joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403190
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x407870
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x4031b7
add eax, 8
inc ecx
cmp eax, 0x4078f8
jb 0x4031a8
cmp dword [ecx*8 + 0x407870], edx
lea ebx, [ecx*8]
jne 0x403372
cmp dword [0x4073dc], 1
je 0x403337
cmp dword [0x4073dc], 0
jne 0x4031ee
cmp dword [0x4073e0], 1
je 0x403337
cmp edx, 0xfc
je 0x403372
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40322b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x40326f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4062c0
push ebp
call fcn.00403fb0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4062a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x407874]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00403f10
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x408260]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x40334e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x407874]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x404ea0
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10c
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x404f29
lea eax, [esp + 4]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x404f29
cmp byte [esp + 4], 0x5c
je 0x404ed7
cmp byte [esp + 4], 0x2f
jne 0x404eea
mov al, byte [esp + 5]
cmp byte [esp + 4], al
jne 0x404eea
xor eax, eax
add esp, 0x10c
ret
mov byte [esp], 0x3d
xor eax, eax
mov al, byte [esp + 4]
push eax
call fcn.004051b0
lea ecx, [esp + 8]
mov byte [esp + 5], al
mov byte [esp + 6], 0x3a
mov byte [esp + 7], 0
lea edx, [esp + 4]
add esp, 4
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x404f29
xor eax, eax
add esp, 0x10c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402060
add esp, 4
mov eax, 0xffffffff
add esp, 0x10c
ret

Function at 0x404f70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
test ebx, ebx
je 0x404fe3
push ebx
call fcn.004050a0
add esp, 4
test eax, eax
jne 0x404fb1
xor eax, eax
pop edi
mov dword [0x4073e8], 0xf
mov dword [0x4073e4], 0xd
pop esi
pop ebx
add esp, 0x10c
ret
add bl, 0x40
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea ecx, [esp + 0x18]
lea ebx, [esp + 0x10]
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x404ff3
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x405092
inc eax
cmp eax, 0x104
ja 0x405092
mov edx, dword [esp + 0x120]
test edx, edx
jne 0x405044
mov ecx, dword [esp + 0x124]
cmp eax, ecx
jg 0x40501f
mov eax, ecx
push eax
call fcn.00403e10
add esp, 4
mov edx, eax
test edx, edx
jne 0x405063
xor eax, eax
pop edi
mov dword [0x4073e4], 0xc
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, dword [esp + 0x124]
jle 0x405063
xor eax, eax
pop edi
mov dword [0x4073e4], 0x22
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x4050a0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
test eax, eax
jne 0x4050b4
mov eax, 1
add esp, 4
ret
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
add al, 0x40
mov byte [esp], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x4050e6
cmp eax, 1
je 0x4050e6
mov eax, 1
add esp, 4
ret
xor eax, eax
add esp, 4
ret
Function at 0x7813480f
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
push ebx
mov ebp, str.__MSVCRT_HEAP_SELECT
push ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x78134961
push esi
push ebx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x7813495f
push esi
push ebx
push ebp
call edi
test eax, eax
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
jbe 0x78134953
cmp eax, esi
ja 0x78134953
cmp byte [ebx], 0
mov ecx, ebx
je 0x78134889
mov al, byte [ecx]
cmp al, 0x61
jl 0x78134883
cmp al, 0x7a
jg 0x78134883
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x78134875
push 0x16
push ebx
push str.__GLOBAL_HEAP_SELECTED
call fcn.7813b158
add esp, 0xc
test eax, eax
jne 0x781348a1
mov edi, ebx
jmp 0x781348fc
push 0x105
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78134953
push 3
push esi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov ecx, esi
je 0x781348e5
mov al, byte [ecx]
cmp al, 0x61
jl 0x781348df
cmp al, 0x7a
jg 0x781348df
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x781348d1
push esi
push ebx
call sym.MSVCR80.dll_strstr
pop ecx
pop ecx
push esi
push 0
mov edi, eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
test edi, edi
je 0x78134953
push 0x2c
push edi
call sym.MSVCR80.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x78134953
inc eax
cmp byte [eax], 0x20
je 0x7813490e
mov cl, byte [eax]
xor esi, esi
cmp cl, 0x30
jl 0x78134953
cmp cl, 0x39
jg 0x78134934
imul esi, esi, 0xa
movsx ecx, cl
inc eax
lea esi, [esi + ecx - 0x30]
mov cl, byte [eax]
cmp cl, 0x30
jge 0x7813491d
cmp esi, 2
je 0x78134943
cmp esi, 3
je 0x78134943
cmp esi, 1
jne 0x78134953
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov eax, esi
jmp 0x781349c1
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
je 0x7813497d
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x78134999
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [esp + 0x10], 2
jne 0x781349ac
cmp dword [esp + 0x14], 5
jb 0x781349ac
xor eax, eax
inc eax
jmp 0x781349c1
lea eax, [esp + 0x18]
push eax
call fcn.781347e2
cmp byte [esp + 0x1c], 6
pop ecx
sbb eax, eax
add eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x78138894
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.MSVCR80.dll__invalid_parameter

Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure
Function at 0x7813b158
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x7813b167
pop dword [ebp - 0x30]
mov eax, 0xfa1fa51e
add eax, 0x7df40c49
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x45ab7
push 0
mov eax, 0x13ecb5b3
sub eax, 0x9bd374f3
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x6e4f26d1
sub ecx, 0x6e4ed14f
mov esi, eax
mov edi, 0x781cb000
add edi, dword [ebp - 0x30]
mov ebx, 0x8d271a7
add ebx, 0x11913964
mov dword [ebp - 0x2c], 0x14de2fe1
mov edx, dword [edi]
mov dword [ebp - 0x2c], 0x8b3ee93e
xor edx, ebx
mov dword [ebp - 0x24], 0x244bfa52
mov dword [esi], edx
xor dword [ebp - 0x18], 0x334519bc
add esi, 4
add edi, 0x629b18ca
add edi, 0x9d64e73a
loop 0x7813b1c0
add eax, 0x148db
xor ebx, ebx
add ebx, eax
add eax, 0x93a4222c
sub eax, 0x93a42227
mov ecx, 0x78130000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7813b158
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7813b158
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret
Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7813b158
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret

Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7813b158
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret
Function at 0x4058d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x439008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x428], edx
push esi
push edi
mov dword [ebp - 0x424], eax
lea esi, [eax + 8]
push esi
push str.SELECT_GUID_FROM_T_FriendMain_WHERE_Name_s
push 0x439d58
call fcn.004112b0
mov ebx, dword [sym.imp.ODBC32.dll_SQLFetch]
add esp, 0xc
push dword [0x439d64]
call ebx
push str.GUID
call fcn.00411500
cmp eax, 0xffffffff
jne 0x40592b
or edi, eax
jmp 0x40593e
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
mov edi, eax
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov ecx, dword [ebp - 0x424]
movq xmm0, qword [esi]
push edi
mov dword [ebp - 0x420], 0x721204c2
movzx eax, word [ecx + 4]
mov word [ebp - 0x41c], ax
movzx eax, word [esi + 8]
mov word [ebp - 0x412], ax
mov al, byte [esi + 0xa]
mov byte [ebp - 0x410], al
movzx eax, word [ecx + 6]
push eax
push str.SELECT_Memo_Photo_Dir_Act_FROM_T_FriendMail_WHERE_MemoIndex_d_AND_GUID_d
push 0x439d58
movq qword [ebp - 0x41a], xmm0
mov word [ebp - 0x40e], ax
call fcn.004112b0
add esp, 0x10
push dword [0x439d64]
call ebx
push 0x12
lea eax, [ebp - 0x40a]
push eax
push str.Photo
call fcn.00411550
push 0x433924
call fcn.00411500
cmp eax, 0xffffffff
jne 0x4059e0
or eax, eax
jmp 0x4059f1
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push 0x433928
mov byte [ebp - 0x3f8], al
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405a0a
or eax, eax
jmp 0x405a1b
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
mov byte [ebp - 0x3f7], al
lea eax, [ebp - 0x3f6]
push 0x3e8
push eax
push str.Memo
call fcn.00411550
lea ecx, [ebp - 0x3f6]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405a40
push dword [0x439d64]
mov esi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
sub ecx, edx
mov word [ebp - 0x40c], cx
call esi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x439d64]
call ebx
mov eax, dword [ebp - 0x424]
push edi
movzx eax, word [eax + 6]
push eax
push str.UPDATE_T_FriendMail_SET_bRead1_WHERE_MemoIndex_d_AND_GUID_d
push 0x439d58
call fcn.004112b0
add esp, 0x10
push dword [0x439d64]
call esi
push 2
push dword [0x439d64]
call ebx
mov ecx, dword [ebp - 0x428]
lea edx, [ebp - 0x420]
push 0x412
call fcn.004046d0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00414177
mov esp, ebp
pop ebp
ret
Function at 0x405ad0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x439008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 0x25], dl
push edi
push str.SELECT_GUID_FROM_T_FriendMain_WHERE_Name_s
push 0x439d58
call fcn.004112b0
add esp, 0xc
test al, al
je 0x405cc7
push dword [0x439d64]
mov ebx, dword [sym.imp.ODBC32.dll_SQLFetch]
call ebx
cmp ax, 0x64
je 0x405cc7
push str.GUID
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405b2e
or esi, eax
jmp 0x405b41
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
mov esi, eax
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 0
push esi
push str.SELECT_FriendName_Del_FROM_T_FriendList_WHERE_GUID_d
push 0x439d58
call fcn.004112b0
add esp, 0x10
test al, al
je 0x405cc7
push dword [0x439d64]
call ebx
cmp ax, 0x64
je 0x405cc7
nop word [eax + eax]
push str.FriendName
mov word [ebp - 0x24], 0x1ec1
mov byte [ebp - 0x22], 0x62
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405bbd
xorps xmm0, xmm0
mov word [ebp - 0x16], 0
movq qword [ebp - 0x1e], xmm0
mov byte [ebp - 0x14], 0
jmp 0x405bd6
shl eax, 0xd
push 0xa
add eax, 0x43b53e
push eax
lea eax, [ebp - 0x1e]
push 0xb
push eax
call fcn.0041d9ba
add esp, 0x10
lea eax, [ebp - 0x1e]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00403270
test al, al
je 0x405cb5
cmp byte [ebp - 0x25], 0
movzx eax, word [ebp - 0x2e]
movq xmm0, qword [edi]
mov word [ebp - 0x20], ax
movzx eax, word [edi + 8]
mov word [ebp - 0xb], ax
mov al, byte [edi + 0xa]
movq qword [ebp - 0x13], xmm0
mov byte [ebp - 9], al
jne 0x405c53
push 0x433744
call fcn.00411500
cmp eax, 0xffffffff
je 0x405c53
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
test eax, eax
jne 0x405c53
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00403270
test al, al
mov eax, 0xffff
je 0x405c4e
movzx eax, word [ebp - 0x48]
mov byte [ebp - 8], al
jmp 0x405c57
mov byte [ebp - 8], 0xff
mov si, word [ebp - 0x2c]
xor edx, edx
xor eax, eax
nop
mov ecx, dword [eax + 0x5cd7c4]
test ecx, ecx
js 0x405c8a
cmp ecx, 0x14
jge 0x405c8a
cmp dword [eax + 0x5cd7c8], 0
je 0x405c8a
cmp dword [eax + 0x5cd7dc], 0xffffffff
je 0x405c8a
cmp word [eax + 0x5cd81c], si
je 0x405c97
add eax, 0x68
inc edx
cmp eax, 0x820
jl 0x405c60
jmp 0x405cb5
imul ecx, edx, 0x68
add ecx, 0x5cd7c0
je 0x405cb5
movzx eax, byte [ebp - 0x23]
lea edx, [ebp - 0x24]
mov ecx, dword [ecx + 4]
push eax
call fcn.004046d0
add esp, 4
push dword [0x439d64]
call ebx
cmp ax, 0x64
jne 0x405b90
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414177
mov esp, ebp
pop ebp
ret
Function at 0x405d00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x439008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push edx
push str.SELECT_MemoIndex_FriendName_wDate_Subject_bRead_FROM_T_FriendMail_WHERE_GUID_d
push 0x439d58
mov dword [ebp - 0x6c], ecx
call fcn.004112b0
add esp, 0xc
test al, al
je 0x405e97
push dword [0x439d64]
mov ebx, dword [sym.imp.ODBC32.dll_SQLFetch]
call ebx
cmp ax, 0x64
je 0x405e97
mov di, word [ebp + 8]
push str.MemoIndex
mov dword [ebp - 0x68], 0x715e00c2
mov word [ebp - 0x64], di
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405d6e
or eax, eax
jmp 0x405d7f
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push str.FriendName
mov word [ebp - 0x62], ax
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405da6
xorps xmm0, xmm0
mov word [ebp - 0x58], 0
movq qword [ebp - 0x60], xmm0
mov byte [ebp - 0x56], 0
jmp 0x405dbf
shl eax, 0xd
push 0xa
add eax, 0x43b53e
push eax
lea eax, [ebp - 0x60]
push 0xb
push eax
call fcn.0041d9ba
add esp, 0x10
mov ax, word [esi + 8]
movq xmm0, qword [esi]
mov word [ebp - 0x4d], ax
mov al, byte [esi + 0xa]
push str.wDate
movq qword [ebp - 0x55], xmm0
mov byte [ebp - 0x4b], al
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405e00
xorps xmm0, xmm0
mov dword [ebp - 0x32], 0
movups xmmword [ebp - 0x4a], xmm0
mov word [ebp - 0x2e], 0
movq qword [ebp - 0x3a], xmm0
jmp 0x405e19
shl eax, 0xd
push 0x1d
add eax, 0x43b53e
push eax
lea eax, [ebp - 0x4a]
push 0x1e
push eax
call fcn.0041d9ba
add esp, 0x10
push str.Subject
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405e35
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
jmp 0x405e4e
shl eax, 0xd
push 0x1f
add eax, 0x43b53e
push eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.0041d9ba
add esp, 0x10
push str.bRead
call fcn.00411500
cmp eax, 0xffffffff
jne 0x405e61
or eax, eax
jmp 0x405e72
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
mov ecx, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
push 0x5e
mov byte [ebp - 0xc], al
call fcn.004046d0
add esp, 4
push dword [0x439d64]
call ebx
cmp ax, 0x64
jne 0x405d50
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414177
mov esp, ebp
pop ebp
ret
Function at 0x40bd80
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x439008]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ecx + 4]
movq xmm0, qword [ecx + 6]
mov word [ebp - 0x2c], ax
movzx eax, word [ecx + 0xe]
mov word [ebp - 0x22], ax
mov al, byte [ecx + 0x10]
add ecx, 0x11
push ebx
push esi
mov byte [ebp - 0x20], al
mov esi, edx
movzx eax, word [ecx + 8]
mov bl, 0x2c
push ecx
movq qword [ebp - 0x2a], xmm0
movq xmm0, qword [ecx]
mov word [ebp - 0x17], ax
mov al, byte [ecx + 0xa]
push str.SELECT__FROM_OptionData_WHERE_Name_s
push 0x439d58
mov word [ebp - 0x30], 0x2cc1
mov byte [ebp - 0x2e], 8
movq qword [ebp - 0x1f], xmm0
mov byte [ebp - 0x15], al
call fcn.004112b0
add esp, 0xc
test al, al
je 0x40befd
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40befd
push 0xa
lea eax, [ebp - 0x14]
push eax
push str.SkillKey
call fcn.00411550
push str.GameOption
call fcn.00411500
cmp eax, 0xffffffff
jne 0x40be2e
or eax, eax
jmp 0x40be3f
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push str.Qkey
mov byte [ebp - 0xa], al
call fcn.00411500
cmp eax, 0xffffffff
jne 0x40be55
or eax, eax
jmp 0x40be66
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push str.Wkey
mov byte [ebp - 9], al
call fcn.00411500
cmp eax, 0xffffffff
jne 0x40be7c
or eax, eax
jmp 0x40be8d
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push str.Ekey
mov byte [ebp - 8], al
call fcn.00411500
cmp eax, 0xffffffff
jne 0x40bea3
or eax, eax
jmp 0x40beb4
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push str.ChatWindow
mov byte [ebp - 7], al
call fcn.00411500
cmp eax, 0xffffffff
jne 0x40beca
or eax, eax
jmp 0x40bedb
shl eax, 0xd
add eax, 0x43b53e
push eax
call fcn.0041a6da
add esp, 4
push dword [0x439d64]
mov byte [ebp - 6], al
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov bl, byte [ebp - 0x2f]
jmp 0x40bf2f
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x439d64]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
or eax, 0xffffffff
mov dword [ebp - 0xa], 0xffffff15
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov word [ebp - 0xc], ax
mov byte [ebp - 6], 0xf
movzx eax, bl
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.00412cb0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00414177
mov esp, ebp
pop ebp
ret