joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c70
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
lea edx, [esp + 4]
push ebx
push ebp
sub ecx, edx
push esi
push edi
lea ebp, [esp + 0x14]
mov eax, 0x46f6a0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], 8
xor dl, dl
xor esi, esi
mov edi, 6
mov cl, byte [eax]
mov ebx, bind
dec ecx
shr ebx, cl
mov ecx, dword [esp + 0x20]
test ecx, ebx
je 0x407cbc
mov ebx, 0x20
mov ecx, esi
sar ebx, cl
or dl, bl
inc esi
inc eax
dec edi
jne 0x407c9f
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + ebp]
xor cl, dl
mov byte [ebp], cl
mov ecx, dword [esp + 0x24]
inc ebp
dec ecx
mov dword [esp + 0x24], ecx
jne 0x407c96
xor ecx, ecx
lea edi, [esp + 0x14]
xor esi, esi
mov ebp, 8
xor eax, eax
mov al, byte [edi]
mov edx, eax
mov ebx, eax
shr edx, 4
and edx, 2
and ebx, 1
or edx, ebx
xor ebx, ebx
add edx, esi
add esi, 4
shr eax, 1
shl edx, 4
and eax, 0xf
shl ecx, 4
mov bl, byte [edx + eax + 0x46f6d0]
mov eax, ebx
add ecx, eax
inc edi
dec ebp
jne 0x407ce6
push ecx
call fcn.00407c30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x407de0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
mov bl, byte [esp + 0x14]
push esi
push edi
test bl, 0x20
je 0x407eb9
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
mov al, byte [ecx]
mov dl, byte [ecx + 1]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 2]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 3]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 5]
mov dword [esp + 0x1c], eax
xor eax, eax
mov al, byte [ecx + 4]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 6]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 7]
shl eax, 8
add eax, edx
test bl, 0x10
mov dword [esp + 0x14], eax
je 0x407e61
lea eax, [esp + 0x14]
push str.:2_
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00407d30
mov eax, dword [esp + 0x20]
add esp, 0xc
mov esi, dword [esp + 0x18]
mov edi, 0x10
push esi
push eax
call fcn.00407c70
mov edx, dword [esp + 0x24]
add esp, 8
xor eax, edx
mov edx, dword [esp + 0x14]
add esi, 8
dec edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
jne 0x407e6a
test bl, 0x40
je 0x407f7c
lea edx, [esp + 0x1c]
push 0x46f930
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00407d30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add esp, 0xc
jmp 0x407f7c
mov ecx, dword [esp + 0x14]
xor edx, edx
xor eax, eax
mov dl, byte [ecx]
mov al, byte [ecx + 1]
shl edx, 8
add edx, eax
xor eax, eax
mov al, byte [ecx + 2]
shl edx, 8
add edx, eax
xor eax, eax
mov al, byte [ecx + 3]
shl edx, 8
add edx, eax
xor eax, eax
mov al, byte [ecx + 4]
mov dword [esp + 0x14], edx
xor edx, edx
mov dl, byte [ecx + 5]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 6]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 7]
shl eax, 8
add eax, edx
test bl, 0x10
mov dword [esp + 0x1c], eax
je 0x407f2a
lea eax, [esp + 0x1c]
push str.:2_
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00407d30
mov eax, dword [esp + 0x28]
add esp, 0xc
mov edx, dword [esp + 0x18]
mov edi, 0x10
lea esi, [edx + 0x78]
push esi
push eax
call fcn.00407c70
mov edx, dword [esp + 0x1c]
add esp, 8
xor eax, edx
mov edx, dword [esp + 0x1c]
sub esi, 8
dec edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
jne 0x407f36
test bl, 0x40
je 0x407f7c
lea eax, [esp + 0x14]
push 0x46f930
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00407d30
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov ebx, eax
shr ebx, 0x18
mov byte [ecx], bl
mov ebx, eax
sar ebx, 0x10
mov byte [ecx + 1], bl
mov ebx, eax
mov byte [ecx + 3], al
mov eax, edx
shr eax, 0x18
mov byte [ecx + 4], al
mov eax, edx
sar eax, 0x10
mov byte [ecx + 5], al
mov eax, edx
sar ebx, 8
sar eax, 8
pop edi
mov byte [ecx + 2], bl
pop esi
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
pop ebx
ret
Function at 0x407fc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
test ebx, 0x10000000
je 0x407fdd
mov ecx, esi
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x407ffc
mov edx, dword [esp + 0x20]
push 0x60b8a40
push edx
call fcn.00407a40
add esp, 8
mov ecx, 0x60b8a40
test ebx, 0x20000000
je 0x408053
mov edi, dword [esp + 0x18]
mov ebp, esi
mov eax, edi
sub ebp, edi
mov dword [esp + 0x18], 8
mov dl, byte [eax + ebp]
xor byte [eax], dl
mov edx, dword [esp + 0x18]
inc eax
dec edx
mov dword [esp + 0x18], edx
jne 0x408016
and bl, 0x70
push ebx
push ecx
push edi
mov edi, dword [esp + 0x20]
push edi
call fcn.00407de0
mov ecx, edi
add esp, 0x10
mov eax, esi
sub ecx, esi
mov esi, 8
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x408045
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
and bl, 0x70
push ebx
push ecx
push ebp
push edi
call fcn.00407de0
mov ecx, esi
add esp, 0x10
mov eax, edi
sub ecx, edi
mov edi, 8
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec edi
jne 0x408075
mov ecx, ebp
mov eax, esi
sub ecx, esi
mov esi, 8
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x40808d
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409580
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
mov edx, dword [ebx + 0x38]
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ecx, dword [ebx + 0x38]
xor edi, edi
push edi
push eax
push ebp
push ecx
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jle 0x4095c2
mov edi, esi
cmp esi, 0xffffffff
jne 0x4095d3
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x40961d
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x40961d
cmp esi, 0x2746
je 0x40961d
cmp esi, 0x2745
je 0x40961d
cmp byte [edi + ebp - 2], 0xd
jne 0x4095fd
cmp byte [edi + ebp - 1], 0xa
je 0x40961d
mov edx, dword [esp + 0x28]
mov ecx, dword [ebx + 0x38]
sub edx, edi
push 0
lea eax, [edi + ebp]
push edx
push eax
push ecx
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jle 0x4095c2
add edi, esi
jmp 0x4095c2
cmp edi, 2
jle 0x40967b
push 3
lea edx, [esp + 0x14]
push ebp
push edx
call fcn.0045eb70
mov esi, dword [esp + 0x38]
add esp, 0xc
mov byte [esp + 0x13], 0
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x409667
test cl, cl
je 0x409663
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x409667
add eax, 2
add esi, 2
test cl, cl
jne 0x40963f
xor eax, eax
jmp 0x40966c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40967b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x413480
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push esi
push edi
je 0x41349d
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x818]
or edi, 0xffffffff
push eax
mov eax, dword [esp + 0x814]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
lea eax, [eax + edx*2]
mov edx, dword [0x476edd0]
lea eax, [eax + eax*4]
shl eax, 5
mov ecx, dword [eax + 0x643944]
lea eax, [esp + 0x10]
push ecx
push edx
push 0x476ed38
push str.SELECT_status_FROM_GATD__sDEVICE_WHERE_idkcom_d_AND_cntchannel_d_AND_iddevice_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x413553
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x413553
mov al, byte [esi + 4]
mov edi, 1
test al, al
jne 0x413540
xor edi, edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test esi, esi
je 0x413553
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x413660
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x804
push ebx
push ebp
push esi
push edi
push 0x46054d8
or ebp, 0xffffffff
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [esp + 0x820]
cmp al, 0x30
jne 0x41368a
mov ecx, str.vend1
jmp 0x413698
cmp al, 0x31
mov ecx, str.vend2
je 0x413698
mov ecx, str.vend3
push 0x476ed38
mov eax, dword [esp + 0x81c]
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
mov esi, dword [esp + 0x844]
push 0x476ed38
push 0x476ed38
push eax
push 0x476ed38
push eax
mov eax, dword [esp + 0x850]
push 0x476ed38
push eax
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea eax, [esi + esi*2]
push 0x476ed38
push ecx
lea ecx, [eax + eax*8]
mov ebx, dword [esp + 0x878]
push 0x476ed38
lea eax, [esi + ecx*8]
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea eax, [eax + eax*4]
lea ecx, [ebx + eax*8]
lea eax, [esi + esi*2]
mov edx, dword [ecx*4 + 0x643948]
lea eax, [eax + eax*8]
push edx
push 0x476ed38
lea eax, [esi + eax*8]
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
mov ecx, dword [0x476edd0]
lea edx, [eax + eax*4]
shl edx, 5
mov eax, dword [edx + 0x643944]
lea edx, [esp + 0x70]
push eax
push 0x476ed38
push ecx
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push str.SELECT_GATC__sAUTHAREE.idtime_FROM_codd__ssubject15_GATD__sDEVICE_GATC__sAUTHAREE_GATC__sBADGE_WHERE_GATD__sDEVICE.idkcom_d_AND_GATD__sDEVICE.cntchannel_d_AND_GATD__sDEVICE.cproword_d_AND_GATD__sDEVICE._sGATC__sAUTHAREE.idarea_AND_GATC__sAUTHAREE.idauthGATC__sBADGE.authacc_AND_GATC__sBADGE.hextessera_s_AND_codd__ssubject15.dtactivat__s_AND_codd__ssubject15.dtexpirat__s_AND_codd__ssubject15.idcompanyGATC__sBADGE.idcompany_AND_codd__ssubject15.idsubjectGATC__sBADGE.idsubject_AND_codd__ssubject15.idsystemGATC__sBADGE.idsystem_AND_codd__ssubject15.idticketGATC__sBADGE.idticket_AND_codd__ssubject15.dtactivatGATC__sBADGE.dtactivat
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x88
lea eax, [esp + 0x14]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00445210
mov ecx, dword [0x516f90]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov edi, eax
xor eax, eax
test edi, edi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x4137f2
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test al, al
jne 0x4137f2
mov al, byte [edi + 4]
test al, al
jne 0x4137df
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
mov ebp, eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
test edi, edi
je 0x4137f2
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebp, ebp
jle 0x41381c
push ebp
push ebx
push esi
call fcn.0042c330
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x804
ret
Function at 0x414b20
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push ebx
push esi
push edi
je 0x414b3e
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x804
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x814]
mov ebx, 1
mov esi, eax
push eax
shl esi, 6
sub esi, eax
push 0x476ed38
shl esi, 2
sub esi, eax
lea eax, [esp + 0x18]
shl esi, 5
push str.SELECT_fldefsortent_fldefsortusc_fldefsortrem_fldisabsort_FROM_GATC__sSORTIMP_WHERE_idsortimp_d
push eax
mov dword [esi + 0x5efd0c], ebx
mov dword [esi + 0x5efd10], ebx
mov dword [esi + 0x5efd14], ebx
mov dword [esi + 0x5eddb8], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x10]
push ebx
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
xor eax, eax
test edi, edi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x414c3f
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x24]
test al, al
jne 0x414c3f
mov al, byte [edi + 4]
test al, al
jne 0x414c2b
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x10]
call fcn.0045f9d8
mov dword [esi + 0x5efd0c], eax
mov edx, dword [edi]
push 2
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
mov dword [esi + 0x5efd10], eax
mov eax, dword [edi]
push 3
mov ecx, edi
call dword [eax + 0x10]
call fcn.0045f9d8
mov dword [esi + 0x5efd14], eax
mov edx, dword [edi]
push 4
mov ecx, edi
call dword [edx + 0x10]
call fcn.0045f9d8
mov dword [esi + 0x5eddb8], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
test edi, edi
je 0x414c41
mov edx, dword [edi]
push ebx
mov ecx, edi
call dword [edx]
jmp 0x414c41
xor ebx, ebx
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x804
ret
Function at 0x414c60
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x804
push esi
push edi
push 0x46054d8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x476ed38
mov eax, dword [esp + 0x814]
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push eax
push 0x476ed38
push eax
mov eax, dword [esp + 0x848]
push 0x476ed38
push eax
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea ecx, [esp + 0x58]
push str.SELECT_GATC__sBADGE.nosortimp_FROM_codd__ssubject15_GATC__sBADGE_WHERE_GATC__sBADGE.hextessera_s_AND_codd__ssubject15.dtactivat__s_AND_codd__ssubject15.dtexpirat__s_AND_codd__ssubject15.idcompanyGATC__sBADGE.idcompany_AND_codd__ssubject15.idsubjectGATC__sBADGE.idsubject_AND_codd__ssubject15.idsystemGATC__sBADGE.idsystem_AND_codd__ssubject15.idticketGATC__sBADGE.idticket_AND_codd__ssubject15.dtactivatGATC__sBADGE.dtactivat
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x54
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x414d50
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x414d50
mov al, byte [esi + 4]
test al, al
jne 0x414d3d
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
call fcn.0045f9d8
mov edi, eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
test esi, esi
je 0x414d50
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x414d70
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x804
push esi
push edi
push 0x46054d8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x476ed38
mov eax, dword [esp + 0x814]
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push eax
push 0x476ed38
push eax
mov eax, dword [esp + 0x848]
push 0x476ed38
push eax
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea ecx, [esp + 0x5c]
push str.SELECT_GATC__sBADGE.refbadgekey_GATC__sBADGE.refbadgelock_FROM_codd__ssubject15_GATC__sBADGE_WHERE_GATC__sBADGE.hextessera_s_AND_codd__ssubject15.dtactivat__s_AND_codd__ssubject15.dtexpirat__s_AND_codd__ssubject15.idcompanyGATC__sBADGE.idcompany_AND_codd__ssubject15.idsubjectGATC__sBADGE.idsubject_AND_codd__ssubject15.idsystemGATC__sBADGE.idsystem_AND_codd__ssubject15.idticketGATC__sBADGE.idticket_AND_codd__ssubject15.dtactivatGATC__sBADGE.dtactivat
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x58
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x414ea8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x414ea8
mov al, byte [esi + 4]
test al, al
jne 0x414e95
mov eax, dword [esp + 0x818]
push 1
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
mov ecx, dword [esp + 0x820]
lea eax, [eax + edx*2]
mov edx, dword [esi]
lea eax, [eax + eax*4]
lea edi, [ecx + eax*8]
mov ecx, esi
shl edi, 2
call dword [edx + 0x10]
call fcn.0045f9d8
mov dword [edi + 0x65689c], eax
mov eax, dword [esi]
push 2
mov ecx, esi
call dword [eax + 0x10]
call fcn.0045f9d8
mov dword [edi + 0x65691c], eax
mov edi, 1
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
test esi, esi
je 0x414ea8
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x4150c0
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x1804
call fcn.0045ec70
push ebx
push ebp
push esi
push edi
push 0x46054d8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x1820]
mov edi, dword [esp + 0x181c]
mov ebx, dword [esp + 0x1818]
push 0x46f4b4
push 0x46f4b4
push 0x46f4b4
push esi
push edi
push ebx
lea eax, [esp + 0x82c]
push 0x476030
push eax
call fcn.00414fa0
push 0x47602c
push 0x47602c
push 0x476028
push esi
push edi
push ebx
lea ecx, [esp + 0x4c]
push 0x476030
push ecx
call fcn.00414fa0
add esp, 0x40
lea edx, [esp + 0x14]
lea eax, [esp + 0x814]
mov ecx, dword [esp + 0x1824]
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push edx
push 0x476ed38
push eax
mov eax, dword [esp + 0x1850]
push 0x476ed38
mov edx, eax
push ecx
neg edx
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffe
push 0x476ed38
add edx, 2
test eax, eax
push edx
push 0x476ed38
sete cl
push ecx
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
push 0x476ed38
lea edx, [esp + 0x1068]
push str.SELECT_GATC__sTRANS.idtrans_FROM_GATC__sTRANS__GATD__sDEVICE_WHERE__GATC__sTRANS.versus0_OR_GATC__sTRANS.versus_d_OR_GATC__sTRANS.versus_d__AND_GATC__sTRANS.badge_s_AND_GATC__sTRANS.datora__s_AND_GATC__sTRANS.datora__s_AND_GATC__sTRANS.kcomGATD__sDEVICE.idkcom_AND_GATC__sTRANS.channelGATD__sDEVICE.cntchannel_AND_GATC__sTRANS.deviceGATD__sDEVICE.iddevice_AND_GATD__sDEVICE.flcater1
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x5c
lea eax, [esp + 0x1014]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00445210
mov ecx, dword [0x516f90]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x41522e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
test al, al
jne 0x41522e
mov al, byte [esi + 4]
test al, al
jne 0x41521b
mov ebp, 1
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
test esi, esi
je 0x41522e
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1804
ret
Function at 0x4193a0
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x804
test eax, eax
push esi
push edi
je 0x4193bc
xor eax, eax
pop edi
pop esi
add esp, 0x804
ret
push 0x46054d8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x810]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea edx, [ecx + ecx*2]
lea eax, [eax + edx*2]
mov edx, dword [0x476edd0]
lea eax, [eax + eax*4]
shl eax, 5
mov ecx, dword [eax + 0x643944]
lea eax, [esp + 0xc]
push ecx
push edx
push 0x476ed38
push str.SELECT_idstmt_FROM_GATC__sSTMT_WHERE_idkcom_d_AND_idchn_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esp + 0xc]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
xor eax, eax
test esi, esi
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x419467
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test al, al
jne 0x419467
mov al, byte [esi + 4]
test al, al
jne 0x419454
mov edi, 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test esi, esi
je 0x419467
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
add esp, 0x804
ret
Function at 0x41a940
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [0x476ecf4]
sub esp, 0x814
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x41a960
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x814
ret
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x830]
xor ebp, ebp
lea eax, [esi + 2]
push eax
call fcn.0045a970
push esi
mov edi, eax
call fcn.0045a970
shl eax, 8
mov esi, dword [esp + 0x834]
lea edx, [edi + eax - 1]
mov eax, dword [esp + 0x830]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea ecx, [ecx + ecx*2]
lea ecx, [eax + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [esi + ecx*8]
mov ecx, dword [ecx*4 + 0x654914]
push ecx
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*8]
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*2]
lea eax, [eax + eax*4]
shl eax, 5
mov ecx, dword [eax + 0x643944]
mov eax, dword [0x476edd0]
push ecx
push eax
push edx
push 0x476ed38
lea ecx, [esp + 0x40]
push str.SELECT_versus_FROM_GATC__sTRANS_WHERE_ntrans_04x_AND_kcom_d_AND_channel_d_AND_device_d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
lea edx, [esp + 0x24]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00445210
mov ecx, dword [0x516f90]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
test eax, eax
mov dword [0x476ecf4], eax
jne 0x41aab8
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x24]
test al, al
jne 0x41aab8
mov edi, 0x477694
or ecx, 0xffffffff
xor eax, eax
mov ebp, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x834]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebx + 4]
test al, al
jne 0x41aaa5
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, ebx
call dword [edx + 0x14]
mov edi, dword [eax + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x834]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.00445280
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
test ebx, ebx
je 0x41aab8
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
push 0x46054d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x814
ret