joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402700
Capabilities:
Get process heap flags
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x411c13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.00401000
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call fcn.004010a0
lea ecx, [esp + 0x14]
call fcn.00410ff8
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x1c]
push str.SELECTFROM_Czyxxb_WHERE_CzyName_s_AND_Pwd_s
push edx
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CString::Format
xor edi, edi
add esp, 0x10
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call fcn.00402540
push ecx
mov ebp, eax
mov dword [esp + 0x14], esp
mov ebx, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x34], 5
je 0x4027c1
push ebp
mov dword [esi + 4], edi
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x4027c3
test ebp, ebp
je 0x4027c3
push 0x8007000e
call fcn.0041171f
jmp 0x4027c3
xor esi, esi
test esi, esi
mov byte [esp + 0x34], 4
mov dword [ebx], esi
jne 0x4027d8
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x20]
call fcn.00401550
mov eax, dword [eax]
test eax, eax
je 0x4027f5
mov ecx, dword [eax]
mov edi, eax
push eax
mov dword [esp + 0x1c], edi
call dword [ecx + 4]
jmp 0x4027ff
push 0x80004003
call fcn.0041171f
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
push edi
call dword [edx + 0x50]
test eax, eax
jge 0x40281a
push 0x41b188
push edi
push eax
call fcn.0041172d
cmp word [esp + 0x10], 0
mov byte [esp + 0x30], 3
je 0x402871
test edi, edi
je 0x402831
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.00401040
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
jmp 0x4028bb
test edi, edi
je 0x40287b
mov edx, dword [edi]
push edi
call dword [edx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.00401040
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x4028d0
Capabilities:
Get process heap flags
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x411c5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 2
call fcn.00401000
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.004010a0
lea ecx, [esp + 0x14]
call fcn.00410ff8
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push str.SELECTFROM_Czyxxb_WHERE_CzyName_s_AND_Pwd_s_AND_Czyjb_s
push eax
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_CString::Format
xor edi, edi
add esp, 0x14
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00402540
push ecx
mov ebp, eax
mov dword [esp + 0x14], esp
mov ebx, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x34], 6
je 0x402996
push ebp
mov dword [esi + 4], edi
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x402998
test ebp, ebp
je 0x402998
push 0x8007000e
call fcn.0041171f
jmp 0x402998
xor esi, esi
test esi, esi
mov byte [esp + 0x34], 5
mov dword [ebx], esi
jne 0x4029ad
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x20]
call fcn.00401550
mov eax, dword [eax]
test eax, eax
je 0x4029ca
mov ecx, dword [eax]
mov edi, eax
push eax
mov dword [esp + 0x1c], edi
call dword [ecx + 4]
jmp 0x4029d4
push 0x80004003
call fcn.0041171f
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
push edi
call dword [edx + 0x50]
test eax, eax
jge 0x4029ef
push 0x41b188
push edi
push eax
call fcn.0041172d
cmp word [esp + 0x10], 0
mov byte [esp + 0x30], 4
je 0x402a54
test edi, edi
je 0x402a06
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call fcn.00401040
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
jmp 0x402aac
test edi, edi
je 0x402a5e
mov edx, dword [edi]
push edi
call dword [edx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call fcn.00401040
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0xc
Function at 0x4053c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x412333
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.004010a0
lea ecx, [esp + 0xc]
call fcn.00410ff8
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.delete_from_Gzffmxb_where_ygid_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402540
push ecx
mov edi, eax
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x2c], 3
je 0x405474
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x405476
test edi, edi
je 0x405476
push 0x8007000e
call fcn.0041171f
jmp 0x405476
xor esi, esi
test esi, esi
mov byte [esp + 0x2c], 2
mov dword [ebp], esi
jne 0x40548c
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x18]
call fcn.004017a0
lea ecx, [esp + 0x14]
call fcn.00401960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00401040
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4
Function at 0x405840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov al, 0x45
push ebx
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1c], al
mov al, 0x6c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], al
lea eax, [ebp - 0x10]
push edi
lea ecx, [ebp - 0x20]
mov bl, 0x65
push eax
push ecx
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], 0
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x1b], 0x4c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x14], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 4], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, 0x73
lea edx, [ebp - 0x30]
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], al
lea eax, [ebp - 0x20]
push edx
push eax
mov byte [ebp - 0x30], 0x47
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x50
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x63
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x26], 0x48
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x23], 0x70
mov byte [ebp - 0x22], 0
call esi
push eax
call edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
push ecx
push 0
call eax
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov edx, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push edi
mov dword [ebp - 0x24], ecx
mov si, word [eax + 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
lea esi, [esi + eax + 0x18]
mov dword [ebp - 0x18], esi
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 6]
mov eax, dword [ebp - 0x14]
cmp eax, edx
jge 0x405f65
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x405ee5
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x405f4d
mov edx, dword [esi + 0xc]
push 4
push 0x1000
add edx, ecx
push ebx
push edx
call dword [0x426a08]
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x405f4d
push 4
push 0x1000
push eax
mov eax, dword [esi + 0xc]
add eax, ecx
push eax
call dword [0x426a08]
lea ecx, [ebp - 0x20]
push 0x417a40
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0xb
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov edx, ecx
add esi, eax
mov eax, 0x405f3d
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
ret
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
inc ecx
add esi, 0x28
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], esi
jmp 0x405e90
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x10]
push edi
mov bl, 0x74
push eax
push str.KERNEL32.dll
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x46
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], 0x56
push ecx
push str.KERNEL32.dll
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [edi]
mov dx, word [eax + 0x14]
lea eax, [edx + eax + 0x18]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi]
xor ebx, ebx
cmp word [ecx + 6], bx
jbe 0x406184
lea esi, [eax + 0x24]
mov eax, dword [esi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
and ecx, 1
and edx, 1
shr eax, 0x1f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test byte [esi + 3], 2
je 0x4060bc
mov edx, dword [esi - 0x14]
mov eax, dword [esi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x406170
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [edx + ecx*2]
lea edx, [eax + ecx*2]
mov eax, dword [esi]
test eax, 0x4000000
mov edx, dword [edx*4 + 0x4257bc]
je 0x4060ee
or dh, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi - 0x14]
test eax, eax
jne 0x406126
mov ecx, dword [esi]
test cl, 0x40
je 0x40611c
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
jmp 0x406126
test cl, 0x80
je 0x406126
mov ecx, dword [edi]
mov eax, dword [ecx + 0x24]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test eax, eax
jbe 0x406170
mov ecx, dword [esi - 0x14]
lea eax, [ebp + 8]
push eax
push edx
mov edx, dword [esi - 0x1c]
push ecx
push edx
call dword [ebp - 4]
test eax, eax
jne 0x406170
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [edi]
xor ecx, ecx
inc ebx
add esi, 0x28
mov cx, word [eax + 6]
cmp ebx, ecx
jl 0x406070
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x412ea3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.004010a0
lea ecx, [esp + 0xc]
call fcn.00410ff8
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.delete_from_ygfdgzxmb_where_ygid_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402540
push ecx
mov edi, eax
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x2c], 3
je 0x409a34
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x409a36
test edi, edi
je 0x409a36
push 0x8007000e
call fcn.0041171f
jmp 0x409a36
xor esi, esi
test esi, esi
mov byte [esp + 0x2c], 2
mov dword [ebp], esi
jne 0x409a4c
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x18]
call fcn.004017a0
lea ecx, [esp + 0x14]
call fcn.00401960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00401040
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4
Function at 0x40bea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4133a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.004010a0
lea ecx, [esp + 0xc]
call fcn.00410ff8
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.delete_from_ygjbgzb_where_ygid_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402540
push ecx
mov edi, eax
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x2c], 3
je 0x40bf54
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x40bf56
test edi, edi
je 0x40bf56
push 0x8007000e
call fcn.0041171f
jmp 0x40bf56
xor esi, esi
test esi, esi
mov byte [esp + 0x2c], 2
mov dword [ebp], esi
jne 0x40bf6c
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x18]
call fcn.004017a0
lea ecx, [esp + 0x14]
call fcn.00401960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00401040
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4
Function at 0x40cfa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4136b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.004010a0
lea ecx, [esp + 0xc]
call fcn.00410ff8
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.delete_from_ygjbsjb_where_ygid_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402540
push ecx
mov edi, eax
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x2c], 3
je 0x40d054
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x40d056
test edi, edi
je 0x40d056
push 0x8007000e
call fcn.0041171f
jmp 0x40d056
xor esi, esi
test esi, esi
mov byte [esp + 0x2c], 2
mov dword [ebp], esi
jne 0x40d06c
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x18]
call fcn.004017a0
lea ecx, [esp + 0x14]
call fcn.00401960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00401040
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4
Function at 0x40e990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413b63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.004010a0
lea ecx, [esp + 0xc]
call fcn.00410ff8
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.delete_from_ygjcxxb_where_ygid_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402540
push ecx
mov edi, eax
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x2c], 3
je 0x40ea44
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x40ea46
test edi, edi
je 0x40ea46
push 0x8007000e
call fcn.0041171f
jmp 0x40ea46
xor esi, esi
test esi, esi
mov byte [esp + 0x2c], 2
mov dword [ebp], esi
jne 0x40ea5c
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x18]
call fcn.004017a0
lea ecx, [esp + 0x14]
call fcn.00401960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00401040
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4
Function at 0x40eab0
Capabilities:
Get process heap flags
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x413b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edi
call fcn.00401000
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.004010a0
lea ecx, [esp + 0x14]
call fcn.00410ff8
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
push str.SELECTFROM_Ygjcxxb_WHERE_YGid_s
push ecx
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 3
call fcn.00402540
push ecx
mov ebp, eax
mov dword [esp + 0x14], esp
mov ebx, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x34], 4
je 0x40eb68
push ebp
mov dword [esi + 4], edi
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x40eb6a
test ebp, ebp
je 0x40eb6a
push 0x8007000e
call fcn.0041171f
jmp 0x40eb6a
xor esi, esi
test esi, esi
mov byte [esp + 0x34], 3
mov dword [ebx], esi
jne 0x40eb7f
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x20]
call fcn.00401550
mov eax, dword [eax]
test eax, eax
je 0x40eb9c
mov edx, dword [eax]
mov edi, eax
push eax
mov dword [esp + 0x1c], edi
call dword [edx + 4]
jmp 0x40eba6
push 0x80004003
call fcn.0041171f
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [eax + 0x50]
test eax, eax
jge 0x40ebc1
push 0x41b188
push edi
push eax
call fcn.0041172d
cmp word [esp + 0x10], 0
mov byte [esp + 0x30], 2
je 0x40ec0a
test edi, edi
je 0x40ebd8
mov edx, dword [edi]
push edi
call dword [edx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.00401040
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
jmp 0x40ec46
test edi, edi
je 0x40ec14
mov eax, dword [edi]
push edi
call dword [eax + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.00401040
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4