joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd074
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x4bd07c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd216
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5e4418]
movzx edx, byte [0x4bd224]
cmp dl, byte [eax]
je 0x4bd0c9
cmp byte [esi + 0x3a], 0
je 0x4bd0b9
mov dl, 1
mov eax, ebx
call fcn.0049303c
jmp 0x4bd0c9
mov edx, dword [0x5e3a34]
movzx edx, byte [edx]
mov eax, ebx
call fcn.0049303c
lea eax, [ebp - 0x10]
movzx edx, byte [esi + 0x39]
mov cl, 1
call sub.rtl170.bpl__System_Variants__VarFromInt_qqrr8TVarDataxixzc
lea ecx, [ebp - 0x10]
mov edx, 0x3f0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x20]
movzx edx, byte [esi + 0x30]
call sub.rtl170.bpl__System_Variants__VarFromBool_qqrr8TVarDataxo
lea ecx, [ebp - 0x20]
mov edx, 0x413
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x30]
mov edx, dword [esi + 0x34]
call sub.rtl170.bpl__System_Variants__VarFromUStr_qqrr8TVarDatax20System_UnicodeString
lea ecx, [ebp - 0x30]
mov edx, 0x412
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x40]
movzx edx, byte [esi + 0x38]
call sub.rtl170.bpl__System_Variants__VarFromBool_qqrr8TVarDataxo
lea ecx, [ebp - 0x40]
mov edx, 0x3ff
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x50]
movzx edx, byte [esi + 0x3c]
call sub.rtl170.bpl__System_Variants__VarFromBool_qqrr8TVarDataxo
lea ecx, [ebp - 0x50]
mov edx, 0x409
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x60]
mov edx, dword [esi + 0x40]
mov cl, 0xfc
call sub.rtl170.bpl__System_Variants__VarFromInt_qqrr8TVarDataxixzc
lea ecx, [ebp - 0x60]
mov edx, 0x40a
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x70]
mov edx, dword [esi + 0x44]
mov cl, 0xfc
call sub.rtl170.bpl__System_Variants__VarFromInt_qqrr8TVarDataxixzc
lea ecx, [ebp - 0x70]
mov edx, 0x407
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x80]
movzx edx, byte [esi + 0x48]
mov cl, 1
call sub.rtl170.bpl__System_Variants__VarFromInt_qqrr8TVarDataxixzc
lea ecx, [ebp - 0x80]
mov edx, 0x415
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0x90]
mov edx, dword [esi + 0x4c]
call sub.rtl170.bpl__System_Variants__VarFromUStr_qqrr8TVarDatax20System_UnicodeString
lea ecx, [ebp - 0x90]
mov edx, 0x414
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
lea eax, [ebp - 0xa0]
mov edx, dword [esi + 0x50]
call sub.rtl170.bpl__System_Variants__VarFromUStr_qqrr8TVarDatax20System_UnicodeString
lea ecx, [ebp - 0xa0]
mov edx, 0x417
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
mov eax, dword [esi + 0x28]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd21d
lea eax, [ebp - 0xa0]
mov edx, dword [sym.imp.rtl170.bpl___xp_14System_Variant]
mov ecx, 0xa
call sub.rtl170.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x4c00e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c0249
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
cmp dword [eax + 0x24], 0
je 0x4c022e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x214]
movzx edx, byte [eax + 0xa]
mov byte [ebp - 5], dl
mov byte [eax + 0xa], 1
xor eax, eax
push ebp
push 0x4c0227
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov eax, dword [eax + 0x24]
mov edx, dword [eax + 0x40]
mov eax, dword [0x5e4238]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x30]
test al, al
je 0x4c01aa
push 0x4c0264
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x58]
push dword [ebx + 0x48]
push 0x4c0290
mov eax, dword [ebx + 0x24]
mov edx, dword [eax]
call dword [edx + 0xb0]
lea edx, [ebp - 0x10]
call sub.rtl170.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x10]
push 0x4c02bc
push 0x4c02e0
push 0x4c02f0
lea eax, [ebp - 0xc]
mov edx, 7
call sub.rtl170.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0xc]
movzx ecx, word [0x4c02fc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xbc]
jmp 0x4c0206
push 0x4c0264
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x58]
push dword [ebx + 0x48]
push 0x4c0290
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x40]
mov eax, dword [0x5e4238]
mov eax, dword [eax]
call sub.dac170.bpl__Craccess_TSQLInfo_QuoteIfNeed_qqrx20System_UnicodeString
push dword [ebp - 0x18]
push 0x4c02bc
push 0x4c02e0
push 0x4c02f0
lea eax, [ebp - 0x14]
mov edx, 7
call sub.rtl170.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0x14]
movzx ecx, word [0x4c02fc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xbc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c022e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x214]
movzx edx, byte [ebp - 5]
mov byte [eax + 0xa], dl
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0250
lea eax, [ebp - 0x18]
mov edx, 4
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4d026c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sub.IMAGEHLP.DLL_ImageDirectoryEntryToData
mov ebx, eax
test ebx, ebx
je 0x4d030a
jmp 0x4d02ad
mov esi, dword [ebp + 8]
add esi, edi
mov eax, dword [ebp - 4]
push eax
push esi
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x4d02b4
add ebx, 0x14
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x4d0297
cmp dword [ebx + 0xc], 0
je 0x4d030a
mov eax, dword [ebp + 8]
add eax, dword [ebx + 0x10]
mov ebx, eax
jmp 0x4d0305
mov esi, ebx
mov eax, dword [esi]
cmp eax, dword [ebp - 8]
sete al
neg al
sbb edi, edi
test edi, edi
je 0x4d0302
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_VirtualProtectEx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
jmp 0x4d030a
add ebx, 4
cmp dword [ebx], 0
jne 0x4d02c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d7850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 0x10]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
mov eax, dword [ebp + 0xc]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
xor eax, eax
push ebp
push 0x4d78bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4d789a
inc edx
xor eax, eax
lea ecx, [eax + esi]
movzx ecx, byte [ebx + ecx]
mov edi, dword [ebp + 0xc]
xor cl, byte [edi + eax]
mov edi, dword [ebp + 0x10]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x4d7883
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d78c2
lea eax, [ebp + 0xc]
mov edx, dword [0x418ccc]
mov ecx, 2
call sub.rtl170.bpl__System__FinalizeArray_qqrpvt1ui
ret

Function at 0x4d78cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
xor eax, eax
push ebp
push 0x4d7934
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4d7913
inc edx
xor eax, eax
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax]
mov ebx, dword [ebp - 4]
xor byte [ebx + eax], cl
inc eax
dec edx
jne 0x4d7902
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d793b
lea eax, [ebp - 8]
mov edx, dword [0x418ccc]
mov ecx, 2
call sub.rtl170.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x4d802c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov esi, 0x10
mov ecx, dword [ebx + esi*4 + 0xc]
xor ecx, dword [ebx + esi*4 - 8]
xor ecx, dword [ebx + esi*4 - 0x20]
xor ecx, dword [ebx + esi*4 - 0x28]
mov edx, 1
mov eax, ebx
call fcn.004d7f68
mov dword [ebx + esi*4 + 0x18], eax
inc esi
cmp esi, 0x50
jne 0x4d803a
mov edi, dword [ebx + 4]
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0xc], eax
xor esi, esi
mov ecx, edi
mov edx, 5
mov eax, ebx
call fcn.004d7f68
mov ebp, eax
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 8]
mov edx, esi
mov eax, ebx
call fcn.004d7fc8
add ebp, eax
add ebp, dword [esp + 0xc]
add ebp, dword [ebx + esi*4 + 0x18]
mov edx, esi
mov eax, ebx
call fcn.004d7f80
add ebp, eax
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov edx, 0x1e
mov eax, ebx
call fcn.004d7f68
mov dword [esp + 4], eax
mov dword [esp], edi
mov edi, ebp
inc esi
cmp esi, 0x50
jne 0x4d8080
add dword [ebx + 4], edi
mov eax, dword [esp]
add dword [ebx + 8], eax
mov eax, dword [esp + 4]
add dword [ebx + 0xc], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x10], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x14], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x527c48
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x527d70
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00527b34
mov eax, dword [esi]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call sub.rtl170.bpl__System_Move_qqrpxvpvi
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call sub.rtl170.bpl__System_Move_qqrpxvpvi
add ebx, 0x1c
