joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d824
Capabilities:
Encrypt data using rc4 prga
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
setl byte [ebp - 0x13]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setl byte [ebp - 0x14]
mov eax, dword [0x52d560]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov dx, word [ebp - 2]
call fcn.00412c94
mov word [ebp - 0xe], ax
mov al, byte [ebp - 0x13]
or al, byte [ebp - 0x14]
je 0x42d9a3
cmp word [ebp - 2], 0x21
je 0x42d885
cmp word [ebp - 2], 0x22
jne 0x42d9a3
mov al, byte [ebp - 9]
xor al, 1
or al, byte [ebp - 0x13]
je 0x42d90b
mov eax, dword [0x52dab8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ax, word [eax + edx*2]
mov word [ebp - 0x12], ax
mov word [ebp - 0x10], 0
cmp word [ebp - 0x12], 0
jbe 0x42d8f0
jmp 0x42d8d0
mov ax, word [ebp - 0xe]
mov word [ebp - 0x10], ax
movzx ecx, word [ebp - 0xe]
mov eax, dword [0x52d560]
mov eax, dword [eax]
mov dx, word [ebp - 2]
call fcn.00412c94
mov word [ebp - 0xe], ax
movzx eax, word [ebp - 0xe]
mov edx, dword [0x52dab8]
mov edx, dword [edx]
mov ax, word [edx + eax*2]
cmp ax, word [ebp - 0x12]
je 0x42d8f0
mov ax, word [ebp - 0xe]
cmp ax, word [ebp - 0x10]
jne 0x42d8b0
mov ax, word [ebp - 0xe]
cmp ax, word [ebp - 0x10]
jne 0x42d9a3
mov ax, word [ebp - 8]
mov word [ebp - 0xe], ax
jmp 0x42d9a3
mov al, byte [ebp - 9]
and al, byte [ebp - 0x14]
je 0x42d9a3
mov word [ebp - 0x10], 0
mov eax, dword [0x52d7b0]
mov al, byte [eax]
mov edx, dword [0x52dbbc]
and eax, 0xff
bt dword [edx], eax
jae 0x42d991
jmp 0x42d956
mov ax, word [ebp - 0xe]
mov word [ebp - 0x10], ax
movzx ecx, word [ebp - 0xe]
mov eax, dword [0x52d560]
mov eax, dword [eax]
mov dx, word [ebp - 2]
call fcn.00412c94
mov word [ebp - 0xe], ax
mov eax, dword [0x52d7b0]
movzx eax, byte [eax]
mov edx, dword [0x52d524]
mov edx, dword [edx]
mov al, byte [edx + eax]
movzx edx, word [ebp - 0xe]
mov ecx, edx
shl edx, 4
add edx, ecx
mov ecx, dword [0x52d774]
mov ecx, dword [ecx]
and eax, 0xff
bt dword [ecx + edx*2], eax
jb 0x42d991
mov ax, word [ebp - 0xe]
cmp ax, word [ebp - 0x10]
jne 0x42d936
mov ax, word [ebp - 0xe]
cmp ax, word [ebp - 0x10]
jne 0x42d9a3
mov ax, word [ebp - 8]
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
mov word [ebp - 0xc], ax
mov ax, word [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4449fc
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x444ae2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x444af0
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x444a3b
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x444a3f
xor eax, eax
jmp 0x444a41
mov al, 1
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
xor al, 1
mov edx, dword [0x52d730]
mov byte [edx], al
cmp byte [ebp - 1], 0
jne 0x444acc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
push 0x444b04
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x444a83
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x444a87
xor eax, eax
jmp 0x444a89
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x444a9d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x444acc
mov eax, dword [0x52d488]
cmp byte [eax], 0
je 0x444acc
mov eax, 0x444b20
call sub.Vcl40.bpl__Dialogs_ShowMessage_qqrx17System_AnsiString
mov eax, dword [0x52d488]
mov byte [eax], 0
mov eax, dword [0x52d3b0]
mov byte [eax], 1
mov eax, dword [0x52d4a4]
and dword [eax], 0xfffffdff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444ae9
lea eax, [ebp - 0x14]
call sub.Vcl40.bpl__System__LStrClr_qqrr17System_AnsiString
ret
Function at 0x458b04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov eax, dword [0x52d7bc]
cmp byte [eax], 0
jne 0x458b20
mov byte [ebp - 5], 0
jmp 0x458c3a
mov eax, dword [0x52da9c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xf], 0
xor eax, eax
mov al, byte [ebp - 0xf]
lea eax, [eax + eax*2]
mov edx, dword [0x52d7dc]
lea eax, [edx + eax*4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0
je 0x458c0f
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x18]
mov dl, byte [edx + 2]
sub dl, al
jb 0x458c0f
inc edx
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x10], al
xor eax, eax
mov al, byte [ebp - 0xf]
add eax, eax
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*8]
xor edx, edx
mov dl, byte [ebp - 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x458c03
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
cmp byte [ebp - 0xd], 0
jne 0x458bc1
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x14]
and eax, 0xff
bt dword [edx + 6], eax
jae 0x458bc1
xor eax, eax
jmp 0x458bc3
mov al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xe], 0
jne 0x458bef
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x14]
and eax, 0xff
bt dword [edx + 6], eax
jb 0x458bef
xor eax, eax
jmp 0x458bf1
mov al, 1
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x58]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x458b92
inc byte [ebp - 0x10]
dec byte [ebp - 0x19]
jne 0x458b71
inc byte [ebp - 0xf]
cmp byte [ebp - 0xf], 6
jne 0x458b36
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0xe]
je 0x458c36
cmp byte [ebp - 0xd], 0
je 0x458c30
mov byte [ebp - 5], 0
jmp 0x458c3a
mov byte [ebp - 5], 1
jmp 0x458c3a
mov byte [ebp - 5], 2
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x45e710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0046ee74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
sub eax, 0xc8
mov ecx, 6
cdq
idiv ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x46c]
sub al, 1
jb 0x45e74b
je 0x45e77b
jmp 0x45e79c
call fcn.0045889c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x3e0]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + 0x3e1]
imul edx, ecx
mov ecx, dword [ebp - 4]
imul edx, dword [ecx + 0x20]
add eax, edx
add eax, 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
jmp 0x45e79c
call fcn.0045889c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x3e1]
mov ecx, dword [ebp - 4]
imul edx, dword [ecx + 0x20]
add eax, edx
add eax, 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [ebp - 4]
call fcn.00459774
test al, al
je 0x45e7cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
shl eax, 2
mov ecx, 5
cdq
idiv ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x42c], eax
mov eax, dword [ebp - 4]
call fcn.00459774
test al, al
jne 0x45e7f0
mov eax, dword [0x52d4a4]
test byte [eax + 3], 1
je 0x45e7f0
mov dword [ebp - 8], 0x578
jmp 0x45e874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x42c]
mov dword [ebp - 8], eax
jmp 0x45e874
mov eax, dword [ebp - 4]
dec dword [eax + 0x20]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x46c]
sub al, 1
jb 0x45e81b
je 0x45e84b
jmp 0x45e86c
call fcn.0045889c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x3e0]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + 0x3e1]
imul edx, ecx
mov ecx, dword [ebp - 4]
imul edx, dword [ecx + 0x20]
add eax, edx
add eax, 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
jmp 0x45e86c
call fcn.0045889c
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x3e1]
mov ecx, dword [ebp - 4]
imul edx, dword [ecx + 0x20]
add eax, edx
add eax, 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [0x52d8fc]
movzx eax, byte [eax]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0x30]
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp - 8]
jg 0x45e804
pop ecx
pop ecx
pop ebp
ret
Function at 0x464654
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x464666
add esp, 0xfffffff0
call sub.Vcl40.bpl__System__ClassCreate_qqrv
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call sub.Vcl40.bpl__System__LStrAddRef_qqrv
xor eax, eax
push ebp
push 0x464735
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0046e478
mov eax, 0x2c0
call sub.Vcl40.bpl__System__GetMem_qqrv
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, 0x2c0
call sub.Vcl40.bpl__System__GetMem_qqrv
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, 0xfb
call sub.Vcl40.bpl__System__GetMem_qqrv
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, 0xfb
call sub.Vcl40.bpl__System__GetMem_qqrv
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0xdc
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], 0xfffffea2
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0x24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
add eax, eax
add eax, 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0xaa
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xa
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46473c
lea eax, [ebp - 0xc]
call sub.Vcl40.bpl__System__LStrClr_qqrr17System_AnsiString
ret
Function at 0x4688fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x52d7bc]
cmp byte [eax], 0
jne 0x468915
mov byte [ebp - 1], 0
jmp 0x468a75
mov eax, dword [0x52da9c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0
mov eax, dword [ebp + 8]
mov byte [eax - 1], 0
mov eax, dword [ebp + 8]
mov al, byte [eax - 1]
mov edx, dword [ebp + 8]
cmp al, byte [edx - 2]
jae 0x468a57
mov eax, dword [ebp + 8]
mov dword [eax - 8], 1
mov eax, dword [ebp + 8]
mov byte [eax - 9], 0
mov eax, dword [ebp + 8]
mov byte [eax - 0xa], 0
jmp 0x468a1f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
and eax, 0xff
bt dword [edx + 0x470], eax
jae 0x468a19
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x12]
dec eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
imul dword [edx + 0x4d4]
mov edx, dword [ebp + 8]
movzx edx, byte [edx - 1]
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, byte [edx - 0xa]
cmp eax, edx
jne 0x468a13
mov eax, dword [ebp + 8]
mov byte [eax - 9], 1
cmp byte [ebp - 2], 0
jne 0x4689de
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp - 8]
and eax, 0xff
bt dword [edx + 6], eax
jae 0x4689de
xor eax, eax
jmp 0x4689e0
mov al, 1
mov byte [ebp - 2], al
cmp byte [ebp - 3], 0
jne 0x468a0c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp - 8]
and eax, 0xff
bt dword [edx + 6], eax
jb 0x468a0c
xor eax, eax
jmp 0x468a0e
mov al, 1
mov byte [ebp - 3], al
jmp 0x468a19
mov eax, dword [ebp + 8]
inc byte [eax - 0xa]
mov eax, dword [ebp + 8]
inc dword [eax - 8]
mov eax, dword [ebp + 8]
cmp byte [eax - 9], 0
jne 0x468a3f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52db98]
movzx edx, byte [edx]
cmp eax, edx
jle 0x46895d
mov eax, dword [ebp + 8]
inc byte [eax - 1]
mov eax, dword [ebp + 8]
mov al, byte [eax - 1]
mov edx, dword [ebp + 8]
cmp al, byte [edx - 2]
jb 0x468940
mov al, byte [ebp - 2]
xor al, byte [ebp - 3]
je 0x468a71
cmp byte [ebp - 2], 0
je 0x468a6b
mov byte [ebp - 1], 0
jmp 0x468a75
mov byte [ebp - 1], 1
jmp 0x468a75
mov byte [ebp - 1], 2
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x46b5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x52d7bc]
cmp byte [eax], 0
jne 0x46b609
mov byte [ebp - 1], 0
jmp 0x46b768
mov eax, dword [0x52da9c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0
mov eax, dword [ebp + 8]
mov byte [eax - 1], 0
mov eax, dword [ebp + 8]
mov al, byte [eax - 1]
mov edx, dword [ebp + 8]
cmp al, byte [edx - 2]
jae 0x46b74a
mov eax, dword [ebp + 8]
mov dword [eax - 8], 1
mov eax, dword [ebp + 8]
mov byte [eax - 9], 0
mov eax, dword [ebp + 8]
mov byte [eax - 0xa], 0
jmp 0x46b712
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
and eax, 0xff
bt dword [edx + 0x470], eax
jae 0x46b70c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
dec eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
imul dword [edx + 0x4d4]
mov edx, dword [ebp + 8]
movzx edx, byte [edx - 1]
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, byte [edx - 0xa]
cmp eax, edx
jne 0x46b706
mov eax, dword [ebp + 8]
mov byte [eax - 9], 1
cmp byte [ebp - 2], 0
jne 0x46b6d1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp - 8]
and eax, 0xff
bt dword [edx + 6], eax
jae 0x46b6d1
xor eax, eax
jmp 0x46b6d3
mov al, 1
mov byte [ebp - 2], al
cmp byte [ebp - 3], 0
jne 0x46b6ff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov edx, dword [ebp - 8]
and eax, 0xff
bt dword [edx + 6], eax
jb 0x46b6ff
xor eax, eax
jmp 0x46b701
mov al, 1
mov byte [ebp - 3], al
jmp 0x46b70c
mov eax, dword [ebp + 8]
inc byte [eax - 0xa]
mov eax, dword [ebp + 8]
inc dword [eax - 8]
mov eax, dword [ebp + 8]
cmp byte [eax - 9], 0
jne 0x46b732
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [0x52db98]
movzx edx, byte [edx]
cmp eax, edx
jle 0x46b651
mov eax, dword [ebp + 8]
inc byte [eax - 1]
mov eax, dword [ebp + 8]
mov al, byte [eax - 1]
mov edx, dword [ebp + 8]
cmp al, byte [edx - 2]
jb 0x46b634
mov al, byte [ebp - 2]
xor al, byte [ebp - 3]
je 0x46b764
cmp byte [ebp - 2], 0
je 0x46b75e
mov byte [ebp - 1], 0
jmp 0x46b768
mov byte [ebp - 1], 1
jmp 0x46b768
mov byte [ebp - 1], 2
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x499f14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
mov eax, 0x17d
call sub.Vcl40.bpl__System__GetMem_qqrv
mov dword [ebp - 8], eax
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x66
call sub.Vcl40.bpl__System__FillChar_qqrv
mov byte [ebp - 0xb], 1
xor eax, eax
mov al, byte [ebp - 0xb]
cmp byte [ebp + eax - 0x74], 0
jne 0x49a01f
xor eax, eax
mov al, byte [ebp - 0xb]
imul eax, eax, 0x17
mov edx, dword [0x52d970]
mov edx, dword [edx]
cmp byte [edx + eax*2 + 0x24], 1
jne 0x49a01f
mov al, byte [ebp - 0xb]
mov byte [ebp - 3], al
xor eax, eax
mov al, byte [ebp - 3]
imul eax, eax, 0x17
mov edx, dword [0x52d970]
mov edx, dword [edx]
mov al, byte [edx + eax*2 + 0x25]
mov byte [ebp - 4], al
xor eax, eax
mov al, byte [ebp - 3]
mov byte [ebp + eax - 0x74], 1
xor eax, eax
mov al, byte [ebp - 4]
mov byte [ebp + eax - 0x74], 1
mov word [ebp - 2], 0
mov eax, dword [0x52db3c]
mov ax, word [eax]
test ax, ax
jbe 0x49a011
mov word [ebp - 0xe], ax
mov word [ebp - 0xa], 1
movzx eax, word [ebp - 0xa]
mov edx, dword [0x52da80]
mov edx, dword [edx]
mov ax, word [edx + eax*2]
mov cl, byte [ebp - 4]
mov dl, byte [ebp - 3]
call fcn.00499ab8
movsx eax, al
cdq
xor eax, edx
sub eax, edx
movzx edx, word [ebp - 0xa]
mov ecx, dword [0x52da80]
mov ecx, dword [ecx]
movzx edx, word [ecx + edx*2]
mov ecx, dword [ebp - 8]
mov byte [ecx + edx], al
movzx eax, word [ebp - 0xa]
mov edx, dword [0x52da80]
mov edx, dword [edx]
movzx eax, word [edx + eax*2]
mov edx, dword [ebp - 8]
movzx eax, byte [edx + eax]
add word [ebp - 2], ax
inc word [ebp - 0xa]
dec word [ebp - 0xe]
jne 0x499fb3
push ebp
call fcn.00499c94
pop ecx
xor eax, eax
call fcn.004210e8
inc byte [ebp - 0xb]
cmp byte [ebp - 0xb], 0x61
jne 0x499f3a
mov edx, 0x17d
mov eax, dword [ebp - 8]
call sub.Vcl40.bpl__System__FreeMem_qqrv
mov eax, dword [sym.imp.Vcl40.bpl__Forms_Application]
mov eax, dword [eax]
call sub.Vcl40.bpl__Forms_TApplication_ProcessMessages_qqrv
mov esp, ebp
pop ebp
ret

Function at 0x49a04c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00402ff0
mov eax, dword [ebp - 0xc]
mov edi, eax
mov esi, 0x49a0e4
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov edx, dword [0x49a104]
mov dword [eax], edx
mov dl, byte [0x49a108]
mov byte [eax + 4], dl
cmp dword [ebp - 4], 0
je 0x49a0dc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dx, word [edx + 4]
call fcn.00402f68
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 8]
and edx, 0xff
bts dword [eax], edx
mov eax, dword [ebp - 0x10]
movsx eax, byte [eax + 0xf]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp + 8]
cmp eax, 0x27
ja 0x49a0ce
bts dword [edx], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49a090
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x49fe00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov byte [ebp - 4], 1
mov eax, dword [0x52d7c4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x320
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 2]
mov byte [ebp - 5], al
jmp 0x49feb4
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [0x52d7d8]
mov edx, dword [edx]
mov al, byte [edx + eax]
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov byte [ebp - 7], al
movsx eax, byte [ebp - 7]
shl eax, 2
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp - 6]
and ecx, 0xff
bt dword [edx + eax*8 + 0x180], ecx
jae 0x49fe9e
xor eax, eax
mov al, byte [ebp - 2]
movsx edx, byte [ebp - 7]
add eax, edx
xor edx, edx
mov dl, byte [ebp - 6]
lea edx, [edx + edx*2]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 8]
lea edx, [ecx + edx*4]
xor ecx, ecx
mov cl, byte [ebp - 1]
cmp eax, 0xf
ja 0x49fe96
bt dword [edx + ecx*2], eax
setb al
xor al, 1
mov byte [ebp - 4], al
dec byte [ebp - 7]
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
cmp al, byte [ebp - 7]
jg 0x49feb1
cmp byte [ebp - 4], 0
jne 0x49fe4f
inc byte [ebp - 5]
cmp byte [ebp - 4], 0
je 0x49fec9
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 3]
cmp al, byte [ebp - 5]
jae 0x49fe33
mov al, byte [ebp - 4]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
mov esp, ebp
pop ebp
ret
Function at 0x505344
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call sub.Vcl40.bpl__System__LStrToPChar_qqrv
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x50535d
test al, 0x10
jne 0x505361
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x52652c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 7], cl
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [0x52db3c]
cmp word [eax], 0
jbe 0x526647
mov eax, dword [ebp - 4]
mov byte [eax + 0x538], 1
mov al, byte [ebp - 7]
mov edx, dword [ebp - 4]
mov byte [edx + 0x539], al
mov ax, word [ebp - 6]
mov edx, dword [ebp - 4]
mov word [edx + 0x53a], ax
mov eax, dword [0x52d4a4]
test byte [eax + 1], 4
jne 0x526647
cmp byte [ebp - 7], 0
je 0x5265b6
mov eax, dword [0x52d308]
cmp dword [eax], 0
jne 0x5265b6
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4cfab0]
call sub.Vcl40.bpl__Forms_TCustomForm__bctr_qqrp18Classes_TComponent
mov edx, dword [0x52d308]
mov dword [edx], eax
mov eax, dword [0x52d308]
mov eax, dword [eax]
call sub.Vcl40.bpl__Forms_TCustomForm_Show_qqrv
jmp 0x526647
cmp byte [ebp - 7], 0
jne 0x5265eb
mov eax, dword [0x52d3d4]
cmp dword [eax], 0
jne 0x5265eb
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4cfab0]
call sub.Vcl40.bpl__Forms_TCustomForm__bctr_qqrp18Classes_TComponent
mov edx, dword [0x52d3d4]
mov dword [edx], eax
mov eax, dword [0x52d3d4]
mov eax, dword [eax]
call sub.Vcl40.bpl__Forms_TCustomForm_Show_qqrv
jmp 0x526647
cmp byte [ebp - 7], 0
je 0x5265fd
mov eax, dword [0x52d308]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x526607
mov eax, dword [0x52d3d4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 1
mov eax, dword [ebp - 0xc]
call sub.Vcl40.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0xc]
call sub.Vcl40.bpl__Controls_TControl_BringToFront_qqrv
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2cc]
call fcn.00413014
push 0
movzx eax, word [ebp - 6]
push eax
push 0x405
mov eax, dword [ebp - 0xc]
call sub.Vcl40.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_PostMessageA
mov esp, ebp
pop ebp
ret
Function at 0x52664c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x52da1c]
cmp byte [eax], 0
jbe 0x526709
mov eax, dword [ebp - 4]
mov byte [eax + 0x538], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x539], 1
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov word [edx + 0x53a], ax
mov eax, dword [0x52dbd4]
cmp dword [eax], 0
jne 0x5266b8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4d21bc]
call sub.Vcl40.bpl__Forms_TCustomForm__bctr_qqrp18Classes_TComponent
mov edx, dword [0x52dbd4]
mov dword [edx], eax
mov eax, dword [0x52dbd4]
mov eax, dword [eax]
call sub.Vcl40.bpl__Forms_TCustomForm_Show_qqrv
jmp 0x526709
push 1
mov eax, dword [0x52dbd4]
mov eax, dword [eax]
call sub.Vcl40.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x52dbd4]
mov eax, dword [eax]
call sub.Vcl40.bpl__Controls_TControl_BringToFront_qqrv
mov eax, dword [0x52dbd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2cc]
call fcn.00413014
push 0
xor eax, eax
mov al, byte [ebp - 5]
push eax
push 0x40b
mov eax, dword [0x52dbd4]
mov eax, dword [eax]
call sub.Vcl40.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop ecx
pop ebp
ret