joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1100cd70
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
push eax
push 0x1105f29c
push 0x17
push 0
mov esi, ecx
push 0x1105f36c
mov dword [esi], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1100ce28
push edi
push str.rootcimv2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push esi
push 0
push 0
push 0
push 0
push 0
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push edi
push eax
call edx
test eax, eax
jne 0x1100ce11
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x1105c1d4
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x1100ce11
mov edx, dword [esi]
mov ecx, dword [eax]
push 0
push 0
push 3
push 2
push 0
push 0
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
pop edi
test eax, eax
je 0x1100ce28
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1100d0b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
push eax
push edi
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x58], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1100d1b3
push esi
call fcn.1101d040
mov ecx, dword [ebp - 0x68]
add esp, 4
push eax
push esi
push ecx
push edi
mov dword [ebp - 0x5c], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1100d1a7
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0x11052ca4
push ecx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x6c]
movzx edx, word [eax + 0xa]
mov dword [ebx], edx
movzx ecx, word [eax + 8]
mov edx, dword [ebp - 0x60]
mov dword [edx], ecx
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp - 0x70]
mov dword [edx], ecx
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
lea eax, [ebp - 0x54]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x54]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1100d173
sub eax, edx
sar eax, 1
cmp eax, dword [ebp + 0x10]
jae 0x1100d1a7
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x54]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1100d191
mov dword [ebp - 0x58], 1
mov edx, dword [ebp - 0x5c]
push edx
call fcn.110277ef
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x58]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.110278cd
mov esp, ebp
pop ebp
ret
Function at 0x1100f9d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x360]
call fcn.11022180
lea ecx, [ebp - 0x360]
mov dword [ebp - fcn.1100e530], vtable.CMSIDllEx.0
call fcn.110221d0
test eax, eax
jne 0x1100fa2b
lea ecx, [ebp - 0x360]
call fcn.110221b0
mov eax, 0x643
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push 0xfe
push eax
lea ecx, [ebp - 0x102]
push ecx
mov word [ebp - 0x104], ax
call fcn.110278e0
add esp, 0xc
lea edx, [ebp - 0x314]
push edx
lea eax, [ebp - 0x104]
push eax
push str.ROOMSPEC
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x314], 0x80
call fcn.11022280
test eax, eax
je 0x1100fa82
push eax
push str.ROOMSPEC
push str.GetProp__s__ERROR__d_n
jmp 0x1100fa93
lea ecx, [ebp - 0x104]
push ecx
push str.ROOMSPEC
push str.GetProp__s____s_n
call fcn.1100bc80
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30a]
push eax
mov word [ebp - 0x30c], dx
call fcn.110278e0
add esp, 0xc
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x30c]
push edx
push str.CLIENT32UPD_FILEPATH
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x310], 0x104
call fcn.11022280
test eax, eax
je 0x1100faf2
push eax
push str.CLIENT32UPD_FILEPATH
push str.GetProp__s__ERROR__d_n
jmp 0x1100fb03
lea eax, [ebp - 0x30c]
push eax
push str.CLIENT32UPD_FILEPATH
push str.GetProp__s____s_n
call fcn.1100bc80
add esp, 0xc
push esi
lea ecx, [ebp - 0x30c]
push ecx
push 0x11055208
call fcn.1100bc80
add esp, 8
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x30c]
push 0x11055204
push eax
call fcn.11029848
mov esi, eax
add esp, 8
test esi, esi
je 0x1100fbd1
lea ecx, [ebp - 0x334]
call fcn.110188d0
push 4
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x320], 0
mov word [ebp - 0x31c], 1
mov dword [ebp - 0x318], 0xffffffff
call fcn.11009740
push str._Client__n
lea ecx, [ebp - 0x338]
