joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42496c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push dword [ebx + 0x3cc]
push dword [ebx + 0x3c8]
lea ecx, [esp + 0xc]
lea edx, [esp + 0xa]
lea eax, [esp + 8]
call sub.rtl210.bpl__System_Sysutils_DecodeDate_qqrx16System_TDateTimerust2t2
cmp esi, dword [ebx + 0x3c4]
jne 0x4249a1
mov esi, 1
jmp 0x4249a4
or esi, 0xffffffff
push 0x10
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x4249bb
add word [esp], si
jmp 0x424a06
push 0x11
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x4249d9
mov eax, esi
add eax, eax
lea eax, [eax + eax*4]
add word [esp], ax
jmp 0x424a06
add word [esp + 2], si
cmp word [esp + 2], 0xc
jbe 0x4249f3
mov word [esp + 2], 1
inc word [esp]
jmp 0x424a06
cmp word [esp + 2], 1
jae 0x424a06
mov word [esp + 2], 0xc
dec word [esp]
movzx eax, word [esp]
call sub.rtl210.bpl__System_Sysutils_IsLeapYear_qqrus
and eax, 0x7f
lea eax, [eax + eax*2]
mov edx, dword [sym.imp.rtl210.bpl__System_Sysutils_MonthDays]
lea eax, [edx + eax*8]
movzx edx, word [esp + 2]
movzx edx, word [eax + edx*2 - 2]
movzx eax, word [esp + 4]
call sub.rtl210.bpl__System_Math_Min_qqrxixi
mov word [esp + 4], ax
movzx ecx, word [esp + 4]
movzx edx, word [esp + 2]
movzx eax, word [esp]
call sub.rtl210.bpl__System_Sysutils_EncodeDate_qqrususus
fstp qword [ebx + 0x3c8]
wait
mov eax, ebx
call sym.TCFLib210.bpl__Edbdate_TFrmDBDateEdCal_MonthChanged_qqrv
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x437bd0
Capabilities:
Get file system object information

Disassembly:
jnp 0x437c03
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
add al, byte [eax]
sar byte [ebx + 0x43], 1
add byte [edi], al
pop es
pop es
andps xmm0, xmmword [ebp + 0x76]
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x437c21
outsd dx, dword [esi]
js 0x437bbe
jns 0x437c27
add byte [eax - 0x2b], dl
dec edx
add byte [ebp], al
pop es
inc ebp
inc esp
imul esi, dword [edx + 0x42], 0x1786f
sbb cl, al
dec edx
add byte [ebx + ebp + 0x2bb40040], ch
inc eax
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [ecx], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x11], al
and eax, 0x74490a00
insd dword es:[edi], dx
dec eax
imul esp, dword gs:[edi + 0x68], 0x3000174
cmc
jnp 0x437c63
add byte [edx], al
add byte [edx], al
add al, byte [eax]
add al, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 4
add dword [eax], eax
add ah, ah
add al, 1
add bh, bh
invalid
or byte [ebx - 0x23170f3c], al
xchg esp, eax
cld
dec dword [eax - 0x277400ab]
Function at 0x437c3c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd38
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], ebx
test dl, dl
je 0x437c6c
add esp, 0xfffffff0
call sub.rtl210.bpl__System__ClassCreate_qqrpvzc
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x437dc3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call sub.vclx210.bpl__Vcl_Filectrl_TDirectoryListBox__bctr_qqrp25System_Classes_TComponent
mov ecx, ebx
mov dl, 1
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Controls_TImageList_]
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList__bctr_qqrp25System_Classes_TComponent
mov dword [ebx + 0x338], eax
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2b5]
push eax
push 0
push 0x437de8
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x437ce3
mov edx, dword [ebx + 0x338]
xchg edx, eax
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_SetHandle_qqrui
mov eax, dword [ebx + 0x338]
mov dl, 1
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_SetShareImages_qqro
mov eax, dword [ebx + 0x338]
mov dl, 3
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_SetDrawingStyle_qqr25Vcl_Imglist_TDrawingStyle
mov edx, 0x11
mov eax, ebx
call sub.vcl210.bpl__Vcl_Stdctrls_TCustomListBox_SetItemHeight_qqri
mov edx, 0x7b
mov eax, ebx
call sub.vcl210.bpl__Vcl_Controls_TControl_SetHeight_qqri
mov edx, 0xc8
mov eax, ebx
call sub.vcl210.bpl__Vcl_Controls_TControl_SetWidth_qqri
lea eax, [ebp - 0x2c0]
mov edx, dword [0x4842cc]
call sub.rtl210.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 0x2c0]
lea edx, [ebp - 0x2bc]
call sub.rtl210.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
cmp dword [ebp - 0x2bc], 0
jne 0x437da5
test byte [ebx + 0x1c], 0x10
jne 0x437da5
push 0x40
call sub.user32.dll_MessageBeep
push 0
push 0x437df8
lea edx, [ebp - 0x2c8]
mov eax, dword [ebx]
call sub.rtl210.bpl__System_TObject_ClassName_qqrv
push dword [ebp - 0x2c8]
push 0x437e20
push 0x437e58
push 0x437ebc
push 0x437ed0
push 0x437f04
push 0x437f14
lea eax, [ebp - 0x2c4]
mov edx, 8
call sub.rtl210.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x2c4]
movzx ecx, word [0x437f44]
mov dl, 2
call sub.vcl210.bpl__Vcl_Dialogs_MessageDlg_qqrx20System_UnicodeString26System_Uitypes_TMsgDlgType53System__Set_25System_Uitypes_TM
mov eax, 0x4842cc
call sub.rtl210.bpl__System__LStrClr_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437dca
lea eax, [ebp - 0x2c8]
mov edx, 4
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x437fa0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd24
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438137
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebx + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp eax, dword [ebx + 0x320]
je 0x43800b
mov dword [ebp - 8], 0x4212
mov eax, esi
add eax, eax
add eax, eax
add eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0xc], eax
jmp 0x43803a
mov dword [ebp - 8], 0x4210
lea edx, [ebp - 0x2d4]
mov eax, ebx
call sub.vclx210.bpl__Vcl_Filectrl_TDirectoryListBox_GetDirectory_qqrv
mov edx, dword [ebp - 0x2d4]
mov eax, ebx
call sym.TCFLib210.bpl__Edirbox_TEvDirectoryBox_DirLevel_qqrx20System_UnicodeString
inc eax
add eax, eax
add eax, eax
add eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0x10
lea ecx, [ebp - 0x2d8]
mov edx, esi
mov eax, dword [ebx + 0x2a0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2d8]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shell32.dll_SHGetFileInfoW
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x2b0]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x338]
sub edx, dword [eax + 0x40]
sar edx, 1
jns 0x438094
adc edx, 0
test esi, esi
jle 0x438099
inc edx
push edx
mov edx, dword [ebp - 0x2cc]
push edx
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebx + 0x2b0]
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_Draw_qqrp20Vcl_Graphics_TCanvasiiio
lea eax, [ebp - 0x2dc]
lea edx, [ebp - 0x2c4]
mov ecx, 0x104
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov edx, dword [ebp - 0x2dc]
lea ecx, [ebp - 4]
mov eax, ebx
call sub.vclx210.bpl__Vcl_Filectrl_TDirectoryListBox_DisplayCase_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x338]
add eax, dword [edx + 0x44]
add eax, 4
mov dword [ebp - 0x1c], eax
push 0x824
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0x2b0]
call sub.vcl210.bpl__Vcl_Graphics_TCanvas_GetHandle_qqrv
push eax
call sub.user32.dll_DrawTextW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43813e
lea eax, [ebp - 0x2dc]
mov edx, 3
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x4388e4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe38
push ebx
xor edx, edx
mov dword [ebp - 0x1c8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43899d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0xc8
lea eax, [ebp - 0x19c]
push eax
mov eax, dword [ebx + 0x44]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x438984
lea eax, [ebx + 0x40]
lea edx, [ebp - 0x19c]
mov ecx, 0xc8
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c8]
mov eax, 8
call sub.rtl210.bpl__System_Sysutils_IntToHex_qqrji
mov edx, dword [ebp - 0x1c8]
lea eax, [ebx + 0x5c]
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebx + 0x58]
lea edx, [ebp - 0x1c4]
mov ecx, 0x14
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4389a4
lea eax, [ebp - 0x1c8]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret

Function at 0x438cd0
Capabilities:
Get file system object information

Disassembly:
add byte [edx], al
add byte [edi], ah
add byte [eax], cl
nop
inc ebx
add byte [edi], al
inc esp
jae 0x438d24
jb 0x438d21
jns 0x438cb7
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [ecx], al
or ah, cl
mov word [ebx], es
add byte [eax], al
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
add al, byte [eax]
ror byte [ebx + eax*2 + 0x540b0700], 1
pop es
or edx, dword [ebp + eax*2 + 0x76]
inc esp
add byte [eax], al
or byte [eax], al
add dword [eax], ecx
int3
pop es
or edx, dword [ebp + eax*2 + 0x76]
inc esp
jb 0x438d41
jbe 0x438d3f
inc edx
outsd dx, dword [esi]
js 0x438ca2
mov al, byte [ebx]
dec eax
aad 0x4a
add byte [eax], al
pop es
inc ebp
inc esp
jb 0x438d62
inc edx
outsd dx, dword [esi]
js 0x438cf0
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
in al, 4
add dword [eax], eax
cmp al, 0xfd
invalid
std
invalid
cmpsd dword ds:[esi], dword es:[edi]
cld
dec dword [ecx + 0x35083]
add byte [eax + 1], ch
inc eax
add byte [eax], al
Function at 0x438d0c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd38
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], ebx
test dl, dl
je 0x438d3c
add esp, 0xfffffff0
call sub.rtl210.bpl__System__ClassCreate_qqrpvzc
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x438e82
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call sub.vclx210.bpl__Vcl_Filectrl_TDriveComboBox__bctr_qqrp25System_Classes_TComponent
mov ecx, ebx
mov dl, 1
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Controls_TImageList_]
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList__bctr_qqrp25System_Classes_TComponent
mov dword [ebx + 0x350], eax
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2b5]
push eax
push 0
push 0x438ea8
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x438db3
mov edx, dword [ebx + 0x350]
xchg edx, eax
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_SetHandle_qqrui
mov eax, dword [ebx + 0x350]
mov dl, 1
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_SetShareImages_qqro
mov eax, dword [ebx + 0x350]
mov dl, 3
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_SetDrawingStyle_qqr25Vcl_Imglist_TDrawingStyle
mov eax, ebx
call sym.TCFLib210.bpl__Edrvbox_TEvDriveBox_ResetItemHeight_qqrv
mov edx, 0xc8
mov eax, ebx
call sub.vcl210.bpl__Vcl_Controls_TControl_SetWidth_qqri
lea eax, [ebp - 0x2c0]
mov edx, dword [0x4842d4]
call sub.rtl210.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 0x2c0]
lea edx, [ebp - 0x2bc]
call sub.rtl210.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
cmp dword [ebp - 0x2bc], 0
jne 0x438e64
test byte [ebx + 0x1c], 0x10
jne 0x438e64
push 0x40
call sub.user32.dll_MessageBeep
push 0
push 0x438eb8
lea edx, [ebp - 0x2c8]
mov eax, dword [ebx]
call sub.rtl210.bpl__System_TObject_ClassName_qqrv
push dword [ebp - 0x2c8]
push 0x438ee0
push 0x438f18
push 0x438f7c
push 0x438f90
push 0x438fc4
push 0x438fd4
lea eax, [ebp - 0x2c4]
mov edx, 8
call sub.rtl210.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x2c4]
movzx ecx, word [0x439004]
mov dl, 2
call sub.vcl210.bpl__Vcl_Dialogs_MessageDlg_qqrx20System_UnicodeString26System_Uitypes_TMsgDlgType53System__Set_25System_Uitypes_TM
mov eax, 0x4842d4
call sub.rtl210.bpl__System__LStrClr_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438e89
lea eax, [ebp - 0x2c8]
mov edx, 4
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4390d0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43920c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x2d0]
mov edx, esi
mov eax, dword [ebx + 0x2cc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2d0]
movzx edx, word [eax]
lea eax, [ebp - 0x2cc]
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov edx, dword [ebp - 0x2cc]
lea eax, [ebp - 4]
mov ecx, 0x439228
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
push 0x4200
push 0x2b4
lea eax, [ebp - 0x2c8]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shell32.dll_SHGetFileInfoW
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x290]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
mov eax, dword [ebx + 0x350]
sub edx, dword [eax + 0x40]
sar edx, 1
jns 0x43918d
adc edx, 0
push edx
mov edx, dword [ebp - 0x2c4]
push edx
push 1
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov edx, dword [ebx + 0x290]
call sub.vcl210.bpl__Vcl_Imglist_TCustomImageList_Draw_qqrp20Vcl_Graphics_TCanvasiiio
add dword [ebp - 0x14], 0x18
lea eax, [ebp - 0x14]
push eax
push 0x824
mov eax, dword [ebx + 0x290]
call sub.vcl210.bpl__Vcl_Graphics_TCanvas_GetHandle_qqrv
push eax
lea eax, [ebp - 0x2d4]
lea edx, [ebp - 0x2bc]
mov ecx, 0x104
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov edx, dword [ebp - 0x2d4]
or ecx, 0xffffffff
pop eax
call fcn.00401d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439213
lea eax, [ebp - 0x2d4]
mov edx, 3
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret

Function at 0x43c8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x43c91e
inc esi
xor ebx, ebx
mov eax, dword [edi + 0x44]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
lea eax, [ebx + 1]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [edi + 0x44]
movzx eax, word [eax + edx*2]
mov edx, ebx
and edx, 0x800000ff
jns 0x43c90d
dec edx
or edx, 0xffffff00
inc edx
add al, dl
movzx edx, byte [ebp + ebx]
xor al, dl
mov byte [ebp + ebx], al
inc ebx
dec esi
jne 0x43c8e2
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43f0e4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x43f20b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [ebp - 8]
call sub.rtl210.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
test al, al
je 0x43f138
mov eax, esi
call sym.TCFLib210.bpl__Efimgr_TEvFileManager_CheckOverwrite_qqrv
test al, al
je 0x43f1f0
lea eax, [ebp - 0x80a]
mov edx, dword [ebp - 4]
call sub.rtl210.bpl__System_Sysutils_StrPCopy_qqrpbx20System_UnicodeString
lea eax, [ebp - 0x100c]
mov edx, dword [ebp - 8]
call sub.rtl210.bpl__System_Sysutils_StrPCopy_qqrpbx20System_UnicodeString
mov eax, dword [ebp - 8]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x43f18f
cmp word [esi + 0xa2], 0
je 0x43f18f
mov cl, 0xc
mov edx, esi
mov eax, dword [esi + 0xa4]
call dword [esi + 0xa0]
mov eax, dword [esi + 0x70]
add dword [esi + 0x60], eax
mov eax, dword [esi + 0x54]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x1010], eax
fild dword [ebp - 0x1010]
mov eax, dword [esi + 0x64]
inc eax
mov dword [ebp - 0x1014], eax
fild dword [ebp - 0x1014]
fdivrp st(1)
fmul dword [0x43f21c]
call sub.rtl210.bpl__System__ROUND_qqrv
mov dword [esi + 0x98], eax
cmp word [esi + 0xba], 0
je 0x43f1e4
mov edx, esi
mov eax, dword [esi + 0xbc]
call dword [esi + 0xb8]
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TApplication_ProcessMessages_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f212
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x44906c
Capabilities:
Get number of processors

Disassembly:
add ecx, dword [edx]
push esp
inc ebp
jbe 0x4490b6
popal
je 0x4490da
push ebx
je 0x4490ea
add dword [eax], eax
add byte [eax], al
add byte [esi], al
add byte [eax], al
add byte [eax - 0x70], ch
inc esp
add byte [esi], al
je 0x4490fc
inc esp
dec ebp
pop ecx
add eax, 0x44737464
dec ebp
add eax, 0x4d737464
pop ecx
add al, 0x64
je 0x44910f
pop ecx
push es
je sym.TCFLib210.bpl__Elibfnc_TEvLibFunctions_
pop ecx
dec ebp
inc esp
add eax, 0x4d737464
inc esp
add eax, 0x59737464
dec ebp
pop es
inc ebp
dec esp
imul esp, dword [edx + 0x46], 0x2636e
add byte [eax], al
adc al, 0x91
outsb dx, byte [esi]
arpl word [edx], ax
add byte [eax], al
add byte [ecx + edx*4], dl
inc esp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + edx*4 + 0x44], ch
add byte [eax], al
push esp
xchg ecx, eax
inc esp
add byte [eax], al
add byte [eax], al
add byte [edx - 0x6f], ah
inc esp
add byte [eax + eax], al
add byte [esi + eax*8 + 0x10f0004a], cl
add byte [eax], al
bound edx, qword [ecx + 0x440044]
add byte [eax], al
mov esi, es
dec edx
add al, dh
adc byte [eax], al
clc
inc eax
add al, bh
adc byte [eax], al
and byte [ecx], dl
inc eax
add byte [esp], dh
inc eax
add byte [eax], dh
adc dword [eax], eax
mov ah, 0x23
inc eax
add byte [eax + 0x11], al
inc eax
add byte [eax], ch
adc dword [eax], eax
enter 0x4010, 0
rcl byte [eax]
inc eax
add byte [ebx + 0x22cc0040], ch
inc eax
add ah, cl
and eax, dword [eax]
les esp, [edx]
inc eax
add ah, dl
and eax, dword [eax]
les esp, [ebx]
inc eax
add ah, bl
and eax, dword [eax]
and al, 0x24
inc eax
add byte [esp], ch
inc eax
add byte [esp], cl
inc eax
add ah, dh
and eax, dword [eax]
cmp al, 0x24
inc eax
add ah, ch
and eax, dword [eax]
in al, 0x23
inc eax
add byte [esp + 0x40], al
add ah, ch
xchg ecx, eax
inc esp
add byte [esp], bl
inc eax
add byte [eax], al
add byte [ecx], al
add byte [edx - 0x6f], dh
inc esp
add byte [eax + eax + 0xe], cl
add byte [eax], dl
add byte [edi], cl
push esp
inc ebp
jbe 0x4491b3
imul esp, dword [edx + 0x46], 0x74636e75
imul ebp, dword [edi + 0x6e], 0xec003673
xchg ecx, eax
inc esp
add byte [esi], al
inc ebx
jb 0x4491e1
popal
je 0x4491e4
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
test al, 0x91
inc esp
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
or byte [eax + 0x2004ac6], cl
add byte [esi], al
inc ecx
dec edi
ja 0x449210
jb 0x4491a7
add byte [edx], al
add byte [ecx + edx*4 + 0xf070044], ch
push esp
inc ebp
jbe 0x4491fe
bound eax, qword [esi + 0x75]
outsb dx, byte [esi]
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
jae 0x4491d2
xchg ecx, eax
inc esp
add byte [edx], al
add byte [eax], al
add byte [eax], al
in al, 4
add dword [eax], eax
add byte [eax], al
add byte [edx], bh
je 0x44924a
cmp dh, byte [ebx + 0x66]
cmp al, byte [eax]
cmp al, byte [eax]
add byte [eax], al
invalid
add byte [edi + edi*8 + 0x30], ah
sti
jmp [edx]
Function at 0x44bac4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44bb52
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x208
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
lea ecx, [ebp - 0x20c]
mov eax, dword [ebx]
mov edx, 1
call sym.TCFLib210.bpl__Elibfnc_StrRight_qqrx20System_UnicodeStringi
mov eax, dword [ebp - 0x20c]
mov edx, 0x44bb6c
call sub.rtl210.bpl__System__UStrEqual_qqrv
je 0x44bb39
mov eax, ebx
mov edx, 0x44bb7c
call sub.rtl210.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bb59
lea eax, [ebp - 0x20c]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret

Function at 0x44beb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44becd
test al, 0x10
jne 0x44bed1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x44bf74
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x44bf9a
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x20c
pop ebx
ret

Function at 0x44bfa4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x44bfce
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x20c
pop ebx
ret

Function at 0x44bfd8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
jbe 0x44c002
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call sub.rtl210.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x20c
pop ebx
ret