joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b06a8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x4f9868]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4b06e4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4b06fc
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b06f5
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004031bc
xor edx, edx
mov eax, 0x4f9a68
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4b0766
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4b071a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4b09a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4b09bd
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4b09b6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4b09cf
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b09c8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004b0598
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b09e9
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004b06a8
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4b0a6e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4b0a8b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004b0628
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b0ab4
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b0acc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4b0ae5
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4b0ade
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4b0af9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b0490
test bl, bl
jne 0x4b0bcc
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4fdd00
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b0b30
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b0b44
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b09a4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4b0b76
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4b0b25
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b0b99
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4b0baa
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b0bbe
jmp 0x4b0c87
cmp bl, 1
jne 0x4b0c87
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4fdd5a
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b0bec
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b0c00
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b09a4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4b0c32
sub ebx, 6
inc dword [ebp - 8]
jne 0x4b0be1
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4b0c59
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4b0c6a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4b0c7e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b0514
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4b0ff4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d20
xor eax, eax
push ebp
push 0x4b108a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b38
mov ecx, eax
test ecx, ecx
jle 0x4b1063
mov esi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x4f9ae0]
shr ebx, 8
and ebx, 0xffffff
xor eax, ebx
mov ebx, eax
inc esi
dec ecx
jne 0x4b102d
mov ecx, dword [ebp - 8]
mov eax, ebx
not eax
mov edx, 8
call fcn.00409558
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1091
lea eax, [ebp - 4]
call fcn.00404880
ret

Function at 0x4b45df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4faa8e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b4637
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4faaaf
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b462d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4b463b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4d28c4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4d28cc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2abe
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2ad4
mov eax, esi
call fcn.004d04d0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004048d4
lea ecx, [ebp - 0x10]
mov edx, 0x4d2ae8
mov eax, esi
call fcn.004d04d0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004048d4
lea ecx, [ebp - 0x14]
mov edx, 0x4d2b00
mov eax, esi
call fcn.004d04d0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004048d4
lea ecx, [ebp - 0x18]
mov edx, 0x4d2b1c
mov eax, esi
call fcn.004d04d0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004048d4
lea ecx, [ebp - 0x1c]
mov edx, 0x4d2b38
mov eax, esi
call fcn.004d04d0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004048d4
lea ecx, [ebp - 0x24]
mov edx, 0x4d2b50
mov eax, esi
call fcn.004d04d0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409170
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004095d0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4d2b68
mov eax, esi
call fcn.004d04d0
mov eax, dword [ebp - 0x28]
call fcn.004ca00c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4d2b78
mov eax, esi
call fcn.004d04d0
mov eax, dword [ebp - 0x2c]
call fcn.004ca00c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4d2b90
mov eax, esi
call fcn.004d04d0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004095d0
inc eax
je 0x4d2a61
lea ecx, [ebp - 0x34]
mov edx, 0x4d2b90
mov eax, esi
call fcn.004d04d0
mov eax, dword [ebp - 0x34]
call fcn.00409594
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b0d0
fstp qword [ebp - 0x3c]
wait
call fcn.0040b494
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4d2a7c
lea ecx, [ebp - 0x40]
mov edx, 0x4d2b90
mov eax, esi
call fcn.004d04d0
mov eax, dword [ebp - 0x40]
call fcn.004ca00c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4d2ba0
mov eax, esi
call fcn.004d04d0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004048d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2ac5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048a4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048a4
ret
Function at 0x4d9930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4d998a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004d9920
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004c8b14
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004c8714
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9991
lea eax, [ebp - 4]
call fcn.00404880
ret

Function at 0x4de4b4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x4deb45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0x318]
mov eax, dword [eax + 0x22c]
xor edx, edx
call fcn.00478c1c
mov eax, dword [eax + 8]
mov edx, 0x4deb5c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx]
mov eax, dword [eax + 0x318]
mov eax, dword [eax + 0x22c]
xor edx, edx
call fcn.00478c1c
mov eax, dword [eax + 8]
mov edx, 0x4deb5c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx]
mov eax, dword [eax + 0x318]
mov eax, dword [eax + 0x22c]
xor edx, edx
call fcn.00478c1c
mov eax, dword [eax + 8]
mov edx, 0x4deb5c
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4deb6c
lea edx, [ebp - 0xc]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c34d8
push dword [ebp - 0xc]
push 0x4deba0
lea edx, [ebp - 0x10]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c34ec
push dword [ebp - 0x10]
push 0x4debb4
lea edx, [ebp - 0x14]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c3464
push dword [ebp - 0x14]
push 0x4debcc
lea eax, [ebp - 8]
mov edx, 7
call fcn.00404bf8
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
mov edx, dword [eax + 0x31c]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c3164
test al, al
je 0x4deb2a
jmp 0x4deb15
Function at 0x4e23f8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4e2426
mov eax, ebx
call fcn.004e2eb0
cmp dword [ebx + 0x3c], 0
je 0x4e241f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4e2497
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4e2489
cmp dword [ebx + 8], 0
je 0x4e2448
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4e245a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e2489
cmp dword [ebx + 8], 0
je 0x4e243b
cmp eax, 3
je 0x4e246d
dec eax
jne 0x4e243b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e243b
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4e243b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4e24b5
cmp dword [ebx + 0x10], 0xcc
je 0x4e24b5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e24c0
pop ebx
ret
Function at 0x4f2fac
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4f2fb4
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f31dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0xc8]
inc eax
je 0x4f31c1
mov esi, dword [ebx + 0x2fc]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [esi + 0x218]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409170
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4f31f4
call fcn.00404e74
mov esi, eax
mov edx, dword [ebp - 8]
mov eax, 0x4f3200
call fcn.00404e74
sub esi, eax
dec esi
push esi
mov edx, dword [ebp - 8]
mov eax, 0x4f3200
call fcn.00404e74
mov edx, eax
inc edx
mov eax, dword [ebp - 8]
pop ecx
call fcn.00404d90
push 0x4f320c
push dword [ebp - 4]
push 0x4f3244
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404bf8
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
mov edx, dword [ebx + 0x318]
call fcn.004c3164
test al, al
je 0x4f31c1
mov eax, dword [ebx + 0x318]
call fcn.0049a994
mov eax, dword [ebx + 0x308]
mov edx, dword [eax]
call dword [edx + 0xdc]
mov edx, 0x4f3250
mov eax, dword [ebx + 0x318]
call fcn.00499604
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4f3260
call fcn.00404b84
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x308]
call fcn.004487c0
mov edx, 0x4f327c
mov eax, dword [ebx + 0x318]
call fcn.00499604
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x248]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4f328c
lea eax, [ebp - 0x24]
push eax
mov edx, 0x4f32b4
mov eax, dword [ebx + 0x318]
call fcn.00499604
lea edx, [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x28]
mov ecx, 4
xor edx, edx
call fcn.00404d90
push dword [ebp - 0x24]
push 0x4f32c4
lea eax, [ebp - 0x2c]
push eax
mov edx, 0x4f32b4
mov eax, dword [ebx + 0x318]
call fcn.00499604
lea edx, [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x30]
mov ecx, 2
mov edx, 5
call fcn.00404d90
push dword [ebp - 0x2c]
push 0x4f32d0
lea eax, [ebp - 0x34]
push eax
mov edx, 0x4f32b4
mov eax, dword [ebx + 0x318]
call fcn.00499604
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x38]
mov ecx, 2
mov edx, 7
call fcn.00404d90
push dword [ebp - 0x34]
push 0x4f32dc
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404bf8
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x248]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f31e3
lea eax, [ebp - 0x38]
mov edx, 0xe
call fcn.004048a4
ret
Function at 0x4f4f64
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4f4f6c
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0x4fbe64]
xor eax, eax
push ebp
push 0x4f50f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x4f50c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f5110
lea edx, [ebp - 0x10]
mov eax, dword [esi]
call fcn.004c3464
push dword [ebp - 0x10]
push 0x4f5140
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404bf8
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi]
mov edx, ebx
call fcn.004c3048
lea edx, [ebp - 0x14]
mov eax, dword [esi]
call fcn.004c3464
cmp dword [ebp - 0x14], 0
je 0x4f5025
push 0x4f5158
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.004c3464
push dword [ebp - 0x1c]
push 0x4f5180
push 0x4f5198
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.004c4324
push dword [ebp - 0x20]
push 0x4f51e0
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404bf8
mov ecx, dword [ebp - 0x18]
mov eax, dword [esi]
mov edx, ebx
call fcn.004c3048
mov eax, dword [esi]
mov ecx, 0x4f51ec
mov edx, ebx
call fcn.004c3048
lea edx, [ebp - 0x28]
mov eax, dword [esi]
call fcn.004c34b4
mov eax, dword [ebp - 0x28]
call fcn.0040cab8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, 0x4f521c
call fcn.0040c2b0
mov eax, dword [ebp - 0x24]
call fcn.00409594
cmp eax, 5
jge 0x4f508c
push 0x4f5228
lea edx, [ebp - 0x2c]
mov eax, dword [esi]
call fcn.004c3464
push dword [ebp - 0x2c]
push 0x4f51e0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404bf8
jmp 0x4f50b0
push 0x4f52a4
lea edx, [ebp - 0x30]
mov eax, dword [esi]
call fcn.004c3464
push dword [ebp - 0x30]
push 0x4f51e0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404bf8
mov eax, dword [esi]
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.004c3048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f50d7
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f50fd
lea eax, [ebp - 0x30]
mov edx, 0xb
call fcn.004048a4
ret
Function at 0x4f5e1c
Capabilities:
Create process on windows
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4f5e24
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404d20
xor eax, eax
push ebp
push 0x4f5fa1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x4f5fb8
lea edx, [ebp - 0x10]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c3464
push dword [ebp - 0x10]
push 0x4f5ff4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404bf8
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
mov edx, dword [esi + 0x31c]
call fcn.004c33a0
test eax, eax
jne 0x4f5ea2
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
mov edx, 0x4f6000
call fcn.004c2d40
jmp 0x4f5f86
lea edx, [ebp - 0x18]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c42fc
push dword [ebp - 0x18]
push 0x4f6034
lea edx, [ebp - 0x1c]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c34b4
push dword [ebp - 0x1c]
push 0x4f6034
lea edx, [ebp - 0x20]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c3464
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404bf8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.00409170
push 1
lea edx, [ebp - 0x28]
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
call fcn.00468dec
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0040995c
mov eax, dword [ebp - 0x24]
call fcn.00404d30
push eax
mov eax, dword [ebp - 8]
call fcn.00404d30
push eax
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00402b3c
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040995c
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.00404b40
mov eax, dword [ebp - 0x2c]
call fcn.00404d30
push eax
push 0x4f6038
mov eax, esi
call fcn.0044ef34
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x4f5f7b
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
mov edx, 0x4f6048
call fcn.004c2d40
jmp 0x4f5f86
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5fa8
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.004048a4
ret
Function at 0x4f71f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4f71fc
push ecx
mov eax, 0x4f6d8c
call fcn.00407028
xor eax, eax
push ebp
push 0x4f7393
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
call fcn.0046877c
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
mov edx, 0x4f73a8
call fcn.00468388
mov ecx, dword [0x4fbfcc]
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
mov edx, dword [0x4dcc00]
call fcn.00468794
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
mov edx, dword [0x4f3fbc]
call fcn.004c3c5c
cmp eax, 1
jne 0x4f7285
mov ecx, dword [0x4fbee0]
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
mov edx, dword [0x4f5398]
call fcn.00468794
jmp 0x4f736c
cmp eax, 3
jne 0x4f736c
push 0xa
lea edx, [ebp - 0x18]
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
call fcn.00468dec
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040995c
mov eax, dword [ebp - 0x14]
call fcn.00404d30
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c42fc
push dword [ebp - 0x24]
push 0x4f73d4
lea edx, [ebp - 0x28]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c34b4
push dword [ebp - 0x28]
push 0x4f73d4
lea edx, [ebp - 0x2c]
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
call fcn.004c3464
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404bf8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409170
mov eax, dword [ebp - 0x1c]
call fcn.00404d30
push eax
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00402b3c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.0040995c
lea eax, [ebp - 0x30]
mov edx, 0x4f73e0
call fcn.00404b40
mov eax, dword [ebp - 0x30]
call fcn.00404d30
push eax
push 0x4f73ec
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x4f736c
mov eax, dword [0x4fbe64]
mov eax, dword [eax]
mov edx, 0x4f73fc
call fcn.004c2cd8
jmp 0x4f7378
mov eax, dword [0x4fc3cc]
mov eax, dword [eax]
call fcn.00468814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f739a
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.004048a4
ret