joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467144
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467272
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4e8500
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x4e8518]
call sub.rtl250.bpl__System__DynArrayHigh_qqrpxv
test eax, eax
jl 0x467243
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add eax, eax
mov edx, dword [0x4e8518]
lea ebx, [edx + eax*8]
xor eax, eax
push ebp
push 0x46722d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
mov edx, eax
mov eax, dword [ebx]
call fcn.0040f3ec
test al, al
jne 0x467223
push 0
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 8]
call sub.rtl250.bpl__System__LStrEqual_qqrv
jne 0x467223
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x467223
mov eax, dword [ebx + 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call sub.rtl250.bpl__System_Move_qqrpxvpvi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467237
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x467187
push 0x4e8500
call sub.kernel32.dll_LeaveCriticalSection
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467279
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x467744
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x467884
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4678a0
call sub.rtl250.bpl__System__LStrEqual_qqrv
je 0x467851
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x4677b9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov ecx, 0x4678b0
mov edx, ebx
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 0x2c]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call eax
jmp 0x46780d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov ecx, 0x4678b0
mov edx, ebx
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 0x30]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x46780d
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call sub.rtl250.bpl__System___llmul_qqrv
call sub.rtl250.bpl__System___llmul_qqrv
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x4678c0
mov edi, dword [0x4e4cc8]
mov edi, dword [edi]
lea edx, [ebp - 0x38]
mov eax, ebx
call edi
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call sub.rtl250.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
push dword [ebp - 0x34]
push 0x4678d0
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.004094b8
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call sub.rtl250.bpl__System__UStrCatN_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46788b
lea eax, [ebp - 0x3c]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x38]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x34]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x30]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x46a97c
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId
cmp esi, eax
je 0x46a9a6
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x46a9a6
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4711e8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4712bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00408980
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x4712d8
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x4712a2
mov byte [0x4e355c], 1
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x47129c
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x471284
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
mov edx, 0x4e3668
lea eax, [esi + 8]
mov ecx, 0x50
call sub.rtl250.bpl__System_Move_qqrpxvpvi
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4712c4
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x4717f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47196d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, 0x47197c
mov ecx, 0x471990
mov eax, ebx
call fcn.0040ec34
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
cmp eax, 0x14
jne 0x471957
cmp ebx, dword [0x4e360c]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x471957
mov eax, ebx
call fcn.0040e3cc
mov esi, eax
cmp word [esi + 0x18], 0x20b
jne 0x4718ca
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x4e360c]
jne 0x471890
mov eax, 0x432ef8
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
jmp 0x47189d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x471948
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x4e360c]
jne 0x471904
mov edx, 0x432ef8
mov eax, dword [ebp - 4]
sub edx, dword [eax]
sub edx, ebx
mov dword [esi + 0x2c], edx
mov edx, 0x4e3584
sub edx, dword [eax + 4]
sub edx, ebx
mov dword [esi + 0x30], edx
jmp 0x47191d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
and edx, 0x7fffffff
mov dword [esi + 0x2c], edx
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471974
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x471a94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471c66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x471c50
xor eax, eax
push ebp
push 0x471c46
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
jmp 0x471c27
cmp dword [ebp - 0x1c], 0x1000
jne 0x471c1f
cmp dword [ebp - 0x18], 1
je 0x471c1f
cmp esi, dword [ebp - 0x28]
je 0x471c1f
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x471c1f
push 0x104
lea eax, [ebp - 0x236]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jbe 0x471c1f
mov eax, dword [ebp - 0x28]
call fcn.0043865c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x471c1f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x471c1f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x471c1f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x4e4af0]
mov esi, dword [esi]
mov eax, 0x471c74
mov ecx, 0xe
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471be0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x4e4af0]
mov esi, dword [esi]
mov eax, 0x471c84
mov ecx, 0x10
mov edx, dword [ebp - 0x10]
call esi
inc eax
sete dl
mov eax, dword [ebp - 0x28]
call fcn.004711a0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x4e4af0]
mov esi, dword [esi]
mov eax, 0x471c98
mov ecx, 0xc
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471c1f
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00470fc0
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add ebx, eax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
je 0x471ae0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471c50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471c6d
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x473eac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x473f71
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0xc], 0
je 0x473f68
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x473f62
cmp dword [ebp - 0x10], 1
jne 0x473f54
mov eax, ebx
mov edx, esi
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
jmp 0x473f62
push 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl250.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47eef0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
lea eax, [ebp - 8]
mov edx, dword [0x47dab4]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x47ef5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x47ed04
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x47ef41
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ef64
lea eax, [ebp - 8]
mov edx, dword [0x47dab4]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret

Function at 0x48fcfc
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x48fd34
test edx, 0x40000000
je 0x48fd20
test edx, 0x80000000
je 0x48fd1b
or eax, 0x40
jmp 0x48fd5e
or eax, 0x20
jmp 0x48fd5e
test edx, 0x80000000
je 0x48fd2f
or eax, 0x80
jmp 0x48fd5e
or eax, 0x10
jmp 0x48fd5e
test edx, 0x40000000
je 0x48fd4e
test edx, 0x80000000
je 0x48fd49
or eax, 4
jmp 0x48fd5e
or eax, 2
jmp 0x48fd5e
test edx, 0x80000000
je 0x48fd5b
or eax, 8
jmp 0x48fd5e
or eax, 1
test edx, 0x4000000
je 0x48fd6b
or eax, 0x200
ret

Function at 0x48fe80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.00403d90
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov eax, dword [ebx + 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x48ff0c
cmp dword [ebx + 0x44], 0x4550
jne 0x48ff0c
cmp word [ebx + 0x48], 0x14c
je 0x48ff22
mov ecx, 0x48ff34
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_Exception_]
call sub.rtl250.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl250.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret
Function at 0x49140c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x491537
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
push 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x48b1b8]
call fcn.0048b598
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49150d
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x491472
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xc], 0
jne 0x491472
lea eax, [ebp - 4]
mov edx, dword [0x4e4c2c]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x49149e
mov eax, dword [ebp - 0xc]
call fcn.0048b830
test al, al
je 0x49148e
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x14]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x49149e
lea eax, [ebp - 4]
mov edx, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov esi, 0xf
mov ebx, dword [0x4e4c2c]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x10]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
xor edi, eax
mov eax, edi
xor edx, edx
push edx
push eax
call sub.rtl250.bpl__System_Math_Min_qqrxjxj
mov dword [ebp - 8], eax
add ebx, 8
dec esi
jne 0x4914a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491514
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
Function at 0x4944dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4945e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], edx
lea eax, [ebx + 4]
mov edx, esi
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebx + 0xc]
mov edx, dword [0x4320cc]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System_Variants_Null_qqrv
lea edx, [ebp - 0x10]
lea eax, [ebx + 0x30]
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
jle 0x4945b8
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x494150]
call sub.rtl250.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
mov edi, eax
dec edi
test edi, edi
jl 0x4945c6
inc edi
xor esi, esi
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
sub eax, esi
add eax, eax
mov edx, dword [ebx + 8]
lea eax, [edx + eax*8 - 0x10]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp + 8]
lea eax, [edx + eax*8 + 0x18]
lea edx, [ebp - 0x20]
call sub.rtl250.bpl__System_Rtti_TValue_AsVariant_qqrv
lea edx, [ebp - 0x20]
pop eax
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
inc esi
dec edi
jne 0x494583
jmp 0x4945c6
lea eax, [ebx + 8]
mov edx, dword [0x494150]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4945ee
lea eax, [ebp - 0x20]
mov edx, dword [sym.imp.rtl250.bpl___xp_14System_Variant]
mov ecx, 2
call sub.rtl250.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x402e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57c629
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call dword [0x58e244]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi + 8]
cmp byte [eax + 0x68], bl
je 0x402eb9
call fcn.0042c370
mov eax, dword [esi + 8]
cmp byte [eax + 0x6a], bl
je 0x402ec4
mov byte [eax + 0x6a], bl
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
cmp ecx, 6
ja case.0x402ecf.0
jmp dword [ecx*4 + 0x402fd4]
mov eax, dword [eax + 0x70]
jmp 0x402ee3
mov eax, dword [eax + 0x74]
jmp 0x402ee3
mov eax, dword [eax + 0x6c]
cmp eax, ebx
je case.0x402ecf.0
mov byte [eax + 0x1bc], bl
mov dword [eax + 0x124], ebx
mov dword [eax + 0x128], ebx
mov dword [eax + 0x12c], ebx
mov dword [eax + 0x130], ebx
mov eax, dword [esi + 0xc]
push eax
call fcn.0044cea0
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0xc]
sub eax, 1
je 0x402f8c
sub eax, 2
je 0x402f8c
sub eax, 1
jne 0x402fb0
call fcn.0042c3e0
mov ecx, dword [esi + 8]
call fcn.0042b090
add eax, 0xf4
cmp dword [eax + 0x14], ebx
jbe 0x402fb0
mov edx, dword [0x619c48]
mov eax, dword [edx + 0x5c]
mov ecx, 0x619c48
call eax
mov ecx, dword [esi + 8]
mov edx, eax
call fcn.0042b090
mov esi, dword [edx]
add eax, 0xf4
mov ecx, edx
mov edx, dword [esi + 0x28]
push eax
call edx
mov esi, eax
mov eax, dword [0x619c48]
mov edx, dword [eax + 0x68]
mov ecx, 0x619c48
call edx
fld1
mov edx, dword [eax]
push 1
push ecx
fstp dword [esp]
mov ecx, eax
mov eax, dword [edx + 0x20]
push esi
call eax
jmp 0x402fb0
call fcn.0042b090
mov byte [eax + 0x1bc], 1
mov dword [eax + 0x130], ebx
mov dword [eax + 0x12c], ebx
mov dword [eax + 0x128], ebx
mov dword [eax + 0x124], ebx
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call dword [0x58e21c]
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x402e99
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57c629
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call dword [0x58e244]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi + 8]
cmp byte [eax + 0x68], bl
je 0x402eb9
call fcn.0042c370
mov eax, dword [esi + 8]
cmp byte [eax + 0x6a], bl
je 0x402ec4
mov byte [eax + 0x6a], bl
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
cmp ecx, 6
ja case.0x402ecf.0
jmp dword [ecx*4 + 0x402fd4]
mov eax, dword [eax + 0x70]
jmp 0x402ee3
mov eax, dword [eax + 0x74]
jmp 0x402ee3
mov eax, dword [eax + 0x6c]
cmp eax, ebx
je case.0x402ecf.0
mov byte [eax + 0x1bc], bl
mov dword [eax + 0x124], ebx
mov dword [eax + 0x128], ebx
mov dword [eax + 0x12c], ebx
mov dword [eax + 0x130], ebx
mov eax, dword [esi + 0xc]
push eax
call fcn.0044cea0
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0xc]
sub eax, 1
je 0x402f8c
sub eax, 2
je 0x402f8c
sub eax, 1
jne 0x402fb0
call fcn.0042c3e0
mov ecx, dword [esi + 8]
call fcn.0042b090
add eax, 0xf4
cmp dword [eax + 0x14], ebx
jbe 0x402fb0
mov edx, dword [0x619c48]
mov eax, dword [edx + 0x5c]
mov ecx, 0x619c48
call eax
mov ecx, dword [esi + 8]
mov edx, eax
call fcn.0042b090
mov esi, dword [edx]
add eax, 0xf4
mov ecx, edx
mov edx, dword [esi + 0x28]
push eax
call edx
mov esi, eax
mov eax, dword [0x619c48]
mov edx, dword [eax + 0x68]
mov ecx, 0x619c48
call edx
fld1
mov edx, dword [eax]
push 1
push ecx
fstp dword [esp]
mov ecx, eax
mov eax, dword [edx + 0x20]
push esi
call eax
jmp 0x402fb0
call fcn.0042b090
mov byte [eax + 0x1bc], 1
mov dword [eax + 0x130], ebx
mov dword [eax + 0x12c], ebx
mov dword [eax + 0x128], ebx
mov dword [eax + 0x124], ebx
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call dword [0x58e21c]
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret