joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58af00
Capabilities:
Create directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0
push 0
push 0x8005
push 0
call dword [0x5dd330]
test eax, eax
js 0x58afa0
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x58af22
mov eax, dword [0x65d18c]
mov dword [ecx], eax
mov eax, dword [0x65d190]
mov dword [ecx + 4], eax
mov eax, dword [0x65d194]
mov dword [ecx + 8], eax
mov eax, dword [0x65d198]
mov dword [ecx + 0xc], eax
mov eax, dword [0x65d19c]
push esi
mov dword [ecx + 0x10], eax
call fcn.005b6237
add esp, 4
lea ecx, [esi - 1]
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x58af60
mov eax, dword [0x65d1a0]
mov dword [ecx], eax
mov eax, dword [0x65d1a4]
mov dword [ecx + 4], eax
mov eax, dword [0x65d1a8]
mov dword [ecx + 8], eax
mov ax, word [0x65d1ac]
mov word [ecx + 0xc], ax
mov al, byte [0x65d1ae]
push esi
mov byte [ecx + 0xe], al
call fcn.005b6237
add esp, 4
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x58b6c0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x58b6d5
pop edi
mov dword [esp + 0x10], eax
jmp fcn.005b5886
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0x114]
push esi
mov esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jb 0x58b6f3
mov esi, ecx
sub esi, edx
test esi, esi
jne 0x58b6fc
pop esi
xor eax, eax
pop edi
ret
mov ecx, dword [edi + 4]
push esi
add ecx, edx
push ecx
push dword [esp + 0x14]
call fcn.005b3090
add dword [edi + 8], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [esp + 0x10]
pop esi
pop edi
ret
Function at 0x58bc40
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4048
call fcn.005b4170
push ebx
push esi
mov esi, dword [esp + 0x4054]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.005b75bb
mov ebx, dword [esp + 0x4060]
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.005b75bb
mov eax, dword [esp + 0x50]
add esp, 0x10
cmp eax, dword [esp + 0x1c]
je 0x58bc88
pop esi
xor eax, eax
pop ebx
add esp, 0x4048
ret
push edi
push 0x65cc5c
push esi
call fcn.005afc0b
push 0x65cc5c
push ebx
mov edi, eax
call fcn.005afc0b
add esp, 0x10
mov ebx, eax
test edi, edi
je 0x58bdb9
test ebx, ebx
je 0x58bda4
push ebp
push edi
mov ebp, 1
call fcn.005b5675
add esp, 4
test eax, eax
jne 0x58bd88
lea ecx, [ecx]
push edi
push 0x2000
lea eax, [esp + 0x60]
push 1
push eax
call fcn.005b5886
push ebx
push 0x2000
mov esi, eax
lea eax, [esp + 0x2070]
push 1
push eax
call fcn.005b5886
add esp, 0x20
cmp esi, eax
je 0x58bd19
push 0
push 0x6af
push 0x65cd74
push 0x65d1b0
call fcn.0058a2c0
add esp, 0x10
lea ecx, [esp + 0x58]
lea edx, [esp + 0x2058]
sub esi, 4
jb 0x58bd41
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x58bd46
add ecx, 4
add edx, 4
sub esi, 4
jae 0x58bd30
cmp esi, 0xfffffffc
je 0x58bd73
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x58bd86
cmp esi, 0xfffffffd
je 0x58bd73
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x58bd86
cmp esi, 0xfffffffe
je 0x58bd73
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x58bd86
cmp esi, 0xffffffff
je 0x58bd73
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x58bd86
push edi
call fcn.005b5675
add esp, 4
test eax, eax
je 0x58bcd0
jmp 0x58bd88
xor ebp, ebp
push edi
call fcn.005af5e5
push ebx
call fcn.005af5e5
add esp, 8
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4048
ret
push edi
call fcn.005af5e5
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x4048
ret
test ebx, ebx
je 0x58bdc6
push ebx
call fcn.005af5e5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4048
ret
Function at 0x58f260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5dbcd8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
jb 0x58f33d
push ebx
push ebp
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea edi, [ecx + 1]
mov dword [esp + 0x24], 0
mov eax, 0x80000000
test edi, edi
js 0x58f2bc
shr eax, 1
test edi, eax
je 0x58f2b6
add eax, eax
lea ecx, [esp + 0x10]
push eax
call fcn.00593cc0
mov edx, dword [esi + 4]
mov ebx, dword [esi]
mov ebp, dword [esp + 0x10]
test edx, edx
je 0x58f2ef
mov ecx, ebp
sub ebx, ebp
lea esp, [esp]
test ecx, ecx
je 0x58f2e9
mov eax, dword [ebx + ecx]
mov dword [ecx], eax
add ecx, 4
dec edx
jne 0x58f2e0
mov eax, dword [esi + 4]
lea ecx, [eax*4]
add ecx, ebp
je 0x58f305
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esp + 0x18]
push 1
mov dword [esi], ebp
push 1
mov dword [esi + 4], edi
push ecx
mov dword [esi + 8], eax
mov dword [esp + 0x30], 0xffffffff
call fcn.0058c050
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov eax, dword [esi]
lea edx, [eax + ecx*4]
lea eax, [ecx + 1]
mov dword [esi + 4], eax
test edx, edx
je 0x58f354
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [edx], eax
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5936d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x134
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x5c], 0
jne 0x593700
push 0
push 0xeb
push 0x65f12c
push 0x65f1e0
call fcn.0058a2c0
add esp, 0x10
push 0x65f1f0
call fcn.005b6237
push dword [esi + 0x58]
lea edi, [esi + 4]
push dword [esi + 0x54]
lea eax, [esp + 0x44]
push edi
push 0x65f188
push eax
call fcn.0057dee0
mov ebx, dword [esi + 0x5c]
add esp, 0x18
mov eax, dword [ebx + 0x3c]
cmp dword [eax], 0
jne 0x593747
push 0
push 0x4d
push 0x65d714
push 0x65d73c
call fcn.0058a2c0
add esp, 0x10
mov ecx, dword [ebx + 0x3c]
call fcn.0058d110
lea edx, [esp + 0x34]
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
push 0
push 0
push dword [esp + 0x3c]
lea eax, [esp + 0x44]
push 2
push eax
call fcn.005cc000
mov eax, dword [esp + 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [esi + 0x58]
lea eax, [esp + 0x3c]
push dword [esi + 0x54]
push edi
push 0x65f1b0
push eax
call fcn.0057dee0
lea eax, [esp + 0x4c]
push 0x674648
push eax
call fcn.0058b670
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jne 0x5937c7
push eax
push 0xfc
push 0x65f12c
push 0x65f1fc
call fcn.0058a2c0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movss xmm0, dword [esi + 0x60]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x65f1cc
push ebx
call fcn.005af467
add esp, 0x10
mov edi, 0x5f
add esi, 0x6c
lea ecx, [ecx]
movss xmm0, dword [esi + 4]
sub esp, 0x20
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
movss xmm0, dword [esi]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esi - 4]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esi - 8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x65f200
push ebx
call fcn.005af467
add esp, 0x28
lea esi, [esi + 0x10]
dec edi
jne 0x5937f0
push ebx
call fcn.005af5e5
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5993f0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dbadb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x14]
push 0x730f24
call fcn.0058c0f0
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x128], 0
push eax
push esi
mov ecx, edi
call fcn.00599870
push esi
push dword [esp + 0x134]
lea eax, [esp + 0x20]
push 0x67684c
push eax
call fcn.0057dee0
add esp, 0x10
lea eax, [esp + 0x18]
push eax
call dword [0x5dd478]
lea eax, [esp + 0x18]
push 0x6749dc
push eax
call fcn.005afc0b
mov edi, eax
add esp, 8
test edi, edi
jne 0x59949e
push dword [esp + 0xc]
call fcn.0058bef0
lea eax, [esp + 0x1c]
push eax
push 0x6620d0
call fcn.00589df0
add esp, 0xc
xor bl, bl
jmp 0x5994c0
mov esi, dword [esp + 0xc]
push edi
push dword [esp + 0x14]
push 1
push esi
call fcn.005b0e23
push edi
call fcn.005af5e5
push esi
call fcn.0058bef0
add esp, 0x18
mov bl, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 0xffffffff
call fcn.0057e9f0
mov ecx, dword [esp + 0x11c]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x599f90
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dba36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 0xc]
push 0x730f24
call fcn.0058c0f0
lea eax, [esp + 0x14]
mov dword [esp + 0x120], 0
push 0x730f24
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
call fcn.0058c0f0
cmp byte [ebp], 0
mov byte [esp + 0x120], 1
jne 0x59a005
push 0
push 0x133
push 0x661bfc
push 0x661dac
call fcn.0058a2c0
add esp, 0x10
push 0
push ebp
lea eax, [esp + 0x18]
push 0x675050
push eax
call fcn.00582b70
add esp, 0x10
mov byte [esp + 0x120], 0
lea ecx, [esp + 8]
call fcn.0057e9f0
lea eax, [esp + 0x14]
push 0x65cc5c
push eax
call fcn.005afc0b
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x59a059
lea eax, [esp + 0x14]
push eax
push 0x661e64
call fcn.00589df0
add esp, 8
xor bl, bl
jmp 0x59a0b6
push esi
push edi
push 2
push 0
push ebx
call fcn.005b51e0
push ebx
call fcn.005b5609
push 0
push 0
push ebx
mov edi, eax
call fcn.005b51e0
lea ecx, [edi + 1]
push 1
push ecx
call fcn.0058bf50
push ebx
push 1
mov esi, eax
push edi
push esi
call fcn.005b5886
push ebx
call fcn.005af5e5
add esp, 0x38
lea eax, [esp + 0x1c]
lea ecx, [ebp + 0x104]
push eax
push edi
push esi
call fcn.00599120
push esi
mov bl, al
call fcn.0058bef0
add esp, 4
pop edi
pop esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x120], 0xffffffff
call fcn.0057e9f0
mov ecx, dword [esp + 0x118]
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x59b190
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dbaf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov ebx, ecx
lea ecx, [esp + 0x24]
push 0x730f24
call fcn.0058c0f0
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
mov dword [esp + 0x4c], 0
test eax, eax
jne 0x59b1e9
push eax
push 0xf8
push 0x661bfc
push 0x675078
call fcn.0058a2c0
add esp, 0x10
mov ebp, dword [esp + 0x54]
test ebp, ebp
jne 0x59b209
push ebp
push 0xf9
push 0x661bfc
push 0x65f1fc
call fcn.0058a2c0
add esp, 0x10
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
imul edi, eax, 0x128
push 1
mov dword [esp + 0x2c], 0x31737573
mov dword [esp + 0x30], 1
mov dword [esp + 0x24], edi
lea eax, [edi + 1]
push eax
call fcn.0058bf50
mov ecx, dword [ebx + 8]
add esp, 8
sub ecx, dword [ebx + 4]
mov esi, eax
sar ecx, 2
xor edx, edx
mov dword [esp + 0x1c], esi
test ecx, ecx
je 0x59b280
mov ebp, esi
mov esi, dword [ebx + 4]
mov edi, ebp
mov ecx, 0x4a
add ebp, 0x128
mov esi, dword [esi + edx*4]
inc edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
cmp edx, eax
jb 0x59b251
mov ebp, dword [esp + 0x54]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x13]
call fcn.0058aa80
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
lea ecx, [esp + 0x23]
call fcn.0058aa90
test eax, eax
jne 0x59b2af
push 0x661d8c
call fcn.00589a10
add esp, 4
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
mov dword [esp + 0x34], eax
mov eax, dword [ebx]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
push edi
push esi
mov dword [esp + 0x48], eax
call fcn.0058ad90
push ebp
push 8
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
push 1
push eax
call fcn.005b0e23
push ebp
push 0x14
lea eax, [esp + 0x50]
push 1
push eax
call fcn.005b0e23
push ebp
push 1
push dword [esp + 0x44]
push dword [esp + 0x4c]
call fcn.005b0e23
push esi
call fcn.0058bef0
push dword [esp + 0x54]
call fcn.0058bef0
add esp, 0x40
mov dword [esp + 0x4c], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0057e9f0
mov ecx, dword [esp + 0x44]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x5a8cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x5a8ce4
mov al, byte [ecx]
test al, al
je 0x5a8ce4
mov edx, 0x811c9dc5
movsx eax, al
lea ecx, [ecx + 1]
or eax, 0x20
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x5a8cc3
xor edx, 0x2a
imul eax, edx, 0x1000193
ret
xor eax, eax
ret
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xee7324
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee732e
pushal
call 0xee7334
pop ebp
sub ebp, 0x10
sub ebp, 0xae7324
jmp 0xee734a
mov eax, 0xae7324
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x5a91cd36
xor byte [eax], dl
inc eax
dec ecx
jne 0xee7361
jmp 0xee7374
mov ebp, 0xabfbdfb
mov bh, 0xf7
into
xor eax, 0x36308efb
mov word ss:[esi], ds
rcl esp, 0x35
invalid
Function at 0x1d768
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1d926
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0001e5b8
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call sub.Vcl50.bpl__Sysutils_ByteType_qqrx17System_AnsiStringi
cmp al, 2
jne 0x1d7c6
dec esi
mov eax, ebx
call fcn.0001e5cc
test al, al
je 0x1d8c1
test esi, esi
jge 0x1d7db
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x208]
mov eax, ebx
call fcn.0001e5b8
mov eax, dword [ebp - 0x208]
call fcn.000111c8
cmp edi, eax
jge 0x1d822
lea edx, [ebp - 0x20c]
mov eax, ebx
call fcn.0001e5b8
mov eax, dword [ebp - 0x20c]
mov al, byte [eax + edi - 1]
mov edx, dword [sym.imp.Vcl50.bpl__Sysutils_LeadBytes]
and eax, 0xff
bt dword [edx], eax
jae 0x1d822
inc edi
mov eax, dword [ebx + 0x2a0]
cmp esi, eax
jl 0x1d830
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.0001da40
cmp edi, esi
je 0x1d8b9
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
push esi
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x200]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop esi
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
mov byte [ebp - 0x1ef], 0
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call sub.Vcl50.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call sub.Vcl50.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x294], esi
jmp 0x1d908
test esi, esi
jge 0x1d8c7
xor esi, esi
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.0001e5b8
mov eax, dword [ebp - 0x210]
call fcn.000111c8
cmp esi, eax
jl 0x1d8fd
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.0001e5b8
mov eax, dword [ebp - 0x214]
call fcn.000111c8
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.0001da40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d92d
lea eax, [ebp - 0x214]
mov edx, 5
call fcn.00011188
ret
Function at 0x7f5c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe94
mov edi, eax
mov eax, edi
call fcn.00078670
mov edx, eax
mov eax, edi
call fcn.0007ed28
mov ebp, eax
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov byte [esp + 0xd], 0
mov eax, edi
call fcn.0007ef40
xor al, 1
mov byte [esp + 0xc], al
lea edx, [esp + 0x30]
mov eax, edi
call fcn.00045984
push edi
lea esi, [esp + 0x34]
lea edi, [esp + 0x14]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 0xe0]
push eax
call sub.user32.dll_IsRectEmpty
test eax, eax
jne 0x7f631
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov al, byte [esp + 0xc]
xor al, 1
test al, al
je 0x7f647
neg dword [esp + 4]
push edi
lea esi, [esp + 0x14]
lea edi, [esp + 0x24]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
test al, al
je 0x7f68b
push 0
lea eax, [esp + 0x160]
push eax
mov ecx, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x28]
call sub.Vcl50.bpl__Classes_Rect_qqriiii
push edi
lea esi, [esp + 0x160]
lea edi, [esp + 0x24]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
jmp 0x7f693
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
xor ebx, ebx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
test eax, eax
jns 0x7f6a6
add eax, 0xff
sar eax, 8
mov dword [esp], eax
cmp dword [esp], 0
jne 0x7f79d
mov dword [esp], 1
jmp 0x7f79d
cmp ebx, 0x14
jg 0x7f6d1
mov esi, dword [esp + 4]
imul esi, dword [esp]
jmp 0x7f6dc
inc dword [esp]
mov esi, dword [esp + 4]
imul esi, dword [esp]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, ecx
add eax, ebx
cmp ebp, eax
jl 0x7f703
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov eax, ebp
sub eax, ebx
sar eax, 1
jns 0x7f6ff
adc eax, 0
cmp ecx, eax
jle 0x7f70c
mov esi, ebp
sub esi, ebx
imul esi, dword [esp + 4]
push 2
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0
mov eax, edi
call sub.Vcl50.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ScrollWindowEx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add ebx, eax
cmp byte [esp + 0xc], 0
jne 0x7f755
mov dword [esp + 0x2c], ebx
mov eax, dword [edi + 0x1f0]
mov eax, dword [eax + 0x14]
mov edx, 0x80000010
call sub.Vcl50.bpl__Graphics_TBrush_SetColor_qqr15Graphics_TColor
jmp 0x7f770
mov eax, dword [esp + 0x2c]
sub eax, ebx
mov dword [esp + 0x24], eax
mov edx, dword [edi + 0x60]
mov eax, dword [edi + 0x1f0]
mov eax, dword [eax + 0x14]
call sub.Vcl50.bpl__Graphics_TBrush_SetColor_qqr15Graphics_TColor
lea edx, [esp + 0x20]
mov eax, dword [edi + 0x1f0]
call sub.Vcl50.bpl__Graphics_TCanvas_FillRect_qqrrx13Windows_TRect
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0x190
jg 0x7f797
cmp ebp, ebx
jle 0x7f797
xor eax, eax
jmp 0x7f799
mov al, 1
mov byte [esp + 0xd], al
cmp byte [esp + 0xd], 0
je 0x7f6c2
add esp, 0x16c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x405590
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40b048
call sym._EnterCriticalSection_4
mov ebx, dword [0x40b040]
sub esp, 4
test ebx, ebx
je 0x4055db
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4055d4
test esi, esi
je 0x4055d4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4055b0
mov dword [esp], 0x40b048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4057c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x405810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4058e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40584e
cmp eax, 4
jne 0x405870
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40585e
cmp edx, 4
je 0x40585e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004057c0