joyce8/EMBER2024-capa huggingface dataset:
Function at 0x730f50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x730f58
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x7310a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edx + 0x28]
test eax, eax
je 0x73105b
mov ebx, eax
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, esi
call fcn.0072df1c
mov dl, 1
mov eax, dword [0x70d454]
call fcn.0070d4f4
mov ebx, eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__Sysutils_LowerCase_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov ecx, 0xfde9
call sub.rtl120.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call sub.rtl120.bpl__Sysutils_BytesOf_qqrx31System__AnsiStringT_us_i65535__
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0070d1ec
mov eax, ebx
call sub.rtl120.bpl__System_TObject_Free_qqrv
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__Sysutils_LowerCase_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_LowerCase_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x7310c4
call sub.rtl120.bpl__Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
push 5
push 0x731124
push 0x731124
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x731128
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7310b0
lea eax, [ebp - 0x34]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x1c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x18]
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x14]
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x10]
mov edx, dword [sym.imp.rtl120.bpl___xp_15Sysutils_TBytes]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x731134
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x7311e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System_AnsiToUtf8_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, ebx
call fcn.007312b4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call sub.rtl120.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x731200
call sub.rtl120.bpl__Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
push 1
push 0
push 0x7312a4
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x7312a8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7311ec
lea eax, [ebp - 0x14]
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x10]
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x7459c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x745b52
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
lea eax, [ebp - 0x50]
mov edx, 0x40
call fcn.00402518
push 0x20
lea eax, [ebp - 0x50]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 8]
lea edx, [ebp - 0x50]
mov ecx, 0x20
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
lea eax, [ebp - 0x50]
mov edx, 0x40
call fcn.00402518
push 0x20
lea eax, [ebp - 0x50]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
push dword [ebp - 8]
push 0x745b70
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x50]
mov ecx, 0x20
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
push dword [ebp - 0x54]
lea eax, [ebp - 8]
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
cmp dword [ebx + 0xc], 0
je 0x745b27
cmp dword [ebx + 4], 0
je 0x745b27
push 0x745b80
push dword [ebx + 8]
push 0x745b94
push 0x745ba4
lea eax, [ebp - 0xc]
mov edx, 4
call sub.rtl120.bpl__System__LStrCatN_qqrv
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
mov edx, eax
mov eax, dword [ebx + 4]
pop ecx
mov esi, dword [eax]
call dword [esi + 0x10]
push 0
push 0
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__Classes_TStream_SetPosition_qqrxj
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + 0x1a0], eax
xor ecx, ecx
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
call fcn.0060f020
mov eax, dword [ebx + 0xc]
add eax, 0x118
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebx + 0xc]
add eax, 0xec
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x188], edx
call fcn.0060e6d4
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + 0x12c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745b59
lea eax, [ebp - 0x54]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x747314
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push str.bad_pack_level
cmp esi, 1
jl 0x747332
cmp esi, 8
jle 0x747336
xor eax, eax
jmp 0x74733b
mov eax, 1
push eax
push ebx
call fcn.00745c96
add esp, 0xc
xor edx, edx
mov dword [ebx + 0x6af78], edx
cmp dword [ebx + 0x6af70], 0
jne 0x74736a
mov dword [ebx + 0x6af78], 1
mov dword [ebx + 0x6af70], 0x10000
xor ecx, ecx
mov dword [ebx + 0x6af6c], ecx
push 0x1fffc
push 0
lea eax, [ebx + 0x4af70]
push eax
call fcn.0074a5f0
add esp, 0xc
movzx edx, word [esi*8 + 0x80285e]
mov dword [ebx + 0x6af98], edx
movzx ecx, word [esi*8 + 0x80285c]
mov dword [ebx + 0x6af9c], ecx
movzx eax, word [esi*8 + 0x802860]
mov dword [ebx + 0x6afa0], eax
movzx edx, word [esi*8 + 0x802862]
mov dword [ebx + 0x6af94], edx
cmp esi, 2
jg 0x7473cb
or word [edi], 4
jmp 0x7473d4
cmp esi, 8
jl 0x7473d4
or word [edi], 2
xor ecx, ecx
mov dword [ebx + 0x6af84], ecx
xor eax, eax
mov dword [ebx + 0x6af74], eax
mov esi, 0x8000
add esi, esi
push esi
lea eax, [ebx + 0x1af70]
push eax
push ebx
call dword [ebx + 0xc]
add esp, 0xc
mov dword [ebx + 0x6af90], eax
cmp dword [ebx + 0x6af90], 0
je 0x747412
cmp dword [ebx + 0x6af90], 0xffffffff
jne 0x747426
mov dword [ebx + 0x6af8c], 1
xor edx, edx
mov dword [ebx + 0x6af90], edx
jmp 0x747470
xor ecx, ecx
mov dword [ebx + 0x6af8c], ecx
cmp dword [ebx + 0x6af90], 0x106
jae 0x747441
push ebx
call fcn.0074764b
pop ecx
xor eax, eax
mov dword [ebx + 0x6af7c], eax
xor esi, esi
mov eax, dword [ebx + 0x6af7c]
shl eax, 5
xor edx, edx
mov dl, byte [ebx + esi + 0x1af70]
xor eax, edx
and eax, 0x7fff
mov dword [ebx + 0x6af7c], eax
inc esi
cmp esi, 2
jb 0x74744b
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x74880f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x802930
test edx, edx
jne 0x74882d
xor eax, eax
jmp 0x748915
xor eax, 0xffffffff
cmp ebx, 8
jb 0x7488f5
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ebx, 8
cmp ebx, 8
jae 0x748839
test ebx, ebx
je 0x748912
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ebx
jne 0x7488f9
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret

Function at 0x748919
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movsx edx, byte [ebp + 0xc]
xor edx, dword [eax]
and edx, 0xff
mov ecx, dword [edx*4 + 0x802930]
mov edx, dword [eax]
shr edx, 8
xor ecx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
and ecx, 0xff
add dword [eax + 4], ecx
imul edx, dword [eax + 4], 0x8088405
inc edx
mov dword [eax + 4], edx
mov ecx, dword [eax + 4]
shr ecx, 0x18
xor ecx, dword [eax + 8]
and ecx, 0xff
mov edx, dword [ecx*4 + 0x802930]
mov ecx, dword [eax + 8]
shr ecx, 8
xor edx, ecx
mov dword [eax + 8], edx
pop ebp
ret
Function at 0x748b75
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
push esi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
jne 0x748b99
mov eax, 0x200
jmp 0x748d23
mov eax, dword [ebp - 0x48]
xor ebx, ebx
test al, 1
je 0x748ba5
or ebx, 1
test al, 2
je 0x748bac
or ebx, 2
test al, 4
je 0x748bb3
or ebx, 4
test al, 0x10
je 0x748bba
or ebx, 0x10
test al, 0x20
je 0x748bc1
or ebx, 0x20
test al, 0x10
je 0x748bcd
or ebx, 0x40000000
jmp 0x748bd3
or ebx, 0x80000000
or ebx, 0x1000000
test al, 1
je 0x748bdf
jmp 0x748be5
or ebx, 0x800000
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov edi, eax
cmp edi, 0x28
jbe 0x748c93
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 2
lea edx, [ebp - 6]
push edx
push esi
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0x24
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea ecx, [ebp - 4]
push ecx
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_ReadFile
movzx edx, word [ebp - 6]
cmp edx, 0x54ad
jne 0x748c93
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
cmp edi, ecx
jbe 0x748c93
push 0
push 0
push dword [ebp - 0xc]
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 4
lea edx, [ebp - 0x10]
push edx
push esi
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0x10], 0x5a4d
je 0x748c8d
cmp dword [ebp - 0x10], 0x454e
je 0x748c8d
cmp dword [ebp - 0x10], 0x454c
je 0x748c8d
cmp dword [ebp - 0x10], 0x4550
jne 0x748c93
or ebx, 0x400000
cmp dword [ebp + 0xc], 0
je 0x748c9e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], ebx
cmp dword [ebp + 0x10], 0
je 0x748ca9
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
cmp dword [ebp + 0x14], 0
je 0x748cf3
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00748acc
add esp, 8
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00748acc
add esp, 8
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.00748acc
add esp, 8
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
cmp dword [ebp + 0x18], 0
je 0x748d21
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x12]
push edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00748aff
add esp, 0x10
movzx edx, word [ebp - 0x14]
movzx ecx, word [ebp - 0x12]
shl ecx, 0x10
or edx, ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x748ecb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, esi
cmp byte [ebx + 0x2d], 0
je 0x748f47
cmp dword [ebx + 0x3c], 0
je 0x748efc
cmp edi, dword [ebx + 0x40]
jbe 0x748efc
push dword [ebx + 0x3c]
call fcn.0074a940
pop ecx
xor edx, edx
mov dword [ebx + 0x3c], edx
cmp dword [ebx + 0x3c], 0
jne 0x748f13
mov ecx, edi
add ecx, ecx
push ecx
call fcn.0074a968
pop ecx
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], edi
push edi
push esi
push dword [ebx + 0x3c]
call fcn.0074a5cc
add esp, 0xc
xor esi, esi
cmp edi, esi
jbe 0x748f44
mov eax, dword [ebx + 0x3c]
mov dl, byte [eax + esi]
push edx
lea ecx, [ebx + 0x30]
push ecx
call fcn.00748997
add esp, 8
mov edx, dword [ebx + 0x3c]
mov byte [edx + esi], al
inc esi
cmp edi, esi
ja 0x748f26
mov eax, dword [ebx + 0x3c]
cmp dword [ebx + 0x20], 0
je 0x748f7c
mov ecx, dword [ebx + 0x24]
add ecx, edi
cmp ecx, dword [ebx + 0x28]
jb 0x748f62
mov dword [ebx + 0x14], 0x30000
xor eax, eax
jmp 0x748fa0
push edi
push eax
mov edx, dword [ebx + 0x20]
add edx, dword [ebx + 0x24]
push edx
call fcn.0074a5cc
add esp, 0xc
add dword [ebx + 0x24], edi
mov eax, edi
jmp 0x748fa0
cmp dword [ebx + 4], 0
je 0x748f97
push 0
lea edx, [ebp - 4]
push edx
push edi
push eax
push dword [ebx + 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 4]
jmp 0x748fa0
mov dword [ebx + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x749415
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x84], 0
je 0x749490
mov edx, dword [ebx + 0x8c]
cmp edx, dword [ebx + 0x88]
jb 0x749443
xor eax, eax
jmp 0x7494d9
mov esi, dword [ebx + 0x88]
sub esi, dword [ebx + 0x8c]
cmp esi, eax
jbe 0x749455
mov esi, eax
push esi
mov eax, dword [ebx + 0x84]
add eax, dword [ebx + 0x8c]
push eax
push edi
call fcn.0074a5cc
add esp, 0xc
add dword [ebx + 0x8c], esi
mov edx, dword [ebx + 0x74]
add edx, esi
mov dword [ebx + 0x74], edx
push esi
push edi
push dword [ebx + 0x78]
call fcn.0074880f
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, esi
jmp 0x7494d9
cmp dword [ebx + 0x7c], 0
je 0x7494d0
push 0
lea edx, [ebp - 4]
push edx
push eax
push edi
push dword [ebx + 0x7c]
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x7494ae
xor eax, eax
jmp 0x7494d9
mov edx, dword [ebx + 0x74]
add edx, dword [ebp - 4]
mov dword [ebx + 0x74], edx
push dword [ebp - 4]
push edi
push dword [ebx + 0x78]
call fcn.0074880f
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, dword [ebp - 4]
jmp 0x7494d9
mov dword [ebx + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x74f0d8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x74f5b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x804af8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x74f692
cmp dword [0x804af4], 0
jne 0x74f692
cmp dword [0x804b70], 0
je 0x74f64c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0074fefc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x74f632
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0074fefc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x74f632
lea ebx, [ebp - 0x84]
jmp 0x74f633
inc ebx
call fcn.0074f570
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA
jmp 0x74f6cd
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x804afc
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0074ade0
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x804aff
push ebx
call sub.kernel32.dll_WriteFile
jmp 0x74f6cd
cmp dword [0x804af4], 0
je 0x74f6ac
cmp dword [0x804af4], 0xffffffff
je 0x74f6cd
push esi
call dword [0x804af4]
pop ecx
mov eax, dword [0x804af8]
test eax, eax
je 0x74f6cd
cmp dword [0x804af8], 0xffffffff
je 0x74f6cd
cmp byte [eax], 0
je 0x74f6cd
push esi
push eax
call fcn.0074ffa4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x74ffa4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
jne 0x74ffd1
jmp 0x750008
call fcn.0074ff54
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0074ade0
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0074ade0
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x75aa08
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x75ab8c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, esi
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
lea eax, [ebp - 4]
mov ecx, 0x75aba8
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x75ab5b
cmp word [ebp - 0x230], 0x2e
jne 0x75aa9e
cmp word [ebp - 0x22e], 0
je 0x75ab46
cmp word [ebp - 0x22e], 0x2e
jne 0x75aab6
cmp word [ebp - 0x22c], 0
je 0x75ab46
test dword [ebp - 0x25c], edi
je 0x75aaf8
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebp - 0x25c], 0x10
setne al
test al, bl
je 0x75ab46
mov eax, dword [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 0x26c]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.0075aa08
pop ecx
lea eax, [ebp - 0x25c]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x75aa86
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75ab93
lea eax, [ebp - 0x26c]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret