joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477ea3
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
push eax
lea eax, [ebp - 0x410]
push 0x518468
push eax
call fcn.004bafeb
mov ecx, dword [ebp + 0x10]
add esp, 0xc
lea edx, [ebp - 0x410]
mov eax, dword [ecx]
push 0
push edx
call dword [eax + 4]
mov esi, eax
test esi, esi
je 0x477f47
mov eax, dword [esi]
and dword [ebp + 8], 0
mov ecx, esi
call dword [eax + 0x68]
test eax, eax
jle 0x477f40
mov eax, dword [esi]
push 0x10
lea ecx, [ebp - 0x10]
push 0x51845c
push ecx
mov ecx, esi
call dword [eax + 0x3c]
push 0
lea eax, [ebp - 0x10]
push 0
push eax
mov eax, dword [esi]
push 0x518454
mov ecx, esi
call dword [eax + 0x44]
push eax
mov ecx, edi
call fcn.004780ca
mov eax, dword [esi]
inc dword [ebp + 8]
mov ecx, esi
call dword [eax + 0x6c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x68]
cmp dword [ebp + 8], eax
jl 0x477efc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
mov al, 1
pop esi
leave
ret 0xc
Function at 0x47ae26
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x4e4cf4
call fcn.004baf44
sub esp, 0x410
push ebx
push esi
mov esi, ecx
call fcn.004b487d
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x10], eax
call fcn.004b443f
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x40]
and dword [ebp - 4], 0
cmp ecx, 4
jb 0x47ae63
mov eax, dword [0x5269cc]
mov ebx, 0xa8
sub eax, dword [0x5269c8]
cdq
idiv ebx
cmp ecx, eax
jb 0x47ae8b
push 0xa2
push 0x518a34
push 0x518afc
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
xor bl, bl
jmp 0x47af28
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x47aeb5
push 0xa3
push 0x518a34
push 0x50ea78
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
jmp 0x47af28
mov ecx, dword [esi + 0x44]
cmp ecx, ebx
jne 0x47aecd
push 0xa4
push 0x518a34
push 0x50ba18
jmp 0x47aea1
mov eax, dword [ecx]
call dword [eax + 4]
push eax
lea eax, [ebp - 0x41c]
push 0x518ac4
push eax
call fcn.004bafeb
mov eax, dword [esi + 4]
push dword [esi + 0x40]
mov ebx, dword [eax]
call fcn.00404bcb
add esp, 0x10
mov ecx, eax
call fcn.00404b9c
mov ecx, dword [esi + 4]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [ebx + 4]
test al, al
jne 0x47af26
push 0xa8
push 0x518a34
push 0x518a9c
push 0x50a714
jmp 0x47ae77
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401538
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x48026a
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x4e5184
call fcn.004baf44
sub esp, 0x404
push esi
mov esi, ecx
push 0x5a
call fcn.0042a360
push eax
lea eax, [ebp - 0x410]
push 0x519534
push eax
call fcn.004bafeb
push dword [esi + 8]
call fcn.00404bcb
add esp, 0x14
mov ecx, eax
call fcn.00404b9c
mov edx, dword [eax]
lea ecx, [ebp - 0x410]
push 1
push ecx
mov ecx, eax
call dword [edx + 4]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
jne 0x48032a
push edi
mov edi, 0x5191e8
push 0x25d
push edi
push 0x519528
mov esi, 0x508530
push 0x509ec4
push esi
call fcn.00401466
mov eax, 0x519514
add esp, 0x14
test eax, eax
je 0x480309
push 0x260
push edi
push 0x5194fc
push 0x508548
push esi
call fcn.00401466
add esp, 0x14
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
pop edi
je 0x48031a
mov eax, dword [ecx]
call dword [eax + 8]
push 5
pop eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x10]
call fcn.00496523
mov edx, dword [eax]
push 0
mov ecx, eax
call dword [edx + 0x4c]
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
mov esi, eax
je 0x48034d
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
jmp 0x48031d
Function at 0x480351
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x48038b
push 0x267
push 0x5191e8
push 0x51966c
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
jmp 0x480425
mov ecx, esi
call fcn.0042a360
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push 0x51963c
push eax
call fcn.004bafeb
push dword [esi + 8]
call fcn.00404bcb
add esp, 0x10
mov ecx, eax
call fcn.00404b9c
mov edx, dword [eax]
lea ecx, [ebp - 0x404]
push 1
push ecx
mov ecx, eax
call dword [edx + 4]
mov edi, eax
test edi, edi
je 0x480425
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x4c]
mov ebx, eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push 0x64
lea eax, [ebp - 0x404]
push dword [ebp - 4]
push ebx
push 0x5195f4
push 0x400
push eax
call fcn.004bb643
push dword [esi + 8]
call fcn.00404bcb
add esp, 0x1c
mov ecx, eax
call fcn.00404b9c
mov edx, dword [eax]
lea ecx, [ebp - 0x404]
push 1
push ecx
mov ecx, eax
call dword [edx + 4]
test eax, eax
jne 0x48042c
xor al, al
jmp 0x480539
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push 0x64
lea eax, [ebp - 0x404]
push dword [ebp - 4]
push ebx
push 0x5195b0
push eax
call fcn.004bafeb
push dword [esi + 8]
call fcn.00404bcb
add esp, 0x18
mov ecx, eax
call fcn.00404b9c
mov edx, dword [eax]
lea ecx, [ebp - 0x404]
push ecx
mov ecx, eax
call dword [edx + 0xc]
mov ecx, esi
mov dword [ebp - 0x804], ebx
mov byte [ebp - 0x7fe], 1
call fcn.0042a360
mov dword [ebp - 0x7fc], eax
mov eax, dword [esi + 0xc]
push 0x10
lea ecx, [eax + 8]
mov eax, dword [eax + 8]
call dword [eax + 8]
push eax
lea eax, [ebp - 0x7f8]
push eax
call fcn.004b2bcb
push dword [esi + 8]
mov word [ebp - 0x800], 0x20
call fcn.00404bcb
mov edx, dword [eax]
add esp, 0x10
lea ecx, [ebp - 0x804]
push ecx
mov ecx, eax
call dword [edx + 0x44]
mov ecx, esi
call fcn.0042a360
push dword [esi + 8]
mov edi, eax
call fcn.00404bcb
pop ecx
mov ecx, eax
call fcn.0040c6d1
test edi, edi
je 0x4804fa
mov ecx, dword [eax + 4]
push edi
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebx, eax
test ebx, ebx
je 0x4804fa
push 0xa
mov ecx, ebx
call fcn.00436c3e
test eax, eax
jg 0x48051d
push 0x28c
push 0x5191e8
push 0x519378
push 0x509ec4
push 0x508530
call fcn.00401466
add esp, 0x14
jmp 0x48052c
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
push 1
push 0xffffffffffffffff
push 0xa
call dword [eax + 0x10]
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.0047fb91
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x488f84
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x4e595c
call fcn.004baf44
sub esp, 0x408
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov ecx, dword [edi + 8]
cmp ecx, 4
jb 0x488fbb
mov eax, dword [0x5269cc]
mov esi, 0xa8
sub eax, dword [0x5269c8]
cdq
idiv esi
cmp ecx, eax
jb 0x488fe0
push 0x31
push 0x51a540
push 0x518afc
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
xor al, al
jmp 0x489138
xor esi, esi
cmp dword [edi + 4], esi
jne 0x488ff5
push 0x32
push 0x51a540
push 0x50ea78
jmp 0x488fc7
mov ecx, dword [edi + 0xc]
cmp ecx, esi
jne 0x48900a
push 0x33
push 0x51a540
push 0x50ba18
jmp 0x488fc7
mov eax, dword [ecx]
call dword [eax + 4]
push eax
lea eax, [ebp - 0x414]
push 0x51a584
push eax
call fcn.004bafeb
push dword [edi + 8]
call fcn.00404bcb
add esp, 0x10
mov ecx, eax
call fcn.00404b9c
mov edx, dword [eax]
lea ecx, [ebp - 0x414]
push esi
push ecx
mov ecx, eax
call dword [edx + 4]
mov ebx, eax
cmp ebx, esi
je 0x488fd9
mov dword [ebp - 0x14], esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x68]
cmp dword [ebp - 0x14], eax
jge 0x489124
push dword [edi + 8]
call fcn.00489c27
mov esi, eax
pop ecx
test esi, esi
jne 0x48909b
and dword [ebp - 4], eax
test ebx, ebx
je 0x488fd9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x488fd9
push ebx
mov ecx, esi
call fcn.004a0136
test al, al
mov eax, dword [esi]
mov ecx, esi
jne 0x4890d1
call dword [eax + 4]
mov dword [ebp - 4], 2
jmp 0x48906d
call dword [eax + 8]
test al, al
mov eax, dword [esi]
jne 0x4890e8
mov ecx, esi
call dword [eax + 0x38]
mov ecx, esi
call fcn.0048b5be
jmp 0x489115
push 1
mov ecx, esi
call dword [eax + 0x30]
mov ecx, dword [edi + 4]
push esi
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [esi]
push 8
mov ecx, esi
call dword [eax + 0x28]
mov dword [esi + 8], eax
call sub.winmm.dll_timeGetTime
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [esi + 0xc], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x6c]
inc dword [ebp - 0x14]
jmp 0x48904b
test ebx, ebx
mov dword [ebp - 4], 4
je 0x489136
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4973ac
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esi + 0x14], eax
call fcn.00497545
pop ecx
mov dword [esi + 4], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x404]
push 0x51cbbc
push eax
call fcn.004bafeb
push dword [esi + 0x18]
call fcn.00404bcb
add esp, 0x10
mov ecx, eax
call fcn.00404b9c
mov edx, dword [eax]
lea ecx, [ebp - 0x404]
push ebx
push ecx
mov ecx, eax
call dword [edx + 4]
mov edi, eax
cmp edi, ebx
je 0x4974b4
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp + 8], ebx
call dword [eax + 0x68]
test eax, eax
jle 0x4974ad
mov eax, dword [edi]
push 2
mov ecx, edi
call dword [eax + 0x4c]
push eax
mov dword [ebp + 0xc], eax
call fcn.0045bc38
mov ecx, eax
call fcn.00444be9
test eax, eax
mov dword [ebp - 4], eax
je 0x497480
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov ebx, dword [ecx]
mov ecx, eax
call dword [edx + 8]
mov ecx, dword [esi + 4]
push eax
call dword [ebx + 0x18]
test eax, eax
jne 0x497480
mov ecx, dword [esi + 4]
push dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi]
push 3
mov ecx, edi
call dword [eax + 0x4c]
mov ebx, eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 8]
call fcn.00415abf
mov dword [eax], ebx
jmp 0x497493
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x51cb90
call fcn.00401394
add esp, 0xc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x6c]
mov eax, dword [edi]
inc dword [ebp + 8]
mov ecx, edi
call dword [eax + 0x68]
cmp dword [ebp + 8], eax
jl 0x497423
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 0xc
Function at 0x4979d9
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
mov esi, ecx
jne 0x4979fc
push 0x1d
push 0x51cc88
push 0x51cc70
jmp 0x497a49
cmp eax, dword [esi + 8]
mov ebx, dword [ebp + 0xc]
jne 0x497a16
cmp ebx, dword [esi + 0xc]
jne 0x497a16
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x10]
jne 0x497a19
jmp 0x497b4b
mov edi, dword [ebp + 0x10]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
test ecx, ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], edi
je 0x497a2e
mov eax, dword [ecx]
call dword [eax + 4]
push 1
call fcn.004980db
test eax, eax
pop ecx
mov dword [esi + 4], eax
jne 0x497a62
push 0x29
push 0x51cc88
push 0x51cc64
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
xor al, al
jmp 0x497b4d
push 0x32
push edi
push dword [esi + 8]
lea eax, [ebp - 0x400]
push ebx
push 0x51cc14
push eax
call fcn.004bafeb
mov ecx, dword [ebp + 0x14]
add esp, 0x18
lea edx, [ebp - 0x400]
mov eax, dword [ecx]
push 0
push edx
call dword [eax + 4]
mov edi, eax
test edi, edi
je 0x497b4b
mov eax, dword [edi]
and dword [ebp + 8], 0
mov ecx, edi
call dword [eax + 0x68]
test eax, eax
jle 0x497b44
call fcn.00426100
mov ebx, eax
test ebx, ebx
jne 0x497ad3
push 0x34
push 0x51cc88
push 0x50e848
push 0x508548
push 0x508530
call fcn.00401466
jmp 0x497b20
push edi
mov ecx, ebx
call fcn.0048ad95
test al, al
mov ecx, ebx
je 0x497b25
call fcn.0045b98d
test al, al
je 0x497af5
mov ecx, dword [esi + 4]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x497b2a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ecx, ebx
mov dword [ebp + 0xc], eax
call fcn.00411e56
push dword [ebp + 0x10]
push 0x51cc0c
push dword [ebp + 0xc]
push 0x5166d0
push 0x51111c
call fcn.004b2c2b
add esp, 0x14
jmp 0x497b2a
call fcn.00411e56
mov eax, dword [edi]
inc dword [ebp + 8]
mov ecx, edi
call dword [eax + 0x6c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x68]
cmp dword [ebp + 8], eax
jl 0x497aab
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4a09f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, 0x51de58
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x4a0a39
mov eax, dword [ebp + 8]
push 0xa
xor edx, edx
pop edi
lea ecx, [esi + eax]
mov eax, esi
div edi
mov al, byte [ebp + edx - 0xc]
xor al, byte [ecx]
mov dl, al
and dl, 0xf
shl dl, 4
shr al, 4
or dl, al
inc esi
cmp esi, dword [ebp + 0xc]
mov byte [ecx], dl
jl 0x4a0a0f
pop edi
pop esi
leave
ret
Function at 0x4a2204
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x4e6fe6
call fcn.004baf44
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], 0x4ede84
xor edi, edi
lea ecx, [esi + 8]
mov dword [ebp - 4], edi
call fcn.004a2a76
lea eax, [ebp - 0xd]
push edi
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.0042fa18
lea eax, [ebp - 0xd]
push edi
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 5
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.0042fa18
lea eax, [ebp - 0xd]
push edi
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 8
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.0042fa18
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 0xb
call fcn.004a22b7
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 0xc
call fcn.004a860f
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0x24a0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esi], 0x4ede6c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4a2993
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
call esi
sub eax, dword [0x5271dc]
cmp eax, 0x927c0
jb 0x4a29fc
push edi
call esi
mov dword [0x5271dc], eax
call fcn.004a26bb
mov esi, eax
push 9
add esi, 0xc
pop ecx
lea edi, [ebp - 0x28]
lea eax, [ebp - 4]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004bb3b1
lea eax, [ebp - 0x28]
push eax
call fcn.004bc4af
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp - 4]
sub ecx, eax
js 0x4a29ed
cmp ecx, 0x794a00
jle 0x4a29f1
xor al, al
jmp 0x4a29fe
call fcn.004a26bb
add eax, 0x48
or dword [eax], 0x10
mov al, 1
pop esi
leave
ret

Function at 0x4a2a22
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 2
call dword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x4a2a45
push 0x51e384
jmp 0x4a2a63
cmp byte [ebp - 0x190], 2
jne 0x4a2a5e
xor eax, eax
mov al, byte [ebp - 0x18f]
test al, al
jne 0x4a2a5e
inc al
leave
ret
push 0x51e35c
call fcn.00401466
pop ecx
xor al, al
leave
ret
Function at 0x4a450b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e71ee
call fcn.004baf44
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4edfec
xor ebx, ebx
mov dword [esi + 4], 0x4edfdc
mov dword [esi + 8], 0x4eaaf0
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 5
call fcn.004a7c0d
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 6
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
call fcn.004a860f
lea eax, [esi + 0x24e8]
mov dword [esi + 0x24e4], ebx
push ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
or dword [esi + 0x44], 0xffffffff
mov dword [esi], 0x4edfb0
mov dword [esi + 4], 0x4edfa0
mov dword [esi + 8], 0x4edf90
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x24a0], ebx
mov dword [esi + 0x24a4], ebx
mov dword [esi + 0x24a8], ebx
mov dword [esi + 0x24ac], ebx
mov byte [esi + 0x24b0], bl
mov byte [esi + 0x24c0], bl
mov byte [esi + 0x24d0], bl
mov dword [esi + 0x24e0], 0x16b8
call fcn.004bb3b1
pop ecx
mov dword [esi + 0x50], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4a8c2e
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
jne 0x4a8c5c
push 0x14f
push 0x51f674
push 0x51f6c0
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
jmp 0x4a8c77
and dword [eax], 0
cmp dword [esi + 0x2028], 2
jne 0x4a8c77
mov edx, dword [esi + 0x1c]
cmp edx, 0xffffffff
jne 0x4a8c7e
mov ecx, esi
call fcn.004a8d76
xor eax, eax
jmp 0x4a8d00
cmp byte [esp + 0xc], 0
push edi
je 0x4a8cf0
mov eax, dword [esi + 0x1020]
mov ecx, 0x1000
cmp eax, ecx
jge 0x4a8cf0
sub ecx, eax
push 0
lea eax, [eax + esi + 0x20]
push ecx
push eax
push edx
call dword [sym.imp.ws2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x4a8cd6
cmp byte [esi + 0x202c], 0
je 0x4a8cce
mov eax, dword [esi + 0x1020]
push 1
push edi
lea ecx, [esi + 0x2238]
lea eax, [esi + eax + 0x20]
push eax
call fcn.004a8f83
add dword [esi + 0x1020], edi
jmp 0x4a8cf0
je 0x4a8ce9
test edi, edi
jge 0x4a8cf0
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4a8cf0
mov ecx, esi
call fcn.004a8d76
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x1020]
pop edi
mov dword [ecx], eax
lea eax, [esi + 0x20]
pop esi
ret 8

Function at 0x4a8e4d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x2028], 2
jne 0x4a8ee1
mov eax, dword [esi + 0x2024]
test eax, eax
jne 0x4a8e6d
mov al, 1
jmp 0x4a8ee3
lea ebx, [esi + 0x1024]
push 0
push eax
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.ws2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x4a8eda
mov eax, dword [esi + 0x2024]
sub eax, edi
test eax, eax
jle 0x4a8ea4
push eax
lea eax, [edi + esi + 0x1024]
push eax
push ebx
call fcn.004bbee0
add esp, 0xc
sub dword [esi + 0x2024], edi
jns 0x4a8ecd
push 0x1cc
push 0x51f674
push 0x51f6d8
push 0x50a2a4
push 0x508530
call fcn.00401466
add esp, 0x14
xor eax, eax
cmp dword [esi + 0x2024], eax
sete al
jmp 0x4a8ee3
mov ecx, esi
call fcn.004a8d76
xor al, al
pop edi
pop esi
pop ebx
ret
Function at 0x4a90ec
Capabilities:
Reference sql statements

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, ecx
push 0
mov eax, dword [edi]
push 0x51f74c
mov ecx, edi
call dword [eax + 4]
mov esi, eax
test esi, esi
jne 0x4a911a
push 0x24
push 0x51f708
push 0x50c770
jmp 0x4a91b6
mov eax, dword [esi]
and dword [esp + 0x10], 0
mov ecx, esi
call dword [eax + 0x68]
test eax, eax
jle 0x4a918e
push ebp
call fcn.004a91d4
mov ebp, eax
test ebp, ebp
jne 0x4a9156
push 0x28
push 0x51f708
push 0x50d7bc
push 0x509ec4
push 0x508530
call fcn.00401466
add esp, 0x14
jmp 0x4a9175
push esi
mov ecx, ebp
call fcn.004adfea
test al, al
je 0x4a916d
mov ecx, dword [ebx + 4]
push ebp
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x4a9175
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x20]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x6c]
mov eax, dword [esi]
inc dword [esp + 0x14]
mov ecx, esi
call dword [eax + 0x68]
cmp dword [esp + 0x14], eax
jl 0x4a912b
pop ebp
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, dword [edi]
push 0
push 0x50c390
mov ecx, edi
call dword [eax + 4]
test eax, eax
mov dword [ebx + 8], eax
jne 0x4a91cc
push 0x34
push 0x51f708
push 0x51f6fc
push 0x50a2f0
push 0x508530
call fcn.00401466
add esp, 0x14
xor al, al
jmp 0x4a91ce
mov al, 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x4aa99b
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
call fcn.004a57ea
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov edx, dword [eax]
push 1
push 0x51fbe8
mov ecx, eax
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x4aaa36
mov eax, dword [esi]
push ebx
mov ecx, esi
xor ebx, ebx
call dword [eax + 0x68]
test eax, eax
jle 0x4aaa2e
add edi, 0x54
mov eax, dword [esi]
push 0x51fbe0
mov ecx, esi
call dword [eax + 0x1c]
mov byte [ebp - 4], al
mov eax, dword [esi]
push 0x51fbd8
mov ecx, esi
call dword [eax + 0x1c]
mov byte [ebp - 3], al
mov eax, dword [esi]
push 0x51fbd0
mov ecx, esi
call dword [eax + 0x1c]
mov byte [ebp - 2], al
mov eax, dword [esi]
push 0x51fbc8
mov ecx, esi
call dword [eax + 0x1c]
mov byte [ebp - 1], al
lea eax, [ebp - 4]
push eax
mov ecx, edi
call fcn.004159e1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x6c]
mov eax, dword [esi]
mov ecx, esi
inc ebx
call dword [eax + 0x68]
cmp ebx, eax
jl 0x4aa9d4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x4aba55
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [ecx + 8]
push ebx
sub eax, dword [ecx + 4]
push esi
lea esi, [ecx + 4]
xor edx, edx
test eax, 0xfffffffc
push edi
jle 0x4aba94
mov edi, dword [esi]
mov ecx, edi
mov eax, dword [ecx]
test eax, eax
je 0x4aba84
mov ebx, dword [ebp + 8]
cmp dword [eax], ebx
je 0x4abae5
mov eax, dword [esi + 4]
inc edx
sub eax, dword [esi]
add ecx, 4
sar eax, 2
cmp edx, eax
jl 0x4aba77
push 4
lea eax, [ebp - 0x400]
pop ebx
push dword [ebp + 8]
push 0x51fd10
push eax
call fcn.004bafeb
add esp, 0xc
call fcn.004a57ea
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov edx, dword [eax]
lea ecx, [ebp - 0x400]
push 1
push ecx
mov ecx, eax
call dword [edx + 4]
mov edi, eax
test edi, edi
je 0x4abb58
push 0x10
call fcn.004d64c3
test eax, eax
pop ecx
je 0x4abaf0
and dword [eax], 0
jmp 0x4abaf2
mov eax, dword [edi + edx*4]
mov eax, dword [eax + 4]
add eax, 4
jmp 0x4abb5a
xor eax, eax
test eax, eax
mov dword [ebp + 8], eax
je 0x4abb51
mov eax, dword [edi]
push 0x514fd8
mov ecx, edi
call dword [eax + 0x44]
mov ecx, dword [ebp + 8]
push 0x51fc84
mov dword [ecx], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
mov ecx, dword [ebp + 8]
push 0x5127b0
mov dword [ecx + 4], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
mov ecx, dword [ebp + 8]
push 0x5127a4
mov dword [ecx + 8], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004abba2
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4