x50f842
cmp dword [ebp - 0x18], 0
je 0x50f842
cmp dword [ebp - 0x28], 4
jne 0x50f7f4
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x28], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f877
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x50f9f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor edx, edx
push ebp
push 0x50fb9a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x120]
mov edx, 0x11c
call fcn.00402094
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
mov edx, 0x24
call fcn.00402094
push 0x50fbb0
push 0x50fbd8
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401878
test eax, eax
je 0x50fa6b
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x50fa77
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [ebp - 0x110], 2
jne 0x50fb90
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x50fa99
mov dword [ebp - 4], 2
cmp dword [ebp - 0x11c], 5
jne 0x50fab7
cmp dword [ebp - 0x118], 0
jne 0x50fab7
mov dword [ebp - 4], 3
jmp 0x50fb90
cmp dword [ebp - 0x11c], 5
jne 0x50fad5
cmp dword [ebp - 0x118], 1
jne 0x50fad5
mov dword [ebp - 4], 4
jmp 0x50fb90
cmp dword [ebp - 0x11c], 5
jne 0x50fb0f
cmp dword [ebp - 0x118], 2
jne 0x50fb0f
cmp byte [ebp - 6], 1
jne 0x50fb03
cmp word [ebp - 0x144], 9
jne 0x50fb03
mov dword [ebp - 4], 4
jmp 0x50fb90
mov dword [ebp - 4], 5
jmp 0x50fb90
cmp dword [ebp - 0x11c], 6
jne 0x50fb2a
cmp dword [ebp - 0x118], 0
jne 0x50fb2a
mov dword [ebp - 4], 6
jmp 0x50fb90
cmp dword [ebp - 0x11c], 6
jne 0x50fb45
cmp dword [ebp - 0x118], 1
jne 0x50fb45
mov dword [ebp - 4], 7
jmp 0x50fb90
cmp dword [ebp - 0x11c], 6
jne 0x50fb65
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x50fb65
mov dword [ebp - 4], 8
jmp 0x50fb90
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x50fb84
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x50fb84
mov dword [ebp - 4], 0xa
jmp 0x50fb90
cmp eax, 0xa
jne 0x50fb90
mov dword [ebp - 4], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50fba4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret