joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d3900
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d39d6
sub esp, 0x2c
mov eax, dword [esp + 0x30]
cmp eax, 3
je 0x5d3925
cmp eax, 9
jne 0x5d3932
mov ecx, 0x2f
lea edx, [0x72e22f]
jmp 0x5d3936
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], eax
call fcn.00409ea0
mov eax, dword [esp + 4]
lea ecx, [0x6f0d40]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea eax, [0x72f5c5]
mov dword [esp], eax
mov dword [esp + 4], 0x34
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c4c20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
call fcn.00450670
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x2c
ret
call fcn.00470430
jmp fcn.005d3900

Function at 0x5d3a10
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d3b23
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp dword [eax + 0x58], 3
jne 0x5d3a3c
movzx ecx, byte [eax + 0x1c0]
test cl, cl
je 0x5d3a52
movzx ecx, byte [eax + 0x1c0]
test cl, cl
je 0x5d3a6a
movzx ecx, byte [eax + 0x1c1]
test cl, cl
jne 0x5d3a6a
lea eax, [0x78b1c0]
mov dword [esp + 0x44], eax
lea eax, [0x93ed20]
mov dword [esp + 0x48], eax
add esp, 0x38
ret
mov ecx, dword [eax + 0x180]
test ecx, ecx
je 0x5d3a94
test ecx, 0x20
jne 0x5d3a94
lea eax, [0x78b1c0]
mov dword [esp + 0x44], eax
lea eax, [0x93ed20]
mov dword [esp + 0x48], eax
add esp, 0x38
ret
mov ecx, dword [eax + 0x4c]
test ecx, ecx
jne 0x5d3ab3
mov eax, dword [0x913d90]
mov ecx, dword [0x913d94]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x38
ret
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + 0x48]
mov ebx, dword [ecx + 0xc]
mov ebp, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x3c]
mov dword [esp + 0x34], edi
mov edi, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x44]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
call fcn.005d3c20
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x38
ret
call fcn.00470430
jmp fcn.005d3a10
Function at 0x5d3b30
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d3c15
sub esp, 0x2c
mov eax, dword [esp + 0x30]
lea ecx, [eax - 1]
cmp ecx, 4
jae 0x5d3b63
lea ecx, [0x91c060]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x5d3b85
mov ecx, eax
sar eax, 0x1f
nop
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.004828a0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00465f00
mov eax, dword [esp + 8]
lea ecx, [0x6db180]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [0x7327ef]
mov dword [esp], eax
mov dword [esp + 4], 0x54
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x2c
ret
call fcn.00470430
jmp fcn.005d3b30
Function at 0x5d4290
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d4371
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
xor edx, edx
cmp ecx, edx
jle 0x5d435d
movzx ebx, byte [eax + edx]
cmp ebx, 0x80
jge 0x5d42c8
inc edx
jmp 0x5d42e8
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.004621c0
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp ebx, 0x7f
jle 0x5d42b1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00465f00
mov eax, dword [esp + 8]
lea ecx, [0x6db180]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
lea eax, [0x72c78d]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x24
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
call fcn.00470430
jmp fcn.005d4290
Function at 0x5d84d0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d85b4
sub esp, 0x2c
mov eax, dword [esp + 0x30]
movzx ecx, byte [eax + 0x4c]
nop
test cl, cl
jne 0x5d859b
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc], edx
call fcn.005d7110
mov eax, dword [esp + 0x38]
and eax, 0xf
test eax, eax
je 0x5d8575
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [eax - 0x10]
neg ecx
cmp ecx, 0x10
ja 0x5d8591
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + 0x4c]
test dl, dl
jne 0x5d8579
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x10
call fcn.005d7110
add esp, 0x2c
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a710]
mov dword [esp + 4], eax
call fcn.0046a9e0
mov edx, 0x10
call fcn.004718d0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a710]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.005d84d0

Function at 0x5d85c0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d8674
sub esp, 0x24
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x2c]
mov ecx, eax
sar eax, 0x1f
mov edx, ecx
shr ecx, 8
mov ebx, eax
shl eax, 0x18
or eax, ecx
mov ecx, edx
shr edx, 0x10
mov ebp, ebx
shl ebx, 0x10
or ebx, edx
mov edx, ebp
shl ebp, 8
mov esi, ecx
shr ecx, 0x18
or ecx, ebp
xchg esi, eax
mov byte [esp + 0x1c], al
xchg esi, eax
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], cl
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x4c]
nop
test cl, cl
jne 0x5d865b
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
mov dword [esp + 0xc], 8
call fcn.005d7110
add esp, 0x24
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a710]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.005d85c0
Function at 0x5e4e90
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e4fe0
sub esp, 0x24
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5e4f85
mov ecx, dword [eax + 8]
cmp ecx, 0x4bcec15d
jne 0x5e4eed
lea ecx, [0x6eb9a0]
cmp eax, ecx
jne 0x5e4f85
mov byte [esp + 0x30], 0xe1
mov dword [esp + 0x34], 8
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x24
ret
cmp ecx, 0x8c7bd38d
jne 0x5e4f24
lea ecx, [0x707fa0]
cmp eax, ecx
jne 0x5e4f85
mov byte [esp + 0x30], 0xe3
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x24
ret
cmp ecx, 0xc0d9e4a4
jne 0x5e4f85
lea ecx, [0x6e3700]
cmp eax, ecx
jne 0x5e4f85
lea eax, [0x730551]
mov dword [esp], eax
mov dword [esp + 4], 0x39
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
lea eax, [0x7279c5]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
call fcn.00470430
jmp fcn.005e4e90

Function at 0x5e54a0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e55aa
sub esp, 0x1c
movzx eax, word [esp + 0x20]
mov word [esp], ax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.005e4ff0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test eax, eax
je 0x5e5512
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x5e5506
movzx ebx, word [esp + 0x20]
cmp bx, 0x303
jne 0x5e5500
mov dword [esp + 0x14], 0x2030201
mov edx, 2
lea ebx, [esp + 0x14]
jmp 0x5e550a
mov ebx, dword [esp + 0x28]
jmp 0x5e550a
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
xor ebp, ebp
jmp 0x5e553a
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.005e55c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov word [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x1c
ret
inc ebp
cmp edx, ebp
jle 0x5e5546
movzx esi, word [ebx + ebp*2]
xor edi, edi
jmp 0x5e5585
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x47
lea ecx, [0x731dc0]
mov dword [eax], ecx
mov word [esp + 0x34], 0
lea ecx, [0x78aa3c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x1c
ret
inc edi
mov ebx, dword [esp + 0x18]
cmp edi, eax
jge 0x5e5539
lea ebx, [ecx + edi*2]
cmp word [ebx], si
jne 0x5e5580
mov word [esp + 0x34], si
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x1c
ret
call fcn.00470430
jmp fcn.005e54a0
Function at 0x5e8440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e8522
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5e8491
mov edx, dword [esp + 0x18]
movzx ebx, byte [ecx + edx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x5e847b
mov eax, ecx
jmp 0x5e8482
mov eax, ecx
mov ecx, 0x100
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
sar ebp, 0x1f
xor edi, edi
jmp 0x5e84d4
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
movzx eax, byte [eax + edx - 1]
mov ecx, esi
and esi, ebx
and eax, ecx
xor esi, eax
xchg esi, ebx
not ebx
xchg esi, ebx
inc edi
movzx eax, byte [esp + 0xb]
and eax, esi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jle 0x5e84ef
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub eax, edi
lea ecx, [eax - 1]
sub esi, edi
mov ebp, dword [esp + 0x1c]
cmp ebp, ecx
ja 0x5e84a2
jmp 0x5e8518
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ecx
mov ecx, ebp
call fcn.004718b0
nop
call fcn.00470430
jmp fcn.005e8440
Function at 0x5efce0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5efe5a
sub esp, 0x34
mov eax, dword [esp + 0x38]
test byte [eax], al
lea ecx, [eax + 0x1f0]
mov dword [esp + 0x28], ecx
mov dword [esp], ecx
call fcn.00476050
mov eax, dword [esp + 4]
test eax, 1
jne 0x5efe42
mov dword [esp + 0x1c], eax
or eax, 1
mov edx, dword [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00475fd0
movzx eax, byte [esp + 0xc]
test al, al
je 0x5efcf7
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x5efe1d
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x14]
mov dword [esp], ecx
call fcn.00476060
mov eax, dword [esp + 4]
test eax, eax
jne 0x5efd67
xor eax, eax
xor ecx, ecx
jmp 0x5efdd8
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.005efe70
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
test eax, eax
je 0x5efdd4
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
je 0x5efd94
mov eax, dword [eax + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
lea eax, [0x7321ba]
mov dword [esp], eax
mov dword [esp + 4], 0x4c
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x5efdd8
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [edx + 4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
mov dword [esp], ebx
call edx
mov eax, dword [esp + 4]
test eax, eax
je 0x5efe09
mov ecx, dword [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x34
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
add esp, 0x34
ret
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x34
ret
mov eax, dword [0x913ab8]
mov ecx, dword [0x913abc]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x34
ret
call fcn.00470430
jmp fcn.005efce0
Function at 0x5f0c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f0e49
sub esp, 0x6c
lea edi, [esp + 0x74]
xor eax, eax
call fcn.00471ab7
lea edi, [esp + 8]
call fcn.00471ab7
mov ecx, dword [esp + 0x70]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.00476060
mov ecx, dword [esp + 4]
test ecx, ecx
setne cl
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x70]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xcc]
mov ebx, dword [ecx + 0xd0]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
movzx edx, byte [ecx + 0x36]
mov byte [esp + 0x68], dl
movzx edx, word [ecx + 0x3a]
mov word [esp + 0x6a], dx
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x78]
mov ebx, dword [ecx + 0x7c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x38]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x54]
mov ebx, dword [ecx + 0x58]
mov ebp, dword [ecx + 0x5c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x6c]
mov ebx, dword [ecx + 0x70]
mov ebp, dword [ecx + 0x74]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x48]
mov ebx, dword [ecx + 0x4c]
mov ebp, dword [ecx + 0x50]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x3c]
mov ebx, dword [ecx + 0x40]
mov ebp, dword [ecx + 0x44]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x5f0d73
movzx eax, byte [ecx + 0x34]
test al, al
je 0x5f0dbc
cmp word [ecx + 0x28], 0x304
je 0x5f0dbc
movzx eax, byte [ecx + 0xa4]
test al, al
je 0x5f0da2
lea eax, [ecx + 0xb1]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x5f0dbc
lea eax, [ecx + 0xbd]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x5f0dd5
lea eax, [0x73881c]
mov dword [esp + 0x64], eax
jmp 0x5f0e2d
cmp word [ecx + 0x28], 0x304
je 0x5f0e23
movzx eax, byte [ecx + 0x34]
test al, al
jne 0x5f0e23
lea eax, [0x6e5980]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
lea ecx, [0x5f0e60]
mov dword [eax], ecx
mov ecx, dword [0x93f150]
test ecx, ecx
jne 0x5f0e0f
mov ecx, dword [esp + 0x70]
jmp 0x5f0e1a
call fcn.00471830
mov ecx, dword [esp + 0x70]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x64], eax
jmp 0x5f0e2d
mov eax, dword [ecx + 0x84]
mov dword [esp + 0x64], eax
movzx eax, byte [ecx + 0x94]
mov byte [esp + 0x60], al
lea edi, [esp + 0x74]
lea esi, [esp + 8]
call fcn.00471ee6
add esp, 0x6c
ret
call fcn.00470430
jmp fcn.005f0c70
Function at 0x5f6ba0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f6cbf
sub esp, 0x28
mov eax, dword [esp + 0x30]
movzx ecx, word [eax + 0x54]
movzx eax, word [eax + 0xc]
test cx, cx
jne 0x5f6bca
mov ecx, eax
mov word [esp + 0x1c], cx
mov word [esp + 0x1e], cx
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x2c]
mov dword [esp], edx
mov byte [esp + 4], 1
lea edx, [esp + 0x1e]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.005e76d0
movzx eax, byte [esp + 0x16]
test al, al
je 0x5f6c3c
movzx eax, word [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov word [ecx + 0x28], ax
mov byte [ecx + 0x2a], 1
mov word [ecx + 0xe4], ax
mov word [ecx + 0x140], ax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
add esp, 0x28
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov byte [esp + 4], 0x46
call fcn.005eccf0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
movzx eax, word [esp + 0x1c]
mov word [esp], ax
call fcn.00409e30
mov eax, dword [esp + 4]
lea ecx, [0x6db280]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
lea eax, [0x72f529]
mov dword [esp], eax
mov dword [esp + 4], 0x34
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x28
ret
call fcn.00470430
jmp fcn.005f6ba0
Function at 0x5f79a0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f7b47
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
mov ebx, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x2c]
movzx edx, word [edx + 0x28]
xor ebp, ebp
jmp 0x5f79d0
inc ebp
cmp ebp, ecx
jge 0x5f79f1
movzx esi, word [ebx + ebp*2]
cmp si, dx
jne 0x5f79cf
nop
mov ecx, dword [0x914468]
mov edx, dword [0x91446c]
xor ebx, ebx
jmp 0x5f7b2f
xor ecx, ecx
mov edx, dword [0x93f150]
test edx, edx
je 0x5f7a0a
call fcn.00471840
mov dword [edi], ecx
mov edx, dword [eax + 0x14]
mov dword [edi + 4], edx
mov dword [eax + 0x14], ecx
test ecx, ecx
je 0x5f7aec
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
mov edx, dword [edx + 0x54]
test edx, edx
jne 0x5f7a6e
mov eax, dword [0x91ec40]
lea edx, [0x6de760]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0040c740
mov eax, dword [esp + 0xc]
movzx eax, byte [eax]
test al, al
jne 0x5f7a4e
mov eax, dword [esp + 0x14]
jmp 0x5f7a6e
mov eax, dword [0x91343c]
mov dword [esp], eax
call fcn.0049c7f0
mov eax, dword [0x91343c]
mov dword [esp], eax
call fcn.0049c620
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x54]
test ecx, ecx
jne 0x5f7acc
mov ecx, dword [0x91ec44]
mov edx, dword [eax + 0x14]
test byte [edx], al
lea ebx, [0x6de760]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0040c740
mov eax, dword [esp + 0xc]
movzx eax, byte [eax]
test al, al
jne 0x5f7aac
mov eax, dword [esp + 0x14]
jmp 0x5f7acc
mov eax, dword [0x913440]
mov dword [esp], eax
call fcn.0049c7f0
mov eax, dword [0x913440]
mov dword [esp], eax
call fcn.0049c620
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 0x14]
movzx eax, word [eax]
mov word [ecx + 0x38], ax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov byte [esp + 4], 0x28
call fcn.005eccf0
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2e
lea ecx, [0x72dae3]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
inc ebx
cmp ebx, edx
jge 0x5f7b3e
mov ebp, dword [ecx + ebx*4]
cmp word [ebp], si
jne 0x5f7b2e
jmp 0x5f7b40
xor ebp, ebp
mov ecx, ebp
jmp 0x5f79f3
call fcn.00470430
jmp fcn.005f79a0
Function at 0x5f99d0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f9b7f
sub esp, 0x38
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0xc]
movzx ecx, byte [ecx + 0x2c]
test cl, cl
je 0x5f9b6b
mov ecx, dword [eax + 0x10]
movzx ecx, byte [ecx + 0x64]
mov edx, dword [eax]
test cl, cl
je 0x5f9b2b
mov dword [esp + 0x24], edx
mov dword [esp], edx
lea ecx, [0x78aef0]
mov dword [esp + 4], ecx
lea ecx, [eax + 0x18]
mov dword [esp + 8], ecx
call fcn.005ede60
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x5f9b1b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lea edx, [0x6eaf20]
cmp eax, edx
jne 0x5f9a86
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx]
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], edx
mov eax, dword [0x93f150]
test eax, eax
je 0x5f9a6f
call fcn.00471840
mov dword [edi], ecx
mov eax, dword [ebx + 0x5c]
mov dword [edi + 4], eax
mov dword [ebx + 0x5c], ecx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x38
ret
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov byte [esp + 4], 0xa
call fcn.005eccf0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
lea eax, [0x6eaf20]
mov dword [esp + 0x30], eax
lea eax, [0x731fb4]
mov dword [esp], eax
mov dword [esp + 4], 0x49
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x38
ret
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x38
ret
mov dword [esp], edx
mov byte [esp + 4], 0x2f
call fcn.005eccf0
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2b
lea ecx, [0x72cc66]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x38
ret
call fcn.00470430
jmp fcn.005f99d0