joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411e70
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0x24
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
mov ebx, 1
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
call fcn.0056c7a0
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
test ebx, ebx
jne 0x411ee5
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x411edc
cmp eax, dword [esi + 4]
jne 0x411edc
cmp dword [esi + 8], ebx
je 0x411ecd
push 0xfffffffffffffffe
push 1
lea ebx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.004116b0
add esp, 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x411edc
push 2
push eax
call sub.WSOCK32.dll_shutdown
push esi
call fcn.00411200
add esp, 4
push esi
push 0xffffffffffffffff
push 0xffffffffffffffff
xor ebx, ebx
call fcn.004110d0
add esp, 0xc
test eax, eax
jne 0x412056
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
movsx eax, byte [edi + 4]
push eax
lea ecx, [esp + 0x28]
push edi
push ecx
call sub.MSVCR90.dll_memcpy
movsx dx, byte [edi + 5]
add esp, 0xc
push ebp
mov word [esp + 0x24], dx
call sub.WSOCK32.dll_htons
push 6
push 1
push 2
mov word [esp + 0x2e], ax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jle 0x411f91
push 0x10
lea ecx, [esp + 0x24]
push ecx
push eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x411fea
call fcn.00410c40
mov eax, dword [0x67f860]
cmp eax, 0x2740
je 0x411f74
cmp eax, 0x274d
jne 0x411fbc
call fcn.0056c7a0
sub eax, dword [esp + 0x1c]
cmp eax, 2
jg 0x411fbc
push 1
call fcn.0056c1a0
add esp, 4
jmp 0x411ea4
call fcn.00410c40
push esi
call fcn.00411200
push 0x725
call fcn.004073f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00586584
add esp, 0x24
ret
call fcn.00410c40
push esi
call fcn.00411c20
mov edx, dword [esi]
push edx
push 0x70d
call fcn.004073f0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00586584
add esp, 0x24
ret
mov ecx, dword [esi]
push 4
lea eax, [esp + 0x14]
push eax
push 8
push 0xffff
push ecx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x41201d
mov eax, dword [esi]
push 4
lea edx, [esp + 0x1c]
push edx
push 1
push 6
push eax
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x412048
call fcn.00410c40
push esi
call fcn.00411200
push 0x726
call fcn.004073f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00586584
add esp, 0x24
ret
mov ecx, dword [esi]
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00586584
add esp, 0x24
ret
Function at 0x412b20
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 1
push 1
push 1
push edi
lea eax, [esp + 0x14]
push eax
push 0
push ecx
call fcn.0042cc60
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x412b53
push 0x3200
push 0
call fcn.00406f10
add esp, 8
mov eax, esi
pop esi
pop ecx
ret
mov edx, dword [edi]
mov esi, dword [sym.imp.MSVCR90.dll_fprintf]
push edx
push str.LENGTH
push str.TREEBEGIN
push str._s__s__ld_n
push ebx
call esi
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
push ebx
push 1
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x24
cmp eax, 1
je 0x412bb4
call dword [sym.imp.MSVCR90.dll__errno]
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push edx
push eax
push str.fwrite
push 0x3200
push 0x719
call fcn.00406f10
add esp, 0x14
mov eax, 0x719
pop esi
pop ecx
ret
push str.TREEEND
push 0x5a8b30
push ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x10
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4149f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
mov edi, dword [esp + 0x41c]
push ebp
push str.Getplan_request__s_n
call fcn.00575440
mov eax, dword [str.public]
mov ebx, dword [sym.imp.MSVCR90.dll_fopen]
add eax, 0x5a2
push 0x5a8460
push eax
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x414a68
mov ecx, dword [str.public]
push 0x5a8460
add ecx, 0x5a2
push ecx
push 0x2f04
push 0x713
call fcn.00406f10
add esp, 0x10
jmp 0x414ade
push edi
push ebp
call ebx
add esp, 8
mov ebx, eax
push esi
test ebx, ebx
jne 0x414a92
call dword [sym.imp.MSVCR90.dll_fclose]
push edi
push ebp
push 0x2f04
push 0x713
call fcn.00406f10
add esp, 0x14
jmp 0x414ade
mov edi, dword [sym.imp.MSVCR90.dll_fread]
push 0x400
lea edx, [esp + 0x18]
push 1
push edx
call edi
add esp, 0x10
test eax, eax
jle 0x414adc
lea ecx, [ecx]
push ebx
push eax
lea eax, [esp + 0x18]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
push esi
test eax, eax
je 0x414af7
push 0x400
lea ecx, [esp + 0x18]
push 1
push ecx
call edi
add esp, 0x10
test eax, eax
jg 0x414ab0
xor eax, eax
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00586584
add esp, 0x404
ret
mov esi, dword [sym.imp.MSVCR90.dll_fclose]
call esi
push ebx
call esi
push ebp
push 0x2f04
push 0x715
call fcn.00406f10
add esp, 0x14
jmp 0x414ade
Function at 0x415780
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov eax, ebx
test ebx, ebx
jne 0x415793
mov eax, 0x5a8a1a
movsx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push ecx
push eax
push edx
push esi
push str.MKBLOB_TA_d_BN_.200s_FN_.200s_istmp_d__n
call fcn.00575440
add esp, 0x14
test esi, esi
jl 0x4157f2
push 0
lea edi, [esp + 0x24]
mov ecx, esi
call fcn.00415210
mov esi, eax
add esp, 4
test esi, esi
jne 0x4158f4
mov eax, dword [0x6d4a74]
cmp dword [eax + 3], 4
je 0x4157f2
mov esi, 2
push 0x2ee0
push esi
call fcn.00406f10
add esp, 8
jmp 0x4158f4
mov eax, dword [esp + 0x1c]
cmp dword [eax], 0
mov ebp, dword [eax + 4]
jne 0x4158c6
mov ecx, dword [str.public]
mov edx, dword [ecx + 0x159]
mov esi, dword [eax + 8]
push 0x5a9240
push edx
push ebx
mov byte [esp + 0x30], 1
call fcn.0056a970
add esp, 0xc
test eax, eax
jne 0x41583d
push 0x32
push 0x717
call fcn.004073f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x5a8524
push ebx
call dword [sym.imp.MSVCR90.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x415870
push 0x5a8524
push ebx
mov esi, 0x713
push 0x2ee0
push esi
call fcn.00406f10
add esp, 0x10
jmp 0x4158f4
cmp ebp, 0x7fa0
jbe 0x4158a1
push edi
push 0x7fa0
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 0x7fa0
jne 0x41590f
sub ebp, 0x7fa0
add esi, eax
cmp ebp, eax
ja 0x415878
push edi
push ebp
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, ebp
jne 0x41590f
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
cmp eax, 0xffffffff
je 0x415919
mov eax, dword [esp + 0x1c]
movsx ecx, byte [esp + 0x24]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x14]
push ecx
push edx
push ebx
push eax
call fcn.00424830
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415935
cmp byte [esp + 0x24], 0
je 0x4158f4
push ebx
call sub.MSVCR90.dll__unlink
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
push 0x2ee0
push 0
call fcn.00406f10
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push ebx
call sub.MSVCR90.dll__unlink
push ebx
mov esi, 0x715
push 0x2ee0
push esi
call fcn.00406f10
add esp, 0x10
jmp 0x4158f4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4162d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [str.public]
mov ecx, dword [eax + 0x12f]
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x18]
push edi
push ebx
push ebp
push ecx
push esi
push edx
push str.DML_TA_d_QU_d_TO_ld_MODE_ld:__.200s_n
mov dword [esp + 0x20], 0xffffffff
call fcn.00575440
mov eax, dword [0x5b46bc]
add esp, 0x18
cmp dword [eax], 0
je 0x41632d
mov ecx, dword [0x5b46b8]
test byte [ecx], 0x40
je 0x41632d
push ebx
push str.Dynamic
push 2
push 6
call fcn.00573da0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x41638f
cmp esi, 0x15
ja 0x41634a
mov edx, esi
imul edx, edx, 0x25
cmp byte [edx + 0x6230a0], 0
je 0x41634a
mov edi, 0x138d
jmp 0x416470
mov ecx, dword [esp + 0x10]
push 1
lea edi, [esp + 0xc]
call fcn.00415210
mov edi, eax
add esp, 4
test edi, edi
jne 0x41638f
mov eax, dword [0x6d4a74]
cmp dword [eax + 3], 4
je 0x416377
mov edi, 2
jmp 0x416470
mov ecx, dword [esp + 0x14]
push 0
push ecx
push esi
push ebp
push ebx
call fcn.004205c0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4163df
push 0x2eed
push 0
call fcn.00406f10
add esp, 8
cmp dword [esp + 8], 0
jl 0x4163d9
mov eax, dword [0x6d4a74]
cmp byte [eax], 0
je 0x4163cb
cmp byte [eax + 1], 0
je 0x4163cb
cmp dword [0x62309c], 0
jne 0x4163cb
mov edx, dword [eax + 7]
mov ecx, 0xe
call fcn.004161c0
push 1
push 0xffffffffffffffff
push 2
call fcn.00419b90
add esp, 0xc
mov eax, edi
pop edi
pop ebp
pop ecx
ret
mov edi, dword [esp + 0x14]
movzx eax, word [edi + 6]
cmp ax, 0x29
jl 0x4163f3
cmp ax, 0x2a
jle 0x4163fd
mov edx, 0x8d
cmp ax, dx
jne 0x41645e
movsx eax, word [edi + 0xa]
add eax, eax
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
mov ecx, esi
imul ecx, ecx, 0x25
add esp, 4
mov dword [ecx + 0x6230a4], eax
test eax, eax
jne 0x416421
lea edi, [eax + 6]
jmp 0x416470
lea ecx, [ecx + 0x6230a2]
push ecx
push edi
call fcn.005754a0
add esp, 8
movzx eax, word [edi + 6]
cmp ax, 0x2a
setne dl
movzx ecx, dl
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push ecx
push edx
mov edx, dword [esp + 0x14]
push eax
mov ecx, ebp
mov eax, esi
call fcn.004145b0
add esp, 0x10
pop edi
xor eax, eax
pop ebp
pop ecx
ret
test ebp, ebp
je 0x416431
push esi
call fcn.0041f450
add esp, 4
mov edi, 0x170d
push esi
push 0x2eed
push edi
call fcn.00406f10
add esp, 0xc
cmp dword [esp + 8], 0
jl 0x41648b
call fcn.00416270
mov eax, edi
pop edi
pop ebp
pop ecx
ret
Function at 0x419920
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x419938
push fcn.00419920
push eax
call dword [sym.imp.MSVCR90.dll_signal]
add esp, 8
ret
mov eax, dword [0x623464]
test eax, eax
je 0x419937
mov eax, dword [eax + 0xd4]
test eax, eax
jle 0x419965
call fcn.004198d0
push eax
push 0x36be
push 0xa
call fcn.00406f10
add esp, 0xc
jmp fcn.00401670
jge 0x419937
push 0x36be
push 2
call fcn.00406f10
add esp, 8
jmp fcn.00401670

Function at 0x419ce0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [str.public]
cmp dword [eax + 0x128], 1
jne 0x419cf4
mov eax, 1
ret
call fcn.00405920
test eax, 0xff07c
je 0x419d18
mov ecx, dword [esp + 4]
mov edx, dword [0x67f910]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
push 1
call fcn.00574330
add esp, 4
call esi
sub eax, edi
cmp eax, 0x37
jb 0x419d24
mov eax, dword [esp + 0xc]
add eax, 0xffffffc9
xor ecx, ecx
test eax, eax
setg cl
pop edi
pop esi
mov eax, ecx
ret

Function at 0x41a5d0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x6235ac], 0xffffffff
je 0x41a5e7
push 1
push 0
push 0
call fcn.0041a270
add esp, 0xc
mov eax, dword [0x6235b0]
push 0x6236d0
push eax
call fcn.0046efe0
push 1
call fcn.0046ec30
mov ecx, dword [0x6235ac]
add esp, 0xc
cmp ecx, 0xffffffff
je 0x41a664
mov eax, dword [0x6235bd]
test eax, eax
je 0x41a664
cmp eax, 1
jle 0x41a626
mov dword [0x6235bd], 1
jmp 0x41a628
jne 0x41a65e
push 1
push 0
push ecx
call fcn.00572490
add esp, 0xc
test eax, eax
je 0x41a659
mov ecx, dword [0x6235ac]
push 0
push ecx
push 0x36bf
push 0x72b
call fcn.00406f10
add esp, 0x10
jmp fcn.00401670
mov eax, dword [0x6235bd]
dec eax
mov dword [0x6235bd], eax
ret
Function at 0x41bff0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [str.public]
push ebx
mov ebx, 1
cmp dword [eax + 0x128], ebx
je 0x41c1c9
push 0
call fcn.0056be70
push ebx
push 0
push 3
call fcn.0041a270
mov edx, dword [0x623464]
add esp, 0x10
cmp dword [edx + 0x151], 0
je 0x41c1c9
mov eax, dword [0x6235b0]
mov ecx, eax
imul ecx, ecx, 0x134
add ecx, edx
cmp byte [ecx + 0x2a0], 0
jne 0x41c0ad
add byte [ecx + 0x29f], bl
mov eax, dword [0x623464]
add dword [eax + 0x149], ebx
mov eax, dword [0x623464]
cmp dword [eax + 0x141], 0
jne 0x41c06e
cmp dword [eax + 0x145], 0
je 0x41c07d
push 0
call fcn.0041bcd0
mov eax, dword [0x623464]
add esp, 4
mov edx, dword [0x6235b0]
imul edx, edx, 0x134
dec byte [edx + eax + 0x29f]
lea eax, [edx + eax + 0x29f]
mov eax, dword [0x623464]
dec dword [eax + 0x149]
mov eax, dword [0x6235b0]
mov edx, dword [0x623464]
imul eax, eax, 0x134
add byte [eax + edx + 0x2a0], bl
lea eax, [eax + edx + 0x2a0]
mov eax, dword [0x623464]
add dword [eax + 0x14d], ebx
mov eax, dword [0x6235c9]
test eax, eax
je 0x41c106
cmp eax, ebx
jne 0x41c1c2
cmp byte [0x6235bc], 0
mov ecx, dword [0x623464]
jne 0x41c17a
mov edx, dword [ecx + 0x128]
push esi
mov esi, dword [str.public]
cmp edx, dword [esi + 0x71c]
pop esi
je 0x41c17a
push eax
mov eax, dword [0x6235ac]
push 3
push eax
push 0x36bf
push 0xf3e
call fcn.00406f10
mov eax, dword [0x623464]
add esp, 0x14
test eax, eax
je 0x41c1c9
mov dword [eax + 0xd4], 4
mov ecx, dword [0x623464]
mov eax, dword [ecx + 0xd4]
test eax, eax
jle 0x41c163
call fcn.004198d0
push eax
push 0x36be
push 0xa
call fcn.00406f10
add esp, 0xc
pop ebx
jmp fcn.00401670
jge 0x41c1c9
push 0x36be
push 2
call fcn.00406f10
add esp, 8
pop ebx
jmp fcn.00401670
mov dword [ecx + 0x128], 0
mov edx, dword [0x623464]
add edx, 0x11b
push edx
call fcn.0056b890
add esp, 4
test eax, eax
je 0x41c1bd
mov eax, dword [0x6235ac]
push 3
push eax
push 0x36bf
push 0x72b
call fcn.00406f10
add esp, 0x10
pop ebx
jmp fcn.00401670
mov eax, dword [0x6235c9]
sub eax, ebx
mov dword [0x6235c9], eax
pop ebx
ret
Function at 0x41c1d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [str.public]
push ebx
mov ebx, 1
cmp dword [eax + 0x128], ebx
je 0x41c3b5
push 0
call fcn.0056be70
push ebx
push 0
push 3
call fcn.0041a270
mov edx, dword [0x623464]
add esp, 0x10
cmp dword [edx + 0x151], 0
je 0x41c3b5
mov eax, dword [0x6235b0]
mov ecx, eax
imul ecx, ecx, 0x134
add ecx, edx
cmp byte [ecx + 0x29e], 0
jne 0x41c299
add byte [ecx + 0x29d], bl
mov eax, dword [0x623464]
add dword [eax + 0x141], ebx
mov edx, dword [0x67f90c]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x623464]
cmp dword [eax + 0x145], 0
jne 0x41c25b
cmp dword [eax + 0x14d], 0
je 0x41c269
push ebx
call fcn.0041bcd0
mov eax, dword [0x623464]
add esp, 4
mov ecx, dword [0x6235b0]
imul ecx, ecx, 0x134
dec byte [ecx + eax + 0x29d]
lea eax, [ecx + eax + 0x29d]
mov eax, dword [0x623464]
dec dword [eax + 0x141]
mov eax, dword [0x6235b0]
mov edx, dword [0x623464]
imul eax, eax, 0x134
add byte [eax + edx + 0x29e], bl
lea eax, [eax + edx + 0x29e]
mov eax, dword [0x623464]
add dword [eax + 0x145], ebx
mov eax, dword [0x6235c9]
test eax, eax
je 0x41c2f2
cmp eax, ebx
jne 0x41c3ae
cmp byte [0x6235bc], 0
mov ecx, dword [0x623464]
jne 0x41c366
mov edx, dword [ecx + 0x128]
push esi
mov esi, dword [str.public]
cmp edx, dword [esi + 0x71c]
pop esi
je 0x41c366
push eax
mov eax, dword [0x6235ac]
push 3
push eax
push 0x36bf
push 0xf3e
call fcn.00406f10
mov eax, dword [0x623464]
add esp, 0x14
test eax, eax
je 0x41c3b5
mov dword [eax + 0xd4], 4
mov ecx, dword [0x623464]
mov eax, dword [ecx + 0xd4]
test eax, eax
jle 0x41c34f
call fcn.004198d0
push eax
push 0x36be
push 0xa
call fcn.00406f10
add esp, 0xc
pop ebx
jmp fcn.00401670
jge 0x41c3b5
push 0x36be
push 2
call fcn.00406f10
add esp, 8
pop ebx
jmp fcn.00401670
mov dword [ecx + 0x128], 0
mov edx, dword [0x623464]
add edx, 0x11b
push edx
call fcn.0056b890
add esp, 4
test eax, eax
je 0x41c3a9
mov eax, dword [0x6235ac]
push 3
push eax
push 0x36bf
push 0x72b
call fcn.00406f10
add esp, 0x10
pop ebx
jmp fcn.00401670
mov eax, dword [0x6235c9]
sub eax, ebx
mov dword [0x6235c9], eax
pop ebx
ret
Function at 0x423d00
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
push esi
test ecx, ecx
jl 0x423d4a
cmp ecx, dword [0x67f9bc]
jae 0x423d4a
mov edx, dword [0x67f9c8]
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*4]
mov eax, dword [edx]
mov dword [0x67f96c], edx
cmp eax, 0xffffffff
je 0x423d4a
mov esi, dword [0x67f9b4]
lea eax, [eax + eax*8]
cmp dword [esi + eax*4 + 4], 0
lea eax, [esi + eax*4]
mov dword [0x67f970], eax
je 0x423d4a
cmp dword [eax], 0xffffffff
jne 0x423d67
push ecx
push 0x324
push 0x1772
call fcn.00406f10
add esp, 0xc
mov eax, 0x1772
pop esi
add esp, 0x18
ret
cmp dword [eax + 0x1c], 0xffffffff
push edi
jne 0x423ddd
mov ecx, dword [edx + 0x10]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push esi
push 1
push edx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp esi, eax
je 0x423dc7
call dword [sym.imp.MSVCR90.dll__errno]
mov ecx, dword [0x67f96c]
mov eax, dword [eax]
movzx edx, word [ecx + 0xc]
push eax
push edx
push 0
call fcn.00424ca0
add esp, 8
push eax
push 0x324
push 0xe27
call fcn.00406f10
add esp, 0x10
pop edi
mov eax, 0xe27
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x423e72
mov dword [eax], esi
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 8], ecx
mov word [esp + 0xc], dx
movzx eax, word [eax + 0x1a]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push 1
push edx
call fcn.0049f310
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x423e55
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.00422920
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x423e55
mov edi, dword [esp + 0x30]
test edi, edi
je 0x423e72
mov ecx, dword [0x67f970]
movzx edx, word [ecx + 0x1a]
push 1
lea eax, [esp + 0xc]
push eax
push edx
lea eax, [esp + 0x24]
push eax
call fcn.0049f310
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423e6c
push 0x324
push 0
call fcn.00406f10
add esp, 8
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret
mov ecx, dword [esp + 8]
mov dword [edi], ecx
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x4844d0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x93c0
call fcn.005865a0
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x93bc], eax
mov edx, dword [esp + 0x93d0]
movsx ecx, word [edx]
mov eax, dword [esp + 0x93cc]
push ebx
push ebp
push esi
sub ecx, 1
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], ecx
js 0x4846f3
mov ebx, ecx
imul ebx, ebx, 0x2d
mov esi, ecx
imul esi, esi, 0xaf
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
jmp 0x484534
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x1a9]
movsx edi, word [eax + esi + 0xa5]
mov ebp, dword [eax + esi + 0xab]
add eax, esi
mov esi, dword [edx + 6]
add esi, ebx
cmp byte [esi + 0x10], 0
mov bl, byte [eax + 0x9a]
jne 0x4846cd
mov eax, dword [esp + 0x93e4]
test eax, eax
jl 0x484577
cmp ecx, eax
jne 0x4846cd
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0x1b9], 0
je 0x48458f
lea edx, [esp + 0x93d8]
mov dword [esp + edi*4 + 0x24], edx
test bl, bl
je 0x4845a1
mov eax, dword [esi + 0x15]
lea ecx, [esp + 0x42c]
mov dword [esp + eax*4 + 0x20], ecx
add edi, 0xffffffff
js 0x4845dd
jmp 0x4845b0
movzx ecx, word [ebp + edi*2]
mov eax, dword [esp + 0x93d4]
movsx edx, cx
lea ecx, [eax + edx*2]
movzx edx, word [ecx]
cmp dx, word [ecx + 2]
jne 0x4845cf
xor ecx, ecx
jmp 0x4845d4
movsx ecx, dx
add ecx, eax
sub edi, 1
mov dword [esp + edi*4 + 0x28], ecx
jns 0x4845b0
test bl, bl
je 0x484665
xor ebx, ebx
cmp dword [esi + 0x11], ebx
jle 0x484632
xor edi, edi
xor edx, edx
mov eax, dword [esi + 0x1d]
movsx ecx, word [edx + eax + 2]
movzx eax, word [ebp + ecx*2]
mov ecx, dword [esp + 0x93d4]
cwde
lea eax, [ecx + eax*2]
movzx ecx, word [eax]
cmp cx, word [eax + 2]
jne 0x484615
xor eax, eax
jmp 0x48461f
movsx eax, cx
add eax, dword [esp + 0x93d4]
mov ecx, dword [esi + 0x29]
mov dword [edi + ecx + 4], eax
inc ebx
add edx, 6
add edi, 9
cmp ebx, dword [esi + 0x11]
jl 0x4845f0
mov edx, 0xffc
mov word [esp + 0x42c], dx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x29]
push eax
push 0
push 0
push ecx
lea edx, [esp + 0x43c]
push edx
call fcn.0050cd00
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x48470e
mov ecx, dword [esi + 0x19]
lea eax, [esp + 0x142c]
push eax
mov eax, dword [esi + 0x15]
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.005789e0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x48470e
cmp dword [esp + 0x93e4], 0xffffffff
push eax
push eax
jne 0x4846ab
mov edx, dword [esi + 8]
lea ecx, [esp + 0x1434]
push ecx
push edx
call fcn.0047d3b0
jmp 0x4846c0
mov ecx, dword [esp + 0x93f0]
lea eax, [esp + 0x1434]
push eax
push ecx
call fcn.004d9ed0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x48470e
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
dec ecx
sub esi, 0xaf
sub ebx, 0x2d
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
test ecx, ecx
jge 0x484530
xor eax, eax
mov ecx, dword [esp + 0x93cc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00586584
add esp, 0x93c0
ret
push 0x801
push 0
call fcn.00406f10
add esp, 8
mov eax, edi
jmp 0x4846f5
Function at 0x486540
Capabilities:
Reference sql statements

Disassembly:
sub esp, 8
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push fcn.00472210
push 0
push str.SELECT__FROM____syscolumn______tWHERE_cname_IN_storepos_STOREPOS__AND_tsegno__________SELECT_segno_from____systable__WHERE_tname_IN____sysindex___SYSINDEX__
call fcn.0050dfb0
add esp, 0x1c
test eax, eax
jne 0x486588
mov edx, dword [esp]
push edx
call fcn.0050dec0
add esp, 4
test eax, eax
jne 0x486588
cmp dword [esp + 4], eax
mov ecx, dword [esp + 0xc]
setne al
mov byte [ecx], al
xor eax, eax
add esp, 8
ret