joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c990
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44ca24
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call sub.rtl210.bpl__System__FillChar_qqrpvic
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], di
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x58]
mov ecx, 0x44ca40
mov edx, esi
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x58]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x44ca0e
mov ebx, dword [ebp - 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ca2b
lea eax, [ebp - 0x58]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret

Function at 0x44ca60
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
ret

Function at 0x44ca80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44cb02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call sub.rtl210.bpl__System__UStrClr_qqrpv
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x44caec
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x26]
mov ecx, 0x11
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call sym.TCFLib210.bpl__Elibfnc_StrLower_qqrx20System_UnicodeString
mov eax, dword [ebx]
movzx eax, word [eax]
call sym.TCFLib210.bpl__Elibfnc_ChUpper_qqrb
mov esi, eax
mov eax, ebx
call sub.rtl210.bpl__System__UniqueStringU_qqrr20System_UnicodeString
mov word [eax], si
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cb09
lea eax, [ebp - 0x2c]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x44cb10
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44cbf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call sub.rtl210.bpl__System__UStrClr_qqrpv
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x44cbd7
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov ecx, pe_nt_image_headers32
mov edx, 2
call sub.rtl210.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 0x20c]
lea edx, [ebp - 0x208]
call sym.TCFLib210.bpl__Elibfnc_StrLower_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x208]
push eax
movzx eax, word [ebp - 0x204]
call sym.TCFLib210.bpl__Elibfnc_ChUpper_qqrb
mov edx, eax
lea eax, [ebp - 0x214]
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov edx, dword [ebp - 0x214]
mov eax, ebx
pop ecx
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cbfc
lea eax, [ebp - 0x214]
mov edx, 4
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x453464
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45362c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [esi + 0x5c]
push eax
call sub.kernel32.dll_GetMailslotInfo
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4535fb
cmp dword [ebp - 0xc], 0xffffffff
je 0x4535fb
cmp dword [ebp - 0x10], 0
je 0x4535fb
lea eax, [ebp - 0x414]
xor ecx, ecx
mov edx, 0x400
call sub.rtl210.bpl__System__FillChar_qqrpvic
push 0
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [esi + 0x5c]
push eax
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x418]
lea eax, [ebp - 0x414]
call sub.rtl210.bpl__System_Sysutils_StrPas_qqrpxc
mov edx, dword [ebp - 0x418]
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
test bl, bl
je 0x4535fb
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x4535fb
mov eax, dword [esi + 0x48]
mov edx, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrEqual_qqrv
je 0x4535fb
lea eax, [esi + 0x48]
mov edx, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x41c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, esi
call sym.TCFLib210.bpl__Enetmail_TEvNetMail_DecodeStr_qqr20System_UnicodeStringi
mov eax, dword [ebp - 0x41c]
call sub.rtl210.bpl__System_Sysutils_StrToFloat_qqrx20System_UnicodeString
fstp qword [esi + 0x60]
wait
lea eax, [ebp - 0x420]
push eax
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, esi
call sym.TCFLib210.bpl__Enetmail_TEvNetMail_DecodeStr_qqr20System_UnicodeStringi
mov eax, dword [ebp - 0x420]
call sub.rtl210.bpl__System_Sysutils_StrToFloat_qqrx20System_UnicodeString
fdiv dword [0x453640]
fstp qword [esi + 0x68]
wait
lea eax, [ebp - 0x424]
push eax
mov ecx, 3
mov edx, dword [ebp - 4]
mov eax, esi
call sym.TCFLib210.bpl__Enetmail_TEvNetMail_DecodeStr_qqr20System_UnicodeStringi
mov edx, dword [ebp - 0x424]
lea eax, [esi + 0x70]
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x428]
push eax
mov ecx, 4
mov edx, dword [ebp - 4]
mov eax, esi
call sym.TCFLib210.bpl__Enetmail_TEvNetMail_DecodeStr_qqr20System_UnicodeStringi
mov edx, dword [ebp - 0x428]
lea eax, [esi + 0x74]
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453633
lea eax, [ebp - 0x428]
mov edx, 4
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x418]
call sub.rtl210.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x4536f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp + 8]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x453857
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
push 0x453878
push dword [ebp - 4]
push 0x45388c
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call sub.rtl210.bpl__System__UStrCatN_qqrv
lea edx, [ebp - 0x41c]
mov eax, ebx
call sym.TCFLib210.bpl__Enetmail_TEvNetMail_GetHeader_qqrv
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 8]
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
lea eax, [ebp - 0x418]
xor ecx, ecx
mov edx, 0x400
call sub.rtl210.bpl__System__FillChar_qqrpvic
lea eax, [ebp - 0x420]
mov edx, dword [ebp - 0x10]
mov ecx, 0
call sub.rtl210.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov edx, dword [ebp - 0x420]
lea eax, [ebp - 0x418]
call sub.rtl210.bpl__System_Sysutils_StrPCopy_qqrpcx27System__AnsiStringT_us_i0__
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0xc]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x45381e
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
lea eax, [ebp - 0x418]
push eax
push esi
call sub.kernel32.dll_WriteFile
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x453818
mov eax, dword [ebp - 0x10]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
cmp eax, dword [ebp - 0x18]
jne 0x453818
mov byte [ebp - 0x11], 1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45385e
lea eax, [ebp - 0x420]
call sub.rtl210.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x41c]
call sub.rtl210.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x10]
mov edx, 4
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp + 8]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x4538a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4539c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2a]
push eax
call sub.kernel32.dll_GetComputerNameW
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2a]
call sub.rtl210.bpl__System_Sysutils_StrLen_qqrpxb
push eax
lea eax, [ebp - 0x38]
lea edx, [ebp - 0x2a]
mov ecx, 0x11
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x38]
mov edx, 2
pop ecx
call sub.rtl210.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call sub.rtl210.bpl__System_Sysutils_LowerCase_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
movzx edx, word [ebp - 0x2a]
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call sub.rtl210.bpl__System_Sysutils_UpperCase_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
pop ecx
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
call sub.rtl210.bpl__System_Sysutils_Now_qqrv
call sub.rtl210.bpl__System__TRUNC_qqrv
push edx
push eax
lea eax, [ebp - 0x44]
call sub.rtl210.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x44]
push 0x4539e0
call sub.rtl210.bpl__System_Sysutils_Now_qqrv
add esp, 0xfffffff4
fstp xword [esp]
wait
call sub.rtl210.bpl__System_Frac_qqrxg
fmul dword [0x4539e4]
call sub.rtl210.bpl__System__TRUNC_qqrv
push edx
push eax
lea eax, [ebp - 0x48]
call sub.rtl210.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x48]
push 0x4539f4
push dword [ebp - 4]
push 0x453a04
mov eax, ebx
mov edx, 6
call sub.rtl210.bpl__System__UStrCatN_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4539ce
lea eax, [ebp - 0x48]
mov edx, 7
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x454070
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x198], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x454141
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call sub.rtl210.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
inc eax
je 0x45411b
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
call sub.rtl210.bpl__System_AllocMem_qqri
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
lea eax, [ebp - 0x198]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl210.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov edx, dword [ebp - 0x198]
mov eax, ebx
pop ecx
call sub.rtl210.bpl__System_Sysutils_StrPLCopy_qqrpcx27System__AnsiStringT_us_i0__ui
push ebx
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x454114
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call sub.rtl210.bpl__System__UStrFromPChar_qqrr20System_UnicodeStringpc
mov eax, ebx
call sub.rtl210.bpl__System__FreeMem_qqrpv
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454148
lea eax, [ebp - 0x198]
call sub.rtl210.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret

Function at 0x454b34
Capabilities:
Enumerate network shares

Disassembly:
push ebx
push esi
add esp, 0xfffffe8c
mov esi, eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_GetParams_qqrruit1
push esp
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.mpr.dll_WNetOpenEnumW
mov ebx, eax
test ebx, ebx
jne 0x454bc1
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x160
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.mpr.dll_WNetEnumResourceW
mov ebx, eax
test ebx, ebx
jne 0x454bbd
lea edx, [esp + 0x14]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_IsContainer_qqrrx13_NETRESOURCEW
test al, al
je 0x454bb2
lea edx, [esp + 0x14]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_EnumNetContainer_qqrrx13_NETRESOURCEW
jmp 0x454bbd
lea edx, [esp + 0x14]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_AddNetInfo_qqrrx13_NETRESOURCEW
test ebx, ebx
je 0x454b67
mov eax, dword [esp]
push eax
call sub.mpr.dll_WNetCloseEnum
add esp, 0x174
pop esi
pop ebx
ret
Function at 0x454bd4
Capabilities:
Enumerate network shares

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe6c
mov esi, edx
lea edi, [esp + 0x14]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, eax
lea edx, [esp + 0x14]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_AddNetInfo_qqrrx13_NETRESOURCEW
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_GetParams_qqrruit1
push esp
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.mpr.dll_WNetOpenEnumW
mov ebx, eax
test ebx, ebx
jne 0x454c7d
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x160
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.mpr.dll_WNetEnumResourceW
mov ebx, eax
test ebx, ebx
jne 0x454c79
lea edx, [esp + 0x34]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_IsContainer_qqrrx13_NETRESOURCEW
test al, al
je 0x454c6e
lea edx, [esp + 0x34]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_EnumNetContainer_qqrrx13_NETRESOURCEW
jmp 0x454c79
lea edx, [esp + 0x34]
mov eax, esi
call sym.TCFLib210.bpl__Enetres_TEvNetResources_AddNetInfo_qqrrx13_NETRESOURCEW
test ebx, ebx
je 0x454c23
mov eax, dword [esp]
push eax
call sub.mpr.dll_WNetCloseEnum
mov ebx, dword [esi + 0x44]
test ebx, ebx
je 0x454c97
mov eax, ebx
call sub.vcl210.bpl__Vcl_Comctrls_TTreeNode_GetParent_qqrv
mov dword [esi + 0x44], eax
add esp, 0x194
pop edi
pop esi
pop ebx
ret
Function at 0x455000
Capabilities:
Authenticate hmac

Disassembly:
aam 0x39
inc eax
add byte [eax + edi + 0x40], al
add ah, al
and al, byte [eax]
movsb byte es:[edi], byte [esi]
aaa
inc eax
add byte [eax + edi], bl
inc eax
add ah, dh
aaa
inc eax
add ah, dl
sub byte [eax], al
fsubr qword [eax]
inc eax
add byte [esp], cl
inc eax
add byte [esi + esi], dh
inc eax
add byte [esp], bh
inc eax
add ah, ch
and eax, dword [eax]
in al, 0x23
inc eax
add byte [esp + 0x40], al
add byte [esp + ebp*2], dl
inc ebp
add byte [esp], bl
inc eax
add byte [ecx + edi + 0x39dc0040], bh
inc eax
add ah, al
cmp dword [eax], eax
jl 0x455085
inc eax
add ah, dh
inc eax
add ah, bh
inc eax
add byte [ebp + esi + 0x40], ah
add byte [ecx + edi + 0x40], bl
add byte [ecx + edi + 0x40], ah
add byte [ecx + edi], bl
inc eax
add byte [ebp + esi + 0x40], bl
add byte [edi + esi + 0x37bc0040], dh
inc eax
add ah, al
cmp byte [eax], al
sbb al, 0x36
inc eax
add byte [eax + ebp], ch
inc eax
add byte [ebp + esi + 0x364c0040], al
inc eax
inc eax
add byte [edx + edi], bh
inc eax
add ah, cl
inc eax
add byte [esi + esi + 0x40], dh
add byte [eax + edi + 0x39cc0040], cl
inc eax
add byte [ebp + esi + 0x40], dl
add ah, cl
aaa
inc eax
add byte [ecx + edi], ah
inc eax
add byte [ecx + edi], dh
inc eax
add byte [ecx + edi], cl
inc eax
add byte [ecx + edi], ch
inc eax
add ah, bh
aaa
inc eax
add byte [eax + edi], al
inc eax
add byte [eax + edi + 0x40], bl
add byte [eax], cl
outsd dx, dword [esi]
inc ebp
add ah, dh
sub byte [eax], al
cmp al, 0x6f
inc ebp
add byte [eax + edi + 0x40], ah
add byte [eax + edi + 0x40], ch
add byte [eax + edi + 0x40], dh
add byte [eax + edi + 0x40], dl
add byte [ecx + ebp], al
inc eax
add byte [edx + edi], ah
inc eax
add byte [ecx + edi + 0x40], dl
add byte [eax + edi + 0x3a140040], bl
inc eax
add byte [eax + edi + 0x39140040], al
inc eax
add byte [edx + edi], dh
inc eax
add byte [eax + ebp + 0x393c0040], bl
inc eax
add byte [eax + ebp], bl
inc eax
add byte [eax + ebp], ah
inc eax
add byte [eax + ebp + 0x287c0040], cl
inc eax
add byte [eax + ebp + 0x28940040], bh
inc eax
add byte [eax + ebp + 0x28a40040], al
inc eax
add byte [eax + ebp + 0xe0040], dh
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
invalid
Function at 0x45ec3c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x45ec76
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x45ec7d
mov eax, ebx
call sub.rtl210.bpl__System__UStrClr_qqrpv
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x45f2ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
xor edx, edx
mov dword [ebp - 0x58], edx
xor eax, eax
push ebp
push 0x45f385
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call sub.rtl210.bpl__System__FillChar_qqrpvic
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 1
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea edx, [ebp - 0x58]
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TApplication_GetExeName_qqrv
lea eax, [ebp - 0x58]
mov edx, 0x45f39c
call sub.rtl210.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x58]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
call sub.kernel32.dll_CreateProcessW
push 0
call sub.user32.dll_PostQuitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f38c
lea eax, [ebp - 0x58]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x46fa70
Capabilities:
Authenticate hmac

Disassembly:
add edx, dword [eax]
push esp
inc ebp
jbe 0x46facb
jo 0x46fabc
outsd dx, dword [esi]
ja 0x46fae9
inc edx
je 0x46faec
push esp
jns 0x46faf1
add dword gs:[eax], eax
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edx + edi*8 + 0x46], ch
add byte [esi], al
bound esi, qword [esi + ecx*2 + 0x65]
js 0x46fb0a
push es
bound esi, qword [eax + edx*2 + 0x72]
jbe 0x46faa3
inc ebp
push ebx
jo 0x46fb0b
outsb dx, byte [esi]
add al, byte [eax]
add byte [eax], al
add byte [edx + edi*8 + 0x13080046], ch
or byte [ebx], dl
inc ebp
jbe 0x46fb24
outsb dx, byte [esi]
pop es
add al, ah
insb byte es:[edi], dx
outsb dx, byte [esi]
add byte [eax], al

Function at 0x46faac
Capabilities:
Authenticate hmac

Disassembly:
or byte [ebx], dl
push esp
inc ebp
jbe 0x46fb07
jo 0x46faf8
outsd dx, dword [esi]
ja 0x46fb25
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x6e657645
je 0x46fac2
add cl, byte [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x46fad3
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 6], si
add byte [esi], al
inc edx
jne 0x46fb4c
je 0x46fb49
outsb dx, byte [esi]
adc byte [ebp + eax*2 + 0x76], dl
push ebp
jo 0x46fb26
outsd dx, dword [esi]
ja 0x46fb53
inc edx
je 0x46fb56
push esp
jns 0x46fb5b
add al, ah
ror byte [edx], 0x6c
cli
inc esi
add bl, bh
cli
inc esi
add byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
or al, ah
ror byte [edx], 6
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x46fb11
add byte [eax], al
insb byte es:[edi], dx
cli
inc esi
add byte [esi], al
inc edx
jne 0x46fb8d
je 0x46fb8a
outsb dx, byte [esi]
add al, byte [eax]
add byte [eax], al
js 0x46fb1d
add byte [eax], al
add byte [eax - 5], bh
inc esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cld
cld
inc esi
add byte [esp + edi*8 + 0x46], bh
add byte [eax - 0x59ffb904], bl
cld
inc esi
add byte [esi - 0x63ffb904], ch
add al, byte [eax]
add byte [eax], ah
aam 0x4a
add al, dh
adc byte [eax], al
lock adc byte [eax], al
clc
adc byte [eax], al
and byte [ecx], dl
add byte [eax], ah
adc dword [eax], eax
xor al, 0x24
inc eax
add byte [esp], dh
inc eax
add byte [eax], dh
adc dword [eax], eax
mov ah, 0x23
inc eax
add byte [eax + 0x11], al
inc eax
add byte [eax + edi + 0x10c80040], dl
inc eax
add al, dl
adc byte [eax], al
in al, dx
aaa
inc eax
add ah, dl
aam 0x39
inc eax
add byte [eax + edi + 0x40], al
add ah, al
and al, byte [eax]
movsb byte es:[edi], byte [esi]
aaa
inc eax
add byte [eax + edi], bl