joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4257f6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x40bcfc
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x40bcfc
call fcn.0040a9a0
mov edi, eax
jmp 0x40be1b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40bd1f
call fcn.0040a9a0
jmp 0x40be0e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x40bd3d
call fcn.0040a9a0
jmp 0x40be0e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40bd5e
mov edi, 0x8007000e
jmp 0x40be10
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x40be54
jb 0x40bd7c
cmp eax, 0xffffffff
ja 0x40be54
cmp eax, 0x400
jbe 0x40bd91
push eax
lea ecx, [ebp - 0x418]
call fcn.0040a820
jmp 0x40bdb7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x40bdb7
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x40bdce
mov edi, 0x8007000e
jmp 0x40be10
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40bdee
call fcn.0040a9a0
jmp 0x40be0e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040bab0
mov edi, eax
test esi, esi
je 0x40be1b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40be34
lea ecx, [ebp - 0x418]
call fcn.0040afb0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00402cb0
int3
Function at 0x40cdf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4258d0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x443624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebx], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
add eax, 2
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov esi, eax
test esi, esi
je 0x40ce71
push edi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea edi, [eax + 1]
mov eax, 0x7fffffff
cmp eax, edi
sbb eax, eax
and eax, 0x80070057
cmp edi, 0x7fffffff
ja 0x40cebd
mov ecx, dword [ebp + 0xc]
mov eax, 0x42626c
test ecx, ecx
cmovne eax, ecx
test edi, edi
jne 0x40ce9e
cmp word [eax], di
je 0x40ceca
mov edi, 0x8007000e
mov dword [ebp - 4], 2
test esi, esi
je 0x40ce88
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x7ffffffe
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.00406c90
test eax, eax
jns 0x40ceca
and edi, 0x7fffffff
jbe 0x40cec6
jmp 0x40cec1
test edi, edi
je 0x40cec6
xor ecx, ecx
mov word [esi], cx
test eax, eax
js 0x40ce71
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push dword [ebp + 0xc]
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], str.Open
mov dword [ebp - 0x38], esi
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40cf35
xor edi, edi
jmp 0x40ce76
cmp word [ebp + 0x14], 0
je 0x40cf65
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40cf5d
cmp dword [ebx], 0x103
jne 0x40cf6b
mov dword [ebx], 0xffffffff
jmp 0x40cf6b
mov dword [ebx], 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test eax, eax
jne 0x40cf86
lea ecx, [ecx]
test cl, cl
je 0x40cf80
mov dword [eax], eax
xor edi, edi
jmp 0x40ce76
Function at 0x40d050
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp word [ebp + 0x10], 0xffff
push esi
mov esi, dword [ebp + 0x14]
sete al
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40d097
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00411faa
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40f32f
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test esi, esi
je 0x40f314
cmp esi, 0x104
jae 0x40f314
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x40f31c
cmp dword [ebp - 0x210], 0
mov ecx, str.System32_s
push edi
mov eax, str.SysWOW64_s
cmove eax, ecx
push eax
push 0x1800
push 0
mov eax, 0x104
sub eax, esi
push 0
push eax
lea eax, [ebp - 0x20c]
lea eax, [eax + esi*2]
push eax
call fcn.00406ab0
add esp, 0x1c
test eax, eax
js 0x40f314
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x40f32f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411faa
mov esp, ebp
pop ebp
ret
Function at 0x40f5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425b10
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x70]
mov edi, dword [ebp + 8]
push eax
push 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 0
push eax
push 0
push ebx
push edi
mov dword [ebp - 0x70], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40f645
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40f77a
mov eax, dword [ebp - 0x74]
cmp eax, 1
je 0x40f669
cmp eax, 2
je 0x40f669
cmp eax, 6
je 0x40f669
push 0x65e
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40f77a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x70]
mov dword [ebp - 0x34], ecx
mov cl, byte [ebp - 0x69]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
push 8
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____stdcall___void___unsigned_long_int__void____void___int__struct_std::_Ph_1__const____int__wchar_t__.0
mov byte [ebp - 0x30], cl
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp - 0x44], 0
test ecx, ecx
je 0x40f6ea
lea eax, [ebp - 0x38]
cmp ecx, eax
jne 0x40f6e2
mov eax, dword [ecx]
lea edx, [ebp - 0x68]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
test ecx, ecx
je 0x40f6ea
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x40f6e5
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], esi
test ecx, ecx
je 0x40f705
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov esi, dword [ebp - 0x40]
test esi, esi
jne 0x40f72d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x40]
xor edi, edi
mov dword [ebp - 4], 0
test eax, eax
je 0x40f760
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x78], eax
test ecx, ecx
je 0x40f796
jmp 0x40f757
lea eax, [ebp - 0x70]
push eax
push esi
lea eax, [ebp - 0x74]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x40f711
mov edi, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x40f716
mov eax, dword [ecx]
lea edx, [ebp - 0x78]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x40f778
mov esi, dword [ecx]
lea eax, [ebp - 0x68]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret
call fcn.00411cb0
int3
Function at 0x40f7a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor edx, edx
test esi, esi
je 0x40f7ee
mov ecx, 0x3fffffff
mov eax, esi
cmp word [eax], dx
je 0x40f7c1
add eax, 2
sub ecx, 1
jne 0x40f7b4
test ecx, ecx
je 0x40f7d8
mov eax, 0x3fffffff
mov edx, ecx
sub eax, ecx
add eax, eax
neg edx
sbb edx, edx
and edx, eax
jmp 0x40f7da
xor edx, edx
test ecx, ecx
jne 0x40f7eb
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebp
ret
add edx, 2
push edx
push esi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebp
ret
Function at 0x65207400
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov ebx, eax
cmp ebx, 0x32
push esi
mov esi, ecx
jbe 0x65207418
mov ebx, 0x32
test esi, esi
je 0x65207448
push edi
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
mov byte [esp + ebx + 0x18], 0
call fcn.65259620
add esp, 8
pop edi
test bl, 1
jne 0x65207451
mov eax, ebp
jmp 0x65207458
movsx eax, byte [esp + ebx + 0xb]
add eax, ebp
shr ebx, 1
lea edx, [esp + ebx*2 + 0xc]
lea esi, [esp + 0xc]
cmp esi, edx
lea ecx, [esp + 0xc]
jae 0x6520747e
lea ebx, [ebx]
movzx esi, word [ecx]
add eax, eax
add ecx, 2
xor eax, esi
cmp ecx, edx
jb 0x65207470
xor edx, edx
mov ecx, 0x3e5
div ecx
pop esi
pop ebp
pop ebx
mov eax, edx
add esp, 0x34
ret
Function at 0x65210ca0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x334
push esi
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x84]
push ecx
mov edi, 1
mov dword [esp + 0x10], 0x50
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edx, dword [esp + 0x340]
push edx
lea eax, [esp + 0x84]
push eax
push pe_nt_image_headers32
lea ecx, [esp + 0x248]
push ecx
push 0x247f
call fcn.65266420
mov eax, dword [esp + 0x358]
lea edx, [esp + 0xe4]
add esp, 0x14
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x65210d02
lea edx, [esp + 0xd0]
push 0x6528bd88
push edx
call fcn.65268880
lea eax, [esp + 0xd8]
push 0
push eax
call fcn.6527e075
add esp, 0x10
test eax, eax
jne 0x65210d49
lea ecx, [esp + 0xd0]
push 0x180
push ecx
call fcn.6527e0bb
add esp, 8
lea edx, [esp + 0xd0]
push 0x6528bd84
push edx
call fcn.6527c0a2
mov esi, eax
add esp, 8
test esi, esi
je 0x65210dde
lea eax, [esp + 0xc]
push eax
call fcn.65269010
push 0x64
lea ecx, [esp + 0x1e0]
push ecx
push 0x2194
call fcn.65266420
lea edx, [esp + 0x1e8]
push edx
push 0x64
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.65268fa0
lea edx, [esp + 0x25c]
push edx
mov byte [esp + eax + 0x40], 0
lea eax, [esp + 0x40]
push eax
push 0x6528bd78
push esi
call fcn.6527bfe8
push esi
call fcn.6527bf97
lea ecx, [esp + 0x104]
push pe_nt_image_headers32
push ecx
call fcn.6527e0bb
add esp, 0x3c
mov eax, edi
pop edi
pop esi
add esp, 0x334
ret
pop edi
xor eax, eax
pop esi
add esp, 0x334
ret
Function at 0x65215c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
cmp word [esi + 0x14], 0
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
jne 0x65215c39
mov eax, dword [esi + 0x48]
push 0x23d4
push eax
call fcn.652659d0
push 2
call fcn.652154b0
add esp, 0xc
mov ecx, dword [esp + 0x18]
push 1
push ecx
push esi
call fcn.65211450
mov ebx, eax
push ebx
push esi
call fcn.652114b0
add esp, 0x14
cmp ebp, 0x1b
mov edi, eax
je 0x65215c6c
push ebx
push esi
call fcn.65212f00
mov edx, dword [esi + 0x74]
push edx
call fcn.65215b60
add esp, 0xc
xor eax, eax
cmp ebp, 0xe
sete al
mov dword [edi + 0x20], 2
push eax
push edi
push esi
call fcn.65212c00
add esp, 0xc
cmp ebp, 0x20
je 0x65215c9f
push edi
push esi
mov dword [edi + 0x20], 1
call fcn.65212cf0
add esp, 8
mov dword [edi + 0xc], eax
cmp ebp, 0x1b
jne 0x65215cb8
push edi
push esi
mov dword [edi + 0x20], 3
call fcn.65212cf0
add esp, 8
mov dword [edi + 0x10], eax
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
mov ebx, dword [esi + 0x74]
push edx
push ebx
call fcn.6520a020
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x3c]
push eax
mov eax, dword [edi + 8]
push esi
call fcn.65215ad0
mov eax, dword [edi + 0xc]
lea ecx, [ebx + 0x24]
push ecx
push esi
call fcn.65215ad0
mov eax, dword [edi + 0x10]
lea edx, [ebx + 0x54]
push edx
push esi
call fcn.65215ad0
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.652117f0
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + 0x20]
mov al, byte [edx + 0x4c]
add esp, 0x28
test al, 8
je 0x65215d36
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x78]
push ecx
movzx ecx, word [esi + 0x14]
push edx
mov edx, dword [esp + 0x28]
push ecx
xor ecx, ecx
cmp ebp, 0x20
sete cl
push edx
mov edx, dword [esi + 0x2c]
push ecx
push edx
call dword [eax + 0x18]
add esp, 0x18
mov ebx, dword [esi + 0x74]
lea eax, [ebx + 0x3c]
push eax
push ebx
call fcn.6520a010
lea ecx, [ebx + 0x24]
push ecx
push ebx
call fcn.6520a010
lea edx, [ebx + 0x54]
push edx
push ebx
call fcn.6520a010
push edi
push esi
call fcn.65211500
add esp, 0x20
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x65235080
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [esi + 0x110]
push eax
lea ecx, [esi + 0x278]
push str.SELECT_user_name_FROM_SYS.SYSUSERPERM_WHERE_user_name_s
push ecx
call fcn.65237150
mov edx, dword [esi + 0x1e8]
push eax
push 0xc
push edx
call fcn.65261aa0
mov eax, dword [esi + 0x1e8]
push 0xc
push eax
call fcn.65262260
add esp, 0x20
test eax, eax
jne 0x652350ee
mov ecx, dword [esi + 0x1e8]
push 0xc
push ecx
call fcn.65261d80
mov edx, dword [esi + 0x1e8]
push str.SELECT_user_name__
push 0xc
push edx
call fcn.65261aa0
mov eax, dword [esi + 0x1e8]
push 0xc
push eax
call fcn.65262260
add esp, 0x1c
mov ecx, dword [esi + 0x1e8]
push edi
push 0
push 0xc
push ecx
call fcn.652617d0
push eax
call fcn.6526d310
mov edx, dword [esi + 0x1e8]
push 0xc
push edx
mov edi, eax
call fcn.65261d80
mov eax, dword [esi + 0x110]
push eax
call fcn.652440f0
add esp, 0x1c
mov dword [esi + 0x110], edi
pop edi
ret
Function at 0x65235540
Capabilities:
Reference sql statements

Disassembly:
push ebp
push edi
push esi
call fcn.65262de0
add esp, 4
xor ebp, ebp
test eax, eax
je 0x65235765
mov eax, dword [esi + 0x1e8]
push ebx
push str.SELECT_name_FROM_dbo.EXCLUDEOBJECT_WHERE_typeP
push 0xb
push eax
mov dword [esi + 0x288], ebp
mov dword [esi + 0x28c], ebp
mov dword [esi + 0x290], ebp
mov dword [esi + 0x298], ebp
mov dword [esi + 0x294], ebp
call fcn.65261aa0
mov ecx, dword [esi + 0x1e8]
push ecx
mov ebx, 0xb
call fcn.65235460
mov edx, dword [esi + 0x1e8]
push ebx
push edx
mov dword [esi + 0x288], eax
call fcn.65261d80
mov eax, dword [esi + 0x288]
add esp, 0x18
cmp eax, ebp
mov edi, 4
jne 0x652355c4
mov word [esi + 0x124], di
cmp word [esi + 0x124], di
je 0x65235727
mov eax, dword [esi + 0x1e8]
push str.SELECT_name_FROM_dbo.EXCLUDEOBJECT_WHERE_typeV
push 0xb
push eax
call fcn.65261aa0
mov ecx, dword [esi + 0x1e8]
push ecx
mov ebx, 0xb
call fcn.65235460
mov edx, dword [esi + 0x1e8]
push ebx
push edx
mov dword [esi + 0x28c], eax
call fcn.65261d80
mov eax, dword [esi + 0x28c]
add esp, 0x18
cmp eax, ebp
jne 0x6523561c
mov word [esi + 0x124], di
cmp word [esi + 0x124], di
je 0x65235727
mov eax, dword [esi + 0x1e8]
push str.SELECT_name_FROM_dbo.EXCLUDEOBJECT_WHERE_typeU_OR_type__E
push 0xb
push eax
call fcn.65261aa0
mov ecx, dword [esi + 0x1e8]
push ecx
mov ebx, 0xb
call fcn.65235460
mov edx, dword [esi + 0x1e8]
push ebx
push edx
mov dword [esi + 0x290], eax
call fcn.65261d80
mov eax, dword [esi + 0x290]
add esp, 0x18
cmp eax, ebp
jne 0x65235674
mov word [esi + 0x124], di
cmp word [esi + 0x124], di
je 0x65235727
mov eax, dword [esi + 0x1e8]
push str.SELECT_name_FROM_dbo.EXCLUDEOBJECT_WHERE_type__E
push 0xb
push eax
call fcn.65261aa0
mov ecx, dword [esi + 0x1e8]
push ecx
mov ebx, 0xb
call fcn.65235460
mov edx, dword [esi + 0x1e8]
push ebx
push edx
mov dword [esi + 0x298], eax
call fcn.65261d80
mov eax, dword [esi + 0x298]
add esp, 0x18
cmp eax, ebp
jne 0x652356cc
mov word [esi + 0x124], di
cmp word [esi + 0x124], di
je 0x65235727
mov eax, dword [esi + 0x1e8]
push str.SELECT_name_FROM_dbo.EXCLUDEOBJECT_WHERE_typeT
push 0xb
push eax
call fcn.65261aa0
mov ecx, dword [esi + 0x1e8]
push ecx
mov ebx, 0xb
call fcn.65235460
mov edx, dword [esi + 0x1e8]
push ebx
push edx
mov dword [esi + 0x294], eax
call fcn.65261d80
mov eax, dword [esi + 0x294]
add esp, 0x18
cmp eax, ebp
jne 0x65235720
mov word [esi + 0x124], di
cmp word [esi + 0x124], di
pop ebx
jne 0x652357b0
mov edi, dword [esi + 0x288]
call fcn.65235430
mov edi, dword [esi + 0x28c]
call fcn.65235430
mov edi, dword [esi + 0x294]
call fcn.65235430
mov eax, dword [esi]
mov ecx, dword [eax + 0x12]
push 0x1a05
push ecx
call fcn.652659d0
add esp, 8
pop edi
pop ebp
ret
cmp dword [esi + 0x50], ebp
je 0x65235782
mov edx, dword [esi]
mov eax, dword [edx + 0x12]
push str.dbo.EXCLUDEOBJECT
push 0x160a
push eax
call fcn.652659d0
add esp, 0xc
mov dword [esi + str.xp_stopmail], 0x652a4008
mov dword [esi + str.sysalternates], 0x652a4328
mov dword [esi + str.RowGenerator], 0x652a43b8
mov dword [esi + str.ul_statement], 0x652a43f4
mov dword [esi + 0x294], ebp
pop edi
pop ebp
ret
Function at 0x652358c0
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [esi]
test byte [eax + 0x24], 0x10
je 0x652358ef
mov eax, dword [eax + 0x3b]
push eax
lea ecx, [esi + 0x278]
push str.SELECT_p.user_name_type_name_publisher_address_FROM_SYS.SYSUSERPERM_p_SYS.SYSREMOTETYPE_t__SYS.SYSREMOTEUSER_u__SYS.SYSUSERPERM_subscriber_WHERE_t.type_id__u.type_id_AND_u.user_id__subscriber.user_id_AND_p.publishauth__Y_AND_subscriber.user_name___s
push ecx
call fcn.65237150
mov edx, dword [esi + 0x1e8]
push eax
push 0x12
push edx
call fcn.65261aa0
add esp, 0x18
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
call fcn.65262260
add esp, 8
test eax, eax
je 0x6523597b
push ebx
push edi
mov ecx, dword [esi + 0x1e8]
push 0
push 0x12
push ecx
call fcn.652617d0
mov edx, dword [esi + 0x1e8]
push 1
push 0x12
push edx
mov ebx, eax
call fcn.652617d0
push 2
mov edi, eax
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
call fcn.652617d0
mov cl, byte [eax]
add esp, 0x24
test cl, cl
jne 0x65235960
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12]
push edi
push 0x158f
push edx
call fcn.652659d0
add esp, 0xc
mov word [esi + 0x124], 1
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
call fcn.65262260
add esp, 8
test eax, eax
jne 0x65235906
pop edi
test ebx, ebx
pop ebx
jne 0x65235997
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12]
push 0x158e
push edx
call fcn.652659d0
add esp, 8
mov word [esi + 0x124], 1
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
call fcn.65261d80
add esp, 8
ret
Function at 0x652359c0
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [esi + 0x7c]
test eax, eax
push ebx
push edi
mov edi, str.sp_hook_mlxtract_begin
jne 0x65235b8d
mov ecx, dword [esi]
mov edx, dword [ecx + 0x3b]
push edx
lea eax, [esi + 0x278]
push str.SELECT_user_id_FROM_SYS.SYSUSERPERM_WHERE_user_name___s
push eax
mov edi, str.sp_hook_dbxtract_begin
call fcn.65237150
mov ecx, dword [esi + 0x1e8]
push eax
push 0x12
push ecx
call fcn.65261aa0
mov edx, dword [esi + 0x1e8]
add esp, 0x18
push 0x12
push edx
call fcn.65262260
add esp, 8
test eax, eax
je 0x65235a3a
mov eax, dword [esi + 0x1e8]
push 0
push 0x12
push eax
call fcn.652617d0
add esp, 0xc
lea edx, [esi + 0x84]
mov edi, edi
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x65235a30
mov ecx, dword [esi + 0x1e8]
push 0x12
push ecx
call fcn.65261d80
mov al, byte [esi + 0x84]
lea ebx, [esi + 0x84]
add esp, 8
test al, al
je 0x65235b8a
mov ecx, dword [esi + 4]
push edi
call fcn.65233770
mov edi, eax
test edi, edi
je 0x65235b8a
mov edx, dword [esi + 0x1e8]
push str.create_table_hook_dict__name_varchar_128__not_null_unique__value_varchar_255__not_null__
push edx
call fcn.65262b60
add esp, 8
push ebx
push str.extracted_db_global_id
mov ecx, edi
call fcn.65233240
mov ecx, edi
call fcn.652332e0
push eax
mov eax, dword [esi + 0x1e8]
push eax
call fcn.65262b60
add esp, 8
mov ecx, edi
call fcn.652333d0
mov ecx, dword [esi + 0x1e8]
push eax
push ecx
call fcn.65262b60
mov edx, dword [esi + 0x1e8]
push str.select__from_hook_dict
push 0x12
push edx
call fcn.65261aa0
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
call fcn.65262260
add esp, 0x1c
test eax, eax
je 0x65235b2a
mov ecx, dword [esi + 0x1e8]
push 1
push 0x12
push ecx
call fcn.652617d0
mov edx, dword [esi + 0x1e8]
add esp, 0xc
push eax
push 0
push 0x12
push edx
call fcn.652617d0
add esp, 0xc
push eax
mov ecx, edi
call fcn.65233430
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
call fcn.65262260
add esp, 8
test eax, eax
jne 0x65235ae6
mov ecx, edi
call fcn.65233500
mov ecx, dword [esi + 0x1e8]
push 0x12
push ecx
call fcn.65261d80
add esp, 8
push str.extracted_db_global_id
mov ecx, edi
call fcn.65233590
mov edx, ebx
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x65235b50
mov edx, dword [esi + 0x1e8]
push 0x6528cecc
push edx
call fcn.65262b60
mov eax, dword [esi + 0x1e8]
push eax
call fcn.65262540
add esp, 0xc
mov ecx, edi
call fcn.652331d0
push edi
call fcn.6527b500
add esp, 4
pop edi
pop ebx
ret
mov eax, dword [esi]
mov ecx, dword [eax + 0x62]
push ecx
lea edx, [esi + 0x278]
push str.SELECT_sync_id_FROM_SYS.SYSSYNC_WHERE_site_name___s
push edx
call fcn.65237150
push eax
mov eax, dword [esi + 0x1e8]
push 0x12
push eax
jmp 0x652359f8