joyce8/EMBER2024-capa huggingface dataset:
Function at 0x792a50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x792ba4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x792b7a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x792bc4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, ebx
call fcn.0078ef44
mov esi, eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [ebp - 0xc], eax
mov edx, 0x792be4
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Classes_TStrings_SetLineBreak_qqrx20System_UnicodeString
push 0x792bf4
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, ebx
call fcn.0078ee48
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test esi, esi
jne 0x792b2a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
je 0x792b60
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x792c10
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.006aa354
jmp 0x792b64
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x792b60
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x18]
lea eax, [ebp - 0x18]
mov edx, 0x792c7c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.006aa354
jmp 0x792b64
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x792b81
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_TObject_Free_qqrv
ret
Function at 0x79512c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x79525d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x795230
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Win32MajorVersion]
cmp dword [eax], 6
jl 0x795184
mov eax, 0x795278
call fcn.00794fdc
mov ebx, eax
jmp 0x795190
mov eax, 0x7952a0
call fcn.00794fdc
mov ebx, eax
mov eax, 0x7952a0
call fcn.00794fdc
mov esi, eax
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.00402518
mov dword [ebp - 0x50], 0x44
mov eax, 0x7952bc
mov dword [ebp - 0x48], eax
mov word [ebp - 0x20], 0
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0xc]
push eax
call sub.userenv.dll_CreateEnvironmentBlock
cmp eax, 1
sbb eax, eax
inc eax
test al, al
test ebx, ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x400
push 0
push 0
push 0
push 0x7952e8
push dword [ebp - 4]
push 0x7952f8
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x64]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
push ebx
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.userenv.dll_DestroyEnvironmentBlock
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x79523a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x795264
lea eax, [ebp - 0x64]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x79b960
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0079ba1c
test bl, bl
je 0x79b988
push 0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, esi
call sub.rtl120.bpl__System_TObject_Free_qqrv
pop esi
pop ebx
ret
mov byte [esi + 0x68], 1
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop esi
pop ebx
ret

Function at 0x79ba1c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, esi
call sub.rtl120.bpl__Classes_TThread_Terminate_qqrv
test bl, bl
je 0x79ba42
push 0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, esi
call sub.rtl120.bpl__System_TObject_Free_qqrv
pop esi
pop ebx
ret
mov byte [esi + 0x44], 1
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop esi
pop ebx
ret
Function at 0x7be414
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x7be41c
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x7be5b7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
sete al
mov ecx, 2
or edx, 0xffffffff
call sub.rtl120.bpl__Math_IfThen_qqroxixi
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.007c7888
cmp ebx, dword [0x8063c0]
jne 0x7be474
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x8063bc]
cmp eax, 0x2710
jb 0x7be58f
call sub.kernel32.dll_GetTickCount
mov dword [0x8063bc], eax
mov dword [0x8063c0], ebx
lea eax, [ebp - 0x10]
call fcn.0040ccac
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x7be5d4
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
je 0x7be58f
test ebx, ebx
jle 0x7be4b7
mov ebx, 1
jmp 0x7be4b9
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x28]
call fcn.0040ccac
push dword [ebp - 0x28]
push 0x7be600
push 0x7be61c
lea eax, [ebp - 0x24]
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x7be634
call fcn.00411984
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x7be654
call fcn.00411984
xor eax, eax
push ebp
push 0x7be556
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0040dad8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7be58f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7be5be
lea eax, [ebp - 0x2c]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x10]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x7c22a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7c24a4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x7c248e
cmp esi, dword [ebx + 0x644]
je 0x7c248e
test cl, cl
je 0x7c22db
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Win32MajorVersion]
cmp dword [eax], 6
jge 0x7c22df
xor eax, eax
jmp 0x7c22e1
mov al, 1
mov ecx, eax
mov byte [ebx + 0x62f], cl
cmp esi, 0x100
sete dl
mov eax, dword [ebx + 0x4dc]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x100
sete dl
mov eax, dword [ebx + 0x4e4]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x4e4]
movzx eax, byte [eax + 0x57]
mov dl, 1
call sub.rtl120.bpl__Sysutils_BoolToStr_qqroo
lea eax, [ebp - 4]
mov edx, 0x7c24bc
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp esi, 0x100
sete dl
mov eax, dword [ebx + 0x4d0]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
mov eax, dword [ebx + 0x4d0]
movzx edx, byte [eax + 0x57]
mov eax, dword [ebx + 0x614]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp byte [ebx + 0x671], 0
je 0x7c2381
xor edx, edx
mov eax, dword [ebx + 0x618]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
jmp 0x7c2396
mov eax, dword [ebx + 0x4d0]
movzx edx, byte [eax + 0x57]
mov eax, dword [ebx + 0x618]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
mov eax, dword [ebx + 0x4d0]
movzx edx, byte [eax + 0x57]
mov eax, dword [ebx + 0x61c]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x100
sete dl
mov eax, dword [ebx + 0x4d8]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4c0]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4bc]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4c4]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4c8]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4cc]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4f0]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x4d4]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
cmp esi, 0x200
sete dl
mov eax, dword [ebx + 0x604]
call sub.vcl120.bpl__Controls_TControl_SetVisible_qqro
mov eax, esi
sub eax, 0x100
je 0x7c2471
sub eax, 0x100
je 0x7c247a
jmp 0x7c2481
mov eax, ebx
call fcn.007c525c
jmp 0x7c2481
mov eax, ebx
call fcn.007c505c
mov dword [ebx + 0x644], esi
mov byte [ebx + 0x62f], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c24ab
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x7c6700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x7c6708
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7c6887
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4fc]
mov eax, dword [eax + 0x274]
mov esi, dword [eax + 4]
dec esi
test esi, esi
jl 0x7c6795
inc esi
xor edi, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4fc]
mov eax, dword [eax + 0x274]
mov edx, edi
call fcn.0047595c
mov ebx, eax
cmp dword [ebx + 0x50], 0
jne 0x7c6773
cmp dword [ebx + 0x98], 0
jne 0x7c6791
mov dword [ebp - 0xc], ebx
jmp 0x7c6791
mov eax, dword [ebx + 0x48]
call fcn.00473b04
test eax, eax
jne 0x7c6791
cmp byte [ebx + 0x45], 0
je 0x7c6791
inc dword [ebp - 0x10]
cmp byte [ebx + 0x38], 0
je 0x7c6791
inc dword [ebp - 0x14]
inc edi
dec esi
jne 0x7c6747
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x7c67ad
cmp dword [ebp - 0x14], 0
je 0x7c67ad
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00473c5c
lea ecx, [ebp - 4]
mov eax, dword [0x806a24]
mov eax, dword [eax]
mov edx, 0x7c68a4
call fcn.00584a64
movzx eax, byte [0x7c68c4]
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x1c]
mov edx, 0x7c68d4
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_StringReplace_qqrx20System_UnicodeStringt1t149System__Set_t21Sysutils_Sysutils__15_iuc_0_iuc_1_
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
movzx eax, byte [0x7c68c4]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x24]
mov edx, 0x7c68e8
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_StringReplace_qqrx20System_UnicodeStringt1t149System__Set_t21Sysutils_Sysutils__15_iuc_0_iuc_1_
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x7c68fc
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x28]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4fc]
mov eax, dword [eax + 0x278]
xor edx, edx
call fcn.004800d4
add eax, 0xc
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c688e
lea eax, [ebp - 0x28]
mov edx, 5
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x7c7888
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
test bl, bl
je 0x7c78af
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x8063ec]
cmp eax, 0x12c
jb 0x7c7967
call sub.kernel32.dll_GetTickCount
mov dword [0x8063ec], eax
push ebp
call fcn.007c77a8
pop ecx
test bl, bl
je 0x7c7954
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x384]
mov eax, dword [esi + 0x5c]
cmp eax, 2
jge 0x7c78f1
mov eax, esi
mov edx, 2
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov dword [0x8063f0], 1
jmp 0x7c7967
mov ebx, eax
mov eax, dword [esi + 0x4c]
call sub.vcl120.bpl__Imglist_TCustomImageList_GetCount_qqrv
dec eax
cmp dword [0x8063f0], 1
jne 0x7c791d
mov edx, dword [0x8063f0]
add edx, ebx
cmp eax, edx
jge 0x7c791d
mov dword [0x8063f0], 0xffffffff
jmp 0x7c793c
cmp dword [0x8063f0], 0xffffffff
jne 0x7c793c
mov eax, dword [0x8063f0]
add eax, ebx
cmp eax, 2
jge 0x7c793c
mov dword [0x8063f0], 1
mov edx, dword [0x8063f0]
add edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x7c7967
inc esi
jne 0x7c7967
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x7cadf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
cmp dword [0x8063f8], 0
jg 0x7caf8a
inc dword [0x8063f8]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x626], 0
jne 0x7caf8a
mov eax, dword [ebp - 4]
call fcn.007b5d04
test al, al
jne 0x7caf8a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4d0]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4d4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
push ebp
push 0x7caf83
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x7bc2c8]
call fcn.007d8f6c
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x7bc6ac]
call fcn.007d9374
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
cmp bl, 1
cmc
sbb eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0x7cadc4
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
push 0xa
push esi
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0x102
jne 0x7caecb
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
jmp 0x7caeab
push esi
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x14], 0
je 0x7caee7
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.007c94f0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x7caf18
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.007d8f24
mov edx, dword [0x4136d4]
call sub.rtl120.bpl__System__Dispose_qqrpvt1
inc esi
dec ebx
jne 0x7caeff
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x7caf3f
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.007d932c
mov edx, dword [0x413640]
call sub.rtl120.bpl__System__Dispose_qqrpvt1
inc esi
dec ebx
jne 0x7caf26
lea eax, [ebp - 8]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7caf8a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4d0]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4d4]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
dec dword [0x8063f8]
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7cbfd4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x7cc038
call fcn.0040fc40
test al, al
je 0x7cc028
mov eax, dword [0x806ce8]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x7cc050
call fcn.00518394
push 0
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, ebx
call fcn.007c7cf0
mov dl, 1
mov eax, ebx
call fcn.007caf90
pop ebx
ret

Function at 0x7cc07c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x7cc0e0
call fcn.0040fc40
test al, al
je 0x7cc0d0
mov eax, dword [0x806ce8]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x7cc0fc
call fcn.00518394
push 0
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, ebx
call fcn.007c7cf0
mov dl, 1
mov eax, ebx
call fcn.007cb8ec
pop ebx
ret
Function at 0x7d0c8c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7d0d8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0xbc
mov dword [ebp - 0x18], edi
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x7d0d9c]
add esp, 0xfffffff4
fstp xword [esp]
wait
push 0x3fff
push 0x80000000
push 0
call sub.rtl120.bpl__Math_Min_qqrxgxg
fstp qword [ebp - 8]
wait
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [0x8069e4]
mov cl, 1
mov edx, 3
call fcn.00555080
fstp qword [ebp - 0x10]
wait
fld dword [0x7d0da0]
fsub qword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
fild dword [ebp - 0x1c]
fmulp st(1)
call sub.rtl120.bpl__System__TRUNC_qqrv
mov esi, eax
lea edx, [ebp - 0x20]
mov eax, esi
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov eax, dword [ebp - 0x20]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
mov edi, 0xf0
sub edi, esi
mov edx, edi
mov eax, dword [ebx + 0x5a0]
call sub.vcl120.bpl__Controls_TControl_SetWidth_qqri
mov eax, dword [ebx + 0x5a0]
mov edx, dword [eax + 0x48]
mov eax, dword [ebx + 0x5a4]
call sub.vcl120.bpl__Controls_TControl_SetWidth_qqri
mov eax, ebx
call fcn.007c1a20
mov edx, dword [ebx + 0x48]
sub edx, edi
dec edx
sub edx, eax
mov eax, dword [ebx + 0x5a0]
call sub.vcl120.bpl__Controls_TControl_SetLeft_qqri
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d0d94
lea eax, [ebp - 0x20]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x7d0da4
Capabilities:
Print debug messages

Disassembly:
add edx, 0xffff6e39
cmp edx, 5
ja case.default.0x7d0daf
jmp dword [edx*4 + 0x7d0db6]
call fcn.007c7d8c
ret
call fcn.007c8be8
ret
mov eax, dword [eax + 0x380]
call fcn.0056819c
push 0x7d0e14
call sub.kernel32.dll_OutputDebugStringW
ret
mov eax, dword [eax + 0x380]
call fcn.0056828c
push 0x7d0e2c
call sub.kernel32.dll_OutputDebugStringW
ret
call fcn.007d0bbc
ret
call fcn.007d0bbc
ret
Function at 0x4010f5
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x40116d
cmp byte [edi], 0
je 0x40116d
push esi
push 0x45d7e4
push edi
call fcn.0044d040
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40111f
mov byte [esi], 0
push edi
mov word [ebp - 0x10], 2
call sub.WSOCK32.dll_inet_addr
test esi, esi
mov dword [ebp - 0xc], eax
jne 0x401136
xor eax, eax
jmp 0x401143
lea eax, [esi + 1]
push eax
call fcn.0044cfa8
pop ecx
movzx eax, ax
push eax
call sub.WSOCK32.dll_htons
test esi, esi
mov word [ebp - 0xe], ax
je 0x401154
mov byte [esi], 0x3a
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_sendto
pop esi
jmp 0x40116f
xor eax, eax
pop edi
leave
ret

Function at 0x4011d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [ebp + 8]
mov dword [ebp - 4], 1
call sub.WSOCK32.dll_setsockopt
push dword [ebp + 0xc]
mov word [ebp - 0x14], 2
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x401217
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x10], eax
jmp 0x40121b
and dword [ebp - 0x10], 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_bind
leave
ret

Function at 0x403631
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
cmp dword [0x4aff50], 0
jne 0x403674
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
test cl, 1
je 0x403654
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x403656
shr ecx, 1
dec esi
jne 0x403645
mov dword [edx*4 + 0x4ad920], ecx
inc edx
cmp edx, 0x100
jl 0x403640
mov dword [0x4aff50], 1
pop esi
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x40369d
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4ad920]
inc ecx
cmp ecx, dword [esp + 8]
jl 0x40367c
not eax
ret

Function at 0x403de9
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [0x4aad7c], esi
jle 0x403e42
push edi
push esi
mov ecx, 0x4aad78
call fcn.004028c9
mov ecx, dword [0x4b1d77]
lea edi, [eax + 0x20]
push edi
push eax
lea edx, [ecx + 0x67331024]
lea eax, [ecx + 0x67331154]
add ecx, 0xbfaf7d73
push str._s___s_
xor eax, edx
xor ecx, dword [eax*4 + 0x4c0b18]
push 0
push dword [esp + 0x1c]
xor ecx, edx
call ecx
add esp, 0x14
inc esi
cmp esi, dword [0x4aad7c]
jl 0x403df5
pop edi
pop esi
ret