joyce8/EMBER2024-capa huggingface dataset:
Function at 0x784987fe
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x784ba231
call fcn.784b8b66
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x78498911
cmp byte [esi + 0x42], bl
je 0x78498911
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x7849883a
xor al, al
jmp 0x78498913
push ebx
push 8
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_unsigned_int__char_
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_
mov ecx, eax
call fcn.78486152
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_
mov ecx, eax
call fcn.78486152
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x784988aa
dec eax
je 0x784988ae
dec eax
dec eax
je 0x7849890d
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_protected:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool__unsigned_int_
mov al, bl
jmp 0x78498913
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_
mov ecx, eax
call fcn.78486152
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x784988ef
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_
mov ecx, eax
call fcn.78486152
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x78498898
cmp byte [esi + 0x42], 0
je 0x7849890d
test edi, edi
jne 0x78498848
push edi
push 8
lea ecx, [ebp - 0x2c]
call sym.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_unsigned_int__char_
jmp 0x78498848
mov bl, 1
jmp 0x7849889a
mov al, 1
call fcn.784b8bf8
ret
Function at 0x78499084
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp sym.MSVCP90.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__

Function at 0x784b4ebd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
xor eax, eax
mov byte [ebp - 4], 0
lea edi, [ebp - 3]
stosb byte es:[edi], al
push 2
lea eax, [ebp - 4]
push eax
push 0x22
call dword [sym.imp.MSVCR90.dll____lc_handle_func]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp byte [ebp - 4], 0x30
pop edi
jne 0x784b4ef1
push 2
pop eax
leave
ret
xor eax, eax
cmp byte [ebp - 4], 0x31
jne 0x784b4efc
inc eax
leave
ret
cmp byte [ebp - 4], 0x32
setne al
dec eax
and eax, 3
leave
ret

Function at 0x784b8ab0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78505894]
jne 0x784b8aba
repz ret
jmp fcn.784b9380
Function at 0x100dfa0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 4
ja case.default.0x100dfc9
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x100e140]
mov eax, dword [ebp + 0x10]
shr eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100e010
push 0x5c
mov edx, dword [ebp + 0xc]
push edx
call fcn.0100e160
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100e010
mov eax, dword [ebp - 0x10]
mov word [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
jmp case.default.0x100dfc9
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.instapi.dll_GetSQLToolsDirPath
cmp eax, 1
jne 0x100e06b
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov esi, eax
mov edx, dword [0x104b11c]
push edx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
add esi, eax
lea eax, [esi + esi + 2]
cmp eax, dword [ebp + 0x10]
ja 0x100e06b
mov ecx, dword [0x104b11c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.01010f20
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
jmp case.default.0x100dfc9
lea edx, [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call sub.instapi.dll_GetSQLBinPathByInstName
cmp eax, 1
jne 0x100e08c
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
jmp case.default.0x100dfc9
mov eax, dword [ebp + 0x10]
shr eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100e0ba
mov edx, dword [ebp + 0x10]
shr edx, 1
cmp dword [ebp - 0x14], edx
jae 0x100e0ba
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp case.default.0x100dfc9
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.instapi.dll_GetSQLToolsDirPath
cmp eax, 1
jne case.default.0x100dfc9
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov esi, eax
mov ecx, dword [0x104b11c]
push ecx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
add esi, eax
mov edx, dword [0x104b118]
push edx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
add esi, eax
lea eax, [esi + esi + 2]
cmp eax, dword [ebp + 0x10]
ja case.default.0x100dfc9
mov ecx, dword [0x104b11c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.01010f20
mov ecx, dword [0x104b118]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.01010f20
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1010f70
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf50
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0xa
mov esi, 0x1001d44
lea edi, [ebp - 0xe44]
rep movsd dword es:[edi], dword [esi]
mov ax, word [0x10015d4]
mov word [ebp - 0xf48], ax
push 0xfe
push 0
lea ecx, [ebp - 0xf46]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0xf4c], 0
mov dword [ebp - 0xe1c], 0
push 0x250
push 0
lea edx, [ebp - 0x258]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x80
lea eax, [ebp - 0xf48]
push eax
push 0x74
mov ecx, dword [0x104ef34]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [ebp + 8], 0
je 0x1011013
mov dword [ebp - 0xf50], 0x10015d4
jmp 0x101101f
lea edx, [ebp - 0xf48]
mov dword [ebp - 0xf50], edx
mov eax, dword [ebp - 0xf50]
push eax
push 0x73
push 0
push 2
call fcn.01028fb0
add esp, 0x10
push 0x1001d04
lea ecx, [ebp - 0xe18]
push ecx
call fcn.0101a5a0
add esp, 8
lea edx, [ebp - 0xe44]
push edx
push 0
lea eax, [ebp - 0xe18]
push eax
call fcn.0101a630
add esp, 0xc
test eax, eax
je 0x10110ea
push 0
lea ecx, [ebp - 0xe18]
push ecx
call fcn.0101bb70
add esp, 8
cmp dword [ebp + 8], 0
je 0x10110ca
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test eax, eax
je 0x10110ca
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xf4c], eax
cmp dword [ebp - 0xf4c], 0xffffffff
je 0x10110ca
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xf4c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0xe1c], 1
cmp dword [ebp + 8], 0
jne 0x10110da
mov dword [ebp - 0xe1c], 1
lea edx, [ebp - 0xe18]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLLogoff]
add esp, 4
mov eax, dword [ebp - 0xe1c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret
Function at 0x10121a0
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x11c], 0
push str.MSSQLSERVER
call sub.instapi.dll_IsDefaultInstanceName
test eax, eax
jne 0x10121db
mov dword [ebp - 8], str.MSSQLSERVER
push 1
push 0
mov eax, dword [ebp - 8]
push eax
push 0x104c74c
call dword [sym.imp.SQLSVC90.dll_CreateCrossServiceSA]
add esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x101221a
mov ecx, dword [ebp - 0x11c]
push ecx
push 0x19d
push 0
push 1
call fcn.01028fb0
add esp, 0x10
jmp 0x1012230
mov dword [0x104ef40], 0x104c74c
mov edx, dword [0x104ef40]
mov dword [0x10597a4], edx
push str.MSSQLSERVER
call fcn.01044610
add esp, 4
test eax, eax
jne 0x1012250
mov dword [0x104f170], 0
jmp 0x101236b
push str.MSSQLSERVER
mov ecx, 0x104f174
call fcn.01043fa0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1012277
mov dword [0x104f170], 0
jmp 0x101236b
call fcn.01044320
test eax, eax
je 0x10122aa
push 0x10599b8
push 0x1002454
push 0x1002444
push 0x1002438
push 0x105
lea eax, [ebp - 0x118]
push eax
call fcn.01012380
add esp, 0x18
jmp 0x10122cd
push 0x10599b8
push 0x1002454
push 0x1002430
push 0x105
lea ecx, [ebp - 0x118]
push ecx
call fcn.01012380
add esp, 0x14
lea edx, [ebp - 0x118]
push edx
push 4
push 0
push 4
mov eax, dword [0x104ef40]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x1012303
mov dword [0x104f170], 0
jmp 0x101236b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1012331
push 6
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.01046130
add esp, 8
test eax, eax
je 0x1012331
mov dword [0x104f170], 0
jmp 0x101236b
push 4
push 0
push 0
push 2
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x1012361
mov dword [0x104f170], 0
jmp 0x101236b
mov dword [0x104f170], 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret
Function at 0x1013d10
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0
push 0x1002668
push 1
call fcn.0100de70
add esp, 0xc
mov dword [0x104f294], eax
cmp dword [0x104f294], 0
je 0x1013de5
push 0x1002654
mov eax, dword [0x104f294]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f2a4], eax
push 0x1002640
mov ecx, dword [0x104f294]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f2a8], eax
push 0x1002630
mov edx, dword [0x104f294]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f2ac], eax
push 0x100261c
mov eax, dword [0x104f294]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f2b0], eax
push 0x1002608
mov ecx, dword [0x104f294]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f2b4], eax
cmp dword [0x104f2a4], 0
je 0x1013de5
cmp dword [0x104f2a8], 0
je 0x1013de5
cmp dword [0x104f2ac], 0
je 0x1013de5
cmp dword [0x104f2b0], 0
je 0x1013de5
cmp dword [0x104f2b4], 0
je 0x1013de5
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10178f0
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x104ec10
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101793a
mov eax, dword [0x104e764]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
test eax, eax
jne 0x101793a
push 0
push 0x80000130
push 1
push 3
call fcn.010287e0
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1017e70
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0xe
mov esi, 0x1002c74
lea edi, [ebp - 0x440]
rep movsd dword es:[edi], dword [esi]
mov ax, word [0x10015d4]
mov word [ebp - 0x408], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x406]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x848], dx
push 0x3fe
push 0
lea eax, [ebp - 0x846]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x84c], 0
cmp dword [ebp + 0xc], 0
jne 0x1017f01
xor eax, eax
jmp 0x10180ac
push 0x3a0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
lea eax, [ebp - 0x440]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0101a630
add esp, 0xc
test eax, eax
je 0x1017fe8
push 0x400
lea edx, [ebp - 0x848]
push edx
push 0x1001b30
push 0x1001b2c
push 0x104ce80
call fcn.01042360
add esp, 0x14
lea eax, [ebp - 0x848]
push eax
push 0x1002c00
push 0x200
lea ecx, [ebp - 0x408]
push ecx
call fcn.01011d00
add esp, 0x10
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SQLSVC90.dll_QSQLExecDirect]
add esp, 8
cmp eax, 1
jne 0x1017fe8
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x444]
push edx
push 4
push 0xfffffffffffffff0
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SQLSVC90.dll_QSQLBind]
add esp, 0x18
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SQLSVC90.dll_QSQLNextRow]
add esp, 4
cmp eax, 0xffffffff
jne 0x1017fcb
jmp 0x1017fb7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLResults]
add esp, 4
cmp eax, 1
je 0x1017f96
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x444]
mov dword [eax], ecx
push 0x104ce80
push 0x84
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
call fcn.01010390
push 0x104d080
push 0x68
mov eax, dword [ebp + 0xc]
add eax, 0x114
push eax
call fcn.01010390
push 0x104cf80
push 0x68
mov ecx, dword [ebp + 0xc]
add ecx, 0x1e4
push ecx
call fcn.01010390
push 0x104d180
push 0x68
mov edx, dword [ebp + 0xc]
add edx, 0x2b4
push edx
call fcn.01010390
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x110], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x384], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x388], 0
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x38c], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x390], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x394], 0
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x398], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x39c], 0
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret
Function at 0x1019e80
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x20c], 0
mov dword [ebp - 4], 0
mov ax, word [0x10015d4]
mov word [ebp - 0x418], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x416]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x208], dx
push 0x1fe
push 0
lea eax, [ebp - 0x206]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push 0
push 0x1002e58
push 0x100
lea ecx, [ebp - 0x208]
push ecx
call fcn.010120f0
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
push 1
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x101a0eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 5
jne 0x1019f85
cmp dword [0x104f2c8], 0
jne 0x1019f7b
push 0
push 0x8000006a
push 1
push 3
call fcn.010287e0
add esp, 0x10
mov dword [0x104f2c8], 1
mov eax, 3
jmp 0x101a104
push 4
push 0
push 0
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1019fad
xor eax, eax
jmp 0x101a104
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx]
mov dword [ebp - 0x41c], edx
cmp dword [ebp - 0x41c], 0
je 0x1019fdf
cmp dword [ebp - 0x41c], 1
je 0x101a031
cmp dword [ebp - 0x41c], 2
je 0x101a07d
jmp 0x101a0e9
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x104d588], 0
je 0x1019ffe
xor eax, eax
jmp 0x101a104
cmp dword [0x104f2cc], 0
jne 0x101a031
push 0x104ed18
push 0x10015b4
push 0x168
push 0
push 2
call fcn.01028fb0
add esp, 0x14
call fcn.01031be0
mov eax, 1
jmp 0x101a104
mov ecx, dword [ebp - 0x214]
mov dword [ecx], 2
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x104f2cc], 0
jne 0x101a07d
push 0x104ed18
push 0x10015b4
push 0x168
push 0
push 2
call fcn.01028fb0
add esp, 0x14
call fcn.01031be0
mov eax, 1
jmp 0x101a104
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x100
lea ecx, [ebp - 0x418]
push ecx
call fcn.0102b310
add esp, 8
lea edx, [ebp - 0x418]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x101a0df
push 0x104ed18
push 0x10015b4
push 0x168
push 0
push 2
call fcn.01028fb0
add esp, 0x14
call fcn.01031be0
jmp 0x101a0e9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101a0ff
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x101a104
mov eax, 3
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret
Function at 0x101af30
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x20c], 0
mov ax, word [0x10015d4]
mov word [ebp - 0x208], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x206]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x410], dx
push 0x1fe
push 0
lea eax, [ebp - 0x40e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x101afac
cmp dword [ebp + 0xc], 0
jne 0x101afb3
xor eax, eax
jmp 0x101b06a
push 0x200
lea ecx, [ebp - 0x410]
push ecx
push 0x1001b30
push 0x1001b2c
mov edx, dword [ebp + 0xc]
push edx
call fcn.01042360
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
push 0x10030c0
push 0x100
lea ecx, [ebp - 0x208]
push ecx
call fcn.01011d00
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SQLSVC90.dll_QSQLExecDirect]
add esp, 8
cmp eax, 1
jne 0x101b064
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 4
push 0xfffffffffffffff0
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SQLSVC90.dll_QSQLBind]
add esp, 0x18
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SQLSVC90.dll_QSQLNextRow]
add esp, 4
cmp eax, 0xffffffff
jne 0x101b045
jmp 0x101b02f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLPurgeResults]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SQLSVC90.dll_QSQLResults]
add esp, 4
cmp eax, 1
je 0x101b00e
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret
Function at 0x101f710
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0xc
mov esi, 0x1004e54
lea edi, [ebp - 0x45c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ax, word [0x10015d4]
mov word [ebp - 0x428], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x426]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x45c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0101a630
add esp, 0xc
test eax, eax
je 0x101f89d
push 0x1c
push 0
lea ecx, [ebp - 0x20]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104ee20
mov edx, dword [ebp + 0x10]
push edx
push 0x1004d08
push 0x200
lea eax, [ebp - 0x428]
push eax
call fcn.01011d00
add esp, 0x14
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLExecDirect]
add esp, 8
cmp eax, 1
jne 0x101f89d
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 4
push 0xfffffffffffffff0
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLBind]
add esp, 0x18
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 4
push 0xfffffffffffffff0
push 2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLBind]
add esp, 0x18
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0xfffffffffffffff0
push 3
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLBind]
add esp, 0x18
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x10
push 0xfffffffffffffffe
push 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLBind]
add esp, 0x18
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SQLSVC90.dll_QSQLNextRow]
add esp, 4
cmp eax, 0xffffffff
jne 0x101f887
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SQLSVC90.dll_SHRecMemAdd]
add esp, 8
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
push 0x1c
push 0
lea ecx, [ebp - 0x20]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
jmp 0x101f849
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SQLSVC90.dll_QSQLResults]
add esp, 4
cmp eax, 1
je 0x101f7d1
mov eax, dword [ebp - 0x24]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret