joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d134
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, edx
mov esi, eax
mov byte [ebp - 1], 0
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42d221
xor eax, eax
push ebp
push 0x42d21a
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__Sysutils_DateTimeToSystemTime_qqrx16System_TDateTimer11_SYSTEMTIME
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
je 0x42d203
sub bl, 1
jb 0x42d1b1
je 0x42d1cd
dec bl
je 0x42d1e9
jmp 0x42d203
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x42d203
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x42d203
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d221
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42d2c4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov byte [ebp - 2], 0
mov eax, esi
call sym.P_Interface.bpl__Jclfileutils_IsDirectory_qqrx17System_AnsiString
test al, al
je 0x42d3d5
test bl, bl
je 0x42d2f7
call fcn.0042d268
test al, al
je 0x42d3d5
push 0
push 0x2000000
push 3
push 0
push 1
push 0x40000000
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42d3d5
xor eax, eax
push ebp
push 0x42d3ce
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__Sysutils_DateTimeToSystemTime_qqrx16System_TDateTimer11_SYSTEMTIME
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov al, byte [ebp - 1]
sub al, 1
jb 0x42d365
je 0x42d381
dec al
je 0x42d39d
jmp 0x42d3b7
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x42d3b7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x42d3b7
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d3d5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov al, byte [ebp - 2]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42dbb0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x42dc2d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x42dc17
lea eax, [ebp - 8]
mov edx, edi
call sub.rtl70.bpl__System__LStrSetLength_qqrv
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push edi
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dc34
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x42e2d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x42e386
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x42e370
lea eax, [ebp - 0x10]
mov edx, edi
call sub.rtl70.bpl__System__LStrSetLength_qqrv
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42e370
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42e398
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42e370
cmp dword [ebp - 8], 0x34
jne 0x42e370
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e38d
lea eax, [ebp - 0x10]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x42e444
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x42e459
add esp, 0xfffffff0
call sub.rtl70.bpl__System__ClassCreate_qqrp17System_TMetaClasso
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call sym.P_Interface.bpl__Jclfileutils_FileExists_qqrx17System_AnsiString
test al, al
jne 0x42e48f
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [sym.P_Interface.bpl__Jclresources__RsFileUtilsFileDoesNotExist]
mov dl, 1
mov eax, dword [sym.P_Interface.bpl__Jclfileutils_EJclFileVersionInfoError_]
call sub.rtl70.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sub.rtl70.bpl__System__RaiseExcept_qqrv
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x42e4c2
mov ecx, dword [sym.P_Interface.bpl__Jclresources__RsFileUtilsNoVersionInfo]
mov dl, 1
mov eax, dword [sym.P_Interface.bpl__Jclfileutils_EJclFileVersionInfoError_]
call sub.rtl70.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRec
call sub.rtl70.bpl__System__RaiseExcept_qqrv
lea eax, [ebx + 4]
mov edx, esi
call sub.rtl70.bpl__System__LStrSetLength_qqrv
mov eax, dword [ebx + 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.version.dll_GetFileVersionInfoA
call sub.rtl70.bpl__Sysutils_Win32Check_qqri
mov eax, ebx
call sym.P_Interface.bpl__Jclfileutils_TJclFileVersionInfo_ExtractData_qqrv
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x42e50a
call sub.rtl70.bpl__System__AfterConstruction_qqrp14System_TObject
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431b54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x50]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x431b92
inc edi
xor ebp, ebp
mov edx, ebp
mov eax, dword [esi + 0x50]
call sub.rtl70.bpl__Classes_TList_Get_qqri
mov edx, ebx
xor dl, 1
mov byte [eax + 0x1fb], dl
mov edx, ebp
mov eax, dword [esi + 0x50]
call sub.rtl70.bpl__Classes_TList_Get_qqri
call sub.rtl70.bpl__Classes_TThread_Terminate_qqrv
inc ebp
dec edi
jne 0x431b6a
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433724
Capabilities:
Parse pe header

Disassembly:
xor ecx, ecx
mov eax, edx
cmp word [eax], 0x5a4d
jne 0x433744
add edx, dword [eax + 0x3c]
mov eax, edx
cmp dword [eax], 0x4550
jne 0x433744
cmp word [eax + 0x5c], 3
sete cl
mov eax, ecx
ret
Function at 0x433ca0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov word [ebp - 6], cx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x433db1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
test eax, eax
jle 0x433d90
cmp word [ebp - 6], 0xffff
je 0x433ce2
cmp word [ebp + 0xc], 0xffff
jne 0x433cf2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call sym.P_Interface.bpl__Jclconsole_TJclScreenCursor_GetPosition_qqrv
mov dword [ebp - 0x10], eax
jmp 0x433d02
mov ax, word [ebp - 6]
mov word [ebp - 0x10], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0xe], ax
cmp dword [ebp + 8], 0
je 0x433d66
mov eax, esi
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x433c7c]
call sub.rtl70.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, esi
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x433d4a
inc ebx
xor edi, edi
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebp - 0x14]
mov word [edx + edi*2], ax
inc edi
dec ebx
jne 0x433d37
mov ax, word [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov cx, word [ebp - 6]
mov edx, esi
mov eax, dword [ebp - 4]
call sym.P_Interface.bpl__Jclconsole_TJclScreenBuffer_Write_qqrx17System_AnsiStringxsxspus
mov dword [ebp - 0xc], eax
jmp 0x433d95
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
mov eax, esi
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
call sub.rtl70.bpl__Sysutils_Win32Check_qqri
jmp 0x433d95
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433db8
lea eax, [ebp - 0x14]
mov edx, dword [0x433c7c]
call sub.rtl70.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x433dc4
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
cmp cx, 0xffff
je 0x433ddf
cmp ax, 0xffff
jne 0x433dec
mov eax, dword [ebx + 0xc]
call sym.P_Interface.bpl__Jclconsole_TJclScreenCursor_GetPosition_qqrv
mov dword [ebp - 8], eax
jmp 0x433df4
mov word [ebp - 8], cx
mov word [ebp - 6], ax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x433e20
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov eax, esi
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
call sub.rtl70.bpl__Sysutils_Win32Check_qqri
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov eax, esi
call sub.rtl70.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
mov eax, esi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
call sub.rtl70.bpl__Sysutils_Win32Check_qqri
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x433fc0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov word [ebp - 6], dx
mov ax, word [ebp - 2]
mov word [ebp - 4], ax
mov eax, esi
mov edx, ebx
call sub.rtl70.bpl__System__LStrSetLength_qqrv
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 6]
push ebx
mov eax, dword [esi]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_ReadConsoleOutputCharacterA
call sub.rtl70.bpl__Sysutils_Win32Check_qqri
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
call sub.rtl70.bpl__Sysutils_StrLen_qqrpxc
xor edx, edx
push edx
push eax
call sub.rtl70.bpl__Math_Min_qqrxjxj
mov edx, eax
mov eax, esi
call sub.rtl70.bpl__System__LStrSetLength_qqrv
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435f78
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
cmp dword [ebp - 8], 0
jbe 0x436036
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x436036
xor eax, eax
push ebp
push 0x43602f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [ebp - 8]
call sub.rtl70.bpl__System_Move_qqrpxvpvi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x10
je 0x435ff4
sub eax, 0x10
je 0x435ff4
sub eax, 0x20
je 0x435ff4
sub eax, 0x40
jne 0x436007
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436036
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438330
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x438442
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x438366
mov eax, dword [ebp - 4]
test eax, eax
jne 0x438372
push 0x57
call sub.kernel32.dll_SetLastError
jmp 0x43842c
test ebx, ebx
jne 0x43837b
mov ebx, 0x1000
push 0x6981ec
call sub.kernel32.dll_InterlockedIncrement
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, dword [0x6981ec]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x24]
mov ecx, 2
mov eax, 0x438460
call sub.rtl70.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
push edi
push 0x1d4c0
push ebx
push ebx
push 1
push 0
push 0x40000001
mov eax, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateNamedPipeA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43842c
push 0
push 0x80
push 3
push edi
push 0
push 0x40000000
mov eax, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x43841e
call sub.kernel32.dll_GetLastError
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_SetLastError
jmp 0x43842c
mov dword [esi], ebx
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438449
lea eax, [ebp - 0xc]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x448ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x448d31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.rtl70.bpl__Sysutils_Win32Platform]
cmp dword [eax], 2
jne 0x448ce0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x448d13
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl70.bpl__System__WStrFromPWChar_qqrr17System_WideStringpb
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrFromWStr_qqrr17System_AnsiStringx17System_WideString
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448d38
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x448d44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x448dd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.rtl70.bpl__Sysutils_Win32Platform]
cmp dword [eax], 2
jne 0x448d87
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
jmp 0x448dba
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl70.bpl__System__WStrFromPWChar_qqrr17System_WideStringpb
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrFromWStr_qqrr17System_AnsiStringx17System_WideString
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448ddf
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x4498bc
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
xor eax, eax
mov dword [esp], eax
push 2
lea eax, [esp + 4]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, esi
call fcn.004489f4
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00448c48
test eax, eax
jne 0x449925
mov eax, ebp
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
jne 0x44992e
mov ecx, ebp
mov edx, edi
mov eax, esi
call fcn.004487ac
jmp 0x44992e
mov edx, edi
mov eax, esi
call fcn.00448730
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x449938
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x449a8c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0xf003f
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, esi
call fcn.004489f4
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00448c48
test eax, eax
sete bl
test bl, bl
je 0x449a67
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp dword [ebp - 0x10], 0
je 0x449a3b
mov edi, dword [ebp - 0x10]
dec edi
cmp edi, 0
jb 0x449a3b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x18]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
call sub.rtl70.bpl__Sysutils_StrLen_qqrpxc
mov edx, eax
lea eax, [ebp - 0x18]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
push dword [ebp - 4]
push 0x449aa4
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, 3
call sub.rtl70.bpl__System__LStrCatN_qqrv
mov edx, dword [ebp - 0x1c]
mov eax, esi
call sym.P_Interface.bpl__Jclregistry_RegDeleteKeyTree_qqrxuix17System_AnsiString
mov ebx, eax
test bl, bl
je 0x449a3b
dec edi
cmp edi, 0xffffffff
jne 0x4499c5
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
je 0x449a71
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, esi
call fcn.004489f4
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
jmp 0x449a71
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00448730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449a93
lea eax, [ebp - 0x1c]
mov edx, 2
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x449aa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.004489f4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448c48
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x449b1a
push esi
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x449b28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edx, eax
mov eax, ebx
call fcn.004489f4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00448c48
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x449b9a
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4