joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c078
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c1cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_BeginUpdate_qqrv
xor eax, eax
push ebp
push 0x44c1ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.004489f4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448c48
test eax, eax
jne 0x44c18c
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x44c181
mov edx, dword [ebp - 0x1c]
inc edx
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
cmp dword [ebp - 0x18], 0
je 0x44c17d
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jb 0x44c17d
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0x20]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
lea eax, [ebp - 0x24]
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x44c136
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x44c195
mov edx, esi
mov eax, ebx
call fcn.004486b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c1b2
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_EndUpdate_qqrv
ret
Function at 0x44c1e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c333
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_BeginUpdate_qqrv
xor eax, eax
push ebp
push 0x44c311
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.004489f4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448c48
test eax, eax
jne 0x44c2f2
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x44c2e7
mov edx, dword [ebp - 0x18]
inc edx
lea eax, [ebp - 0x1c]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
cmp dword [ebp - 0x14], 0
je 0x44c2e3
mov ebx, dword [ebp - 0x14]
dec ebx
test ebx, ebx
jb 0x44c2e3
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x1c]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x44c29c
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x44c2fb
mov edx, esi
mov eax, ebx
call fcn.004486b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c318
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Classes_TStrings_EndUpdate_qqrv
ret
Function at 0x44e258
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x44e26d
add esp, 0xfffffff0
call sub.rtl70.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call sub.rtl70.bpl__System_TObject__bctr_qqrv
lea eax, [ebx + 0xc]
mov edx, esi
call sub.rtl70.bpl__System__LStrAsg_qqrpvpxv
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x44e2c2
mov ecx, dword [sym.P_Interface.bpl__Jclresources__RsSynchCreateMutex]
mov dl, 1
mov eax, dword [sym.P_Interface.bpl__Jclsynch_EJclMutexError_]
call sym.P_Interface.bpl__Jclwin32_EJclWin32Error__bctr_qqrp20System_TResStringRec
call sub.rtl70.bpl__System__RaiseExcept_qqrv
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44e2e9
call sub.rtl70.bpl__System__AfterConstruction_qqrp14System_TObject
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4512f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [eax + 4]
dec edi
test edi, edi
jl 0x45132a
inc edi
xor ebx, ebx
mov edx, ebx
mov ebp, dword [esi + 4]
mov eax, ebp
call sub.rtl70.bpl__Classes_TBits_GetBit_qqri
mov ecx, eax
xor cl, 1
mov edx, ebx
mov eax, ebp
call sub.rtl70.bpl__Classes_TBits_SetBit_qqrio
inc ebx
dec edi
jne 0x45130c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x452e88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 2
movzx ebx, dx
shr ebx, 8
mov bx, word [eax + ebx*2]
shl edx, 8
xor bx, dx
mov edx, ebx
dec esi
jne 0x452e8f
or esi, 0xffffffff
inc esi
test dl, 1
je 0x452ebd
xor dx, word [eax + 2]
movzx edx, dx
shr edx, 1
or dx, 0x8000
jmp 0x452ec7
movzx edx, dx
shr edx, 1
and dx, 0x7fff
cmp dx, 0x8000
je 0x452ed8
lea ebx, [ecx + 2]
shl ebx, 3
cmp esi, ebx
jne 0x452ea7
cmp dx, 0x8000
je 0x452ee7
mov eax, 0xfffffc18
pop esi
pop ebx
ret
mov eax, esi
sub eax, 0x10
pop esi
pop ebx
ret

Function at 0x452ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov bx, word [sym.P_Interface.bpl__Jclmath_Crc16DefaultStart]
mov edx, ecx
dec edx
test edx, edx
jl 0x452f2a
inc edx
xor ecx, ecx
movzx esi, bx
shr esi, 8
mov si, word [eax + esi*2]
shl ebx, 8
xor si, bx
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx]
xor si, bx
mov ebx, esi
inc ecx
dec edx
jne 0x452f0a
mov ecx, 2
movzx edx, bx
shr edx, 8
mov dx, word [eax + edx*2]
shl ebx, 8
xor dx, bx
movzx ebx, word [ebp + 8]
shr ebx, 8
xor dx, bx
mov ebx, edx
shl word [ebp + 8], 8
dec ecx
jne 0x452f2f
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x453170
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 4
mov ebx, edx
shr ebx, 0x18
mov ebx, dword [eax + ebx*4]
shl edx, 8
xor ebx, edx
mov edx, ebx
dec esi
jne 0x453177
or esi, 0xffffffff
inc esi
test dl, 1
je 0x45319f
xor edx, dword [eax + 4]
shr edx, 1
or edx, 0x80000000
jmp 0x4531a7
shr edx, 1
and edx, 0x7fffffff
cmp edx, 0x80000000
je 0x4531b9
lea ebx, [ecx + 4]
shl ebx, 3
cmp esi, ebx
jne 0x45318c
cmp edx, 0x80000000
je 0x4531c9
mov eax, 0xfffffc18
pop esi
pop ebx
ret
mov eax, esi
sub eax, 0x20
pop esi
pop ebx
ret

Function at 0x4531d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, dword [sym.P_Interface.bpl__Jclmath_Crc32DefaultStart]
mov edx, ecx
dec edx
test edx, edx
jl 0x453209
inc edx
xor ecx, ecx
mov esi, ebx
shr esi, 0x18
mov esi, dword [eax + esi*4]
shl ebx, 8
xor esi, ebx
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx]
xor esi, ebx
mov ebx, esi
inc ecx
dec edx
jne 0x4531ed
mov ecx, 4
mov edx, ebx
shr edx, 0x18
mov edx, dword [eax + edx*4]
shl ebx, 8
xor edx, ebx
mov ebx, dword [ebp + 8]
shr ebx, 0x18
xor edx, ebx
mov ebx, edx
shl dword [ebp + 8], 8
dec ecx
jne 0x45320e
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x466078
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4660dc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call sub.rtl70.bpl__Sysutils_StrToIntDef_qqrx17System_AnsiStringi
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4660e3
lea eax, [ebp - 0xc]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x46b20c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call sub.rtl70.bpl__System__WStrToPWChar_qqrx17System_WideString
push eax
call 0x401b04
cmp eax, 0xffffffff
je 0x46b225
test al, 0x10
jne 0x46b229
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x476ccc
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x476e1a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call sym.P_Interface.bpl__Md5_MD5Init_qqrr15Md5_TMD5Context
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x476df9
xor eax, eax
push ebp
push 0x476df2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x476ddb
xor eax, eax
push ebp
push 0x476dd4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x476dbd
xor eax, eax
push ebp
push 0x476db6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x6c]
call sym.P_Interface.bpl__Md5_MD5Update_qqrr15Md5_TMD5Contextpxvui
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476dbd
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476ddb
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476df9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call sym.P_Interface.bpl__Md5_MD5Final_qqrr15Md5_TMD5Context
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476e21
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x476ed8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x4af72c
Capabilities:
Create http request

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x4af73b
add esp, 0xfffffff0
call sub.rtl70.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [edi + 0x10]
call sub.rtl70.bpl__System__LStrClr_qqrpv
mov eax, 0xa00000
call sub.rtl70.bpl__System__GetMem_qqri
mov dword [edi + 0x1c], eax
test esi, esi
jne 0x4af771
push 0
push 0
push 0
push 1
push 0x4af7a4
call sub.wininet.dll_InternetOpenA
mov dword [edi + 4], eax
jmp 0x4af786
push 0
push 0
push 0
push 0
push 0x4af7a4
call sub.wininet.dll_InternetOpenA
mov dword [edi + 4], eax
mov eax, edi
test bl, bl
je 0x4af79b
call sub.rtl70.bpl__System__AfterConstruction_qqrp14System_TObject
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4afa3c
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4afbb5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004af7f4
mov eax, dword [edi + 8]
test eax, eax
je 0x4afa96
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4afaa3
push eax
call sub.wininet.dll_InternetCloseHandle
push 0
push 0
push 3
push 0
push 0
mov ax, word [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [edi + 4]
push eax
call sub.wininet.dll_InternetConnectA
mov esi, eax
mov dword [edi + 0xc], esi
push 4
lea eax, [ebp + 8]
push eax
push 6
push esi
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp + 8]
push eax
push 5
mov eax, dword [edi + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp + 8]
push eax
push 7
mov eax, dword [edi + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp + 8]
push eax
push 8
mov eax, dword [edi + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp + 8]
push eax
push 2
mov eax, dword [edi + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
mov dword [ebp + 8], pe_nt_image_headers32
push 4
lea eax, [ebp + 8]
push eax
push 0x1f
mov eax, dword [edi + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
mov dword [ebp - 0x1c], 0x40b180
cmp dword [ebp - 0x18], 1
jne 0x4afb47
or dword [ebp - 0x1c], 0x800000
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov esi, eax
mov dword [edi + 8], esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x1f
push esi
call sub.wininet.dll_InternetQueryOptionA
mov eax, dword [ebp - 0x1c]
or dword [ebp + 8], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x1f
mov eax, dword [edi + 8]
push eax
call sub.wininet.dll_InternetSetOptionA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afbbc
lea eax, [ebp - 0x10]
mov edx, 4
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x4b2d44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4b2d71
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4b2df0
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004b06cc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4b2dbe
mov cx, word [esp]
sub cx, si
jmp 0x4b2dc0
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4b2da7
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4b2de6
mov cx, word [esp]
sub cx, si
jmp 0x4b2de8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4b2dcf
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4b2e4d
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004b2a18
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4b2e38
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4b2e4d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4b2d4e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bb4b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4bb4bd
mov eax, dword [ebp - 4]
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4bb5d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.rtl70.bpl__System_FileMode]
mov byte [eax], 0
xor ecx, ecx
push ebp
push 0x4bb5b3
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__Assign_qqrr15System_TTextRecx17System_AnsiString
mov edx, 1
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__ResetFile_qqrr15System_TFileReci
call sub.rtl70.bpl__System_IOResult_qqrv
test eax, eax
jne 0x4bb591
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10149]
mov ecx, 0xfff1
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__BlockRead_qqrr15System_TFileRecpviri
mov dx, word [ebp - 0xc]
test dx, dx
jbe 0x4bb58b
lea eax, [ebp - 0x10149]
xor ecx, ecx
mov cl, byte [eax]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
and ebx, 0xff
xor ecx, ebx
mov ecx, dword [ecx*4 + sym.P_Interface.bpl__Crc32_Table]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
shr ebx, 8
xor ecx, ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4bb55e
cmp dword [ebp - 0xc], 0
jne 0x4bb535
lea eax, [ebp - 0x158]
call sub.rtl70.bpl__System__Close_qqrr15System_TTextRec
mov eax, dword [ebp - 8]
not dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb5c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb5df
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x4bb5e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4bb67e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
mov ecx, eax
test ecx, ecx
jle 0x4bb657
mov esi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
and eax, 0xff
mov eax, dword [eax*4 + sym.P_Interface.bpl__Crc32_Table]
shr ebx, 8
and ebx, 0xffffff
xor eax, ebx
mov ebx, eax
inc esi
dec ecx
jne 0x4bb621
mov ecx, dword [ebp - 8]
mov eax, ebx
not eax
mov edx, 8
call sub.rtl70.bpl__Sysutils_IntToHex_qqrii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb685
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x4d55b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d5632
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x3000
lea eax, [ebp - 8]
mov edx, ebx
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call sub.rtl70.bpl__System__LStrFromPChar_qqrr17System_AnsiStringpc
mov eax, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5639
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret

Function at 0x4d5644
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d5674
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d571e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call sym.P_Interface.bpl__Codehook_InjectMemory_qqruipvui
mov esi, eax
mov eax, edi
call sym.P_Interface.bpl__Codehook_SizeOfProc_qqrpv
mov ecx, eax
mov edx, edi
mov eax, ebx
call sym.P_Interface.bpl__Codehook_InjectMemory_qqruipvui
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x4d56ef
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
jmp 0x4d5708
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call sub.rtl70.bpl__Sysutils_IntToStr_qqrj
mov eax, dword [ebp - 0x10]
call sub.vcl70.bpl__Dialogs_ShowMessage_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5725
lea eax, [ebp - 0x10]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret