joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440fb4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x18e
lea eax, [ebp - 0x322]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [ebp - 0x324], bx
call fcn.004a7110
push 0x7f
lea eax, [ebp - 0x8b]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004a7110
push 0x103
lea eax, [ebp - 0x193]
push ebx
push eax
mov byte [ebp - 0x194], bl
call fcn.004a7110
add esp, 0x24
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x330], ebx
jge 0x441031
mov dword [ebp + 8], 0x104
cmp edi, ebx
je 0x44116c
cmp esi, ebx
je 0x44116c
cmp dword [ebp + 8], ebx
jle 0x44116c
call fcn.00498efc
push edi
push 0x7e
pop ecx
lea eax, [ebp - 0x8c]
mov byte [esi], bl
call fcn.00475883
lea eax, [ebp - 0x194]
call fcn.004757d4
mov edi, 0x4d9a00
push edi
lea eax, [ebp - 0x330]
lea ecx, [ebp - 0x8c]
call fcn.0047717c
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x328], eax
je 0x4410a3
push edi
lea eax, [ebp - 0x330]
xor ecx, ecx
call fcn.0047717c
pop ecx
mov dword [ebp - 0x328], eax
mov edx, dword [ebp - 0x328]
call fcn.00475851
test eax, eax
jne 0x4410d9
push dword [ebp - 0x328]
mov ecx, 0x104
lea eax, [ebp - 0x194]
call fcn.00475883
push 0x3a
xor eax, eax
lea edi, [ebp - 0x194]
call fcn.004765d4
pop ecx
pop ecx
lea ebx, [ebp - 0x8c]
call fcn.004403a4
test eax, eax
je 0x44116c
call fcn.0046c54c
test eax, eax
jne 0x44117d
mov byte [esi], al
lea eax, [ebp - 0x324]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x44116c
mov ecx, ebx
call fcn.00440c3b
push 2
mov dword [ebp - 0x32c], eax
push 4
lea eax, [ebp - 0x32c]
push eax
call sub.WSOCK32.dll_gethostbyaddr
mov edi, eax
test edi, edi
je 0x441155
mov eax, dword [edi]
test eax, eax
je 0x441155
push eax
call fcn.004a63c0
test eax, eax
pop ecx
jbe 0x441155
push dword [edi]
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00475883
pop ecx
xor edi, edi
jmp 0x441158
or edi, 0xffffffff
call sub.WSOCK32.dll_WSACleanup
test edi, edi
jne 0x44116c
push esi
call fcn.004a63c0
test eax, eax
pop ecx
ja 0x4411a5
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
cmp eax, 1
jne 0x441189
push str.WebSrv22
jmp 0x44119a
cmp eax, 2
jne 0x441195
push str.WebSrv21
jmp 0x44119a
push str.Mission_Control
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00475883
pop ecx
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp + 8]
call fcn.00475953
pop ecx
call fcn.00498efc
mov eax, esi
jmp 0x44116e
Function at 0x442a8c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and word [ebp - 0x14], 0
and dword [ebp - 4], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x2130
mov esi, str..Network.c
push esi
stosd dword es:[edi], eax
push str.addrchng.flg
push 0
stosw word es:[edi], ax
call fcn.00459ede
pop ecx
pop ecx
mov edx, 0x4c5348
mov ecx, eax
call fcn.0041a89d
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x442b14
push 0x2135
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004998ed
call fcn.0040ef2e
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004a612e
push edi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004a612e
add esp, 0x2c
mov ecx, edi
call fcn.0041acca
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x442b2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
mov word [esp + 0x10], si
xor eax, eax
lea edi, [esp + 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x2152
mov ebx, str..Network.c
push ebx
stosd dword es:[edi], eax
push str.addrchng.flg
push esi
stosw word es:[edi], ax
mov dword [esp + 0x1c], esi
call fcn.00459ede
pop ecx
pop ecx
mov edx, 0x4c520c
mov ecx, eax
call fcn.0041a89d
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x442b83
xor eax, eax
jmp 0x442cce
push edi
push 1
lea eax, [esp + 0x14]
push 4
push eax
call fcn.004a7455
push edi
push 1
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004a7455
add esp, 0x20
mov ecx, edi
call fcn.0041acca
call fcn.0040ef2e
test eax, eax
jne 0x442bf4
push 0x215b
push ebx
lea esi, [esp + 0x28]
call fcn.00499889
push ecx
push ecx
mov edi, esp
lea esi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00498649
push eax
call fcn.004a863d
add esp, 0x24
cmp eax, 0x6ddd000
jle 0x442bf4
call fcn.00442b18
push 0x215f
push ebx
lea esi, [esp + 0x28]
call fcn.00499889
push ecx
push ecx
mov edi, esp
lea esi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00498649
push eax
call fcn.004a863d
add esp, 0x24
cmp eax, 0x240c8400
jle 0x442c39
call fcn.00442b18
jmp 0x442b7c
call fcn.0040ef2e
test eax, eax
je 0x442c82
push 0x2165
push ebx
lea esi, [esp + 0x28]
call fcn.00499889
push ecx
push ecx
mov edi, esp
lea esi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00498649
push eax
call fcn.004a863d
xor ecx, ecx
add esp, 0x24
cmp eax, 0x5cb2780
setle cl
jmp 0x442ccc
cmp dword [esp + 0xc], 0
je 0x442c8e
xor eax, eax
inc eax
jmp 0x442cce
push 0x216d
push ebx
lea esi, [esp + 0x28]
call fcn.00499889
push ecx
push ecx
mov edi, esp
lea esi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00498649
push eax
call fcn.004a863d
xor ecx, ecx
add esp, 0x24
cmp eax, 0x4b87f00
setl cl
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444de3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push 0x31
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x3b]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x248], ebx
mov byte [ebp - 0x3c], bl
call fcn.004a7110
add esp, 0xc
push 0xff
lea eax, [ebp - 0x13b]
push ebx
push eax
mov byte [ebp - 0x13c], bl
call fcn.004a7110
add esp, 0xc
push 0x103
lea eax, [ebp - 0x243]
push ebx
push eax
mov byte [ebp - 0x244], bl
call fcn.004a7110
add esp, 0xc
mov edx, esi
call fcn.00475851
test eax, eax
je 0x444e66
xor eax, eax
jmp 0x444fe4
push esi
lea edi, [ebp - 0x244]
call fcn.004411be
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
pop ecx
push ebx
mov edi, 0x80000020
push edi
push 1
push ebx
push 7
push 6
lea eax, [ebp - 0x244]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x250], eax
jne 0x444ee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push edi
push 4
push ebx
push 7
push 6
lea eax, [ebp - 0x244]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x250], eax
jne 0x444ee8
call fcn.00498efc
sub eax, dword [0x5faad0]
cmp eax, 0xea60
ja 0x444ed9
call fcn.0040ef2e
test eax, eax
jne 0x444e5f
call fcn.00498efc
mov dword [0x5faad0], eax
jmp 0x444e5f
push 0x32
lea eax, [ebp - 0x3c]
call fcn.0043c5ae
cmp dword [ebp + 8], ebx
pop ecx
je 0x444f09
push 0x4c5438
push 0x32
pop eax
lea esi, [ebp - 0x3c]
call fcn.00475953
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x13c]
push str._nLock_was_initiated_by:__s
push eax
call fcn.004a708e
add esp, 0xc
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a63c0
mov esi, dword [ebp - 0x250]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
call edi
test eax, eax
jne 0x444f57
inc dword [0x5faacc]
mov edx, dword [ebp - 0x24c]
call fcn.00475851
test eax, eax
jne 0x444fa0
push dword [ebp - 0x24c]
lea eax, [ebp - 0x13c]
push str._nIn_Source_File:__s
push eax
call fcn.004a708e
add esp, 0xc
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a63c0
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
call edi
cmp dword [ebp + 0x10], ebx
jle 0x444fdc
push dword [ebp + 0x10]
lea eax, [ebp - 0x13c]
push str._nFrom_Source_Line:__d
push eax
call fcn.004a708e
add esp, 0xc
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a63c0
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
call edi
call fcn.0041b138
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
Function at 0x4460aa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x29b]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x29c], bl
call fcn.004a7110
add esp, 0xc
push edi
lea eax, [ebp - 0x193]
push ebx
push eax
mov byte [ebp - 0x194], bl
call fcn.004a7110
add esp, 0xc
push 0x7f
lea eax, [ebp - 0x8b]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004a7110
xor eax, eax
mov word [ebp - 0x334], bx
lea edi, [ebp - 0x332]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x344], bx
lea edi, [ebp - 0x342]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp esi, ebx
stosw word es:[edi], ax
jne 0x446156
push str.StoreId.dat
lea edi, [ebp - 0x29c]
call fcn.004412cb
jmp 0x446167
push esi
mov ecx, 0x104
lea eax, [ebp - 0x29c]
call fcn.00475883
pop ecx
lea edx, [ebp - 0x29c]
call fcn.00475851
test eax, eax
je 0x446188
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
call fcn.004a75cc
push eax
push str.StoreId.dat
push ebx
push ebx
call fcn.00459ede
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x194]
push str._stempGet_s_d
push eax
call fcn.004a708e
add esp, 0x14
lea eax, [ebp - 0x194]
call fcn.004189f3
lea edx, [ebp - 0x194]
lea ecx, [ebp - 0x29c]
call fcn.00418a9e
test eax, eax
je 0x446177
push 0x10
lea eax, [ebp - 0x334]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004a7110
add esp, 0xc
push 0x10
lea eax, [ebp - 0x344]
push ebx
push eax
call fcn.004a7110
add esp, 0xc
push 0x2a5b
push str..Network.c
mov edx, 0x4c520c
lea ecx, [ebp - 0x194]
call fcn.0041a89d
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x320], eax
je 0x446177
push 0x7f
lea eax, [ebp - 0x31b]
push ebx
push eax
mov byte [ebp - 0x31c], bl
call fcn.004a7110
add esp, 0xc
push dword [ebp - 0x320]
mov edi, 0x80
push edi
lea esi, [ebp - 0x8c]
call fcn.0046b66b
push ebx
push 0xa
call fcn.004763bc
push dword [ebp - 0x320]
lea esi, [ebp - 0x31c]
push edi
call fcn.0046b66b
push dword [ebp - 0x320]
lea eax, [ebp - 0x334]
push 1
push 0x10
push eax
call fcn.004a7455
mov ecx, dword [ebp - 0x320]
add esp, 0x28
call fcn.0041acca
mov edi, dword [ebp - 0x324]
cmp edi, ebx
je 0x4462a6
lea esi, [ebp - 0x334]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
sub esp, 0x10
lea esi, [ebp - 0x334]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00498023
add esp, 0x14
test eax, eax
jne 0x4462ee
cmp dword [ebp - 0x324], ebx
je 0x4462dc
push 0x10
push ebx
push dword [ebp - 0x324]
call fcn.004a7110
add esp, 0xc
lea eax, [ebp - 0x194]
call fcn.004189f3
mov eax, ebx
jmp 0x446179
xor ebx, ebx
inc ebx
jmp 0x4462dc
Function at 0x447971
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.004a7110
add esp, 0xc
push str.lnd.reg
push ebx
push ebx
call fcn.00459ede
pop ecx
pop ecx
push eax
push 0x4c64d0
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00476e0a
push 0x2e97
push str..Network.c
mov edx, 0x4c520c
lea ecx, [ebp - 0x110]
call fcn.0041a89d
mov edi, eax
add esp, 0x1c
cmp edi, ebx
jne 0x4479f0
xor eax, eax
jmp 0x447a1b
call fcn.00447927
mov esi, eax
cmp esi, ebx
je 0x4479ec
push edi
push 0x1a
push 0x27c
push esi
call fcn.004a7455
mov ecx, edi
call fcn.0041acca
push ebx
mov eax, esi
call fcn.0044793e
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret

Function at 0x447a2a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x10f]
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.004a7110
add esp, 0xc
cmp esi, edi
jne 0x447a71
xor eax, eax
jmp 0x447b3a
push str.lnd.reg
push edi
push edi
call fcn.00459ede
pop ecx
pop ecx
push eax
push 0x4c64d0
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00476e0a
add esp, 0x14
movsx eax, byte [esi]
call fcn.004756e0
cmp eax, 0x61
jl 0x447aab
cmp eax, 0x7a
jle 0x447ac4
inc edi
add esi, 0x27c
cmp edi, 0x1a
jl 0x447a99
lea eax, [ebp - 0x110]
call fcn.004189f3
jmp 0x447b3a
push 0x2eca
mov edi, str..Network.c
mov esi, 0x4c5348
push edi
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0041a89d
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x447b13
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2ecd
push edi
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0041a89d
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x447a6a
push ebx
push 0x1a
push 0x27c
push dword [ebp - 0x114]
call fcn.004a612e
add esp, 0x10
mov ecx, ebx
mov esi, eax
call fcn.0041acca
xor eax, eax
cmp esi, 0x1a
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
Function at 0x448726
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x120], edi
mov byte [ebp - 0x110], bl
call fcn.004a7110
add esp, 0xc
push 0x8c
lea eax, [ebp - 0x1ac]
push ebx
push eax
mov dword [ebp - 0x1b0], ebx
call fcn.004a7110
add esp, 0xc
cmp edi, ebx
mov dword [ebp - 0x118], ebx
jne 0x448797
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
mov esi, 0x90
push esi
push ebx
push edi
mov dword [ebp - 0x114], 1
call fcn.004a7110
add esp, 0xc
push 0x32ab
push str..Network.c
push 0x280
call fcn.0044198e
add esp, 0xc
push str.fTender.cfg
lea edi, [ebp - 0x110]
call fcn.004411be
pop ecx
push ebx
push 0x20
push 3
push 0x80000000
mov eax, edi
call fcn.004179ab
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x11c], eax
jne 0x448800
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x448786
push ebx
lea ecx, [ebp - 0x118]
push ecx
push esi
lea ecx, [ebp - 0x1b0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44882d
mov esi, dword [ebp - 0x11c]
call fcn.0041b138
mov eax, ebx
jmp 0x448788
cmp dword [ebp - 0x118], esi
jae 0x44884c
push esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.004a7110
add esp, 0xc
mov dword [ebp - 0x114], ebx
cmp dword [ebp - 0x1b0], ebx
jl 0x44885d
cmp dword [ebp - 0x1b0], 7
jle 0x448874
push esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.004a7110
add esp, 0xc
mov dword [ebp - 0x114], ebx
mov edi, dword [ebp - 0x120]
mov ebx, dword [ebp - 0x114]
push 0x24
pop ecx
lea esi, [ebp - 0x1b0]
rep movsd dword es:[edi], dword [esi]
jmp 0x44881b
Function at 0x44d556
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
mov ebx, eax
jne 0x44d569
mov edi, 0x5fbcc8
mov eax, dword [ebp + 0x14]
dec eax
dec eax
je 0x44d6d7
dec eax
je 0x44d5f4
push dword [ebp + 8]
mov eax, dword [ebp + 0x14]
call fcn.0044d81d
push eax
push str.DRIVER_s_SERVER_s_OPTION3_
mov esi, 0x200
push esi
push edi
call fcn.00476e0a
add esp, 0x14
mov edx, ebx
call fcn.00475851
test eax, eax
jne 0x44d5b1
push ebx
push str.DATABASE_s_
mov eax, esi
call fcn.00476dc8
pop ecx
pop ecx
mov edx, dword [ebp + 0xc]
call fcn.00475851
test eax, eax
jne 0x44d5ce
push dword [ebp + 0xc]
mov eax, esi
push str.USER_s_
call fcn.00476dc8
pop ecx
pop ecx
mov edx, dword [ebp + 0x10]
call fcn.00475851
test eax, eax
jne 0x44d760
push dword [ebp + 0x10]
mov eax, esi
push str.PASSWORD_s_
call fcn.00476dc8
pop ecx
pop ecx
jmp 0x44d760
push 3
pop eax
call fcn.0044d81d
push eax
push str.DRIVER_s_
mov esi, 0x200
push esi
push edi
call fcn.00476e0a
push dword [ebp + 8]
mov eax, esi
push str.HOST_s_
call fcn.00476dc8
push dword [ebp + 8]
mov eax, esi
push str.SERVERtms_server_
call fcn.00476dc8
push str.SERVICE1525_
mov eax, esi
call fcn.00476dc8
push str.PROTOCOLontlitcp_
mov eax, esi
call fcn.00476dc8
add esp, 0x28
mov edx, ebx
call fcn.00475851
test eax, eax
jne 0x44d661
push ebx
push str.DATABASE_s_
mov eax, esi
call fcn.00476dc8
pop ecx
pop ecx
mov edx, dword [ebp + 0xc]
call fcn.00475851
test eax, eax
jne 0x44d67e
push dword [ebp + 0xc]
mov eax, esi
push str.UID_s_
call fcn.00476dc8
pop ecx
pop ecx
cmp dword [ebp + 0x10], 0
je 0x44d695
push dword [ebp + 0x10]
mov eax, esi
push str.PWD_s_
call fcn.00476dc8
pop ecx
pop ecx
mov ebx, str.informix_
push ebx
push 0
call fcn.00459cf0
push eax
push str.TDLL_sbinigo4n304.dll_
mov eax, esi
call fcn.00476dc8
push str.TRANSLATIONOPTION0_
mov eax, esi
call fcn.00476dc8
push ebx
push 0
call fcn.00459cf0
add esp, 0x1c
push eax
push str.INFORMIXDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x44d760
push 2
pop eax
call fcn.0044d81d
push eax
push str.Driver_s_
mov esi, 0x200
push esi
push edi
call fcn.00476e0a
mov edx, dword [ebp + 0xc]
add esp, 0x10
call fcn.00475851
test eax, eax
jne 0x44d711
push dword [ebp + 0xc]
mov eax, esi
push str.UID_s_
call fcn.00476dc8
pop ecx
pop ecx
cmp dword [ebp + 0x10], 0
je 0x44d728
push dword [ebp + 0x10]
mov eax, esi
push str.PWD_s_
call fcn.00476dc8
pop ecx
pop ecx
mov edx, ebx
call fcn.00475851
test eax, eax
jne 0x44d742
push ebx
push str.DBN_s_
mov eax, esi
call fcn.00476dc8
pop ecx
pop ecx
push str.ENGdefault_
mov eax, esi
call fcn.00476dc8
push dword [ebp + 8]
mov eax, esi
push str.Linkstcpip_HOST_s_PORT2638_verifyno_dobroadcastnone__
call fcn.00476dc8
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44eed8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, 0xff
push esi
xor ebx, ebx
lea eax, [ebp - 0x10b]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x114], edi
mov byte [ebp - 0x10c], 0
call fcn.004a7110
add esp, 0xc
cmp edi, ebx
je 0x44ef20
mov eax, edi
call fcn.004757d4
push ebx
call fcn.0044eba5
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x44ef34
xor eax, eax
jmp 0x44f01c
push str.SELECT_STORE_PROFILE.STORE_NUM__COMPANY.NAME_FROM_STORE_PROFILE__COMPANY_WHERE_STORE_PROFILE.COMPANY_IDCOMPANY.ID
push edi
mov dword [ebp - 0x110], ebx
call fcn.0044dda3
test eax, eax
pop ecx
pop ecx
je 0x44f009
push 2
push 9
push esi
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 0x118], ebx
call fcn.0044de8e
add esp, 0x14
test eax, eax
je 0x44f00f
mov ebx, 0x4c7f6c
cmp dword [ebp - 0x118], 0xde
jge 0x44f00f
cmp dword [ebp - 0x110], 0
jne 0x44efe4
lea eax, [ebp - 0x10c]
push eax
call fcn.004a8d6e
cmp dword [ebp - 0x114], 0
pop ecx
mov dword [ebp - 0x110], eax
je 0x44efe4
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.004a6450
test eax, eax
pop ecx
pop ecx
je 0x44efe4
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.004a6450
mov ecx, dword [ebp + 8]
inc eax
push eax
mov eax, dword [ebp - 0x114]
call fcn.00475883
add esp, 0xc
call fcn.0047625d
inc dword [ebp - 0x118]
push 2
push 9
push esi
lea eax, [ebp - 0x10c]
push eax
push edi
call fcn.0044de8e
add esp, 0x14
test eax, eax
jne 0x44ef77
jmp 0x44f00f
mov dword [ebp - 0x110], ebx
push edi
call fcn.0044db5e
mov eax, dword [ebp - 0x110]
pop ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
Function at 0x44f17b
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3f
xor ebx, ebx
lea eax, [ebp - 0x47]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x50], esi
mov byte [ebp - 0x48], 0
call fcn.004a7110
add esp, 0xc
call fcn.00498efc
cmp esi, ebx
je 0x44f1b3
mov dword [esi], ebx
push ebx
call fcn.0044eba5
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x44f1d0
call fcn.0040ee7c
neg eax
sbb eax, eax
neg eax
jmp 0x44f268
mov ecx, edi
mov dword [ebp - 0x4c], ebx
call fcn.0044ee2c
push eax
push str.SELECT_TENDER_TYPE_ACCEPTED_FROM_TENDER_TYPE_PROFILE_WHERE_LOC_d
push edi
call fcn.0044dda3
add esp, 0xc
test eax, eax
je 0x44f23b
push 1
push 9
push 0x3f
lea eax, [ebp - 0x48]
push eax
push edi
call fcn.0044de8e
jmp 0x44f231
cmp ebx, 0xde
jge 0x44f238
lea esi, [ebp - 0x48]
call fcn.00478292
test eax, eax
je 0x44f21d
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x4c], eax
push 1
push 9
push 0x3f
lea eax, [ebp - 0x48]
push eax
push edi
inc ebx
call fcn.0044de8e
mov esi, dword [ebp - 0x50]
add esp, 0x14
test eax, eax
jne 0x44f1ff
mov ebx, dword [ebp - 0x4c]
push edi
call fcn.0044db5e
test esi, esi
pop ecx
je 0x44f248
mov dword [esi], ebx
test bl, 1
je 0x44f265
test bl, 2
je 0x44f265
test bl, 8
je 0x44f261
test bl, 0x10
je 0x44f261
test bl, 4
jne 0x44f265
xor eax, eax
jmp 0x44f268
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret
Function at 0x454071
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x454146
cmp dword [esi + 4], ebx
jle 0x454146
push edi
call fcn.00468599
cmp dword [esi + 4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
jle 0x4540f3
lea eax, [esi + 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movsx ebx, word [eax]
mov edi, dword [ebp - 8]
call fcn.00468922
test eax, eax
mov edi, dword [ebp - 0xc]
jne 0x4540c7
movsx eax, word [edi]
mov ebx, dword [ebp - 8]
push eax
call fcn.0046864b
pop ecx
cmp word [edi + 6], 0
jle 0x4540dd
movsx ebx, word [edi]
push 1
push dword [ebp - 8]
call fcn.00468994
pop ecx
pop ecx
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 0x90
cmp eax, dword [esi + 4]
mov dword [ebp - 0xc], edi
jl 0x4540a5
xor ebx, ebx
cmp dword [esi + 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
jle 0x454138
lea eax, [esi + 0x63]
mov dword [ebp - 0xc], eax
jmp 0x45410b
mov eax, dword [ebp - 0xc]
xor ebx, ebx
mov edi, dword [ebp - 8]
mov byte [eax], bl
movsx ebx, word [eax - 0x23]
call fcn.00468aba
test eax, eax
je 0x454126
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x10]
mov byte [eax], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 0xc], 0x90
cmp eax, dword [esi + 4]
jl 0x454106
mov esi, dword [ebp - 8]
call fcn.0046860e
mov eax, dword [ebp - 0x10]
pop edi
jmp 0x454149
or eax, 0xffffffff
pop esi
pop ebx
leave
ret