joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c924
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x43ca1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jl 0x43c9fc
mov dword [ebp - 8], 0xf
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl170.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetComputerNameW
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl170.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x43c9fc
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call sub.rtl170.bpl__System_Sysutils_AnsiUpperCase_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x10]
mov edx, 0x43ca3c
call sub.rtl170.bpl__System__UStrEqual_qqrv
jne 0x43c9c6
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x20]
jmp 0x43c9f6
push dword [ebp - 4]
push 0x43ca60
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 3
call sub.rtl170.bpl__System__UStrCatN_qqrv
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec dword [ebp - 0xc]
jne 0x43c992
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ca26
lea eax, [ebp - 0x1c]
mov edx, 4
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl170.bpl__System__UStrClr_qqrpv
ret
Function at 0x44392c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrClr_qqrpv
push 0
push 0
push 0x443980
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x443979
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call sub.rtl170.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x443980
call sub.kernel32.dll_GetEnvironmentVariableW
pop ecx
pop ecx
pop ebp
ret
Function at 0x4486f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x448893
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00448fc0
mov eax, dword [sym.imp.rtl170.bpl__System_IsLibrary]
cmp byte [eax], 0
jne 0x44871e
call fcn.00448ba4
mov byte [0x5e5779], 0
mov eax, dword [0x5e5794]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
dec eax
jle 0x4487ec
cmp dword [0x5e5788], 0
je 0x4487ec
lea eax, [ebp - 4]
call fcn.0044392c
lea edx, [ebp - 0x10]
mov eax, dword [0x5e5760]
call sub.rtl170.bpl__System_Sysutils_ExtractFileDir_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4488ac
call sub.rtl170.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System_Pos_qqrx20System_UnicodeStringt1i
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4487ec
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrLen_qqrx20System_UnicodeString
mov ebx, eax
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__UStrLen_qqrx20System_UnicodeString
sub ebx, eax
sub ebx, dword [ebp - 0xc]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
pop ecx
call sub.rtl170.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call sub.rtl170.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x4488b0
call sub.kernel32.dll_SetEnvironmentVariableW
cmp dword [0x5e57a8], 0
jbe 0x448807
mov eax, dword [0x5e57a8]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x5e57a8], eax
cmp dword [0x5e57ac], 0
jbe 0x448822
mov eax, dword [0x5e57ac]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x5e57ac], eax
mov byte [0x5e57a4], 0
mov eax, 0x5e5760
call sub.rtl170.bpl__System__UStrClr_qqrpv
mov eax, 0x5e5764
call sub.rtl170.bpl__System__UStrClr_qqrpv
mov eax, 0x5e5768
call sub.rtl170.bpl__System__UStrClr_qqrpv
mov word [0x5e576c], 0
mov byte [0x5e576e], 0
mov al, byte [0x4488bc]
mov byte [0x5e576f], al
mov eax, 0x5e5788
call sub.rtl170.bpl__System__UStrClr_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44889a
lea eax, [ebp - 0x18]
mov edx, 3
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x44feb4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0x67452301
mov dword [eax + 0x18], 0xefcdab89
mov dword [eax + 0x1c], 0x98badcfe
mov dword [eax + 0x20], 0x10325476
call fcn.0044f4f0
pop ebp
ret
Function at 0x4512b4
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0x67452301
mov dword [eax + 0x18], 0xefcdab89
mov dword [eax + 0x1c], 0x98badcfe
mov dword [eax + 0x20], 0x10325476
mov dword [eax + 0x24], 0xc3d2e1f0
call fcn.00450088
pop ebp
ret

Function at 0x451610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
xor eax, eax
push ebp
push 0x4516c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, ebx
mov ecx, 1
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
mov edx, eax
dec edx
test edx, edx
jl 0x45167e
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
mov esi, dword [ebp - 8]
xor cl, byte [esi + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x451668
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
push eax
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__DynArrayLength_qqrpxv
mov edx, eax
dec edx
pop eax
sub edx, eax
jl 0x4516a8
inc edx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x451698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4516d0
lea eax, [ebp - 8]
mov edx, dword [0x418ccc]
mov ecx, 2
call sub.rtl170.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x45e968
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
mov eax, dword [ebp + 0x10]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
xor eax, eax
push ebp
push 0x45eb75
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x44ebb4]
call fcn.0044f4b0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45eb2c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp edi, 0x939
jne 0x45ea1c
push 0x10
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArraySetLength_qqrv
add esp, 4
xor eax, eax
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
lea ecx, [esi + eax]
mov edi, dword [ebp + 0x10]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x45e9e2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0044fee8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
call fcn.0044ff88
jmp 0x45eb16
cmp edi, 0x1b25
jne 0x45eb08
push 0x18
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArraySetLength_qqrv
add esp, 4
push 0x18
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArraySetLength_qqrv
add esp, 4
xor eax, eax
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
lea ecx, [esi + eax]
mov edi, dword [ebp + 0x10]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x18
jne 0x45ea5a
push 0x10
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, dword [0x418ccc]
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__DynArrayCopyRange_qqrpvt1iirpv
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0044fee8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0044ff88
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0x10
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [sym.imp.dac170.bpl__Clrclasses_Buffer_]
call sub.dac170.bpl__Clrclasses_Buffer_BlockCopy_qqrx25System__DynamicArray_tuc_it1ii
push 8
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10
mov edx, dword [0x418ccc]
mov eax, dword [ebp - 8]
call sub.rtl170.bpl__System__DynArrayCopyRange_qqrpvt1iirpv
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.0044fee8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0044ff88
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0x10
push 8
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [sym.imp.dac170.bpl__Clrclasses_Buffer_]
call sub.dac170.bpl__Clrclasses_Buffer_BlockCopy_qqrx25System__DynamicArray_tuc_it1ii
jmp 0x45eb16
mov eax, dword [ebp + 8]
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArrayClear_qqrrpvpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eb33
mov eax, dword [ebp - 0x10]
call sub.rtl170.bpl__System_TObject_Free_qqrv
ret
Function at 0x45f354
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
xor ecx, ecx
mov dword [ebp - 0x208], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x45f3d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call sub.rtl170.bpl__System__LStrClr_qqrpv
mov dword [ebp - 4], 0x200
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x45f3c0
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call sub.rtl170.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov edx, dword [ebp - 0x208]
mov eax, ebx
mov ecx, 0
call sub.rtl170.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f3e0
lea eax, [ebp - 0x208]
call sub.rtl170.bpl__System__UStrClr_qqrpv
ret
Function at 0x464ff8
Capabilities:
Access peb ldr_data
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x46519c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x3c], 0x2328
jge 0x465035
mov eax, dword [0x5e36f8]
mov byte [eax], 0
jmp 0x465181
lea eax, [ebp - 4]
mov edx, 0x4651b8
call sub.rtl170.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [0x5e3a1c]
mov eax, dword [eax]
call sub.dac170.bpl__Memutils_GetGCHandleTarget_qqrpv
mov ecx, eax
mov dl, 1
mov eax, dword [0x44c538]
call fcn.00465eac
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x16]
call sub.dac170.bpl__Memutils_OrdinalToPtr_qqrrus
mov esi, eax
mov edx, 0x3e8
mov eax, dword [sym.imp.dac170.bpl__Clrclasses_Marshal_]
call sub.dac170.bpl__Clrclasses_Marshal_AllocHGlobal_qqri
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x46517a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
add eax, 0x28
mov edx, dword [ebp - 4]
call sub.rtl170.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 0xc]
mov word [eax + 0x30], 8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x44bd30]
call fcn.0046223c
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x20]
mov edx, ebx
call sub.rtl170.bpl__System_Classes_TList_Add_qqrpv
lea eax, [ebx + 0xc]
mov edx, 0x465318
call sub.rtl170.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
push 1
mov eax, dword [ebp - 0x14]
push eax
push 0x3e8
push 9
push 0
push esi
push 0
push 0
lea edx, [ebp - 0x10]
mov ecx, edi
mov eax, dword [ebp - 0xc]
call fcn.00469b14
xor edx, edx
call fcn.00449470
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00469b98
xor edx, edx
call fcn.00449470
lea edx, [ebp - 0x16]
mov eax, esi
call sub.dac170.bpl__Memutils_PtrToOrdinal_qqrpvrus
lea eax, [ebp - 8]
push eax
movzx ecx, word [ebp - 0x16]
mov edx, dword [ebp - 0x14]
mov eax, dword [sym.imp.dac170.bpl__Clrclasses_Marshal_]
call sub.dac170.bpl__Clrclasses_Marshal_PtrToStringAnsi_qqrpvi
mov eax, dword [ebp - 8]
mov edx, 0x465328
call sub.rtl170.bpl__System__LStrEqual_qqrv
je 0x46514f
mov eax, dword [0x5e36f8]
mov byte [eax], 1
jmp 0x465157
mov eax, dword [0x5e36f8]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465181
mov edx, dword [ebp - 0x14]
mov eax, dword [sym.imp.dac170.bpl__Clrclasses_Marshal_]
call sub.dac170.bpl__Clrclasses_Marshal_FreeHGlobal_qqrpv
mov eax, dword [ebp - 0xc]
call sub.rtl170.bpl__System_TObject_Free_qqrv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4651a3
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl170.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x46c9dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x46cb87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5e3a1c]
mov eax, dword [eax]
call sub.dac170.bpl__Memutils_GetGCHandleTarget_qqrpv
mov ecx, eax
mov dl, 1
mov eax, dword [0x44c538]
call fcn.00465eac
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], 0
je 0x46ca38
lea eax, [ebp - 8]
mov edx, 0x46cba8
call sub.rtl170.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
jmp 0x46ca45
lea eax, [ebp - 8]
mov edx, 0x46cbbc
call sub.rtl170.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
cmp bl, 2
je 0x46ca4f
cmp bl, 3
jne 0x46ca6f
mov si, 0x70
push 0x46cbd0
push dword [ebp - 8]
push 0x46cc18
lea eax, [ebp - 4]
mov edx, 3
call sub.rtl170.bpl__System__LStrCatN_qqrv
jmp 0x46ca8d
mov si, 0x71
push 0x46cc38
push dword [ebp - 8]
push 0x46cc18
lea eax, [ebp - 4]
mov edx, 3
call sub.rtl170.bpl__System__LStrCatN_qqrv
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov edx, dword [ebp - 4]
call sub.rtl170.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 0x14]
mov word [eax + 0x30], 8
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x44bd30]
call fcn.0046223c
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
mov edx, ebx
call sub.rtl170.bpl__System_Classes_TList_Add_qqrpv
lea eax, [ebx + 0xc]
mov edx, 0x46cc80
call sub.rtl170.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 0xc]
call fcn.004622d4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
call sub.dac170.bpl__Memutils_OrdinalToPtr_qqrrpv
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x46cb5c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 0x1c]
push eax
push 4
push esi
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x20]
mov ecx, edi
mov eax, dword [ebp - 0x14]
call fcn.00469b14
xor edx, edx
call fcn.00449470
mov eax, dword [ebp - 0x10]
call sub.dac170.bpl__Memutils_GetGCHandleTarget_qqrpv
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0x14]
call fcn.00469b98
xor edx, edx
call fcn.00449470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cb63
mov eax, dword [ebp - 0x14]
call sub.rtl170.bpl__System_TObject_Free_qqrv
mov eax, dword [ebp - 0x1c]
call sub.dac170.bpl__Memutils_FreeOrdinal_qqrpv
ret
Function at 0x46d038
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x46d04a
add esp, 0xfffffff0
call sub.rtl170.bpl__System__ClassCreate_qqrpvzc
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x10]
call sub.rtl170.bpl__System__DynArrayAddRef_qqrpv
xor eax, eax
push ebp
push 0x46d0ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call sub.rtl170.bpl__System_TObject__bctr_qqrv
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x18]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
lea eax, [edi + 0x28]
mov edx, dword [ebp + 0x10]
mov ecx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArrayAsg_qqrrpvpvt2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x14]
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArrayClear_qqrrpvpv
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x18], eax
mov byte [edi + 0xd], 0
mov byte [edi + 0xc], 0
mov word [edi + 0xe], 0
xor eax, eax
mov dword [edi + 0x20], eax
mov word [edi + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d0f4
lea eax, [ebp + 0x10]
mov edx, dword [0x418ccc]
call sub.rtl170.bpl__System__DynArrayClear_qqrrpvpv
ret

Function at 0x492f80
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, ecx
mov esi, edx
push 0
mov eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_TerminateThread
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x492faf
mov eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi], eax
test bl, bl
je 0x492fcf
push 1
push 0x400
push 0x400
mov eax, dword [0x5df9cc]
push eax
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageW
mov al, 1
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x4b70c8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4b70d0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b7211
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, 0x4b722c
mov eax, esi
call sub.rtl170.bpl__System_Classes_TStrings_GetValue_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call sub.rtl170.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
lea ecx, [ebp - 0x18]
mov edx, 0x4b7258
mov eax, esi
call sub.rtl170.bpl__System_Classes_TStrings_GetValue_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call sub.rtl170.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
lea ecx, [ebp - 0x20]
mov edx, 0x4b7280
mov eax, esi
call sub.rtl170.bpl__System_Classes_TStrings_GetValue_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call sub.rtl170.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
call sub.dac170.bpl__Crfunctions__UpperCase_qqrx20System_UnicodeString
lea eax, [ebp - 4]
call sub.rtl170.bpl__System__UStrClr_qqrpv
mov eax, dword [ebp - 0x10]
mov edx, 0x4b7298
call sub.rtl170.bpl__System__UStrEqual_qqrv
je 0x4b7172
mov eax, dword [ebp - 8]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x4b72b0
mov eax, ebx
call sub.dac170.bpl__Craccess_TCRMetaData_AddWhere_qqrr20System_UnicodeStringx20System_UnicodeStringt2o
jmp 0x4b7198
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x19c]
call fcn.004906d8
mov eax, dword [ebp - 0x24]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x4b72b0
mov eax, ebx
call sub.dac170.bpl__Craccess_TCRMetaData_AddWhere_qqrr20System_UnicodeStringx20System_UnicodeStringt2o
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x4b72c8
mov eax, ebx
call sub.dac170.bpl__Craccess_TCRMetaData_AddWhere_qqrr20System_UnicodeStringx20System_UnicodeStringt2o
cmp dword [ebp - 4], 0
je 0x4b71c0
lea eax, [ebp - 4]
mov edx, 0x4b72ec
call sub.rtl170.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0x11
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x4b7304
call sub.dac170.bpl__Crfunctions__Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1bc]
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x60]
mov ebx, dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7218
lea eax, [ebp - 0x28]
mov edx, 0xa
call sub.rtl170.bpl__System__UStrArrayClr_qqrpvi
ret