joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d820
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424d78]
jne 0x40d82a
repz ret
jmp fcn.004105ff

Function at 0x415b19
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424d78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411ee0
and dword [ebp - 0x14], 0
cmp dword [0x42707c], 0
mov dword [ebp - 0x18], eax
jne 0x415bcc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x415c74
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41fb4c
push ebx
call edi
test eax, eax
je 0x415c74
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42707c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427080], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427084], eax
call edi
push eax
call esi
mov dword [0x42708c], eax
test eax, eax
je 0x415bcc
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427088], eax
mov eax, dword [0x427088]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x415c25
cmp dword [0x42708c], ecx
je 0x415c25
push eax
call esi
push dword [0x42708c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x415c25
test ebx, ebx
je 0x415c25
call edi
test eax, eax
je 0x415c1c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x415c1c
test byte [ebp - 8], 1
jne 0x415c25
or dword [ebp + 0x10], 0x200000
jmp 0x415c58
mov eax, dword [0x427080]
cmp eax, dword [ebp - 0x18]
je 0x415c58
push eax
call esi
test eax, eax
je 0x415c58
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x415c58
mov eax, dword [0x427084]
cmp eax, dword [ebp - 0x18]
je 0x415c58
push eax
call esi
test eax, eax
je 0x415c58
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42707c]
call esi
test eax, eax
je 0x415c74
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x415c76
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d820
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x436935
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x436944
pop dword [ebp - 8]
mov eax, 0x436944
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x4fdca
push 0
mov eax, 0xa15feb67
sub eax, 0xa11b38ab
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x47e2
mov edi, eax
mov edx, 0x5eeb09e
sub edx, 0x5a6329e
add edx, dword [ebp - 8]
mov esi, 0xf0d02b9f
xor dword [ebp - 4], ebx
mov ebx, dword [edx]
add ebx, esi
add dword [ebp - 4], 0x1301e017
mov dword [edi], ebx
add edi, 4
add edx, 4
loop 0x436992
add eax, 0x1125b
mov ebx, eax
add eax, 0x8e4d4e73
sub eax, 0x8e4d4e6e
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x403520
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x45c2f4], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push bind
push 0
push bind
push 0xcf0000
push 0x45c2f8
push 0x45c290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x45c3a4], eax
cmp dword [0x45c3a4], 0
jne 0x40356d
xor eax, eax
jmp 0x4035d7
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x45c3a4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x45c3a4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x5dc
push 0x64
mov edx, dword [0x45c3a4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 4], 0xdbba00
push 0
mov eax, dword [ebp - 4]
push eax
push 0x65
mov ecx, dword [0x45c3a4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xea60
push 0x66
mov edx, dword [0x45c3a4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x405730
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a4], ecx
cmp dword [ebp + 0xc], 0x3e8
jle 0x405759
mov dword [ebp + 0xc], 0x3e8
mov dword [ebp - 0x19c], 0
jmp 0x405774
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
cmp ecx, dword [ebp + 0xc]
jge 0x405816
mov edx, dword [ebp - 0x19c]
shl edx, 5
mov eax, dword [ebp - 0x1a4]
mov byte [eax + edx + 0x1c], 0
mov ecx, dword [ebp - 0x19c]
shl ecx, 5
mov edx, dword [ebp - 0x1a4]
mov dword [edx + ecx + 8], 0xffffffff
mov eax, dword [ebp - 0x19c]
shl eax, 5
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + eax + 0x20], 0xffffffff
push 0x2006c
call fcn.00437162
add esp, 4
mov dword [ebp - 0x1a0], eax
mov edx, dword [ebp - 0x19c]
shl edx, 5
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a0]
mov dword [eax + edx + 0x24], ecx
push 0xf
push 0
mov edx, dword [ebp - 0x19c]
shl edx, 5
mov eax, dword [ebp - 0x1a4]
lea ecx, [eax + edx + 0xc]
push ecx
call fcn.00435470
add esp, 0xc
jmp 0x405765
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1a4]
call fcn.00405860
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret 8

Function at 0x405860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x7db4], ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x405a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x7db8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x7db8], 0
jne 0x4058c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateThread___failed_with_error__d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx]
call eax
add esp, 0xc
xor eax, eax
jmp 0x4058ca
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4058d0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ecx
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x7dbc], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x7dbc], 0xffffffff
jne 0x405932
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.WSASocket___failed_with_error__d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ecx]
call eax
add esp, 0xc
xor eax, eax
jmp 0x405a4d
mov ecx, 2
mov word [ebp - 0x18], cx
push 0
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x1c]
movzx eax, word [edx + 0x7db4]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x16], ax
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x7dbc]
push eax
call dword [sym.imp.WSOCK32.dll_bind]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4059c7
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.bind___failed_with_error__d
push 2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [edx + 4]
call ecx
add esp, 0x10
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x7db4]
push eax
push str.error_L3_:_cant_bind_port:__d
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00407370
add esp, 0xc
push 1
call fcn.0043584e
xor eax, eax
jmp 0x405a4d
push 5
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x7dbc]
push eax
call dword [sym.imp.WSOCK32.dll_listen]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x405a26
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.listen___failed_with_error__d
push 2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [edx + 4]
call ecx
add esp, 0x10
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.error_L3_:_listen___failed_with_error__d
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00407370
add esp, 0xc
push 1
call fcn.0043584e
xor eax, eax
jmp 0x405a4d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x7db4]
push ecx
push str.Server_Listen_OK._Port:__d
push 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [eax + 4]
call edx
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret
Function at 0x406c80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0xfa
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
call fcn.004061b0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 0x10038
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1002c], 0
jle 0x406cdb
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x7d08]
mov edx, dword [eax + 0xc]
call edx
xor eax, eax
jmp 0x406e5c
mov eax, dword [ebp - 8]
mov dword [eax + 0x10020], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x1001c], 0
jle 0x406d38
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1001c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x801c
push ecx
mov edx, dword [ebp - 8]
add edx, 0x1c
push edx
call fcn.004360a0
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1001c]
mov dword [eax + 0x10020], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x1001c], 0
jmp 0x406d56
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x7d08]
mov edx, dword [eax + 0xc]
call edx
xor eax, eax
jmp 0x406e5c
mov eax, dword [ebp - 8]
add eax, 0x1c
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10020]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 8]
mov dword [edx + 0x10024], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10028], 1
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
mov ecx, dword [ebp - 4]
shl ecx, 5
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x406e1e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x406e1c
mov ecx, dword [ebp - 4]
shl ecx, 5
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0xc]
push eax
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0x2dc
push str.WSASend__d__failed_with_error__d__s
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [edx]
call ecx
add esp, 0x14
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00407100
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x7d08]
mov eax, dword [edx + 0xc]
call eax
xor eax, eax
jmp 0x406e5c
jmp 0x406e33
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20068]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x20068], edx
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1002c], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x7d08]
mov edx, dword [eax + 0xc]
call edx
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x406e70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0xfa
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
call fcn.004061b0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 0x10038
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 0x10020]
sub edx, dword [ecx + 0x10024]
jns 0x406ed3
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x7d08]
mov eax, dword [edx + 0xc]
call eax
xor eax, eax
jmp 0x406fdf
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10024]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x1c]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 0x10020]
sub edx, dword [ecx + 0x10024]
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], edx
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10028], 1
push 0
mov edx, dword [ebp - 8]
push edx
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x14
push ecx
mov edx, dword [ebp - 4]
shl edx, 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx + 0x20]
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x406fa1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x406f9f
mov edx, dword [ebp - 4]
shl edx, 5
mov eax, dword [ebp - 0x10]
lea ecx, [eax + edx + 0xc]
push ecx
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0x306
push str.WSASend__d__failed_with_error__d__s
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax]
call edx
add esp, 0x14
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00407100
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x7d08]
mov edx, dword [eax + 0xc]
call edx
xor eax, eax
jmp 0x406fdf
jmp 0x406fb6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20068]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x20068], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x1002c], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x7d08
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x7d08]
mov edx, dword [eax + 0xc]
call edx
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4074f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x407535
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x407560
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x14
push 0
mov eax, dword [ebp - 8]
add eax, 0x28
push eax
call fcn.00435470
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
add eax, 0x44
push eax
call fcn.004360a0
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x848], edx
mov eax, dword [ebp - 8]
add eax, 0x44
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x848]
mov dword [edx + 0x3c], ecx
push 0
mov edx, dword [ebp - 8]
add edx, 0x28
push edx
push 0x10
mov eax, dword [ebp - 8]
add eax, 0x84c
push eax
push 0
lea ecx, [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp - 8]
add edx, 0x3c
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x407605
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x407605
or eax, 0xffffffff
jmp 0x40760a
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x408f60
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [ebp - 8], 0
xor eax, eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push 8
push 0x90
lea ecx, [ebp - 8]
call fcn.00408ff0
mov byte [ebp - 5], 1
push str.SELECT_ItemCount_FROM_GameServerInfo_WHERE_Number0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
push ecx
call fcn.00407950
add esp, 8
cmp eax, 1
jne 0x408fc9
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
push str.ItemCount
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407cf0
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
movzx edx, byte [ebp - 7]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406820
mov esp, ebp
pop ebp
ret
Function at 0x40cbe0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 0x78], 0
push 0x63
push 0
lea ecx, [ebp - 0x77]
push ecx
call fcn.00435470
add esp, 0xc
push 0xa
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.004360a0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.SELECT_Name_FROM_OptionData_WHERE_Name_s
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
cwde
cmp eax, 0x64
jne 0x40cccf
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 0x25]
push edx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 0x26]
push ecx
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 0x24]
push eax
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 0x23]
push edx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 0x22]
push ecx
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 0x21]
push eax
lea ecx, [ebp - 0x10]
push ecx
push str.INSERT_INTO_OptionData__Name__GameOption__Qkey__Wkey__Ekey__Rkey__ChatWindow__VALUES___s___d___d___d___d___d___d_
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0x24
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
jmp 0x40cd44
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 0x25]
push edx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 0x26]
push ecx
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 0x24]
push eax
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 0x23]
push edx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 0x22]
push ecx
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 0x21]
push eax
push str.UPDATE_OptionData_SET_GameOption_d__Qkey_d__Wkey_d__Ekey_d__Rkey_d__ChatWindow_d_WHERE_Name_s
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
push ecx
call fcn.00407950
add esp, 0x24
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
lea edx, [ebp - 0x10]
push edx
push str.UPDATE_OptionData_SET_SkillKey__where_Name_s
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x14
mov ecx, dword [ebp + 0x10]
add ecx, 0xd
push ecx
lea edx, [ebp - 0x78]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.004080c0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret
Function at 0x40ff10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x14
push 0xd3
lea ecx, [ebp - 0x1c]
call fcn.00408ff0
mov eax, dword [ebp + 0xc]
mov cx, word [eax + 0xe]
mov word [ebp - 0x18], cx
mov byte [ebp - 0x16], 1
mov byte [ebp - 0x15], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 0x1c]
mov byte [ebp - 0xc], cl
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 0x1d]
mov byte [ebp - 0xb], al
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp + 0xc]
add ecx, 3
push ecx
mov edx, dword [ebp + 8]
add edx, 0xf030
push edx
push str.SELECT_SCFExtInventory_FROM__s.dbo.Character_WHERE_Name___s
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
movsx ecx, ax
cmp ecx, 0x64
je 0x40ffd1
push str.SCFExtInventory
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407cf0
mov byte [ebp - 0x15], al
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x18], 0xcb
jg 0x40ffe6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0
jge 0x410014
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x1c]
test edx, edx
jne 0x410014
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x1d]
test ecx, ecx
jne 0x410014
mov byte [ebp - 0x16], 0
push 0x14
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406820
jmp 0x410085
movzx ecx, byte [ebp - 0x15]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x10]
add ecx, eax
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 1]
cmp ecx, 2
jg 0x41006f
mov dl, byte [ebp - 1]
mov byte [ebp - 0x15], dl
mov eax, dword [ebp + 0xc]
add eax, 3
push eax
movzx ecx, byte [ebp - 1]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xf030
push edx
push str.UPDATE__s.dbo.Character_SET_SCFExtInventory_d_WHERE_Name___s
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0x14
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
jmp 0x410073
mov byte [ebp - 0x16], 0
push 0x14
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406820
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret