joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490580
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490663
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x49064a
mov edx, dword [eax + 0x14]
lea ebx, [eax + 0xc]
mov dword [esp + 0xc], ebx
test edx, edx
jne 0x4905e1
mov edx, dword [eax]
cmp dword [edx], 4
jne 0x490632
mov ebp, dword [edx + 4]
test ebp, ebp
je 0x490632
mov eax, dword [eax + 4]
test ecx, 0x80
je 0x4905cf
mov eax, dword [eax]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.00468040
jmp 0x4905fd
mov dword [esp], ebx
call fcn.004680b0
mov eax, dword [esp + 4]
test eax, eax
je 0x49061a
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00468080
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.004680b0
mov eax, dword [esp + 4]
test eax, eax
setne al
mov byte [esp + 0x18], al
add esp, 0x10
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a280]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a1c0]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a278]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.00490580
Function at 0x4908e0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490aba
sub esp, 0x10
movzx eax, byte [0x91ef20]
nop
test al, al
je 0x49093b
lea eax, [0x6db5c0]
mov dword [0x91ef24], eax
mov eax, dword [0x93f150]
test eax, eax
jne 0x49091f
mov eax, dword [esp + 0x18]
jmp 0x490933
call fcn.00471840
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov ecx, dword [0x91ef28]
mov dword [edi + 4], ecx
mov dword [0x91ef28], eax
jmp 0x49093f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and ecx, 0x1f
mov dword [esp + 0xc], ecx
nop
cmp ecx, 0x15
ja 0x4909bb
cmp ecx, 0x12
jne 0x490960
mov ecx, dword [esp + 0x14]
jmp 0x490a0f
cmp ecx, 0x13
jne 0x4909ac
test edx, 0x200
jne 0x49099e
nop
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 4
jne 0x490aa1
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x490aa1
test edx, 0x80
je 0x490990
mov eax, dword [eax]
test eax, eax
je 0x490996
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x4959f0]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp ecx, 0x15
jne 0x490a4f
mov ecx, dword [esp + 0x14]
jmp 0x490a0f
cmp ecx, 0x17
ja 0x490a01
cmp ecx, 0x16
jne 0x4909f7
mov ecx, dword [esp + 0x14]
mov ebx, dword [ecx + 4]
test ebx, ebx
jne 0x490a0f
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.004697a0
movzx eax, byte [esp + 4]
test al, al
je 0x490a89
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp ecx, 0x18
je 0x490a2d
cmp ecx, 0x1a
jne 0x490a4f
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 4
jne 0x490a37
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x490a37
test edx, 0x80
je 0x490a25
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a1c0]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6ed9c0]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x15
lea ecx, [0x721937]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6e2140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a288]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a1c0]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.004908e0
Function at 0x490cb0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490ddb
sub esp, 0x14
nop
mov eax, dword [esp + 0x20]
test eax, 0x60
jne 0x490cda
test eax, 0x100
jne 0x490ce6
mov dword [esp], eax
call fcn.0048e7f0
mov eax, dword [esp + 0x20]
and eax, 0x1f
nop
cmp eax, 0x17
jne 0x490d74
mov eax, dword [esp + 0x18]
test byte [eax], al
mov dword [esp], eax
call fcn.0048c2b0
mov eax, dword [esp + 4]
test eax, eax
je 0x490d11
lea ecx, [0x78cbe4]
jmp 0x490d15
xor ecx, ecx
xor eax, eax
mov ecx, dword [ecx + 0x54]
mov dword [esp], eax
call ecx
cmp dword [esp + 4], 8
jne 0x490d5c
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [0x93f150]
test eax, eax
jne 0x490d46
mov eax, dword [esp + 0x24]
jmp 0x490d56
call fcn.00471840
mov eax, dword [esp + 0x24]
mov dword [edi], eax
mov edx, dword [ecx]
mov dword [edi + 4], edx
mov dword [ecx], eax
add esp, 0x14
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a290]
mov dword [esp + 4], eax
call fcn.0046a9e0
mov dword [esp + 0xc], eax
call fcn.0048e510
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
lea edx, [0x6ed9c0]
mov dword [esp], edx
call fcn.0040bb90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [0x93f150]
test ecx, ecx
jne 0x490dce
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6e2140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046a9e0
call fcn.00471830
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
jmp 0x490daf
call fcn.00470430
jmp fcn.00490cb0
Function at 0x490df0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490f3a
sub esp, 0x14
nop
mov eax, dword [esp + 0x20]
test eax, 0x60
jne 0x490e1a
test eax, 0x100
jne 0x490e26
mov dword [esp], eax
call fcn.0048e7f0
mov eax, dword [esp + 0x20]
and eax, 0x1f
nop
cmp eax, 0x17
jne 0x490ed3
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp cl, 0x12
ja 0x490e57
cmp cl, 0x11
jne 0x490e4d
mov eax, dword [eax + 0x20]
jmp 0x490e77
cmp cl, 0x12
jne 0x490e75
mov eax, dword [eax + 0x20]
jmp 0x490e77
cmp cl, 0x15
jne 0x490e61
mov eax, dword [eax + 0x24]
jmp 0x490e77
cmp cl, 0x16
jne 0x490e6b
mov eax, dword [eax + 0x20]
jmp 0x490e77
cmp cl, 0x17
jne 0x490e75
mov eax, dword [eax + 0x20]
jmp 0x490e77
xor eax, eax
movzx eax, byte [eax + 0xf]
and eax, 0x1f
cmp al, 5
jne 0x490ebb
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [0x93f150]
test eax, eax
jne 0x490ea5
mov eax, dword [esp + 0x24]
jmp 0x490eb5
call fcn.00471840
mov eax, dword [esp + 0x24]
mov dword [edi], eax
mov edx, dword [ecx]
mov dword [edi + 4], edx
mov dword [ecx], eax
add esp, 0x14
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a298]
mov dword [esp + 4], eax
call fcn.0046a9e0
mov dword [esp + 0xc], eax
call fcn.0048e510
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
lea edx, [0x6ed9c0]
mov dword [esp], edx
call fcn.0040bb90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [0x93f150]
test ecx, ecx
jne 0x490f2d
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6e2140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046a9e0
call fcn.00471830
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
jmp 0x490f0e
call fcn.00470430
jmp fcn.00490df0
Function at 0x491440
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49157f
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x491544
test eax, 0x200
je 0x4914fe
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
sar eax, 0xa
cmp dl, 0x14
jne 0x4914b6
cmp dword [ecx + 0x28], eax
jbe 0x49152c
mov edx, dword [ecx + 0x24]
lea eax, [edx + eax*8 + 4]
mov eax, dword [eax]
nop
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046bbe0
mov eax, dword [esp + 8]
lea ecx, [0x78cbe4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.004011f0
mov eax, dword [esp + 0x10]
cmp dword [esp + 8], eax
jbe 0x491514
mov ecx, dword [esp + 4]
shl eax, 4
mov eax, dword [ecx + eax + 4]
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046bbe0
mov eax, dword [esp + 8]
lea ecx, [0x78cbe4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x78cbe4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a200]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a200]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6ed9c0]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x71fdcc]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x6e2140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.00491440
Function at 0x491590
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x491740
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
nop
cmp eax, 0x15
ja 0x49162d
cmp eax, 0x12
jne 0x4915c8
mov eax, dword [esp + 0x10]
jmp 0x491687
cmp eax, 0x13
jne 0x49161e
test ecx, 0x200
jne 0x49160f
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x491727
mov eax, dword [eax + 4]
test eax, eax
je 0x491727
test ecx, 0x80
je 0x4915fd
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x491601
mov eax, dword [esp + 0x14]
test eax, eax
je 0x491607
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x4959f0]
nop
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x4916d5
mov eax, dword [esp + 0x10]
jmp 0x491687
cmp eax, 0x17
ja 0x491679
cmp eax, 0x16
jne 0x49166b
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 4]
test edx, edx
jne 0x491687
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [esp], ecx
call fcn.004697a0
movzx eax, byte [esp + 4]
test al, al
je 0x49170f
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x18
je 0x4916af
cmp eax, 0x1a
jne 0x4916d5
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4916bd
mov eax, dword [eax + 4]
test eax, eax
je 0x4916bd
test ecx, 0x80
je 0x4916a3
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4916a7
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a1c0]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6ed9c0]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x725230]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x6e2140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a2a8]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a1c0]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.00491590
Function at 0x4922a0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x492362
sub esp, 0x10
mov eax, dword [esp + 0x14]
test eax, eax
je 0x492349
lea ecx, [0x78cbe4]
cmp eax, ecx
jne 0x49232d
mov eax, dword [esp + 0x18]
test byte [eax], al
nop
mov dword [esp], eax
call fcn.00495290
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0xf]
test cl, 0x20
je 0x492315
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00466c20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x16
add esp, 0x10
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a2f0]
mov dword [esp + 4], eax
call fcn.0046a9e0
mov ecx, dword [0x78cbe8]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [0x710160]
mov dword [esp + 8], eax
call fcn.00409c60
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a2e8]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.004922a0
Function at 0x495890
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4959de
sub esp, 0x24
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4959a3
movzx ecx, byte [esp + 0x34]
test cl, cl
je 0x4958c7
test eax, 0x60
jne 0x49598b
test eax, 0x200
jne 0x4958da
mov edx, eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
jmp 0x495910
lea ecx, [0x71c2bb]
mov dword [esp], ecx
mov dword [esp + 4], 9
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.0048bda0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, edx
and edx, 0x1f
cmp edx, 0x14
jne 0x495967
mov dword [esp + 0x20], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.004907a0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x495952
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x495943
mov ecx, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.0048e2e0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a248]
mov dword [esp + 4], eax
call fcn.0046a9e0
lea eax, [0x6ed9c0]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x722ae6]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x6e2140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.00495890
Function at 0x49c400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49c4fa
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x49c440
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x49c479
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00476070
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x49c433
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x49c483
inc eax
cmp eax, 4
jge 0x49c499
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x49c4f3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.004760c0
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x49c4bc
jmp 0x49c482
call fcn.00470430
jmp fcn.0049c400

Function at 0x4a00d0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a0135
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0049fec0
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4a011c
mov edx, dword [esp + 0xc]
test edx, edx
jbe 0x4a0113
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
xor eax, eax
mov ecx, eax
call fcn.004718b0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x789fc0]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.004a00d0
Function at 0x4aa6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aa83b
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.00471acb
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x4aa6df
xor edx, edx
jmp 0x4aa70a
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x72424e]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.00402d90
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x4aa715
mov edx, 1
jmp 0x4aa749
cmp ecx, 0x23
je 0x4aa71e
xor edx, edx
jmp 0x4aa749
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x72936f]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.00402d90
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x4aa7a3
lea edi, [esp + 0x3c]
call fcn.00471acb
mov ecx, dword [0x9133c4]
lea edx, [0x78b5c0]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.004b6120
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.00471fae
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x4aa81a
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.00471acb
mov ecx, dword [0x9133c0]
mov edx, dword [0x9133c4]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.004aa850
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.00471fae
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.00471fae
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.00471fae
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.00470430
jmp fcn.004aa6b0
Function at 0x4adc00
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4adc4d
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4adc34
mov dword [esp], eax
call fcn.0046ecd0
movzx eax, byte [esp + 4]
mov byte [esp + 0x10], al
add esp, 8
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x789e50]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.004adc00

Function at 0x4add70
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4addf5
sub esp, 0x18
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4adddc
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.004adb70
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0046ed10
movzx eax, byte [esp + 0x14]
mov byte [esp + 0x28], al
add esp, 0x18
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a498]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.004add70
Function at 0x4b4040
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b422a
sub esp, 0x48
mov eax, dword [0x9133c0]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.004b0300
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.00471fae
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.00471fae
call fcn.004ae440
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00462870
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x4b4117
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x4b4131
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4b41a8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4b417e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x4b417a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x4b4173
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x4b4180
mov ebx, 0x1d
jmp 0x4b419e
mov ebp, eax
jmp 0x4b4180
mov ebp, eax
cmp ebp, 0xd
jae 0x4b421d
lea eax, [ebp - 1]
lea edx, [0x8ee680]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x4b4213
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4b41a8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4b41da
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4b41e2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.004718b0
mov eax, ebp
mov ecx, 0xd
call fcn.004718b0
nop
call fcn.00470430
jmp fcn.004b4040