joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501b99e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc eax, 0x6e695754
outsd dx, dword fs:[esi]
ja 0x501b99c2
imul ebp, dword [ebp + 0x48], 0x7a69726f
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x501b99db
insb byte es:[edi], dx
invalid
adc dl, byte [eax + 0x30]
adc dword [edx], edx
push eax
mov word [0x11405012], ds
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cmp byte [ebx - 0x746fafe2], cl
nop
mov ebx, dword [esi]

Function at 0x501b9a58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc edx, dword [edi + edx*2 + 0x69]
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x501b9ab6
imul ebp, dword [ebp + 0x56], 0x69747265
arpl word [ecx + 0x6c], sp
call 0xec6bb60b
xchg esi, eax
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9adf
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
mov eax, eax
fcomp qword [edx + 0x501b]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec esp
wait
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + ebx*4], dh
sbb edx, dword [eax - 0x54]
add byte [eax], al
add ah, bl
xchg ebp, eax
sbb edx, dword [eax - 0x20]
adc byte [edx], dl
push eax
call 0x806bacc9
adc dl, byte [eax + 0x30]
adc dword [edx], edx
push eax
mov word [0x11405012], ds
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax

Function at 0x501b9b4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc dl, byte [edi + edx*2 + 0x69]
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x501b9ba3
imul ebp, dword [esi + 0x69], 0x657a696d
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
fcomp qword [edx - 0x6963afe5]
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9bd2
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
rcr byte [ebx + 0x501b], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp al, 0x9c
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
pushfd
sbb edx, dword [eax - 0x54]
add byte [eax], al
add ah, bl
xchg ebp, eax
sbb edx, dword [eax - 0x20]
adc byte [edx], dl
push eax
call 0x806badbd
adc dword [edx], edx
push eax
mov word [0x11405012], ds
push eax
loopne 0x501b9bb6
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
nop
push ds
Function at 0x501b9bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc dl, byte [edi + edx*2 + 0x69]
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x501b9ba3
imul ebp, dword [esi + 0x69], 0x657a696d
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
fcomp qword [edx - 0x6963afe5]
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9bd2
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
rcr byte [ebx + 0x501b], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp al, 0x9c
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
pushfd
sbb edx, dword [eax - 0x54]
add byte [eax], al
add ah, bl
xchg ebp, eax
sbb edx, dword [eax - 0x20]
adc byte [edx], dl
push eax
call 0x806badbd
adc dword [edx], edx
push eax
mov word [0x11405012], ds
push eax
loopne 0x501b9bb6
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
nop
push ds

Function at 0x501b9c3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
push cs
push esp
push edi
imul ebp, dword [esi + 0x64], 0x7241776f
jb 0x501b9caa
outsb dx, byte [esi]
rcr byte gs:[bp + di + 0x501b], 1
pushfd
xchg esi, eax
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9cbe
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
mov esp, 0x501b9c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
popfd
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dl
popfd
sbb edx, dword [eax - 0x5c]
add byte [eax], al
add al, bl
jge 0x501b9cad
push eax
loopne 0x501b9ca2
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
adc dl, byte [eax + 0x38]
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cmp byte [ebx - 0x746fafe2], cl
nop
invalid
push ds
Function at 0x501b9cbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
push cs
push esp
push edi
imul ebp, dword [esi + 0x64], 0x7241776f
jb 0x501b9caa
outsb dx, byte [esi]
rcr byte gs:[bp + di + 0x501b], 1
pushfd
xchg esi, eax
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9cbe
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
mov esp, 0x501b9c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
popfd
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dl
popfd
sbb edx, dword [eax - 0x5c]
add byte [eax], al
add al, bl
jge 0x501b9cad
push eax
loopne 0x501b9ca2
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
adc dl, byte [eax + 0x38]
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cmp byte [ebx - 0x746fafe2], cl
nop
invalid
push ds

Function at 0x501b9d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or edx, dword [eax + ecx*2 + 0x65]
insb byte es:[edi], dx
jo 0x501b9d69
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
mov esp, 0x8c501b9c
jle 0x501b9d52
push eax
adc eax, dword [eax]
or byte [ebx + 0x74], dl
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
mov eax, eax
pushfd
popfd
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + ebx*4], al
add byte [eax], al
add al, 0x9e
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dh
popfd
sbb edx, dword [eax - 0x5c]
add byte [eax], al
add byte [esp + ebx*4 + 0x1b], ah
push eax
loopne 0x501b9d82
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
Function at 0x501b9e04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or eax, 0x6c654854
jo 0x501b9e4f
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x501b9e75
outsb dx, byte [esi]
je 0x501b9e86
pushfd
popfd
sbb edx, dword [eax + 0x1c]
popfd
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9e85
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
sbb byte [esi + 0x501b], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, ch
sahf
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, dl
sahf
sbb edx, dword [eax - 0x5c]
add byte [eax], al
add byte [esp + ebx*4 + 0x1b], ah
push eax
loopne 0x501b9e66
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
sbb eax, 0x18145012
adc dl, byte [eax + 0x2c]
sbb eax, 0x1e1c5012

Function at 0x501b9eec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc byte [eax + ecx*2 + 0x65], dl
insb byte es:[edi], dx
jo 0x501b9f48
outsd dx, dword [esi]
jo 0x501b9f60
arpl word [ebx + 0x65], dx
popal
jb 0x501b9f60
push sym.vcl120.bpl__Stdactns_THelpTopicSearch_
sbb al, 0x9d
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9f70
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
nop
insb byte es:[edi], dx
lahf
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dl
lahf
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, al
lahf
sbb edx, dword [eax - 0x5c]
add byte [eax], al
add byte [esp + ebx*4 + 0x1b], ah
push eax
loopne 0x501b9f52
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cmp byte [ebx - 0x746fafe2], cl
nop
mov ebx, dword [esi]
Function at 0x501b9f6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc byte [eax + ecx*2 + 0x65], dl
insb byte es:[edi], dx
jo 0x501b9f48
outsd dx, dword [esi]
jo 0x501b9f60
arpl word [ebx + 0x65], dx
popal
jb 0x501b9f60
push sym.vcl120.bpl__Stdactns_THelpTopicSearch_
sbb al, 0x9d
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9f70
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
nop
insb byte es:[edi], dx
lahf
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dl
lahf
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, al
lahf
sbb edx, dword [eax - 0x5c]
add byte [eax], al
add byte [esp + ebx*4 + 0x1b], ah
push eax
loopne 0x501b9f52
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cmp byte [ebx - 0x746fafe2], cl
nop
mov ebx, dword [esi]

Function at 0x501b9fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or edx, dword [eax + ecx*2 + 0x65]
insb byte es:[edi], dx
jo 0x501ba027
outsb dx, byte [esi]
dec eax
insb byte es:[edi], dx
jo 0x501ba04a
lahf
sbb edx, dword [eax + 0x1c]
popfd
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501ba04f
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
mov eax, eax
dec esp
mov al, byte [0x501b]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov eax, 0x501ba0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x5bafe460], ah
add byte [eax], al
add byte [esp + ebx*4 + 0x1b], ah
push eax
loopne 0x501ba032
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push ds
push eax
Function at 0x501ba0b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc dl, byte [eax + ecx*2 + 0x65]
insb byte es:[edi], dx
jo 0x501ba103
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x501ba129
js 0x501ba13a
inc ecx
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
dec esp
mov al, byte [0x9d1c501b]
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501ba13e
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
cmp al, 0xa1
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x501ba1], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x33afe45f], ah
add byte [eax], al
add ah, al
jl 0x501ba12d
push eax
loopne 0x501ba122
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xa0501210
aad 0x1b
push eax
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
mov al, byte [0x90501bd5]
nop
sbb edx, dword [eax - 0x70]
push ds

Function at 0x501ba13c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc dl, byte [eax + ecx*2 + 0x65]
insb byte es:[edi], dx
jo 0x501ba103
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x501ba129
js 0x501ba13a
inc ecx
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
dec esp
mov al, byte [0x9d1c501b]
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501ba13e
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
cmp al, 0xa1
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x501ba1], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x33afe45f], ah
add byte [eax], al
add ah, al
jl 0x501ba12d
push eax
loopne 0x501ba122
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xa0501210
aad 0x1b
push eax
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
mov al, byte [0x90501bd5]
nop
sbb edx, dword [eax - 0x70]
push ds
Function at 0x501ba1b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc edx, dword [ebx + eax*2 + 0x6f]
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
inc esp
imul esp, dword [ecx + 0x6c], 0x6341676f
je 0x501ba234
outsd dx, dword [esi]
outsb dx, byte [esi]
cmp al, 0xa1
sbb edx, dword [eax - 0x50]
jge 0x501ba1f2
push eax
add eax, dword [eax]
or byte [ebx + 0x74], dl
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
mov eax, eax
cmp al, 0xa2
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x501ba2], dh
add byte [eax], al
mov al, 0xa2
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x33afe45e], ah
add byte [eax], al
add ah, ah
mov al, byte [0x10e0501b]
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xa0501210
aad 0x1b
push eax

Function at 0x501ba2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or edx, dword [esi + eax*2 + 0x69]
insb byte es:[edi], dx
inc ecx
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
cmp al, 0xa2
sbb edx, dword [eax - 0x4c]
mov eax, dword [0x3501b]
or byte [ebx + 0x74], dl
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
mov eax, eax
sub al, 0xa3
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x501ba3], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x2bafe45d], dl
add byte [eax], al
add ah, ah
mov eax, dword [0x10e0501b]
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xa0501210
aad 0x1b
push eax
Function at 0x501bb4d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or eax, 0x61655354
jb 0x501bb543
push 0x69746341
outsd dx, dword [esi]
outsb dx, byte [esi]
pop esp
mov ah, 0x1b
push eax
mov ah, 0xa1
sbb edx, dword [eax + 3]
add byte [eax], cl
push ebx
je 0x501bb559
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
push esp
mov ch, 0x1b
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
int3
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x84501210
fstp qword [ebx]
push eax
sbb eax, 0x18145012
adc dl, byte [eax + 0x2c]
sbb eax, 0xde145012
sbb edx, dword [eax - 0x7c]
sbb dword [esi], 0x50
rcl byte [ecx + 0x1d94501e]
adc dl, byte [eax + 0x44]
sbb eax, 0x1d3c5012
adc dl, byte [eax - 0x64]
sbb eax, 0xdd345012
sbb edx, dword [eax + 0x44]
Function at 0x501bbc3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc byte [ebx + edx*2 + 0x65], dl
popal
jb 0x501bbca7
push 0x646e6946
inc esi
imul esi, dword [edx + 0x73], 0x1bbbbc74
push eax
enter 0x1bb5, 0x50
adc eax, dword [eax]
or byte [ebx + 0x74], dl
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
nop
mov esp, 0x501bbc
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi*4 + 0x501b], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [ebp + 0xac501b], bh
add byte [eax], al
les edi, [esi + ebx + 0x50]
loopne 0x501bbca2
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
Function at 0x501bd818
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x501bd884
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TCommonDialogAction_ExecuteTarget_qqrp14System_TObject
cmp byte [ebx + 0xa0], 0
je 0x501bd86e
cmp byte [ebx + 0xc8], 0
je 0x501bd86e
push 5
push 0
push 0
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TFileAction_GetDialog_qqrv
lea edx, [ebp - 4]
call sym.vcl120.bpl__Dialogs_TOpenDialog_GetFileName_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501bd88b
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x501bd898
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x501bd98e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xd0]
test eax, eax
je 0x501bd8c9
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x501bd8d1
mov al, 1
jmp 0x501bd8de
mov eax, dword [ebx + 0xd0]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
xor al, 1
test al, al
je 0x501bd90a
mov edx, esi
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TFileOpen_ExecuteTarget_qqrp14System_TObject
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TFileAction_GetDialog_qqrv
lea edx, [ebp - 4]
call sym.vcl120.bpl__Dialogs_TOpenDialog_GetFileName_qqrv
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xd0]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x501bd911
mov byte [ebx + 0xa0], 1
cmp byte [ebx + 0xa0], 0
je 0x501bd958
push 5
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0xd0]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x501bd9a8
call sub.rtl120.bpl__Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x501bd9e4
push 0x501bda00
push 0
call sub.shell32.dll_ShellExecuteW
cmp word [ebx + 0xda], 0
je 0x501bd970
mov edx, ebx
mov eax, dword [ebx + 0xdc]
call dword [ebx + 0xd8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501bd995
lea eax, [ebp - 8]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x501bfb98
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x501bfbdf
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop esi
pop ebx
ret