joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039ea
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1006260]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x1003a7f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003a08
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x1003a7f
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003a39
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x1003a5f
cmp cx, 0x2f
jne 0x1003a66
xor ecx, ecx
mov word [eax], cx
jmp 0x1003a4e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1003a81
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010043f6
leave
ret
Function at 0x1003a92
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1006260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1003ad2
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1003ae7
sub eax, ecx
sar eax, 1
push 0x1001b28
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x1003b42
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1003ccd
mov ecx, 0x1001b24
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003b73
test dx, dx
je 0x1003b6f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003b73
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003b4d
xor eax, eax
jmp 0x1003b78
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003c93
mov ecx, 0x1001b1c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003bb1
test dx, dx
je 0x1003bad
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003bb1
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003b8b
xor eax, eax
jmp 0x1003bb6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003c93
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x1003bf7
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01003f51
test eax, eax
je 0x1003c93
cmp dword [edi + 0xc], 0
je 0x1003c70
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01003917
test eax, eax
je 0x1003c70
test byte [ebp - 0x75c], 0x10
je 0x1003c93
lea esi, [ebp - 0x30c]
call fcn.010039ea
test eax, eax
je 0x1003c93
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.0100375c
jmp 0x1003c93
lea esi, [ebp - 0x20c]
call fcn.010039ea
test eax, eax
je 0x1003c93
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01003835
mov esi, eax
test esi, esi
jne 0x1003cb0
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x1003b42
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1003ccb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1003ccb
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010043f6
leave
ret 8
Function at 0x10043e7
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10048a8
call fcn.010045d4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100786c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10041fc
cmp eax, esi
jne 0x10041ef
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10041ff
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10041d6
xor esi, esi
inc esi
mov eax, dword [0x1007868]
cmp eax, esi
jne 0x1004212
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100424d
mov eax, dword [0x1007868]
test eax, eax
jne 0x1004247
mov dword [0x1007868], esi
push 0x1001188
push 0x100117c
call fcn.01004153
pop ecx
pop ecx
test eax, eax
je 0x100424d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1004317
mov dword [0x10062d4], esi
mov eax, dword [0x1007868]
cmp eax, esi
jne 0x1004271
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1007868], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100427e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1007870], ebx
je 0x100429f
push 0x1007870
call fcn.01004549
pop ecx
test eax, eax
je 0x100429f
push ebx
push 2
push ebx
call dword [0x1007870]
push dword [0x10062bc]
push dword [0x10062c0]
push dword [0x10062b8]
call fcn.0100257d
add esp, 0xc
mov dword [0x10062d0], eax
cmp dword [0x10062c4], ebx
jne 0x10042fd
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10062d4], ebx
jne 0x100430b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10062d0]
call fcn.01004619
ret
call fcn.01004721
jmp 0x10041b4
Function at 0x74d578
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
call sub.KERNEL32.DLL_ClearCommError
jmp 0x74d5c9
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
call sub.KERNEL32.DLL_ClearCommError
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jg 0x74d5e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp eax, dword [ebp - 8]
jl 0x74d5af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp eax, dword [ebp - 8]
jl 0x74d5f0
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x7665dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ClearCommError
jmp 0x76661b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ClearCommError
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jg 0x766630
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
jl 0x76660a
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
jl 0x76663c
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x7693c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x769482
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x190
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x769490
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x76946c
mov dword [ebp - 0x10], 0x20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x7694a8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 0x14], 2
je 0x76946c
cmp dword [ebp - 0x14], 0
jne 0x76943c
cmp dword [ebp - 0xc], 1
je 0x769443
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x76946c
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x38]
mov ecx, 0x20
call fcn.004055d4
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x18]
call fcn.00403b14
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], 0
je 0x76946c
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x769489
lea eax, [ebp - 0x3c]
call fcn.00405364
ret

Function at 0x76a048
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x76a118
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8297cc]
cmp dword [eax], 5
jl 0x76a078
mov eax, dword [0x82a2f4]
cmp dword [eax], 2
je 0x76a081
mov byte [ebp - 5], 1
jmp 0x76a102
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x76a130
push dword [ebp - 4]
push 0x76a15c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004056e4
mov eax, dword [ebp - 0x20]
call fcn.00405824
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x76a102
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x76a0ec
cmp word [ebp - 0x14], 0
jne 0x76a0f5
cmp dword [ebp - 0x1c], 0xea
jne 0x76a0f9
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76a11f
lea eax, [ebp - 0x20]
call fcn.00405364
ret
Function at 0x76f0e8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00490878
test al, al
je 0x76f243
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00490574
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetUpdateRect
test eax, eax
je 0x76f151
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_EqualRect
test eax, eax
je 0x76f151
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0076b9b0
jmp 0x76f243
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x76f231
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76f238
cmp dword [ebp - 0xc], 0
je 0x76f214
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x76f223
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
mov esp, ebp
pop ebp
ret
Function at 0x774200
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
call fcn.007741ac
xor eax, eax
mov dword [ebp - 0x11], eax
xor eax, eax
mov dword [ebp - 0xd], eax
call fcn.00773f28
mov eax, 0x830998
xor ecx, ecx
mov edx, 0x4c
call fcn.0040389c
mov eax, dword [ebp - 4]
mov dword [0x830998], eax
mov eax, dword [ebp - 8]
mov dword [0x83099c], eax
cmp byte [ebp - 9], 0
je 0x774255
cmp dword [0x8309ec], 0
jne 0x774259
xor eax, eax
jmp 0x77425b
mov al, 1
mov byte [0x8309a0], al
mov al, byte [ebp + 8]
mov byte [0x8309d4], al
push 0x8309cc
call sub.user32.dll_GetCursorPos
push 0x8309b4
mov eax, dword [0x830998]
push eax
call sub.user32.dll_GetClientRect
push 2
push 0x8309b4
push 0
mov eax, dword [0x830998]
push eax
call sub.user32.dll_MapWindowPoints
lea eax, [ebp - 0x30]
push eax
mov eax, dword [0x830998]
push eax
call sub.user32.dll_GetWindowRect
push 3
push 0
mov eax, dword [0x830998]
push eax
call sub.user32.dll_GetDCEx
mov dword [0x8309a8], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
mov dword [0x8309c4], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
mov dword [0x8309c8], eax
mov eax, dword [0x8309c8]
push eax
mov eax, dword [0x8309c4]
push eax
mov eax, dword [0x8309a8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [0x8309b0], eax
mov eax, dword [0x8309a8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [0x8309ac], eax
mov eax, dword [0x8309b0]
push eax
mov eax, dword [0x8309ac]
push eax
call sub.gdi32.dll_SelectObject
push 0x1e
mov eax, dword [0x8309ac]
push eax
push 0x317
mov eax, dword [0x830998]
push eax
call sub.user32.dll_SendMessageA
cmp byte [0x8309a0], 0
je 0x774393
push 0xffffffffffffffec
mov eax, dword [0x830998]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [0x830998]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x8309a4], 0x20
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x1c], 0
mov al, byte [0x8309a4]
mov byte [ebp - 0x1a], al
push 2
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x11]
push eax
mov eax, dword [0x8309ac]
push eax
push 0x8309c4
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, dword [0x830998]
push eax
call dword [0x8309ec]
jmp 0x7743c8
xor eax, eax
mov dword [0x8309a4], eax
push 0
push 0
push 0
push 0
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0x20], eax
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x830998]
push eax
call sub.user32.dll_SetWindowRgn
test eax, eax
jne 0x7743c8
mov eax, dword [ebp - 0x20]
push eax
call sub.gdi32.dll_DeleteObject
push 0x425f
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x830998]
push eax
call sub.user32.dll_SetWindowPos
push 0
push 4
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x773f74
xor edx, edx
xor eax, eax
call fcn.00405318
mov dword [0x830994], eax
cmp dword [0x830994], 0
jne 0x77440d
call fcn.0077410c
jmp 0x77441e
inc dword [0x8309e4]
mov eax, dword [0x830994]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esp, ebp
pop ebp
ret 4
Function at 0x786640
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x786858
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x344]
mov eax, dword [eax + 0x26c]
call fcn.0045f9b8
mov eax, dword [ebp - 4]
call fcn.00787238
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [0x82a2ac]
mov eax, dword [eax]
mov dx, 0xffef
call fcn.004a8dd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.006557ac
mov edx, 0x78686c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x7868c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.00655878
xor edx, edx
shr al, cl
sub eax, ebp
out dx, eax
dec dword [ebx - 0x7f7403bb]
add al, 3
add byte [eax], al
call fcn.004e4f3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e7638
jmp 0x786805
mov edx, 0x7868d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
test eax, eax
jne 0x78671b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e7954
jmp 0x786805
mov edx, 0x7868f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
add al, 3
add byte [eax], al
call fcn.004e61b4
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x344]
mov eax, dword [eax + 0x26c]
mov edx, dword [ebp - 8]
call fcn.0045fa3c
mov dword [ebp - 0xc], eax
mov edx, 0x786908
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
test eax, eax
jle 0x786779
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0045edc8
mov eax, 0x10
call fcn.00402bc0
mov dword [ebp - 0x10], eax
mov edx, 0x7868d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov edx, 0x7868c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov edx, 0x786908
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0045e734
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0045e9d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004e7954
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
cmp byte [eax + 0xa1], 0
je 0x7866ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [0x82a2ac]
mov eax, dword [eax]
xor edx, edx
call fcn.004a8dd4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.0078731c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78685f
lea eax, [ebp - 0x14]
call fcn.00405364
ret
Function at 0x786cf4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6638d0]
call fcn.00664edc
mov dword [ebp - 8], eax
mov eax, dword [0x829684]
mov eax, dword [eax]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 8]
call fcn.00694f2c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6528f0]
call fcn.006530b4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00674c88
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0xc]
call fcn.006557ac
mov edx, 0x786da0
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004e4f3c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 1]
mov eax, dword [ebp - 0xc]
call fcn.004e4f48
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00404414
mov eax, dword [ebp - 8]
call fcn.00404414
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x786dd4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6638d0]
call fcn.00664edc
mov dword [ebp - 8], eax
mov eax, dword [0x829684]
mov eax, dword [eax]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 8]
call fcn.00694f2c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6528f0]
call fcn.006530b4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00674c88
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0xc]
call fcn.006557ac
mov edx, 0x786e84
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004e4f3c
mov edx, 0x786ec4
mov eax, dword [ebp - 0xc]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004e4f48
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00404414
mov eax, dword [ebp - 8]
call fcn.00404414
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x7870d4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7871c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6638d0]
call fcn.00664edc
mov dword [ebp - 0xc], eax
mov eax, dword [0x829684]
mov eax, dword [eax]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 0xc]
call fcn.00694f2c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6528f0]
call fcn.006530b4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00674c88
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.006557ac
mov edx, 0x7871d8
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.004e4f3c
mov edx, 0x787214
mov eax, dword [ebp - 0x10]
call fcn.004e61b4
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004053b8
mov edx, 0x78722c
mov eax, dword [ebp - 0x10]
call fcn.004e61b4
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
call fcn.004e4f48
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.00404414
mov eax, dword [ebp - 0xc]
call fcn.00404414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7871cb
lea eax, [ebp - 0x14]
call fcn.00405364
ret
Function at 0x789770
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ClearCommError
jmp 0x7897af
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ClearCommError
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jg 0x7897c4
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
jl 0x78979e
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
jl 0x7897d0
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret