joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5016fac0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x281], 0
jne 0x5016fb82
mov eax, dword [ebp - 4]
mov byte [eax + 0x280], 1
xor eax, eax
push ebp
push 0x5016fb5c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
xor edx, edx
call sym.vcl120.bpl__Controls_TControl_SetAlign_qqr15Controls_TAlign
mov eax, dword [ebp - 4]
mov byte [eax + 0x281], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x290], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + pe_nt_image_headers32]
mov edx, eax
mov eax, dword [ebp - 4]
call sym.vcl120.bpl__Controls_TControl_SetHeight_qqri
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016fb63
mov eax, dword [ebp - 4]
mov byte [eax + 0x280], 0
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x5017023c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x281], 0
je 0x50170314
mov eax, dword [ebp - 4]
mov byte [eax + 0x280], 1
xor eax, eax
push ebp
push 0x501702ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
mov dl, 5
call sym.vcl120.bpl__Controls_TControl_SetAlign_qqr15Controls_TAlign
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov byte [eax + 0x281], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x290]
mov eax, dword [ebp - 4]
call sym.vcl120.bpl__Controls_TControl_SetHeight_qqri
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2b4]
mov eax, dword [eax + 0x264]
call sym.vcl120.bpl__Forms_TControlScrollBar_IsScrollBarVisible_qqrv
test al, al
je 0x501702d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2b4]
mov edx, dword [ebp - 4]
call sym.vcl120.bpl__Forms_TScrollingWinControl_ScrollInView_qqrp17Controls_TControl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501702f5
mov eax, dword [ebp - 4]
mov byte [eax + 0x280], 0
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x501790ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or dword [esp + edx*2 + 0x72], edx
push esi
imul esp, dword [ebp + 0x77], 0x50178fc8
inc esp
invalid
Function at 0x5017d710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb dl, byte [eax - 0x34]
sbb byte [edx], dl
push eax
fcomp qword [eax]
adc dl, byte [eax + 1]
add bh, bh
call dword [edi + ecx*8]
sbb dl, byte [eax + 0xb]
push esp
dec esp
imul esi, dword [ebx + 0x74], 0x756f7247
jo 0x5017d77f
adc bh, dl
pop ss
push eax
pop es
or edx, dword [esp + ecx*2 + 0x69]
jae 0x5017d78b
inc edi
jb 0x5017d789
jne sym.vcl120.bpl__Comctrls_TListColumn_
jae 0x5017d6ee
salc
pop ss
push eax
adc al, 0x81
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017d7a0
insb byte es:[edi], dx
jae 0x5017d731
add byte [ebx + 0x17d78cc0], cl
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
lodsb al, byte [esi]
xlatb
pop ss
push eax
rcl bh, 1
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov esi, 0x345017d7
add byte [eax], al
add byte [eax], ah
and dword [eax + edx*2], sub.rtl120.bpl__System_TObject_Equals_qqrp14System_TObject
call 0x8067e979
adc dword [edx], edx
push eax
sub byte [ecx], dl
adc dl, byte [eax + 0x40]
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x44501210
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
inc esp
jb 0x5017d7a4
push eax
loopne 0x5017d816
sbb dword [eax - 0x74], edx
sbb byte [edx], dl
push eax
xchg esp, eax

Function at 0x5017d78c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
adc dl, byte [eax - 0x48]
jb 0x5017d7ac
push eax
or al, 0x77
sbb dword [eax - 0x80], edx
ja 0x5017d7b4
push eax
test byte [eax], bl
adc dl, byte [eax - 0x20]
je 0x5017d7bc
push eax
mov word [eax], ds
adc dl, byte [eax - 0x6c]
jno 0x5017d7c4
push eax
push cs
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esp + edi*2], ah
add byte [eax], al
and al, 0x7c
and al, 0x50
adc byte [eax], al
add byte [eax], al
or edx, dword [esp + ecx*2 + 0x69]
jae 0x5017d838
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
jne 0x5017d836
outsb dx, byte [esi]
mov eax, eax
rcl bh, 1
pop ss
push eax
and al, 0x7c
and al, 0x50
Function at 0x5017d7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or edx, dword [esp + ecx*2 + 0x69]
jae 0x5017d84b
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
jne 0x5017d849
outsb dx, byte [esi]
mov edi, ss
pop ss
push eax
sbb al, 0x81
and al, 0x50
or byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017d860
insb byte es:[edi], dx
jae 0x5017d7f9
add byte [ecx + eax*4 + 0xc5024], cl
add bh, bh
jo 0x5017d872
push dword [eax + 0x76]
sbb dword [eax + 1], edx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], al
add byte [eax], al
or dword [ecx + 0x6c], eax
imul esp, dword [edi + 0x6e], 0x746e656d
inc esp
jl 0x5017d83d
push eax
or eax, 0xa8ff0000
jbe 0x5017d83a
push eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
or byte [ecx + 0x75], al
je 0x5017d8a4
push ebx
imul edi, dword [edx + 0x65], sym.imp.rtl120.bpl___xp_13System_string
jl 0x5017d860
push eax
adc byte [eax], al
add bh, bh
pushfd
jne 0x5017d85d
push eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
add al, byte [eax]
pop es
inc ebx
popal
jo 0x5017d8cc
imul ebp, dword [edi + 0x6e], 0x501e507c
push ds
push eax
sbb al, 0
add bh, bh
fdiv qword [esi + 0x19]
push eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 1], al
add eax, dword [eax]
or cl, byte [ecx + 0x6d]
add byte [eax], al
invalid
inc dword [ebx]
add byte [edx], cl
dec ecx
insd dword es:[edi], dx
popal
dec ecx
outsb dx, byte [esi]
js 0x5017d881
rcl dword [edi], cl
push eax
adc al, 0
add bh, bh
in al, dx
jbe 0x5017d8a4
push eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
or byte [ebp + 0x61], cl
js 0x5017d8f6
imul esp, dword [esp + esi*2 + 0x68], 0x5017d300
rcl dword [edi], cl
push eax
sbb byte [eax], al
add bh, bh
cld
jbe 0x5017d8c7
push eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0x694d0800
outsb dx, byte [esi]
push edi
imul esp, dword [esp + esi*2 + 0x68], 0x50247c38
jl 0x5017d8ed
push eax
sub al, 0
add bh, bh
sub al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
push es
add byte [ebx], al
push esp
popal
add bl, dl
pop ss
push eax
les esi, [ebp + 0x19]
push eax
inc esp
jbe 0x5017d908
push eax
cmp al, 0x76
sbb dword [eax], edx
add byte [eax], al
xor byte [edx], 0
add byte [eax], al
add byte [eax + 0x32], al
pop es
add byte [0x74646957], al
push sym.vcl120.bpl__Comctrls_TListColumns_
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, byte [0x5017d9]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + ebx*8 - 0x2673afe9], al
pop ss
Function at 0x5017d95c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
and byte [eax], al
add byte [eax], al
sbb byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xb4501210
sbb byte [edx], dl
push eax
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
les ebx, [eax]
adc dl, byte [eax + 0x34]
sbb dword [edx], edx
push eax
cmp al, 0x19
adc dl, byte [eax + 0x44]
sbb dword [edx], edx
push eax
adc al, 0x19
adc dl, byte [eax + 0x28]
js 0x5017d994
push eax
int3
insb byte es:[edi], dx
jne 0x5017da04
outsb dx, byte [esi]
jae 0x5017d927
inc eax
add byte [eax + 0x75017d9], ah
pop es
inc edx
outsd dx, dword [esi]

Function at 0x5017d9c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul esi, dword [ebx + 0x74], 0x756c6f43
insd dword es:[edi], dx
outsb dx, byte [esi]
jae 0x5017da0b
fst dword [edi]
push eax
adc al, 0x81
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017da31
insb byte es:[edi], dx
jae 0x5017d9c2
add byte [eax + sym.vcl120.bpl___xp_21Comctrls_TDisplayCode], dl
add ecx, dword [esp + edx*2]
inc esp
imul esi, dword [ebx + 0x70], 0x4379616c
outsd dx, dword [esi]
add dword gs:[eax], eax
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add ah, al
fst dword [edi]
push eax
or byte [edx + esi*2 + 0x42], ah
outsd dx, dword [esi]
jne 0x5017da58
jae 0x5017d9f3
jb 0x5017da39
arpl word [edi + 0x6e], bp
pop es
jb 0x5017da43
popal
bound esp, qword [ebp + 0x6c]
push cs
jb 0x5017da52
insb byte es:[edi], dx
arpl word gs:[edx + eax*2 + 0x6f], si
jne 0x5017da76
jae 0x5017da13
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
inc ebx
je 0x5017da83
insb byte es:[edi], dx
jae 0x5017d9a4
nop
insb byte es:[edi], dx
ficom dword [edi]
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jl 0x5017d9fc
pop ss
push eax
pushfd
ficom dword [edi]
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ds, edx
pop ss
push eax
xor al, 0
add byte [eax], al
cmp byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
add byte [eax], al
add byte [esi + 0x345017da], cl
add byte [eax], al
add byte [eax], bh
and dword [eax + edx*2], sub.rtl120.bpl__System_TObject_Equals_qqrp14System_TObject
push eax
call 0x8067ec59
adc dword [edx], edx
push eax
sub byte [ecx], dl
adc dl, byte [eax + 0x40]
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x8501210
jg 0x5017da84
push eax
sbb dword [eax - 0x5c], edx
add byte [eax], al
and al, 0x7c
Function at 0x5017da6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
push 0xa4501985
jle 0x5017da94
push eax
push cs
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esp + edi*2], ah
and al, 0x50
and byte [eax], al
add byte [eax], al
or dword [esp + ecx*2 + 0x69], edx
jae 0x5017db08
dec ecx
je 0x5017dafc
insd dword es:[edi], dx
pushfd
ficom dword [edi]
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
rcl byte [eax]
adc dl, byte [eax + 0x14]
adc al, 0x54

Function at 0x5017da9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or dword [esp + ecx*2 + 0x69], edx
jae 0x5017db17
dec ecx
je 0x5017db0b
insd dword es:[edi], dx
insb byte es:[edi], dx
ficom dword [edi]
push eax
xor al, 0x81
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017db2a
insb byte es:[edi], dx

Function at 0x5017db14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jb 0x5017db25
jae 0x5017dabb
add byte [ebx + ebx*8], dl
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc al, 0xdb
pop ss
push eax
adc byte [eax], al
add byte [eax], al
adc byte [esp + 0x50], bh
loopne 0x5017dafa
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
adc dl, byte [eax + 0x48]
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xd0501210
adc byte [edx], dl
push eax
adc al, 0x54
dec esp
imul esi, dword [ebx + 0x74], 0x6d657449
jae 0x5017db65
outsb dx, byte [esi]
jne 0x5017db90
jb 0x5017db87
popal
je 0x5017db97
jb 0x5017dab7
inc eax
add byte [eax], dh
fist dword [edi]
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dl
fist dword [edi]
push eax
loopne 0x5017db9a
adc dl, byte [eax + 0x48]

Function at 0x5017db30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc al, 0x54
dec esp
imul esi, dword [ebx + 0x74], 0x6d657449
jae 0x5017db82
outsb dx, byte [esi]
jne 0x5017dbad
jb 0x5017dba4
je sym.vcl120.bpl__Comctrls_TListItems_
jb 0x5017db5b
fist dword [edi]
push eax
or al, 0x7c
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017dbc9
insb byte es:[edi], dx
jae 0x5017db5a
add byte [eax + sym.vcl120.bpl__Comctrls_TListItems_], dl
nop
adc byte [edx], dl
push eax
or byte [eax + 0x181c5019], 0x12
sbb al, 0x18
adc dl, byte [eax - 0x7c]
lea ebx, [ecx]
push eax
xchg esp, eax
mov word [ecx], ds
push eax
or dl, byte [esp + ecx*2 + 0x69]
jae 0x5017dc3a
dec ecx
je 0x5017dc2e
insd dword es:[edi], dx
Function at 0x5017dbb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ah, 0xdb
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
rcr bl, 1
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
rcr bl, 0x17
push eax
adc al, 0
add byte [eax], al
cmp byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
sbb al, 0x18
adc dl, byte [eax - 0x7c]
lea ebx, [ecx]
push eax
xchg esp, eax
mov word [ecx], ds
push eax
or dl, byte [esp + ecx*2 + 0x69]
jae 0x5017dc3a
dec ecx
je 0x5017dc2e
insd dword es:[edi], dx
jae 0x5017db5c
rcr bl, 1
pop ss
push eax
adc dl, byte [eax + 0x40]
adc dl, byte [eax + 0x38]
adc dword [edx], edx

Function at 0x5017dbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [edx], edx
push eax
sub byte [ecx], dl
adc dl, byte [eax + 0x40]
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x80501210
mov byte [ecx], bl
push eax
pop es
or dl, byte [esp + ecx*2 + 0x69]
jae 0x5017dc4b
dec ecx
je 0x5017dc3f
insd dword es:[edi], dx
jae 0x5017db91
fist dword [edi]
push eax
xor al, 0x81
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017dc5f
insb byte es:[edi], dx
jae 0x5017dbf0
add byte [ebp - 0x23b3ffc0], cl
pop ss
inc eax
add byte [esp + ebx*8 + 0x17], cl
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
fcom qword [edi]
push eax
mov esp, ds
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jle 0x5017dbf2
pop ss
push eax
sub byte [eax], al
add byte [eax], al
and byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x64501210
sbb byte [edx], dl
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
sbb byte fs:[edx], dl
push eax
push eax
xchg esp, eax

Function at 0x5017dc4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
adc al, 0x18
adc dl, byte [eax - 0x64]
jns 0x5017dc74
push eax
test byte [eax], bl
adc dl, byte [eax - 0x6c]
sbb byte [edx], dl
push eax
mov esp, 0x54501979
jns 0x5017dc84
push eax
push cs
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esp + edi*2], ah
add byte [eax], al
and al, 0x7c
and al, 0x50
sbb al, 0
add byte [eax], al
or dword [edi + edx*2 + 0x6f], edx
jb 0x5017dcef
inc ecx
jb 0x5017dcec
popal
mov esp, ds
pop ss
push eax
Function at 0x5017dc8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or dword [edi + edx*2 + 0x6f], edx
jb 0x5017dcfe
inc ecx
jb 0x5017dcfb
popal
dec esp
fcom qword [edi]
push eax
sbb al, 0x81
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017dd1a
insb byte es:[edi], dx
jae 0x5017dcab
add byte [ebx*8 + 0x5017], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp al, 0xdd
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc dl, byte [eax - 0x4c]
adc dl, byte [eax + 0x14]
sbb dword [edx], edx
push eax
and byte [edx + 0x19], bh

Function at 0x5017dd04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
les ebx, [eax]
adc dl, byte [eax + 0x34]
sbb dword [edx], edx
push eax
cmp al, 0x19
adc dl, byte [eax + 0x44]
sbb dword [edx], edx
push eax
adc al, 0x19
adc dl, byte [eax + 0x20]
jp sym.vcl120.bpl___xp_19Comctrls_TWorkAreas
push eax
int3

Function at 0x5017dd3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or dl, byte [edi + edx*2 + 0x6f]
jb 0x5017ddae
inc ecx
jb 0x5017ddab
popal
jae 0x5017dd4d
fst qword [edi]
push eax
or al, 0x81
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
and dword [eax + edx*2], 0x43080000
outsd dx, dword [esi]
insd dword es:[edi], dx
inc ebx
je 0x5017ddcb
insb byte es:[edi], dx
jae 0x5017dd5c
add byte [ebp - 0x229bffc0], cl
pop ss
push eax
add byte [esi + ebx*8], dl
push eax
call 0x8067efe1
adc dword [edx], edx
push eax
sub byte [ecx], dl
adc dl, byte [eax + 0x40]
Function at 0x5017dd64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
sub al, 0xdd
pop ss
push eax
and byte [eax], al
add byte [eax], al
adc byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xb4501210
sbb byte [edx], dl
push eax
push eax
fcomp qword [eax]
adc dl, byte [eax + 0xa]
push esp
push edi
outsd dx, dword [esi]
jb 0x5017dd9d
inc ecx
jb 0x5017dd9a
popal
jae 0x5017dcc8
cmp al, 0xdd
pop ss
push eax
add edx, dword [eax]
push esp
dec ecx
arpl word [edi + 0x6e], bp
inc ecx
jb 0x5017dde0
popal
outsb dx, byte [esi]
insd dword es:[di], dx
outsb dx, byte gs:[esi]
je 0x5017dd78
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
pushal
fst qword [edi]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax - 0x23], ah
pop ss
push eax
add eax, 0x6f546169
jo 0x5017dd90
imul esp, dword [ecx + 0x4c], 0x8746665
inc ebx
outsd dx, dword [esi]
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x5017de09
insb byte es:[edi], dx
jae 0x5017dd27
inc eax
add ah, dh
fst qword [edi]
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc al, 0xde
pop ss
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dh, bl
pop ss
push eax
adc byte [eax], al
add byte [eax], al
cmp byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xc501210
sbb byte [edx], dl
push eax
Function at 0x50182910
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax], al
add byte [eax], al
sbb byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xc501210
sbb dl, byte [eax + 0x1c]
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
les ebx, [eax]
adc dl, byte [eax + 0x34]
sbb dword [edx], edx
push eax
cmp al, 0x19
adc dl, byte [eax + 0x44]
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
les ebx, [eax]
adc dl, byte [eax + 0x34]
sbb dword [edx], edx
push eax
cmp al, 0x19
adc dl, byte [eax + 0x44]
sbb dword [edx], edx
push eax
adc al, 0x19
adc dl, byte [eax - 0x2c]
sbb dl, byte [eax - 0x34]
sbb byte [edx], dl
push eax
fcomp qword [eax]
adc dl, byte [eax + 1]
add bh, bh
dec eax
sbb dl, byte [eax + 0xa]
push esp
inc ebx
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
inc edx
popal
outsb dx, byte [esi]
jae 0x501828dc

Function at 0x5018902c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov eax, ebx
mov si, 0xffb3
call sub.rtl120.bpl__System__CallDynaInst_qqrv
test al, al
jne 0x50189059
call sub.user32.dll_GetFocus
push eax
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_IsChild
test eax, eax
je 0x5018908b
cmp word [edi + 4], 9
jne 0x5018908b
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5018908b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setge dl
mov cl, 1
mov eax, ebx
call sym.vcl120.bpl__Comctrls_TPageControl_SelectNextPage_qqroo
mov dword [edi + 0xc], 1
jmp 0x50189094
mov edx, edi
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_CMDialogKey_qqrr15Messages_TWMKey
pop edi
pop esi
pop ebx
ret

Function at 0x50193490
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
add esp, 0xffffff88
mov ebx, eax
movzx eax, byte [0x50193548]
mov byte [esp], al
mov eax, dword [ebx + 4]
call sym.vcl120.bpl__Controls_TWinControl_HandleAllocated_qqrv
test al, al
je 0x5019353d
cmp byte [ebx + 8], 0
jne 0x5019353d
lea edx, [esp + 4]
mov eax, ebx
call sym.vcl120.bpl__Comctrls_TTextAttributes_InitFormat_qqrr22Richedit__CHARFORMAT2W
lea eax, [esp + 4]
push eax
push 1
mov eax, dword [ebx + 4]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
cmp byte [ebx + 8], 0
sete cl
and ecx, 0x7f
mov edx, 0x43a
call fcn.50123184
mov ebx, dword [esp + 8]
test bl, 1
je 0x501934f5
or byte [esp], 1
test ebx, 0x40000000
je 0x50193501
or byte [esp], 2
test ebx, 0x20000000
je 0x5019350d
or byte [esp], 4
test bl, 2
je 0x50193516
or byte [esp], 8
test ebx, 0x80000000
je 0x50193522
or byte [esp], 0x10
test bl, 8
je 0x5019352b
or byte [esp], 0x20
test bl, 4
je 0x50193534
or byte [esp], 0x40
test bl, 0x10
je 0x5019353d
or byte [esp], 0x80
movzx eax, byte [esp]
add esp, 0x78
pop ebx
ret
Function at 0x501a55a8
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x5024513c], 0
jne 0x501a55cb
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x501a551c
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5024513c], eax
ret