joyce8/EMBER2024-capa huggingface dataset:
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.0905791c
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.0905791c
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.0905791c
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0905791c
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.0905791c
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.0905791c
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.0905791c
int3
Function at 0x403bf8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403c54
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x403c46
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403c3b
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403c36
mov eax, 0x64
jmp 0x403c4b
call sub.kernel32.dll_GetLastError
call fcn.0040266c
xor eax, eax
jmp 0x403c36
mov eax, 0x67
jmp 0x403c4b

Function at 0x403c5c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403cb7
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x403ca9
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403c9e
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403c99
mov eax, 0x65
jmp 0x403cae
call sub.kernel32.dll_GetLastError
call fcn.0040266c
xor eax, eax
jmp 0x403c99
mov eax, 0x67
jmp 0x403cae

Function at 0x403d40
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403d70
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x403d66
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.0040267c
or eax, 0xffffffff
jmp 0x403d64
mov eax, 0x67
call fcn.0040266c
or eax, 0xffffffff
jmp 0x403d64

Function at 0x405300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405339
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403200
jmp 0x405342
mov eax, ebx
mov edx, esi
call fcn.004031b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40534c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40536d
mov al, byte [esp]
jmp 0x40536f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407110
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40f580
mov eax, esi
mov edx, 8
test al, 1
je 0x40712c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40712e
shr eax, 1
dec edx
jne 0x40711f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407118
pop esi
ret
Function at 0x407144
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [0x40f57c], 0
jne 0x407162
call fcn.00407110
mov byte [0x40f57c], 1
mov eax, edi
test esi, esi
je 0x40718d
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40f580]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407168
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40afdc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b061
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40b044
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040b2e8
mov eax, dword [ebp - 0xc]
call fcn.004033a0
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b04b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x40b0ec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
xor eax, eax
mov dl, byte [ebx]
sub dl, 1
jb 0x40b118
sub dl, 0x1f
je 0x40b110
sub dl, 2
je 0x40b10c
jmp 0x40b114
xor al, 1
jmp 0x40b114
test al, al
je 0x40b118
inc ebx
jmp 0x40b0f9
inc ebx
cmp byte [ebx], 0x20
je 0x40b117
mov eax, esi
mov edx, ebx
call fcn.00403230
pop esi
pop ebx
ret

Function at 0x40b38c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404e88
add esp, 0x104
pop ebx
ret

Function at 0x40baa4
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40d07c], 2
jne 0x40bb11
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40bac9
call fcn.0040ba84
jmp 0x40bb23
lea eax, [esp + 8]
push eax
push 0x40bb28
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x40bb11
call fcn.0040ba84
jmp 0x40bb23
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x40bb23
call fcn.0040ba84
add esp, 0x14
ret
Function at 0x40bb3c
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
dec ebx
test ebx, ebx
jl 0x40bb82
inc ebx
xor esi, esi
test esi, esi
je 0x40bb59
push 0xfa
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.004033a0
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x40bb82
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40bb82
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40bb82
inc esi
dec ebx
jne 0x40bb4b
pop edi
pop esi
pop ebx
ret

