joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54c880
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.004b6ad0
mov eax, dword [0x60c1e0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
push edi
mov edi, dword [esp + 0x9c]
je 0x54c8f5
cmp ebx, dword [esi]
je 0x54c8ec
test edi, edi
je 0x54c8d2
cmp dword [esp + 0xa0], eax
jge 0x54c8ec
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004a5e13
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x54c8fb
mov ebx, dword [esi]
test ebx, ebx
je 0x54c8d2
test edi, edi
push ebp
je 0x54c9cd
push ebx
call fcn.004ea2a0
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x54c92b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.004e8dc0
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x54c985
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.004e8f40
add esp, 0xc
test eax, eax
je 0x54ca88
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.004e90f0
add esp, 0xc
test eax, eax
je 0x54ca88
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.004e9100
add esp, 0xc
test eax, eax
je 0x54ca88
jmp 0x54c9aa
cmp eax, 0x80
ja 0x54ca88
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.0049f720
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x54c9d5
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.0049cee0
add esp, 0xc
jmp 0x54c9d5
test eax, eax
je 0x54ca74
xor eax, eax
jmp 0x54c9e0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x54c9e0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.004e8f40
add esp, 0xc
test eax, eax
je 0x54ca88
push ebx
call fcn.004ea2a0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.004e90f0
add esp, 0x10
test eax, eax
je 0x54ca88
xor eax, eax
jmp 0x54ca30
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x54ca30
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.004e8f40
add esp, 0xc
test eax, eax
je 0x54ca88
push ebx
call fcn.004ea2a0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.004e90f0
add esp, 0x10
test eax, eax
je 0x54ca88
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.004e9290
add esp, 8
test eax, eax
jne 0x54ca8c
xor eax, eax
jmp 0x54ca91
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a5e13
add esp, 0x88
ret
Function at 0x55e820
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x55e839
mov esi, edi
mov edi, eax
jmp 0x55e83b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x55e84b
mov eax, ebx
jmp 0x55e855
push eax
push ebx
call fcn.004e1630
add esp, 8
test eax, eax
jne 0x55e85d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x55e87b
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x55e864
cmp eax, dword [esi + 4]
jge 0x55e892
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x55e880
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x55e8b5
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x55e8b2
sub eax, 1
test eax, eax
jg 0x55e8a2
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3e2123a3
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0xcb564a9
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405904
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe30
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4059a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0xc8
lea eax, [ebp - 0x19c]
push eax
lea edx, [ebp - 0x1c8]
mov eax, ebx
call sym.TCFLib210.bpl__Eappprot_TEvAppProtect_GetSystemDrive_qqrv
mov eax, dword [ebp - 0x1c8]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x40598f
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 0x1cc], 0
lea edx, [ebp - 0x1d0]
xor ecx, ecx
mov eax, 0x4059c4
call sub.rtl210.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059af
lea eax, [ebp - 0x1c8]
call sub.rtl210.bpl__System__UStrClr_qqrpv
ret
Function at 0x405c6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x405d92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call sub.rtl210.bpl__System__UStrClr_qqrpv
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
test al, al
jbe 0x405d6a
mov byte [ebp - 0xb], al
mov bl, 1
mov eax, dword [ebp - 8]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
movzx edi, bl
mov eax, edi
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 8]
movzx edx, word [eax + edx*2]
lea eax, [ebp - 0x14]
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x405db0
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x10]
call sub.rtl210.bpl__System_Sysutils_StrToInt_qqrx20System_UnicodeString
mov byte [ebp - 9], al
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
movzx edx, word [edx + edi*2 - 2]
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x405dc0
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
call sub.rtl210.bpl__System_Sysutils_StrToInt_qqrx20System_UnicodeString
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x20]
push eax
movzx eax, byte [ebp - 9]
xor al, byte [ebp - 0xa]
movzx eax, al
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x28]
xor ecx, ecx
mov eax, 0x405dd0
call sub.rtl210.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov edx, dword [ebp - 0x20]
mov eax, esi
call sub.rtl210.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
inc ebx
dec byte [ebp - 0xb]
jne 0x405cc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d99
lea eax, [ebp - 0x20]
mov edx, 5
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x406e6c
Capabilities:
Create http request

Disassembly:
push ebx
push esi
mov ebx, eax
push 0x4000000
push 0
push 0
push 1
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 0x48]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.wininet.dll_InternetOpenW
mov esi, eax
mov dword [ebx + 0x40], esi
test esi, esi
jne 0x406ea2
mov dl, 4
mov eax, dword [ebx + 0x60]
call sym.TCFLib210.bpl__Efidown_TEvFileDownload_RaiseError_qqr20Efidown_TEvDownError
pop esi
pop ebx
ret
push 0
push 0x44000000
push 0
push 0
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 0x48]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0x40]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
mov dword [ebx + 0x44], esi
test esi, esi
jne 0x406ee1
mov eax, dword [ebx + 0x40]
push eax
call sub.wininet.dll_InternetCloseHandle
mov dl, 6
mov eax, dword [ebx + 0x60]
call sym.TCFLib210.bpl__Efidown_TEvFileDownload_RaiseError_qqr20Efidown_TEvDownError
pop esi
pop ebx
ret
push 0
push 0x88000000
push 1
push 0
push 1
push 0x40000000
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 0x58]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
mov dword [ebx + 0x48], esi
cmp esi, 0xffffffff
jne 0x406f2d
mov eax, dword [ebx + 0x40]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebx + 0x44]
push eax
call sub.wininet.dll_InternetCloseHandle
mov dl, 5
mov eax, dword [ebx + 0x60]
call sym.TCFLib210.bpl__Efidown_TEvFileDownload_RaiseError_qqr20Efidown_TEvDownError
pop esi
pop ebx
ret
mov eax, ebx
call sym.TCFLib210.bpl__Efidown_TEvDownThread_CopyFile_qqrv
mov byte [ebx + 0x64], al
mov eax, dword [ebx + 0x40]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebx + 0x44]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebx + 0x48]
push eax
call sub.kernel32.dll_CloseHandle
pop esi
pop ebx
ret
Function at 0x406f58
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, eax
lea ebp, [esp + 4]
mov byte [esp], 0
mov eax, dword [esi + 0x60]
mov eax, dword [eax + 0x40]
call sub.rtl210.bpl__System__GetMem_qqri
mov edi, eax
xor eax, eax
mov dword [ebp], eax
call sub.rtl210.bpl__System_Sysutils_Time_qqrv
fstp qword [esi + 0x50]
wait
push ebp
mov eax, dword [esi + 0x60]
mov eax, dword [eax + 0x40]
push eax
push edi
mov eax, dword [esi + 0x44]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, esi
call sym.TCFLib210.bpl__Efidown_TEvDownThread_GetSeconds_qqrv
cmp byte [esi + 0x58], 0
jne 0x406fbb
cmp dword [ebp], 0
jne 0x406fbb
test bl, bl
jne 0x406fbb
mov edx, dword [esi + 0x60]
cmp eax, dword [edx + 0x50]
jle 0x406f84
cmp dword [ebp], 0
jne 0x406fc9
mov edx, dword [esi + 0x60]
cmp eax, dword [edx + 0x50]
jg 0x406fcf
cmp byte [esi + 0x58], 0
je 0x406fed
cmp byte [esi + 0x58], 0
je 0x406fe1
mov dl, 9
mov eax, dword [esi + 0x60]
call sym.TCFLib210.bpl__Efidown_TEvFileDownload_RaiseError_qqr20Efidown_TEvDownError
jmp 0x40704c
mov dl, 8
mov eax, dword [esi + 0x60]
call sym.TCFLib210.bpl__Efidown_TEvFileDownload_RaiseError_qqr20Efidown_TEvDownError
jmp 0x40704c
xor eax, eax
mov dword [esp + 8], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebp]
push eax
push edi
mov eax, dword [esi + 0x48]
push eax
call sub.kernel32.dll_WriteFile
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [esp + 8]
cmp eax, dword [ebp]
jne 0x40701b
test bl, bl
jne 0x407027
mov dl, 7
mov eax, dword [esi + 0x60]
call sym.TCFLib210.bpl__Efidown_TEvFileDownload_RaiseError_qqr20Efidown_TEvDownError
jmp 0x40704c
mov eax, dword [esp + 8]
add dword [esi + 0x5c], eax
mov eax, dword [esi + 0x60]
push eax
push sym.TCFLib210.bpl__Efidown_TEvFileDownload_Progress_qqrv
mov eax, esi
call sub.rtl210.bpl__System_Classes_TThread_Synchronize_qqrynpqqrv_v
cmp dword [ebp], 0
jne 0x406f76
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408c04
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
or ebx, 0xffffffff
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call sub.rtl210.bpl__System__FillChar_qqrpvic
mov dword [esp], 0x44
mov dword [esp + 0x2c], 1
mov word [esp + 0x30], di
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, esi
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x408c60
mov ebx, dword [esp + 0x44]
mov eax, ebx
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x418094
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x418178
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, esi
call sym.TCFLib210.bpl__Ecripto_TEvCriptografa_Invert_qqr20System_UnicodeString
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call sub.rtl210.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0xc]
call sub.rtl210.bpl__System__UStrClr_qqrpv
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edi, eax
test edi, edi
jle 0x418150
mov ebx, 1
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x40]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
inc edx
mov ecx, 1
mov eax, dword [esi + 0x40]
call sub.rtl210.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 8]
movzx eax, word [eax]
add al, bl
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
movzx edx, word [edx + ebx*2 - 2]
movzx ecx, byte [ebp - 0xd]
xor dx, cx
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call sub.rtl210.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0xc]
inc ebx
dec edi
jne 0x4180f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41817f
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x418188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x418267
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call sub.rtl210.bpl__System__UStrClr_qqrpv
mov eax, dword [ebp - 4]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
test eax, eax
jle 0x418229
mov dword [ebp - 0x10], eax
mov ebx, 1
lea eax, [ebp - 8]
push eax
mov eax, dword [edi + 0x40]
call sub.rtl210.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
inc edx
mov eax, dword [edi + 0x40]
mov ecx, 1
call sub.rtl210.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 8]
movzx eax, word [eax]
add al, bl
mov byte [ebp - 9], al
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, word [edx + ebx*2 - 2]
movzx ecx, byte [ebp - 9]
xor dx, cx
call sub.rtl210.bpl__System__UStrFromWChar_qqrr20System_UnicodeStringb
mov edx, dword [ebp - 0x14]
mov eax, esi
call sub.rtl210.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
inc ebx
dec dword [ebp - 0x10]
jne 0x4181d4
lea ecx, [ebp - 0x18]
mov edx, dword [esi]
mov eax, edi
call sym.TCFLib210.bpl__Ecripto_TEvCriptografa_Invert_qqr20System_UnicodeString
mov edx, dword [ebp - 0x18]
mov eax, esi
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41826e
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret

Function at 0x4187e0
Capabilities:
Authenticate hmac

Disassembly:
add dword [0x6e615254], ecx
inc ebx
outsb dx, byte gs:[esi]
je 0x418862
jb 0x418868
add dword [eax], eax
add byte [eax], al
add byte [ebx], ah
add byte [eax], al
add al, byte [eax]
add byte [eax], al
push esp
mov byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
mov dword [ecx], eax
add al, 0x8c
inc ecx
add byte [edx + 0x1b004189], ah
mov eax, dword [ecx]
cmp dword [ebx - 0x7494ffbf], ecx
inc ecx
add byte [ebx + eax], dh
add byte [eax], al
pop eax
salc
dec edx
add al, dh
adc byte [eax], al
clc
adc byte [eax], al
and byte [ecx], dl
inc eax
add byte [esp], dh
inc eax
add byte [eax], dh
adc dword [eax], eax
mov ah, 0x23
inc eax
add byte [eax + 0x11], al
inc eax
add byte [ecx + ebp], dl
inc eax
add al, cl
adc byte [eax], al
rcl byte [eax]
inc eax
add byte [eax - 0x2bffbe5d], dh
aam 0x39
inc eax
add byte [eax + edi + 0x40], al
add ah, al
and al, byte [eax]
movsb byte es:[edi], byte [esi]
aaa
inc eax
add byte [eax + edi], bl
hlt
Function at 0x41c97c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push dword [ebx + 0x3cc]
push dword [ebx + 0x3c8]
lea ecx, [esp + 0xc]
lea edx, [esp + 0xa]
lea eax, [esp + 8]
call sub.rtl210.bpl__System_Sysutils_DecodeDate_qqrx16System_TDateTimerust2t2
cmp esi, dword [ebx + 0x3c4]
jne 0x41c9b1
mov esi, 1
jmp 0x41c9b4
or esi, 0xffffffff
push 0x10
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x41c9cb
add word [esp], si
jmp 0x41ca16
push 0x11
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x41c9e9
mov eax, esi
add eax, eax
lea eax, [eax + eax*4]
add word [esp], ax
jmp 0x41ca16
add word [esp + 2], si
cmp word [esp + 2], 0xc
jbe 0x41ca03
mov word [esp + 2], 1
inc word [esp]
jmp 0x41ca16
cmp word [esp + 2], 1
jae 0x41ca16
mov word [esp + 2], 0xc
dec word [esp]
movzx eax, word [esp]
call sub.rtl210.bpl__System_Sysutils_IsLeapYear_qqrus
and eax, 0x7f
lea eax, [eax + eax*2]
mov edx, dword [sym.imp.rtl210.bpl__System_Sysutils_MonthDays]
lea eax, [edx + eax*8]
movzx edx, word [esp + 2]
movzx edx, word [eax + edx*2 - 2]
movzx eax, word [esp + 4]
call sub.rtl210.bpl__System_Math_Min_qqrxixi
mov word [esp + 4], ax
movzx ecx, word [esp + 4]
movzx edx, word [esp + 2]
movzx eax, word [esp]
call sub.rtl210.bpl__System_Sysutils_EncodeDate_qqrususus
fstp qword [ebx + 0x3c8]
wait
mov eax, ebx
call sym.TCFLib210.bpl__Edateed_TFrmDateEdCal_MonthChanged_qqrv
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x41d750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x41d76b
add esp, 0xfffffff0
call sub.rtl210.bpl__System__ClassCreate_qqrpvzc
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x41d8ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call sub.vcl210.bpl__Vcl_Controls_TCustomControl__bctr_qqrp25System_Classes_TComponent
mov eax, dword [0x41d914]
mov dword [ebx + 0x60], eax
mov edx, 0x11
mov eax, ebx
call sub.vcl210.bpl__Vcl_Controls_TControl_SetHeight_qqri
mov edx, 0x78
mov eax, ebx
call sub.vcl210.bpl__Vcl_Controls_TControl_SetWidth_qqri
mov byte [ebx + 0x298], 1
xor eax, eax
mov dword [ebx + 0x2a0], eax
mov dl, 1
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Imglist_TChangeLink_]
call sub.rtl210.bpl__System_TObject__bctr_qqrv
mov esi, eax
mov dword [ebx + 0x2a4], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], sym.TCFLib210.bpl__Edbckbox_TEvDBCheckBox_GlyphsListChange_qqrp14System_TObject
mov dword [ebx + 0x2a8], 0xffffffff
mov dword [ebx + 0x2ac], 0xffffffff
mov dword [ebx + 0x2b0], 0xffffffff
mov byte [ebx + 0x2b4], 1
mov byte [ebx + 0x2b5], 0
lea eax, [ebx + 0x2b8]
mov edx, 0x41d924
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebx + 0x2bc]
mov edx, 0x41d93c
call sub.rtl210.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dl, 1
mov eax, dword [sym.imp.vcldb210.bpl__Vcl_Dbctrls_TFieldDataLink_]
call sub.vcldb210.bpl__Vcl_Dbctrls_TFieldDataLink__bctr_qqrv
mov esi, eax
mov dword [ebx + 0x29c], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], sym.TCFLib210.bpl__Edbckbox_TEvDBCheckBox_DataChange_qqrp14System_TObject
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], sym.TCFLib210.bpl__Edbckbox_TEvDBCheckBox_UpdateData_qqrp14System_TObject
lea eax, [ebp - 0xc]
mov edx, dword [0x4841ec]
call sub.rtl210.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call sub.rtl210.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
cmp dword [ebp - 8], 0
jne 0x41d8d1
test byte [ebx + 0x1c], 0x10
jne 0x41d8d1
push 0x40
call sub.user32.dll_MessageBeep
push 0
push 0x41d954
lea edx, [ebp - 0x14]
mov eax, dword [ebx]
call sub.rtl210.bpl__System_TObject_ClassName_qqrv
push dword [ebp - 0x14]
push 0x41d97c
push 0x41d9b4
push 0x41da18
push 0x41da2c
push 0x41da60
push 0x41da70
lea eax, [ebp - 0x10]
mov edx, 8
call sub.rtl210.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x10]
movzx ecx, word [0x41daa0]
mov dl, 2
call sub.vcl210.bpl__Vcl_Dialogs_MessageDlg_qqrx20System_UnicodeString26System_Uitypes_TMsgDlgType53System__Set_25System_Uitypes_TM
mov eax, 0x4841ec
call sub.rtl210.bpl__System__LStrClr_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d8f3
lea eax, [ebp - 0x14]
mov edx, 4
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret