joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422020
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
push 0xa
mov edx, dword [ebp + 0x10]
add edx, 0xe
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00434160
add esp, 0xc
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00434160
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.004063d0
add esp, 4
cmp eax, 1
jne 0x42225f
lea ecx, [ebp - 0x10]
push ecx
call fcn.00406360
add esp, 4
cmp eax, 1
jne 0x42225f
mov byte [ebp - 0x350], 0
push 0x11d
push 0
lea edx, [ebp - 0x34f]
push edx
call fcn.00433530
add esp, 0xc
push 0x11e
push 0xa1
lea eax, [ebp - 0x350]
push eax
call fcn.00406330
add esp, 0xc
mov byte [ebp - 0x128], 0
push 0x100
push 0
lea ecx, [ebp - 0x127]
push ecx
call fcn.00433530
add esp, 0xc
push 0xa
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34c]
push eax
call fcn.00434160
add esp, 0xc
push 0xa
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x341]
push edx
call fcn.00434160
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov cx, word [eax + 0x1a]
mov word [ebp - 0x336], cx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, 0xeff0
push eax
push str.SELECT_Name_FROM__s.dbo.OfficialHelper_WHERE_Name___s
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
push ecx
call fcn.00408880
add esp, 0x10
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
movsx edx, ax
cmp edx, 0x64
je 0x42217b
cmp dword [ebp - 0x22c], 0
jne 0x4221b6
push 0x101
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00433530
add esp, 0xc
mov byte [ebp - 0x127], 1
mov byte [ebp - 0x126], 0x11
mov byte [ebp - 0x111], 0x51
mov byte [ebp - 0x110], 0x15
mov byte [ebp - 0x10e], 0x20
jmp 0x42221e
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xeff0
push edx
push str.SELECT_Data_FROM__s.dbo.OfficialHelper_where_Name___s
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408e20
cmp eax, 0xffffffff
jne 0x42221e
push 0x101
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00433530
add esp, 0xc
push 0x101
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x334]
push edx
call fcn.00434160
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
push 0x11e
lea eax, [ebp - 0x350]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407670
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434051
mov esp, ebp
pop ebp
ret
Function at 0x422270
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e38
call fcn.004357f0
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
push 0xa
mov ecx, dword [ebp + 0xc]
add ecx, 0xf
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00434160
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.004063d0
add esp, 4
cmp eax, 1
jne 0x422425
lea ecx, [ebp - 0x10]
push ecx
call fcn.00406360
add esp, 4
cmp eax, 1
jne 0x422425
mov edx, dword [ebp + 0xc]
add edx, 0xf
push edx
mov eax, dword [ebp + 8]
add eax, 0xeff0
push eax
push str.SELECT_Name_FROM__s.dbo.OfficialHelper_WHERE_Name___s
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
push ecx
call fcn.00408880
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
movsx edx, ax
cmp edx, 0x64
je 0x422320
cmp dword [ebp - 0x14], 0
jne 0x4223c6
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov eax, dword [ebp + 0xc]
add eax, 0xf
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.INSERT_INTO__s.dbo.OfficialHelper__Name__VALUES___s_
mov edx, dword [ebp + 8]
add edx, 0x7d80
push edx
call fcn.00408880
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.UPDATE__s.dbo.OfficialHelper_SET_Data__WHERE_Name_s
lea edx, [ebp - 0x2728]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x101
mov eax, dword [ebp + 0xc]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x2728]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408fe0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
jmp 0x422417
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, 0xeff0
push eax
push str.UPDATE__s.dbo.OfficialHelper_SET_Data__WHERE_Name_s
lea ecx, [ebp - 0x4e38]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x101
mov edx, dword [ebp + 0xc]
add edx, 0x1c
push edx
lea eax, [ebp - 0x4e38]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408fe0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434051
mov esp, ebp
pop ebp
ret

Function at 0x422d60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x422db0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c6e00], eax
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x422f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c6dfc], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42aed0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x42ad80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c6eb8], eax
mov esp, ebp
pop ebp
ret
Function at 0x42fec0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 0xe
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00434160
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.004063d0
add esp, 4
cmp eax, 1
jne 0x430054
lea ecx, [ebp - 0x14]
push ecx
call fcn.00406360
add esp, 4
cmp eax, 1
jne 0x430054
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.SELECT_Name_Seconds_FROM__s.dbo.Race_Data_WHERE_Name___s_and_AccountID__s
mov edx, dword [ebp + 8]
add edx, 0x7d80
push edx
call fcn.00408880
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
cwde
cmp eax, 0x64
je 0x42ff72
cmp dword [ebp - 0x18], 0
jne 0x42ffd3
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
mov edx, dword [ebp + 8]
add edx, 0xeff0
push edx
push str.INSERT_INTO__s.dbo.Race_Data__AccountID__Name__Seconds__VALUES___s__s__d_
mov eax, dword [ebp + 8]
add eax, 0x7d80
push eax
call fcn.00408880
add esp, 0x18
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
jmp 0x42ffe9
push str.Seconds
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408c10
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x1c]
jle 0x430054
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 0xe
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.UPDATE__s.dbo.Race_Data_SET_Seconds_d_WHERE_Name_s_and_AccountID_s
mov edx, dword [ebp + 8]
add edx, 0x7d80
push edx
call fcn.00408880
add esp, 0x18
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00434051
mov esp, ebp
pop ebp
ret
Function at 0x431b10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 8
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00434160
add esp, 0xc
mov byte [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
push 0x1c
push 0xab
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004062e0
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x18], edx
push 0xa
mov eax, dword [ebp + 0x10]
add eax, 8
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00434160
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
call fcn.004063d0
add esp, 4
cmp eax, 1
jne 0x431c84
lea eax, [ebp - 0x24]
push eax
call fcn.00406360
add esp, 4
cmp eax, 1
jne 0x431c84
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xeff0
push edx
push str.SELECT_Name_FROM__s.dbo.BotPet_WHERE_Name_s
mov eax, dword [ebp + 8]
add eax, 0x7d80
push eax
call fcn.00408880
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
movsx ecx, ax
cmp ecx, 0x64
je 0x431c0f
cmp dword [ebp - 0x30], 0
jne 0x431c64
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, 0xeff0
push eax
push str.SELECT_Name_FROM__s.dbo.Character_WHERE_Name_s
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
push ecx
call fcn.00408880
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
movsx edx, ax
cmp edx, 0x64
je 0x431c60
cmp dword [ebp - 0x30], 0
jne 0x431c64
mov byte [ebp - 0x14], 1
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
push 0x1c
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407670
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434051
mov esp, ebp
pop ebp
ret
Function at 0x431ca0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
push 0xd
push 0xc3
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004062e0
add esp, 0xc
mov byte [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
push 9
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00434160
add esp, 0xc
push 9
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
lea ecx, [ebp - 0x29]
push ecx
call fcn.00434160
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call fcn.004063d0
add esp, 4
cmp eax, 1
jne 0x431e9e
lea eax, [ebp - 0x10]
push eax
call fcn.00406360
add esp, 4
cmp eax, 1
jne 0x431e9e
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
mov edx, dword [ebp + 8]
add edx, 0xeff0
push edx
push str.SELECT_SCFG_Gens_G_Master_FROM__s.dbo.Guild_WHERE_G_Name___s
mov eax, dword [ebp + 8]
add eax, 0x7d80
push eax
call fcn.00408880
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
movsx ecx, ax
cmp ecx, 0x64
je 0x431e7e
push str.SCFG_Gens
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408c10
mov byte [ebp - 0x20], al
lea edx, [ebp - 0x1c]
push edx
push str.G_Master
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408bc0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.SELECT_SCFGensFamily_FROM__s.dbo.Character_WHERE_Name___s
mov edx, dword [ebp + 8]
add edx, 0x7d80
push edx
call fcn.00408880
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
cwde
cmp eax, 0x64
je 0x431e04
cmp dword [ebp - 0x30], 0
jne 0x431e06
jmp 0x431e70
push str.SCFGensFamily
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408c10
mov dword [ebp - 0x34], eax
movzx ecx, byte [ebp - 0x20]
cmp dword [ebp - 0x34], ecx
je 0x431e70
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov dl, byte [ebp - 0x34]
mov byte [ebp - 0x20], dl
lea eax, [ebp - 0x1c]
push eax
movzx ecx, byte [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xeff0
push edx
push str.UPDATE__s.dbo.Guild_SET_SCFG_Gens_d_WHERE_G_Master___s
mov eax, dword [ebp + 8]
add eax, 0x7d80
push eax
call fcn.00408880
add esp, 0x14
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
push 0xd
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407670
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434051
mov esp, ebp
pop ebp
ret
Function at 0x432180
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push eax
call fcn.00402060
add esp, 4
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402040
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 1
jne 0x432273
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x432273
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
jne 0x432273
mov edx, dword [ebp + 8]
add edx, 0xf022
push edx
push str.INSERT__s.dbo.LuckyCoinsRank__Account_LuckyCoins_Date__SELECT_TOP_5_memb___id__SCFLuckyCoins_getdate___FROM_MEMB_INFO_WHERE_SCFLuckyCoins___0_ORDER_BY_SCFLuckyCoins_Desc
mov eax, dword [ebp + 8]
add eax, 0x7d80
push eax
call fcn.00408880
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov ecx, dword [ebp + 8]
add ecx, 0xf022
push ecx
push str.UPDATE__s.dbo.MEMB_INFO_SET_SCFLuckyCoins0
mov edx, dword [ebp + 8]
add edx, 0x7d80
push edx
call fcn.00408880
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
mov byte [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
push 4
push 0xd1
lea ecx, [ebp - 0x14]
push ecx
call fcn.004062e0
add esp, 0xc
mov byte [ebp - 0x11], 1
push 4
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407610
mov esp, ebp
pop ebp
ret
Function at 0x4329f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2934
call fcn.004357f0
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x130], 0
push 0x10b
push 0
lea eax, [ebp - 0x12f]
push eax
call fcn.00433530
add esp, 0xc
push 0x10c
push 0xdb
lea ecx, [ebp - 0x130]
push ecx
call fcn.00406330
add esp, 0xc
push 0xa
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
lea eax, [ebp - 0x12c]
push eax
call fcn.00434160
add esp, 0xc
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 0xe
push ecx
lea edx, [ebp - 0x121]
push edx
call fcn.00434160
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov cx, word [eax + 0x1a]
mov word [ebp - 0x116], cx
mov byte [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
push 0xa
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00434160
add esp, 0xc
mov byte [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov word [ebp - 0x13], dx
push 0xa
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00434160
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call fcn.004063d0
add esp, 4
cmp eax, 1
jne 0x432c1d
lea eax, [ebp - 0x10]
push eax
call fcn.00406360
add esp, 4
cmp eax, 1
jne 0x432c1d
mov byte [ebp - 0x220], 0
push 0xef
push 0
lea ecx, [ebp - 0x21f]
push ecx
call fcn.00433530
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.SELECT_Name_FROM__s.dbo.Character_WHERE_Name___s_and_AccountID___s
mov edx, dword [ebp + 8]
add edx, 0x7d80
push edx
call fcn.00408880
add esp, 0x14
mov dword [ebp - 0x2934], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408ad0
cwde
cmp eax, 0x64
je 0x432b58
cmp dword [ebp - 0x2934], 0
jne 0x432b70
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x220]
push ecx
call fcn.00433530
add esp, 0xc
jmp 0x432bdc
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeff0
push ecx
push str.SELECT_SCFMasterSkill_FROM__s.dbo.Character_where_Name___s_and_AccountID___s
lea edx, [ebp - 0x2930]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x2930]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408e20
cmp eax, 0xffffffff
jne 0x432bdc
push pe_nt_image_headers32
push 0
lea edx, [ebp - 0x220]
push edx
call fcn.00433530
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.00434160
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7d80
call fcn.00408a80
push 0x10c
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.00407670
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434051
mov esp, ebp
pop ebp
ret
Function at 0x434051
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454350]
jne 0x43405b
repz ret
jmp fcn.00439fc1

Function at 0x43f34f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x454350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00437157
and dword [ebp - 0x14], 0
cmp dword [0x75b854], 0
mov dword [ebp - 0x18], eax
jne 0x43f402
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x43f4aa
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x43f4aa
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x75b854], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x75b858], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x75b85c], eax
call edi
push eax
call esi
mov dword [0x75b864], eax
test eax, eax
je 0x43f402
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x75b860], eax
mov eax, dword [0x75b860]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x43f45b
cmp dword [0x75b864], ecx
je 0x43f45b
push eax
call esi
push dword [0x75b864]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x43f45b
test ebx, ebx
je 0x43f45b
call edi
test eax, eax
je 0x43f452
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43f452
test byte [ebp - 8], 1
jne 0x43f45b
or dword [ebp + 0x10], 0x200000
jmp 0x43f48e
mov eax, dword [0x75b858]
cmp eax, dword [ebp - 0x18]
je 0x43f48e
push eax
call esi
test eax, eax
je 0x43f48e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43f48e
mov eax, dword [0x75b85c]
cmp eax, dword [ebp - 0x18]
je 0x43f48e
push eax
call esi
test eax, eax
je 0x43f48e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x75b854]
call esi
test eax, eax
je 0x43f4aa
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x43f4ac
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434051
leave
ret
Function at 0x1546058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.015461a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x154607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x154606a
add dl, dl
jne 0x1546089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15460dc
xor eax, eax
add dl, dl
jne 0x1546096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x154617d
add dl, dl
jne 0x15460a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15460b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15460bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15460c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15460d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1546075
mov eax, 1
add dl, dl
jne 0x15460ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15460f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15460e1
sub eax, ebx
mov ebx, 1
jne 0x1546128
mov ecx, 1
add dl, dl
jne 0x154610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1546119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1546105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1546075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x154613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x154614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1546136
cmp eax, 0x7d00
jae 0x154616d
cmp eax, 0x500
jb 0x1546168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1546075
cmp eax, 0x7f
ja 0x1546170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1546075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x154619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1546075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x49b15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x39
pop eax
movzx edx, si
cmp si, ax
ja 0x49b161
add ecx, ebx
movzx eax, word [ecx]
mov esi, eax
mov edx, eax
cmp ax, di
jae 0x49b148
push 0x7d
pop esi
add al, 0xb0
add dword [ebx], edi
salc
sete al
jmp 0x49b175
push cs
mov eax, dword [0x8700c35b]
in al, 0x83
in al, dx
mov edx, dword [ebx + esi]
fcomi st(1)
add byte [edi], cl
cld
xor byte [ebp - 0x4c], al
invalid
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
je 0x401089
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp byte [esi], 0
je 0x401089
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x401089
and byte [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401062
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105b
test ebp, ebp
je 0x40105b
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401062
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401083
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
je 0x401083
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401014
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret