joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4184e9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x438689
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x25], 0
mov esi, dword [ebp + 8]
je 0x418530
mov eax, dword [edi]
call dword [eax + 0x14]
mov edx, esi
lea ecx, [esp + 0x28]
mov byte [edi + 0x25], 1
call fcn.004069bf
and dword [esp + 0x50], 0
mov esi, dword [sym.imp.MSVCR110.dll_wcslen]
and dword [esp + 0x20], 0
xor eax, eax
mov ebx, str.User_Agent:_Adobe_Log_Transport_r_n
push ebx
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
call esi
pop ecx
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00402667
mov ebx, str.Content_Type:_multipart_form_data__boundaryxxxxx_r_n
push ebx
mov byte [esp + 0x54], 1
call esi
pop ecx
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00402667
mov ebx, str.Content_Length:_0
push ebx
call esi
pop ecx
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00402667
lea eax, [edi + 0xc]
push eax
lea eax, [edi + 4]
push eax
push 0
push 0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x40]
push eax
mov ecx, edi
call fcn.00418158
push 0
push 1
lea ecx, [esp + 0x18]
mov bl, al
mov word [edi + 0x24], 1
call fcn.00402667
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.00402667
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0041d508
mov esp, ebp
pop ebp
ret 4

Function at 0x418601
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4386c1
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x25], 0
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
je 0x418656
mov eax, dword [esi]
call dword [eax + 0x14]
mov eax, dword [esp + 0x14]
mov edx, eax
lea ecx, [esp + 0x30]
mov byte [esi + 0x25], 1
call fcn.004069bf
and dword [esp + 0x58], 0
and dword [esp + 0x28], 0
xor eax, eax
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push ebx
push edi
mov byte [esp + 0x64], 1
call fcn.00418019
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 4]
push eax
push 0
push 0
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.00418158
push 0
push 1
lea ecx, [esp + 0x20]
mov bl, al
mov word [esi + 0x24], 1
call fcn.00402667
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.00402667
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0041d508
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41da2d
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x443180
call fcn.0041da80
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, ebx
mov esi, 0x44df58
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x41d900
cmp eax, edx
jne 0x41d8e9
xor esi, esi
inc esi
mov edi, esi
jmp 0x41d903
xor esi, esi
inc esi
cmp dword [0x44df5c], esi
jne 0x41d915
push 0x1f
call sub.MSVCR110.dll__amsg_exit
pop ecx
jmp 0x41d94f
cmp dword [0x44df5c], ebx
jne 0x41d949
mov dword [0x44df5c], esi
push 0x43a57c
push 0x43a568
call sub.MSVCR110.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41d94f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41da27
mov dword [0x44dd34], esi
cmp dword [0x44df5c], esi
jne 0x41d972
push 0x43a564
push 0x43a4fc
call sub.MSVCR110.dll__initterm
pop ecx
pop ecx
mov dword [0x44df5c], 2
test edi, edi
jne 0x41d97f
xor eax, eax
mov ecx, 0x44df58
xchg dword [ecx], eax
cmp dword [0x44df60], 0
je 0x41d9a1
push 0x44df60
call fcn.00402667
pop ecx
test eax, eax
je 0x41d9a1
push ebx
push 2
push ebx
call dword [0x44df60]
mov ecx, dword [0x44dd40]
mov eax, dword [sym.imp.MSVCR110.dll___initenv]
mov dword [eax], ecx
push dword [0x44dd40]
push dword [0x44dd3c]
push dword [0x44dd38]
call fcn.0040f60f
add esp, 0xc
mov dword [0x44dd30], eax
cmp dword [0x44dd48], 0
jne 0x41da0c
push eax
call dword [sym.imp.MSVCR110.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.MSVCR110.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x44dd34], 0
jne 0x41da20
call dword [sym.imp.MSVCR110.dll__cexit]
mov eax, dword [0x44dd30]
mov dword [ebp - 4], 0xfffffffe
call fcn.0041dac5
ret
call fcn.00402667
jmp 0x41d8c8
Function at 0x431fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x435528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi]
mov ebx, dword [esp + 0x3c]
mov eax, dword [ecx + 0x13c]
sub eax, dword [ecx + 0x138]
cmp dword [esi + 0x70], eax
jne 0x43208f
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
je 0x43208f
mov eax, dword [esi + 0x7c]
cmp dword [eax - 4], ebx
jle 0x43208f
mov eax, dword [ecx + 0x14]
test al, 3
jne 0x43204d
test eax, 0x1000000
je 0x43208f
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x14]
call fcn.00402667
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x5c]
sub eax, dword [esi + 0x54]
mov ecx, esi
push eax
push 0x11
mov dword [esp + 0x40], 0
call fcn.00429a30
cmp dword [esp + 0x24], 0x10
jb 0x43208b
push dword [esp + 0x10]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x4320fe
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
je 0x4320fc
lea esp, [esp]
mov eax, dword [esi + 0x7c]
mov edi, dword [eax - 4]
cmp edi, ebx
jle 0x4320fc
cmp dword [esi + 0x78], eax
je 0x4320b5
add eax, 0xfffffffc
mov dword [esi + 0x7c], eax
mov edx, dword [esi]
mov ecx, dword [edx + 0x13c]
sub ecx, dword [edx + 0x138]
add ecx, 3
and ecx, 0xfffffffc
add ecx, dword [edx + 0x138]
mov dword [edx + 0x13c], ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
sub ecx, dword [eax + 0x138]
mov eax, dword [eax + 0x138]
sub ecx, edi
mov dword [eax + edi + 8], ecx
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
jne 0x4320a0
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0041d508
add esp, 0x28
ret 4
Function at 0x468ea0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x49000]
mov dword [edi + 0x487c0], 0
push edi
or ebp, 0xffffffff
jmp 0x468eca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x468ed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x468ec0
mov eax, 1
add ebx, ebx
jne 0x468ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x468ef4
jne 0x468f13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x468f13
dec eax
add ebx, ebx
jne 0x468f00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x468ed8
add ebx, ebx
jne 0x468f0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x468f65
xor ecx, ecx
sub eax, 3
jb 0x468f2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x468f9a
sar eax, 1
mov ebp, eax
jmp 0x468f36
add ebx, ebx
jne 0x468f36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x468f04
inc ecx
add ebx, ebx
jne 0x468f44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x468f04
add ebx, ebx
jne 0x468f51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x468f46
jne 0x468f62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x468f46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x468f84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x468f76
jmp 0x468ec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x468f84
add edi, ecx
jmp 0x468ec6
pop esi
mov edi, esi
mov ecx, 0x21a8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x468fa2
cmp byte [edi], 0xe
jne 0x468fa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x468fa7
lea edi, [esi + 0x66000]
mov eax, dword [edi]
or eax, eax
je 0x469016
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x727d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7288c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x468fd4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x72890]
or eax, eax
je 0x469010
mov dword [ebx], eax
add ebx, 4
jmp 0x468ff1
call dword [esi + 0x728a0]
mov ebp, dword [esi + 0x72894]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46904a
sub esp, 0xffffff80
jmp 0x4483b4
Function at 0xc33108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c33258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
jnp 0xc33127
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc3312e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3311a
add dl, dl
jne 0xc33139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3318c
xor eax, eax
add dl, dl
jne 0xc33146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3322d
add dl, dl
jne 0xc33155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc33160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3316b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc33176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc33182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc33125
mov eax, 1
add dl, dl
jne 0xc3319a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc331a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc33191
sub eax, ebx
mov ebx, 1
jne 0xc331d8
mov ecx, 1
add dl, dl
jne 0xc331be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc331c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc331b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc33125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc331ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc331fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc331e6
cmp eax, 0x7d00
jae 0xc3321d
cmp eax, 0x500
jb 0xc33218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc33125
cmp eax, 0x7f
ja 0xc33220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc33125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc3324e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc33125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40b1d1
pop dword [ebp - 0x10]
mov eax, 0x40b1d1
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x36da7
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x1a46c8f2
add ecx, 0xe5b97533
mov edi, eax
mov edx, 0x976eebe5
sub edx, 0x972db021
add edx, dword [ebp - 0x10]
mov esi, 0x897a8c7b
sub esi, 0x3d4488a5
add dword [ebp - 4], ebx
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x5bccfdea
xor ebx, esi
sub dword [ebp - 4], edi
mov dword [edi], ebx
sub dword [ebp - 0xc], ecx
add edi, 0x5826d1c
add edi, 0xfa7d92e8
add edx, 4
loop 0x40b226
add eax, 0x384ba6f0
add eax, 0xc7b54477
mov ebx, eax
add eax, 0xe9d9377f
sub eax, 0xe9d9377a
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sbb edi, esi
push edi
call 0xb6a520
test eax, eax
jne 0x405e30
cmp dword [0x4108dc], 0x46
cmpsb byte [esi], byte es:[edi]
mov esi, gs
add byte [eax], al
add byte [ecx + 0x41e484], ah
test dword [ebx + 0x3ce85c4], eax
add byte [eax], al
aas
add eax, 0x25410384
add dword [eax], eax
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x405db3
mov eax, dword [0x41f758]
test eax, eax
jne 0x405d89
push eax
adc ah, dh
inc eax
add byte [edx + 4], ch
call 0x5440a8a9
xor dword [esi - 0x78a75cf4], 0x41
add byte [ebp - 0x507bf040], al
add byte [eax], al
add byte [ebp + 0x5651fc4d], cl
lea ecx, [ebp - 4]
push ecx
push esi
call eax
mov esi, eax
test esi, esi
je 0x405db3
mov edx, dword [ebp - 4]
mov ecx, edi
or al, 0x52
cmp dword [esi - 0x18], ebx
sub al, 0x48
add byte [eax], al
mov ecx, dword [ebp + 8]
add esp, 0xc
push esi
mov dword [ecx], eax
adc eax, 0x2740c0a0
push ebx
call dword [0x2740c054]
mov ebx, eax
call dword ss:[ebx - 1]
adc eax, sym.imp.MSVCRT.dll___p__environ
push eax
call fcn.00405e50
into
jge 0x405dde
add esp, 0xc
add al, 0xff
je 0x405dcf
les ecx, [esp + eax]
push dword [edx + edi*8 - 0x73]
xor al, 0x85
inc edi
add cl, dh
add byte [esi - 1], dl
lea esi, [eax*4 + 0xf10047]
push esi
call dword [0xc240c15c]
adc eax, 0xc240c15c
add esp, 4
mov dword [edi], eax
call dword [0xcc40e28d]
mov ebp, dword [ebx]
mov ecx, esi
mov esi, dword [eax]
mov edx, ecx
ror dword [ebx + edx*4 - 0x35315a0d], 0x83
loope 0x405e03
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov esi, dword [0x82402628]
call esi
mov ecx, dword [eax]
adc dword [ebp + 0x715074c9], eax
salc
mov edi, dword [eax]
call esi
push edi
mov dword [eax], 0
adc eax, 0xdac130
mov esi, 0xc03304c4
add ch, byte [ecx - 0x3da29175]
popal
add byte [edx + 1], ch
inc dword [edx + 0x21]
rol byte [eax - 0x4c], 0x56
sbb edi, edi
invalid

Function at 0x408c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insd dword es:[edi], dx
mov al, byte [0xe9905fb8]
push cs
add byte [eax], al
add byte [eax], bl
popal
sti
fld dword [ecx + 0x48e01cd0]
or al, 0x27
in eax, 6
lcall 0, 0xae9905a
add byte [ebp - 0x26], ah
les edx, [eax]
invalid
Function at 0x402480
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 8]
movq xmm0, qword [ecx + 6]
push ebx
push esi
movzx eax, word [ecx + 4]
lea esi, [ecx + 6]
push edi
mov word [ebp - 0x1c], ax
movzx eax, word [esi + 8]
push esi
mov word [ebp - 0x12], ax
mov al, byte [esi + 0xa]
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
push 0x440e30
mov dword [ebp - 0x20], 0x1820c1
movq qword [ebp - 0x1a], xmm0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0
call fcn.00416550
add esp, 0xc
test al, al
je 0x40257c
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40257c
push str.WCoinC
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x4024fe
or eax, eax
jmp 0x40250f
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
push str.WCoinP
mov dword [ebp - 0xc], eax
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x402525
or eax, eax
jmp 0x402536
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
push str.GoblinPoint
mov dword [ebp - 8], eax
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x40254c
or eax, eax
jmp 0x40255d
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
push dword [0x440e3c]
mov dword [ebp - 4], eax
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x4025ea
push dword [0x440e3c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x440e3c]
call ebx
push esi
push str.INSERT_INTO_CashShopData__AccountID_WCoinC_WCoinP_GoblinPoint__VALUES___s_0_0_0_
push 0x440e30
call fcn.00416550
add esp, 0xc
push dword [0x440e3c]
test al, al
jne 0x4025c9
call edi
push 2
push dword [0x440e3c]
call ebx
mov byte [ebp - 0xf], 1
jmp 0x4025ea
call edi
push 2
push dword [0x440e3c]
call ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x20
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.00418230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402610
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov ecx, dword [ebp + 8]
movq xmm0, qword [ecx + 6]
lea edx, [ecx + 6]
push esi
push edi
movzx eax, word [ecx + 4]
mov word [ebp - 0x38], ax
movzx eax, word [edx + 8]
mov word [ebp - 0x2e], ax
mov al, byte [edx + 0xa]
mov byte [ebp - 0x2c], al
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x20], eax
movzx eax, word [ecx + 0x20]
mov word [ebp - 0x1c], ax
mov eax, dword [ecx + 0x24]
push edx
mov dword [ebp - 0x18], eax
mov al, byte [ecx + 0x28]
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
push 0x440e30
mov dword [ebp - 0x3c], 0x1183cc1
mov dword [ebp + 8], edx
movq qword [ebp - 0x36], xmm0
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x14], al
call fcn.00416550
add esp, 0xc
test al, al
je 0x40279b
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40279b
push str.WCoinC
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x4026b6
or eax, eax
jmp 0x4026c7
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
push str.WCoinP
mov dword [ebp - 0x10], eax
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x4026dd
or eax, eax
jmp 0x4026ee
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
push str.GoblinPoint
mov dword [ebp - 0xc], eax
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x402704
or eax, eax
jmp 0x402715
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
push dword [0x440e3c]
mov esi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov dword [ebp - 8], eax
call esi
mov edi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x440e3c]
call edi
push 0x53
push dword [ebp + 8]
push str.SELECT_count___FROM_CashShopInventory_WHERE_AccountID_s_AND_InventoryType_d
push 0x440e30
call fcn.00416550
add esp, 0x10
test al, al
je 0x402787
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x402787
push 0x441a62
call fcn.00422137
add esp, 4
mov dword [ebp - 4], eax
push dword [0x440e3c]
call esi
push 2
push dword [0x440e3c]
call edi
jmp 0x4027b9
push dword [0x440e3c]
call esi
push 2
push dword [0x440e3c]
call edi
jmp 0x4027b5
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov byte [ebp - 0x2b], 1
push 0x3c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
call fcn.00418230
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403140
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x44000c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x11
mov ecx, 6
push esi
push edi
cmp byte [ebx + 0x11], 0
cmovne ecx, eax
mov ax, word [ecx + ebx + 8]
movq xmm0, qword [ecx + ebx]
mov word [ebp - 0xc], ax
mov al, byte [ecx + ebx + 0xa]
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
push eax
push str.SELECT_WCoinC_WCoinP_GoblinPoint_FROM_CashShopData_WHERE_AccountID_s
push 0x440e30
movq qword [ebp - 0x14], xmm0
call fcn.00416550
add esp, 0xc
test al, al
je 0x403287
push dword [0x440e3c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x403287
push str.WCoinC
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x4031c9
mov dword [ebp - 0x20], eax
jmp 0x4031dd
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
mov dword [ebp - 0x20], eax
push str.WCoinP
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x4031f1
mov dword [ebp - 0x1c], eax
jmp 0x403205
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
mov dword [ebp - 0x1c], eax
push str.GoblinPoint
call fcn.004167c0
cmp eax, 0xffffffff
jne 0x403219
mov dword [ebp - 0x18], eax
jmp 0x40322d
shl eax, 0xe
add eax, 0x441a62
push eax
call fcn.00422137
add esp, 4
mov dword [ebp - 0x18], eax
push dword [0x440e3c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov esi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x440e3c]
call esi
mov edx, dword [ebx + 0x24]
mov eax, closesocket
add edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp edx, eax
cmova edx, eax
add ecx, dword [ebx + 0x20]
cmp ecx, eax
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
add eax, dword [ebp - 0x20]
mov ebx, closesocket
cmp eax, 0x7fffffff
cmova eax, ebx
lea ebx, [ebp - 0x14]
push ebx
push edx
push ecx
push eax
push str.UPDATE_CashShopData_SET_WCoinC_d_WCoinP_d_GoblinPoint_d_WHERE_AccountID_s
jmp 0x4032b7
push dword [0x440e3c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov esi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x440e3c]
call esi
push dword [ebx + 0x24]
lea eax, [ebp - 0x14]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push eax
push str.INSERT_INTO_CashShopData__AccountID_WCoinC_WCoinP_GoblinPoint__VALUES___s__d__d__d_
push 0x440e30
call fcn.00416550
add esp, 0x18
push dword [0x440e3c]
call edi
push 2
push dword [0x440e3c]
call esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004197fb
mov esp, ebp
pop ebp
ret 4