joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x43d4c0
push esi
call fcn.0040605c
push esi
call fcn.00405bd9
mov edi, eax
test edi, edi
jne 0x405c49
xor eax, eax
jmp 0x405c9b
push edi
call fcn.004062e4
test byte [0x4492f8], 0x80
je 0x405c62
mov al, byte [edi]
test al, al
je 0x405c45
cmp al, 0x5c
je 0x405c45
sub edi, esi
push esi
call fcn.00406072
cmp eax, edi
push esi
jle 0x405c85
call fcn.0040652a
test eax, eax
je 0x405c7d
test byte [eax], 0x10
je 0x405c45
push esi
call fcn.00405b8c
jmp 0x405c64
call fcn.00405b45
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405d12
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405d2e
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405d31
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405da5
mov eax, edi
dec edi
test eax, eax
jne 0x405d6b
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405d9f
Function at 0x405da9
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00406551
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405dcd
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405f06
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43fe48], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x43fe48
je 0x405e11
push 1
push 0
push esi
call fcn.00405d31
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405f0c
cmp eax, edi
jg 0x405f0c
mov esi, 0x43f8c0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405f0c
cmp eax, edi
jg 0x405f0c
push esi
push ebp
push str._s_s_r_n
push 0x43f4c0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x4492f0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00406090
push 4
push 0xc0000000
push esi
call fcn.00405d31
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405f06
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405eff
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405eff
cmp edi, dword [esp + 0x18]
jne 0x405eff
push str._Rename__r_n
push esi
call fcn.00405ca0
test eax, eax
jne 0x405f13
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.0040605c
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x43f4c0
push eax
call fcn.00405cec
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x449370]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40aad8
push eax
call fcn.00405ca0
test eax, eax
je 0x405eca
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405f3a
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405f2f
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405ecc
Function at 0x405f42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405fb3
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405fa2
cmp dword [ebp + 0x14], 1
je 0x405fa4
cmp dword [ebp + 0x14], 2
je 0x405fa4
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x40637d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4063a2
mov eax, dword [0x40a8a8]
cmp eax, 0xffffffff
je 0x406399
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a8], 0xffffffff
jmp 0x406415
cmp dword [0x440a60], ebx
je 0x406415
cmp byte [0x440660], bl
je 0x4063e1
cmp dword [0x40a8a8], 0xffffffff
jne 0x4063ea
push 4
push 0x40000000
push 0x440660
call fcn.00405d31
cmp eax, 0xffffffff
mov dword [0x40a8a8], eax
je 0x406415
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a8], 0xffffffff
je 0x406415
push esi
mov esi, 0x444a80
push 0x40aaf0
push esi
call fcn.0040607f
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00406072
push eax
push esi
push dword [0x40a8a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4065c7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44024c], esi
push edi
jne 0x406601
mov ecx, 0x440248
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4065dd
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440648
jl 0x4065d8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406636
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440248]
xor eax, esi
inc ecx
dec edx
jne 0x406619
pop edi
pop esi
not eax
ret 0xc
Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4034db
pop dword [ebp - 0x18]
mov eax, 0x4034db
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x98172eb7
add dword [ebp - 0x28], 0xb63b1694
mov dword [ebp - 0x24], 0x8f20a627
add dword [ebp - 0x24], 0xa312a61e
mov dword [ebp - 0x20], 0xf4cdf415
add dword [ebp - 0x20], 0x577e5019
mov dword [ebp - 0x1c], 0xf61812cd
sub dword [ebp - 0x1c], 0xf61812cd
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x395041e8
add dword [ebp - 0x28], 0x3b22276e
mov dword [ebp - 0x24], 0x73b00024
add dword [ebp - 0x24], 0xcdbc6151
mov dword [ebp - 0x20], 0xf8b0c121
sub dword [ebp - 0x20], 0x954154b5
mov dword [ebp - 0x1c], 0xdeb78ee8
add dword [ebp - 0x1c], 0x21487118
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x54ea02a8
add eax, 0xab563da8
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37e38
push 0
call eax
mov ecx, 0x3e62ce06
add ecx, 0xc19d7dfd
mov edi, eax
mov ebx, 0x8f90bd2a
sub ebx, 0x8f50392a
add ebx, dword [ebp - 0x18]
mov edx, 0xb2651a37
add edx, 0xf8b085b0
add dword [ebp - 0x10], 0x5add7266
mov esi, dword [ebx]
xor dword [ebp - 0x10], 0x1157825b
xor esi, edx
mov dword [ebp - 4], 0x55071658
mov dword [edi], esi
add dword [ebp - 0x14], 0x4be86a1d
add edi, 4
add ebx, 4
loop 0x4035f3
add eax, 0x989e51b7
sub eax, 0x989d2ed8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x42088f
Capabilities:
Encode data using xor

Disassembly:
lcall 0x27f3, 0xa9e4ad8d
aas
aad 0xd5
invalid
jne 0x420844
insd dword es:[edi], dx
test al, 0xc8
cmc
in eax, 4
jp 0x4208ed
jp 0x4208ed
or dl, byte [edx + ebp*2]
push ebp
paddq mm1, qword [edi + 0x1cec6cd0]
test dword [edi + 0x673bffd7], esi
test dword [esi - 0x4f], edx
mov ebp, dword [edx - 0x60]
movsd dword es:[edi], dword [esi]
add eax, dword [esi + eax*8 + 0x48]
insb byte es:[edi], dx
in al, dx
sbb al, 0x85
mov bh, 0xd7
invalid
dec edi
mov dl, 0xfb
cdq
jb 0x4208ec
ret
jno 0x4208a2
mov ah, 0x65
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword gs:[esi]
cmp ah, byte [edx + ebp*2 - 0x6b]
mov esi, dword [eax - 0x62]
or eax, 0x65ee2ae0
mov esi, 0x2e153ff5
xor al, 0x22
adc ah, byte [eax - 0x42f2989]
or ebx, dword [edi - 0x3f]
loope 0x420898
out 0xfd, eax
js 0x420939
or al, 0x16
and dl, byte [ebx - 0x7b29c35c]
ljmp 0xaff7
inc edi
inc eax
aam 0x1f
add eax, 0xeabc4562
push es
mov byte [0xf5fabd7e], al
cmc
or al, 0x4d
pop esi
mov ecx, 0x87ccf006
stc
int 0x4e
in al, 0x60
cli
cmp eax, 0xae495bbd
xchg byte [si], dl
fild dword [esi + ebp*4 - 0x410ad32e]
lds ecx, [ecx + edi + 0x7be2e59c]
xor al, byte [ebx - 0x7d]

Function at 0x4320e3
Capabilities:
Packed with generic packer

Disassembly:
xchg ecx, edx
cmp ecx, 0xff000000
jae 0x4320fe
cmp ecx, 0xfe000000
jb 0x4320fc
movsx ecx, cx
add ecx, dword [eax]
jmp dword [ecx]
jmp ecx
and ecx, 0xffffff
add ecx, eax
mov eax, edx
mov edx, dword [ecx]
jmp fcn.004374a7
Function at 0x4374a7
Capabilities:
Packed with generic packer

Disassembly:
adc al, 0x9c
xor byte [eax], ah
add bh, byte [ebp - 0x16b23e76]
aam 0xdd
loopne 0x43749d
add byte [edx + edx + 0x3c2113a0], al
iretd
salc
popal
push 0x5446a389
mov cs, esp
invalid
pop eax
jnp 0x4374e8
jns 0x4374ec
dec esp
xor dl, ah
rol dword [ecx], 1
xchg ecx, eax
shr dh, cl
and dword [esi], ebp
cmp eax, dword [eax + 0x29]
les esp, [ebx - 0x7e]
xor esi, dword [ebp - 0x67]
jae 0x437472
mov byte [ebx - 0x560f9965], bl
and dword [esp + edx*8 - 0x3c], edx
mov dword [0x34af8dc0], eax
inc ecx
cmc
dec ecx
js 0x437518
mov dl, 0x80
aam 0x9d
sbb eax, 0x91effe51
lodsd eax, dword cs:[esi]
call fcn.005f8e56
xor bl, byte [ecx - 0x2fee0fcb]
inc ebp
invalid
mov al, byte [0x15fde1a0]
add eax, 0x3bfb8138
fst dword [esi + 0x41]
invalid
inc edx
jo 0x43752b
rcl dword [eax + eax*4 + 0x69], 0xd1
xlatb
nop
sbb dword [eax], edx
push eax
mov byte [0x42e3b8be], al
in al, 0xa4
movsb byte es:[edi], byte [esi]
mov eax, 0x8120f169
or byte [ecx + eax*4], 0xb0
les ebp, [ebp - 7]
rol byte fs:[ecx], cl
aad 0x79
xor dword [ecx - 0x2eaf7f70], edx
mov al, 0x97
fild qword [ecx + 0x155d5cf]
arpl word [ebx + edx*4 + 0xdc1887f], dx
add dword [eax + 0x21], edi
aad 0xe9
test dword [ebp + edi*2 - 0x2c], esi
rol byte [ebp + ecx*4 - 0x44f0f32], cl
adc ch, byte [eax]
sar edx, 1
push cs
fsub qword [eax - 0xd2f1a1f]
add bl, byte [ecx - 0x3b173810]
nop
mov al, byte gs:[0xfd515131]
sar al, 1
test dword [eax + 0x69], 0xf13ab2a3
pushfd
xchg ebx, eax
fdiv dword [ebx + edi]
mov cl, 0x80
sub al, 0xe8
inc ecx
in al, dx
lodsd eax, dword [esi]
add ch, 0x96
xchg ebx, eax
fisub word [edx]
mov ch, 0x59
push ss
adc al, 0xf0
int1
cmp bl, byte [edi]
test bl, dh
aaa
or eax, 0x2530ef96
sub byte [eax], dl
nop
inc ebp
cmp dword es:[ecx], edx
pop es
jne 0x43762b
pop ecx
and edx, dword [eax]
sbb byte [edx], bl
invalid
lodsd eax, dword [esi]
xor eax, 0x60b052d1
mov byte [0xae912760], al
wait
mov byte [0xfef7c044], al
mov ecx, 0x17f17a41
sub al, cl
jno 0x43755b
sal dword [ecx - 0x76], 0
push ss
add byte [esi], dl
and edx, dword [edx*2 - 0xd7eeee7]
push eax
wait
insd dword es:[edi], dx
aad 0x92
adc al, 0xa8
push edi
pushfd
mov al, byte [0x30406069]
enter 0x5300, 0x16
jns 0x4375ce
invalid
popal
jmp 0x4375b7

Function at 0x473423
Capabilities:
Encode data using xor

Disassembly:
rcr dword [edx], 1
pop es
aaa
shr byte [ecx], 1
invalid
cmpsb byte [esi], byte es:[edi]
xlatb
fcmove st(0), st(7)
js 0x4733c7
cmpsb byte [esi], byte es:[edi]
jle 0x47340c
cli
Function at 0x47c29f
Capabilities:
Encode data using xor

Disassembly:
cmc
xchg ebp, eax
aaa
sub eax, 0x554be475
dec ebp
iretd
jo 0x47c2fd
popal
cmp byte [eax + 0x46], dl
push es
pop ebx
movsd dword es:[edi], dword [esi]
mov eax, dword [0x5a6486d5]
sub dword [edi - 0xa980bfb], eax
cwde
inc ecx
loop 0x47c321
insd dword es:[edi], dx
and esp, dword [ebp + 0x1b0954b7]
bound esp, qword [ebx + 9]
push eax
lahf
lds ebp, [edx + 0x76a85465]
out 0x73, eax
mov al, 0xed
cmp eax, ebp
xor al, 0xf5
cmp eax, 0x806c1ed5
jp 0x47c27d
movsb byte es:[edi], byte [esi]
lahf
or eax, 0x52358162
xchg byte fs:[esi], ah
adc al, 0x38
or eax, 0x255baa64
cmp byte [0x255baa64], cl
dec ebp
sar edx, 0xc3
fidiv dword [ebp + 0x33e73590]
popfd
xor edx, dword [0x62196d11]
movsb byte es:[edi], byte [esi]
or dh, byte [ecx + 0x54]
aad 0x1d
dec ebx
jmp 0x47c298
lcall 0x678e, 0x2dc52833
iretd
pop edi
cli
lodsd eax, dword [esi]
rcr dword [edx - 0x16], 1
xchg ebx, eax
xor dword [edx - 0x11640a8c], esi
aad 0xc8
das
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xc630553d]
inc ebp
push edx
add ebp, dword [ebx]
mov word [ebx - 0x32143aff], ds
test dword [ebp + 0x60], edx
wait
loop 0x47c2dd
xor esp, dword [edi + edx*8 + 0x5a159df2]
mov edi, 0x3562008d
lahf
or dword [eax + 0x2fc56035], eax
xchg ebp, eax
inc eax
add eax, 0xc33de3cb
in eax, 0xf1
xor eax, 0x95236f85
jecxz 0x47c390
cmc
inc edi
and dword [edi + 0x756f3623], 0x12e32390
push es
mov dh, 0x7d
push ds
inc ebp
mov ch, 0x54
xchg dword [ebx - 0x30], ecx
mov dword [0x3aa5d5ac], edx
cli
mov ch, 0x51
invalid
mov fs, word es:[ebx + 0x4a]
push ecx
nop
or dh, byte [eax + 0x37]
arpl word [ebp - 0x59], sp
sub esi, dword fs:[ebp + 0x5d]
invalid
Function at 0x402400
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
movups xmmword [ebp - 0x1f], xmm0
push esi
movzx eax, word [ecx + 4]
lea ebx, [ecx + 6]
push edi
mov word [ebp - 0x1c], ax
movzx eax, word [ebx + 8]
push ebx
movq qword [ebp - 0xf], xmm0
movq xmm0, qword [ebx]
mov word [ebp - 0x12], ax
mov al, byte [ebx + 0xa]
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
push 0x446e50
mov dword [ebp - 7], 0
mov word [ebp - 3], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x20], 0x1820c1
movq qword [ebp - 0x1a], xmm0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0
call fcn.0041ad10
add esp, 0xc
test al, al
je 0x40252d
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40252d
push str.WCoinC
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x40249a
or esi, eax
jmp 0x4024ad
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov esi, eax
push str.WCoinP
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4024c0
or edi, eax
jmp 0x4024d3
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov edi, eax
push str.GoblinPoint
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4024e6
or eax, eax
jmp 0x4024f7
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push dword [0x446e5c]
xor ecx, ecx
test esi, esi
cmovs esi, ecx
test edi, edi
mov dword [ebp - 0xc], esi
cmovs edi, ecx
test eax, eax
mov dword [ebp - 8], edi
cmovs eax, ecx
mov dword [ebp - 4], eax
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x40259b
push dword [0x446e5c]
mov esi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call esi
mov edi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call edi
push ebx
push str.INSERT_INTO_CashShopData__AccountID_WCoinC_WCoinP_GoblinPoint__VALUES___s_0_0_0_
push 0x446e50
call fcn.0041ad10
add esp, 0xc
push dword [0x446e5c]
test al, al
jne 0x40257a
call esi
push 2
push dword [0x446e5c]
call edi
mov byte [ebp - 0xf], 1
jmp 0x40259b
call esi
push 2
push dword [0x446e5c]
call edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x20
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.0041c350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4025c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x3b
lea eax, [ebp - 0x3b]
push 0
push eax
call fcn.0041f490
mov ecx, dword [ebp + 8]
add esp, 0xc
movq xmm0, qword [ecx + 6]
lea edx, [ecx + 6]
mov dword [ebp - 0x3c], 0x1183cc1
mov dword [ebp + 8], edx
movzx eax, word [ecx + 4]
mov word [ebp - 0x38], ax
movzx eax, word [edx + 8]
mov word [ebp - 0x2e], ax
mov al, byte [edx + 0xa]
mov byte [ebp - 0x2c], al
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x20], eax
movzx eax, word [ecx + 0x20]
mov word [ebp - 0x1c], ax
mov eax, dword [ecx + 0x24]
push edx
mov dword [ebp - 0x18], eax
mov al, byte [ecx + 0x28]
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
push 0x446e50
movq qword [ebp - 0x36], xmm0
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x14], al
call fcn.0041ad10
add esp, 0xc
test al, al
je 0x402770
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x402770
push str.WCoinC
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x402676
or esi, eax
jmp 0x402689
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov esi, eax
push str.WCoinP
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x40269c
or edi, eax
jmp 0x4026af
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov edi, eax
push str.GoblinPoint
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4026c2
or eax, eax
jmp 0x4026d3
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push dword [0x446e5c]
xor ecx, ecx
test esi, esi
cmovs esi, ecx
test edi, edi
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
cmovs edi, ecx
test eax, eax
mov dword [ebp - 0xc], edi
cmovs eax, ecx
mov dword [ebp - 8], eax
call esi
mov edi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call edi
push 0x53
push dword [ebp + 8]
push str.SELECT_count___FROM_CashShopInventory_WHERE_AccountID_s_AND_InventoryType_d
push 0x446e50
call fcn.0041ad10
add esp, 0x10
test al, al
je 0x40275c
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40275c
push 0x447a7e
call fcn.0042417e
add esp, 4
mov dword [ebp - 4], eax
push dword [0x446e5c]
call esi
push 2
push dword [0x446e5c]
call edi
jmp 0x40278e
push dword [0x446e5c]
call esi
push 2
push dword [0x446e5c]
call edi
jmp 0x40278a
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov byte [ebp - 0x2b], 1
push 0x3c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
call fcn.0041c350
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403170
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x11
mov ecx, 6
push esi
push edi
cmp byte [ebx + 0x11], 0
cmovne ecx, eax
mov ax, word [ecx + ebx + 8]
movq xmm0, qword [ecx + ebx]
mov word [ebp - 0xc], ax
mov al, byte [ecx + ebx + 0xa]
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
push eax
push str.SELECT_WCoinC_WCoinP_GoblinPoint_FROM_CashShopData_WHERE_AccountID_s
push 0x446e50
movq qword [ebp - 0x14], xmm0
call fcn.0041ad10
add esp, 0xc
test al, al
je 0x4032b7
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x4032b7
push str.WCoinC
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4031f9
mov dword [ebp - 0x20], eax
jmp 0x40320d
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov dword [ebp - 0x20], eax
push str.WCoinP
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x403221
mov dword [ebp - 0x1c], eax
jmp 0x403235
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov dword [ebp - 0x1c], eax
push str.GoblinPoint
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x403249
mov dword [ebp - 0x18], eax
jmp 0x40325d
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov dword [ebp - 0x18], eax
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov esi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call esi
mov edx, dword [ebx + 0x24]
mov eax, closesocket
add edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp edx, eax
cmova edx, eax
add ecx, dword [ebx + 0x20]
cmp ecx, eax
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
add eax, dword [ebp - 0x20]
mov ebx, closesocket
cmp eax, 0x7fffffff
cmova eax, ebx
lea ebx, [ebp - 0x14]
push ebx
push edx
push ecx
push eax
push str.UPDATE_CashShopData_SET_WCoinC_d_WCoinP_d_GoblinPoint_d_WHERE_AccountID_s
jmp 0x4032e7
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov esi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call esi
push dword [ebx + 0x24]
lea eax, [ebp - 0x14]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push eax
push str.INSERT_INTO_CashShopData__AccountID_WCoinC_WCoinP_GoblinPoint__VALUES___s__d__d__d_
push 0x446e50
call fcn.0041ad10
add esp, 0x18
push dword [0x446e5c]
call edi
push 2
push dword [0x446e5c]
call esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret 4