joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bf677
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5bf6c2
mov edx, ebx
and edx, 1
shr ebx, 1
mov esi, dword [ebp + 8]
mov esi, dword [esi + eax*4]
mov edi, edx
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [edi + esi*4]
add dword [ebp - 4], esi
add eax, eax
or edx, eax
mov eax, edx
dec ecx
test ecx, ecx
jne 0x5bf692
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xc3a0aac
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x23d06d5a
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x44ba10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
sub esp, 8
mov al, byte [0x662041]
mov cl, byte [0x66204a]
xor cl, al
push ebx
mov byte [0x66204a], cl
mov cl, byte [0x662042]
or cl, 0x10
shr cl, 3
and ecx, 0xff
mov dword [esp + 4], ecx
fild dword [esp + 4]
fdivr qword [0x665958]
fadd qword [0x662058]
fstp qword [0x6659c8]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dl, byte [0x66204c]
mov ebx, eax
mov al, byte [0x662041]
or al, dl
mov byte [0x662041], al
mov al, byte [0x662044]
or al, 2
shr al, 1
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x662058]
fadd qword [0x65e718]
fstp qword [0x665968]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
adc eax, sym.imp.KERNEL32.dll_GetCommandLineW
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44bac9
mov edx, dword [0x665ab4]
push 0x6657cc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x665ab4]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov ecx, ebx
xor eax, eax
and ecx, 0xff
mov al, bh
cmp ecx, 5
pop ebx
jne 0x44baee
cmp eax, 1
jae 0x44bafe
mov dword [0x664fb8], 0x409
add esp, 8
ret
ja 0x44bafe
mov dword [0x664fb8], 0x409
add esp, 8
ret
mov dword [0x664fb8], 0x7f
add esp, 8
ret
Function at 0x5374db
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x5795622
pop esp
push 0xffffffffffffffdc
sbb eax, dword [ecx - 0x3f]
pop esi
sti
invalid
pushal
pop ebp
fdiv st(1), st(0)
or edi, dword [esi - 0x18]
imul edx, dword [edx], 0x3f842ad
fiadd word [edx + 0x34f2514b]
sar byte [ebp + 0x713f9f74], cl
xor al, 0xd2
xor al, 0xd2
mov ebp, 0x713f9f74
pop esi
arpl word [eax + edx], bx
cmp eax, 0x8047bdd2
adc ah, byte [edx]
std
sbb byte [ecx - 5], 0x16
mov dword [0x6c0aa00], eax
das
js 0x53739b
add esp, dword [ebx + 0x7588662c]
dec esi
jne 0x537410
mov eax, 0x4206e9fe
inc edx
salc
and edi, esp
arpl word [ebp - 0x1d144dc0], sp
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push 0x75
push 0xa93c5eee
ja 0x537389
cmp dh, ah
sbb ebp, edx
mov ebx, 0x5cfae303
inc eax
out dx, eax
inc edx
cld
jae 0x537376
jg 0x5373c0
adc dword [edx + 0x50], esi
int3
mov edi, 0x77b5de18
salc
or al, 0x44
scasb al, byte es:[edi]
stosb byte es:[edi], al
jns 0x53739c
shr byte [ebp - 0x23], cl
invalid
imul edi, dword [eax - 0x7f], 0x97bfcf2c
add eax, 0x5fd75b18
xchg ebx, eax
jle 0x5373c6
iretd
cmpsd dword [esi], dword es:[edi]
je 0x537483
loopne 0x537487
adc al, 0x71
mov edi, 0x5d0620d6
and al, 0x3f
sub edi, ebp
nop
js 0x537484
push ebp
mov esi, 0xd5a7eae0
sub al, 0xa1
invalid
mov dword [0xc3bd53d9], eax
movsb byte es:[edi], byte [esi]
and dword [ecx], esp
cmp byte [edi + edx*2], 0x20
sbb byte [esi], al
cld
push eax
or eax, 0xe02fcf5c
or byte [eax + edx + 0x38e10657], dl
mov dl, 0x5b
adc dword [eax + 0x43], 0xffffff84
xor bl, byte [ebx + eax + 0x2c751831]
ja 0x537414
cld
inc ecx
push cs
les edi, [ebx]
mov ah, 0xf8
and edi, dword [esi]
shr dword [esi], 1
mov dword [eax + ebp*4], edi
jp 0x537448
jle 0x5373ff
mov dl, 0x3a
or eax, 0x9871c13b
sal dword [ecx - 0x68], 0xc3
jno 0x53741e
ret
lds ebx, [eax + 0x1a3f73c5]
fst dword [ebx - 0x7b]
arpl word [edx], cx
xchg ecx, eax
or dl, bl
pop edx
sbb ebp, dword [ebx + esi*4]
sub byte [edx + 0x3b29492b], bh
lodsb al, byte [esi]
popal
int1
push ebx
push ss
and eax, 0x658fe93c
mov eax, 0x6a1778c5
or ebx, dword [edi + 0x7846a0f]
cmpsd dword [esi], dword es:[edi]
dec esi
daa
lea esp, [ebx + 0x454bb019]
mov al, 0x4b
inc ebp
jp 0x537442
mov word [ebp - 4], es
pop edi
int3
dec edx
xlatb
push edx
add byte [0xafd0d380], dh
leave
fild qword [eax + 0x38]
in al, 0xc7
in al, dx
in eax, 0x11
lodsb al, byte [esi]
inc edi
pop ebp
arpl word [0xe8523cc3], sp
rcl dword [esi - 0x16], cl
mov bl, 0x8f
xor ebp, dword cs:[ebp + 0x3e]
jb 0x5374ba
push edi
inc edx
and al, 0xd7
and dh, byte [ebx - 0x7c0a280]
mov word [edi], ss
out dx, eax
cmpsd dword [esi], dword es:[edi]
lodsd eax, dword [esi]
out dx, eax
cld
pushal
invalid

Function at 0x569fd3
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
and ebx, dword [ebx + 0x5ffbdb9d]
rcl dword [ebp + 0x72], cl
aaa
Function at 0x659a2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662398
cmp edx, dword [eax]
je 0x659a4f
add eax, 8
inc ecx
cmp eax, 0x662428
jl 0x659a40
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662398]
jne 0x659b7d
mov eax, dword [0xa5cd00]
cmp eax, 1
je 0x659b57
test eax, eax
jne 0x659a80
cmp dword [0x6622c4], 1
je 0x659b57
cmp edx, 0xfc
je 0x659b7d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659ab7
lea eax, [ebp - 0x1a4]
push 0x65eab0
push eax
call fcn.0065a410
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a8a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659afa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a8a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eaac
push edi
call fcn.0065c770
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ea90
push eax
call fcn.0065a410
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a420
lea eax, [ebp - 0xa0]
push 0x65ea8c
push eax
call fcn.0065a420
push dword [esi + 0x66239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a420
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ea64
push eax
call fcn.0065c6e4
add esp, 0x2c
pop edi
jmp 0x659b7d
lea eax, [ebp + 8]
lea esi, [esi + 0x66239c]
push 0
push eax
push dword [esi]
call fcn.0065a8a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x409ec4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x18]
push eax
push 0x40a00c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
push ebp
push 0x409ff7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 8
jg 0x409f4b
je 0x409fbe
sub esi, 1
jb 0x409f73
je 0x409fa4
dec esi
je 0x409f8a
jmp 0x409fed
sub esi, 0x40
je 0x409fd8
sub esi, 0xfffffc0
jne 0x409fed
xor ecx, ecx
or edx, 0xffffffff
xor eax, eax
call sub.powrprof.dll_SetSuspendState
cmp al, 1
sbb ebx, ebx
inc ebx
jmp 0x409fed
push 0
movzx eax, byte [ebp - 1]
or eax, 0
push eax
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x409fed
push 0xffff
movzx eax, byte [ebp - 1]
or eax, 2
push eax
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x409fed
push 0xffff
movzx eax, byte [ebp - 1]
or eax, 1
push eax
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x409fed
push 0xffff
movzx eax, byte [ebp - 1]
or eax, 9
push eax
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x409fed
push 0
movzx eax, byte [ebp - 1]
or eax, 0x40
push eax
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a003
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40a12f
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x40a126
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40a11f
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x40a108
sub eax, 4
jne 0x40a113
mov eax, ebx
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
jmp 0x40a11f
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov eax, esi
call sub.rtl120.bpl__System__FreeMem_qqrpv
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40a138
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40a1c4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x40a1bb
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40a1bb
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffc
sub eax, 2
jae 0x40a1bb
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a1d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
push 0
mov eax, ebx
mov ecx, 1
mov edx, dword [sym.imp.rtl120.bpl___xp_15Sysutils_TBytes]
call sub.rtl120.bpl__System__DynArraySetLength_qqrv
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40a294
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x40a28b
mov eax, dword [ebp - 0xc]
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [sym.imp.rtl120.bpl___xp_15Sysutils_TBytes]
call sub.rtl120.bpl__System__DynArraySetLength_qqrv
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x40a28b
push 0
mov eax, ebx
mov ecx, 1
mov edx, dword [sym.imp.rtl120.bpl___xp_15Sysutils_TBytes]
call sub.rtl120.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a2a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x40a2f6
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x40a2f6
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x40a304
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push esp
push 0xf003f
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40a343
mov eax, ebp
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
jne 0x40a343
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a908
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 4], edx
mov edx, 0x40
call sub.rtl120.bpl__Sysutils_FileOpen_qqrx20System_UnicodeStringui
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40a96b
xor edx, edx
push ebp
push 0x40a964
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
jne 0x40a94b
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x40a96b
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a96b
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__Sysutils_FileClose_qqri
ret
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x40a974
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40a991
test eax, 0x10
ja 0x40a995
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x40b1f8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b272
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetUserDefaultUILanguage
mov ecx, 0x40b28c
mov edx, 0x59
call sub.rtl120.bpl__Sysutils_GetLocaleStr_qqriix20System_UnicodeString
push dword [ebp - 4]
push 0x40b2a0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetUserDefaultUILanguage
mov ecx, 0x40b2b0
mov edx, 0x5a
call sub.rtl120.bpl__Sysutils_GetLocaleStr_qqriix20System_UnicodeString
push dword [ebp - 8]
mov eax, ebx
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b279
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x40b430
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x20c
pop ebx
ret

Function at 0x40b464
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x40b495
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x40b49e
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
add esp, 0x20c
pop ebx
ret

Function at 0x40b4f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b568
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x7a2004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b56f
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x40b574
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b5e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x7a2004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b5ef
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x40b5f4
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b689
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x26
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x7a2004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x20c]
mov eax, ebx
mov ecx, 0x40b6a4
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b690
lea eax, [ebp - 0x210]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x40b6c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b753
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call sub.rtl120.bpl__Activex_Succeeded_qqrl
test al, al
je 0x40b731
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__Sysutils_StrPas_qqrpxb
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x210]
mov eax, ebx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x40b73a
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b75a
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x40b760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b7f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_ExtractFileDrive_qqrx20System_UnicodeString
lea edx, [ebp - 0x214]
mov eax, dword [ebx]
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x214]
mov eax, ebx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7fb
lea eax, [ebp - 0x214]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x40b800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b86f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b876
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x40b87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b8eb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8f2
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret