joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44258f
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401f60
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x7c4380]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00401e40
mov eax, dword [esp + 4]
test eax, eax
je 0x442574
mov eax, dword [esp + 0x1c]
lea ecx, [0x7c4380]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00408ef0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00401e40
mov eax, dword [esp + 4]
test eax, eax
je 0x442562
mov eax, dword [esp + 0x1c]
lea ecx, [0x7c4380]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.004429a0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x442484
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401f60
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004090f0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x44255e
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4424e1
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.00456320
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x442578
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x44251b
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.004425a0
movzx eax, byte [esp + 4]
test al, al
je 0x442517
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x44251b
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.00442010
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x44255e
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x44255e
nop
lea eax, [0x4f1f00]
mov dword [esp], eax
call fcn.00458a00
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004090f0
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x4ebe3d]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00432150
nop
call fcn.00458b70
jmp fcn.00442390
Function at 0x44a190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44a313
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44a30b
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44a1ec
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44a1ec
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44a1ff
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44a2e0
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44a2d2
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44a2cb
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44a256
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44a29f
mov eax, 1
cmp eax, ecx
ja 0x44a28d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0045a0a0
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x44a2c6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x44a292
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44a25b
call fcn.0045a040
xor eax, eax
call fcn.0045a030
call fcn.0045a0a0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x44a306
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x44a2d7
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x44a204
call fcn.0045a040
xor eax, eax
call fcn.0045a030
nop
call fcn.00458b70
jmp fcn.0044a190
Function at 0x451040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4510df
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045a177
lea ecx, [0x4510f0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00458a60
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00458b70
jmp fcn.00451040
Function at 0x456470
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x456601
sub esp, 0x20
lea eax, [0x7e8310]
mov dword [esp], eax
call fcn.0042be80
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
test byte [eax], al
lea ecx, [eax + 4]
mov dword [esp + 0x14], ecx
nop
mov dword [esp], ecx
call fcn.00408ef0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x58]
mov dword [esp + 0x1c], ecx
mov dword [esp], ecx
call fcn.00401eb0
mov eax, dword [esp + 4]
test eax, eax
je 0x4564d5
cmp eax, 1
jne 0x4565ea
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
call fcn.00401eb0
mov eax, dword [esp + 4]
test eax, eax
je 0x4564f9
cmp eax, 1
jne 0x4565d4
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 8], eax
mov word [ecx + 0xc], 0
inc dword [ecx + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.00401ed0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
inc dword [eax + 0x54]
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00401ed0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov dword [eax + 0x94], eax
nop
nop
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
call fcn.004090f0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.0042c000
mov eax, dword [esp + 8]
test eax, eax
je 0x4565c0
mov dword [esp + 0x10], eax
lea eax, [0x7e8310]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.0042ba50
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
add esp, 0x20
ret
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
add esp, 0x20
ret
lea eax, [0x4eef17]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00432150
lea eax, [0x4ef10c]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.00432150
nop
call fcn.00458b70
jmp fcn.00456470

Function at 0x456610
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4566c6
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 0xc]
test cl, cl
je 0x4566af
lea ecx, [eax + 0x58]
mov dword [esp], ecx
call fcn.00401eb0
mov eax, dword [esp + 4]
test eax, eax
je 0x45664d
cmp eax, 1
jne 0x456699
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x18]
mov dword [esp], ecx
call fcn.00401eb0
mov eax, dword [esp + 4]
test eax, eax
je 0x456669
cmp eax, 1
jne 0x456683
lea eax, [0x7e8310]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.0042ba50
add esp, 8
ret
lea eax, [0x4ef639]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00432150
lea eax, [0x4ef8aa]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00432150
lea eax, [0x4ee532]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00432150
nop
call fcn.00458b70
jmp fcn.00456610
Function at 0x456b20
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x14
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
lea ecx, [esp + 0x18]
cmp dword [eax + 0x38], ecx
jb 0x456cd7
mov dword [esp + 0xc], eax
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x5c]
mov dword [esp + 0x10], edx
mov dword [ecx + 0x5c], 0
mov dword [esp], edx
call fcn.0043bfa0
movzx eax, byte [esp + 4]
test al, al
jne 0x456ba7
mov eax, dword [esp + 0xc]
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0
movzx ecx, byte [0x7cc868]
test cl, cl
je 0x456c5e
mov ecx, dword [esp + 0x10]
jmp 0x456ca5
movzx eax, byte [0x7cc868]
test al, al
je 0x456be3
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov ebx, dword [esp + 0x10]
cmp edx, ebx
jne 0x456bcf
mov ecx, dword [ecx + 0x164]
cmp dword [edx + 0x10], ecx
je 0x456be7
lea eax, [0x4f1fc0]
mov dword [esp], eax
call fcn.00458a60
mov eax, dword [esp + 0xc]
jmp 0x456be7
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
inc dword [ecx + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 3
mov dword [esp + 8], 2
call fcn.00435ff0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x38], 0
mov ecx, dword [eax + 0x18]
dec dword [ecx + 0x78]
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x456c2a
mov dword [eax + 8], 0xfffffade
jmp 0x456c35
mov ecx, dword [eax]
add ecx, 0xba0
mov dword [eax + 8], ecx
mov byte [eax + 0x6b], 0
movzx ecx, byte [0x7c2c5c]
test cl, cl
je 0x456c5a
mov dword [esp], eax
call fcn.0043fbc0
movzx eax, byte [esp + 4]
test al, al
jne 0x456c5a
call fcn.004347b0
add esp, 0x14
ret
mov ecx, dword [eax + 0x18]
dec dword [ecx + 0x78]
lea ecx, [0x4f1ea8]
mov dword [esp], ecx
call fcn.00458a00
mov eax, dword [esp + 0xc]
mov dword [eax + 0x38], 0
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
inc dword [ecx + 0x10]
mov byte [eax + 0x6b], 0
add esp, 0x14
ret
nop
lea eax, [0x4f1fb4]
mov dword [esp], eax
call fcn.00458a60
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x456cb7
mov edx, dword [eax + 0x18]
mov ebx, dword [ecx + 0x10]
cmp dword [edx + 0x164], ebx
je 0x456c8e
call fcn.00459e10
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [edx + 0x88], eax
mov dword [edx + 0x84], ecx
mov eax, edx
jmp 0x456c5e
lea eax, [0x4efdbc]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00432150
nop
int3
Function at 0x459e60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x7e8440]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45862b
je 0x45867a
cmp ebx, 0x20
jbe 0x458680
cmp ebx, 0x40
jbe 0x4586be
jmp 0x45874f
test ebx, ebx
je 0x458670
add eax, 0x10
test ax, 0xff0
je 0x45865c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x512300]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x512400]
jmp 0x458648
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x458648
pxor xmm1, xmmword [0x7e8450]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e8450]
pxor xmm2, xmmword [0x7e8460]
pxor xmm3, xmmword [0x7e8470]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e8450]
pxor xmm2, xmmword [0x7e8460]
pxor xmm3, xmmword [0x7e8470]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4587ae
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7e81b1], 0
je 0x459e7a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4585f0
jmp fcn.00407a20
Function at 0x459e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4025be
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407a20
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00458b70
jmp 0x402580
cmp byte [0x7e81b1], 0
je 0x459e9b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4585f0
jmp 0x402580

Function at 0x45aba0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00459de0
call fcn.004589e0
ret

Function at 0x45e230
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45e32c
sub esp, 0x10
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45e313
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
call fcn.0045e3c0
mov eax, dword [esp + 4]
test eax, eax
je 0x45e274
mov ecx, eax
cmp eax, 0xffffffff
je 0x45e255
jmp 0x45e2a6
call fcn.00456d30
mov eax, 0xffffffff
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call fcn.00455b00
movzx eax, byte [esp + 0xc]
test al, al
jne 0x45e2c7
call fcn.00456d50
jmp 0x45e255
cmp dword [esp + 0x18], ecx
jne 0x45e2fb
mov eax, dword [esp + 0x14]
add eax, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00455ac0
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
lea ecx, [eax + 4]
mov edx, dword [esp + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00455ac0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00455ac0
call fcn.00456d50
add esp, 0x10
ret
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50f020]
mov dword [esp + 4], eax
call fcn.004319f0
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50f018]
mov dword [esp + 4], eax
call fcn.004319f0
nop
call fcn.00458b70
jmp fcn.0045e230
Function at 0x45f440
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45f5a0
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x12
ja 0x45f4c8
cmp eax, 0x11
je 0x45f4b9
cmp eax, 0x12
jne 0x45f535
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x45f587
mov eax, dword [eax + 4]
test eax, eax
je 0x45f587
test ecx, 0x80
je 0x45f4a1
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x45f4a5
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00455ba0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x45f50d
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x45f56f
mov eax, dword [eax + 4]
test eax, eax
je 0x45f56f
test ecx, 0x80
je 0x45f4f5
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x45f4f9
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00456140
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x17
je 0x45f526
cmp eax, 0x18
jne 0x45f535
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x4dae00]
mov dword [esp], eax
call fcn.0040af50
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x4e901a]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x4d86a0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004319f0
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50edac]
mov dword [esp + 4], eax
call fcn.004319f0
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50edac]
mov dword [esp + 4], eax
call fcn.004319f0
nop
call fcn.00458b70
jmp fcn.0045f440
Function at 0x46c7b0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46c8aa
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x46c872
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x46c891
shl ecx, 4
lea edx, [0x599940]
mov ebx, dword [edx + ecx + 8]
mov ecx, dword [edx + ecx + 0xc]
test eax, eax
jge 0x46c802
add ebx, 1
adc ecx, 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
call fcn.00462670
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shl eax, 7
mov ebx, edx
shr edx, 0x19
or edx, eax
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x1a935
sar eax, 0xf
mov edx, dword [esp + 0x28]
lea eax, [eax + edx - 6]
mov dword [esp + 0x34], eax
shl ebx, 7
mov eax, ecx
shr ecx, 0x19
or ecx, ebx
test ecx, ecx
sete cl
shl eax, 7
test eax, eax
sete al
and ecx, eax
mov byte [esp + 0x38], cl
add esp, 0x20
ret
mov eax, dword [esp + 0x24]
shl eax, 6
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffffa
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], 1
add esp, 0x20
ret
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50efd8]
mov dword [esp + 4], eax
call fcn.004319f0
nop
call fcn.00458b70
jmp fcn.0046c7b0
Function at 0x46c8c0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46ca7f
sub esp, 0x40
mov eax, dword [esp + 0x50]
test eax, eax
je 0x46ca35
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x46ca66
shl ecx, 4
lea edx, [0x599940]
lea esi, [edx + ecx]
lea edi, [esp + 0x30]
call fcn.0045a668
test eax, eax
jge 0x46c926
mov ecx, dword [esp + 0x30]
add ecx, 1
mov edx, dword [esp + 0x34]
mov dword [esp + 0x30], ecx
adc edx, 0
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00462670
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], esi
mov edi, dword [esp + 0x48]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x44]
mov dword [esp], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00462670
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ebx, eax
adc eax, edx
mov ebp, dword [esp + 0x10]
mov esi, edx
and edx, ebx
or esi, ebx
mov ebx, eax
not eax
and eax, esi
or eax, edx
shr eax, 0x1f
add eax, ebp
mov edx, dword [esp + 0x14]
adc edx, 0
mov ebp, ebx
shl ebx, 9
mov esi, ecx
shr ecx, 0x17
or ecx, ebx
test ecx, ecx
sete cl
shl esi, 9
test esi, esi
sete bl
mov esi, dword [esp + 0x50]
imul esi, esi, 0x1a935
sar esi, 0xf
mov edi, dword [esp + 0x4c]
lea esi, [esi + edi - 8]
nop
and ebx, ecx
test bl, bl
je 0x46ca0d
mov ecx, dword [esp + 0x2c]
test ecx, ecx
sete cl
mov ebx, dword [esp + 0x28]
test ebx, ebx
sete bl
and ebx, ecx
jmp 0x46ca0f
xor ebx, ebx
shl edx, 9
mov ecx, eax
shr eax, 0x17
or eax, edx
mov dword [esp + 0x58], eax
shl ecx, 9
shr ebp, 0x17
or ebp, ecx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x5c], esi
mov byte [esp + 0x60], bl
add esp, 0x40
ret
mov eax, dword [esp + 0x48]
shl eax, 8
mov ecx, dword [esp + 0x44]
mov edx, ecx
shr ecx, 0x18
or ecx, eax
mov dword [esp + 0x58], ecx
shl edx, 8
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff8
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], 1
add esp, 0x40
ret
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50efe0]
mov dword [esp + 4], eax
call fcn.004319f0
nop
call fcn.00458b70
jmp fcn.0046c8c0
Function at 0x477910
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x477948
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x47793f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x477932
mov dword [esp + 0x14], edx
ret
call fcn.00458b70
jmp fcn.00477910

Function at 0x477950
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x477a00
sub esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4779e7
mov eax, dword [eax + 0x50]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call eax
cmp dword [esp + 4], 0x14
jne 0x4779cf
mov eax, dword [esp + 0x14]
lea ecx, [0x512264]
cmp eax, ecx
jne 0x4779b3
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00477a10
movzx eax, byte [esp + 8]
mov byte [esp + 0x1c], al
add esp, 0xc
ret
mov dword [esp], eax
lea eax, [0x4e4540]
mov dword [esp + 4], eax
lea eax, [0x4e2a00]
mov dword [esp + 8], eax
call fcn.00408770
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50ee4c]
mov dword [esp + 4], eax
call fcn.004319f0
lea eax, [0x4d7140]
mov dword [esp], eax
lea eax, [0x50ee44]
mov dword [esp + 4], eax
call fcn.004319f0
nop
call fcn.00458b70
jmp fcn.00477950