joyce8/EMBER2024-capa huggingface dataset:
Function at 0x696af8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
test dl, dl
je 0x696b0c
add esp, 0xfffffff0
call sub.rtl120.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov esi, eax
shl esi, 4
lea esi, [esi + esi*2]
mov dword [ebx + 8], esi
mov eax, esi
call sub.rtl120.bpl__System_AllocMem_qqrui
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov esi, eax
mov dword [ebx + 0x10], esi
push 0
mov eax, dword [ebx + 8]
push eax
push esi
push 8
call sub.NTdll.dll_NtQuerySystemInformation
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
call fcn.00402504
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x696b75
call sub.rtl120.bpl__System__AfterConstruction_qqrp14System_TObject
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x696bac
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
call fcn.00402504
push 0
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 0x10]
push eax
push 8
call sub.NTdll.dll_NtQuerySystemInformation
xor edx, edx
mov dword [esp], edx
test eax, eax
jne 0x696ce9
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ebp, dword [esi + 4]
dec ebp
test ebp, ebp
jb 0x696c7c
inc ebp
xor edi, edi
mov ecx, dword [esi + 0x10]
mov eax, edi
shl eax, 4
lea eax, [eax + eax*2]
add ecx, eax
mov ebx, dword [esi + 0xc]
add ebx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, dword [ecx]
adc edx, dword [ecx + 4]
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add eax, dword [ecx + 8]
adc edx, dword [ecx + 0xc]
add eax, dword [ecx + 0x10]
adc edx, dword [ecx + 0x14]
add eax, dword [ecx + 0x18]
adc edx, dword [ecx + 0x1c]
add eax, dword [ecx + 0x20]
adc edx, dword [ecx + 0x24]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
sub eax, dword [ebx + 0x10]
sbb edx, dword [ebx + 0x14]
sub eax, dword [ebx + 0x18]
sbb edx, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x20]
sbb edx, dword [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
inc edi
dec ebp
jne 0x696c0c
mov eax, dword [esp + 8]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x24], eax
cmp dword [esp + 0xc], 0
jne 0x696ca4
cmp dword [esp + 8], 0
je 0x696cd1
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov eax, 0x64
xor edx, edx
call sub.rtl120.bpl__System___llmul_qqrv
call sub.rtl120.bpl__System___lldiv_qqrv
mov edx, 0x64
sub edx, eax
mov dword [esp], edx
cmp dword [esp], 0x64
jle 0x696cde
mov dword [esp], 0x64
cmp dword [esp], 0
jge 0x696ce9
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6a0ee4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6a0fb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x6a0f90
push 0xf01ff
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
je 0x6a0f90
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6a0f90
mov ebx, dword [ebp - 0x20]
cmp ebx, 4
je 0x6a0f90
push 0x6a0fd0
push dword [ebp - 4]
push 0x6a101c
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.006a05e0
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0fba
lea eax, [ebp - 0x2c]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x6a1780
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a188c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6406c4]
call fcn.00640a10
test al, al
je 0x6a17f6
push 0
push 0
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 0x6a18a8
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6a18b8
push 0x6a18c8
push 0
call sub.shell32.dll_ShellExecuteW
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x6a18e0
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.006a05e0
mov bl, 1
jmp 0x6a1871
mov edx, esi
mov eax, ebx
call fcn.006a1554
test al, al
je 0x6a184d
push 0
push 0
lea eax, [ebp - 0xc]
mov ecx, esi
mov edx, 0x6a18a8
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6a18b8
push 0x6a18c8
push 0
call sub.shell32.dll_ShellExecuteW
lea eax, [ebp - 0x10]
mov ecx, esi
mov edx, 0x6a18e0
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.006a05e0
mov bl, 1
jmp 0x6a1871
push 0x6a1944
push esi
push 0x6a1978
lea eax, [ebp - 0x14]
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.006a05e0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a1893
lea eax, [ebp - 0x14]
mov edx, 5
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x6aa354
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6aa3c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6aa3e0
push dword [ebp - 8]
push 0x6aa3f4
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aa3d0
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6aedf4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6aeec4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call sub.rtl120.bpl__Classes_TCollectionItem_GetIndex_qqrv
lea edx, [ebp - 4]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, esi
call sub.rtl120.bpl__Classes_TCollectionItem_GetIndex_qqrv
test eax, eax
je 0x6aeeae
mov eax, esi
call sub.rtl120.bpl__Classes_TCollectionItem_GetIndex_qqrv
cmp eax, dword [ebx + 0x404]
jne 0x6aee58
movzx eax, byte [ebx + 0x408]
xor al, 1
mov byte [ebx + 0x408], al
jmp 0x6aee5f
mov byte [ebx + 0x408], 0
cmp byte [ebx + 0x408], 0
je 0x6aee77
mov eax, dword [ebx + 0x3bc]
mov byte [eax + 0x4a8], 2
jmp 0x6aee84
mov eax, dword [ebx + 0x3bc]
mov byte [eax + 0x4a8], 1
mov eax, esi
call sub.rtl120.bpl__Classes_TCollectionItem_GetIndex_qqrv
mov dword [ebx + 0x404], eax
mov eax, esi
call sub.rtl120.bpl__Classes_TCollectionItem_GetIndex_qqrv
push eax
mov eax, edi
mov edx, dword [sym.imp.vcl120.bpl__Comctrls_TListView_]
call sub.rtl120.bpl__System__AsClass_qqrp14System_TObjectp17System_TMetaClass
xor edx, edx
pop ecx
call sub.vcl120.bpl__Comctrls_TCustomListView_CustomSort_qqrpqqsiii_ii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aeecb
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x6b443c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x20a
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
cmp eax, 0x104
jg 0x6b446f
test eax, eax
jle 0x6b446f
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x6b447b
mov eax, ebx
mov edx, 0x6b4490
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
add esp, 0x20c
pop ebx
ret
Function at 0x6b79f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x6b7a63
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0x6b7a74
call sub.winmm.dll_mciSendStringW
mov ebx, eax
test ebx, ebx
je 0x6b7a48
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x6b7a98
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b7a6a
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6eba40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6ebab4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x808004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ebabb
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x6f8244
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6f82b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x808004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f82bf
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x6fc2c4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6fc321
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6fc338
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6fc328
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x7021cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x70223e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 8]
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_GetExeName_qqrv
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
lea eax, [ebp - 4]
mov edx, 0x702258
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x702280
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x702245
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x704474
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x704513
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x7044f3
push 4
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
jbe 0x7044e9
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x7044e3
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
jmp 0x7044f8
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70451a
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x70458c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x704670
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, 0xfffffffe
push 0xf003f
push 0
push 0x704680
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x70465a
push 0x23
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x704654
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.advapi32.dll_QueryServiceConfigW
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x70462b
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.advapi32.dll_QueryServiceConfigW
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__FreeMem_qqrpv
cmp edi, 4
jne 0x70464e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x704677
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x704684
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x70478c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x70476a
push 0x14
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x704764
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x70475e
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70475e
xor edi, edi
jmp 0x704758
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp edi, 0xc8
ja 0x70475e
cmp dword [ebp - 0x14], 0x64
jbe 0x704730
push 0x32
call sub.kernel32.dll_Sleep
add edi, 0x32
jmp 0x70473c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_Sleep
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70475e
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x70475e
cmp dword [ebp - 0x18], 0
je 0x70475e
cmp dword [ebp - 0x28], 4
jne 0x704710
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x28], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x704793
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x70490c
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor edx, edx
push ebp
push 0x704ab6
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x120]
mov edx, 0x11c
call fcn.00402518
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
mov edx, 0x24
call fcn.00402518
push 0x704acc
push 0x704af4
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401bd0
test eax, eax
je 0x704987
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x704993
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [ebp - 0x110], 2
jne 0x704aac
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x7049b5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x11c], 5
jne 0x7049d3
cmp dword [ebp - 0x118], 0
jne 0x7049d3
mov dword [ebp - 4], 3
jmp 0x704aac
cmp dword [ebp - 0x11c], 5
jne 0x7049f1
cmp dword [ebp - 0x118], 1
jne 0x7049f1
mov dword [ebp - 4], 4
jmp 0x704aac
cmp dword [ebp - 0x11c], 5
jne 0x704a2b
cmp dword [ebp - 0x118], 2
jne 0x704a2b
cmp byte [ebp - 6], 1
jne 0x704a1f
cmp word [ebp - 0x144], 9
jne 0x704a1f
mov dword [ebp - 4], 4
jmp 0x704aac
mov dword [ebp - 4], 5
jmp 0x704aac
cmp dword [ebp - 0x11c], 6
jne 0x704a46
cmp dword [ebp - 0x118], 0
jne 0x704a46
mov dword [ebp - 4], 6
jmp 0x704aac
cmp dword [ebp - 0x11c], 6
jne 0x704a61
cmp dword [ebp - 0x118], 1
jne 0x704a61
mov dword [ebp - 4], 7
jmp 0x704aac
cmp dword [ebp - 0x11c], 6
jne 0x704a81
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x704a81
mov dword [ebp - 4], 8
jmp 0x704aac
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x704aa0
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x704aa0
mov dword [ebp - 4], 0xa
jmp 0x704aac
cmp eax, 0xa
jne 0x704aac
mov dword [ebp - 4], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x704ac0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x704b18
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff9f4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x704ce4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x704cbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x704d00
xor eax, eax
call fcn.00704524
test al, al
je 0x704b9b
mov edx, 2
mov eax, 0x704d00
call fcn.0070458c
mov edx, 0x704d00
xor eax, eax
call fcn.00704684
xor ebx, ebx
jmp 0x704b8b
push 0x64
call sub.kernel32.dll_Sleep_1
inc ebx
cmp ebx, 2
jae 0x704b9b
mov edx, 0x704d00
xor eax, eax
call fcn.0070440c
test al, al
je 0x704b7e
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 6
jg 0x704bbf
mov dword [ebp - 0x28], 0x1779
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov edx, 0x704d00
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x704bda
mov dword [ebp - 0x28], 0x1b59
mov dword [ebp - 0x2c], 0x44d
lea eax, [ebp - 8]
mov edx, 0x704d20
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0x704d58
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x704cb5
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x160c]
xor ecx, ecx
mov edx, 0x15e0
call sub.rtl120.bpl__System__FillChar_qqrpvib
jmp 0x704c83
lea ebx, [ebp - 0x160c]
jmp 0x704c6e
mov eax, dword [ebx + 0x10]
call fcn.0070481c
fstp qword [ebp - 0x20]
wait
lea eax, [ebp - 4]
mov edx, edi
add edx, 0x38
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebx + 0x14]
call fcn.00704b10
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x704c68
cmp esi, dword [ebp - 0x28]
jne 0x704c68
movzx eax, word [ebx + 0x1c]
cmp eax, dword [ebp - 0x2c]
jne 0x704c68
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [eax - 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax - 0xc], edx
mov byte [ebp - 0x21], 1
jmp 0x704c7d
mov eax, dword [ebx]
add eax, ebx
mov ebx, eax
lea eax, [ebp - 0x160c]
add eax, dword [ebp - 0x10]
mov edi, ebx
cmp eax, edi
ja 0x704c13
cmp byte [ebp - 0x21], 0
jne 0x704cac
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x15e0
lea eax, [ebp - 0x160c]
push eax
push 0
push 9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ReadEventLogW
test eax, eax
jne 0x704c0b
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseEventLog
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x704cc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x704ceb
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret