joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b42c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 0xc]
xor esi, esi
call dword [0x1002e0e0]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffffff
je 0x1000b516
push edi
push ebx
call dword [0x1002e110]
mov ecx, 0x19000
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x1000b477
mov dword [ebp - 4], ecx
push dword [ebp - 4]
call fcn.10001029
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1000b50b
push 9
push 8
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10018cf2
add esp, 0x28
test eax, eax
jne 0x1000b502
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
mov ebx, dword [0x1002e104]
jmp 0x1000b4e8
cmp dword [ebp + 0x10], edi
je 0x1000b4f3
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1001838d
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x1000b4f3
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
mov dword [ebp + 0x10], edi
call ebx
mov esi, eax
cmp esi, edi
jne 0x1000b4bb
push dword [ebp + 8]
call fcn.1001863a
pop ecx
test eax, eax
je 0x1000b502
xor esi, esi
push dword [ebp - 8]
call fcn.1001c2a4
pop ecx
push dword [ebp - 0xc]
call dword [0x1002e0d8]
jmp 0x1000b537
call dword [0x1002e128]
cmp eax, 2
je 0x1000b534
cmp eax, 3
je 0x1000b534
push dword [ebp + 0xc]
call dword [0x1002e1a8]
cmp eax, 0xffffffff
jne 0x1000b537
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1001244b
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0xc]
push fcn.100123bc
push eax
push eax
call fcn.1001ce74
add esp, 0x18
ret

Function at 0x10012ab5
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [0x10039854], edi
je 0x10012b39
cmp dword [0x1003995c], edi
je 0x10012b39
xor eax, eax
inc eax
push esi
cmp dword [0x10037098], eax
jne 0x10012b0a
mov dword [0x10038dfc], eax
call fcn.1001163d
push 0x50
mov esi, eax
call fcn.10001000
pop ecx
cmp eax, edi
je 0x10012afb
push esi
mov ecx, eax
call fcn.10013487
mov dword [0x10039644], eax
jmp 0x10012b01
mov dword [0x10039644], edi
push esi
call fcn.10011691
pop ecx
jmp 0x10012b10
mov dword [0x10038dfc], edi
push edi
push edi
push edi
push 0x10012a80
push edi
push edi
call fcn.1001ce74
mov esi, eax
add esp, 0x18
cmp esi, edi
je 0x10012b38
push 0xffffffffffffffff
push esi
call dword [0x1002e0fc]
push esi
call dword [0x1002e0d8]
pop esi
pop edi
ret

Function at 0x10017a5b
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret
Function at 0x10017ad6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100370fc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
jge 0x10017b09
xor eax, eax
jmp 0x10017c0a
inc dword [0x10039ba0]
cmp dword [0x10039ba0], 1
jne 0x10017b2c
push 0
call fcn.1001fafb
xor eax, 0xbb40e64e
push eax
call fcn.1001fb4c
pop ecx
pop ecx
push edi
mov ecx, ebx
mov eax, esi
call fcn.10017a9e
add esp, 4
xor esi, esi
call fcn.1001fb5e
mov ebx, eax
mov eax, dword [ebp - 0x14]
sar ebx, 7
and ebx, 0xff
call fcn.10017a3e
mov ecx, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x18], eax
call fcn.10017a5b
xor bl, byte [ebp - 0x18]
add esp, 4
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xa
jl 0x10017b3b
mov eax, dword [ebp - 0x20]
push edi
call fcn.10017a9e
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
add esp, 4
xor esi, esi
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
call fcn.10017a3e
mov bl, byte [ebp + esi - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
movzx eax, bl
push eax
call fcn.10017a5b
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add eax, esi
add esp, 4
inc esi
cmp esi, 0xa
mov byte [ebp + eax - 0x10], bl
jl 0x10017b88
mov eax, ecx
call fcn.10017a3e
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
shr ebx, 0x10
mov eax, ebx
and eax, 0xff
push eax
call fcn.10017a5b
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov byte [eax + esi], bl
mov eax, ecx
inc esi
call fcn.10017a3e
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
shr ebx, 0x18
push ebx
mov dword [ebp - 0x18], eax
call fcn.10017a5b
mov eax, dword [ebp - 0x1c]
add esp, 8
xor bl, byte [ebp - 0x18]
mov byte [eax + esi], bl
lea eax, [esi + 1]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c1d7
leave
ret

Function at 0x10018305
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x4090], eax
je 0x10018365
cmp dword [esi + 0x6c], eax
jbe 0x10018365
push ebx
mov dword [ebp - 4], 0xffffff78
sub dword [ebp - 4], esi
push edi
lea ebx, [esi + 0x88]
lea edx, [esi + 0x4094]
mov eax, edx
call fcn.10017a3e
mov edi, dword [esi + 0x40a0]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
push eax
mov ecx, edx
call fcn.10017a5b
mov al, byte [ebp - 0xc]
xor byte [ebx], al
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x1001832f
pop edi
pop ebx
push dword [esi + 0x6c]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, dword [esi + 0x6c]
je 0x10018384
or dword [ebp - 8], 0xffffffff
and dword [esi + 0x6c], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x1001846f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x10018483
push 0xffffffffffffff9a
pop eax
jmp 0x10018637
cmp dword [ebx + 0x2c], edi
je 0x1001847b
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x100184e0
cmp dword [ebx + 0x84], edi
jne 0x100184e0
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x100184be
mov esi, ebx
call fcn.10018305
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
push ebp
call fcn.10018e90
mov edi, eax
mov eax, dword [ebx + 0x44]
sub eax, esi
add dword [ebx + 0x6c], eax
pop ecx
pop ecx
test edi, edi
je 0x100184a1
cmp edi, 1
jne 0x100184e0
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x100184f8
test edi, edi
jne 0x100184f8
mov esi, ebx
call fcn.10018305
cmp eax, 0xffffffff
jne 0x100184f8
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x1001851a
cmp dword [ebx + 0x84], 0
jne 0x10018534
lea eax, [ebx + 0x30]
push eax
call fcn.10019601
and dword [ebx + 0x68], 0
pop ecx
mov edi, eax
cmp dword [ebx + 0x84], 0
jne 0x10018534
mov eax, dword [ebx + 0x408c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x18], eax
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0x1c]
add ebp, dword [ebx + 0x44]
push 4
add esi, 0x10
pop edx
call fcn.10017d2c
mov esi, dword [ebx + 0x74]
push 4
add esi, 0x14
pop edx
mov ecx, ebp
call fcn.10017d2c
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x5c], ecx
jne 0x10018575
mov esi, dword [ebx + 0x74]
push 2
add esi, 0x24
pop edx
call fcn.10017d2c
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x18]
push 4
add esi, 0x18
pop edx
call fcn.10017d2c
test edi, edi
jne 0x1001859d
push dword [ebx + 0x78]
lea edi, [ebx + 0x24]
push dword [ebx + 0x74]
call fcn.10017c55
pop ecx
pop ecx
mov edi, eax
push dword [ebx + 0x74]
call fcn.1001f291
pop ecx
test edi, edi
jne 0x10018629
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x18
test eax, eax
je 0x100185d4
or edi, 0xffffffff
jmp 0x10018610
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x20]
push 4
pop esi
mov edi, ebx
call fcn.10017ce3
mov edi, eax
pop ecx
test edi, edi
jne 0x10018610
push dword [ebx + 0x20]
mov ecx, ebp
mov edi, ebx
call fcn.10017ce3
mov edi, eax
pop ecx
test edi, edi
jne 0x10018610
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x1c]
mov edi, ebx
call fcn.10017ce3
pop ecx
mov edi, eax
push 0
push dword [esp + 0x18]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x10
test eax, eax
je 0x10018629
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
and dword [ebx + 0x2c], 0
pop esi
mov eax, edi
pop ebp
pop edi
pop ebx
ret
Function at 0x1001864b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x10018669
push 0xffffffffffffff9a
pop eax
jmp 0x100187f5
cmp dword [edi + 0x2c], 1
jne 0x10018678
push edi
call fcn.1001863a
pop ecx
mov ebx, eax
cmp dword [ebp + 0xc], esi
jne 0x1001868f
mov eax, dword [edi + 0x40b4]
mov dword [ebp + 0xc], eax
cmp eax, esi
jne 0x1001868f
mov dword [ebp + 8], esi
jmp 0x1001869b
push dword [ebp + 0xc]
call fcn.1001c840
pop ecx
mov dword [ebp + 8], eax
push dword [edi + 0x20]
push dword [edi + 0x1c]
call dword [edi + 0xc]
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x100186e2
mov esi, dword [edi + 0x24]
jmp 0x100186de
test ebx, ebx
jne 0x100186d6
mov eax, dword [esi + 8]
test eax, eax
jbe 0x100186d6
push eax
lea eax, [esi + 0x10]
push eax
push dword [edi + 0x20]
push dword [edi + 0x1c]
call dword [edi + 8]
add esp, 0x10
cmp eax, dword [esi + 8]
je 0x100186d6
or ebx, 0xffffffff
mov eax, dword [esi + 8]
add dword [ebp - 4], eax
mov esi, dword [esi]
test esi, esi
jne 0x100186b2
mov eax, dword [edi + 0x24]
call fcn.10017c37
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
mov ecx, 0x6054b50
push 4
pop esi
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
xor ecx, ecx
push 2
pop esi
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
xor ecx, ecx
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
mov ecx, dword [edi + 0x40b0]
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
mov ecx, dword [edi + 0x40b0]
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
mov ecx, dword [ebp - 4]
push 4
pop esi
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
mov ecx, dword [ebp - 8]
sub ecx, dword [edi + 0x40ac]
push dword [edi + 0x20]
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
push dword [edi + 0x20]
mov ecx, dword [ebp + 8]
push 2
pop esi
call fcn.10017ce3
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100187c5
cmp dword [ebp + 8], eax
jbe 0x100187c5
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [edi + 0x20]
push dword [edi + 0x1c]
call dword [edi + 8]
add esp, 0x10
cmp eax, dword [ebp + 8]
je 0x100187c5
or ebx, 0xffffffff
push dword [edi + 0x20]
push dword [edi + 0x1c]
call dword [edi + 0x14]
pop ecx
pop ecx
test eax, eax
je 0x100187db
test ebx, ebx
jne 0x100187db
or ebx, 0xffffffff
mov eax, dword [edi + 0x40b4]
test eax, eax
je 0x100187ec
push eax
call fcn.1001f291
pop ecx
push edi
call fcn.1001f291
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10019960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x100199e5
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.1001c8d0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x100199a8
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x100199ca
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x10019a40
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.100196ae
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
pop ecx
pop ecx
cmp esi, 3
jb 0x10019a2c
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x10019a40
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10019969
pop esi
pop ebx
leave
ret
Function at 0x407548
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40758c
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40755b
jmp 0x40758c
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40757c
pop esi
pop ebp
ret

Function at 0x40801a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40804f
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x408079
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x408079
test edi, edi
je 0x408046
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408046
test edi, edi
je 0x408081
mov eax, edi
jmp 0x408048
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x408048
int3
Function at 0x40a462
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize], eax
call fcn.0040801a
pop ecx
mov ecx, dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize]
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40a49a
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x419375c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
mov edx, dword [0x4192988]
call sub.rtl60.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x41938a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, dword [0x41b8f80]
call sub.rtl60.bpl__Comobj_CreateComObject_qqrrx5_GUID
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0xc]
mov ecx, 0x41938b8
call sub.rtl60.bpl__System__IntfCast_qqrr45System__DelphiInterface_t17System_IInterface_x45System__DelphiInterface_t17System_IInter
xor ecx, ecx
push ebp
push 0x4193872
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [edi]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov edx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [esi]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call sub.rtl60.bpl__System__CheckAutoResult_qqrl
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x14]
cmp dword [ebp - 0x10], 1
jne 0x419382f
mov byte [ebp - 5], 1
jmp 0x4193833
mov byte [ebp - 5], 0
mov eax, esi
mov edx, dword [ebp - 0x20]
call sub.rtl60.bpl__System__WStrAsg_qqrr17System_WideStringx17System_WideString
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call sub.rtl60.bpl__System__WStrAsg_qqrr17System_WideStringx17System_WideString
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x1c]
call fcn.0419369c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4193879
lea eax, [ebp - 0xc]
call sub.rtl60.bpl__System__IntfClear_qqrr45System__DelphiInterface_t17System_IInterface_
ret
Function at 0x41a560c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a56a3
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a56bc
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a56aa
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41ac618
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41ac6ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x41ac6e4
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x2b4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [ebx + 0x38]
call sub.VEDatasets.bpl__Vedataset_TVEDataset_ParseSqlString_qqroiii
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x41ac71c
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + 0x2b4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [ebx + 0x3c]
call sub.VEDatasets.bpl__Vedataset_TVEDataset_ParseSqlString_qqroiii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ac6d5
lea eax, [ebp - 0x10]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x41b3ee4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41b3ff5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x338]
call sub.adortl60.bpl__Adodb_TCustomADODataSet_GetConnection_qqrv
mov edx, eax
mov ecx, 0x41b400c
mov eax, dword [0x4199a58]
call fcn.0419a648
lea eax, [ebp - 0x10]
call sub.rtl60.bpl__System__VarToInt_qqrrx14System_Variant
test eax, eax
jne 0x41b3f4a
mov eax, dword [ebx + 0x338]
call sub.adortl60.bpl__Adodb_TCustomADODataSet_GetConnection_qqrv
mov edx, eax
mov ecx, 0x41b4054
mov eax, dword [0x4199a58]
call fcn.0419a4d4
mov eax, dword [ebx + 0x338]
call sub.dbrtl60.bpl__Db_TDataSet_Close_qqrv
mov eax, dword [ebx + 0x338]
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
mov edx, 0x41b4124
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebx + 0x338]
call sub.adortl60.bpl__Adodb_TADOQuery_ExecSQL_qqrv
mov eax, dword [ebx + 0x338]
call sub.dbrtl60.bpl__Db_TDataSet_Close_qqrv
mov eax, dword [ebx + 0x338]
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
mov edx, 0x41b4270
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebx + 0x324]
call sub.dbrtl60.bpl__Db_TDataSet_Close_qqrv
mov eax, dword [ebx + 0x324]
call sub.adortl60.bpl__Adodb_TCustomADODataSet_GetParameters_qqrv
xor edx, edx
call sub.adortl60.bpl__Adodb_TParameters_GetItem_qqri
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebx + 0xc]
mov cl, 0xfc
call sub.rtl60.bpl__System__VarFromInt_qqrr14System_Variantxixi
lea edx, [ebp - 0x20]
pop eax
call sub.adortl60.bpl__Adodb_TParameter_SetValue_qqrrx14System_Variant
mov eax, dword [ebx + 0x324]
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b3ffc
lea eax, [ebp - 0x20]
mov edx, dword [sym.imp.rtl60.bpl___xp_14System_Variant]
mov ecx, 2
call sub.rtl60.bpl__System__FinalizeArray_qqrpvt1ui
ret