joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af5cc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4af6d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004b0df0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4af69b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409d90
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004afe84
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409c74
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004afef8
jmp 0x4af6ad
xor edx, edx
mov eax, ebx
call fcn.004afe84
xor edx, edx
mov eax, ebx
call fcn.004afef8
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af6dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404510
ret

Function at 0x4b104c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4b10aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004b1128
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4b1092
lea eax, [ebp - 4]
call fcn.004b1128
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4b1094
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b10b1
lea eax, [ebp - 4]
call fcn.004044ec
ret

Function at 0x4b10b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4b111c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004b1128
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1123
lea eax, [ebp - 4]
call fcn.004044ec
ret
Function at 0x4b31f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3365
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b3340
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004046d4
lea eax, [ebp - 0x118]
mov edx, 0x4b337c
call fcn.004047b4
mov eax, dword [ebp - 0x118]
call fcn.004049ac
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4b32b2
lea eax, [ebp - 0x111]
call fcn.00409f48
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004045dc
jmp 0x4b32b9
mov eax, esi
call fcn.004044ec
cmp bl, 0x61
jae 0x4b32da
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e428
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404540
jmp 0x4b32f4
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e39c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404540
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4b3388
call fcn.0040a624
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3347
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4bbb0c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004bbd40
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004bbd40
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4bbb80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4bbba5
inc esi
mov eax, edi
call fcn.004bbb64
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004bbb0c
inc ebx
dec esi
jne 0x4bbb8f
pop edi
pop esi
pop ebx
ret
Function at 0x4bbc34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4bbca9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004bbbac
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004bbb64
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004bbb0c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4bbc74
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbcb0
lea eax, [ebp - 4]
call fcn.004044ec
ret
Function at 0x4bc86c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bca50
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4bca0c
mov eax, dword [ebp - 4]
call fcn.004be1bc
cmp ebx, eax
jge 0x4bca0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004ae8d0
mov edx, dword [0x4aef64]
call fcn.0040386c
mov esi, eax
mov eax, esi
call fcn.004afe18
test al, al
je 0x4bca02
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4bc9f6
xor eax, eax
push ebp
push 0x4bc9ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004bce24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00421144
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404b38
mov eax, dword [ebp - 8]
call fcn.00404a04
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004bcbe8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bca3a
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4bc9ee
mov eax, dword [ebp - 4]
call fcn.004bcea8
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a134
jmp 0x4bca3a
mov eax, dword [ebp - 8]
call fcn.004044ec
jmp 0x4bca3a
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.004096bc
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41b9f8]
call fcn.0040d5d4
call fcn.00403f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bca57
lea eax, [ebp - 0x54]
call fcn.004044ec
ret
Function at 0x4d4998
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4b26
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004044ec
lea eax, [ebp - 8]
mov edx, 0x4d4b3c
call fcn.00404584
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x4d4b4c
call fcn.0040a624
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x4d4b80
call fcn.0040a624
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.004047b4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, 0x4d4bc4
call fcn.0040a624
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.004047b4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41c7c0]
call fcn.00421a98
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a003c]
call fcn.004acb20
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4d4af7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f0a10]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, 0x4f2d24
mov eax, dword [ebp - 4]
call fcn.004d4404
test al, al
je 0x4d4ad9
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xa1], 0
jne 0x4d4ad9
mov edx, 0x4d4bf4
mov eax, dword [ebp - 0x10]
call fcn.004997a0
mov edx, dword [0x48aeac]
call fcn.0040386c
mov edx, dword [ebp - 0xc]
call fcn.004945b8
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00421164
mov eax, esi
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
call fcn.00404540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4afe
mov eax, dword [ebp - 0x10]
call fcn.004036bc
mov eax, dword [ebp - 0xc]
call fcn.004036bc
ret
Function at 0x4d4bfc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4d4daa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4d4dc4
call fcn.0040a624
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4d4df4
call fcn.0040a624
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.004047b4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x34]
mov ecx, 1
mov eax, 0x4d4e38
call fcn.0040a624
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.004047b4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a003c]
call fcn.004acb20
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4d4d73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f0a10]
push eax
push 1
lea ecx, [ebp - 0x14]
mov edx, 0x4f2d24
mov eax, dword [ebp - 0x10]
call fcn.004d4404
test al, al
jne 0x4d4cf9
call fcn.00403fb8
jmp 0x4d4d7a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0xa1], 0
jne 0x4d4d5d
mov eax, dword [ebp - 0x14]
call fcn.0049aeb8
mov edx, 0x4d4e68
mov eax, dword [ebp - 0x14]
call fcn.004997a0
mov edx, dword [0x48aeac]
call fcn.0040386c
mov edx, ebx
call fcn.00494410
xor eax, eax
push ebp
push 0x4d4d53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24c]
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4d5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d7a
mov eax, dword [ebp - 0x14]
call fcn.004036bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4db1
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404510
lea eax, [ebp - 0x10]
call fcn.004044ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404510
ret
Function at 0x4d50e4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d5212
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004044ec
lea eax, [ebp - 4]
push eax
mov eax, 0x4d5228
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], 0xb
mov eax, 0x4d5228
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x4d5238
call fcn.0040a624
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41c7c0]
call fcn.00421a98
mov dword [ebp - 8], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a003c]
call fcn.004acb20
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d51f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f0a10]
push eax
push 1
lea ecx, [ebp - 0xc]
mov edx, 0x4f2d24
mov eax, dword [ebp - 4]
call fcn.004d4404
test al, al
je 0x4d51d7
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xa1], 0
jne 0x4d51d7
mov edx, 0x4d52c4
mov eax, dword [ebp - 0xc]
call fcn.004997a0
mov edx, dword [0x48aeac]
call fcn.0040386c
mov edx, dword [ebp - 8]
call fcn.004945b8
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00421164
mov eax, esi
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
call fcn.00404540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d51fc
mov eax, dword [ebp - 0xc]
call fcn.004036bc
mov eax, dword [ebp - 8]
call fcn.004036bc
ret
Function at 0x4d52cc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4d547b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 9
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a003c]
call fcn.004acb20
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x41c744]
call fcn.0040368c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4d5457
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d543a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, 0x4d5494
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, 0x4d5494
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x4d54a4
call fcn.0040a624
mov eax, dword [0x4f0a10]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, 0x4f2d24
mov eax, dword [ebp - 0xc]
call fcn.004d4404
test al, al
jne 0x4d53ac
call fcn.00403fb8
call fcn.00403fb8
jmp 0x4d5460
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00421914
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00421164
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xa1], 0
jne 0x4d5424
mov eax, dword [ebp - 0x10]
call fcn.0049aeb8
mov edx, 0x4d5530
mov eax, dword [ebp - 0x10]
call fcn.004997a0
mov edx, dword [0x48aeac]
call fcn.0040386c
mov edx, dword [ebp - 0x14]
call fcn.00494410
xor eax, eax
push ebp
push 0x4d541a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d5424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5441
mov eax, dword [ebp - 0x14]
call fcn.004036bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5482
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404510
ret
Function at 0x4d5538
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4d56e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 9
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a003c]
call fcn.004acb20
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x41c744]
call fcn.0040368c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4d56c3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d56a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, 0x4d5700
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, 0x4d5700
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x4d5710
call fcn.0040a624
mov eax, dword [0x4f0a10]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, 0x4f2d24
mov eax, dword [ebp - 0xc]
call fcn.004d4404
test al, al
jne 0x4d5618
call fcn.00403fb8
call fcn.00403fb8
jmp 0x4d56cc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00421914
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00421164
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xa1], 0
jne 0x4d5690
mov eax, dword [ebp - 0x10]
call fcn.0049aeb8
mov edx, 0x4d579c
mov eax, dword [ebp - 0x10]
call fcn.004997a0
mov edx, dword [0x48aeac]
call fcn.0040386c
mov edx, dword [ebp - 0x14]
call fcn.00494410
xor eax, eax
push ebp
push 0x4d5686
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d5690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d56ad
mov eax, dword [ebp - 0x14]
call fcn.004036bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d56ee
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404510
ret

Function at 0x4d8e5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.004d88fc
test byte [ebx + 0x23d], 4
jne 0x4d8ef1
mov edx, esp
mov eax, ebx
call fcn.00448594
push esp
mov eax, ebx
call fcn.0044f2b8
push eax
push 0
mov eax, ebx
test eax, eax
je 0x4d8e91
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x4d8ec2
mov ecx, dword [0x4f1040]
mov dl, 1
mov eax, dword [0x4864e0]
call fcn.0040d654
call fcn.00403f0c
mov eax, ebx
call fcn.004d9430
cmp byte [ebx + 0x57], 0
jne 0x4d8ef8
mov eax, ebx
call fcn.0044f4bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4d8ef8
push 0
mov eax, ebx
call fcn.0044f4bc
push eax
call sub.user32.dll_ShowWindow
jmp 0x4d8ef8
mov eax, ebx
call fcn.0044c394
add esp, 0x10
pop ebx
ret
Function at 0x4ddc90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ddcf7
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00404b38
push edi
mov eax, dword [ebp - 8]
call fcn.004049ac
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddcfe
lea eax, [ebp - 8]
call fcn.004044ec
ret

Function at 0x4e2630
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e26ba
xor edx, edx
push ebp
push 0x4e269b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e26ba
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4e3a28
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
mov eax, dword [ebp - 0xc]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4e3b57
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004049ac
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0xc]
call fcn.004049ac
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
call fcn.004354c0
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e3b3c
xor eax, eax
push ebp
push 0x4e3b35
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
push 0
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4e3b15
push 0
push 0
push 0x25
push 0
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4e3b19
xor eax, eax
jmp 0x4e3b1b
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3b3c
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3b5e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404510
ret