joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403991
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
push 0x50000080
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403a64
mov eax, dword [ebx + 0x290]
push dword [esi + 0x464]
mov dword [esi + 0x460], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp + 8], edi
lea edi, [ebx + 0x29c]
push 0x14
push 9
push dword [esi + 0x468]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [edi - 4]
push 0x403fb3
mov dword [eax + 8], ecx
inc dword [esi]
push eax
mov dword [eax + 0x10], esi
push dword [edi]
push dword [esi + 0x47c]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x403a21
mov eax, esi
call fcn.00403746
dec dword [esi + 0x460]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add edi, 0xc
cmp eax, dword [ebx + 0x290]
jbe 0x4039de
jmp 0x403a52
push 1
push 0x1388
push dword [esi + 0x464]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x403a5b
cmp eax, 0x102
je 0x403a5b
cmp dword [esi + 0x460], 0
jg 0x403a34
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret 4

Function at 0x403a69
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
mov edi, eax
cmp dword [esi + 4], ebx
je 0x403a8f
lea eax, [esi + 0x35a]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x403b2e
mov esi, dword [esi + 0x478]
mov eax, esi
imul eax, eax, 0x64
push eax
lea eax, [esi + esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
je 0x403b25
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp dword [eax + 0x10c], ebx
jbe 0x403b25
lea ecx, [eax + 0x120]
mov dword [ebp + 0xc], ecx
mov ebx, dword [ecx - 4]
cmp ebx, dword [ecx]
ja 0x403b11
mov ecx, ebx
imul ecx, ecx, 0xc
lea esi, [ecx + eax + 0x29c]
mov edi, dword [esi - 8]
push dword [esi]
add edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov eax, dword [ebp + 0xc]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jbe 0x403ae8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
add ecx, 0x18
mov dword [ebp + 0xc], ecx
cmp edx, dword [eax + 0x10c]
jb 0x403ad5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404116
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x214]
push ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
je 0x404192
cmp dword [ebp - 0x214], ebx
jle 0x40418b
xor esi, esi
cmp dword [ebp - 0x214], ebx
jle 0x40418b
mov eax, dword [edi + esi*4]
push str._prefetch
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404181
inc esi
cmp esi, dword [ebp - 0x214]
jl 0x404163
jmp 0x40418b
mov dword [ebp - 0x218], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00406dd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x404233
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x484
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
je 0x40420a
lea ecx, [ebp - 0x210]
push ecx
mov esi, eax
call fcn.00403654
mov esi, eax
jmp 0x40420c
xor esi, esi
cmp esi, ebx
je 0x404233
cmp dword [esi + 0x10], 6
jae 0x404225
mov eax, dword [esi + 0x46c]
cmp eax, 0xffffffff
je 0x40422c
cmp eax, ebx
je 0x40422c
mov ecx, esi
call fcn.00403764
mov eax, esi
call fcn.00403746
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c0
leave
ret

Function at 0x404248
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x4042af
cmp dword [ebp - 4], edi
jle 0x4042a6
push ebx
push esi
mov eax, dword [ebp - 8]
mov ebx, dword [eax + edi*4]
mov esi, 0x413e60
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40429d
add esi, 4
cmp esi, 0x413e98
jl 0x40427d
inc edi
cmp edi, dword [ebp - 4]
jl 0x404272
jmp 0x4042a4
mov dword [ebp - 0xc], 1
pop esi
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xc]
pop edi
leave
ret

Function at 0x4042c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413054]
jne 0x4042ca
repz ret
jmp fcn.00404dee
Function at 0x40c5f9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040955f
and dword [ebp - 0x14], 0
cmp dword [0x414ccc], 0
mov dword [ebp - 0x18], eax
jne 0x40c6ac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c754
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40c754
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x414ccc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x414cd0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x414cd4], eax
call edi
push eax
call esi
mov dword [0x414cdc], eax
test eax, eax
je 0x40c6ac
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x414cd8], eax
mov eax, dword [0x414cd8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c705
cmp dword [0x414cdc], ecx
je 0x40c705
push eax
call esi
push dword [0x414cdc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c705
test ebx, ebx
je 0x40c705
call edi
test eax, eax
je 0x40c6fc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c6fc
test byte [ebp - 8], 1
jne 0x40c705
or dword [ebp + 0x10], 0x200000
jmp 0x40c738
mov eax, dword [0x414cd0]
cmp eax, dword [ebp - 0x18]
je 0x40c738
push eax
call esi
test eax, eax
je 0x40c738
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c738
mov eax, dword [0x414cd4]
cmp eax, dword [ebp - 0x18]
je 0x40c738
push eax
call esi
test eax, eax
je 0x40c738
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x414ccc]
call esi
test eax, eax
je 0x40c754
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c756
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c0
leave
ret
Function at 0x415b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x415b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415b78
mov eax, 1
add ebx, ebx
jne 0x415b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415b90
jne 0x415bac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415b90
xor ecx, ecx
sub eax, 3
jb 0x415bc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415c32
mov ebp, eax
add ebx, ebx
jne 0x415bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415bd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415bfc
inc ecx
add ebx, ebx
jne 0x415be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415bdd
jne 0x415bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415bdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415c1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415c0d
jmp 0x415b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415c1c
add edi, ecx
jmp 0x415b7e
pop esi
mov edi, esi
mov ecx, 0x3c3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415c3a
cmp byte [edi], 1
jne 0x415c3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x415c3f
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415cb7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1691c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x169d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415c6c
mov ecx, edi
jns 0x415c9b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x169d4]
or eax, eax
je 0x415cb1
mov dword [ebx], eax
add ebx, 4
jmp 0x415c89
call dword [esi + 0x169dc]
mov ebp, dword [esi + 0x169d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415ceb
sub esp, 0xffffff80
jmp 0x40a0e6
Function at 0x404060
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 4], 0
push 0x40b314
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406cb0
add esp, 0xc
test eax, eax
je 0x404091
mov eax, 1
jmp 0x404131
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 1
push 2
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x4040c8
movzx edx, word [ebp - 4]
cmp edx, 0xfffe
jne 0x4040c8
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x40412f
cmp dword [ebp - 8], 1
jne 0x4040e5
movzx ecx, word [ebp - 4]
cmp ecx, 0xfeff
jne 0x4040e5
mov edx, dword [ebp + 0x10]
mov dword [edx], 1
jmp 0x40412f
mov eax, dword [ebp + 0x10]
mov dword [eax], 3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCR71.dll_rewind]
add esp, 4
push 0x4000
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.MSVCR71.dll__setmode]
add esp, 8
cmp eax, 0xffffffff
jne 0x40412f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x404131
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405210
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], str.OSQLUSER
mov dword [ebp - 0xc], str.OSQLPASSWORD
mov dword [ebp - 8], str.OSQLSERVER
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x405247
cmp dword [ebp - 0x18], 1
je 0x405257
cmp dword [ebp - 0x18], 2
je 0x405267
jmp 0x405275
mov dword [ebp - 4], 0x40c800
mov dword [ebp - 0x14], 0x80
jmp 0x405275
mov dword [ebp - 4], 0x40c940
mov dword [ebp - 0x14], 0x80
jmp 0x405275
mov dword [ebp - 4], 0x40bd60
mov dword [ebp - 0x14], 0x3d
mov ecx, dword [ebp - 4]
mov word [ecx], 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + ecx*4 - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4052a0
xor eax, eax
jmp 0x4052c9
cmp dword [ebp + 8], 1
jne 0x4052c4
push 0x40b498
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR71.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4052c4
mov ecx, dword [ebp - 4]
mov word [ecx], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4057e0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0x40b554
push 0x40bfe0
lea eax, [ebp - 8]
push eax
call fcn.00406cb0
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x40583d
push 0x100
push 0x40bde0
push 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00406630
push 0x40bfe0
push 0x40bde0
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
jmp 0x405990
mov ecx, dword [0x40c908]
mov dword [ecx + 4], 0
mov word [0x40b024], 1
mov edx, dword [ebp - 8]
push edx
push 0x3e8
push 0x40ca60
call dword [sym.imp.MSVCR71.dll_fgetws]
add esp, 0xc
test eax, eax
je 0x405978
push 0xa
push 0x40ca60
call dword [sym.imp.MSVCR71.dll_wcschr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405893
mov eax, dword [ebp - 4]
mov word [eax], 0
cmp dword [0x40b020], 0
je 0x4058cf
movzx ecx, word [0x40b024]
mov dword [ebp - 0xc], ecx
mov dx, word [0x40b024]
add dx, 1
mov word [0x40b024], dx
mov eax, dword [ebp - 0xc]
push eax
push 0x40b558
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
mov dword [ebp - 0x10], eax
jmp 0x4058d6
mov dword [ebp - 0x10], 1
call fcn.00406800
test eax, eax
je 0x4058f4
push 0x40ca60
push str._s_r_n
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
jmp 0x405907
push 0x40ca60
push 0x40b570
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
push 0x40ca60
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
cmp eax, 0x3e7
je 0x40594d
cmp dword [0x40b960], 0
je 0x40593a
push 0x40b578
push 0x40ca60
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
jmp 0x40594d
push 0x40b57c
push 0x40ca60
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
push 0xfffffffffffffffd
push 0x40ca60
push 0x40c908
call fcn.00406140
add esp, 0xc
mov cx, word [0x40c58c]
add cx, 1
mov word [0x40c58c], cx
jmp 0x405853
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
push 0x40bfe0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x405c80
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7e0
mov eax, dword [0x40b938]
mov dword [ebp - 8], eax
push edi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCR71.dll_fflush]
add esp, 4
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
add ecx, 0x40
push ecx
call dword [sym.imp.MSVCR71.dll_fflush]
add esp, 4
push 0
push 0x405b80
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
cmp dword [0x40b960], 0
jne 0x405ce7
cmp dword [ebp + 8], 0xffffffff
jne 0x405ce7
cmp dword [0x40b9a0], 0x7f
je 0x405ce7
mov dword [ebp + 8], 1
jmp 0x405d12
cmp dword [0x40b960], 0
jne 0x405d12
cmp dword [0x40b9a0], 0x7f
jne 0x405d12
cmp dword [0x40b9a4], 0
jl 0x405d12
cmp dword [0x40b9a4], 0xa
jg 0x405d12
mov dword [ebp + 8], 0
cmp dword [ebp + 8], 0xffffffff
je 0x405dd9
cmp dword [0x40b9d0], 0
je 0x405dd9
movzx edx, word [0x40c600]
test edx, edx
je 0x405dd9
mov word [ebp - 0x7d8], 0
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x7d6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x7dc], 0
mov dword [ebp - 0x7e0], 0
push str.___call_master.dbo.sp_bindsession_NULL_
lea eax, [ebp - 0x7d8]
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
lea ecx, [ebp - 0x7e0]
push ecx
push 0
lea edx, [ebp - 0x7dc]
push edx
push 0
push 0
push 4
push 0xfffffffffffffff0
push 4
push 1
mov eax, dword [0x40b9d0]
push eax
call sub.ODBC32.dll_SQLBindParameter
mov word [ebp - 4], ax
push 0xfffffffffffffffd
lea ecx, [ebp - 0x7d8]
push ecx
mov edx, dword [0x40b9d0]
push edx
call sub.ODBC32.dll_SQLExecDirectW
mov word [ebp - 4], ax
movsx eax, word [ebp - 4]
cmp eax, 0xffffffff
jne 0x405dd9
mov ecx, dword [0x40b9d0]
push ecx
push 3
call fcn.00406250
add esp, 8
cmp dword [0x40b9d0], 0
je 0x405e0d
mov edx, dword [0x40b9d0]
push edx
call sub.ODBC32.dll_SQLCancel
mov word [ebp - 4], ax
mov eax, dword [0x40b9d0]
push eax
push 3
call sub.ODBC32.dll_SQLFreeHandle
mov word [ebp - 4], ax
mov dword [0x40b9d0], 0
cmp dword [0x40b9cc], 0
je 0x405e42
mov ecx, dword [0x40b9cc]
push ecx
call sub.ODBC32.dll_SQLDisconnect
mov word [ebp - 4], ax
mov edx, dword [0x40b9cc]
push edx
push 2
call sub.ODBC32.dll_SQLFreeHandle
mov word [ebp - 4], ax
mov dword [0x40b9cc], 0
cmp dword [0x40b9c8], 0
je 0x405e66
mov eax, dword [0x40b9c8]
push eax
push 1
call sub.ODBC32.dll_SQLFreeHandle
mov word [ebp - 4], ax
mov dword [0x40b9c8], 0
cmp dword [0x40b9e8], 0
je 0x405e86
mov ecx, dword [0x40b9ec]
cmp ecx, dword [0x40b9e8]
jl 0x405e86
mov edx, dword [0x40b9ec]
mov dword [ebp + 8], edx
cmp dword [0x40b9f0], 0
je 0x405ea8
mov eax, dword [0x40b9f0]
push eax
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov dword [0x40b9f0], 0
cmp dword [0x40c908], 0
je 0x405ecb
mov ecx, dword [0x40c908]
push ecx
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov dword [0x40c908], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x406880
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b938]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0x40b6d8
cmp dword [ebp + 0xc], 0
je 0x406992
cmp dword [ebp + 0x10], 1
jne 0x406992
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.MSVCR71.dll__wmktemp]
add esp, 4
push 0x40b6ec
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00406cb0
add esp, 0xc
cmp dword [ebp - 0x24], 0
jne 0x4068fc
mov eax, 0x80004005
jmp 0x4069a1
push 1
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.MSVCR71.dll__dup2]
add esp, 8
test eax, eax
jne 0x406920
mov ecx, dword [ebp + 8]
push ecx
call fcn.004069c0
add esp, 4
jmp 0x406927
mov dword [ebp - 0x20], 0x80004005
mov edx, dword [sym.imp.MSVCR71.dll__iob]
add edx, 0x20
push edx
call dword [sym.imp.MSVCR71.dll_fflush]
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 1
call fcn.00406a40
add esp, 0xc
mov dword [ebp - 0x20], eax
push 1
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.MSVCR71.dll__dup2]
add esp, 8
test eax, eax
je 0x40696c
mov dword [ebp - 0x20], 0x80004005
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x40ca44], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40699e
mov eax, dword [ebp + 8]
push eax
call fcn.004069c0
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
call fcn.004094e1
mov esp, ebp
pop ebp
ret

Function at 0x4069c0
Capabilities:
Execute command

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x40b938]
mov dword [ebp - 4], eax
cmp dword [0x40b9ac], 0
je 0x4069eb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR71.dll__wsystem]
add esp, 4
jmp 0x406a26
push 0x3e7
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x3f0]
push edx
call dword [sym.imp.MSVCR71.dll_wcstombs]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x406a12
mov byte [ebp - 0x3f0], 0
jmp 0x406a16
mov byte [ebp - 9], 0
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.MSVCR71.dll_system]
add esp, 4
mov ecx, dword [ebp - 4]
call fcn.004094e1
mov esp, ebp
pop ebp
ret
Function at 0x406a40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR71.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR71.dll_ftell]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jge 0x406a84
mov dword [ebp - 8], 0x80004005
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR71.dll_fseek]
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x406bfb
cmp dword [ebp - 8], 0x80004005
je 0x406bfb
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR71.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x406af6
push 0x1007
push 0x40b6f4
push 0x40b70c
call dword [sym.imp.MSVCR71.dll__assert]
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x406b2e
push 0x100a
push 0x40b724
push str.count__1
call dword [sym.imp.MSVCR71.dll__assert]
add esp, 0xc
mov eax, dword [ebp - 4]
shl eax, 1
push eax
call dword [sym.imp.MSVCR71.dll_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406b5e
push 0x100d
push 0x40b748
push str.NULL___lpWideCharStr
call dword [sym.imp.MSVCR71.dll__assert]
add esp, 0xc
mov edx, dword [ebp - 4]
shl edx, 1
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 2
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x18]
je 0x406bb9
push 0x1017
push 0x40b778
push str.count__cchWideCharStr
call dword [sym.imp.MSVCR71.dll__assert]
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x406bc6
mov dword [ebp - 8], 0x80004005
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCR71.dll_fflush]
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret