joyce8/EMBER2024-capa huggingface dataset:
Function at 0x646484
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6465bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c94
mov dl, 1
mov eax, dword [0x44c720]
call fcn.0044c944
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x646597
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000000
mov eax, dword [ebp - 4]
call fcn.0044ca20
mov edx, 0x6465d0
mov eax, dword [ebp - 4]
call fcn.0044cc88
test al, al
je 0x646581
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0044d298
mov edx, dword [ebx]
mov eax, 0x646614
call fcn.004052b4
test eax, eax
jle 0x646562
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebx]
mov ecx, pe_nt_image_headers32
mov edx, 0xd
call fcn.004051d0
mov eax, dword [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404f04
mov edx, dword [ebp - 0x10c]
mov eax, ebx
pop ecx
call fcn.00404fbc
mov eax, dword [ebp - 4]
call fcn.0044c9f0
cmp dword [ebx], 0
je 0x646581
mov eax, dword [ebx]
call fcn.0040a798
test al, al
jne 0x646581
mov eax, ebx
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64659e
mov eax, dword [ebp - 4]
call fcn.00403e04
ret

Function at 0x649564
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.006499c0
mov esi, eax
cmp esi, 1
jne 0x64959a
mov eax, dword [0x6f061c]
mov eax, dword [eax]
xor edx, edx
call fcn.0067a438
mov eax, dword [0x6f04ec]
mov eax, dword [eax]
call fcn.004a988c
test esi, esi
je 0x64961b
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d4e48]
call fcn.004e1f64
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x649614
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x58]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x26c]
mov eax, dword [ebp - 8]
call fcn.004e20e8
mov edx, 0x64962c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
call fcn.004cd230
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.004c372c
mov edx, dword [eax]
call dword [edx + 0x58]
cmp eax, 2
setge byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64961b
mov eax, dword [ebp - 8]
call fcn.00403e04
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x6496a4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x6496ac
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x64981b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d4e48]
call fcn.004e1f64
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6497f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x58]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x26c]
lea eax, [ebp - 0x18]
mov edx, dword [0x6f0660]
call fcn.00404ef8
lea eax, [ebp - 0x18]
mov edx, 0x649834
call fcn.00404f78
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409d4c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x649844
call fcn.00404fbc
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004e20e8
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004cd230
mov eax, dword [ebp - 0xc]
call fcn.004cf5f0
test al, al
je 0x649759
mov byte [ebp - 1], 0
jmp 0x6497db
mov edx, 0x649890
mov eax, dword [ebp - 0xc]
call fcn.004ce338
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
test esi, esi
jne 0x64979d
lea eax, [ebp - 0x20]
mov edx, dword [0x6f0660]
call fcn.00404ef8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409c78
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0067baac
mov byte [ebp - 1], al
jmp 0x6497db
dec esi
jne 0x6497db
lea eax, [ebp - 0x28]
mov edx, dword [0x6f0660]
add edx, 0x100
call fcn.00404ef8
mov ecx, dword [ebp - 0x28]
mov edx, dword [0x6eff00]
mov edx, dword [edx + 4]
lea eax, [ebp - 0x24]
call fcn.00404fbc
mov eax, dword [ebp - 0x24]
mov ecx, 1
mov edx, dword [ebp - 8]
call fcn.0067baac
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6497f8
mov eax, dword [ebp - 0xc]
call fcn.00403e04
ret

Function at 0x67a52c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffff7c
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x67a55d
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x80
call fcn.00404f04
jmp 0x67a569
mov eax, ebx
mov edx, 0x67a57c
call fcn.00404ce8
add esp, 0x84
pop ebx
ret
Function at 0x67b050
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe44
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x67b159
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c94
lea eax, [ebp - 0x1bc]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x67b099
mov eax, 2
call fcn.00404c5c
xor eax, eax
push ebp
push 0x67b0ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea eax, [ebp - 0x2c]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
je 0x67b0c0
mov eax, 3
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67b0de
lea eax, [ebp - 0x2c]
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x67b0f9
mov eax, 4
call fcn.00404c5c
jmp 0x67b13e
mov ebx, 1
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + ebx - 1]
lea edx, [ebp - 8]
call fcn.0040a1e8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404f78
cmp ebx, 4
jge 0x67b12d
lea eax, [ebp - 0xc]
mov edx, 0x67b170
call fcn.00404f78
inc ebx
cmp ebx, 5
jne 0x67b0fe
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67b160
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404cb8
ret

Function at 0x685df8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x685edf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x6f09b8]
add edx, 0x300
call fcn.00404ef8
lea eax, [ebp - 8]
mov ecx, 0x685ef8
mov edx, dword [ebp - 4]
call fcn.00404fbc
mov eax, dword [ebp - 8]
call fcn.0040a798
mov ebx, eax
test bl, bl
je 0x685ebc
push 1
mov eax, dword [ebp - 4]
call fcn.00405170
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x6f0198]
call fcn.00404ef8
push dword [ebp - 0x10]
push 0x685f10
lea eax, [ebp - 0x14]
mov edx, dword [0x6f0198]
add edx, 0x302
call fcn.00404ef8
push dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405030
mov eax, dword [ebp - 0xc]
call fcn.00405170
push eax
lea eax, [ebp - 0x18]
mov ecx, 0x685ef8
mov edx, dword [ebp - 4]
call fcn.00404fbc
mov eax, dword [ebp - 0x18]
call fcn.00405170
push eax
push 0x685f14
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x685ec0
xor eax, eax
jmp 0x685ec2
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685ee6
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404cb8
ret

Function at 0x68eed4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffebc
mov ebx, eax
lea eax, [esp + 1]
push eax
push 0x40
call sub.kernel32.dll_GetTempPathA
mov byte [esp], al
lea eax, [esp + 0x42]
push eax
push 0
push 0x68ef18
lea eax, [esp + 0xd]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [esp + 0x42]
call fcn.0040af2c
add esp, 0x144
pop ebx
ret
Function at 0x6a9d34
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6a9daf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x6a9dc4
call fcn.00404d2c
cmp dword [ebp - 4], 0
je 0x6a9d86
push dword [ebp - 8]
push 0x6a9df8
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405030
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x328]
call fcn.00646c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a9db6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cb8
ret

Function at 0x6aa350
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x6aa453
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d4e48]
call fcn.004e1f64
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6aa431
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x26c]
mov eax, dword [ebp - 8]
call fcn.004e20e8
mov edx, 0x6aa46c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
call fcn.004cd230
jmp 0x6aa40f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, 1
call fcn.004c372c
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.004c372c
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.004cfa78
mov eax, dword [ebp - 8]
cmp byte [eax + 0xa1], 0
je 0x6aa3c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aa438
mov eax, dword [ebp - 8]
call fcn.00403e04
ret
Function at 0x6aa8fc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6aaa62
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x6aaa7c
call fcn.00404d2c
mov eax, dword [ebx + 0x328]
cmp byte [eax + 0x9d], 2
jne 0x6aa96c
push dword [ebp - 8]
push 0x6aaac0
mov eax, dword [ebx + 0x328]
mov edx, 0x6aaad8
call fcn.004ce338
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x60]
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405030
mov eax, dword [ebx + 0x340]
mov edx, dword [ebp - 8]
call fcn.00646c1c
mov ebx, dword [ebx + 0x340]
jmp 0x6aaa3a
mov edx, 0x6aaae8
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp esi, eax
jl 0x6aa9af
mov edx, 0x6aaafc
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp esi, eax
jle 0x6aaa2d
mov edx, 0x6aaae8
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp edi, eax
jl 0x6aa9d9
mov edx, 0x6aaafc
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp edi, eax
jle 0x6aaa2d
mov edx, 0x6aaae8
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp esi, eax
jg 0x6aaa03
mov edx, 0x6aaae8
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp edi, eax
jge 0x6aaa2d
mov edx, 0x6aaafc
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp esi, eax
jg 0x6aaa33
mov edx, 0x6aaafc
mov eax, ebx
call fcn.004ce338
mov edx, dword [eax]
call dword [edx + 0x58]
cmp edi, eax
jl 0x6aaa33
mov byte [ebp - 1], 1
jmp 0x6aaa47
mov eax, ebx
call fcn.004cfa78
cmp byte [ebx + 0xa1], 0
je 0x6aa985
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aaa69
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404cb8
ret

Function at 0x6aab08
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
mov eax, dword [ebp - 8]
call fcn.00405160
xor eax, eax
push ebp
push 0x6aab8d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6aaba4
push dword [ebp - 4]
push 0x6aabec
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00405030
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x340]
call fcn.00646c1c
mov eax, dword [ebx + 0x340]
call fcn.004cf5f0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aab94
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb8
ret
Function at 0x6b00dc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b0269
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x228], 0
jne 0x6b01eb
cmp dword [ebp - 4], 0
jne 0x6b0123
lea eax, [ebp - 4]
mov edx, dword [0x6f0660]
call fcn.00404ef8
push 0x6b0280
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409d4c
push dword [ebp - 0xc]
push 0x6b0350
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405030
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6aea18]
call fcn.006aedd0
mov esi, eax
mov dword [ebx + 0x228], esi
mov byte [esi + 0x70], 1
mov dl, 1
mov eax, esi
call fcn.006afe94
mov edx, dword [ebx + 0x224]
mov eax, dword [ebx + 0x228]
call fcn.006afc60
mov eax, dword [ebx + 0x228]
add eax, 0x60
mov edx, 0x6b0360
call fcn.00404ce8
mov eax, dword [ebx + 0x228]
add eax, 0x58
mov edx, dword [0x6efed8]
mov edx, dword [edx]
call fcn.00404ce8
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [ebx + 0x228]
call fcn.006afc70
mov eax, dword [ebx + 0x228]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x6b036c
mov eax, dword [ebx + 0x228]
call fcn.006afdc8
mov edx, 0x6b0380
mov eax, dword [ebx + 0x228]
call fcn.006afdf0
mov eax, dword [ebx + 0x228]
call fcn.006afb60
mov eax, dword [ebx + 0x224]
mov eax, dword [eax + 0x26c]
call fcn.0045fa7c
test eax, eax
jle 0x6b023f
mov eax, dword [ebx + 0x224]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.0045fe70
mov dl, 1
call fcn.0045eda8
mov eax, dword [ebx + 0x224]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.0045fe70
mov dl, 1
call fcn.0045ed74
xor edx, edx
mov eax, dword [ebx + 0x228]
call fcn.006afe94
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b0270
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb8
ret
Function at 0x6b0500
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b06b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x6f0970]
mov eax, dword [eax + 0x18]
call fcn.00409c78
cmp dword [ebp - 0xc], 0
je 0x6b055e
mov eax, dword [0x6f0970]
mov eax, dword [eax + 0x18]
call fcn.00405170
push eax
call sub.LibSKCommun.dll_fnSetCompanyCode
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov ebx, dword [eax + 0x5c]
mov eax, ebx
call fcn.004cd23c
mov eax, ebx
call fcn.004e20e8
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, ebx
call fcn.004e20e8
mov edx, 0x6b06c8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.004e20e8
mov edx, 0x6b070c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.004cd230
xor edx, edx
mov eax, dword [ebx + 0x30]
call fcn.004c372c
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 0x6b0748
mov edx, 0x6b075c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov eax, ebx
call fcn.004cfa78
cmp dword [ebp - 8], 0
je 0x6b05ef
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x6b076c
mov edx, 0x6b075c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
jmp 0x6b0616
xor edx, edx
mov eax, dword [ebx + 0x30]
call fcn.004c372c
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, 0x6b076c
mov edx, 0x6b075c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
movzx eax, word [ebp - 2]
push eax
mov ecx, 0x6b077c
mov edx, 0x6b078c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x1c]
mov edx, dword [0x6eff00]
add edx, 8
call fcn.00404ef8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409c78
cmp dword [ebp - 0x18], 0
jne 0x6b0666
push 0x6b079c
mov ecx, 0x6b07a8
mov edx, 0x6b075c
mov eax, esi
mov esi, dword [eax]
call dword [esi + 4]
jmp 0x6b068c
lea eax, [ebp - 0x20]
mov edx, dword [0x6eff00]
add edx, 8
call fcn.00404ef8
mov eax, dword [ebp - 0x20]
push eax
mov ecx, 0x6b07a8
mov edx, 0x6b075c
mov eax, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, ebx
call fcn.004cd23c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b06b7
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404cb8
ret
Function at 0x6b5b84
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b5bff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x6b5c14
call fcn.00404d2c
cmp dword [ebp - 4], 0
je 0x6b5bd6
push dword [ebp - 8]
push 0x6b5c48
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405030
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x334]
call fcn.00646c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b5c06
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cb8
ret

Function at 0x6b7094
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b710f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x6b7124
call fcn.00404d2c
cmp dword [ebp - 4], 0
je 0x6b70e6
push dword [ebp - 8]
push 0x6b7158
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405030
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x304]
call fcn.00646c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b7116
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cb8
ret

Function at 0x6b73f4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6b73fc
push ecx
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x6b7510
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [0x6f0660]
call fcn.00404ef8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409d4c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 0x6b7524
call fcn.00404fbc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d4600]
call fcn.004da430
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6b74ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00646c1c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.004c372c
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x18]
mov ecx, 4
mov edx, 3
call fcn.004051d0
push 1
lea eax, [ebp - 0x1c]
push eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0040a390
inc eax
lea edx, [ebp - 0x20]
call fcn.0040a1e8
mov eax, dword [ebp - 0x20]
mov cl, 0x30
mov edx, 4
call fcn.0067afa8
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
mov edx, dword [0x6f0660]
call fcn.00404ef8
mov edx, dword [ebp - 0x24]
mov eax, ebx
pop ecx
call fcn.00404fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b74f5
mov eax, dword [ebp - 4]
call fcn.00403e04
ret
Function at 0x6b8148
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 8]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b8322
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d4e48]
call fcn.004e1f64
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x6b82eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x26c]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00409d4c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x6b833c
call fcn.00404fbc
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004e20e8
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.004cd230
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.004c372c
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 8]
call fcn.00404f70
dec eax
jle 0x6b8218
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004051d0
mov edx, dword [ebp - 8]
mov eax, 0x6b837c
call fcn.004052b4
test eax, eax
jle 0x6b824e
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x6b837c
call fcn.004052b4
mov ecx, eax
sub ecx, 3
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.004051d0
jmp 0x6b826c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404f70
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.004051d0
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, 0x6b837c
call fcn.004052b4
test eax, eax
jle 0x6b82af
mov edx, dword [ebp - 8]
mov eax, 0x6b837c
call fcn.004052b4
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405210
jmp 0x6b82c6
mov eax, dword [ebp - 8]
call fcn.00404f70
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405210
mov eax, dword [ebp - 8]
call fcn.00404f70
dec eax
jge 0x6b81f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b82f2
mov eax, dword [ebp - 0x14]
call fcn.00403e04
ret