joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ccff0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4cd18a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004cd83c
mov eax, dword [0x533a34]
cmp byte [eax], 0
jne 0x4cd01e
call fcn.004cd494
mov byte [0x537b2d], 0
cmp dword [0x537b44], 1
jle 0x4cd0e3
cmp dword [0x537b3c], 0
je 0x4cd0e3
lea eax, [ebp - 4]
call fcn.004c96c0
lea edx, [ebp - 0x10]
mov eax, dword [0x537b14]
call fcn.00409770
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4cd1a0
call fcn.004045dc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004048d4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4cd0e3
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404590
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00404590
sub ebx, eax
sub ebx, dword [ebp - 0xc]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.00404590
mov edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
pop ecx
call fcn.004047f0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004047f0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.004045dc
mov eax, dword [ebp - 4]
call fcn.00404790
push eax
push 0x4cd1a4
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [0x537bd4], 0
jbe 0x4cd0fe
mov eax, dword [0x537bd4]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x537bd4], eax
cmp dword [0x537bd8], 0
jbe 0x4cd119
mov eax, dword [0x537bd8]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x537bd8], eax
mov byte [0x537bd0], 0
mov eax, 0x537b14
call fcn.004042c0
mov eax, 0x537b18
call fcn.004042c0
mov eax, 0x537b1c
call fcn.004042c0
mov word [0x537b20], 0
mov byte [0x537b22], 0
mov al, byte [0x4cd1ac]
mov byte [0x537b23], al
mov eax, 0x537b3c
call fcn.004042c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd191
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004042e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042e4
ret

Function at 0x4ce9e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4cea69
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x537c18
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4cea53
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c700
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x4cea80
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x5341f0]
mov dl, 1
mov eax, dword [0x4ce7b4]
call fcn.0040d024
call fcn.00403c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cea70
lea eax, [ebp - 0x1c]
call fcn.004042c0
ret
Function at 0x4cf11c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004cf040
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004036a0
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4cf180
call fcn.004ce928
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x4cf172
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004036a0
pop esi
pop ebx
ret

Function at 0x4cf1a4
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00404790
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402e28
test ebx, ebx
je 0x4cf1ef
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x4cf2cc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4cf2fd
mov ecx, dword [0x533ff0]
mov dl, 1
mov eax, dword [0x4ce7b4]
call fcn.0040cfe8
call fcn.00403c58
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4cf32a
mov ecx, dword [0x533f24]
mov dl, 1
mov eax, dword [0x4ce7b4]
call fcn.0040cfe8
call fcn.00403c58
xor eax, eax
push ebp
push 0x4cf3a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004036a0
cmp byte [ebp + 8], 0
je 0x4cf382
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004cf234
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004cf11c
jmp 0x4cf39c
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004cec14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cf3c3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cf588
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004ceedc
xor eax, eax
push ebp
push 0x4cf6f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4cf6e3
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4cf5d3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4cf5dd
call fcn.00403d04
jmp 0x4cf700
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041fe64
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4cf6d8
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4cf68b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4cf678
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004036a0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004cf540
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4cf70c]
cmp dl, byte [eax + 0x28]
je 0x4cf6df
call fcn.0040cf0c
jmp 0x4cf6df
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041fe84
jmp 0x4cf6df
cmp ecx, ebx
jge 0x4cf6a7
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041fe84
jmp 0x4cf5dd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041fe64
cmp edx, dword [esp + 4]
jne 0x4cf6c7
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4cf5dd
push ebp
call fcn.004cf540
pop ecx
jmp 0x4cf6df
push ebp
call fcn.004cf540
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf700
mov eax, dword [ebp - 4]
call fcn.004ceee8
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf710
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf832
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ceedc
xor eax, eax
push ebp
push 0x4cf815
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4cf760
call fcn.00403d04
jmp 0x4cf81c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4cf7ff
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4cf7ff
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004036a0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4cf7ff
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c700
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4cf84c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x5341f0]
mov dl, 1
mov eax, dword [0x4ce7b4]
call fcn.0040d024
call fcn.00403c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf81c
mov eax, dword [ebp - 4]
call fcn.004ceee8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf839
lea eax, [ebp - 0x28]
call fcn.004042c0
ret
Function at 0x4cf898
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf9e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ceedc
xor eax, eax
push ebp
push 0x4cf9c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4cf8fd
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4cf8fd
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4cf9af
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4cf910
call fcn.00403d04
jmp 0x4cf9cc
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4cf9af
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4cf9af
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004036a0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4cf9af
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c700
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4cf9fc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x5341f0]
mov dl, 1
mov eax, dword [0x4ce7b4]
call fcn.0040d024
call fcn.00403c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf9cc
mov eax, dword [ebp - 4]
call fcn.004ceee8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf9e9
lea eax, [ebp - 0x28]
call fcn.004042c0
ret
Function at 0x4cfd8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x4cfeae
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x478e8c]
call fcn.00405a38
add esp, 4
mov eax, dword [ebp - 4]
call fcn.0040587c
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x478e8c]
call fcn.00405a38
add esp, 4
mov eax, dword [ebp - 4]
call fcn.0040587c
mov esi, eax
test esi, esi
jns 0x4cfe03
add esi, 7
sar esi, 3
dec esi
test esi, esi
jl 0x4cfe55
inc esi
xor ebx, ebx
xor eax, eax
mov edx, ebx
shl edx, 3
add edx, eax
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
mov ecx, dword [ebp - 0x10]
xor byte [ecx + eax], dl
inc eax
cmp eax, 8
jne 0x4cfe10
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004cfebc
cmp byte [ebp - 5], 0
jne 0x4cfe51
mov eax, ebx
shl eax, 3
push eax
push 8
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004cfccc
inc ebx
dec esi
jne 0x4cfe0e
cmp byte [ebp - 5], 0
je 0x4cfe6e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x478e8c]
call fcn.00405b94
jmp 0x4cfe7f
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x478e8c]
call fcn.00405b94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfeb5
lea eax, [ebp - 0x14]
mov edx, dword [0x478e8c]
mov ecx, 2
call fcn.00404f5c
lea eax, [ebp - 4]
mov edx, dword [0x478e8c]
call fcn.00405b58
ret
Function at 0x4dc08c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004042c0
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4dc0cc
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404540
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e3510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4e36be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x533bf4]
mov eax, dword [eax]
call fcn.004839cc
mov ecx, eax
mov dl, 1
mov eax, dword [0x4d1d48]
call fcn.004dd438
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x4e356c
lea eax, [ebp - 0x14]
mov edx, 0x4e36d8
call fcn.00404358
jmp 0x4e3579
lea eax, [ebp - 0x14]
mov edx, 0x4e36e8
call fcn.00404358
cmp bl, 2
je 0x4e3583
cmp bl, 3
jne 0x4e35a3
mov si, 0x70
push 0x4e36f8
push dword [ebp - 0x14]
push 0x4e373c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404650
jmp 0x4e35c1
mov si, 0x71
push 0x4e3758
push dword [ebp - 0x14]
push 0x4e373c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404650
mov eax, dword [ebp - 0x10]
add eax, 0x28
mov edx, dword [ebp - 0xc]
call fcn.00404314
mov eax, dword [ebp - 0x10]
mov word [eax + 0x30], 8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4d1aa0]
call fcn.004db3f0
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.0041d790
lea eax, [ebx + 0xc]
mov edx, 0x4e379c
call fcn.00404314
mov eax, dword [ebp - 4]
call fcn.004db4a4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
call fcn.00483a00
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4e3690
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 0x1c]
push eax
push 4
push esi
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x20]
mov ecx, edi
mov eax, dword [ebp - 0x10]
call fcn.004e0848
xor edx, edx
call fcn.004cdc78
mov eax, dword [ebp - 8]
call fcn.004839cc
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0x10]
call fcn.004e08cc
xor edx, edx
call fcn.004cdc78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3697
mov eax, dword [ebp - 0x10]
call fcn.004034a4
mov eax, dword [ebp - 0x1c]
call fcn.00483a24
ret
Function at 0x4e37a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e393b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x537dbc], 0
je 0x4e37ee
push 0
mov eax, dword [ebp - 4]
add eax, 0xc
mov ecx, 1
mov edx, dword [0x478e8c]
call fcn.00405a38
add esp, 4
xor ebx, ebx
jmp 0x4e3925
mov eax, dword [0x533bf4]
mov eax, dword [eax]
call fcn.004839cc
mov ecx, eax
mov dl, 1
mov eax, dword [0x4d1d48]
call fcn.004dd438
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov edx, 0x4e3954
call fcn.00404358
mov eax, dword [ebp - 0xc]
add eax, 0x28
mov edx, dword [ebp - 8]
call fcn.00404314
mov eax, dword [ebp - 0xc]
mov word [eax + 0x30], 8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4d1aa0]
call fcn.004db3f0
mov edi, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x20]
mov edx, edi
call fcn.0041d790
lea eax, [edi + 0xc]
mov edx, 0x4e3984
call fcn.00404314
mov eax, dword [ebp - 4]
call fcn.004db4a4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
call fcn.00483a00
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4e391c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 0x14]
push eax
push 4
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x10]
push eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004e0848
xor edx, edx
call fcn.004cdc78
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1d]
mov dword [ebp - 0x1c], eax
push ebx
push 0x20
push 0
lea eax, [ebp - 0x1c]
push eax
push 5
mov eax, dword [ebp - 0x18]
push eax
call fcn.004e55ac
add esp, 0x18
xor edx, edx
call fcn.004cdc78
mov eax, esi
call fcn.004839cc
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004e08cc
xor edx, edx
call fcn.004cdc78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3923
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 0
mov eax, dword [ebp - 0xc]
call fcn.004034a4
mov eax, dword [ebp - 0x14]
call fcn.00483a24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3942
lea eax, [ebp - 8]
call fcn.004042c0
ret
Function at 0x4e3afc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4e3b0e
add esp, 0xfffffff0
call fcn.004037f0
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x10]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x4e3bb1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403474
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x18]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
lea eax, [edi + 0x28]
mov edx, dword [ebp + 0x10]
mov ecx, dword [0x478e8c]
call fcn.00405b94
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x14]
mov edx, dword [0x478e8c]
call fcn.00405b58
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x18], eax
mov byte [edi + 0xd], 0
mov byte [edi + 0xc], 0
mov word [edi + 0xe], 0
xor eax, eax
mov dword [edi + 0x20], eax
mov word [edi + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3bb8
lea eax, [ebp + 0x10]
mov edx, dword [0x478e8c]
call fcn.00405b58
ret

Function at 0x4fa14c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, ecx
mov esi, edx
push 0
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4fa17b
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi], eax
test bl, bl
je 0x4fa19b
push 1
push 0x400
push 0x400
mov eax, dword [0x533824]
push eax
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
mov al, 1
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x517ffc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x518004
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x518145
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, 0x51815c
mov eax, esi
call fcn.0041f04c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.00408bb4
lea ecx, [ebp - 0x18]
mov edx, 0x518174
mov eax, esi
call fcn.0041f04c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.00408bb4
lea ecx, [ebp - 0x20]
mov edx, 0x51818c
mov eax, esi
call fcn.0041f04c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408bb4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
call fcn.00484374
lea eax, [ebp - 4]
call fcn.004042c0
mov eax, dword [ebp - 0x10]
mov edx, 0x51819c
call fcn.004046dc
je 0x5180a6
mov eax, dword [ebp - 8]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x5181ac
mov eax, ebx
call fcn.004aadb8
jmp 0x5180cc
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x170]
call fcn.004f8bb4
mov eax, dword [ebp - 0x24]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x5181ac
mov eax, ebx
call fcn.004aadb8
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x5181bc
mov eax, ebx
call fcn.004aadb8
cmp dword [ebp - 4], 0
je 0x5180f4
lea eax, [ebp - 4]
mov edx, 0x5181d0
call fcn.00404598
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x5181e0
call fcn.004843dc
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x198]
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x54]
mov ebx, dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51814c
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004042e4
ret