joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa4f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x590860]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4aa523
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4aa5e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x590860]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4aa61f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4aa6f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x590860]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4aa73f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4b5574
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5710
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4b56f5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4b56f5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
add eax, eax
add eax, eax
call sub.rtl120.bpl__System_AllocMem_qqrui
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
add eax, eax
add eax, eax
call sub.rtl120.bpl__System_AllocMem_qqrui
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b564e
inc ebx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Classes_TStrings_GetName_qqri
mov eax, dword [ebp - 0x24]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
call sub.rtl120.bpl__Sysutils_StrNew_qqrpxb
mov dword [esi], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Classes_TStrings_GetValueFromIndex_qqri
mov eax, dword [ebp - 0x28]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
call sub.rtl120.bpl__Sysutils_StrNew_qqrpxb
mov dword [edi], eax
add esi, 4
add edi, 4
inc dword [ebp - 0x10]
dec ebx
jne 0x4b5608
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0x4b5400
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
push 0xa
push esi
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0x102
jne 0x4b568f
mov eax, dword [0x59eaf0]
mov eax, dword [eax]
call fcn.0048087c
push 0xa
call sub.kernel32.dll_Sleep_1
jmp 0x4b5668
push esi
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 8], 0
je 0x4b56ac
cmp dword [ebp - 0x14], 0
je 0x4b56ac
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b56d9
inc ebx
mov eax, dword [esi]
call sub.rtl120.bpl__Sysutils_StrDispose_qqrpb
mov eax, dword [edi]
call sub.rtl120.bpl__Sysutils_StrDispose_qqrpb
add esi, 4
add edi, 4
dec ebx
jne 0x4b56c2
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__FreeMem_qqrpv
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System__FreeMem_qqrpv
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4b56f5
call sub.rtl120.bpl__Sysutils_StrDispose_qqrpb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5717
lea eax, [ebp - 0x28]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4ba638
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x4ba65e
shr edx, 1
xor edx, eax
jmp 0x4ba660
shr edx, 1
inc ecx
jne 0x4ba650
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x4ba649
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ba678
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4ba681
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Classes_TStream_GetPosition_qqrv
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4ba72e
cmp dword [ebp - 0xc], 0x2800
jl 0x4ba6dc
mov dword [ebp - 8], 0x2800
jmp 0x4ba6e2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x4ba726
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x5a0764]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x4ba6fd
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x4ba6c4
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4bc3a4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4bc43e
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x59421c]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x59421c]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x59421c]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x59421c]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4bc3c3
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4bc454
dec edx
je 0x4bc489
jmp 0x4bc4da
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x59421c]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x59421c]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4bc4da
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x59421c]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x59421c]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x59421c]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bc580
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4bc59f
add edx, 3
sar edx, 2
test edx, edx
jle 0x4bc6ad
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4bc5d4
je 0x4bc617
sub ecx, 0x2b
je 0x4bc60d
sub ecx, 4
je 0x4bc612
dec ecx
sub ecx, 0xa
jb 0x4bc5ff
jmp 0x4bc61a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4bc5e6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4bc5f1
jmp 0x4bc61a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4bc61a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4bc61a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4bc61a
mov byte [eax], 0x3e
jmp 0x4bc61a
mov byte [eax], 0x3f
jmp 0x4bc61a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4bc5b7
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4bc66b
cmp byte [esp + 7], 0xff
jne 0x4bc66b
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4bc6a2
cmp dl, 0xff
je 0x4bc6a2
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4bc5ae
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4bd3bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bd3dd
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bd3ca
pop edi
pop esi
pop ebx
ret

Function at 0x4c1dc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x4c1e14
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x59649c]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x59689c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x596c9c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x59709c]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x4c1dce
pop edi
pop esi
pop ebx
ret
Function at 0x4c2d00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4c2eff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
jne 0x4c2d76
lea eax, [ebp - 0x1c]
mov ecx, 0x4c2f20
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x1c]
call fcn.004c3698
jmp 0x4c2ed7
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TMemoryStream_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c2da8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__Classes_TMemoryStream_LoadFromFile_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2e06
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TMemoryStream_]
call sub.rtl120.bpl__System_TObject__bctr_qqrv
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4c2e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4aa490]
call fcn.004af614
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__Classes_TCustomMemoryStream_SaveToFile_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2ec3
mov eax, dword [ebp - 0x14]
call sub.rtl120.bpl__System_TObject_Free_qqrv
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System_TObject_Free_qqrv
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2f06
lea eax, [ebp - 0x2c]
mov edx, 5
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4c376c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c37e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x59f004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c37e7
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x4c37ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c385b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3862
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x4c6024
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c60c0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0x4c60d8
call fcn.004c5640
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4c6088
mov eax, ebx
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov ecx, dword [ebx]
lea eax, [ebp - 0x210]
mov edx, 0x4c6104
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x210]
xor edx, edx
call fcn.004c5640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c60c7
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x4c6128
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffec0
xor ebx, ebx
mov eax, esp
mov edx, 0x11c
call fcn.0040288c
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
lea eax, [esp + 0x11c]
mov edx, 0x24
call fcn.0040288c
push 0x4c6260
push 0x4c6288
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401c48
test eax, eax
je 0x4c6180
lea edx, [esp + 0x11c]
push edx
call eax
jmp 0x4c618d
lea eax, [esp + 0x11c]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [esp + 0x10], 2
jne 0x4c6253
mov eax, dword [esp + 4]
add eax, 0xfffffffd
sub eax, 2
jae 0x4c61a6
xor ebx, ebx
cmp dword [esp + 4], 5
jne 0x4c61bb
cmp dword [esp + 8], 0
jne 0x4c61bb
xor ebx, ebx
jmp 0x4c6253
cmp dword [esp + 4], 5
jne 0x4c61d0
cmp dword [esp + 8], 1
jne 0x4c61d0
xor ebx, ebx
jmp 0x4c6253
cmp dword [esp + 4], 5
jne 0x4c61fb
cmp dword [esp + 8], 2
jne 0x4c61fb
cmp byte [esp + 0x11a], 1
jne 0x4c61f7
cmp word [esp + 0x11c], 9
jne 0x4c61f7
xor ebx, ebx
jmp 0x4c6253
xor ebx, ebx
jmp 0x4c6253
cmp dword [esp + 4], 6
jne 0x4c620d
cmp dword [esp + 8], 0
jne 0x4c620d
mov bl, 1
jmp 0x4c6253
cmp dword [esp + 4], 6
jne 0x4c621f
cmp dword [esp + 8], 1
jne 0x4c621f
mov bl, 1
jmp 0x4c6253
cmp dword [esp + 4], 6
jne 0x4c6236
mov eax, dword [esp + 8]
add eax, 0xfffffffe
sub eax, 2
jae 0x4c6236
mov bl, 1
jmp 0x4c6253
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x4c624c
mov edx, dword [esp + 8]
sub edx, 4
jne 0x4c624c
mov bl, 1
jmp 0x4c6253
cmp eax, 0xa
jne 0x4c6253
mov bl, 1
mov eax, ebx
add esp, 0x140
pop ebx
ret