joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fb250
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5fb3e2
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.006071f0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x5fb354
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
call ecx
mov edx, dword [esp + 0x48]
mov eax, dword [edx]
mov ecx, dword [esp + 0x34]
mov dword [esp], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
call eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], edx
lea ebx, [0x6d9460]
mov dword [esp], ebx
call fcn.0040bb90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x20]
mov dword [eax + 8], edx
mov edx, dword [0x93f150]
test edx, edx
jne 0x5fb306
mov edx, dword [esp + 0x28]
jmp 0x5fb311
call fcn.00471830
mov edx, dword [esp + 0x28]
mov dword [edi], edx
mov dword [eax], edx
mov edx, dword [esp + 0x30]
cmp dword [edx + 0xf4], 1
jne 0x5fb32a
mov ebx, dword [edx + 0xf0]
xor ebp, ebp
jmp 0x5fb375
nop
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2f
lea ecx, [0x72e0e6]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
jmp 0x5fb364
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x2c
ret
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
add esp, 0x2c
ret
mov ebp, 1
test ebp, ebp
jg 0x5fb3a8
cmp dword [ebx + 4], ecx
je 0x5fb370
nop
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2f
lea ecx, [0x72e0e6]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
jmp 0x5fb364
mov dword [edx + 0xf4], 1
mov dword [edx + 0xf8], 1
mov ecx, dword [0x93f150]
test ecx, ecx
je 0x5fb3d6
call fcn.00471840
mov dword [edi], eax
mov ecx, dword [edx + 0xf0]
mov dword [edi + 4], ecx
mov dword [edx + 0xf0], eax
xor ecx, ecx
xor eax, eax
jmp 0x5fb364
call fcn.00470430
jmp fcn.005fb250
Function at 0x60fd20
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60fea1
sub esp, 0x5c
lea edi, [esp + 0x28]
xor eax, eax
call fcn.00471ac5
mov ecx, dword [esp + 0x40]
nop
mov byte [esp + 0x23], 0x18
test ecx, ecx
jne 0x60fe88
movzx eax, byte [esp + 0x3c]
test al, al
je 0x60fd9c
mov eax, dword [esp + 0x34]
inc eax
lea ecx, [esp + 0x28]
cmp dword [ecx + 0x10], eax
jge 0x60fd9c
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x72fbd1]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jmp 0x60fdfb
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x30]
cmp eax, edx
jae 0x60fde5
mov dword [esp + 0x24], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
lea eax, [0x6db200]
mov dword [esp + 0x10], eax
call fcn.0046c670
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx + ecx], al
xchg ebp, eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], ebx
lea eax, [0x60feb0]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 3
mov byte [esp + 8], 0
lea eax, [esp + 0x54]
mov dword [esp + 0xc], eax
call fcn.005a6290
mov eax, dword [esp + 0x28]
test eax, eax
je 0x60fe44
mov ecx, dword [esp + 0x2c]
xor ebp, ebp
xor edx, edx
mov ebx, ecx
xor ecx, ecx
jmp 0x60fe6b
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x44]
cmp ecx, eax
jb 0x60fe83
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and ebx, eax
sub ecx, eax
add edx, ebx
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ebx
add esp, 0x5c
ret
call fcn.00471910
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a4f8]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.0060fd20
Function at 0x616370
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x616475
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00471ab8
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
jmp 0x616425
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005c0dd0
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
dec eax
test eax, eax
jg 0x6163eb
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005c0fb0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call fcn.00470430
jmp fcn.00616370
Function at 0x616480
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x7c]
cmp eax, dword [ecx + 8]
jbe 0x6166b8
sub esp, 0xfc
lea eax, [0x6db200]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.0046c5c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0xf8], eax
nop
lea edi, [esp + 0x94]
xor eax, eax
call fcn.00471ab9
nop
mov dword [esp + 0x94], 0x67452301
mov dword [esp + 0x98], 0xefcdab89
mov dword [esp + 0x9c], 0x98badcfe
mov dword [esp + 0xa0], 0x10325476
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
mov eax, dword [esp + 0x100]
mov ecx, eax
mov edx, dword [esp + 0x104]
jmp 0x616582
mov dword [esp + 0x90], edx
mov dword [esp + 0xf4], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
lea ebp, [esp + 0x94]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005bfc40
mov eax, dword [esp + 0xf4]
add eax, 0xc
mov ecx, dword [esp + 0x90]
lea edx, [ecx - 1]
mov ecx, dword [esp + 0x100]
test edx, edx
jg 0x616536
lea edi, [esp + 0x34]
lea esi, [esp + 0x94]
call fcn.00471efa
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.005bff20
lea edi, [esp + 0x20]
lea esi, [esp + 4]
call fcn.00471fb8
mov dword [esp], 0
mov dword [esp + 4], 0x10
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
lea eax, [0x6db200]
mov dword [esp + 0x10], eax
call fcn.0046c670
mov eax, dword [esp + 0x14]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp], eax
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x10
call fcn.004721c0
mov eax, dword [esp + 0x30]
cmp eax, 0x24
jl 0x616616
mov eax, 0x24
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf8]
cmp ecx, edx
je 0x616638
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004721c0
mov eax, dword [esp + 0x100]
mov dword [esp], eax
mov eax, dword [esp + 0x104]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x108]
mov dword [esp + 8], eax
call fcn.00616370
mov eax, dword [esp + 0x10]
cmp eax, 0x14
jl 0x61666b
mov eax, 0x14
mov ecx, dword [esp + 0xf8]
lea edx, [ecx + 0x10]
mov ebx, dword [esp + 0xc]
cmp ebx, edx
je 0x616694
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.004721c0
mov ecx, dword [esp + 0xf8]
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], 0x24
mov dword [esp + 0x114], 0x24
add esp, 0xfc
ret
call fcn.00470430
jmp fcn.00616480
Function at 0x61a740
Capabilities:
Reference sql statements
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61a8e8
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x61a76c
movzx ecx, byte [esp + 0x80]
jmp 0x61a779
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x61a7b1
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x61a8cf
cmp cl, 0xe4
je 0x61a790
cmp ax, 0x303
jmp 0x61a7b5
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x61a843
cmp cl, 0xe3
jne 0x61a80d
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.00471f5e
call fcn.0061a420
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.0052aa00
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x1c]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a510]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.0061a740
Function at 0x61cb40
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61ccda
sub esp, 0x20
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx + 0x14]
test eax, eax
jle 0x61cbb9
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0x18]
cmp edx, ecx
jb 0x61ccd4
cmp ecx, eax
jb 0x61cccf
mov ebp, dword [ebx + 4]
mov esi, dword [ebx]
sub ecx, eax
sub edx, eax
neg edx
sar edx, 0x1f
and edx, eax
lea edi, [esi + edx]
cmp ebp, ecx
jg 0x61cb91
mov ecx, ebp
test edx, edx
je 0x61cba9
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
call fcn.004721c0
mov ebx, dword [esp + 0x24]
mov edx, dword [ebx + 0x18]
sub edx, dword [ebx + 0x14]
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x14], 0
mov edx, dword [ebx + 0x18]
cmp dword [ebx + 4], edx
jle 0x61ccb7
mov eax, 0x64
jmp 0x61cbd3
mov edx, dword [esp + 0x1c]
lea eax, [edx - 1]
test eax, eax
jle 0x61cc64
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x18]
cmp edx, ecx
ja 0x61ccb0
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x10]
mov eax, dword [eax + 0xc]
mov esi, dword [ebx]
mov edi, dword [ebx + 8]
mov dword [esp], ebp
sub edi, edx
sub ecx, edx
mov ebp, edi
xchg edi, ebx
neg ebx
xchg edi, ebx
sar edi, 0x1f
and edi, edx
lea edx, [edi + esi]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
test eax, eax
jl 0x61cc91
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
add dword [ebx + 0x18], eax
test edx, edx
jne 0x61cc43
test eax, eax
jle 0x61cbcc
add esp, 0x20
ret
mov dword [ebx + 0x1c], edx
mov eax, dword [0x93f150]
test eax, eax
je 0x61cc5d
call fcn.00471840
mov dword [edi], ecx
mov eax, dword [ebx + 0x20]
mov dword [edi + 4], eax
mov dword [ebx + 0x20], ecx
add esp, 0x20
ret
mov eax, dword [0x9135a8]
mov ecx, dword [0x9135ac]
mov dword [ebx + 0x1c], eax
mov eax, dword [0x93f150]
test eax, eax
je 0x61cc8a
call fcn.00471840
mov dword [edi], ecx
mov eax, dword [ebx + 0x20]
mov dword [edi + 4], eax
mov dword [ebx + 0x20], ecx
add esp, 0x20
ret
mov eax, dword [0x913b60]
test eax, eax
je 0x61cc9e
mov eax, dword [eax + 4]
mov ecx, dword [0x913b64]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0046a9e0
mov eax, edx
call fcn.00471910
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a558]
mov dword [esp + 4], eax
call fcn.0046a9e0
call fcn.00471910
call fcn.004718f0
nop
call fcn.00470430
jmp fcn.0061cb40
Function at 0x61d600
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61d78a
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov byte [esp + 4], 0xa
call fcn.0061d420
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
cmp dword [0x913b50], eax
jne 0x61d6ef
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], eax
mov ecx, dword [0x913b54]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
call fcn.00404430
movzx eax, byte [esp + 0xc]
test al, al
je 0x61d6db
mov eax, dword [esp + 0x20]
test eax, eax
je 0x61d6ac
mov ecx, dword [esp + 0x2c]
lea edx, [ecx + eax - 1]
cmp byte [edx], 0xd
jne 0x61d6a8
mov edx, dword [esp + 0x34]
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x61d771
dec ebx
mov dword [edx + 0x14], ebx
lea edx, [eax - 1]
jmp 0x61d6b2
mov edx, eax
jmp 0x61d6b2
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x30
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
test edx, edx
jne 0x61d71a
test eax, eax
je 0x61d6fd
xor edx, edx
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebp
add esp, 0x30
ret
lea eax, [ecx + edx - 1]
cmp byte [eax], 0xa
jne 0x61d743
cmp edx, 1
jle 0x61d738
lea eax, [edx + ecx - 2]
cmp byte [eax], 0xd
jne 0x61d738
mov eax, 2
jmp 0x61d73d
mov eax, 1
sub edx, eax
cmp ebx, edx
jb 0x61d768
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x30
ret
mov ecx, edx
mov edx, ebx
call fcn.004718f0
lea eax, [0x6db180]
mov dword [esp], eax
lea eax, [0x78a560]
mov dword [esp + 4], eax
call fcn.0046a9e0
nop
call fcn.00470430
jmp fcn.0061d600
Function at 0x61f4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61f6cc
sub esp, 0x68
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
xor ecx, ecx
mov ebx, 1
jmp 0x61f51d
mov ebp, dword [esp + 0x5c]
lea ecx, [ebp + 1]
cmp dl, 0x2d
sete bl
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
cmp eax, ecx
jle 0x61f6c0
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x18], bl
movzx ebp, byte [edx + ecx]
xchg ebp, eax
mov byte [esp + 0x19], al
xchg ebp, eax
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 1
shl edx, cl
neg ecx
mov byte [esp + 0x1b], cl
mov eax, 1
shr eax, cl
lea edi, [ebp - 0x60]
mov ecx, edi
mov ebx, 1
shl ebx, cl
mov dword [esp + 0x64], ebx
neg ecx
mov byte [esp + 0x1a], cl
mov ebx, 1
shr ebx, cl
mov dword [esp + 0x60], ebx
add ebp, 0xffffffc0
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and edx, esi
movzx esi, byte [esp + 0x1b]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and eax, esi
or eax, edx
and eax, 0x3ff6cfa
cmp cl, 0x20
sbb edx, edx
and edx, ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
mov ebp, dword [esp + 0x64]
and ebp, ebx
movzx ebx, byte [esp + 0x1a]
cmp bl, 0x20
sbb ebx, ebx
mov esi, dword [esp + 0x60]
and esi, ebx
or ebp, esi
and ebp, 0x57ffffff
or ebp, eax
test ebp, ebp
setne al
test edx, 0xc7fffffe
setne dl
or eax, edx
test al, al
je 0x61f6ac
movzx eax, byte [esp + 0x18]
test al, al
je 0x61f601
movzx edx, byte [esp + 0x19]
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x61f614
test al, al
jne 0x61f508
jmp 0x61f606
movzx edx, byte [esp + 0x19]
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x61f508
jmp 0x61f660
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.004509c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0061f6e0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.004509c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0061f6e0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x78], eax
add esp, 0x68
ret
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
add esp, 0x68
ret
call fcn.00470430
jmp fcn.0061f4e0
Function at 0x621a40
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x621bda
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00622a00
mov eax, dword [esp + 0xc]
test eax, eax
je 0x621ba7
mov eax, dword [esp + 0x14]
test eax, eax
je 0x621b93
nop
jle 0x621ab5
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp], eax
lea ecx, [0x71b1fb]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
call fcn.00402d90
movzx eax, byte [esp + 0xc]
test al, al
jne 0x621ae8
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x72aed1]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov eax, dword [esp + 0x18]
dec eax
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, 1
mov edx, dword [esp + 0x1c]
add eax, edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00622a00
mov eax, dword [esp + 0xc]
test eax, eax
je 0x621b60
mov eax, dword [esp + 0x14]
test eax, eax
je 0x621b4c
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2c
lea ecx, [0x72d1b2]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
add esp, 0x20
ret
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x20
lea ecx, [0x7280d9]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
add esp, 0x20
ret
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x720d21]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call fcn.00470430
jmp fcn.00621a40
Function at 0x636540
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6366f4
sub esp, 0x40
mov eax, dword [esp + 0x44]
movzx ecx, byte [eax + 0x54]
test cl, cl
jne 0x63656e
mov ecx, dword [eax + 0x1c]
test ecx, ecx
ja 0x636699
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov ebx, dword [eax + 0x34]
mov byte [esp], 5
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.00636700
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x636689
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x44]
cmp dword [edx + 0x24], eax
setb bl
test ecx, ecx
sete cl
xchg ebp, ebx
seta bl
xchg ebp, ebx
and ecx, ebx
or ebp, ecx
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x63662e
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x30], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x34], ebp
nop
mov dword [edx + 0x20], eax
mov dword [esp], edx
call fcn.00635760
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
mov dword [ecx + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x3c], eax
mov eax, dword [0x93f150]
test eax, eax
jne 0x636606
mov eax, dword [esp + 0x34]
jmp 0x636617
call fcn.00471840
mov eax, dword [esp + 0x34]
mov dword [edi], eax
mov edx, dword [ecx + 0x34]
mov dword [edi + 4], edx
mov dword [ecx + 0x34], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x40
ret
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x23
lea ecx, [0x729743]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea eax, [0x6f05c0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.00409d70
mov eax, dword [esp + 8]
lea ecx, [0x78ad70]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x40
ret
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x40
ret
lea eax, [0x6e6720]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x47
lea ecx, [0x731e07]
mov dword [eax], ecx
lea ecx, [0x78aa3c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea eax, [0x6f05c0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.00409d70
mov eax, dword [esp + 8]
lea ecx, [0x78ad70]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x40
ret
call fcn.00470430
jmp fcn.00636540