mov eax, dword [esi]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
mov dword [ebp - 0xc], eax
mov eax, dword [0x5e4484]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.005169b8
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call sub.rtl170.bpl__System__FillChar_qqrpvic
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.00516994
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.0051674c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.005169b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527d77
lea eax, [ebp - 4]
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x5a8f74
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x5a905f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x24]
mov al, 0x2c
call sub.PQLibPack17.bpl__Sysfkts_GetStdFldNam_qqrx15Sysfkts_TStdFld
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
mov eax, dword [sym.imp.PQLibPack17.bpl__Sysfkts_CPQSysTblName]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xa
lea eax, [ebp - 0x28]
push eax
mov eax, dword [sym.imp.PQLibPack17.bpl__Sqlunit_SQLSyntax]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 0x1e
call sub.PQLibPack17.bpl__Sqlunit_TSQLMySQL_GetCompareStr_qqr15Sysfkts_TStdFld20System_UnicodeString
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x20]
mov ecx, 2
mov eax, 0x5a907c
call sub.rtl170.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005a744c
test al, al
je 0x5a9035
mov eax, dword [ebx + 0x894]
mov eax, dword [eax + 0x38]
xor edx, edx
call sub.dbrtl170.bpl__Data_Db_TFields_GetField_qqri
mov edx, dword [eax]
call dword [edx + 0x70]
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, ebx
call sub.rtl170.bpl__System_Math_InRange_qqrxixixi
test al, al
jne 0x5a9037
mov ebx, esi
jmp 0x5a9037
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9066
lea eax, [ebp - 0x28]
mov edx, 2
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x5b0038
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5b0040
push ecx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5b01d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x48]
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.PQLibPack17.bpl__Sysfkts_CPQSysTblName]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xa
lea edx, [ebp - 0x24]
mov al, 0x40
call sub.PQLibPack17.bpl__Sysfkts_GetStdFldNam_qqrx15Sysfkts_TStdFld
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, 0x5b01f0
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x20]
mov ecx, 2
mov eax, 0x5b020c
call sub.rtl170.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.005a744c
test al, al
je 0x5b01b1
jmp 0x5b019e
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edi + 0x38]
mov edx, 1
call sub.dbrtl170.bpl__Data_Db_TFields_GetField_qqri
mov edx, dword [eax]
call dword [edx + 0x60]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2c]
call sub.rtl170.bpl__System_Sysutils_DateTimeToStr_qqrx16System_TDateTime
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
mov eax, dword [esi + 0x894]
mov eax, dword [eax + 0x38]
mov edx, 4
call sub.dbrtl170.bpl__Data_Db_TFields_GetField_qqri
lea edx, [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x84]
push dword [ebp - 0x34]
push 0x5b0258
mov eax, dword [esi + 0x894]
mov eax, dword [eax + 0x38]
mov edx, 2
call sub.dbrtl170.bpl__Data_Db_TFields_GetField_qqri
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x84]
push dword [ebp - 0x38]
lea eax, [ebp - 0x30]
mov edx, 3
call sub.rtl170.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [esi + 0x894]
mov eax, dword [eax + 0x38]
mov edx, 6
call sub.dbrtl170.bpl__Data_Db_TFields_GetField_qqri
lea edx, [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x20]
mov ecx, 2
mov eax, 0x5b0268
call sub.rtl170.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esi + 0x894]
call sub.dbrtl170.bpl__Data_Db_TDataSet_Next_qqrv
mov edi, dword [esi + 0x894]
cmp byte [edi + 0xa5], 0
je 0x5b00c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b01db
lea eax, [ebp - 0x3c]
mov edx, 7
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl170.bpl__System__UStrClr_qqrpv
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
xor eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414ddd
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], eax
or ebx, edi
add esi, 4
add edx, 0x34530668
cmp esi, ecx
jne fcn.00414ddd
or edx, edx
or ebx, edx
sub edi, 0x19aa17a6
ret
Function at 0x40353a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403563
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40355b
cmp al, 0x22
jne 0x40354f
cmp byte [esi], 0x22
jne 0x40356d
inc esi
jmp 0x40356d
cmp al, 0x20
jle 0x40356d
inc esi
cmp byte [esi], 0x20
jg 0x403567
mov al, byte [esi]
test al, al
je 0x403577
cmp al, 0x20
jle 0x403560
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401de7
push 0x404004
push section..data
call fcn.00403520
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4035a7
movzx eax, word [ebp - 0x14]
jmp 0x4035aa
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004035cd
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x8de124
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de12a
pop ebp
sub ebp, 6
sub ebp, 0x4de124
jmp 0x8de188
jmp 0x8de191
mov eax, 0x4de124
add eax, ebp
add eax, 0x93
mov ecx, 0x625
mov edx, 0xb266cd6b
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de1a8
jmp 0x8de1bb
add dword [ebx], ebp
add ebp, dword [ebx + 0x7b]
imul ebp, dword [ebx + 3], 0x6b
cmpsd dword [esi], dword es:[edi]
inc edi
imul ebx, dword [eax - 0x55], 0x3b
xchg esp, eax
invalid
Function at 0x3002178c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x300217b4
xor eax, eax
jmp 0x3002198f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 4
push ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0xc], eax
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x300217ad
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
call edi
mov eax, dword [eax + 8]
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
call edi
push 0
push 0
push 0x3001e3e9
push 0x30020f8e
mov esi, eax
call fcn.3001c3eb
push 0x30097c58
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov eax, dword [esi + 0xe2]
mov dword [0x30075a04], ebx
mov dword [0x30075a00], eax
mov eax, dword [esi + 0xb6]
lea ebx, [esi + 0xce]
push ebx
mov dword [0x300759a4], eax
mov eax, dword [esi + 0x1c6]
push 0x67
push 0x64
mov dword [0x300759a8], eax
push dword [esi + 0x26]
mov dword [0x300759f4], 0x3001cb67
mov dword [0x300759f8], 0x300198de
mov dword [0x300759fc], 0x3001a80c
call fcn.3003a67d
test eax, eax
je 0x30021873
xor eax, eax
inc eax
jmp 0x3002198f
mov eax, dword [ebx]
lea ebx, [esi + 0xd6]
push ebx
mov dword [0x300759ac], eax
push dword [esi + 0xde]
push 0x65
push dword [esi + 0x26]
call fcn.3003a67d
test eax, eax
jne 0x3002195b
or dword [0x30075a08], 0xffffffff
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0xea]
mov dword [0x30075974], ecx
mov dword [0x300759dc], eax
inc edx
cmp dword [esi + 0x32], ecx
mov dword [0x300759c8], ecx
jne 0x300218c4
mov dword [eax + 4], edx
lea eax, [esi + 0x16a]
mov dword [0x300759e0], eax
cmp dword [esi + 0x36], ecx
jne 0x300218d6
mov dword [eax], edx
test word [esi + 0x22], 0x200
jne 0x300218ec
cmp dword [ebp + 8], ecx
je 0x300218f2
cmp dword [ebp + 8], 0x1f4
jge 0x300218f2
mov dword [0x3007598c], edx
push ecx
push ecx
push dword [ebp + 0x10]
xor eax, eax
push eax
push eax
push dword [esi + 0x72]
push dword [esi + 0x6e]
push dword [ebx]
push dword [esi + 0x26]
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.3001cd1d
mov ecx, dword [0x300759dc]
mov eax, 0x4000
test dword [ecx + 4], eax
jne 0x3002192b
mov ecx, dword [0x300759e0]
test dword [ecx], eax
je 0x30021936
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.30020a8c
and dword [0x3007598c], 0
push dword [ebx]
call edi
mov ecx, dword [eax + 0x44]
push dword [ebx]
mov dword [esi + 0x32], ecx
mov eax, dword [eax + 0x48]
mov edi, ecx
mov dword [esi + 0x36], eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x3002195e
mov edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 0
jne 0x30021976
cmp dword [esi + 0x32], 1
mov eax, dword [0x30075a08]
mov dword [esi + 0x42], eax
je 0x30021976
or dword [esi + 0x42], 0xffffffff
push dword [ebx]
and dword [0x300759f4], 0
call fcn.3004ee74
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc