joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ecd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48ee03
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
push 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x488338]
call fcn.00488718
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48edd9
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x48ed3e
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xc], 0
jne 0x48ed3e
lea eax, [ebp - 4]
mov edx, dword [0x603988]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x48ed6a
mov eax, dword [ebp - 0xc]
call fcn.004889b0
test al, al
je 0x48ed5a
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x14]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x48ed6a
lea eax, [ebp - 4]
mov edx, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov esi, 0x11
mov ebx, dword [0x603988]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x10]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
xor edi, eax
mov eax, edi
xor edx, edx
push edx
push eax
call sub.rtl250.bpl__System_Math_Min_qqrxjxj
mov dword [ebp - 8], eax
add ebx, 8
dec esi
jne 0x48ed75
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ede0
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
Function at 0x4d3b64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4d3c54
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4af434]
call fcn.004b2bc8
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 8]
call fcn.004b2d24
test al, al
je 0x4d3c30
xor eax, eax
push ebp
push 0x4d3c29
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004b32b0
test bl, bl
je 0x4d3bd9
lea eax, [esi + 0x38]
mov edx, dword [ebp - 4]
mov ecx, dword [0x4af930]
call sub.rtl250.bpl__System__DynArrayAsg_qqrrpvpvt2
mov eax, dword [ebp - 8]
push esi
lea edi, [esi + 4]
lea esi, [eax + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esi + 0x1c]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
mov dword [esi + 0x30], edx
mov edx, dword [eax + 0x24]
mov dword [esi + 0x34], edx
lea eax, [esi + 0x20]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x28]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3c30
mov eax, dword [ebp - 8]
call fcn.004b2fd8
ret
mov eax, dword [ebp - 8]
call sub.rtl250.bpl__System_TObject_Free_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3c5b
lea eax, [ebp - 4]
mov edx, dword [0x4af930]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x4d5f84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4d6074
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4af434]
call fcn.004b2bc8
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 8]
call fcn.004b2d24
test al, al
je 0x4d6050
xor eax, eax
push ebp
push 0x4d6049
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004b32b0
test bl, bl
je 0x4d5ff9
lea eax, [esi + 0x38]
mov edx, dword [ebp - 4]
mov ecx, dword [0x4af930]
call sub.rtl250.bpl__System__DynArrayAsg_qqrrpvpvt2
mov eax, dword [ebp - 8]
push esi
lea edi, [esi + 4]
lea esi, [eax + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esi + 0x1c]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
mov dword [esi + 0x30], edx
mov edx, dword [eax + 0x24]
mov dword [esi + 0x34], edx
lea eax, [esi + 0x20]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x28]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6050
mov eax, dword [ebp - 8]
call fcn.004b2fd8
ret
mov eax, dword [ebp - 8]
call sub.rtl250.bpl__System_TObject_Free_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d607b
lea eax, [ebp - 4]
mov edx, dword [0x4af930]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x4dba9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4dbb98
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.004df48c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d651c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004dd238
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d64ac
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004dd2b0
lea eax, [ebx + 0x50]
call sub.rtl250.bpl__System__LStrClr_qqrpv
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbb9f
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4dbba8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4dbcb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.004df48c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4dbc77
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d651c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004dd238
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d64ac
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004dd2b0
jmp 0x4dbc89
xor edx, edx
mov eax, ebx
call fcn.004dd238
xor edx, edx
mov eax, ebx
call fcn.004dd2b0
lea eax, [ebx + 0x50]
call sub.rtl250.bpl__System__LStrClr_qqrpv
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbcbb
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x4df980
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4df9d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
je 0x4df9c1
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 5
jne 0x4df9c3
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df9e0
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x4df9e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4dfa4c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetVolumeInformationW
mov edx, ebx
lea eax, [ebp - 0x28]
call sub.rtl250.bpl__System_Sysutils_StrPas_qqrpxb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfa53
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x4e404c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e41bf
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4e419a
push dword fs:[edx]
mov dword fs:[edx], esp
mov word [ebp - 0x216], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call sub.rtl250.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
lea eax, [ebp - 0x21c]
mov edx, 0x4e41d8
call sub.rtl250.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x21c]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4e410b
lea eax, [ebp - 0x216]
call sub.rtl250.bpl__System__PWCharLen_qqrpb
lea edx, [ebp - 0x216]
mov ecx, ebx
xchg ecx, eax
call sub.rtl250.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
jmp 0x4e4112
mov eax, ebx
call sub.rtl250.bpl__System__UStrClr_qqrpv
cmp si, 0x61
jae 0x4e4134
lea edx, [ebp - 0x220]
mov eax, dword [ebx]
call sub.rtl250.bpl__System_Sysutils_AnsiUpperCaseFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x220]
mov eax, ebx
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x4e414e
lea edx, [ebp - 0x224]
mov eax, dword [ebx]
call sub.rtl250.bpl__System_Sysutils_AnsiLowerCaseFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x224]
mov eax, ebx
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x4e41ec
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x228]
mov eax, ebx
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e41a1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4e8321
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x4e8898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0x104
push dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, 0x104
push edx
call fcn.004e7fac
add esp, 0xc
cmp dword [ebp - 4], 0x104
jae 0x4e88ec
mov ecx, 0x104
sub ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
call dword [edx + 0x20c]
add esp, 8
add dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jb 0x4e88c4
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov cl, byte [edx + eax + 0x104]
not cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
xor byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x104
jb 0x4e88f1
push dword [ebp + 8]
call fcn.004e87e4
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0x104
push ecx
call fcn.004e87e4
pop ecx
pop ecx
pop ebp
ret

Function at 0x4e9dd2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x4e9e80
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x4e9e11
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.004e8401
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.004e7f98
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4e9e3c
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.004e8321
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.004e8365
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x4e9e9b
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e8365
add esp, 0xc
pop ecx
pop ebp
ret
Function at 0x4e9e9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x4e9ebf
push dword [ebp + 0x10]
push 0
push 0
call fcn.004e9dd2
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.004e8401
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4e9ed7
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.004e8321
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.004e8365
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.004e8365
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.004e8401
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x4e9f5e
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x4e9f43
mov esp, ebp
pop ebp
ret
Function at 0x4eb404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.004e9d20
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e9d37
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.004e7fac
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004e9dd2
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x4eb598
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.004e7f98
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.004e7fac
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x4eb552
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.004e9dd2
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.004e9e9e
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x4eb515
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.004e7fac
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x4eb4e5
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x4eb57b
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x4eb589
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x4eb565
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x4eb481
mov esp, ebp
pop ebp
ret

Function at 0x4f35b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x180]
mov edx, ebx
mov eax, edi
call fcn.004f3884
mov esi, eax
mov dword [edi + 0x180], esi
and esi, 0xff
add dword [edi + 0x184], esi
imul esi, dword [edi + 0x184], 0x8088405
inc esi
mov dword [edi + 0x184], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x188]
mov eax, edi
call fcn.004f3884
mov dword [edi + 0x188], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f3630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x120]
cmp byte [eax + 0x4c], 0
jne 0x4f3667
mov edi, ecx
dec edi
test edi, edi
jl 0x4f3678
inc edi
mov eax, esi
call fcn.004f3610
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.004f35b4
inc ebx
dec edi
jne 0x4f364e
jmp 0x4f3678
lea eax, [esi + 0x3cc]
push eax
push ecx
push ebx
call fcn.004e8794
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f370c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4f3782
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004f3680
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004f3610
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004f35b4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4f374c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3789
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x4fed54
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, eax
call fcn.004febf0
test al, al
je 0x4fed81
lea edx, [ebp - 0x3c]
mov eax, ebx
call fcn.004fecf4
test al, al
jne 0x4fed79
call sub.rtl250.bpl__System_Sysutils_RaiseLastWin32Error_qqrv
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x34]
jmp 0x4fedad
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
jne 0x4feda7
call sub.rtl250.bpl__System_Sysutils_RaiseLastWin32Error_qqrv
mov eax, dword [ebp - 4]
imul dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x507630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x5d8], 0
je 0x507657
mov eax, dword [esi + 0x5d8]
call fcn.004d61f4
test al, al
jne 0x50767c
lea eax, [ebp - 0x25a]
push eax
push 0x12d
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
lea edx, [ebp - 0x25a]
mov ecx, 0x12d
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x507689
mov eax, ebx
mov edx, dword [esi + 0x5d8]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebx]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x5076a6
mov eax, ebx
mov edx, 0x5076b8
call sub.rtl250.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
pop esi
pop ebx
mov esp, ebp
pop ebp
ret