Function at 0x40bce8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x74]
xor eax, eax
push ebp
push 0x40bdda
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.0040b334
push dword [ebp - 0x78]
push 0x40bdf0
push edi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004032ac
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402738
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40bd73
mov al, 0x59
call fcn.0040bb88
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40bd8a
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40bd7e
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40bd8a
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bde1
lea eax, [ebp - 0x78]
call fcn.00403120
lea eax, [ebp - 4]
call fcn.00403120
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10007fbe
pop dword [ebp - 0x44]
mov eax, 0x97e7ffdf
add eax, 0x78187fdf
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x6e3eb3a9
add dword [ebp - 0x54], 0xe01391a2
mov dword [ebp - 0x50], 0x79a4f7fc
add dword [ebp - 0x50], 0xb88e5449
mov dword [ebp - 0x4c], 0x9635212d
add dword [ebp - 0x4c], 0xb6172301
mov dword [ebp - 0x48], 0x70431960
add dword [ebp - 0x48], 0x8fbce6a0
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xbca2e085
add dword [ebp - 0x54], 0xb7cf88d1
mov dword [ebp - 0x50], 0xda98cfd3
sub dword [ebp - 0x50], 0x992c6e5e
mov dword [ebp - 0x4c], 0x508882fc
sub dword [ebp - 0x4c], 0xed191690
mov dword [ebp - 0x48], 0x368d0d00
add dword [ebp - 0x48], 0xc972f300
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36cb7
push 0
call eax
mov ecx, 0x997d8c62
sub ecx, 0x997d4731
mov ebx, eax
mov edx, 0x10026800
add edx, dword [ebp - 0x44]
mov edi, 0x476cb1d8
xor dword [ebp - 0x1c], 0x38949067
mov esi, dword [edx]
add dword [ebp - 0x2c], eax
sub esi, edi
xor dword [ebp - 8], ebx
mov dword [ebx], esi
sub dword [ebp - 0x40], 0xc28db02e
add ebx, 0xf1a040df
sub ebx, 0xf1a040db
add edx, 4
loop 0x100080ca
add eax, 0x95ed7bb7
add eax, 0x6a138be0
xor ebx, ebx
add ebx, eax
add eax, 0xb02cd899
sub eax, 0xb02cd894
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4024b0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x598b58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xba
push eax
mov dword [esp + 0x28], 1
call ebp
cmp eax, 0x3e8
jle 0x402549
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xbb
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x402549
mov edx, dword [esi + 0x20]
push 0
push 0x1f4
push 0xbb
push edx
call ebp
test eax, eax
jg 0x40252a
mov eax, dword [esi + 0x20]
push 0
push edi
push 0xc1
push eax
call ebp
add eax, edi
mov ecx, dword [esi + 0x20]
push eax
push edi
push 0xb1
push ecx
call ebp
mov edx, dword [esi + 0x20]
push 0x62fc5c
push 0
push 0xc2
push edx
call ebp
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xa
push 0xd
push eax
push ecx
mov byte [esp + 0x28], 2
call fcn.004eaa70
push eax
lea edx, [esp + 0x20]
push 0x6010ec
push edx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x44]
add esp, 0x1c
test edx, edx
je 0x402623
push ebx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x402622
jmp 0x4025a6
mov edx, dword [esp + 0x2c]
mov al, byte [ebx + edx]
cmp al, 0xd
jne 0x4025d3
push 0xd
lea ecx, [esp + 0x14]
call fcn.005928d0
push 0xa
lea ecx, [esp + 0x14]
call fcn.005928d0
push 0x6010e4
lea ecx, [esp + 0x14]
call fcn.005928ca
jmp 0x40260f
cmp al, 0x3e
jne 0x402605
push 0xd
lea ecx, [esp + 0x14]
call fcn.005928d0
push 0xa
lea ecx, [esp + 0x14]
call fcn.005928d0
push 0x6010e4
lea ecx, [esp + 0x14]
call fcn.005928ca
mov eax, dword [esp + 0x2c]
mov cl, byte [ebx + eax]
push ecx
jmp 0x402606
push eax
lea ecx, [esp + 0x14]
call fcn.005928d0
mov edi, dword [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jl 0x4025a2
pop ebx
push 0xd
lea ecx, [esp + 0x10]
call fcn.005928d0
push 0xa
lea ecx, [esp + 0x10]
call fcn.005928d0
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetWindowTextLengthA
mov edx, dword [esi + 0x20]
push 0xffffffffffffffff
push eax
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x20]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x20]
push ecx
push 0
push 0xc2
push edx
call ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x4026b0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x598b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xba
