joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440683
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x714]
push eax
call fcn.0043e622
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0043e5d7
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4406b3
jmp 0x4406b8
jmp 0x43ffb4

Function at 0x4407e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0043e612
xchg esp, eax
ror byte [ebp + 0x23], cl
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4407ff
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4407ff
call fcn.0043e612
pushal
cld
aaa
or dword [ebx - 0x20fcdba6], 0x66
mov ecx, dword [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0043e612
int1
mov edx, 0x875ff47
push dword [ebp + 4]
push dword [ebp]
call fcn.0043ee12
invalid

Function at 0x441be0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x441be8
mov dword [ecx*4 + 0x489c80], eax
inc ecx
cmp ecx, 0x100
jb 0x441be3
mov edx, 0x800
jmp 0x441c35
mov eax, dword [ecx*4 + 0x489880]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x489c80]
inc ecx
mov dword [ecx*4 + 0x489c7c], eax
cmp ecx, edx
jb 0x441c14
mov eax, 0x443f3f
mov esi, 0x443fdb
mov dword [0x489c60], eax
mov dword [0x48bc80], eax
mov dword [0x489c5c], esi
call fcn.00444176
test eax, eax
jne 0x441c62
mov dword [0x48bc80], esi
pop esi
ret
Function at 0x445367
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x445386
xor eax, eax
jmp 0x445489
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x4453a0
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4453a5
inc esi
cmp esi, dword [ebp - 4]
jb 0x445395
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x445473
cmp ecx, 2
jbe 0x445441
xor edx, edx
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x445468
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
add edi, 5
mov ebx, ecx
sub ebx, edi
test edx, edx
je 0x44541e
and edx, 6
shl edx, 2
mov ecx, edx
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], ecx
inc eax
test al, 0xfe
jne 0x445419
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
sub ebx, edi
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, ebx
shr ecx, 8
mov byte [esi + 1], bl
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
shr ecx, 0x10
and bl, 1
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x445390
shr edx, cl
test edx, edx
je 0x4453c3
cmp edx, 4
ja 0x445468
cmp edx, 3
je 0x445468
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
jne 0x4453c3
or edx, 8
shr edx, 1
inc edi
jmp 0x445390
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0xc]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret

Function at 0x44742e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x487368], 0
push esi
jne 0x4473a1
call fcn.004472c7
test eax, eax
je 0x4473e4
mov eax, dword [0x487368]
cmp eax, 1
jne 0x4473c2
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4473e4
pop esi
ret
push eax
call dword [0x487370]
test eax, eax
jne 0x44742c
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4473e8
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x487368]
call dword [0x487370]
mov edi, eax
test edi, edi
je 0x44740d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x447429
mov edi, esi
add esi, 0xff0
push edi
push dword [0x487368]
call dword [0x48736c]
add edi, 0x10
cmp edi, esi
jb 0x447415
mov eax, edi
pop edi
pop esi
ret
jmp 0x44738e

Function at 0x447554
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x484060]
jne 0x44755e
repz ret
jmp fcn.0044c22c
Function at 0x45dddb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044c3a4
and dword [ebp - 4], 0
cmp dword [0x487f40], 0
mov ebx, eax
jne 0x45de8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45df3d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45df3d
push eax
call fcn.0044c332
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x487f40], eax
call esi
push eax
call fcn.0044c332
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x487f44], eax
call esi
push eax
call fcn.0044c332
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x487f48], eax
call esi
push eax
call fcn.0044c332
pop ecx
mov dword [0x487f50], eax
test eax, eax
je 0x45de8c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044c332
pop ecx
mov dword [0x487f4c], eax
mov eax, dword [0x487f4c]
cmp eax, ebx
je 0x45dee4
cmp dword [0x487f50], ebx
je 0x45dee4
push eax
call fcn.0044c3ad
push dword [0x487f50]
mov esi, eax
call fcn.0044c3ad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45dee4
test edi, edi
je 0x45dee4
call esi
test eax, eax
je 0x45dedb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45dedb
test byte [ebp - 0xc], 1
jne 0x45dee4
or dword [ebp + 0x10], 0x200000
jmp 0x45df1d
mov eax, dword [0x487f44]
cmp eax, ebx
je 0x45df1d
push eax
call fcn.0044c3ad
pop ecx
test eax, eax
je 0x45df1d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45df1d
mov eax, dword [0x487f48]
cmp eax, ebx
je 0x45df1d
push eax
call fcn.0044c3ad
pop ecx
test eax, eax
je 0x45df1d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x487f40]
call fcn.0044c3ad
pop ecx
test eax, eax
je 0x45df3d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45df3f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x85bc86
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x85bc98
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x85bce6
movzx edx, word [ebp + 0xc]
and edx, 0x80
je 0x85bcba
movzx eax, word [ebp + 0xc]
xor eax, 0x658e
mov word [ebp + 0xc], ax
movzx ecx, word [ebp + 0xc]
shl ecx, 1
mov word [ebp + 0xc], cx
movzx edx, byte [ebp + 8]
and edx, 0x80
je 0x85bcdc
mov ax, word [ebp + 0xc]
add ax, 1
mov word [ebp + 0xc], ax
mov cl, byte [ebp + 8]
shl cl, 1
mov byte [ebp + 8], cl
jmp 0x85bc90
mov ax, word [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x85bd46
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x85bd55
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jbe 0x85bdcb
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
mov byte [ebp - 1], 0
jmp 0x85bd71
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x85bdc0
movzx edx, word [ebp + 0x10]
and edx, 0x8000
je 0x85bd93
movzx eax, word [ebp + 0x10]
xor eax, 0x8411
mov word [ebp + 0x10], ax
mov cx, word [ebp + 0x10]
shl cx, 1
mov word [ebp + 0x10], cx
movzx edx, byte [ebp - 2]
and edx, 0x80
je 0x85bdb6
mov ax, word [ebp + 0x10]
add ax, 1
mov word [ebp + 0x10], ax
mov cl, byte [ebp - 2]
shl cl, 1
mov byte [ebp - 2], cl
jmp 0x85bd69
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x85bd4c
mov ax, word [ebp + 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x94e406
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x94e44a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x94e479
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + 0xc]
jb 0x94e477
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 8]
add edx, dword [eax + 8]
cmp dword [ebp + 0xc], edx
jae 0x94e477
mov eax, dword [ebp - 8]
jmp 0x94e47b
jmp 0x94e438
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x94ea96
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0x94eada
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x28
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x94eb1d
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0094e846
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jb 0x94eb1b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 8]
cmp dword [ebp + 0x10], edx
jae 0x94eb1b
mov eax, dword [ebp - 0xc]
jmp 0x94eb1f
jmp 0x94eac8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x94eb26
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x94eb71
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x94ebc2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x94eb8f
mov eax, dword [ebp - 0xc]
jmp 0x94ebc4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 8]
cmp eax, dword [edx + 0x10]
jbe 0x94eba8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x18], edx
jmp 0x94ebb1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
and edx, 0xfffffffe
add edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
jmp 0x94eb5f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xae69f4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.0040569c
xor eax, eax
push ebp
push 0xae6b0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004051ec
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xae6b24
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xae6b74
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 0xc]
call fcn.0068332c
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
je 0xae6acd
mov edx, 0xae6b8c
mov eax, dword [ebp - 0x18]
call fcn.004e481c
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00405240
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xae6b12
lea eax, [ebp - 0x1c]
call fcn.004051ec
lea eax, [ebp - 0xc]
call fcn.004051ec
ret
Function at 0xae6b9c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.0040569c
xor eax, eax
push ebp
push 0xae6cea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0xae6060]
call fcn.00ae6124
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, dword [0x438970]
call fcn.00438b10
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xae6d04
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xae6d54
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 0xc]
call fcn.0068332c
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
jmp 0xae6c98
mov edx, 0xae6d6c
mov eax, dword [ebp - 0x18]
call fcn.004e481c
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.00ae62e0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0xae6c90
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.00438b08
mov eax, dword [ebp - 0x18]
call fcn.004e5fbc
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0xa1], 0
je 0xae6c5c
mov eax, dword [ebp - 0x1c]
call fcn.0040429c
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xae6cf1
lea eax, [ebp - 0x24]
call fcn.004051ec
lea eax, [ebp - 0xc]
call fcn.004051ec
ret
Function at 0xae7668
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xae7864
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00672a4c
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x38]
xor eax, eax
push ebp
push 0xae7842
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00652ce4
mov edx, 0xae787c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xae78b4
mov eax, dword [ebp - 0x14]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x14]
call fcn.004e35a4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
jle 0xae7814
mov dl, 1
mov eax, dword [0xae6db4]
call fcn.00ae6eec
mov dword [ebp - 0xc], eax
mov edx, 0xae78b4
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov edx, 0xae78c4
mov eax, dword [ebp - 0x14]
call fcn.004e481c
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add eax, 8
call fcn.00405240
mov edx, 0xae78d4
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov edx, 0xae78e8
mov eax, dword [ebp - 0x14]
call fcn.004e481c
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, 0x10
call fcn.00405240
mov edx, 0xae78fc
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x44]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x14], al
mov edx, 0xae7910
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x44]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x15], al
mov edx, 0xae7928
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x84]
test al, al
je 0xae77fc
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0xffffffff
jmp 0xae7814
mov edx, 0xae7928
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x14]
call fcn.004e35b0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xae7849
mov eax, dword [ebp - 0x14]
call fcn.0040429c
mov eax, dword [ebp - 0x10]
call fcn.0040429c
ret
Function at 0xae7934
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00672a4c
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x38]
xor eax, eax
push ebp
push 0xae7a21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00652ce4
mov edx, 0xae7a38
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xae7a78
mov eax, dword [ebp - 0x14]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x14]
call fcn.004e35a4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
jle 0xae79f3
mov edx, 0xae7a8c
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00ae7668
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
call fcn.004e35b0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xae7a28
mov eax, dword [ebp - 0x14]
call fcn.0040429c
mov eax, dword [ebp - 0x10]
call fcn.0040429c
ret
Function at 0xae8318
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xae84bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0xae7eb8]
call fcn.00ae7f9c
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00672a4c
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x14]
call fcn.00652ce4
mov edx, 0xae84d4
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xae8518
mov eax, dword [ebp - 0x14]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x14]
call fcn.004e35a4
jmp 0xae8471
mov dl, 1
mov eax, dword [0xae7e48]
call fcn.00ae7f28
mov dword [ebp - 0x18], eax
mov edx, 0xae8530
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], eax
mov edx, 0xae8518
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0x18]
mov dword [edx + 8], eax
mov edx, 0xae8540
mov eax, dword [ebp - 0x14]
call fcn.004e481c
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add eax, 0xc
call fcn.00405240
mov edx, 0xae8554
mov eax, dword [ebp - 0x14]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
mov eax, dword [ebp - 0x18]
fistp qword [eax + 0x10]
wait
mov edx, 0xae8564
mov eax, dword [ebp - 0x14]
call fcn.004e481c
lea edx, [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add eax, 0x18
call fcn.00405240
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00ae8038
mov eax, dword [ebp - 0x14]
call fcn.004e5fbc
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0xa1], 0
je 0xae83c0
mov eax, dword [ebp - 0x14]
call fcn.004e35b0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x14]
call fcn.0040429c
mov eax, dword [ebp - 0x10]
call fcn.0040429c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xae84c3
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405210
ret