call fcn.110093d0
lea ecx, [ebp - 0x104]
push ecx
push 0xa
lea edx, [ebp - 0x338]
push str.RoomSpec_s
push edx
call fcn.11009c20
mov eax, dword [ebp - 0x324]
add esp, 0x10
test eax, eax
je 0x1100fbc6
push eax
call fcn.110292f8
add esp, 4
lea ecx, [ebp - 0x334]
call fcn.11017260
lea eax, [ebp - 0x104]
push eax
call fcn.1100d040
push eax
lea ecx, [ebp - 0x104]
push ecx
push str.write__client_RoomSpec_s___s__n
call fcn.1100bc80
add esp, 0x10
lea ecx, [ebp - 0x360]
call fcn.110221b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
Function at 0x11011830
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1106772a], 0
je 0x1101185f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.110278e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x100
lea edx, [ebp - 0x204]
push edx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x204], 0
jne 0x110118b6
push 0x100
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x204]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x110118c0
mov ecx, dword [str._nsm.___]
mov edx, dword [0x11055bb8]
mov dword [eax], ecx
mov ecx, dword [0x11055bbc]
mov dword [eax + 4], edx
mov edx, dword [0x11055bc0]
mov dword [eax + 8], ecx
mov cx, word [0x11055bc4]
mov dword [eax + 0xc], edx
lea edx, [ebp - 0x204]
push edx
push str.CheckSerFile:__s
mov word [eax + 0x10], cx
call fcn.1100bc80
push 0x110675c4
lea eax, [ebp - 0x204]
push 0x11067688
push eax
call fcn.11011810
add esp, 0x14
test eax, eax
je 0x11011948
push eax
push 0x11067390
push 7
call fcn.11010c60
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x110675cc]
push esi
lea edx, [ebp - 0x60c]
push edi
push edx
mov dword [0x1106772a], ecx
call fcn.1102b7b4
lea eax, [ebp - 0x60c]
push eax
call fcn.1102b78d
mov ecx, 9
mov esi, eax
mov edi, 0x110677b8
rep movsd dword es:[edi], dword [esi]
add dword [0x110677cc], 0x76c
inc dword [0x110677c8]
add esp, 8
cmp word [0x110676fe], 0
jne 0x11011a20
mov ecx, dword [0x110677cc]
mov edx, dword [0x110677c8]
mov eax, dword [0x110677c4]
push ecx
push edx
push eax
push 0x11067688
call fcn.1100b160
add esp, 0x10
test eax, eax
je 0x11011a20
mov edx, dword [0x110675dc]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea ecx, [ebp - 0x604]
push ecx
push 5
push edx
call esi
mov ecx, dword [0x110675dc]
push 0x100
lea eax, [ebp - 0x404]
push eax
push 8
push ecx
call esi
push 0x40
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x604]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.110278cd
mov esp, ebp
pop ebp
ret
Function at 0x11012530
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.110278e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x100
lea edx, [ebp - 0x204]
push edx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x204], 0
jne 0x1101259a
push 0x100
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x204]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x110125a3
mov ecx, dword [str._nsm.___]
mov edx, dword [0x11055bb8]
mov dword [eax], ecx
mov ecx, dword [0x11055bbc]
push esi
mov dword [eax + 4], edx
mov edx, dword [0x11055bc0]
push edi
mov dword [eax + 8], ecx
mov cx, word [0x11055bc4]
mov dword [eax + 0xc], edx
push 0x110675c4
lea edx, [ebp - 0x204]
push 0x11067688
push edx
mov word [eax + 0x10], cx
call fcn.11011810
mov eax, dword [0x110675cc]
lea ecx, [ebp - 0x20c]
push ecx
mov dword [0x1106772a], eax
call fcn.1102b7b4
lea edx, [ebp - 0x20c]
push edx
call fcn.1102b78d
add esp, 0x14
mov ecx, 9
mov esi, eax
mov edi, 0x110677b8
rep movsd dword es:[edi], dword [esi]
add dword [0x110677cc], 0x76c
inc dword [0x110677c8]
cmp word [0x110676fe], 0
pop edi
pop esi
je 0x1101267a
mov eax, dword [0x110677cc]
mov ecx, dword [0x110677c8]
mov edx, dword [0x110677c4]
push eax
push ecx
push edx
push 0x11067688
call fcn.1100b160
add esp, 0x10
test eax, eax
je 0x1101267a
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.110278cd
mov esp, ebp
pop ebp
ret
Function at 0x110160a0
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x14]
mov esi, eax
mov eax, dword [0x11068610]
test eax, eax
je 0x110160c0
test bl, 8
jne 0x110160c0
call eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x110160d6
call fcn.11015420
test eax, eax
jne 0x110160d6
or ebx, 0x11
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push eax
push ecx
push edx
call fcn.11015630
add esp, 0x10
pop esi
test bl, 4
pop ebx
jne 0x1101611f
cmp dword [0x1106860c], 0
jne 0x11016117
mov eax, dword [0x11068614]
test eax, eax
je 0x11016117
mov dword [0x1106860c], 1
call eax
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebp
ret

Function at 0x110193f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x1101941e
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
je 0x1101945e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
add edi, 8
push edi
lea edx, [ebp - 0x104]
push str.WaitForSingleObject___FAILED___mutex:__s_res:_0x_x___d__r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
sete al
pop esi
xor ecx, ebp
pop edi
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4

Function at 0x11019480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x110194ac
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, eax
test edi, edi
jne 0x110194e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
add esi, 8
push esi
lea eax, [ebp - 0x104]
push str.ReleaseMutex___FAILED___mutex:__s___d__r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.110278cd
mov esp, ebp
pop ebp
ret
Function at 0x11019d60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
cmp eax, edi
jne 0x11019d98
mov eax, str.sqlite3.dll
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, edi
je 0x11019e3c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.sqlite3_close
push eax
call edi
mov ecx, dword [esi]
push str.sqlite3_exec
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.sqlite3_errcode
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.sqlite3_free
push eax
call edi
mov ecx, dword [esi]
push str.sqlite3_prepare_v2
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.sqlite3_finalize
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi]
push str.sqlite3_column_int
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.sqlite3_bind_int
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.sqlite3_reset
push eax
call edi
mov dword [esi + 0x2c], eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1101a080
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x104]
push str.SELECT_Value_FROM_ParamTable_WHERE_Param___s_
push eax
mov dword [ebp - 0x108], 0
mov byte [esi], 0
call fcn.11029d68
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x108]
push edx
mov edx, dword [0x11068634]
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x110], ecx
push 0x1101a020
lea ecx, [ebp - 0x104]
push ecx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x10c], 0
mov eax, dword [edx + 0xc]
push edi
call eax
add esp, 0x20
test eax, eax
je 0x1101a14d
mov ecx, dword [ebp - 0x108]
push ecx
push str.SQL_error:__s_n
call fcn.1102bfd7
mov edx, dword [ebp - 0x108]
mov eax, dword [0x11068634]
mov ecx, dword [eax + 0x14]
push edx
call ecx
mov edx, dword [0x11068634]
mov eax, dword [edx + 0x10]
push edi
call eax
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10c]
test eax, eax
jne 0x1101a134
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.110278cd
mov esp, ebp
pop ebp
ret
Function at 0x1101af60
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push str._rProcessing_MessageTable...______d_records
mov dword [0x11068624], edi
call fcn.1102bfd7
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x40c], edi
mov ecx, 0x14
mov esi, str.SELECT__FROM_MessageTable_WHERE_MessageID_NOT_IN__SELECT_id_From_MessageDupTable_
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x408]
push eax
mov eax, dword [0x11068634]
lea ecx, [ebp - 0x414]
push ecx
movsw word es:[edi], word [esi]
push 0x1101a850
lea edx, [ebp - 0x404]
push edx
mov byte [ebp - 0x410], 0
movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 0xc]
push ebx
call ecx
add esp, 0x1c
test eax, eax
je 0x1101b028
mov edx, dword [ebp - 0x408]
push edx
push str.SQL_error:__s_n
call fcn.1102bfd7
mov eax, dword [ebp - 0x408]
mov ecx, dword [0x11068634]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [0x11068634]
mov ecx, dword [eax + 0x10]
push ebx
call ecx
add esp, 0x10
mov esi, eax
mov dword [0x11068628], 1
jmp 0x1101b02e
mov esi, dword [ebp - 0x40c]
push 0x11058bc0
call fcn.1102bfd7
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.110278cd
mov esp, ebp
pop ebp
ret

Function at 0x1101b050
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push str._rProcessing_MessageTable...______d_records
mov dword [0x11068624], edi
call fcn.1102bfd7
push ebx
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], edi
call fcn.1101a6e0
mov dword [ebp - 0x414], esi
mov ecx, 0x13
mov esi, str.SELECT__FROM_MessageTable_WHERE_MessageID_IN__SELECT_id_From_MessageDupTable_
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
mov dword [0x11068630], eax
lea eax, [ebp - 0x408]
push eax
mov eax, dword [0x11068634]
lea ecx, [ebp - 0x414]
push ecx
movsw word es:[edi], word [esi]
push 0x1101a850
lea edx, [ebp - 0x404]
push edx
mov byte [ebp - 0x410], 1
movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 0xc]
push ebx
call ecx
add esp, 0x20
test eax, eax
je 0x1101b123
mov edx, dword [ebp - 0x408]
push edx
push str.SQL_error:__s_n
call fcn.1102bfd7
mov eax, dword [ebp - 0x408]
mov ecx, dword [0x11068634]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [0x11068634]
mov ecx, dword [eax + 0x10]
push ebx
call ecx
add esp, 0x10
mov esi, eax
mov dword [0x11068628], 1
jmp 0x1101b129
mov esi, dword [ebp - 0x40c]
push 0x11058bc0
call fcn.1102bfd7
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.110278cd
mov esp, ebp
pop ebp
ret
Function at 0x1101b150
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push str._rProcessing_ClientTable...______d_records
mov dword [0x11068624], edi
call fcn.1102bfd7
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x40c], edi
mov ecx, 0x14
mov esi, str.SELECT__FROM_ClientTable_WHERE_ClientID_NOT_IN__SELECT_id_From_ClientDupTable_
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x408]
push eax
mov eax, dword [0x11068634]
lea ecx, [ebp - 0x414]
push ecx
push 0x1101ac70
lea edx, [ebp - 0x404]
push edx
mov byte [ebp - 0x410], 0
mov ecx, dword [eax + 0xc]
push ebx
call ecx
add esp, 0x1c
test eax, eax
je 0x1101b215
mov edx, dword [ebp - 0x408]
push edx
push str.SQL_error:__s_n
call fcn.1102bfd7
mov eax, dword [ebp - 0x408]
mov ecx, dword [0x11068634]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [0x11068634]
mov ecx, dword [eax + 0x10]
push ebx
call ecx
add esp, 0x10
mov esi, eax
mov dword [0x11068628], 1
jmp 0x1101b21b
mov esi, dword [ebp - 0x40c]
push 0x11058bc0
call fcn.1102bfd7
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.110278cd
mov esp, ebp
pop ebp
ret

Function at 0x1101b240
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push str._rProcessing_ClientTable...______d_records
mov dword [0x11068624], edi
call fcn.1102bfd7
push ebx
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], edi
call fcn.1101a5d0
mov dword [ebp - 0x414], esi
mov dword [0x1106862c], eax
mov ecx, 0x13
mov esi, str.SELECT__FROM_ClientTable_WHERE_ClientID_IN__SELECT_id_From_ClientDupTable_
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x408]
push eax
mov eax, dword [0x11068634]
lea ecx, [ebp - 0x414]
push ecx
push 0x1101ac70
lea edx, [ebp - 0x404]
push edx
mov byte [ebp - 0x410], 1
mov ecx, dword [eax + 0xc]
push ebx
call ecx
add esp, 0x20
test eax, eax
je 0x1101b310
mov edx, dword [ebp - 0x408]
push edx
push str.SQL_error:__s_n
call fcn.1102bfd7
mov eax, dword [ebp - 0x408]
mov ecx, dword [0x11068634]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [0x11068634]
mov ecx, dword [eax + 0x10]
push ebx
call ecx
add esp, 0x10
mov esi, eax
mov dword [0x11068628], 1
jmp 0x1101b316
mov esi, dword [ebp - 0x40c]
push 0x11058bc0
call fcn.1102bfd7
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.110278cd
mov esp, ebp
pop ebp
ret