joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65240b60
Capabilities:
Reference sql statements

Disassembly:
push ebp
push eax
push ecx
lea edx, [ebx + 0x278]
push str.SELECT_column_name_FROM_SYS.SYSARTICLECOL_a___SYS.SYSCOLUMN_WHERE_a.table_id__SYS.SYSCOLUMN.table_id_AND_a.column_id__SYS.SYSCOLUMN.column_id_AND_publication_id_s_AND_a.table_id_s
push edx
xor ebp, ebp
call fcn.65237150
push eax
mov eax, dword [ebx + 0x1e8]
push 0x15
push eax
call fcn.65261aa0
mov ecx, dword [ebx + 0x1e8]
push 0x15
push ecx
call fcn.65262260
add esp, 0x24
test eax, eax
je 0x65240c37
push edi
lea edi, [ebx + 0x128]
push esi
mov edx, dword [ebx + 0x1e8]
push 0
push 0x15
push edx
call fcn.652617d0
add esp, 0xc
mov esi, eax
call fcn.652379d0
test eax, eax
push esi
jne 0x65240bf2
test ebp, ebp
je 0x65240bdb
push 0x6528cc04
push 0xf
push edi
call fcn.652371f0
add esp, 0x10
jmp 0x65240c0c
push 0x65293f88
push 0xf
push edi
call fcn.652371f0
add esp, 0x10
mov ebp, 1
jmp 0x65240c0c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push str.EXEC_sp_add_article_col___s_____s_____s__r_ngo_r_n
push 0xf
push edi
call fcn.652371f0
add esp, 0x18
mov edx, dword [ebx + 0x1e8]
push 0x15
push edx
call fcn.65262260
add esp, 8
test eax, eax
jne 0x65240ba6
test ebp, ebp
pop esi
je 0x65240c36
push 0x6528b878
push 0xf
push edi
call fcn.652371f0
add esp, 0xc
pop edi
pop ebp
mov dword [esp + 8], 0x15
mov eax, dword [ebx + 0x1e8]
mov dword [esp + 4], eax
jmp fcn.65261d80
Function at 0x65241460
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [esi]
test byte [eax + 0x24], 0x10
je 0x65241492
mov eax, dword [eax + 0x3b]
push eax
push eax
lea eax, [esi + 0x278]
push str.SELECT_type_name__user_name___option____setting__FROM_SYS.SYSREMOTETYPE_srt__SYS.SYSREMOTEOPTIONTYPE_srot__SYS.SYSREMOTEOPTION_sro__SYS.SYSUSERPERM_sup_WHERE_srt.type_id__srot.type_id_AND_srot.option_id__sro.option_id_AND_sro.user_id__sup.user_id_AND__sro.user_id__user_id___s___OR_sro.user_id_IN__select_group_id_FROM_SYS.SYSGROUP_WHERE_group_member__user_id___s_____
push eax
call fcn.65237150
mov ecx, dword [esi + 0x1e8]
push eax
push 0x13
push ecx
call fcn.65261aa0
add esp, 0x1c
jmp 0x652414a8
mov edx, dword [esi + 0x1e8]
push str.SELECT_type_name__user_name___option____setting__FROM_SYS.SYSREMOTETYPE_srt__SYS.SYSREMOTEOPTIONTYPE_srot__SYS.SYSREMOTEOPTION_sro__SYS.SYSUSERPERM_sup_WHERE_srt.type_id__srot.type_id_AND_srot.option_id__sro.option_id_AND_sro.user_id__sup.user_id
push 0x13
push edx
call fcn.65261aa0
add esp, 0xc
mov eax, dword [esi + 0x1e8]
push 0x13
push eax
call fcn.65262260
add esp, 8
test eax, eax
je 0x65241537
push edi
lea edi, [esi + 0x128]
mov ecx, dword [esi + 0x1e8]
push 3
push 0x13
push ecx
call fcn.652617d0
mov edx, dword [esi + 0x1e8]
add esp, 0xc
push eax
push 2
push 0x13
push edx
call fcn.652617d0
add esp, 0xc
push eax
mov eax, dword [esi + 0x1e8]
push 1
push 0x13
push eax
call fcn.652617d0
mov ecx, dword [esi + 0x1e8]
add esp, 0xc
push eax
push 0
push 0x13
push ecx
call fcn.652617d0
add esp, 0xc
push eax
push str.SET_REMOTE___s__OPTION___s_.__s____s__r_ngo_r_n
push 0xf
push edi
call fcn.652371f0
mov edx, dword [esi + 0x1e8]
push 0x13
push edx
call fcn.65262260
add esp, 0x24
test eax, eax
jne 0x652414c4
pop edi
mov eax, dword [esi + 0x1e8]
push 0x13
push eax
call fcn.65261d80
add esp, 8
ret
Function at 0x65242700
Capabilities:
Reference sql statements

Disassembly:
sub esp, 8
push ebx
push esi
call fcn.652379d0
mov eax, dword [esp + 0x14]
push eax
lea ecx, [edi + 0x278]
push str.SELECT_error__description_FROM_SYS.SYSUSERMESSAGES_WHERE_uid___s
push ecx
mov dword [esp + 0x14], 0
call fcn.65237150
mov edx, dword [edi + 0x1e8]
push eax
push 0x16
push edx
call fcn.65261aa0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
add esp, 0x18
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x6524276a
test cl, cl
je 0x65242766
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x6524276a
add eax, 2
add esi, 2
test cl, cl
jne 0x65242742
xor eax, eax
jmp 0x6524276f
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
test eax, eax
mov eax, dword [edi + 0x1e8]
sete bl
push 0x16
push eax
mov dword [esp + 0x14], ebx
call fcn.65262260
add esp, 8
test eax, eax
je 0x652428be
lea esi, [edi + 0x128]
push ebp
lea ebx, [ebx]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x652427da
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push 0xc
push esi
call fcn.65237220
add esp, 0x10
test ebx, ebx
jne 0x652427d2
mov eax, dword [esp + 0x1c]
push ebx
push eax
push 0xc
push esi
call fcn.65237220
add esp, 0x10
mov dword [esp + 0xc], 1
mov ecx, dword [edi + 0x1e8]
push 0
push 0x16
push ecx
call fcn.652617d0
push eax
push str.CREATE_MESSAGE__s_AS_r_n
push 0xc
push esi
call fcn.652371f0
mov edx, dword [edi + 0x1e8]
push 1
push 0x16
push edx
call fcn.652617d0
push 0xc
push esi
mov ebp, eax
call fcn.652371e0
add esp, 0x30
test eax, eax
je 0x6524284f
mov ecx, ebp
lea ebx, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x65242820
push eax
push 0x652385e0
xor eax, eax
mov al, byte [edi + 0x126]
push 1
push 1
sub ecx, ebx
push eax
push str._x_nov
push ecx
push ebp
call fcn.6526d4b0
mov ebx, dword [esp + 0x30]
add esp, 0x20
push str._r_ngo_r_n_r_n
push 0xc
push esi
call fcn.652371f0
mov ecx, dword [edi + 0x1e8]
push 0x16
push ecx
call fcn.65262260
add esp, 0x14
test eax, eax
jne 0x652427a0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x652428bd
test ebx, ebx
jne 0x652428ad
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
push ebp
push ebx
push 0xc
push esi
call fcn.65237220
push 0x6528b6e4
push 0xc
push esi
call fcn.652371f0
push ebp
push ebx
push 0xc
push esi
call fcn.65237220
add esp, 0x2c
push 0x6528b6e4
push 0xc
push esi
call fcn.652371f0
add esp, 0xc
pop ebp
mov edx, dword [edi + 0x1e8]
push 0x16
push edx
call fcn.65261d80
add esp, 8
pop esi
pop ebx
add esp, 8
ret
Function at 0x652428e0
Capabilities:
Reference sql statements

Disassembly:
push ecx
push ebx
push ebp
push edi
push eax
lea ecx, [esi + 0x278]
push str.SELECT_type_name__domain_name__nulls__width__scale___default____check__FROM_SYS.SYSUSERTYPE__SYS.SYSDOMAIN__WHERE_SYS.SYSUSERTYPE.domain_id__SYS.SYSDOMAIN.domain_id_AND_domain_name____java.lang.Object_AND_creator___s
push ecx
mov dword [esp + 0x18], 0
call fcn.65237150
mov edx, dword [esi + 0x1e8]
push eax
push 0x17
push edx
call fcn.65261aa0
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
add esp, 0x18
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x65242940
test cl, cl
je 0x6524293c
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x65242940
add eax, 2
add edi, 2
test cl, cl
jne 0x65242918
xor eax, eax
jmp 0x65242945
sbb eax, eax
sbb eax, 0xffffffff
mov edx, dword [esi + 0x1e8]
xor ecx, ecx
test eax, eax
sete cl
push 0x17
push edx
mov ebp, ecx
call fcn.65262260
add esp, 8
test eax, eax
je 0x65242aa2
lea edi, [esi + 0x128]
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x652429aa
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push 2
push edi
call fcn.65237220
add esp, 0x10
test ebp, ebp
jne 0x652429a2
mov edx, dword [esp + 0x14]
push ebp
push edx
push 2
push edi
call fcn.65237220
add esp, 0x10
mov dword [esp + 0xc], 1
mov eax, dword [esi + 0x1e8]
push 0
push 0x17
push eax
call fcn.652617d0
push eax
push str.CREATE_DOMAIN__s
push 2
push edi
call fcn.652371f0
mov ecx, dword [esi + 0x1e8]
push 5
push 0x17
push ecx
call fcn.652617f0
mov edx, dword [esi + 0x1e8]
push 6
push 0x17
push edx
mov ebx, eax
call fcn.652617f0
add esp, 0x34
push eax
mov eax, dword [esi + 0x1e8]
push 0
push ebx
push 4
push 0x17
push eax
call fcn.652617d0
mov ecx, dword [esi + 0x1e8]
add esp, 0xc
push eax
push 3
push 0x17
push ecx
call fcn.652617d0
mov edx, dword [esi + 0x1e8]
add esp, 0xc
push eax
push 2
push 0x17
push edx
call fcn.652617d0
add esp, 0xc
push eax
mov eax, dword [esi + 0x1e8]
push 0
push 1
push 0x17
push eax
call fcn.652617d0
add esp, 0xc
push eax
push 2
push esi
call fcn.6523e720
push 0x6528fa54
push 2
push edi
call fcn.652371f0
mov ecx, dword [esi + 0x1e8]
push 0x17
push ecx
call fcn.65262260
add esp, 0x3c
test eax, eax
jne 0x65242970
mov eax, dword [esp + 0xc]
test eax, eax
je 0x65242aa2
test ebp, ebp
jne 0x65242a92
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push 2
push edi
call fcn.65237220
add esp, 0x10
push 0x6528b6e4
push 2
push edi
call fcn.652371f0
add esp, 0xc
mov ecx, dword [esi + 0x1e8]
push 0x17
push ecx
call fcn.65261d80
add esp, 8
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x65242ac0
Capabilities:
Reference sql statements

Disassembly:
push ebp
push esi
push edi
lea ebp, [ebx + 0x278]
push str.SELECT_user_id_FROM_SYS.SYSUSERPERM_WHERE_SYS.SYSUSERPERM.user_name__rs_systabgroup
push ebp
call fcn.65237150
push eax
mov eax, dword [ebx + 0x1e8]
push 0
push eax
call fcn.65261aa0
mov ecx, dword [ebx + 0x1e8]
push 0
push ecx
call fcn.65262260
add esp, 0x1c
test eax, eax
je 0x65242b1d
mov edx, dword [ebx + 0x1e8]
push 0
push 0
push edx
mov edi, 0x65293d74
call fcn.652617d0
add esp, 0xc
mov esi, eax
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x65242b45
push str.rs_systabgroup
push str.REVOKE_CONNECT_FROM___s__r_ngo_r_n
lea esi, [ebx + 0x128]
push 0
push esi
call fcn.652371f0
push str.sa_exec_script__rstab.sql____r_ngo_r_n
push 1
push esi
call fcn.652371f0
add esp, 0x1c
mov ecx, dword [ebx + 0x1e8]
push 0
push ecx
call fcn.65261d80
push str.SELECT_user_id_FROM_SYS.SYSUSERPERM_WHERE_SYS.SYSUSERPERM.user_name__SA_DEBUG
push ebp
call fcn.65237150
mov edx, dword [ebx + 0x1e8]
push eax
push 0
push edx
call fcn.65261aa0
mov eax, dword [ebx + 0x1e8]
push 0
push eax
call fcn.65262260
add esp, 0x24
test eax, eax
je 0x65242ba7
mov ecx, dword [ebx + 0x1e8]
push 0
push 0
push ecx
mov edi, 0x65296984
call fcn.652617d0
add esp, 0xc
mov esi, eax
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x65242bcf
push str.SA_DEBUG
push str.REVOKE_CONNECT_FROM___s__r_ngo_r_n
lea esi, [ebx + 0x128]
push 0
push esi
call fcn.652371f0
push str.sa_exec_script__sadebug.sql____r_ngo_r_n
push 1
push esi
call fcn.652371f0
add esp, 0x1c
mov eax, dword [ebx + 0x1e8]
push 0
push eax
call fcn.65261d80
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x65243720
Capabilities:
Reference sql statements

Disassembly:
call fcn.652379d0
test eax, eax
jne 0x65243860
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test byte [eax + 0x24], 0x10
jne 0x6524385f
push esi
call fcn.65262cf0
add esp, 4
test eax, eax
je 0x6524385f
mov eax, dword [esi]
cmp byte [eax + 0x23], 2
jne 0x65243768
mov ecx, dword [eax + 0x16]
push 0x15ef
push ecx
call fcn.652659d0
add esp, 8
lea edx, [esi + 0x278]
push str.SELECT_l.integrated_login_id__u.user_name__l.remarks_FROM_SYS.SYSLOGIN_l__SYS.SYSUSERPERM_u_WHERE_l.login_uid__u.user_id
push edx
call fcn.65237150
push eax
mov eax, dword [esi + 0x1e8]
push 0x19
push eax
call fcn.65261aa0
mov ecx, dword [esi + 0x1e8]
push 0x19
push ecx
call fcn.65262260
add esp, 0x1c
test eax, eax
je 0x6524384e
push edi
lea edi, [esi + 0x128]
jmp 0x652437b0
mov edx, dword [esi + 0x1e8]
push 1
push 0x19
push edx
call fcn.652617d0
add esp, 0xc
push eax
mov eax, dword [esi + 0x1e8]
push 0
push 0x19
push eax
call fcn.652617d0
add esp, 0xc
push eax
push str.GRANT_INTEGRATED_LOGIN_TO___s__AS_USER___s__r_ngo_r_n
push 0x13
push edi
call fcn.652371f0
mov ecx, dword [esi + 0x1e8]
push 2
push 0x19
push ecx
call fcn.65261720
add esp, 0x20
test eax, eax
jne 0x65243834
mov edx, dword [esi + 0x1e8]
push 2
push 0x19
push edx
call fcn.652617d0
add esp, 0xc
push eax
mov eax, dword [esi + 0x1e8]
push 0
push 0x19
push eax
call fcn.652617d0
add esp, 0xc
push eax
push str.COMMENT_ON_LOGIN___s__IS___s__r_ngo_r_n
push 0x13
push edi
call fcn.652371f0
add esp, 0x14
mov ecx, dword [esi + 0x1e8]
push 0x19
push ecx
call fcn.65262260
add esp, 8
test eax, eax
jne 0x652437b0
pop edi
mov edx, dword [esi + 0x1e8]
push 0x19
push edx
call fcn.65261d80
add esp, 8
pop esi
ret
Function at 0x65243f30
Capabilities:
Reference sql statements

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
cmp byte [eax + 0x23], 2
jne 0x65243f4f
mov eax, dword [eax + 0x16]
push 0x15f0
push eax
call fcn.652659d0
add esp, 8
lea eax, [esi + 0x278]
push str.SELECT_class.class_name___jarcomp.contents___SELECT_jar_name_FROM_SYS.SYSJAR_WHERE_class.jar_idjar_id_____userperm.user_name_FROM_SYS.SYSJAVACLASS_class__SYS.SYSJARCOMPONENT_jarcomp__SYS.SYSUSERPERM_userperm__WHERE_class.component_id__jarcomp.component_id_AND_userperm.user_id__class.creator_AND_class.creator___0__AND_class.replaced_by_IS_NULL_AND_jarcomp.contents_IS_NOT_NULL
push eax
call fcn.65237150
mov ecx, dword [esi + 0x1e8]
push eax
push 0x1a
push ecx
call fcn.65261aa0
push str.create_variable__byte_code_long_binary_r_ngo_r_n
lea ebp, [esi + 0x128]
push 3
push ebp
call fcn.652371f0
mov edx, dword [esi + 0x1e8]
push 0x1a
push edx
call fcn.65262260
add esp, 0x28
test eax, eax
je 0x652440cf
push ebx
push edi
lea ecx, [ecx]
mov eax, dword [esi + 0x1e8]
push 3
push 0x1a
push eax
call fcn.652617d0
mov edi, dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x14], 0
mov ecx, eax
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [edi]
jne 0x65243fe5
test dl, dl
je 0x65243fe1
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [edi + 1]
jne 0x65243fe5
add ecx, 2
add edi, 2
test dl, dl
jne 0x65243fc1
xor ecx, ecx
jmp 0x65243fea
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x65244003
push 0
push eax
push 3
push ebp
mov edi, 1
call fcn.65237220
add esp, 0x10
jmp 0x65244007
mov edi, dword [esp + 0x14]
mov ecx, dword [esi + 0x1e8]
push 0
push 0x1a
push ecx
call fcn.652617d0
push eax
lea eax, [esi + 0x278]
push str.___class:__s_r_n
push eax
call fcn.65237150
push eax
push 3
push ebp
call fcn.652371f0
push str._byte_code
push 1
push 0x1a
push 3
push esi
call fcn.65239080
push str.install_java
push 3
push ebp
call fcn.652371f0
mov edx, dword [esi + 0x1e8]
add esp, 0x44
push 2
push 0x1a
push edx
call fcn.65261720
add esp, 0xc
test eax, eax
jne 0x6524408b
mov eax, dword [esi + 0x1e8]
push 2
push 0x1a
push eax
call fcn.652617d0
push eax
push str.update_jar__s_component
push 3
push ebp
call fcn.652371f0
add esp, 0x1c
push str.from__byte_code_r_ngo_r_n
push 3
push ebp
call fcn.652371f0
add esp, 0xc
test edi, edi
je 0x652440b4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push 3
push ebp
call fcn.65237220
add esp, 0x10
mov eax, dword [esi + 0x1e8]
push 0x1a
push eax
call fcn.65262260
add esp, 8
test eax, eax
jne 0x65243fa0
pop edi
pop ebx
push str.drop_variable__byte_code_r_ngo_r_n
push 3
push ebp
call fcn.652371f0
mov ecx, dword [esi + 0x1e8]
push 0x1a
push ecx
call fcn.65261d80
add esp, 0x14
pop esi
pop ebp
ret
Function at 0x65244a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [ebx + 0x24]
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
lea ecx, [ecx]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub edx, ecx
sub edx, esi
jne 0x65244a9e
test ecx, ecx
jne 0x65244aad
test esi, esi
jne 0x65244aad
mov edx, eax
jmp 0x65244b2a
cmp edx, 0xffffffff
jne 0x65244aad
mov edx, 0xfffffffe
jmp 0x65244b2a
mov esi, dword [ebx + 0x24]
lea esi, [eax + esi - 0x106]
cmp ecx, esi
jb 0x65244b2a
mov edi, dword [ebx + 0x30]
mov ecx, eax
mov ebp, ecx
shr ecx, 2
lea esi, [edi + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x68]
mov esi, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x54]
sub edi, eax
sub esi, eax
sub ecx, eax
mov dword [ebx + 0x68], edi
mov edi, dword [ebx + 0x44]
mov dword [ebx + 0x54], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [ebx + 0x64], esi
lea esi, [ecx + edi*2]
movzx ecx, word [esi - 2]
sub esi, 2
cmp ecx, eax
jb 0x65244b01
sub ecx, eax
jmp 0x65244b03
xor ecx, ecx
dec edi
mov word [esi], cx
jne 0x65244af2
mov ecx, dword [ebx + 0x38]
mov edi, eax
lea esi, [ecx + eax*2]
movzx ecx, word [esi - 2]
sub esi, 2
cmp ecx, eax
jb 0x65244b20
sub ecx, eax
jmp 0x65244b22
xor ecx, ecx
dec edi
mov word [esi], cx
jne 0x65244b11
add edx, eax
mov ebp, dword [ebx]
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x65244bf1
mov esi, dword [ebx + 0x64]
mov edi, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
add edi, esi
add edi, ecx
mov ecx, dword [ebp + 4]
mov esi, ecx
cmp esi, edx
mov dword [esp + 0xc], esi
jbe 0x65244b57
mov dword [esp + 0xc], edx
mov esi, edx
test esi, esi
jne 0x65244b5f
xor ecx, ecx
jmp 0x65244bad
mov edx, dword [ebp + 0x1c]
sub ecx, esi
mov dword [ebp + 4], ecx
mov ecx, dword [edx + 0x18]
test ecx, ecx
jne 0x65244b86
mov eax, dword [ebp]
mov ecx, dword [ebp + 0x30]
push esi
push eax
push ecx
call fcn.652442d0
mov dword [ebp + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, esi
mov esi, dword [ebp]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
mov esi, dword [ebp]
mov edx, dword [ebp + 8]
add esi, ecx
add edx, ecx
mov dword [ebp], esi
mov dword [ebp + 8], edx
mov edx, dword [ebx + 0x6c]
add edx, ecx
mov edi, edx
cmp edi, 3
mov dword [ebx + 0x6c], edx
jb 0x65244bdc
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
lea esi, [ecx + edx]
movzx edx, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], edx
shl edx, cl
movzx ecx, byte [esi + 1]
xor edx, ecx
and edx, dword [ebx + 0x4c]
mov dword [ebx + 0x40], edx
cmp edi, 0x106
jae 0x65244bf1
mov edx, dword [ebx]
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x65244a80
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x6524b4c0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x460
push esi
push 0x652e14fc
push str.auditing
push str.public
mov esi, ecx
push 0
lea eax, [esp + 0x1c]
add esi, 0x1c
push esi
mov byte [esp + 0x20], 0
mov dword [0x652e1510], eax
call sub.dblib8.dll_Ordinal_257
mov ecx, dword [str.dbbackup]
push 0
push 2
push 0
push 0
push str.select_db_property_FileVersion_
push 0x652fa904
push ecx
push 0
push esi
call sub.dblib8.dll_Ordinal_260
mov edx, dword [str.dbbackup]
push 1
push 0
push 0
push 0
push 0x652fa904
push edx
push 0
push 0x652e1570
push esi
call sub.dblib8.dll_Ordinal_258
push 0
push 0
push 0x652e1574
push 1
push 1
push 0x652e1570
lea eax, [esp + 0x1c]
push esi
mov dword [0x652e1588], eax
call sub.dblib8.dll_Ordinal_254
push 0x652e1570
push esi
call sub.dblib8.dll_Ordinal_237
mov ax, word [esp + 4]
cmp ax, 0x3ed
mov dword [esp + 0x10], 0x50
jge 0x6524b586
cmp ax, 0x27
jl 0x6524b616
cmp ax, 0x3e8
jge 0x6524b616
lea ecx, [esp + 0xc]
push 0x65296fec
push ecx
call fcn.6527b8f4
add esp, 8
test eax, eax
jne 0x6524b616
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0x14]
push ecx
push 0x400
lea edx, [esp + 0x6c]
push edx
push 0x2480
call fcn.65266420
mov ecx, dword [str.dbbackup]
add esp, 0x10
push 0
push 2
push 0
push 0
push 0x652e15b0
lea eax, [esp + 0x1c]
push eax
push ecx
push 0
push esi
mov dword [esp + 0x2c], 0
call sub.dblib8.dll_Ordinal_260
mov ecx, dword [str.dbbackup]
push 0
push 0x652e15d0
lea eax, [esp + 0x10]
push eax
push ecx
push 0
lea edx, [esp + 0x78]
push esi
mov dword [0x652e15e4], edx
call sub.dblib8.dll_Ordinal_252
mov eax, 1
pop esi
add esp, 0x460
ret
Function at 0x6524c290
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x2ec
push ebx
push esi
mov esi, eax
mov eax, dword [esp + 0x2f8]
push eax
call fcn.6524cf30
xor ebx, ebx
add esp, 4
cmp eax, ebx
jne 0x6524c4aa
mov edx, dword [str.dbcollat]
push ebp
push edi
push ebx
push 2
push ebx
push ebx
push str.SELECT_cs_label__so_case_label__so_caseless_label__jdk_label_n_FROM_SYS.SYSCOLLATIONMAPPINGS_n_WHERE_collation_label__:clabel
lea ecx, [esp + 0x34]
push ecx
push edx
push ebx
lea edi, [esi + 0x24]
push edi
mov dword [esp + 0x44], ebx
call sub.dblib8.dll_Ordinal_260
cmp dword [esi + 0x30], ebx
jge 0x6524c30e
mov eax, dword [esi + 0x1c]
mov ebp, dword [eax + 0x16]
push 0xc8
lea ecx, [esp + 0x238]
push ecx
push edi
call sub.dblib8.dll_Ordinal_286
push eax
push 0x154b
push ebp
call fcn.652659d0
push 1
call fcn.65268a10
add esp, 0x10
mov edx, dword [esp + 0x300]
mov dword [0x652e17b4], edx
lea eax, [esp + 0x12c]
mov dword [0x652e17f4], eax
lea edx, [esp + 0x24]
push 0x652e17e0
mov dword [0x652e1820], edx
lea eax, [esp + 0x14]
mov dword [0x652e1824], eax
lea edx, [esp + 0x18]
push 0x652e17a0
mov dword [0x652e1850], edx
lea eax, [esp + 0xb0]
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
mov dword [0x652e1878], eax
mov eax, dword [str.dbcollat]
mov dword [0x652e17f8], ecx
push eax
lea ecx, [esp + 0x1c0]
mov dword [0x652e184c], ecx
push ebx
lea ecx, [esp + 0x30]
push edi
mov dword [0x652e187c], ecx
call sub.dblib8.dll_Ordinal_267
cmp dword [esi + 0x30], ebx
jge 0x6524c3c1
mov ecx, dword [esi + 0x1c]
mov ebp, dword [ecx + 0x16]
push 0xc8
lea edx, [esp + 0x238]
push edx
push edi
call sub.dblib8.dll_Ordinal_286
push eax
push 0x154b
push ebp
call fcn.652659d0
push 1
call fcn.65268a10
add esp, 0x10
cmp dword [esi + 0x30], 0x64
jne 0x6524c3d4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2ec
ret
mov di, word [esp + 0x18]
cmp di, bx
jge 0x6524c3e6
mov word [esp + 0x12c], bx
movzx eax, word [esp + 0x12c]
mov si, word [esp + 0x10]
cmp si, bx
mov byte [esp + eax + 0x12e], bl
jge 0x6524c404
mov word [esp + 0x24], bx
movzx ecx, word [esp + 0x24]
mov byte [esp + ecx + 0x26], bl
mov cx, word [esp + 0x14]
cmp cx, bx
jge 0x6524c41f
mov word [esp + 0x1b0], bx
movzx edx, word [esp + 0x1b0]
mov ax, word [esp + 0x1c]
cmp ax, bx
mov byte [esp + edx + 0x1b2], bl
jge 0x6524c440
mov word [esp + 0xa8], bx
movzx edx, word [esp + 0xa8]
mov byte [esp + edx + 0xaa], bl
xor edx, edx
cmp ax, bx
setl dl
lea eax, [esp + 0xaa]
dec edx
and edx, eax
push edx
xor edx, edx
cmp cx, bx
setl dl
xor ecx, ecx
lea eax, [esp + 0x1b6]
dec edx
and edx, eax
cmp si, bx
setl cl
push edx
xor eax, eax
lea edx, [esp + 0x2e]
dec ecx
and ecx, edx
mov edx, dword [esp + 0x308]
cmp di, bx
setl al
push ecx
lea ecx, [esp + 0x13a]
dec eax
and eax, ecx
push eax
push edx
call fcn.6524cfc0
add esp, 0x14
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x2ec
ret
Function at 0x65256e30
Capabilities:
Get session user name

Disassembly:
sub esp, 0x458
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x10], 0x50
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edx, dword [esp + 0x460]
push edx
lea eax, [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x68]
push ecx
push 0x247f
call fcn.65266420
mov eax, dword [str.online]
mov esi, dword [esp + 0x478]
add esp, 0x14
push 0
push 2
push 0
push 0
push str.CALL_sa_audit_string__:string__
lea edx, [esp + 0x18]
push edx
push eax
push 0
push esi
mov dword [esp + 0x28], 0
call sub.dblib8.dll_Ordinal_260
mov eax, dword [str.online]
push 0
push 0x652e31f4
lea edx, [esp + 0xc]
push edx
push eax
push 0
lea ecx, [esp + 0x70]
push esi
mov dword [0x652e3208], ecx
call sub.dblib8.dll_Ordinal_252
mov eax, 1
pop esi
add esp, 0x458
ret

Function at 0x65256ee0
Capabilities:
Get session user name

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
jmp fcn.65256e30