joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5add08
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ade8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x110]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x5adea4
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call sub.rtl260.bpl__System_Sysutils_Now_qqrv
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc]
mov eax, 0x5adf78
call sub.rtl260.bpl__System_Sysutils_FormatDateTime_qqrx20System_UnicodeString16System_TDateTime
mov eax, dword [ebp - 0xc]
push eax
mov edx, 0x5adf9c
mov eax, dword [ebp - 8]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x48]
call sub.rtl260.bpl__System_Sysutils_Now_qqrv
fadd dword [0x5adfa8]
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0x10]
mov eax, 0x5adf78
call sub.rtl260.bpl__System_Sysutils_FormatDateTime_qqrx20System_UnicodeString16System_TDateTime
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x5adfb8
mov eax, dword [ebp - 8]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x5adfd0
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x74]
test eax, eax
jle 0x5ade56
mov eax, dword [0x731020]
mov eax, dword [eax]
mov eax, dword [eax + 0xab4]
mov dl, 1
call sub.vcl260.bpl__Vcl_Controls_TControl_SetVisible_qqro
cmp dword [ebp - 4], 1
jne 0x5ade42
mov eax, dword [0x731020]
mov eax, dword [eax]
cmp byte [eax + 0x215], 0
jne 0x5ade42
mov eax, dword [0x730a08]
cmp dword [eax], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x5ade42
mov eax, dword [0x731020]
mov eax, dword [eax]
call fcn.005d4c24
mov eax, dword [0x731020]
mov eax, dword [eax]
call fcn.005d4e3c
mov eax, dword [0x731020]
mov eax, dword [eax]
call sub.vcl260.bpl__Vcl_Forms_TCustomForm_Show_qqrv
mov eax, dword [0x730a90]
mov eax, dword [eax]
call sub.vcl260.bpl__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SetForegroundWindow
jmp 0x5ade6a
mov eax, dword [0x731020]
mov eax, dword [eax]
mov eax, dword [eax + 0xab4]
xor edx, edx
call sub.vcl260.bpl__Vcl_Controls_TControl_SetVisible_qqro
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ade94
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x5faa4c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x444]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x5fab24
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
push dword [eax + 0x494]
push dword [eax + 0x490]
mov edx, 0x5faba4
mov eax, dword [ebp - 0x10]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x78]
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x194]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x194]
dec eax
jle 0x5faae7
mov edx, 0x5fabb8
mov al, 4
call fcn.006efbe4
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5fab0e
cmp dword [ebp - 0xc], 0
jne 0x5fab00
mov edx, 0x5fac0c
mov al, 4
call fcn.006efbe4
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5fab0e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x444]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x6399dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x639aab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call sub.rtl260.bpl__System__FillChar_qqrpvic
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov ax, word [ebp - 0xc]
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
lea eax, [ebp - 8]
call sub.rtl260.bpl__System_UniqueString_qqrr20System_UnicodeString
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x639a76
mov dword [ebp - 0x10], 0xffffffff
jmp 0x639a95
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639ab2
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x6528a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6529d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x6529ec
call sub.rtl260.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
cmp al, 1
jne 0x6529ad
mov dl, 1
mov eax, 0x652a34
call sub.rtl260.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
cmp al, 1
jne 0x6529ad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov eax, dword [eax + 0x2d8]
mov edx, 0x652a34
mov ecx, dword [eax]
call dword [ecx + 0x6c]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
call sub.vcl260.bpl__Vcl_Controls_TControl_GetText_qqrv
mov edx, dword [ebp - 8]
mov ecx, 1
mov eax, 0x652a78
call sub.rtl260.bpl__System_Pos_qqrx20System_UnicodeStringt1i
test eax, eax
jle 0x652993
mov al, byte [0x652a8c]
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
call sub.vcl260.bpl__Vcl_Controls_TControl_GetText_qqrv
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x730d84]
mov ecx, dword [ecx]
mov edx, 0x652a78
call sub.rtl260.bpl__System_Sysutils_StringReplace_qqrx20System_UnicodeStringt1t162System__Set_35System_Sysutils_System_Sysutils__8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov eax, dword [eax + 0x2d8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov eax, dword [eax + 0x2d8]
mov edx, 0x652a34
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, 0x652a9c
call fcn.006fc318
mov eax, 0x652a9c
call fcn.006fc190
test eax, eax
jne 0x6529ad
push 5
push 0x652ab8
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6529da
lea eax, [ebp - 0x10]
call sub.rtl260.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl260.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x657348
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x65747f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x657498
mov eax, dword [ebp - 4]
call fcn.00661c58
mov edx, dword [ebp - 8]
mov eax, 0x6574d8
call sub.rtl260.bpl__System__UStrEqual_qqrv
je 0x6573b1
mov eax, 0x657498
call sub.rtl260.bpl__System_Sysutils_DeleteFile_qqrx20System_UnicodeString
push 0
push 0
lea eax, [ebp - 0xc]
mov edx, 0x6574f4
call sub.rtl260.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0xc]
mov ecx, 0x657498
xor eax, eax
call fcn.00404fbc
test eax, eax
lea ecx, [ebp - 0x10]
mov edx, 0x657574
mov eax, dword [ebp - 4]
call fcn.00661c58
mov edx, dword [ebp - 0x10]
mov eax, 0x6575c0
call sub.rtl260.bpl__System__UStrEqual_qqrv
je 0x657448
mov eax, 0x6575dc
call sub.rtl260.bpl__System_Sysutils_DeleteFile_qqrx20System_UnicodeString
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, 0x65761c
call sub.rtl260.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, 0x65765c
call sub.rtl260.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x18]
xor eax, eax
pop ecx
call fcn.00404fbc
test eax, eax
mov dl, 1
mov eax, 0x657574
call sub.rtl260.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
test al, al
jne 0x657448
push 0
push 0
lea eax, [ebp - 0x1c]
mov edx, 0x65761c
call sub.rtl260.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
mov edx, 0x657710
call sub.rtl260.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x20]
xor eax, eax
pop ecx
call fcn.00404fbc
test eax, eax
mov dl, 1
mov eax, 0x657574
call sub.rtl260.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
test al, al
je 0x657464
push 5
push 0x657760
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657486
lea eax, [ebp - 0x20]
mov edx, 7
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x6583c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x658422
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x658430
mov eax, dword [ebp - 4]
call sub.vcl260.bpl__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658429
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x661c58
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x661dbb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x661d98
mov eax, dword [ebp - 0x10]
call sub.rtl260.bpl__System__GetMem_qqri
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x661dc8
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x661dd8
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov edx, 3
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x661dd8
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, 3
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x661dd8
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov edx, 3
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call sub.rtl260.bpl__System__FreeMem_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x661dc2
lea eax, [ebp - 0x30]
mov edx, 3
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x662458
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6624c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xfd
lea eax, [ebp - 8]
mov edx, 0xfe
call sub.rtl260.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6624cd
lea eax, [ebp - 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x665f28
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6660ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call sub.rtl260.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0xc]
call fcn.006e78f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
push ebp
push 0x66601a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x10]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x6660ec
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, 0x66616c
mov eax, dword [ebp - 0x10]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x78]
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x194]
test eax, eax
jle 0x665fcd
mov dword [ebp - 8], 1
jmp 0x665fd2
xor eax, eax
mov dword [ebp - 8], eax
mov edx, 0x666180
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0xc4]
test al, al
je 0x665ff6
mov eax, dword [0x730df8]
xor edx, edx
mov dword [eax], edx
jmp 0x666010
mov edx, 0x666180
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x74]
mov edx, dword [0x730df8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66603c
xor eax, eax
push ebp
push 0x666092
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6661a4
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0xc4]
test al, al
je 0x66606e
mov eax, dword [0x730c0c]
xor edx, edx
mov dword [eax], edx
jmp 0x666088
mov edx, 0x6661a4
mov eax, dword [ebp - 0x10]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x74]
mov edx, dword [0x730c0c]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6660b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6660d1
lea eax, [ebp - 0xc]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x6661b8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0x1c]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x1c]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x666254
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, 0x6662c0
mov eax, dword [ebp - 0x1c]
call sub.odac260.bpl__Ora_TOraDataSet_ParamByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x78]
mov eax, dword [ebp - 0x1c]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov edx, 0x6662d8
mov eax, dword [ebp - 0x1c]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
mov edx, dword [eax]
call dword [edx + 0x6c]
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
fld qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x673b88
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 8]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x673bdc
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
pop ecx
pop ecx
pop ebp
ret

Function at 0x681a08
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x681b4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov eax, dword [eax + 0x2dc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 1
jl 0x681a7b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov eax, dword [eax + 0x2dc]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x2dc]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x681a44
mov eax, dword [0x730f34]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 0xc]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0xc]
call sub.dac260.bpl__Dbaccess_TCustomDADataSet_GetSQL_qqrv
mov edx, 0x681b68
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_First_qqrv
jmp 0x681b27
mov edx, 0x681bd0
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov eax, dword [eax + 0x2dc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x681bec
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x2dc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0xc]
call sub.dbrtl260.bpl__Data_Db_TDataSet_Next_qqrv
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xad], 0
je 0x681ac1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x681b55
lea eax, [ebp - 0x14]
mov edx, 2
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x688d5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x688e97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730a90]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a4]
mov dl, 1
call sub.vcl260.bpl__Vcl_Menus_TMenuItem_SetVisible_qqro
push 0x688eb0
push dword [ebp - 8]
push 0x688ed8
push 0
push 0x688ed8
push 0x688ee8
push 0x688ed8
push 0
push 0x688ed8
push 0x688f38
push 0x688ed8
push 0x688f9c
push 0x688ed8
push 0
push 0x688ed8
push 0x688fe8
push 0x688ed8
push 0
push 0x688ed8
push 0x689064
push 0x688ed8
push 0x6890ac
push 0x688ed8
push 0
push 0x688ed8
push 0x689124
push 0x688ed8
push 0x689170
push 0x688ed8
push 0x6891fc
push 0x688ed8
push 0x689274
lea eax, [ebp - 0xc]
mov edx, 0x20
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0xc]
mov al, 4
call fcn.006efbe4
mov dl, 1
mov eax, 0x689304
call sub.rtl260.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
cmp al, 1
je 0x688e59
mov edx, 0x689358
mov al, 4
call fcn.006efbe4
push 1
push 0
push 0
push 0x6893f4
push 0x689420
mov eax, dword [sym.imp.vcl260.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x688e9e
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret