joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c8008], 0x8088405
inc edx
mov dword [ebx + 0x4c8008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4ac53a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4ad89f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x4ca348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x4ca348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x4c9178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad8a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x10001b77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1000e018
call fcn.1000dd50
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10001bf4
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10001bf4
call fcn.1000127b
mov esi, eax
jmp 0x10001cfa
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x10001c17
call fcn.1000127b
jmp 0x10001ced
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10001c0d
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10001c4a
mov esi, 0x8007000e
jmp 0x10001cef
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x10001d28
jb 0x10001c65
cmp eax, 0xffffffff
ja 0x10001d28
cmp eax, 0x400
jbe 0x10001c7a
push eax
lea ecx, [ebp - 0x418]
call fcn.1000beaf
jmp 0x10001c9c
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10001c9c
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10001c40
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10001c0d
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.1000beaf
mov esi, eax
test edi, edi
je 0x10001cfa
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10001d13
lea ecx, [ebp - 0x418]
call fcn.10004013
lea ecx, [ebp - 0x428]
call fcn.10003e34
mov eax, esi
call fcn.1000dca1
ret 0x10
push 0x80070216
call fcn.1000beaf
int3
Function at 0x10004775
Capabilities:
Parse url

Disassembly:
push 0x4c
mov eax, 0x1000e30d
call fcn.1000dcae
mov dword [ebp - 0x1c], ecx
push 0x3c
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x58]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x58], esi
test ebx, ebx
jne 0x100047a6
mov dword [ebp - 0x10], edi
jmp 0x100047af
push ebx
lea ecx, [ebp - 0x10]
call fcn.1000beaf
push 5
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push ebx
call edi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x10004908
push 6
push ebx
mov byte [ebp - 4], 1
call edi
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x10004908
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10004abb
mov ebx, eax
test ebx, ebx
js 0x100048ed
lea ecx, [ebp - 0x18]
call fcn.10004abb
mov ebx, eax
test ebx, ebx
js 0x100048ed
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x40], 0
je 0x100048e8
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
call ebx
cmp eax, 0x8000
ja 0x100048e8
push dword [ebp - 0x10]
call ebx
cmp eax, 6
jb 0x100048e8
lea ecx, [ebp - 0x10]
call fcn.10004abb
mov ebx, eax
test ebx, ebx
js 0x100048ed
push str.http:
lea ecx, [ebp - 0x14]
call fcn.1000beaf
test al, al
je 0x1000486d
push str.https:
lea ecx, [ebp - 0x18]
call fcn.1000beaf
test al, al
jne 0x100048e8
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x18], eax
movzx eax, word [eax]
test ax, ax
je 0x100048e8
mov ecx, eax
cmp cx, 0xd
je 0x100048e8
cmp cx, 0xa
je 0x100048e8
mov dword [ebp - 0x1c], 0x2f
lea eax, [edx + 1]
cmp word [ebp - 0x1c], cx
cmovne eax, edx
mov edx, eax
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x1000487f
cmp edx, 3
jb 0x100048e8
push dword [ebp - 0x10]
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x50], eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea ecx, [ebp - 0x58]
push ecx
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x100048ed
mov ebx, 0x80070057
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
push dword [ebp - 0x10]
call edi
mov eax, ebx
call fcn.1000dc7f
ret 4
push 0x8007000e
call fcn.1000beaf
int3
Function at 0x1000beaf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000bebe
pop dword [ebp - 0xc]
mov eax, 0xd6048dcd
sub eax, 0xc603cf0f
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3773d
push 0
mov eax, 0x7f040147
add eax, 0x90fcef8d
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x4244
mov esi, eax
mov edi, 0x3743ebc2
sub edi, 0x274227c2
add edi, dword [ebp - 0xc]
mov ebx, 0x50759340
xor dword [ebp - 4], 0x18787a3
mov edx, dword [edi]
add dword [ebp - 8], edi
xor edx, ebx
sub dword [ebp - 8], 0x539a17d6
mov dword [esi], edx
add esi, 0xc588d3c9
sub esi, 0xc588d3c5
add edi, 0xd2092a0f
add edi, 0x2df6d5f5
loop 0x1000bf11
add eax, 0x534519b1
add eax, 0xacbbe232
xor ebx, ebx
add ebx, eax
add eax, 0x842d4714
sub eax, 0x842d470f
mov ecx, 0x15e7b3cb
sub ecx, 0x5e7b3cb
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401060
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor esi, esi
xor eax, esi
mov esi, ebx
mov eax, eax
mov esi, esi
xor eax, ebx
mov ebx, esi
xor eax, esi
xor esi, ebx
bswap esi
dec eax
mov edi, 0x5d
bswap ebx
not esi
add eax, 0x1e
sbb esi, 0xdd
dec esi
inc edx
not ebx
dec eax
rcr esi, 0x14
rcr ebx, 0x23
not ebx
and edi, 0x29
bswap edi
neg ebx
rcl edx, 0xff
bswap edx
sbb ebx, 0x81
rcr edi, 0xb2
imul edx
bswap ebx
inc edi
rcr esi, 0x8e
rcr eax, 0xc2
inc eax
dec ebx
dec eax
inc edi
dec edx
and edx, 0x17
bswap esi
ror edx, 0x4b
rol esi, 0x8f
sbb esi, 0xe9
ror edi, 0x4d
inc edx
ror ebx, 0xf6
and edi, 0x80
rol eax, 0x37
or edi, 0x68
bswap esi
neg ebx
imul edi
ror ebx, 0xc7
mov esi, 0x4e
sub eax, 0x62
sbb eax, 0x20
rol edi, 0x73
xor ecx, ecx
xor edi, edi
mov ebx, esi
xor esi, esi
mov ebx, ebx
mov eax, esi
mov esi, eax
xor ebx, esi
ror esi, 0x36
not esi
add edi, 0x1f
inc edx
sbb edx, 0x87
neg eax
neg eax
dec eax
neg esi
imul ebx
bswap ebx
bswap ebx
bswap edi
add edi, 0x9f
dec edx
neg ebx
bswap esi
sbb ebx, 0xd
inc esi
mov edi, 0x88
inc edi
or edi, 0x83
rcr eax, 0xa6
imul edi
rcl edi, 0xba
neg esi
neg eax
sbb esi, 0xe2
mov edx, 0x7e
rcr ebx, 0xdb
inc esi
rol eax, 0x42
dec ebx
imul ebx
neg esi
rcr edi, 0x8c
or eax, 0xb9
add edx, 0x3e
rol eax, 0x9d
sbb esi, 0xc5
not esi
or eax, 0x50
rol ebx, 0xc6
dec edi
not edi
and ebx, 0x11
inc eax
mov esi, 0x3f
inc edi
sub edx, 0x9c
mov esi, eax
mov eax, ebx
mov eax, eax
xor eax, eax
mov ebx, esi
mov eax, esi
mov eax, ebx
xor ebx, eax
mov ebx, ebx
mov ecx, dword [ebp + 0xc]
neg edx
rcl esi, 0x3d
dec esi
not ebx
ror eax, 0x48
ror edx, 0x54
add eax, 0xa8
rcr esi, 0xcc
imul edi
imul ebx
sub esi, 0x60
imul ebx
inc edx
and edx, 0x8d
mov edx, 0x96
imul edi
neg ebx
not ebx
rcr eax, 0xbb
inc edi
imul edx
rol edi, 0x6f
add edi, 0x86
bswap edx
not esi
sub edx, 5
and edx, 0x16
dec eax
imul eax
sub edi, 0xfa
not edi
inc esi
not esi
and esi, 1
imul eax
rol esi, 0xf4
neg eax
mov edx, 0xc9
inc esi
imul edx
ror edx, 0x1b
not esi
sbb eax, 0x20
bswap eax
bswap edx
bswap eax
dec edx
and esi, 0xdd
inc edi
dec ebx
mov edi, dword [ebp + 8]
xor ebx, esi
mov esi, esi
mov esi, eax
xor eax, eax
mov ebx, eax
mov esi, ebx
xor ebx, eax
xor eax, ebx
mov esi, esi
not byte [edi]
xor ebx, esi
mov eax, eax
xor esi, ebx
xor eax, eax
mov eax, ebx
xor eax, esi
xor ebx, esi
mov esi, ebx
xor ebx, eax
mov ebx, eax
mov eax, esi
mov eax, esi
add byte [edi], 0xff
sub byte [edi], 0x4a
xor esi, ebx
mov eax, eax
mov esi, eax
xor esi, esi
xor esi, esi
mov eax, esi
xor ebx, esi
mov eax, esi
xor ebx, ebx
imul byte [edi]
inc edi
loop 0x40123a
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412d8c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x412e23
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x412e3c
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e2a
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x4201cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x42022c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x420216
push 3
push 0x420238
push 0x420238
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x42023c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420233
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x423fa8
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffd4
mov eax, 0x424034
mov dword [esp], eax
mov eax, 0x424054
mov dword [esp + 4], eax
mov eax, 0x424074
mov dword [esp + 8], eax
mov eax, 0x424094
mov dword [esp + 0xc], eax
mov eax, 0x4240b8
mov dword [esp + 0x10], eax
mov eax, 0x4240d8
mov dword [esp + 0x14], eax
mov eax, 0x4240fc
mov dword [esp + 0x18], eax
mov eax, 0x42411c
mov dword [esp + 0x1c], eax
mov eax, 0x42413c
mov dword [esp + 0x20], eax
mov eax, 0x42415c
mov dword [esp + 0x24], eax
mov eax, 0x42417c
mov dword [esp + 0x28], eax
mov eax, esp
mov edx, 0xa
call fcn.0041929c
mov edx, 0x42419c
mov eax, 0x424f18
call fcn.0041965c
add esp, 0x2c
ret
Function at 0x424f2c
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffdc
mov eax, 0x424fa8
mov dword [esp], eax
mov eax, 0x424fc4
mov dword [esp + 4], eax
mov eax, 0x424fe4
mov dword [esp + 8], eax
mov eax, 0x425004
mov dword [esp + 0xc], eax
mov eax, 0x425024
mov dword [esp + 0x10], eax
mov eax, 0x425040
mov dword [esp + 0x14], eax
mov eax, 0x425060
mov dword [esp + 0x18], eax
mov eax, 0x425080
mov dword [esp + 0x1c], eax
mov eax, 0x4250a4
mov dword [esp + 0x20], eax
mov eax, esp
mov edx, 8
call fcn.0041929c
mov edx, 0x4250c4
mov eax, 0x425d68
call fcn.0041965c
add esp, 0x24
ret
Function at 0x40510c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404428
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x405125
test al, 0x10
je 0x405129
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4052b8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404284
add esp, 0x104
pop ebx
ret

Function at 0x4052e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404418
xor eax, eax
push ebp
push 0x405330
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404428
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405337
lea eax, [ebp - 4]
call fcn.00404030
ret

Function at 0x406ed8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406f11
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404120
jmp 0x406f1a
mov eax, ebx
mov edx, esi
call fcn.00404084
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406f24
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406f46
movzx eax, byte [esp]
jmp 0x406f48
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4075d8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x407450
mov eax, dword [0x40baa0]
cmp byte [eax], 0
je 0x407654
mov eax, dword [0x40b9f8]
call fcn.00402f88
call fcn.00402dac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406398
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40769c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40768a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x40b9d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40e7f0]
call fcn.004047cc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret