joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477e84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004774a4
xor eax, eax
push ebp
push 0x477f89
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x477ed4
call fcn.00404cd8
jmp 0x477f90
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x477f73
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x477f73
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004045b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x477f73
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0041143c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x477fc0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x523708]
mov dl, 1
mov eax, dword [0x4762c8]
call fcn.00411d6c
call fcn.00404c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477f90
mov eax, dword [ebp - 4]
call fcn.004774b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477fad
lea eax, [ebp - 0x28]
call fcn.004052dc
ret
Function at 0x47800c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478156
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004774a4
xor eax, eax
push ebp
push 0x478139
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x478071
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x478071
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x478123
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x478084
call fcn.00404cd8
jmp 0x478140
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x478123
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x478123
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004045b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x478123
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0041143c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x478170
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x523708]
mov dl, 1
mov eax, dword [0x4762c8]
call fcn.00411d6c
call fcn.00404c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478140
mov eax, dword [ebp - 4]
call fcn.004774b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47815d
lea eax, [ebp - 0x28]
call fcn.004052dc
ret
Function at 0x4797d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, eax
test esi, esi
jne 0x4797ea
mov eax, esi
call fcn.004797a8
mov edi, 1
jmp 0x4797f2
inc edi
cmp byte [esi + edi - 1], 0x20
je 0x4797f1
cmp byte [esi + edi - 1], 0x2d
jne 0x479807
mov eax, esi
call fcn.004797a8
cmp byte [esi + edi - 1], 0x2b
jne 0x47980f
inc edi
cmp byte [esi + edi - 1], 0x24
je 0x479832
cmp byte [esi + edi - 1], 0x30
jne 0x4798ec
movzx eax, byte [esi + edi]
call fcn.004035b4
cmp al, 0x58
jne 0x4798ec
cmp byte [esi + edi - 1], 0x30
jne 0x47983a
inc edi
inc edi
cmp byte [esi + edi - 1], 0
jne 0x479849
mov eax, esi
call fcn.004797a8
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x4798dd
mov eax, ebx
add al, 0xd0
sub al, 0xa
jb 0x479874
add al, 0xf9
sub al, 6
jb 0x47987f
add al, 0xe6
sub al, 6
jb 0x47988a
jmp 0x479895
movzx eax, bl
sub eax, 0x30
mov dword [ebp - 0x1c], eax
jmp 0x47989c
movzx eax, bl
sub eax, 0x37
mov dword [ebp - 0x1c], eax
jmp 0x47989c
movzx eax, bl
sub eax, 0x57
mov dword [ebp - 0x1c], eax
jmp 0x47989c
mov eax, esi
call fcn.004797a8
mov eax, dword [ebp - 0x14]
shr eax, 0x1c
xor edx, edx
cmp edx, 0
jne 0x4798b0
cmp eax, 0
jbe 0x4798b9
jmp 0x4798b2
jle 0x4798b9
mov eax, esi
call fcn.004797a8
mov eax, dword [ebp - 0x1c]
cdq
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 4
shl eax, 4
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc edi
movzx ebx, byte [esi + edi - 1]
test bl, bl
jne 0x47985e
jmp 0x479964
cmp byte [esi + edi - 1], 0
jne 0x4798fa
mov eax, esi
call fcn.004797a8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x47994f
xor bl, 0x30
movzx eax, bl
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 0xa
mul ecx
or edx, edx
jne 0x479937
mov esi, eax
mov eax, dword [ebp - 8]
mul ecx
add edx, esi
add eax, dword [ebp - 0xc]
adc edx, 0
jb 0x479937
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
jmp 0x47993e
mov dword [ebp - 0xc], 0x29a
pop esi
mov eax, dword [ebp - 0xc]
sub eax, 0xa
jb 0x47994e
mov eax, esi
call fcn.004797a8
inc edi
movzx ebx, byte [esi + edi - 1]
test bl, bl
jne 0x479906
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c6fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test ecx, ecx
jle 0x49c726
mov ebx, eax
shl ebx, 3
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
movzx ebx, byte [ebx + 0x517b7c]
xor eax, ebx
dec ecx
test ecx, ecx
jg 0x49c70c
pop ebx
pop ebp
ret
Function at 0x4fe354
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
cmp dword [ebp + 0x18], 0
je 0x4fe3d6
mov edx, dword [ebx + 0x10]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push str.CREATE_TABLE___w_.__w_node__nodeno_INTEGER_PRIMARY_KEY__data_BLOB__CREATE_TABLE___w_.__w_rowid__rowid_INTEGER_PRIMARY_KEY__nodeno_INTEGER__CREATE_TABLE___w_.__w_parent__nodeno_INTEGER_PRIMARY_KEY__parentnode_INTEGER__INSERT_INTO__q._q_node_VALUES_1__zeroblob__d__
call fcn.0049aac8
add esp, 0x28
mov edi, eax
test edi, edi
jne 0x4fe3af
mov eax, 7
jmp 0x4fe48f
push 0
push 0
push 0
push edi
mov edx, dword [ebp + 0xc]
push edx
call fcn.004d0bb4
add esp, 0x14
mov esi, eax
push edi
call fcn.004993e4
pop ecx
test esi, esi
je 0x4fe3d6
mov eax, esi
jmp 0x4fe48f
lea edx, [ebx + 0x234]
lea ecx, [ebx + 0x238]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
lea ecx, [ebx + 0x23c]
lea eax, [ebx + 0x240]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
lea edx, [ebx + 0x244]
lea ecx, [ebx + 0x248]
mov dword [ebp - 0x1c], edx
lea eax, [ebx + 0x24c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
lea edx, [ebx + 0x250]
add ebx, 0x254
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
xor eax, eax
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov edi, 0x51c684
jmp 0x4fe483
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0049aac8
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fe46d
push 0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push edx
push 0xffffffffffffffff
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004d518c
add esp, 0x14
mov esi, eax
jmp 0x4fe472
mov esi, 7
push ebx
call fcn.004993e4
pop ecx
inc dword [ebp - 4]
add dword [ebp - 8], 4
add edi, 4
cmp dword [ebp - 4], 9
jge 0x4fe48d
test esi, esi
je 0x4fe439
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fe4f8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
je 0x4fe578
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebx + 0x20]
push edx
push str.PRAGMA__Q.page_size
call fcn.0049aac8
add esp, 8
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 8]
push edx
call fcn.004fe498
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x4fe559
mov eax, dword [ebp - 4]
add eax, 0xffffffc0
mov dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x18]
mov ecx, edx
shl edx, 4
add edx, ecx
lea edx, [edx + edx*2]
add edx, 4
cmp eax, edx
jle 0x4fe5c3
mov dword [ebx + 0x10], edx
jmp 0x4fe5c3
mov eax, dword [ebp + 8]
push eax
call fcn.004e9634
pop ecx
push eax
push 0x522e08
call fcn.0049aac8
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
jmp 0x4fe5c3
mov ecx, dword [ebx + 0x24]
push ecx
mov ecx, dword [ebx + 0x20]
push ecx
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.0049aac8
add esp, 0xc
mov edi, eax
add ebx, 0x10
push ebx
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004fe498
add esp, 0xc
mov esi, eax
test esi, esi
je 0x4fe5c3
mov eax, dword [ebp + 8]
push eax
call fcn.004e9634
pop ecx
push eax
push 0x522e44
call fcn.0049aac8
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push edi
call fcn.004993e4
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4febd8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x500d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x523240], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x500df2
cmp dword [0x52323c], 0
jne 0x500df2
cmp dword [0x5232c8], 0
je 0x500dac
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00501934
add esp, 8
mov ebx, eax
test eax, eax
jne 0x500d92
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00501934
add esp, 8
mov ebx, eax
test eax, eax
jne 0x500d92
lea ebx, [ebp - 0x84]
jmp 0x500d93
inc ebx
call fcn.00500cd0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x500e2d
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x523244
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004fff6c
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x523247
push ebx
call sub.kernel32.dll_WriteFile_1
jmp 0x500e2d
cmp dword [0x52323c], 0
je 0x500e0c
cmp dword [0x52323c], 0xffffffff
je 0x500e2d
push esi
call dword [0x52323c]
pop ecx
mov eax, dword [0x523240]
test eax, eax
je 0x500e2d
cmp dword [0x523240], 0xffffffff
je 0x500e2d
cmp byte [eax], 0
je 0x500e2d
push esi
push eax
call fcn.005019dc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x501870
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x5019dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
test eax, eax
jne 0x501a09
jmp 0x501a40
call fcn.0050198c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004fff6c
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004fff6c
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x501f0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov ebp, eax
mov esi, 2
mov byte [esp + 5], 0
mov dword [esp + 8], ecx
mov byte [esp + 6], 0xeb
mov byte [esp + 7], 0x3b
mov edi, dword [esp]
dec edi
test edi, edi
jl 0x501fcf
inc edi
movzx eax, byte [ebp]
xor al, byte [esp + 6]
inc ebp
cmp esi, 6
jne 0x501f7f
mov edx, eax
and dl, 0x3f
movzx edx, dl
movzx ebx, byte [esp + 7]
add edx, ebx
mov byte [ecx], dl
inc ecx
movzx eax, al
shr eax, 2
and al, 0x30
or byte [esp + 5], al
movzx eax, byte [esp + 5]
movzx edx, byte [esp + 7]
add eax, edx
mov byte [ecx], al
inc ecx
mov byte [esp + 5], 0
jmp 0x501fb9
movzx edx, al
shr edx, 2
mov byte [esp + 4], dl
movzx edx, byte [esp + 4]
and dl, 0x3c
and al, 3
or dl, al
movzx eax, dl
movzx edx, byte [esp + 7]
add eax, edx
mov byte [ecx], al
inc ecx
movzx eax, byte [esp + 5]
add eax, eax
add eax, eax
movzx edx, byte [esp + 4]
and dl, 3
or al, dl
mov byte [esp + 5], al
mov eax, esi
mov ebx, 6
cdq
idiv ebx
add edx, 2
mov esi, edx
dec edi
jne 0x501f3d
cmp esi, 2
je 0x501fe3
movzx eax, byte [esp + 5]
movzx edx, byte [esp + 7]
add eax, edx
mov byte [ecx], al
inc ecx
mov eax, ecx
sub eax, dword [esp + 8]
mov byte [ecx], 0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x501ff4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
mov dword [esp + 0x10], edi
mov eax, dword [esp]
test eax, eax
jns 0x502010
add eax, 3
sar eax, 2
mov edx, dword [esp]
and edx, 0x80000003
jns 0x502023
dec edx
or edx, 0xfffffffc
inc edx
mov dword [esp + 4], edx
mov byte [esp + 0xd], 0xeb
mov dl, 0x3b
dec eax
test eax, eax
jl 0x5020dd
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 8]
add esi, esi
add esi, esi
lea eax, [esi + ebp]
add eax, 3
movzx eax, byte [eax]
sub al, dl
mov byte [esp + 0xc], al
lea eax, [esi + ebp]
movzx eax, byte [eax]
sub al, dl
mov ecx, eax
add ecx, ecx
add ecx, ecx
and cl, 0xf0
movzx ebx, byte [esp + 0xc]
and bl, 0xc
or cl, bl
and al, 3
or cl, al
mov eax, ecx
xor al, byte [esp + 0xd]
mov byte [edi], al
inc edi
lea eax, [esi + ebp]
inc eax
movzx eax, byte [eax]
sub al, dl
mov ecx, eax
add ecx, ecx
add ecx, ecx
and cl, 0xf0
movzx ebx, byte [esp + 0xc]
add ebx, ebx
add ebx, ebx
and bl, 0xc
or cl, bl
and al, 3
or cl, al
mov eax, ecx
xor al, byte [esp + 0xd]
mov byte [edi], al
inc edi
add esi, ebp
add esi, 2
movzx eax, byte [esi]
sub al, dl
movzx ecx, byte [esp + 0xc]
add ecx, ecx
add ecx, ecx
and cl, 0xc0
or al, cl
xor al, byte [esp + 0xd]
mov byte [edi], al
inc edi
inc dword [esp + 8]
dec dword [esp + 0x14]
jne 0x502044
cmp dword [esp + 4], 2
jne 0x502123
mov eax, dword [esp]
add eax, ebp
mov ecx, eax
dec ecx
movzx ecx, byte [ecx]
sub cl, dl
mov byte [esp + 0xc], cl
sub eax, 2
movzx eax, byte [eax]
sub al, dl
mov edx, eax
add edx, edx
add edx, edx
and dl, 0xf0
movzx ecx, byte [esp + 0xc]
add ecx, ecx
add ecx, ecx
and cl, 0xc
or dl, cl
and al, 3
or dl, al
mov eax, edx
xor al, byte [esp + 0xd]
mov byte [edi], al
inc edi
jmp 0x502191
cmp dword [esp + 4], 3
jne 0x502191
mov esi, dword [esp]
add esi, ebp
mov eax, esi
dec eax
movzx eax, byte [eax]
sub al, dl
mov byte [esp + 0xc], al
mov eax, esi
sub eax, 3
movzx eax, byte [eax]
sub al, dl
mov ecx, eax
add ecx, ecx
add ecx, ecx
and cl, 0xf0
movzx ebx, byte [esp + 0xc]
and bl, 0xc
or cl, bl
and al, 3
or cl, al
mov eax, ecx
xor al, byte [esp + 0xd]
mov byte [edi], al
inc edi
sub esi, 2
movzx eax, byte [esi]
sub al, dl
mov edx, eax
add edx, edx
add edx, edx
and dl, 0xf0
movzx ecx, byte [esp + 0xc]
add ecx, ecx
add ecx, ecx
and cl, 0xc
or dl, cl
and al, 3
or dl, al
mov eax, edx
xor al, byte [esp + 0xd]
mov byte [edi], al
inc edi
mov eax, edi
sub eax, dword [esp + 0x10]
mov byte [edi], 0
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5036f4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5038b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x503891
cmp dword [eax + 0x3c], 0
jne 0x503743
mov byte [eax + 0x1a4], 0
jmp 0x503891
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, 0x64
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0x19], 0
xor edx, edx
push ebp
push 0x503812
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x15
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 4
lea edx, [ebp - 0x28]
xor ecx, ecx
mov eax, 0x5038d0
call fcn.0040f0f4
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040db08
mov eax, dword [ebp - 0x2c]
mov edx, 0x503940
call fcn.0047a168
dec eax
jle 0x5037b2
call fcn.00404cd8
jmp 0x503891
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00494d64
cmp dword [ebp - 0x20], 0
je 0x5037f9
cmp eax, 0x65
je 0x5037f9
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00495924
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00495918
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x114], eax
mov byte [ebp - 0x19], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503819
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00495004
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5038c0
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00405300
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405300
ret
Function at 0x503990
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x503998
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x503c92
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x25], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x503c6a
cmp dword [eax + 0x3c], 0
jne 0x5039d7
mov byte [eax + 0x1a4], 0
jmp 0x503c6a
mov byte [ebp - 0x25], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, 0x64
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0x2d], 0
xor edx, edx
push ebp
push 0x503af1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x15
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 4
lea edx, [ebp - 0x3c]
xor ecx, ecx
mov eax, 0x503cac
call fcn.0040f0f4
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
call fcn.0040db08
mov eax, dword [ebp - 0x40]
mov edx, 0x503d44
call fcn.0047a168
dec eax
jle 0x503a46
call fcn.00404cd8
jmp 0x503c6a
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.00494d64
cmp dword [ebp - 0x34], 0
je 0x503ad8
cmp eax, 0x65
je 0x503ad8
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495924
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495924
lea eax, [ebp - 0xc]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495924
lea eax, [ebp - 0x10]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495924
lea eax, [ebp - 0x14]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495924
lea eax, [ebp - 0x18]
push eax
mov ecx, 5
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495924
mov byte [ebp - 0x2d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503af8
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x20]
call fcn.00495004
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503c99
lea eax, [ebp - 0x58]
mov edx, 7
call fcn.00405300
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405300
ret
Function at 0x503d48
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x503f74
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x503f44
cmp dword [eax + 0x3c], 0
jne 0x503d9a
mov byte [eax + 0x1a4], 0
jmp 0x503f44
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
add eax, 0x64
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 8]
call fcn.00405374
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0x1d], 0
xor edx, edx
push ebp
push 0x503e5e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0x15
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 4
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x503f8c
call fcn.0040f0f4
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.0040db08
mov eax, dword [ebp - 0x30]
mov edx, 0x503fec
call fcn.0047a168
dec eax
jle 0x503e17
call fcn.00404cd8
jmp 0x503f44
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00494d64
cmp dword [ebp - 0x24], 0
je 0x503e45
cmp eax, 0x65
je 0x503e45
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00495924
mov byte [ebp - 0x1d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503e65
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00495004
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503f7b
lea eax, [ebp - 0x48]
call fcn.004052dc
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00405300
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405300
ret