joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75abac
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x264]
xor eax, eax
push ebp
push 0x75ad69
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
lea eax, [ebp - 4]
mov ecx, 0x75ad84
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov esi, eax
push edi
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x75acef
cmp word [edi + 0x2c], 0x2e
jne 0x75ac4e
cmp word [edi + 0x2e], 0
je 0x75ace0
cmp word [edi + 0x2e], 0x2e
jne 0x75ac60
cmp word [edi + 0x30], 0
je 0x75ace0
mov eax, dword [ebp - 0x10]
and eax, dword [edi]
je 0x75ac9e
lea eax, [ebp - 0x26c]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [edi], 0x10
je 0x75ace0
mov eax, dword [ebp + 8]
cmp byte [eax + 0x10], 0
je 0x75ace0
lea eax, [ebp - 0x274]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x270]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push edi
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x75ac3c
push ebx
call sub.kernel32.dll_FindClose
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x75ad37
inc ebx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x278]
mov edx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.0075abac
pop ecx
inc dword [ebp - 0x14]
dec ebx
jne 0x75ad0b
mov eax, esi
call sub.rtl120.bpl__System_TObject_Free_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75ad70
lea eax, [ebp - 0x278]
mov edx, 5
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x762568
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x7625d9
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x762598
mov ebx, 0x111
jmp 0x76259d
mov ebx, 0x110
push ebx
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x80
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7625e0
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x7625e8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x762656
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x762618
mov ebx, 0x101
jmp 0x76261d
mov ebx, pe_nt_image_headers32
push ebx
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76265d
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x77fb48
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push 0x77fbb0
push 0x77fbdc
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401bd0
test eax, eax
je 0x77fb76
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x77fb91
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call sub.rtl120.bpl__System___lldiv_qqrv
mov esp, ebp
pop ebp
ret

Function at 0x77fbf8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x18]
xor eax, eax
push ebp
push 0x77fcaa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.0077f7f8
test al, al
jne 0x77fc8c
call fcn.0077fa6c
cmp eax, 0x7d0
jl 0x77fc8c
call fcn.0077fb48
cmp eax, 0x5dc
jl 0x77fc8c
mov dword [esi], 0
mov dword [esi + 4], 0
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
call fcn.0040ccf8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
cmp dword [esi + 4], 0
jne 0x77fc88
cmp dword [esi], 0x1f400000
jae 0x77fc8a
jmp 0x77fc8c
jl 0x77fc8c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77fcb1
lea eax, [ebp - 0x20]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x1c]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret
Function at 0x77fd24
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x77fe3f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x77fe1c
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x77fe15
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x77fdf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov ecx, eax
mov edx, 0x77fe50
mov eax, 0x77fe70
call sub.rtl120.bpl__Classes_ExtractStrings_qqrrx29System__Set_tc_iuc_0_iuc_255_t1pbp16Classes_TStrings
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Sysutils_StrToInt_qqrx20System_UnicodeString
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x77fe9c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x77fdff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77fe1c
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77fe46
lea eax, [ebp - 0x18]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x781090
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x781151
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetSystemDefaultLangID
mov esi, eax
lea edx, [ebp - 8]
movzx eax, si
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x78116c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp si, 0x409
je 0x781134
cmp si, 0x809
je 0x781134
cmp si, 0x40c
je 0x781134
cmp si, 0x407
je 0x781134
cmp si, 0x410
je 0x781134
cmp si, 0x1009
je 0x781134
cmp si, 0xc0c
je 0x781134
cmp si, 0xc09
je 0x781134
cmp si, 0x411
je 0x781134
cmp si, 0xc0a
je 0x781134
cmp si, 0x1409
je 0x781134
cmp si, 0x413
je 0x781134
cmp si, 0x462
jne 0x781136
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x781158
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x782b00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x782b08
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x782d97
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
xor ecx, ecx
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringStream_]
call sub.rtl120.bpl__Classes_TStringStream__bctr_qqrx20System_UnicodeString
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x722300]
call fcn.0058a3d4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00725068
add eax, 0x40
mov edx, 0x782db4
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x782d6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dx, 0x26
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Classes_TStrings_SetDelimiter_qqrxb
mov dl, 1
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Classes_TStrings_SetStrictDelimiter_qqrxo
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Classes_TStrings_SetDelimitedText_qqrx20System_UnicodeString
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
push ebp
push 0x782c41
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x782c30
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax + 0x68], 0
je 0x782be4
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x5c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0072297c
jmp 0x782bf9
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x5c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00722ef8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__Classes_TStringStream_GetDataString_qqrv
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x782e04
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x782c37
ret
Function at 0x782f40
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x7830c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.0040a698
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x7830ab
xor eax, eax
push ebp
push 0x7830a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call sub.rtl120.bpl__System__FillChar_qqrpvib
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0040a6b8
mov ebx, eax
jmp 0x783085
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call sub.rtl120.bpl__Sysutils_ExtractFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x244]
mov eax, 0x7830e4
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x783075
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x783075
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x8062ec]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x783075
xor eax, eax
push ebp
push 0x78306e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x783057
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x7830ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x783075
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0040a6d8
mov ebx, eax
test ebx, ebx
jne 0x782fc3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7830ab
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7830d0
lea eax, [ebp - 0x248]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x783500
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x78369d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, dword [ebp - 4]
mov eax, 0x7836b8
call fcn.007832a8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x783595
xor eax, eax
push ebp
push 0x78358e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.007836d4
test al, al
je 0x78356d
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x783687
mov eax, dword [ebp - 8]
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x783595
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov dword [ebp - 0x10], 0x802
lea eax, [ebp - 0x822]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call sub.rtl120.bpl__System__FillChar_qqrpvib
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x822]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov ebx, eax
push ebx
push 0
call sub.advapi32.dll_LookupAccountNameW
cmp dword [ebp - 0x14], 0
jbe 0x783687
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System__GetMem_qqri
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x783680
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call sub.rtl120.bpl__System__FillChar_qqrpvib
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x822]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x783642
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__FreeMem_qqrpv
xor eax, eax
mov dword [ebp - 0x1c], eax
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x783687
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ConvertSidToStringSidW
test eax, eax
je 0x783667
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x783687
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__FreeMem_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7836a4
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x7839f4
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
cmp byte [0x83b668], 0
je 0x783a2b
xor eax, eax
call fcn.00783488
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x783a9a
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.00783abc
jmp 0x783a9a
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.00783100
push eax
mov eax, dword [0x8062ec]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x783a78
mov eax, ebx
mov edx, dword [esp]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebx]
mov edx, 0x783aac
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x783a6f
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x783a9a
xor eax, eax
call fcn.00783488
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x783a9a
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.00783abc
pop ecx
pop edx
pop ebx
ret

Function at 0x783cc8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x783d41
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 4]
call fcn.007839f4
lea eax, [ebp - 8]
lea edx, [ebp - 0x214]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrEqual_qqrv
je 0x783d26
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x783d48
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x78be14
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x78be6c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x78bc00
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78be73
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x78bfc0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x78c0ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x78c0cb
mov eax, ebx
call sub.rtl120.bpl__System__GetMem_qqri
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x78c0fc
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x14]
push 0x78c10c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x18]
push 0x78c10c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x1c]
push 0x78c10c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x20]
mov eax, edi
mov edx, 7
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, esi
call sub.rtl120.bpl__System__FreeMem_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78c0f5
lea eax, [ebp - 0x20]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret