joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d64c
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0046d0ac
test byte [ebx + 0x285], 4
jne 0x46d6e1
mov edx, esp
mov eax, ebx
call fcn.004486ec
push esp
mov eax, ebx
call fcn.00450bc4
push eax
push 0
mov eax, ebx
test eax, eax
je 0x46d681
sub eax, 0xfffffd34
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x260]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x274], 0
jne 0x46d6b2
mov ecx, dword [0x591b98]
mov dl, 1
mov eax, dword [0x4695e4]
call fcn.0040f1d8
call fcn.00404984
mov eax, ebx
call fcn.0046dc24
cmp byte [ebx + 0x57], 0
jne 0x46d6e8
mov eax, ebx
call fcn.00450dd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46d6e8
push 0
mov eax, ebx
call fcn.00450dd4
push eax
call sub.user32.dll_ShowWindow
jmp 0x46d6e8
mov eax, ebx
call fcn.0044cfc0
add esp, 0x10
pop ebx
ret

Function at 0x473438
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x473492
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x591500]
cmp byte [eax], 0
je 0x473462
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
jmp 0x47347c
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004051bc
mov eax, dword [ebp - 4]
call fcn.00405440
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473499
lea eax, [ebp - 4]
call fcn.00404f94
ret

Function at 0x473510
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47358d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x591500]
cmp byte [eax], 0
je 0x473544
push edi
push esi
push ebx
call sub.KERNEL32.DLL_CopyFileW
mov ebx, eax
jmp 0x473572
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.004051bc
mov eax, dword [ebp - 4]
call fcn.00405440
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004051bc
mov eax, dword [ebp - 8]
call fcn.00405440
push eax
call sub.KERNEL32.DLL_CopyFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473594
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fb8
ret

Function at 0x474020
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x47407c
push esp
push 0x40
push 6
push ebx
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x47404b
call fcn.0041078c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004032d4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x47407c
call fcn.0041078c
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x479bd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x479c37
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 4]
call fcn.004056d0
push edi
mov eax, dword [ebp - 4]
call fcn.00405440
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479c3e
lea eax, [ebp - 4]
call fcn.00404f94
ret

Function at 0x47e568
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47e5f2
xor edx, edx
push ebp
push 0x47e5d3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e5f2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x482434
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x482462
mov eax, ebx
call fcn.00482ee8
cmp dword [ebx + 0x40], 0
je 0x48245b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4824d3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4824c5
cmp dword [ebx + 8], 0
je 0x482484
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x482496
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4824c5
cmp dword [ebx + 8], 0
je 0x482477
cmp eax, 3
je 0x4824a9
dec eax
jne 0x482477
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x482477
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x482477
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4824f1
cmp dword [ebx + 0x14], 0xcc
je 0x4824f1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004824fc
pop ebx
ret
Function at 0x492be0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405430
mov eax, dword [ebp - 8]
call fcn.00405430
xor eax, eax
push ebp
push 0x492cfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00405440
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x492d10
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405440
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x492ce2
xor eax, eax
push ebp
push 0x492cdb
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x492cbb
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x492cbf
xor eax, eax
jmp 0x492cc1
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492ce2
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492d04
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fb8
ret
Function at 0x492d18
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405430
mov eax, dword [ebp - 8]
call fcn.00405430
mov eax, dword [ebp - 0xc]
call fcn.00405430
mov eax, dword [ebp + 0xc]
call fcn.00405430
xor eax, eax
push ebp
push 0x492e87
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00405440
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x492e9c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405440
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x492e64
xor edx, edx
push ebp
push 0x492e5d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405440
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405440
push eax
movzx eax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405440
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x492e46
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x492e3d
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x492e41
xor eax, eax
jmp 0x492e43
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492e64
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492e8e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fb8
lea eax, [ebp + 0xc]
call fcn.00404f94
ret
Function at 0x492ea4
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x492f6c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x492f70
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x492f6c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x492f63
xor eax, eax
push ebp
push 0x492f5c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492f63
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4931dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4933ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x105
mov eax, dword [ebp - 0x20]
call fcn.004030e4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49325a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
je 0x493244
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040518c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493261
mov eax, dword [ebp - 0x10]
call fcn.00403100
ret

Function at 0x49479c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004038b0
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x4947d6
cmp byte [ebp - 0xa], 0x31
jne 0x4947d4
mov bl, 1
jmp 0x4947d6
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495ec8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00451148
test al, al
je 0x495f87
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
jmp 0x495f65
cmp word [esi + 0x65a], 0
je 0x495f19
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x65c]
call dword [esi + 0x658]
movzx eax, byte [esi + 0x650]
or al, byte [ebp - 9]
jne 0x495f3c
cmp dword [ebp - 4], 0
jbe 0x495f38
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x495f3c
xor ebx, ebx
jmp 0x495f3e
mov bl, 1
test bl, bl
jne 0x495f87
mov eax, dword [0x59207c]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x495f87
mov eax, dword [0x59207c]
mov eax, dword [eax]
call fcn.0046744c
push 1
call sub.KERNEL32.DLL_Sleep_1
test esi, esi
je 0x495f87
cmp byte [esi + 0x5f0], 0
jne 0x495f87
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046da5c
cmp eax, 4
jne 0x495ef6
mov byte [esi + 0x650], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b111c
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x4b1135
add esp, 0xfffffff0
call fcn.00404370
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b11aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0041fe1c
xor edx, edx
mov eax, esi
call fcn.004b131c
xor edx, edx
mov eax, esi
call fcn.004b1340
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.0041a468
lea edx, [ebp - 0x10]
lea eax, [esi + 0x18]
call fcn.004133b0
mov byte [esi + 0x39], 0
mov byte [esi + 0x30], 1
lea eax, [esi + 0x10]
call fcn.00404f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b11b1
lea eax, [ebp - 0x10]
call fcn.00412f98
ret
Function at 0x4c20e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edi, dword [eax + 8]
sub edi, 1
jno 0x4c20ff
call fcn.00403edc
test edi, edi
jl 0x4c21cd
inc edi
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00429a40
mov esi, eax
mov dl, 1
mov eax, dword [0x4ca958]
call fcn.004caca0
mov ebx, eax
movzx eax, byte [esi + 4]
mov byte [ebx + 4], al
movzx eax, byte [esi + 5]
mov byte [ebx + 5], al
movzx eax, byte [esi + 6]
mov byte [ebx + 6], al
movzx eax, byte [esi + 7]
mov byte [ebx + 7], al
movzx eax, byte [esi + 8]
mov byte [ebx + 8], al
movzx eax, byte [esi + 9]
mov byte [ebx + 9], al
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov edx, dword [esi + 0x10]
call fcn.00404fe8
lea eax, [ebx + 0x14]
mov edx, dword [esi + 0x14]
call fcn.00404fe8
lea eax, [ebx + 0x18]
mov edx, dword [esi + 0x18]
call fcn.00404fe8
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov edx, dword [esi + 0x24]
call fcn.00404fe8
lea eax, [ebx + 0x28]
mov edx, dword [esi + 0x28]
call fcn.00404fe8
movzx eax, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
movzx eax, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
movzx eax, byte [esi + 0x2e]
mov byte [ebx + 0x2e], al
movzx eax, byte [esi + 0x2f]
mov byte [ebx + 0x2f], al
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004299e8
inc dword [ebp - 0xc]
dec edi
jne 0x4c210f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db5d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4db5e5
add esp, 0xfffffff0
call fcn.00404370
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004071fc
xor eax, eax
push ebp
push 0x4db68f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
mov byte [ebx + 0x14], 0
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
lea eax, [ebx + 0x20]
call fcn.00407188
mov byte [ebx + 0x24], 0
xor eax, eax
mov dword [ebx + 0x28], eax
mov byte [ebx + 0x2c], 0
mov byte [ebx + 0x2d], 0
lea eax, [ebx + 0x30]
call fcn.00404f94
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.004071a0
mov dl, 1
mov eax, dword [0x41d160]
call fcn.00403fdc
mov dword [ebx + 0x34], eax
mov dl, 1
mov eax, dword [0x41d160]
call fcn.00403fdc
mov edi, eax
mov dword [ebx + 0x3c], edi
test esi, esi
je 0x4db679
mov eax, edi
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db696
lea eax, [ebp - 4]
call fcn.00407188
ret
Function at 0x500404
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x500419
add esp, 0xfffffff0
call fcn.00404370
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004071fc
mov eax, dword [ebp + 0xc]
call fcn.004071fc
mov eax, dword [ebp + 8]
call fcn.004071fc
xor eax, eax
push ebp
push 0x5004cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
call fcn.004d2740
lea eax, [edi + 0x34]
mov edx, dword [ebp - 4]
call fcn.004071a0
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
jle 0x5004a7
mov ebx, 1
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x5004a3
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
add al, 0xfe
sub al, 4
jae 0x5004a3
mov dword [edi + 0x38], ebx
jmp 0x5004a7
inc ebx
dec esi
jne 0x500480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5004d4
lea eax, [ebp - 4]
call fcn.00407188
lea eax, [ebp + 8]
call fcn.00407188
lea eax, [ebp + 0xc]
call fcn.00407188
ret

Function at 0x52a3b0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x52a49f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 3
mov edx, 7
mov eax, ebx
call fcn.0052a0cc
test al, al
je 0x52a3ef
lea eax, [ebp - 4]
mov edx, 0x52a4b8
call fcn.0040502c
jmp 0x52a3fc
lea eax, [ebp - 4]
mov edx, 0x52a554
call fcn.0040502c
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x238]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0xc]
test al, al
jne 0x52a44f
lea edx, [ebp - 0x14]
mov eax, dword [0x5926b0]
call fcn.00407720
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4090c4]
call fcn.0040f11c
call fcn.00404984
mov edx, 0x52a590
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov ebx, eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a4a6
lea eax, [ebp - 0x14]
call fcn.00404f94
lea eax, [ebp - 0x10]
call fcn.00407188
lea eax, [ebp - 0xc]
call fcn.00407188
lea eax, [ebp - 8]
call fcn.00407188
lea eax, [ebp - 4]
call fcn.00404f94
ret
Function at 0x53d184
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x53d199
add esp, 0xfffffff0
call fcn.00404370
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004071fc
mov eax, dword [ebp + 0xc]
call fcn.004071fc
mov eax, dword [ebp + 8]
call fcn.004071fc
xor eax, eax
push ebp
push 0x53d24d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
call fcn.004d2740
lea eax, [edi + 0x34]
mov edx, dword [ebp - 4]
call fcn.004071a0
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
jle 0x53d227
mov ebx, 1
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x53d223
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
add al, 0xfe
sub al, 4
jae 0x53d223
mov dword [edi + 0x38], ebx
jmp 0x53d227
inc ebx
dec esi
jne 0x53d200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d254
lea eax, [ebp - 4]
call fcn.00407188
lea eax, [ebp + 8]
call fcn.00407188
lea eax, [ebp + 0xc]
call fcn.00407188
ret

Function at 0x55528c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x5552a6
add esp, 0xfffffff0
call fcn.00404370
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004071fc
mov eax, dword [ebp + 0xc]
call fcn.004071fc
mov eax, dword [ebp + 8]
call fcn.004071fc
xor eax, eax
push ebp
push 0x55539e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
call fcn.004d2740
lea edx, [ebp - 0xc]
mov eax, dword [0x5523d4]
call fcn.005524f4
mov edx, dword [ebp - 0xc]
lea eax, [edi + 0x30]
call fcn.004071a0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0040730c
push 0x5553cc
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0040730c
push 1
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
call fcn.0040730c
xor eax, eax
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
jle 0x555370
mov ebx, 1
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x55536c
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
add al, 0xfe
sub al, 4
jae 0x55536c
mov dword [edi + 0x34], ebx
jmp 0x555370
inc ebx
dec esi
jne 0x555349
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5553a5
lea eax, [ebp - 0xc]
call fcn.00407188
lea eax, [ebp - 4]
call fcn.00407188
lea eax, [ebp + 8]
call fcn.00407188
lea eax, [ebp + 0xc]
call fcn.00407188
ret