joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b140
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42b185
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 6
jl 0x42b17e
mov dword [ebp - 8], 1
jmp 0x42b18a
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42b18a
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x43bda8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x233a], 1
jne 0x43bde7
mov eax, dword [ebp - 4]
mov byte [eax + 0x233a], 2
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43bddd
mov dl, 5
mov eax, dword [ebp - 4]
call fcn.0042ed64
jmp 0x43bde7
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0042ed64
pop ecx
pop ebp
ret

Function at 0x43bdec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x233a], 2
jne 0x43beba
mov eax, dword [ebp - 4]
mov byte [eax + 0x233a], 0
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetCursorPos
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call sub.vcl260.bpl__Vcl_Controls_TControl_ScreenToClient_qqrrx19System_Types_TPoint
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x70]
lea eax, [ebp - 0x24]
lea edx, [ebp - 0xc]
call sub.rtl260.bpl__System_Types_PtInRect_qqrrx18System_Types_TRectrx19System_Types_TPoint
test al, al
je 0x43be6b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2b0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x314]
mov eax, dword [ebp - 4]
call fcn.0043c06c
test al, al
je 0x43be75
mov eax, dword [ebp - 4]
call fcn.00439104
jmp 0x43beba
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43bea0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2b0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x314]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x254]
jmp 0x43beba
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2b0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x314]
mov eax, dword [ebp - 4]
call fcn.0043c800
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444128
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x44421c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebp
push 0x4441ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x44423c
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x4442a8
mov eax, dword [ebp - 0x10]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x4442c0
mov edx, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x14]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x194]
test eax, eax
jg 0x4441dd
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4441fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444223
lea eax, [ebp - 0x14]
call sub.rtl260.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x44d324
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x44d3e8
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, 0x44d474
mov eax, dword [ebp - 0x10]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
push ebp
push 0x44d3ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x44d488
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x74]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d3d1
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4558ac
Capabilities:
Access peb ldr_data
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4559d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x414]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x4559f0
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
push ebp
push 0x455997
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0x49c]
push dword [eax + 0x498]
mov edx, 0x455c3c
mov eax, dword [ebp - 8]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x480]
mov edx, dword [eax]
call dword [edx + 0x130]
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ac]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x455c54
mov eax, dword [ebp - 8]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x194]
test eax, eax
jle 0x455985
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x408]
mov eax, dword [ebp - 4]
call fcn.00455c60
jmp 0x45598d
mov eax, dword [ebp - 4]
call fcn.0045608c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4559bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4559da
lea eax, [ebp - 0x10]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x459ea4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ac]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x14]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [0x730b8c]
cmp dword [eax], 1
sbb eax, eax
inc eax
test al, al
jne 0x459ef1
mov eax, dword [ebp - 0x14]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x459ff4
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x459f03
mov eax, dword [ebp - 0x14]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x45a0ac
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x45a130
mov eax, dword [ebp - 0x14]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x14]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x194]
test eax, eax
jle 0x459fe1
mov edx, 0x45a144
mov eax, dword [ebp - 0x14]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x6c]
fstp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x14]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x14]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [0x730b8c]
cmp dword [eax], 1
sbb eax, eax
inc eax
test al, al
jne 0x459f87
mov eax, dword [ebp - 0x14]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x45a15c
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x459f99
mov eax, dword [ebp - 0x14]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x45a1fc
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov edx, 0x45a144
mov eax, dword [ebp - 0x14]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x78]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4a0]
mov edx, 0x45a268
mov al, 3
call fcn.006efbe4
mov eax, dword [0x730a90]
mov eax, dword [eax]
call fcn.00653954
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ec], 2
mov esp, ebp
pop ebp
ret
Function at 0x45a294
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ac]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x45a358
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x730b8c]
cmp dword [eax], 1
sbb eax, eax
inc eax
test al, al
jne 0x45a2f1
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x45a3d4
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x45a418
mov eax, dword [ebp - 8]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x194]
test eax, eax
jle 0x45a335
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c4]
xor edx, edx
call sub.vcl260.bpl__Vcl_Controls_TControl_SetVisible_qqro
jmp 0x45a345
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c4]
mov dl, 1
call sub.vcl260.bpl__Vcl_Controls_TControl_SetVisible_qqro
pop ecx
pop ecx
pop ebp
ret
Function at 0x45ffdc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x460147
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x4b8
mov edx, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0xc]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x460164
call sub.rtl260.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x14]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
push ebp
push 0x4600fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x460218
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x4bc
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x46022c
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x4c0
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x460244
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x4c4
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
call fcn.0045fc2c
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46014e
lea eax, [ebp - 0x20]
mov edx, 4
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x467d78
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x467ee3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x4e4
mov edx, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0xc]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x467f00
call sub.rtl260.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x14]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
push ebp
push 0x467e9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x467fb4
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x4e8
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x467fc8
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x4ec
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x467fe0
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x4f0
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
call fcn.00468e20
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467eea
lea eax, [ebp - 0x20]
mov edx, 4
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x46a424
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46a53b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x46a558
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
push ebp
push 0x46a4f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x46a61c
mov eax, dword [ebp - 0x10]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4e4]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x46a630
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x46a650
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46a520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a542
lea eax, [ebp - 0x1c]
mov edx, 2
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x48a1c8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48a308
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48a2c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x48a324
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, 0x48a39c
mov eax, dword [ebp - 8]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x454]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x48a3b0
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0x458
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x48a3c4
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x45c
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, 0x48a3dc
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x460
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a2ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a30f
lea eax, [ebp - 0x18]
mov edx, 3
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4d6dcc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4d6e72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x4d6e8c
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, 0x4d6f20
mov eax, dword [ebp - 0x10]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x40]
xor edx, edx
call sub.dbrtl260.bpl__Data_Db_TFields_GetField_qqri
mov edx, dword [eax]
call dword [edx + 0x74]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6e79
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret