joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52cb28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x52cbe7
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x52cbde
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x52cbd7
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x52cbc0
sub eax, 4
jne 0x52cbcb
mov eax, ebx
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
jmp 0x52cbd7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov eax, esi
call sub.rtl120.bpl__System__FreeMem_qqrpv
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x52d2b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52d328
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x808004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d32f
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x52d334
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52d3a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d3aa
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x52d658
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x52d6f2
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x52d677
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x52d708
dec edx
je 0x52d73d
jmp 0x52d78e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x52d78e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52d834
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x52d853
add edx, 3
sar edx, 2
test edx, edx
jle 0x52d961
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x52d888
je 0x52d8cb
sub ecx, 0x2b
je 0x52d8c1
sub ecx, 4
je 0x52d8c6
dec ecx
sub ecx, 0xa
jb 0x52d8b3
jmp 0x52d8ce
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x52d89a
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x52d8a5
jmp 0x52d8ce
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x52d8ce
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x52d8ce
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x52d8ce
mov byte [eax], 0x3e
jmp 0x52d8ce
mov byte [eax], 0x3f
jmp 0x52d8ce
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x52d86b
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x52d91f
cmp byte [esp + 7], 0xff
jne 0x52d91f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x52d956
cmp dl, 0xff
je 0x52d956
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x52d862
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x52e670
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x52e691
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x52e67e
pop edi
pop esi
pop ebx
ret

Function at 0x533d14
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x533d3a
shr edx, 1
xor edx, eax
jmp 0x533d3c
shr edx, 1
inc ecx
jne 0x533d2c
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x533d25
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x533d54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x533d5d
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Classes_TStream_GetPosition_qqrv
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x533e0a
cmp dword [ebp - 0xc], 0x2800
jl 0x533db8
mov dword [ebp - 8], 0x2800
jmp 0x533dbe
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x533e02
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x839244]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x533dd9
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x533da0
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x53ce78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x53cf7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrClr_qqrpv
cmp dword [ebp - 8], 0
jne 0x53cecb
mov eax, edi
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
jmp 0x53cf64
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0053cdc0
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov esi, eax
test esi, esi
jle 0x53cf5a
mov ebx, 1
lea eax, [ebp - 0x10]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
push edx
lea eax, [ebp - 0x10]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
pop edx
movzx eax, byte [eax + edx]
call fcn.0053cc94
push eax
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
movzx eax, byte [eax + ebx - 1]
call fcn.0053cc94
mov edx, eax
pop eax
xor al, dl
call fcn.0053cd3c
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromChar_qqrr27System__AnsiStringT_us_i0__cus
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrCat_qqrv
inc ebx
dec esi
jne 0x53cef0
mov eax, edi
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53cf86
lea eax, [ebp - 0x14]
mov edx, 5
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x53cf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x53d097
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrClr_qqrpv
cmp dword [ebp - 8], 0
jne 0x53cfe3
mov eax, edi
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
jmp 0x53d07c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0053cdc0
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov esi, eax
test esi, esi
jle 0x53d072
mov ebx, 1
lea eax, [ebp - 0x10]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
push edx
lea eax, [ebp - 0x10]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
pop edx
movzx eax, byte [eax + edx]
call fcn.0053cc94
push eax
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
movzx eax, byte [eax + ebx - 1]
call fcn.0053cc94
mov edx, eax
pop eax
xor al, dl
call fcn.0053cd3c
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromChar_qqrr27System__AnsiStringT_us_i0__cus
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrCat_qqrv
inc ebx
dec esi
jne 0x53d008
mov eax, edi
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d09e
lea eax, [ebp - 0x14]
mov edx, 5
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x53d520
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp + 0xc]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp + 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x53d5df
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0053d960
test al, al
je 0x53d5b7
push 2
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x53d5b7
mov eax, dword [ebp - 8]
call fcn.0053d2b0
test al, al
je 0x53d5b7
push 2
push esi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x53d5b7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.0053d5f0
test al, al
je 0x53d5b7
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d5e6
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp + 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x53d5f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x53d823
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
jne 0x53d669
lea eax, [ebp - 0x1c]
mov ecx, 0x53d844
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x1c]
call fcn.0053df78
jmp 0x53d7fb
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TMemoryStream_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x53d69b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__Classes_TMemoryStream_LoadFromFile_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53d6f9
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_DeleteFile_qqrx20System_UnicodeString
test al, al
jne 0x53d72a
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System_TObject_Free_qqrv
lea eax, [ebp - 0x28]
mov ecx, 0x53d8d4
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x28]
call fcn.0053df78
jmp 0x53d7fb
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TMemoryStream_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x53d784
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [0x41752c]
call fcn.00420c04
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__Classes_TCustomMemoryStream_SaveToFile_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53d7e7
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System_TObject_Free_qqrv
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System_TObject_Free_qqrv
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d82a
lea eax, [ebp - 0x30]
mov edx, 6
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x53ed8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x53edd4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop ebx
ret

Function at 0x53ee04
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop ebx
ret

Function at 0x53ee30
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop ebx
ret

Function at 0x53ee60
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x53ee9d
mov eax, ebx
lea edx, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53eea4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53ef20
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x53ef07
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call sub.rtl120.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ef27
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x53f758
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53f7a7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53f7be
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53f7c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53f817
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53f82e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x542410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x54249c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x542493
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x542493
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffc
sub eax, 2
jae 0x542493
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4