joyce8/EMBER2024-capa huggingface dataset:
Function at 0x647818
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x188], eax
xor eax, eax
push ebp
push 0x6479a4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x64797c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x180]
push eax
push 0
push 0x80
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x647972
mov eax, dword [ebp - 4]
push eax
call sub.rtl120.bpl__System_GetMemory_qi
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
jne 0x647968
mov esi, dword [ebp - 8]
test esi, esi
je 0x647968
cmp dword [esi + 0x44], 1
jne 0x64795d
mov ebx, dword [esi + 0x1c]
xor edi, edi
test ebx, ebx
je 0x6478cf
inc edi
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6478c7
test edi, edi
jle 0x64795d
lea eax, [ebp - 0x188]
mov edx, dword [esi + 0x28]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov ecx, dword [ebp - 0x188]
lea eax, [ebp - 0x184]
mov edx, 0x6479c0
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x184]
call fcn.00644b64
cmp dword [esi + 0x40], 0x47
jne 0x647918
mov eax, 0x6479e4
call fcn.00644b64
jmp 0x64795d
cmp dword [esi + 0x40], 6
jne 0x64792a
mov eax, 0x647a3c
call fcn.00644b64
jmp 0x64795d
mov eax, dword [esi + 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x190]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
mov ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x18c]
mov edx, 0x647aa0
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18c]
call fcn.00644b64
mov esi, dword [esi + 8]
test esi, esi
jne 0x6478b4
mov eax, dword [ebp - 8]
push eax
call sub.rtl120.bpl__System_FreeMemory_qpv
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x647986
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6479ab
lea eax, [ebp - 0x190]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x64bb3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x64bd54
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x72], 0
jne 0x64bb7b
mov eax, 0x64bd70
call fcn.00644b64
mov dword [0x83a854], 6
jmp 0x64bd39
cmp byte [0x801a1c], 0
je 0x64bbf5
call fcn.00644d20
cmp eax, 2
sete bl
mov eax, 0x64bdc8
call sub.rtl120.bpl__Sysutils_FindCmdLineSwitch_qqrx20System_UnicodeString
test al, al
je 0x64bb9f
mov bl, 1
test bl, bl
je 0x64bbaf
mov dword [0x83a854], 0xf
jmp 0x64bbcb
cmp byte [esi + 0x68], 0
je 0x64bbc1
mov dword [0x83a854], 0xe
jmp 0x64bbcb
mov dword [0x83a854], 0xa
lea edx, [ebp - 0x10]
mov eax, dword [0x83a854]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x64bde8
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0xc]
call fcn.00644b64
jmp 0x64bd39
cmp byte [esi + 0x70], 0
je 0x64bc14
mov eax, 0x64be80
call fcn.00644b64
mov dword [0x83a854], 4
jmp 0x64bd39
lea eax, [ebp - 0x14]
call fcn.0040ccf8
lea eax, [ebp - 0x14]
mov edx, 0x64beec
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0063b72c
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x64bf38
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
call fcn.00644b64
call sub.kernel32.dll_GetTickCount
mov edi, eax
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov edx, 0x64bf94
mov eax, esi
call fcn.0064cb70
test al, al
jne 0x64bc8d
mov edx, 0x64bfb8
mov eax, esi
call fcn.0064cb70
test al, al
jne 0x64bc8d
call fcn.0064515c
test al, al
jne 0x64bc8d
xor ebx, ebx
jmp 0x64bc8f
mov bl, 1
test bl, bl
jne 0x64bca1
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x3a98
jbe 0x64bc56
mov eax, 0x64bfd8
call sub.rtl120.bpl__Sysutils_FindCmdLineSwitch_qqrx20System_UnicodeString
test al, al
je 0x64bcb1
xor ebx, ebx
test bl, bl
je 0x64bd1b
mov eax, 0x64c01c
call fcn.00644b64
call fcn.00644d20
cmp eax, 2
sete bl
mov eax, 0x64bdc8
call sub.rtl120.bpl__Sysutils_FindCmdLineSwitch_qqrx20System_UnicodeString
test al, al
je 0x64bcda
mov bl, 1
test bl, bl
je 0x64bcea
mov dword [0x83a854], 0xf
jmp 0x64bcf4
mov dword [0x83a854], 0xe
lea edx, [ebp - 0x20]
mov eax, dword [0x83a854]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x64c094
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x1c]
call fcn.00644b64
jmp 0x64bd39
mov eax, 0x64c0e4
call fcn.00644b64
mov eax, 0x64c164
call fcn.00644b64
mov dword [0x83a854], 5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64bd5b
lea eax, [ebp - 0x20]
mov edx, 8
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x65dacc
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 4], edx
mov edx, 0x40
call sub.rtl120.bpl__Sysutils_FileOpen_qqrx20System_UnicodeStringui
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x65db2f
xor edx, edx
push ebp
push 0x65db28
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
jne 0x65db0f
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x65db2f
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65db2f
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__Sysutils_FileClose_qqri
ret
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x65dc0c
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x65dd44
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x18
call sub.rtl120.bpl__System__FillChar_qqrpvib
lea eax, [ebp - 0x40]
push eax
call sub.winhttp.dll_WinHttpGetIEProxyConfigForCurrentUser
test eax, eax
je 0x65dc9b
cmp dword [ebp - 0x40], 0
je 0x65dc67
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 3
mov bl, 1
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x65dc7d
cmp word [esi], 0
je 0x65dc7d
or dword [ebp - 0x30], 2
mov dword [ebp - 0x28], esi
mov bl, 1
test bl, bl
jne 0x65dcab
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x38]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0065db3c
jmp 0x65dcab
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 3
mov bl, 1
test bl, bl
je 0x65dd29
push 0
push 0
push 0
push 0
push 0
call sub.winhttp.dll_WinHttpOpen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x65dd29
xor eax, eax
push ebp
push 0x65dd22
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.winhttp.dll_WinHttpGetProxyForUrl
test eax, eax
je 0x65dd0b
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x14]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0065db3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65dd29
mov eax, dword [ebp - 0xc]
push eax
call sub.winhttp.dll_WinHttpCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65dd4b
lea eax, [ebp - 0x48]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x666cec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
xor eax, eax
push ebp
push 0x666da8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov esi, 8
mov ebx, 0x801a40
mov edx, dword [ebx]
mov eax, edi
call sub.rtl120.bpl__Strutils_AnsiContainsStr_qqrx20System_UnicodeStringt1
test al, al
jne 0x666d8d
add ebx, 4
dec esi
jne 0x666d16
lea edx, [ebp - 8]
mov eax, edi
call sub.rtl120.bpl__Sysutils_ExtractFileDrive_qqrx20System_UnicodeString
cmp dword [ebp - 8], 0
je 0x666d8d
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, edi
call sub.rtl120.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov edx, 0x666dc8
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Strutils_AnsiContainsStr_qqrx20System_UnicodeStringt1
test al, al
jne 0x666d8d
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x666d8d
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shlwapi.dll_PathIsNetworkPathW
test eax, eax
jne 0x666d8d
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x666daf
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x674e9c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov ebx, dword [0x807260]
xor eax, eax
push ebp
push 0x674f5b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movzx eax, byte [ebx + 0x20]
mov dl, 1
call sub.rtl120.bpl__Sysutils_BoolToStr_qqroo
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea ecx, [ebp - 0x24]
movzx eax, byte [ebx + 0x28]
mov dl, 1
call sub.rtl120.bpl__Sysutils_BoolToStr_qqroo
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x674f78
call fcn.00411984
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp dword [ebx], 0
jle 0x674f30
cmp byte [ebx + 0x20], 0
jne 0x674f30
cmp byte [ebx + 0x28], 0
je 0x674f34
xor eax, eax
jmp 0x674f36
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x674f62
lea eax, [ebp - 0x24]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x6762b4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00402518
ret
Function at 0x6763e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x67652e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.006762b4
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x67650d
xor eax, eax
push ebp
push 0x676506
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6764ef
xor eax, eax
push ebp
push 0x6764e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6764d1
xor eax, eax
push ebp
push 0x6764ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.006762e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6764d1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6764ef
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67650d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0067636c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x676535
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x676690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x676704
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x808004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67670b
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x67797c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x677a03
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2b8]
xor ecx, ecx
mov edx, 0x2b4
call sub.rtl120.bpl__System__FillChar_qqrpvib
mov ebx, 0x4100
or ebx, 2
or ebx, 1
or edi, 0xffffffff
push ebx
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shell32.dll_SHGetFileInfoW
mov edx, dword [ebp - 0x2b8]
mov eax, esi
call sub.vcl120.bpl__Graphics_TIcon_SetHandle_qqrp7HICON__
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x677a0a
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x67db20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x67dcaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x67dcc4
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov dl, 1
mov eax, dword [ebx + 0x3bc]
call sub.vcl120.bpl__Extctrls_TTimer_SetEnabled_qqro
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
mov dx, 0x22
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_AnsiQuotedStr_qqrx20System_UnicodeStringb
lea eax, [ebp - 0x10]
mov edx, 0x67dce8
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x10]
mov ecx, 1
mov edx, 0x7530
call fcn.0040dad8
test eax, eax
cmp byte [ebx + 0x43c], 0
jne 0x67dbdf
cmp byte [ebx + 0x41b], 0
je 0x67dbdf
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0xbb8
jb 0x67dbac
xor edx, edx
mov eax, dword [ebx + 0x3bc]
call sub.vcl120.bpl__Extctrls_TTimer_SetEnabled_qqro
cmp byte [ebx + 0x43c], 0
je 0x67dc04
mov dword [ebx + 0x2a4], 7
jmp 0x67dc8f
mov edx, 0x64
mov eax, dword [ebx + 0x3ac]
call fcn.004c78fc
movzx eax, byte [0x67dcf4]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
mov eax, dword [0x806a24]
mov eax, dword [eax]
mov edx, 0x67dd04
call fcn.00584a64
mov eax, dword [ebp - 0x18]
mov ecx, 0x67dd3c
mov edx, 0x67dd50
call sub.rtl120.bpl__Sysutils_StringReplace_qqrx20System_UnicodeStringt1t149System__Set_t21Sysutils_Sysutils__15_iuc_0_iuc_1_
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x3b8]
call sub.vcl120.bpl__Controls_TControl_SetText_qqrx20System_UnicodeString
mov eax, dword [ebx + 0x3ac]
call sub.vcl120.bpl__Controls_TControl_Refresh_qqrv
mov eax, dword [ebx + 0x3b8]
call sub.vcl120.bpl__Controls_TControl_Refresh_qqrv
push 0x32
call sub.kernel32.dll_Sleep_1
mov eax, ebx
call fcn.0067f61c
mov eax, ebx
call fcn.00684f3c
mov eax, ebx
call fcn.0067f834
xor edx, edx
mov eax, ebx
call fcn.0068442c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67dcb1
lea eax, [ebp - 0x18]
mov edx, 6
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x683c98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x683ca0
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x683e13
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x683e2c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, ebx
call fcn.00684544
mov eax, 0x683e74
call fcn.0040fad4
cmp byte [ebx + 0x418], 0
je 0x683d3a
movzx eax, byte [0x683e90]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov eax, dword [0x806a24]
mov eax, dword [eax]
mov edx, 0x683ea0
call fcn.00584a64
mov eax, dword [ebp - 0x14]
mov ecx, 0x683edc
mov edx, 0x683eec
call sub.rtl120.bpl__Sysutils_StringReplace_qqrx20System_UnicodeStringt1t149System__Set_t21Sysutils_Sysutils__15_iuc_0_iuc_1_
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x3b8]
call sub.vcl120.bpl__Controls_TControl_SetText_qqrx20System_UnicodeString
jmp 0x683d7a
movzx eax, byte [0x683e90]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
mov eax, dword [0x806a24]
mov eax, dword [eax]
mov edx, 0x683f00
call fcn.00584a64
mov eax, dword [ebp - 0x1c]
mov ecx, 0x683edc
mov edx, 0x683eec
call sub.rtl120.bpl__Sysutils_StringReplace_qqrx20System_UnicodeStringt1t149System__Set_t21Sysutils_Sysutils__15_iuc_0_iuc_1_
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x3b8]
call sub.vcl120.bpl__Controls_TControl_SetText_qqrx20System_UnicodeString
push 1
push 0
mov eax, dword [0x801ae8]
call sub.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x24]
push 0x683f38
push 0x683f5c
push 0x683f84
push dword [ebp - 4]
push 0x683fa8
lea eax, [ebp - 0x20]
mov edx, 6
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x20]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
lea edx, [ebp - 0x2c]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
lea eax, [ebp - 0x28]
mov edx, 0x683e74
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x28]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683e1a
lea eax, [ebp - 0x2c]
mov edx, 0xb
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x68a1c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x68a2fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [ebp - 0x22a]
mov edx, 0x208
call fcn.00402518
lea eax, [ebp - 0x22a]
push eax
push 0x208
call sub.kernel32.dll_GetLogicalDriveStringsW
mov dword [ebp - 0x10], eax
xor edi, edi
jmp 0x68a2b5
lea eax, [ebp - 4]
movzx edx, word [ebp + edi*2 - 0x22a]
call sub.rtl120.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
lea eax, [ebp - 0x230]
mov ecx, 0x68a318
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x230]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetDriveTypeW
mov esi, eax
cmp esi, 3
jne 0x68a2b2
mov eax, dword [ebp - 4]
movzx ebx, word [eax]
sub bl, 0x41
inc ebx
mov eax, ebx
call sub.rtl120.bpl__Sysutils_DiskFree_qqruc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, ebx
call sub.rtl120.bpl__Sysutils_DiskSize_qqruc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
add dword [ecx], eax
adc dword [ecx + 4], edx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
add dword [ecx], eax
adc dword [ecx + 4], edx
add edi, 4
mov eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x68a2d2
cmp eax, dword [esp]
pop edx
pop eax
ja 0x68a237
jmp 0x68a2da
pop edx
pop eax
jg 0x68a237
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68a302
lea eax, [ebp - 0x230]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x68a31c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
mov esi, eax
xor edx, edx
push ebp
push 0x68a3a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov al, 1
call fcn.004024e4
lea edx, [ebp - 0x190]
push edx
push eax
call sub.wsock32.dll_WSAStartup
push 0x80
lea eax, [ebp - 0x211]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x211]
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x68a37b
mov eax, esi
mov edx, dword [ebx]
call sub.rtl120.bpl__System__UStrFromPChar_qqrr20System_UnicodeStringpc
jmp 0x68a38d
mov eax, esi
lea edx, [ebp - 0x211]
mov ecx, 0x81
call sub.rtl120.bpl__System__UStrFromArray_qqrr20System_UnicodeStringpci
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68a3a7
call sub.wsock32.dll_WSACleanup
ret