joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acd00
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x53909c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48]
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0x147
push eax
call ebp
cmp eax, ebx
jle 0x4acddf
mov ecx, dword [edi + 0x20]
push ebx
push eax
push 0x150
push ecx
call ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x4c], eax
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::CString::constructor_void_]
mov ebx, 1
mov dword [esp + 0x40], ebx
mov edx, dword [0x5c6ed0]
push str.SELECT__text__FROM_statusNotes2_WHERE_id__
push edx
lea ecx, [esp + 0x2c]
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::db::CCommand::constructor_class_wtw::db::CConnection___wchar_t_const__]
mov byte [esp + 0x40], 2
lea eax, [esp + 0x4c]
push eax
push ebx
lea ecx, [esp + 0x2c]
call dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CCommand::bind_int__int_const__]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x28]
call dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CCommand::executeAndRead_class_wtw::CString__]
lea ecx, [esp + 0x14]
call dword [sym.imp.libWTW.module_public:_wchar_t_const____thiscall_wtw::CString::c_str_void_const]
push eax
mov ecx, esi
call dword [0x55a504]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x40], bl
lea ecx, [esp + 0x24]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::db::CCommand::destructor_void_]
mov byte [esp + 0x40], 0
lea ecx, [esp + 0x14]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::CString::destructor_void_]
jmp 0x4acdf8
mov edx, dword [esp + 0x4c]
push edx
mov ecx, esi
call dword [0x55a520]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x10], 1
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 8
Function at 0x4af700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5421d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], 1
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov byte [esp + 0x10], bl
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
sub esp, 0x14
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x30], esp
mov dword [eax + 0x10], ecx
mov byte [esp + 0x40], 2
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push ecx
push eax
push edi
push edx
push esi
mov byte [esp + 0x54], 1
call fcn.004afe30
add esp, 0x34
mov dword [esp + 0x14], 1
mov byte [esp + 0x20], bl
lea edi, [esp + 0x2c]
call fcn.004aebb0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4b02c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x545bc9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov edi, 1
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
mov byte [esp + 0x34], bl
mov edx, dword [esp + 0x34]
push edx
push eax
sub esp, 0x14
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x50], esp
mov dword [eax + 0x10], ecx
mov byte [esp + 0x60], 2
push esi
mov byte [esp + 0x64], 1
mov ecx, dword [esp + 0x84]
call fcn.004b0650
add esp, 0x40
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], bl
lea edi, [esp + 0x30]
call fcn.004aebb0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4b0650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x545b79
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 1
jmp 0x4b0690
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
cmp ecx, eax
je 0x4b06f9
mov edx, dword [esp + 0x74]
cmp edx, dword [esp + 0x7c]
je 0x4b06f9
lea eax, [esp + 0x60]
call fcn.00413720
mov esi, eax
lea eax, [esp + 0x70]
call fcn.00413720
push esi
push eax
call edi
add esp, 8
test al, al
je 0x4b06df
lea eax, [esp + 0x70]
call fcn.00413720
lea ebx, [esp + 0x44]
call fcn.004b01c0
inc dword [esp + 0x74]
xor ebx, ebx
jmp 0x4b0690
lea eax, [esp + 0x60]
call fcn.00413720
lea ebx, [esp + 0x44]
call fcn.004b01c0
inc dword [esp + 0x64]
xor ebx, ebx
jmp 0x4b0690
push eax
mov eax, dword [esp + 0x6c]
push eax
push ecx
mov ecx, dword [esp + 0x6c]
push ecx
sub esp, 0x14
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x3c], esp
mov dword [eax + 0x10], edx
mov byte [esp + 0x5c], 2
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x60], 1
call fcn.004af700
add esp, 0x28
mov byte [esp + 0x38], 3
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x54], ecx
mov byte [esp + 0x38], 1
lea edi, [esp + 0x1c]
call fcn.004aebb0
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x74]
push eax
push ecx
push edx
sub esp, 0x14
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x3c], esp
mov dword [eax + 0x10], ecx
mov byte [esp + 0x5c], 4
push ebp
mov byte [esp + 0x60], 1
call fcn.004af700
add esp, 0x28
mov dword [esp + 0x14], 1
mov byte [esp + 0x38], bl
lea edi, [esp + 0x44]
call fcn.004aebb0
mov eax, ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4b10a0
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x545ae8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, esi
call fcn.004a6e70
mov dword [esp + 0x18], 0
mov ecx, dword [0x5c6ed0]
lea eax, [esp + 0xc]
push eax
push str.SELECT_COUNT___FROM_sqlite_master_WHERE_namecontactInfos_
mov dword [esi], vtable.CExtendManager.0
call dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CConnection::executeAndRead_wchar_t_const___int__]
cmp dword [esp + 0xc], 0
jne 0x4b1119
mov ecx, dword [0x5c6ed0]
mov edi, dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CConnection::executeNoRead_wchar_t_const__]
push str.CREATE_TABLE_contactInfos____network__VARCHAR_64_____id__VARCHAR_64_____name__VARCHAR_32_____value__TEXT___
call edi
mov ecx, dword [0x5c6ed0]
push str.CREATE_UNIQUE_INDEX_contactInfosUnique_ON_contactInfos___network____id____name___
call edi
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004b1640
mov ecx, dword [0x5c6d24]
push 0
push esi
push fcn.004b0d70
push str.WTW_Extend_GetField
call fcn.004b3950
mov ecx, dword [0x5c6d24]
push 0
push esi
push 0x4b0eb0
push str.WTW_Extend_SetField
call fcn.004b3950
mov ecx, dword [0x5c6d24]
push 0
push esi
push 0x4b0fb0
push str.WTW_Extend_DelField
call fcn.004b3950
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x4b1200
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x534aa2
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [0x5c6ed0]
push str.SELECT_network_FROM_contactInfos_WHERE_id__AND_name__
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::db::CCommand::constructor_class_wtw::db::CConnection___wchar_t_const__]
mov dword [esp + 0x3c], 0
lea ecx, [esp + 0xc]
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::CString::constructor_void_]
mov byte [esp + 0x3c], 1
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx]
mov esi, dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CCommand::bind_int__wchar_t_const___int_]
push 0xffffffffffffffff
push eax
push 1
lea ecx, [esp + 0x28]
call esi
mov edx, dword [esp + 0x44]
mov eax, dword [edx]
push 0xffffffffffffffff
push eax
push 2
lea ecx, [esp + 0x28]
call esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CCommand::executeAndRead_class_wtw::CString__]
test eax, eax
jne 0x4b12d6
lea ecx, [esp + 0xc]
call dword [sym.imp.libWTW.module_public:_wchar_t_const____thiscall_wtw::CString::operator_wchar_t_const__void_const]
mov ecx, dword [esp + 0x4c]
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov byte [esp + 0x3c], 0
lea ecx, [esp + 0xc]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::CString::destructor_void_]
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x1c]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::db::CCommand::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 0xc
mov byte [esp + 0x3c], 0
lea ecx, [esp + 0xc]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::CString::destructor_void_]
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x1c]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::db::CCommand::destructor_void_]
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 0xc
Function at 0x4b1310
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x5420bc
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x54]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x18], 0
mov ecx, dword [eax]
mov ebx, dword [0x5c6f50]
push ecx
push edx
call fcn.004e8350
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x4b1370
push ebp
mov ecx, edi
call dword [0x55a520]
jmp 0x4b1454
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4b144b
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b1380
sub eax, edx
sar eax, 1
je 0x4b144b
mov eax, dword [0x5c6ed0]
push str.SELECT_value_FROM_contactInfos_WHERE_network__AND_id__AND_name__
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::db::CCommand::constructor_class_wtw::db::CConnection___wchar_t_const__]
mov ebx, 1
mov dword [esp + 0x4c], ebx
lea ecx, [esp + 0x1c]
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::CString::constructor_void_]
mov byte [esp + 0x4c], 2
mov esi, dword [esi + 0x10]
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CCommand::bind_int__wchar_t_const___int_]
push ebx
lea ecx, [esp + 0x38]
call esi
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
push 0xffffffffffffffff
push eax
push 2
lea ecx, [esp + 0x38]
call esi
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
push 0xffffffffffffffff
push eax
push 3
lea ecx, [esp + 0x38]
call esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CCommand::executeAndRead_class_wtw::CString__]
test eax, eax
jne 0x4b1440
lea ecx, [esp + 0x1c]
call dword [sym.imp.libWTW.module_public:_wchar_t_const____thiscall_wtw::CString::c_str_void_const]
push eax
mov ecx, edi
call dword [0x55a504]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x1c]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::CString::destructor_void_]
mov byte [esp + 0x4c], 0
lea ecx, [esp + 0x2c]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::db::CCommand::destructor_void_]
jmp 0x4b1460
push ebp
mov ecx, edi
call dword [0x55a520]
jmp 0x4b141d
push ebp
mov ecx, edi
call dword [0x55a520]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x18], 1
mov eax, edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x14
Function at 0x4b7c30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54b539
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [0x5c704c]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x28], 0x4b7c00
mov dword [esp + 0x20], str.GA_Timer
mov dword [esp + 0x24], 0xea60
mov dword [esp + 0x2c], esi
call dword [0x55a6c4]
mov dword [esp + 0x40], 0
mov ebx, dword [0x5c7008]
lea eax, [esp + 0x14]
push eax
push 0x55ae9c
push str.GA_UAID
call fcn.00513fa0
push str.UA_387051_23
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
test eax, eax
je 0x4b7d1f
push str.GA_First
call fcn.00513eb0
push str.GA_Prev
call fcn.00513eb0
push str.GA_Visits
call fcn.00513eb0
push str.GA_UID
call fcn.00513eb0
mov ecx, dword [0x5c7008]
push 0
push str.UA_387051_23
push str.GA_UAID
call fcn.00514160
mov ebx, dword [0x5c7008]
lea edi, [esi + 0x10]
push edi
push 0
push 0
push str.GA_First
call fcn.00514760
mov ebp, dword [sym.imp.MSVCR90.dll__time64]
push 0
call ebp
mov ebx, dword [0x5c7008]
add esp, 4
lea ecx, [esi + 0x18]
push ecx
push edx
push eax
push str.GA_Prev
call fcn.00514760
mov edx, dword [edi]
or edx, dword [edi + 4]
jne 0x4b7d85
push edx
call ebp
mov ecx, dword [0x5c7008]
add esp, 4
push edx
push eax
push str.GA_First
call fcn.00514e30
push 0
call ebp
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], edx
push 0
call ebp
mov ecx, dword [0x5c7008]
add esp, 4
push edx
push eax
push str.GA_Prev
call fcn.00514e30
mov ebx, dword [0x5c7008]
lea edi, [esi + 0x20]
push edi
push 0
push str.GA_Visits
call fcn.00514350
inc dword [edi]
mov edi, dword [edi]
mov ecx, dword [0x5c7008]
push edi
push str.GA_Visits
call fcn.00514480
lea edi, [esi + 0x28]
push edi
call fcn.004b7070
mov ebx, dword [0x5c7008]
push eax
push str.GA_UID
call fcn.00514350
mov eax, dword [edi]
mov ecx, dword [0x5c7008]
push eax
push str.GA_UID
call fcn.00514480
xor edi, edi
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push 0x4b7480
push edi
push edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
cmp eax, edi
je 0x4b7e26
lea ecx, [esp + 0x1c]
call fcn.004ff910
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7e50
Capabilities:
Suspend thread
Terminate thread

Disassembly:
mov eax, dword [0x5c6f74]
push esi
mov esi, dword [0x5c704c]
test eax, eax
je 0x4b7e6a
push str.GA_Timer
call fcn.004ffb00
cmp dword [esi + 0x30], 0
je 0x4b7ebb
mov eax, dword [esi + 0xc]
push eax
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x30]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4b7eaa
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], 0
pop esi
ret

Function at 0x4b8580
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
xor eax, eax
push esi
mov esi, dword [0x5c7050]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x4b8270
push 0
push 0
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x2c], 0x4b8550
mov dword [esp + 0x24], str.GH_Timer
mov dword [esp + 0x28], 0xea60
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
test eax, eax
je 0x4b85ff
lea ecx, [esp + 8]
call fcn.004ff910
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b8610
Capabilities:
Suspend thread
Terminate thread

Disassembly:
mov eax, dword [0x5c6f74]
push esi
mov esi, dword [0x5c7050]
test eax, eax
je 0x4b862a
push str.GH_Timer
call fcn.004ffb00
cmp dword [esi + 0x18], 0
je 0x4b867b
mov eax, dword [esi + 8]
push eax
mov dword [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x18]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4b866a
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
pop esi
ret
Function at 0x4bb650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x538ca0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
lea ecx, [esi + 0x28]
mov dword [esi], 0x28
call dword [0x55a6c4]
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x2c]
call dword [0x55a6c4]
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x30]
call dword [0x55a6c4]
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x38]
call dword [0x55a6c4]
mov byte [esp + 0x14], 3
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4bb700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x53d400
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [esp + 0x60]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
lea ecx, [edi + 0x28]
mov dword [edi], 0x28
call dword [0x55a6c4]
mov dword [esp + 0x58], 0
lea ecx, [edi + 0x2c]
call dword [0x55a6c4]
mov byte [esp + 0x58], 1
lea ecx, [edi + 0x30]
call dword [0x55a6c4]
mov byte [esp + 0x58], 2
lea ecx, [edi + 0x38]
call dword [0x55a6c4]
mov byte [esp + 0x58], 3
lea ecx, [esp + 0xc]
call fcn.004bb650
lea ecx, [esp + 0xc]
call fcn.00417f00
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0xc]
push eax
call fcn.004bb7d0
lea ecx, [esp + 0xc]
call fcn.00417f00
mov dword [esp + 0x58], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x54
ret 8
Function at 0x4bb7d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x538c49
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0xc], 0
mov eax, dword [esi + 4]
push eax
lea ecx, [edi + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov ecx, dword [esi + 8]
push ecx
lea ecx, [edi + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov edx, dword [esi + 0xc]
push edx
lea ecx, [edi + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov eax, dword [esi + 0x10]
mov dword [edi + 0x34], eax
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x3c], ecx
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x4bb848
mov edx, dword [esi + 4]
push edx
lea ecx, [edi + 0x38]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
push edi
push ebx
call fcn.0042aa00
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 1
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4bbc80
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x5528f6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::db::CConnection::constructor_void_]
xor edi, edi
mov dword [esp + 0x1c], edi
lea eax, [esi + 0x10]
push eax
call fcn.0040f7d0
mov byte [esp + 0x1c], 1
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x38]
call sub.mfc90u.dll_CEvent::CEvent
mov byte [esp + 0x1c], 2
lea eax, [esi + 0x40]
push eax
mov dword [esp + 0x14], eax
call fcn.004d3aa0
mov byte [esp + 0x1c], 4
mov ecx, dword [0x5c6d24]
push edi
push esi
push 0x4bdcb0
push str.Ar_WriteSMS
call fcn.004b3950
mov ecx, dword [0x5c6d24]
push edi
push esi
push 0x4bdda0
push str.Ar_WriteMessage
call fcn.004b3950
mov ecx, dword [0x5c6d24]
push edi
push esi
push 0x4c3ca0
push str.Arch_Transaction
call fcn.004b3950
mov ecx, dword [0x5c6d24]
push edi
push esi
push 0x4bd980
push str.WTW_TriggerArchiveWrite
call fcn.004b3950
push esi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
call fcn.004be1e0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push 0x4bbf40
push edi
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x34], eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4