push eax
mov dword [esp + 0x2c], 2
call edi
cmp eax, 0x3e8
jle 0x40274b
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xbb
push ecx
call edi
mov ebp, eax
test ebp, ebp
jl 0x40274b
mov edx, dword [esi + 0x20]
push 0
push 0x1f4
push 0xbb
push edx
call edi
test eax, eax
jg 0x40272c
mov eax, dword [esi + 0x20]
push 0
push ebp
push 0xc1
push eax
call edi
add eax, ebp
mov ecx, dword [esi + 0x20]
push eax
push ebp
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0x62fc5c
push 0
push 0xc2
push edx
call edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0xa
push 0xd
push eax
push ecx
mov byte [esp + 0x2c], 3
call fcn.004eaa70
push eax
lea edx, [esp + 0x20]
push str._s____s______s______c_c
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x48]
add esp, 0x1c
xor ebp, ebp
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x4027be
mov al, byte [eax + ebp]
cmp al, 0xa
jne 0x4027a2
push 0xd
lea ecx, [esp + 0x10]
call fcn.005928d0
push 0xa
jmp 0x4027ab
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.005928d0
mov eax, dword [esp + 0x2c]
inc ebp
cmp ebp, dword [eax - 8]
jl 0x40278c
push 0xd
lea ecx, [esp + 0x10]
call fcn.005928d0
push 0xa
lea ecx, [esp + 0x10]
call fcn.005928d0
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetWindowTextLengthA
mov ecx, dword [esi + 0x20]
push 0xffffffffffffffff
push eax
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push edx
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0xc2
push ecx
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x4250b0
Capabilities:
Access peb ldr_data
Get number of processors
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x59d9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esi + 0x74]
lea ecx, [esp + 0xc]
push eax
xor ebx, ebx
push str.SELECT__FROM_ins_filter_WHERE_id_d
push ecx
mov dword [esp + 0x3c], ebx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
mov ecx, dword [0x635400]
add esp, 0xc
push ebx
push ebx
push edx
push str.XGSP
call fcn.0058f640
mov edi, eax
cmp edi, ebx
jne 0x4251e0
mov eax, dword [0x635400]
cmp eax, ebx
je 0x425179
cmp byte [eax + 0x40], bl
je 0x425179
add eax, 0x250
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push 0x607904
push 0x601774
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str..dbs.
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [0x635400]
push str.runtime
push 0x601760
mov ecx, dword [eax + 0x44]
push ecx
call fcn.004eb7d0
mov edx, dword [0x635400]
add esp, 0x1c
mov eax, dword [edx + 0x248]
lea ecx, [edx + 0x248]
call dword [eax + 0x1c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x607904
call sub.MFC42.DLL_CString::CString_3
push ecx
mov byte [esp + 0x38], 1
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x601774
call sub.MFC42.DLL_CString::CString_3
push ecx
mov byte [esp + 0x3c], 2
mov ecx, esp
mov dword [esp + 0x2c], esp
push str..dbs.
call sub.MFC42.DLL_CString::CString_3
push ecx
mov byte [esp + 0x40], 3
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x60175c
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [0x62ffdc]
mov byte [esp + 0x40], bl
call fcn.00458cb0
jmp 0x425267
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x6c]
mov byte [esp + 0x30], 4
push ecx
push str.cmd_name
mov ecx, edi
mov dword [esp + 0x18], ebx
call sym.ETermProxy.exe_public:_int___thiscall_CAdoRecordSet::GetCollect_char_const___class_CString__
lea edx, [esi + 0x70]
mov ecx, edi
push edx
push str.cmd_perfix
call sym.ETermProxy.exe_public:_int___thiscall_CAdoRecordSet::GetCollect_char_const___class_CString__
lea eax, [esi + 0x68]
mov ecx, edi
push eax
push str.min_len
call sym.ETermProxy.exe_public:_int___thiscall_CAdoRecordSet::GetCollect_char_const___class_CString__
lea ecx, [esi + 0x64]
push ecx
push str.max_len
mov ecx, edi
call sym.ETermProxy.exe_public:_int___thiscall_CAdoRecordSet::GetCollect_char_const___class_CString__
lea edx, [esp + 0x10]
mov ecx, edi
push edx
push str.disable
call sym.ETermProxy.exe_public:_int___thiscall_CAdoRecordSet::GetCollect_char_const___int__
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 1
push ebx
sete al
mov ecx, esi
mov dword [esi + 0x60], eax
call sub.MFC42.DLL_CWnd::UpdateData
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret