joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9140
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4d9284
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [eax + 0xc], 0
jne 0x4d9183
lea edx, [ebp - 0x1c]
push edx
xor ecx, ecx
mov edx, 0x4d929c
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x4d9269
cmp byte [ebp + 8], 0
je 0x4d91ac
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 8]
push edx
push 0x4d92d0
mov eax, dword [eax + 8]
push eax
call fcn.0051f3c8
add esp, 0x18
jmp 0x4d91cd
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 8]
push edx
push 0x4d9350
mov eax, dword [eax + 8]
push eax
call fcn.0051f3c8
add esp, 0x18
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
add edi, 4
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x4d9259
mov dword [ebp - 0x18], eax
mov ebx, 0x4d9398
test ebx, ebx
je 0x4d91f3
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x20]
mov edx, dword [edi]
call fcn.00405014
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x4d9209
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x24]
mov edx, dword [edi]
call fcn.00405014
mov eax, dword [ebp - 0x24]
call fcn.004052ac
push eax
push ebx
mov eax, 0x4d9398
call fcn.004052ac
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
je 0x4d9251
lea eax, [ebp - 0x28]
mov edx, dword [edi]
call fcn.00405014
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add edi, 4
dec dword [ebp - 0x18]
jne 0x4d91e5
cmp dword [ebp - 8], 0
je 0x4d9269
mov eax, dword [ebp - 8]
push eax
call fcn.0051f554
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d928b
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404e30
ret

Function at 0x4e0b7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test ecx, ecx
jle 0x4e0ba6
mov ebx, eax
shl ebx, 3
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
movzx ebx, byte [ebx + 0x56b784]
xor eax, ebx
dec ecx
test ecx, ecx
jg 0x4e0b8c
pop ebx
pop ebp
ret
Function at 0x5427d4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
cmp dword [ebp + 0x18], 0
je 0x542856
mov edx, dword [ebx + 0x10]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push str.CREATE_TABLE___w_.__w_node__nodeno_INTEGER_PRIMARY_KEY__data_BLOB__CREATE_TABLE___w_.__w_rowid__rowid_INTEGER_PRIMARY_KEY__nodeno_INTEGER__CREATE_TABLE___w_.__w_parent__nodeno_INTEGER_PRIMARY_KEY__parentnode_INTEGER__INSERT_INTO__q._q_node_VALUES_1__zeroblob__d__
call fcn.004def48
add esp, 0x28
mov edi, eax
test edi, edi
jne 0x54282f
mov eax, 7
jmp 0x54290f
push 0
push 0
push 0
push edi
mov edx, dword [ebp + 0xc]
push edx
call fcn.00515034
add esp, 0x14
mov esi, eax
push edi
call fcn.004dd864
pop ecx
test esi, esi
je 0x542856
mov eax, esi
jmp 0x54290f
lea edx, [ebx + 0x234]
lea ecx, [ebx + 0x238]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
lea ecx, [ebx + 0x23c]
lea eax, [ebx + 0x240]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
lea edx, [ebx + 0x244]
lea ecx, [ebx + 0x248]
mov dword [ebp - 0x1c], edx
lea eax, [ebx + 0x24c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
lea edx, [ebx + 0x250]
add ebx, 0x254
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
xor eax, eax
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov edi, 0x57028c
jmp 0x542903
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004def48
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x5428ed
push 0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push edx
push 0xffffffffffffffff
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0051960c
add esp, 0x14
mov esi, eax
jmp 0x5428f2
mov esi, 7
push ebx
call fcn.004dd864
pop ecx
inc dword [ebp - 4]
add dword [ebp - 8], 4
add edi, 4
cmp dword [ebp - 4], 9
jge 0x54290d
test esi, esi
je 0x5428b9
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x542978
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
je 0x5429f8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebx + 0x20]
push edx
push str.PRAGMA__Q.page_size
call fcn.004def48
add esp, 8
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 8]
push edx
call fcn.00542918
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x5429d9
mov eax, dword [ebp - 4]
add eax, 0xffffffc0
mov dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x18]
mov ecx, edx
shl edx, 4
add edx, ecx
lea edx, [edx + edx*2]
add edx, 4
cmp eax, edx
jle 0x542a43
mov dword [ebx + 0x10], edx
jmp 0x542a43
mov eax, dword [ebp + 8]
push eax
call fcn.0052dab4
pop ecx
push eax
push 0x576a10
call fcn.004def48
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
jmp 0x542a43
mov ecx, dword [ebx + 0x24]
push ecx
mov ecx, dword [ebx + 0x20]
push ecx
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.004def48
add esp, 0xc
mov edi, eax
add ebx, 0x10
push ebx
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00542918
add esp, 0xc
mov esi, eax
test esi, esi
je 0x542a43
mov eax, dword [ebp + 8]
push eax
call fcn.0052dab4
pop ecx
push eax
push 0x576a4c
call fcn.004def48
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push edi
call fcn.004dd864
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x543058
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x545198
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x576e48], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x545272
cmp dword [0x576e44], 0
jne 0x545272
cmp dword [0x576ed0], 0
je 0x54522c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00545db4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x545212
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00545db4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x545212
lea ebx, [ebp - 0x84]
jmp 0x545213
inc ebx
call fcn.00545150
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x5452ad
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x576e4c
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.005443ec
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x576e4f
push ebx
call sub.kernel32.dll_WriteFile_1
jmp 0x5452ad
cmp dword [0x576e44], 0
je 0x54528c
cmp dword [0x576e44], 0xffffffff
je 0x5452ad
push esi
call dword [0x576e44]
pop ecx
mov eax, dword [0x576e48]
test eax, eax
je 0x5452ad
cmp dword [0x576e48], 0xffffffff
je 0x5452ad
cmp byte [eax], 0
je 0x5452ad
push esi
push eax
call fcn.00545e5c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x545cf0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x545e5c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
jne 0x545e89
jmp 0x545ec0
call fcn.00545e0c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.005443ec
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.005443ec
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5467ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x54696b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [esi + 0x370]
call fcn.00404ea4
jmp 0x54692d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x546980
mov edx, 0x54698c
mov eax, dword [ebp - 4]
call fcn.0047f740
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00404ea4
cmp dword [ebp - 8], 0
je 0x546942
push 0
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x18], 0x2f
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047f474
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0047f3b4
mov ebx, eax
sub ebx, 0x64
je 0x546887
dec ebx
je 0x5468d5
sub ebx, 3
je 0x546923
jmp 0x54692d
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00546f10
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5777f0]
sub eax, dword [edx]
mov edx, dword [0x577a48]
mov dword [edx], eax
mov eax, dword [0x5779f0]
mov eax, dword [eax]
mov edx, dword [0x577a48]
cmp eax, dword [edx]
jae 0x5468c6
mov eax, dword [0x577a48]
mov eax, dword [eax]
mov edx, dword [0x5779f0]
mov dword [edx], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5777f0]
mov dword [edx], eax
jmp 0x54692d
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.0054711c
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5777f0]
sub eax, dword [edx]
mov edx, dword [0x577a48]
mov dword [edx], eax
mov eax, dword [0x5779f0]
mov eax, dword [eax]
mov edx, dword [0x577a48]
cmp eax, dword [edx]
jae 0x546914
mov eax, dword [0x577a48]
mov eax, dword [eax]
mov edx, dword [0x5779f0]
mov dword [edx], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5777f0]
mov dword [edx], eax
jmp 0x54692d
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.005473b8
mov edx, dword [ebp - 4]
mov eax, 0x546980
call fcn.004053f8
test eax, eax
jg 0x54681c
lea eax, [esi + 0x370]
mov edx, dword [ebp - 4]
call fcn.00404e60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546972
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404e30
ret
Function at 0x553f9c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55414c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
call fcn.004d7108
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov dl, 1
call fcn.004d7964
xor eax, eax
push ebp
push 0x554122
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x554168
call fcn.0040b194
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00409570
mov eax, dword [ebp - 0x20]
mov edx, 0x5541dc
call fcn.0047fcbc
dec eax
jle 0x554036
call fcn.0040484c
jmp 0x554129
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004d8adc
mov esi, eax
cmp dword [ebp - 0x14], 0
je 0x5540a2
cmp esi, 0x65
je 0x5540a2
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004d9c08
mov edi, eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004d9c08
mov ebx, eax
test ebx, ebx
jle 0x554090
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, edi
call fcn.004d77c8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.004d77b4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004d9050
mov esi, eax
cmp esi, 0x65
jne 0x554051
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
call fcn.0042117c
cmp edx, 0
jne 0x5540bb
cmp eax, 0x200
jbe 0x5540e2
jmp 0x5540bd
jle 0x5540e2
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
call fcn.004d7690
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
add eax, 0xc
call fcn.00404e60
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 1
jmp 0x554105
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
call fcn.004d7378
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, 0xc
call fcn.00404e60
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554129
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004d8d7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554153
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404e30
lea eax, [ebp - 4]
call fcn.00404e0c
ret
Function at 0x554df0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x555208
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0
je 0x5551d5
mov eax, dword [ebp - 0xc]
add eax, 0xc
call fcn.0040530c
mov dword [ebp - 0x14], eax
mov word [ebp - 0x1a], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x33], 0
jbe 0x5551d5
xor edx, edx
push ebp
push 0x5551cb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x554f00
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x24
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 4
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x555224
call fcn.0040b194
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00409570
mov eax, dword [ebp - 0x28]
mov edx, 0x55529c
call fcn.0047fcbc
dec eax
jle 0x554ec8
call fcn.0040484c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5551d5
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004d8adc
cmp dword [ebp - 0x18], 0
je 0x554ee7
cmp eax, 0x65
jne 0x554ee7
mov word [ebp - 0x1a], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554f07
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004d8d7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55520f
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.00404e30
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404e30
lea eax, [ebp - 4]
call fcn.00404e0c
ret
Function at 0x5589cc
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x558b41
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x558b58
call fcn.004053f8
test eax, eax
mov edi, dword [ebp - 4]
mov eax, edi
test eax, eax
je 0x558a0d
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jge 0x558a14
xor esi, esi
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005594dc
test al, al
jne 0x558a27
mov esi, 2
mov eax, dword [ebp - 4]
call fcn.0047fa94
test al, al
jne 0x558a35
xor esi, esi
xor ecx, ecx
mov eax, edi
test eax, eax
je 0x558a42
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jle 0x558b2b
mov eax, 1
mov edx, dword [ebp - 4]
movzx edx, byte [edx + eax - 1]
cmp dl, 0x20
je 0x558b08
cmp dl, 0x2f
je 0x558b08
cmp dl, 0x40
je 0x558b08
cmp dl, 0x3f
je 0x558b08
cmp dl, 0x27
je 0x558b08
cmp dl, 0x22
je 0x558b08
cmp dl, 0x5c
je 0x558b08
cmp dl, 0x2e
je 0x558b08
cmp dl, 0x2c
je 0x558b08
cmp dl, 0x3a
je 0x558b08
cmp dl, 0x3b
je 0x558b08
cmp dl, 0x60
je 0x558b08
cmp dl, 0x7e
je 0x558b08
cmp dl, 0x21
je 0x558b08
cmp dl, 0x23
je 0x558b08
cmp dl, 0x24
je 0x558b08
cmp dl, 0x25
je 0x558b08
cmp dl, 0x5e
je 0x558b08
cmp dl, 0x26
je 0x558b08
cmp dl, 0x2a
je 0x558b08
cmp dl, 0x28
je 0x558b08
cmp dl, 0x29
je 0x558b08
cmp dl, 0x2d
je 0x558b08
cmp dl, 0x5f
je 0x558b08
cmp dl, 0x2b
je 0x558b08
cmp dl, 0x3d
je 0x558b08
cmp dl, 0x7c
je 0x558b08
cmp dl, 0x5b
je 0x558b08
cmp dl, 0x7b
je 0x558b08
cmp dl, 0x5d
je 0x558b08
cmp dl, 0x7d
jne 0x558b0c
xor esi, esi
jmp 0x558b1f
cmp dl, 0xa1
jne 0x558b1d
test cl, cl
je 0x558b19
xor esi, esi
jmp 0x558b1f
mov cl, 1
jmp 0x558b1f
xor ecx, ecx
test esi, esi
je 0x558b2b
inc eax
dec edi
jne 0x558a51
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558b48
lea eax, [ebp - 4]
call fcn.00404e0c
ret
Function at 0x558b5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x558c5f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x558c30
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, 0x57e454
call fcn.00547a54
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x2c]
call fcn.00404e60
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 4]
call fcn.00404e60
push 0x8f
push 0x8f
lea eax, [ebp - 0x14]
push eax
mov cx, 0x8f
mov edx, 0x8f
mov ax, 0x9595
call fcn.004c4cc4
lea ecx, [ebp - 0x1c]
mov edx, dword [0x57e48c]
add edx, 0x3c
mov eax, 0x57e454
call fcn.004c4f1c
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x14]
call fcn.004c4e34
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
pop ecx
call fcn.00405134
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00559428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558c37
ret
Function at 0x5598b0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x5598b8
push ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x559bee
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xc], 0
je 0x559bae
mov byte [ebp - 0x19], 1
mov eax, dword [ebp - 0x18]
mov word [eax + 2], 0
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, 0x559c08
call fcn.0047f0ec
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 8]
call fcn.0047f290
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, 0x559c08
call fcn.0047f0ec
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 4]
call fcn.0047f290
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0xc]
call fcn.00404ea4
mov eax, dword [ebp - 0x18]
add eax, 0xc
xor edx, edx
call fcn.0040553c
mov eax, dword [ebp - 0x18]
add eax, 0xc
call fcn.00404e0c
xor eax, eax
push ebp
push 0x559a08
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
lea edx, [ebp - 0x44]
mov ecx, 1
mov eax, 0x559c14
call fcn.0040b194
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.00409570
mov eax, dword [ebp - 0x48]
mov edx, 0x559c9c
call fcn.0047fcbc
dec eax
jle 0x5599c9
call fcn.0040484c
jmp 0x559bae
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004d8adc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 0
je 0x5599ef
cmp dword [ebp - 0x24], 0x65
jne 0x5599ef
mov eax, dword [ebp - 0x18]
mov word [eax + 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559a0f
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x14]
call fcn.004d8d7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559bf5
lea eax, [ebp - 0x7c]
call fcn.00404e0c
lea eax, [ebp - 0x54]
call fcn.00404e0c
lea eax, [ebp - 0x48]
call fcn.00404e0c
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00404e30
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404e30
ret
Function at 0x55a6d4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x55a8f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
je 0x55a8c9
mov byte [ebp - 0x15], 1
push 0
lea eax, [ebp - 8]
push eax
mov byte [ebp - 0x20], 0x2f
lea ecx, [ebp - 0x20]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
call fcn.0047f474
mov eax, dword [ebp - 0x14]
add eax, 0xc
xor edx, edx
call fcn.0040553c
mov eax, dword [ebp - 0x14]
add eax, 0xc
call fcn.00404e0c
mov eax, dword [ebp - 0x14]
mov word [eax + 2], 1
xor edx, edx
push ebp
push 0x55a7eb
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, 0x55a90c
call fcn.0040b194
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00409570
mov eax, dword [ebp - 0x34]
mov edx, 0x55a994
call fcn.0047fcbc
dec eax
jle 0x55a7b0
call fcn.0040484c
jmp 0x55a8c9
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004d8adc
cmp dword [ebp - 0x1c], 0
je 0x55a7d2
cmp eax, 0x65
jne 0x55a7d2
mov eax, dword [ebp - 0x14]
mov word [eax + 2], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a7f2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.004d8d7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a8fb
lea eax, [ebp - 0x5c]
call fcn.00404e0c
lea eax, [ebp - 0x34]
call fcn.00404e0c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e30
ret