joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7665e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x31c000]
push edi
or ebp, 0xffffffff
jmp 0x766602
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x766609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7665f8
mov eax, 1
add ebx, ebx
jne 0x76661b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x76662c
jne 0x76664b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76664b
dec eax
add ebx, ebx
jne 0x766638
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x766610
add ebx, ebx
jne 0x766647
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x76669d
xor ecx, ecx
sub eax, 3
jb 0x766663
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7666d2
sar eax, 1
mov ebp, eax
jmp 0x76666e
add ebx, ebx
jne 0x76666e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76663c
inc ecx
add ebx, ebx
jne 0x76667c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76663c
add ebx, ebx
jne 0x766689
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x76667e
jne 0x76669a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x76667e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7666bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7666ae
jmp 0x7665fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7666bc
add edi, ecx
jmp 0x7665fe
pop esi
mov edi, esi
mov ecx, 0x75
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7666da
cmp byte [edi], 0x12
jne 0x7666da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7666df
lea edi, [esi + 0x364000]
mov eax, dword [edi]
or eax, eax
je 0x766757
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x366484]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x366534]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x76670c
mov ecx, edi
jns 0x76673b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x36653c]
or eax, eax
je 0x766751
mov dword [ebx], eax
add ebx, 4
jmp 0x766729
call dword [esi + 0x366538]
mov ebp, dword [esi + 0x366540]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x76678b
sub esp, 0xffffff80
jmp 0x418f70
Function at 0x402310
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00402370

Function at 0x402370
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x406420]
test esi, esi
jle 0x40245d
mov edi, dword [0x406424]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4023a4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402456
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x402390
mov dword [esp], eax
mov ebx, eax
call fcn.00402ca0
test eax, eax
mov edi, eax
je 0x40249a
lea ebx, [esi + esi*2]
mov esi, dword [0x406424]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00402da0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x406424]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40247a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40244f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40244f
mov eax, dword [esp + 0x20]
add ebx, dword [0x406424]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x402464
add dword [0x406420], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x4023ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402310
mov eax, dword [0x406424]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402310
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402310
lea esi, [esi]
Function at 0x402910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406438
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406430]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402965
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40295e
test esi, esi
je 0x40295e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402940
mov dword [esp], 0x406438
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402bc0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402bf8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x402bee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402bfa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402be0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40482c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp byte [0x54d26c], 0
jne 0x404971
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + str.0123456789ABCDEF]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
inc eax
cmp eax, 8
jne 0x404848
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x54d268], eax
cmp dword [0x54d268], 0
jne 0x404916
mov eax, dword [sym.imp.rtl250.bpl__System_IsLibrary]
cmp byte [eax], 0
jne 0x4048d1
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x54d268], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x54d268]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x54d250
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x54d250], fcn.00403238
mov dword [0x54d254], 0x40351c
mov dword [0x54d258], 0x40369c
mov dword [0x54d25c], 0x40392c
mov dword [0x54d260], 0x403b00
mov dword [0x54d264], 0x403b4c
mov byte [0x54d26d], 1
jmp 0x404956
push 0
push 0
push 0
push 4
mov eax, dword [0x54d268]
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, dword [eax]
mov edi, 0x54d250
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [0x54d268]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x54d268], eax
mov byte [0x54d26d], 0
mov eax, 0x54d238
call sub.rtl250.bpl__System_GetMemoryManager_qqrr23System_TMemoryManagerEx
mov eax, 0x54d250
call sub.rtl250.bpl__System_SetMemoryManager_qqrrx23System_TMemoryManagerEx
mov byte [0x54d26c], 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409dfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x409e82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x409e6c
push ebx
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x409ea0
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Sysutils_EFileAccessException_]
call sub.AxComponentsRTL.bpl__Axrtl_System_Sysutils_EFileAccessException__bctr_qqrix20System_UnicodeStringt2t2
call sub.rtl250.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e89
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x40a0ec
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x40a18d
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [eax + 8], 0
je 0x40a11a
mov eax, dword [eax + 8]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
jmp 0x40a177
mov dl, 1
mov eax, ebx
call sub.rtl250.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
test al, al
je 0x40a177
mov eax, ebx
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x40a177
push ebx
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x40a1a8
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Sysutils_EFileAccessException_]
call sub.AxComponentsRTL.bpl__Axrtl_System_Sysutils_EFileAccessException__bctr_qqrix20System_UnicodeStringt2t2
call sub.rtl250.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a194
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret

Function at 0x40a4c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x40a577
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [eax + 8], 0
je 0x40a4f2
mov eax, dword [eax + 8]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x28]
jmp 0x40a55c
mov eax, ebx
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
mov edx, esi
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 4]
mov dl, 1
call sub.rtl250.bpl__System_Sysutils_DirectoryExists_qqrx20System_UnicodeStringo
test al, al
je 0x40a55c
push esi
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
jne 0x40a55c
push ebx
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov eax, dword [eax]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x40a590
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Sysutils_EFileAccessException_]
call sub.AxComponentsRTL.bpl__Axrtl_System_Sysutils_EFileAccessException__bctr_qqrix20System_UnicodeStringt2t2
call sub.rtl250.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a57e
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x40e14c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov edi, edx
xor eax, eax
push ebp
push 0x40e1e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x200]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jle 0x40e1cc
cmp word [ebp + ebx*2 - 0x200], 0
je 0x40e1c5
lea eax, [ebp + ebx*2 - 0x200]
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x40e1c5
lea eax, [ebp - 0x204]
lea edx, [ebp + ebx*2 - 0x200]
call sub.rtl250.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x204]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
add ebx, 4
cmp esi, ebx
jg 0x40e189
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e1ec
lea eax, [ebp - 0x204]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret

Function at 0x40e268
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x210], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x40e2ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x40e2c4
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
call sub.rtl250.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl250.bpl__System_Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
jmp 0x40e2d3
mov eax, ebx
mov edx, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e2f3
lea eax, [ebp - 0x210]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x4111a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp + 0xc]
push eax
push edi
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, esi
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_CheckResult_qqri
test al, al
jne 0x411200
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [sym.imp.rtl250.bpl__System_Rtlconsts__SRegGetDataFailed]
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Win_Registry_ERegistryException_]
call sub.rtl250.bpl__System_Sysutils_Exception__bctr_qqrp20System_TResStringRecpx14System_TVarRecxi
call sub.rtl250.bpl__System__RaiseExcept_qqrv
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4117d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4118e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call sub.rtl250.bpl__System_Win_Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
xor eax, eax
push ebp
push 0x4118c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_GetKeyInfo_qqrr31System_Win_Registry_TRegKeyInfo
test al, al
je 0x4118a6
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004116ac
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl250.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4118a6
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x4118a2
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x30]
call sub.rtl250.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004116ac
pop ecx
inc edi
dec ebx
jne 0x411857
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4118c9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call sub.rtl250.bpl__System_Win_Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
ret
Function at 0x41cda8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x41cf1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
movzx eax, byte [ebp + 8]
sub al, 1
jb 0x41cde7
je 0x41cdf6
jmp 0x41cef2
lea eax, [ebp - 4]
mov edx, 0x41cf40
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x41ce03
lea eax, [ebp - 4]
mov edx, 0x41cf64
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
push ebp
push 0x41cee8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x41cf7c
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0041a720
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41ce58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41cef2
xor eax, eax
push ebp
push 0x41ced7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0041bfc4
mov eax, dword [ebp - 0xc]
call fcn.0041b6d0
test al, al
jne 0x41cec1
lea ecx, [ebp - 0x24]
mov edx, 0x41cfd8
mov eax, dword [ebp - 0xc]
call fcn.0041b6e4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 0x10]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea ecx, [ebp - 0x2c]
mov edx, 0x41cff0
mov eax, dword [ebp - 0xc]
call fcn.0041b6e4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Internet_Internet_UrlUnescape_qqrx20System_UnicodeStringui
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 0xc]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cede
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cf24
lea eax, [ebp - 0x2c]
mov edx, 3
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x41d070
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41d201
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebp + 8]
sub al, 1
jb 0x41d0b0
je 0x41d0bf
jmp 0x41d1d9
lea eax, [ebp - 4]
mov edx, 0x41d220
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x41d0cc
lea eax, [ebp - 4]
mov edx, 0x41d244
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
cmp byte [ebp + 8], 0
jne 0x41d186
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x41d25c
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0041cd44
test eax, eax
jg 0x41d1d9
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x41d2d0
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov ecx, dword [ebp - 0x14]
mov edx, esi
mov eax, ebx
call fcn.0041cd44
test eax, eax
jg 0x41d1d9
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x41d358
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov ecx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.0041cd44
test eax, eax
jg 0x41d1d9
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x41d3e8
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, ebx
call fcn.0041cd44
test eax, eax
jg 0x41d1d9
xor eax, eax
push ebp
push 0x41d1cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0x11
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, 0x41d470
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.00419e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d1d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d208
lea eax, [ebp - 0x20]
mov edx, 4
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
ret