joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50068828
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov byte [eax + 0x5006], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
lcall 0, 0xc500688
add al, ah
adc al, byte [eax]
push eax
test al, 0x6c
add byte [eax - 0x50], dl
insb byte es:[edi], dx
add byte [eax + 0x20], dl
outsd dx, dword [esi]
add byte [eax + 0x18], dl
outsd dx, dword [esi]
add byte [eax + 0x38], dl
outsd dx, dword [esi]
add byte [eax + 0x3c], dl
outsd dx, dword [esi]
add byte [eax + 0x40], dl
outsd dx, dword [esi]
add byte [eax + 0x34], dl
outsd dx, dword [esi]
add byte [eax - 0x7c], dl
imul eax, dword [eax], 0x50
mov al, byte [0xdc50006b]
imul eax, dword [eax], 0x50
mov esp, 0xbc500049
dec ecx
add byte [eax - 0x78], dl
lea eax, [esi]
push eax
aam 0x8e
push es
push eax
xor byte [edi - 0x6c0faffa], cl
push es
push eax
jl 0x500687d6
push es
push eax
pop esp
pop dword [esi]
push eax
adc al, 0x90
push es
push eax
int3

Function at 0x50068c50
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, 0x8c
push es
push eax
or al, 0
add byte [eax], al
rol byte [edi + 0x6ca85006], 1
add byte [eax - 0x50], dl
insb byte es:[edi], dx
add byte [eax + 0x20], dl
outsd dx, dword [esi]
add byte [eax + 0x18], dl
outsd dx, dword [esi]
add byte [eax + 0x38], dl
outsd dx, dword [esi]
add byte [eax + 0x3c], dl
outsd dx, dword [esi]
add byte [eax + 0x40], dl
outsd dx, dword [esi]
add byte [eax + 0x34], dl
outsd dx, dword [esi]
add byte [eax - 0x7c], dl
imul eax, dword [eax], 0x50
mov al, byte [0x50006b]
test eax, 0xa92c5006
sub al, 0xa9
sub al, 0xa9
push es
push eax
mov word [ecx - 0x7277affa], gs
push es
push eax
aam 0x8e
push es
push eax
xor byte [edi - 0x6c0faffa], cl
push es
push eax
jl 0x50068bfe
push es
push eax
pop esp
pop dword [esi]
push eax
adc al, 0x90
push es
push eax
int3

Function at 0x50069a38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x50069ab8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x50069a75
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x50069a75
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call sym.rtl120.bpl__System__InternalUStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
test eax, eax
je 0x50069a7e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x50069aa2
mov edx, 1
mov ecx, ebx
add ecx, ecx
add ecx, ecx
shr ebx, 0x1e
or ecx, ebx
mov ebx, dword [ebp - 4]
movzx ebx, word [ebx + edx*2 - 2]
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x50069a87
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50069abf
lea eax, [ebp - 4]
call sym.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x5006a92c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x800
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp + 0xc]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, edi
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, esi
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov ecx, eax
lea edx, [ebp - 0x1000]
mov eax, dword [ebp + 8]
call sym.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5006a9f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5006aaed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4000
call sym.rtl120.bpl__System__GetMem_qqri
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5006aad0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Classes_TStrings_BeginUpdate_qqrv
xor eax, eax
push ebp
push 0x5006aab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x4000
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetPrivateProfileStringW
test eax, eax
je 0x5006aa9d
mov ebx, dword [ebp - 8]
jmp 0x5006aa97
lea eax, [ebp - 0xc]
mov edx, ebx
call sym.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call sym.rtl120.bpl__Sysutils_StrLen_qqrpxb
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
jne 0x5006aa76
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006aaba
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Classes_TStrings_EndUpdate_qqrv
ret
Function at 0x5006abbc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x400
mov eax, dword [ebp - 0x1c]
add eax, eax
call sym.rtl120.bpl__System__GetMem_qqri
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5006ac48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
sub eax, 2
cmp eax, dword [ebp - 8]
jle 0x5006ac2f
push ebp
call fcn.5006aafc
pop ecx
call sym.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x5006ac5e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006ac4f
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__System__FreeMem_qqrpv
ret
mov esp, ebp
pop ebp
ret
Function at 0x5006c30c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5006c476
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call sym.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
call fcn.5006bbd4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x5006c35e
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call sym.rtl120.bpl__System__UStrDelete_qqrr20System_UnicodeStringii
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__Registry_TRegistry_GetKey_qqrx20System_UnicodeString
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5006c433
xor eax, eax
push ebp
push 0x5006c42c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x5006c40a
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call sym.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x5006c40a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x5006c404
mov eax, dword [ebp - 8]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x3c]
call sym.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__Registry_TRegistry_DeleteKey_qqrx20System_UnicodeString
dec ebx
cmp ebx, 0xffffffff
jne 0x5006c3bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006c433
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__Registry_TRegistry_GetBaseKey_qqro
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006c47d
lea eax, [ebp - 0x3c]
call sym.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sym.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x5006c50c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5006c5c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call sym.rtl120.bpl__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x5006c5a6
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call sym.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x5006c5a6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x2c]
call sym.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x5006c55f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006c5cb
lea eax, [ebp - 0x2c]
call sym.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sym.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x5006c5d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5006c68c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call sym.rtl120.bpl__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x5006c66e
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call sym.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x5006c66e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x2c]
call sym.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x5006c627
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006c693
lea eax, [ebp - 0x2c]
call sym.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sym.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x5006ccb8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.5006bc48
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x5006cd17
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [sym.rtl120.bpl__Rtlconsts__SRegSetDataFailed]
mov dl, 1
mov eax, dword [sym.rtl120.bpl__Registry_ERegistryException_]
call sym.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sym.rtl120.bpl__System__RaiseExcept_qqrv
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5006cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x5006cd78
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [sym.rtl120.bpl__Rtlconsts__SRegGetDataFailed]
mov dl, 1
mov eax, dword [sym.rtl120.bpl__Registry_ERegistryException_]
call sym.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sym.rtl120.bpl__System__RaiseExcept_qqrv
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.5006bc78
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5006d350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5006d467
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call sym.rtl120.bpl__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
xor eax, eax
push ebp
push 0x5006d442
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call sym.rtl120.bpl__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x5006d426
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.5006d230
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call sym.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x5006d426
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x5006d422
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x30]
call sym.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.5006d230
pop ecx
inc edi
dec ebx
jne 0x5006d3d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5006d449
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call sym.rtl120.bpl__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
ret
Function at 0x500773ac
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x50077435
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x500a904c
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x5007741f
lea edx, [ebp - 0x1c]
mov eax, ebx
call sym.rtl120.bpl__Sysutils_SysErrorMessage_qqrui
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x50077450
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [sym.rtl120.bpl__Rtlconsts__sWindowsSocketError]
mov dl, 1
mov eax, dword [sym.rtl120.bpl__Scktcomp_ESocketError_]
call sym.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sym.rtl120.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5007743c
lea eax, [ebp - 0x1c]
call sym.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x50077ae0
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x50077b3c]
cmp al, byte [ebx + 0x28]
je 0x50077b04
mov esi, 0x401
mov eax, ebx
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_GetHandle_qqrv
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x50077b3c]
cmp al, byte [ebx + 0x28]
jne 0x50077b34
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x50077bd4
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_DoSetAsyncStyles_qqrv
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call sym.rtl120.bpl__System__CallDynaInst_qqrv
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x50077c3c
call fcn.500772f4
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x50077c2a
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call sym.rtl120.bpl__System__CallDynaInst_qqrv
pop esi
pop ebx
ret
Function at 0x50077c68
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Lock_qqrv
xor eax, eax
push ebp
push 0x50077ce9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call sym.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x50077ca3
call sym.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x50077cf0
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x50077cd3
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call sym.rtl120.bpl__System__UStrFromPChar_qqrr20System_UnicodeStringpc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50077cf0
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Unlock_qqrv
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50077cf8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Lock_qqrv
xor eax, eax
push ebp
push 0x50077d73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call sym.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x50077d36
call sym.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x50077d7a
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x50077d5d
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call sym.rtl120.bpl__System__UStrFromArray_qqrr20System_UnicodeStringpci
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50077d7a
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Unlock_qqrv
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50077d80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Lock_qqrv
xor eax, eax
push ebp
push 0x50077dfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x50077db6
call sym.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x50077e02
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x50077de5
movzx eax, word [ebp - 0x1a]
push eax
call sub.wsock32.dll_ntohs
movzx eax, ax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50077e02
mov eax, dword [ebp - 4]
call sym.rtl120.bpl__Scktcomp_TCustomWinSocket_Unlock_qqrv
ret
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x500780c8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x50078154
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, ebx
mov ecx, 0
call sym.rtl120.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0xc]
call sym.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 4
call sym.rtl120.bpl__System__FillChar_qqrpvib
test ebx, ebx
je 0x50078138
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [ebp - 8], cl
movzx ecx, byte [edx + 1]
mov byte [ebp - 7], cl
movzx ecx, byte [edx + 2]
mov byte [ebp - 6], cl
movzx eax, byte [edx + 3]
mov byte [ebp - 5], al
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5007815b
lea eax, [ebp - 0xc]
call sym.rtl120.bpl__System__LStrClr_qqrpv
ret