joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb542cc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb54390
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb543f8
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov edx, 0xb5440c
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
fistp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
fild qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0xb54410
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb544d4
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb54538
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov edx, 0xb5454c
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
fistp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
fild qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xb54550
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb54614
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb5467c
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov edx, 0xb54690
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
fistp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
fild qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0xb54694
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb54758
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb547a4
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov edx, 0xb547b8
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
fistp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
fild qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xb547bc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb54880
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb548c8
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov edx, 0xb548dc
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
fistp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
fild qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0xb548e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb549a4
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb549f4
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov edx, 0xb54a08
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x4c]
fistp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
fild qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xb55118
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp - 4]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00672a4c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 8]
call fcn.00652ce4
mov edx, 0xb55210
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb55240
mov eax, dword [ebp - 8]
call fcn.00652db0
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
call fcn.00682cb8
mov eax, dword [ebp - 8]
call fcn.004e35a4
mov edx, 0xb55250
mov eax, dword [ebp - 8]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
mov edx, 0xb55264
mov eax, dword [ebp - 8]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x44]
test al, al
je 0xb551d3
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov edx, 0xb55278
call fcn.00405284
jmp 0xb551e3
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov edx, 0xb5528c
call fcn.00405284
mov eax, dword [ebp - 8]
call fcn.004e35b0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 8]
call fcn.0040429c
mov eax, dword [ebp - 4]
call fcn.0040429c
pop ecx
pop ecx
pop ebp
ret
Function at 0xb5a830
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, 0xb5a92c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb5a97c
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov edx, 0xb5a990
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 0xc]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
je 0xb5a8f8
mov edx, 0xb5a9a0
mov eax, dword [ebp - 0x18]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0xb5b4f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
xor eax, eax
push ebp
push 0xb5b5db
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.004b8ce0
lea eax, [ebp - 0x60]
mov edx, 0x10
call fcn.004b8ce0
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov ax, word [ebp - 8]
mov word [ebp - 0x20], ax
lea eax, [ebp - 4]
call fcn.004056fc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0xb5b5c5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.user32.dll_WaitForInputIdle
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
jne 0xb5b5b3
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0xb5b5b3
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5b5e2
lea eax, [ebp - 4]
call fcn.004051ec
ret
Function at 0xb5b904
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb5ba3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
xor eax, eax
push ebp
push 0xb5ba1f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0xb5ba54
call fcn.00405284
cmp byte [ebp - 9], 0
je 0xb5b99c
lea eax, [ebp - 0x10]
mov edx, 0xb5bab4
call fcn.004054b4
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb5bad0
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, 0xe
call fcn.00682cb8
mov edx, 0xb5bae4
mov eax, dword [ebp - 0x18]
call fcn.00652db0
mov edx, dword [ebp - 8]
call fcn.00682cb8
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 0xa]
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5ba26
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
ret
Function at 0xb5caa0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov esi, edx
lea edi, [ebp - 0x50]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov edx, dword [0xb5bb70]
call fcn.00406080
xor eax, eax
push ebp
push 0xb5cc43
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00672a4c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
xor eax, eax
push ebp
push 0xb5cc13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00652ce4
mov edx, 0xb5cc5c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x50
mov edx, 1
mov eax, dword [ebp - 0x40]
call fcn.0040570c
mov eax, dword [ebp - 0x54]
push eax
mov edx, 0xb5cd7c
mov eax, dword [ebp - 0x10]
call fcn.00652db0
pop edx
call fcn.0068332c
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x50
mov edx, 1
mov eax, dword [ebp - 0x3c]
call fcn.0040570c
mov eax, dword [ebp - 0x58]
push eax
mov edx, 0xb5cd94
mov eax, dword [ebp - 0x10]
call fcn.00652db0
pop edx
call fcn.0068332c
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.0040570c
mov eax, dword [ebp - 0x5c]
push eax
mov edx, 0xb5cdac
mov eax, dword [ebp - 0x10]
call fcn.00652db0
pop edx
call fcn.0068332c
mov eax, dword [ebp - 0x10]
call fcn.004e35a4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004e35b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5cc1a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 0x10]
call fcn.0040429c
mov eax, dword [ebp - 0xc]
call fcn.0040429c
ret
Function at 0xb667f4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0xb66823
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0xb66826
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0xb6680a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0xba915c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0xb667ff
mov byte [0xba955c], 1
mov esp, ebp
pop ebp
ret

Function at 0xb66854
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0xba955c], 0
jne 0xb66877
call fcn.00b667f4
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0xb668b6
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0xba915c]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0xb6688a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xb7be9c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 0xc]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00672a4c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.00652ce4
mov edx, 0xb7bf64
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb7bfa8
mov eax, dword [ebp - 0x10]
call fcn.00652db0
mov edx, dword [ebp - 4]
call fcn.00682cb8
mov eax, dword [ebp - 0x10]
call fcn.004e35a4
mov edx, 0xb7bfbc
mov eax, dword [ebp - 0x10]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
test eax, eax
setg byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004e35b0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040429c
mov eax, dword [ebp - 0xc]
call fcn.0040429c
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0xb7bfc4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 0xc]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00672a4c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.00652ce4
mov edx, 0xb7c08c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb7c0d0
mov eax, dword [ebp - 0x10]
call fcn.00652db0
mov edx, dword [ebp - 4]
call fcn.00682cb8
mov eax, dword [ebp - 0x10]
call fcn.004e35a4
mov edx, 0xb7c0e4
mov eax, dword [ebp - 0x10]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
test eax, eax
setg byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004e35b0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040429c
mov eax, dword [ebp - 0xc]
call fcn.0040429c
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0xb7c0ec
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 0xc]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00672a4c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.00652ce4
mov edx, 0xb7c1b4
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb7c308
mov eax, dword [ebp - 0x10]
call fcn.00652db0
mov edx, dword [ebp - 4]
call fcn.00682cb8
mov eax, dword [ebp - 0x10]
call fcn.004e35a4
mov edx, 0xb7c31c
mov eax, dword [ebp - 0x10]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
test eax, eax
setg byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004e35b0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040429c
mov eax, dword [ebp - 0xc]
call fcn.0040429c
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0xb7d85c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040569c
mov eax, dword [ebp - 0xc]
call fcn.0040569c
xor eax, eax
push ebp
push 0xb7d9f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x318]
call fcn.006928a0
test al, al
je 0xb7d8bb
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x318]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x318]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov eax, dword [eax + 0x38c]
call fcn.00695ce0
mov edx, 0xb7da10
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov edx, 0xb7da6c
call fcn.00652db0
mov edx, dword [ebp - 0xc]
call fcn.0068332c
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
call fcn.004e35a4
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
jne 0xb7d95f
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
call fcn.004e35b0
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x318]
mov edx, dword [eax]
call dword [edx + 0x3c]
jmp 0xb7d9d6
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov edx, 0xb7da88
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov dword [ebp - 0x14], eax
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov edx, 0xb7da98
call fcn.004e481c
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
call fcn.004e35b0
mov eax, dword [0xba1524]
mov eax, dword [eax]
mov eax, dword [eax + 0x318]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.004055f8
jne 0xb7d9d6
cmp dword [ebp - 0x14], 0xffffffff
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb7da00
lea eax, [ebp - 0x18]
call fcn.004051ec
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405210
ret