joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c79c
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
push 0x800
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, ebx
call fcn.00405554
push eax
call sub.shell32.dll_SHGetFileInfoA
test byte [esp + 0xb], 0x40
setne al
add esp, 0x160
pop ebx
ret

Function at 0x49c8a8
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x49cae5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1d], 1
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.00405278
lea eax, [ebp - 0x28]
mov edx, 0x49cb00
call fcn.0040535c
mov eax, dword [ebp - 0x28]
call fcn.00405554
mov dword [ebp - 0x11], eax
mov eax, edi
call fcn.00405554
mov dword [ebp - 0xd], eax
xor eax, eax
mov dword [ebp - 5], eax
cmp byte [ebp - 1], 0
je 0x49c916
mov eax, 1
jmp 0x49c918
xor eax, eax
push eax
push 0
push 0
lea eax, [ebp - 0x21]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
mov eax, ebx
cmp eax, 0x4b0
jg 0x49c977
je 0x49ca1f
cmp eax, 0x43
jg 0x49c962
je 0x49ca30
sub eax, 1
jb 0x49c9e0
sub eax, 4
je 0x49c9ec
sub eax, 0x3d
je 0x49ca0e
jmp case.0x49c985.1204
sub eax, 0x55
je 0x49c9fd
dec eax
je 0x49ca79
jmp case.0x49c985.1204
add eax, 0xfffffb4e
cmp eax, 0x14
ja case.0x49c985.1204
jmp dword [eax*4 + 0x49c98c]
mov eax, esi
call fcn.00405090
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cb0c
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cb24
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cb60
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cba8
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cbc0
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cc04
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cc30
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cc5c
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49ccb0
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49ccc8
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49ccf0
call fcn.004050e4
jmp 0x49cac4
mov eax, esi
mov edx, 0x49cd50
call fcn.004050e4
jmp 0x49cac4
test ebx, ebx
jbe 0x49cac4
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0040a8ac
mov ecx, dword [ebp - 0x2c]
mov eax, esi
mov edx, 0x49cd74
call fcn.004053a0
cmp dword [esi], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49caec
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004050b4
ret
Function at 0x49e508
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x49e510
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x49e676
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41dfb8]
call fcn.00404120
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49e64c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x49e68c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x49e6a0
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x49e6b4
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x49e6c8
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x49e6dc
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x49e636
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00480f38
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00480dc4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
pop ecx
call fcn.004053a0
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.0040326c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040b22c
push dword [ebp - 0x1c]
push 0x49e6f0
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405414
mov eax, dword [ebp - 0x18]
call fcn.00405554
push eax
call sub.kernel32.dll_CopyFileA
inc ebx
dec esi
jne 0x49e59d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e653
mov eax, dword [ebp - 8]
call fcn.00404150
ret
Function at 0x49e6fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49e7c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004038c4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, edi
call fcn.00405554
push eax
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0x49e7d8
push esi
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00405414
mov eax, dword [ebp - 0x5c]
call fcn.00405554
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x49e795
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e7c7
lea eax, [ebp - 0x5c]
call fcn.00405090
ret

Function at 0x49f1cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x105]
xor eax, eax
push ebp
push 0x49f256
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
push 0x104
call sub.kernel32.dll_GetTempPathA
push edi
push 0
push 0x49f264
push edi
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebp - 0x10c]
mov edx, edi
mov ecx, 0x105
call fcn.00405300
mov eax, dword [ebp - 0x10c]
mov ecx, ebx
mov edx, esi
call fcn.0040b198
mov eax, dword [ebx]
call fcn.0040ae08
test al, al
jne 0x49f1f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f25d
lea eax, [ebp - 0x10c]
call fcn.00405090
ret

Function at 0x49f44c
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 5
push 0
mov eax, ebx
call fcn.00405554
push eax
push 0x49f470
push 0x49f47c
push 0
call sub.shell32.dll_ShellExecuteA
pop ebx
ret

Function at 0x4a2a17
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a2a6f
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4a2a65
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a2a73
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4bc5c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x4bc5d9
add esp, 0xfffffff0
call fcn.004044b4
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bc64e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00420c94
xor edx, edx
mov eax, esi
call fcn.004bc7c0
xor edx, edx
mov eax, esi
call fcn.004bc7e4
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.0041b20c
lea edx, [ebp - 0x10]
lea eax, [esi + 0x18]
call fcn.00413308
mov byte [esi + 0x39], 0
mov byte [esi + 0x30], 1
lea eax, [esi + 0x10]
call fcn.00405090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc655
lea eax, [ebp - 0x10]
call fcn.00412ff4
ret

Function at 0x4d2d0c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d2e5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4d2e3c
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
call fcn.004053a0
mov eax, dword [ebp - 0x10]
call fcn.0040ae08
test al, al
je 0x4d2e0b
push 0
mov eax, dword [ebp + 8]
push dword [eax - 8]
push 0x4d2e7c
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405414
mov eax, dword [ebp - 0x14]
call fcn.00405554
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.004053a0
mov eax, dword [ebp - 0x18]
call fcn.00405554
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4d2e34
push 0x4d2e98
mov eax, dword [ebp + 8]
push dword [eax - 4]
push dword [ebp - 4]
push 0x4d2ec4
mov eax, dword [ebp + 8]
push dword [eax - 8]
push 0x4d2ed4
push 0x4d2ef4
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x1c]
call fcn.0040e9a4
push dword [ebp - 0x1c]
push 0x4d2f00
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 9
call fcn.00405414
mov byte [ebp - 9], 0
jmp 0x4d2e3c
push 0x4d2f0c
mov eax, dword [ebp + 8]
push dword [eax - 4]
push dword [ebp - 4]
push 0x4d2f34
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 4
call fcn.00405414
mov byte [ebp - 9], 0
jmp 0x4d2e3c
inc esi
dec ebx
jne 0x4d2d46
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2e66
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004050b4
lea eax, [ebp - 4]
call fcn.00405090
ret
Function at 0x50297c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x4f9358]
call fcn.004042dc
test al, al
je 0x502a21
movzx edx, byte [ebx + 5]
mov edi, esi
mov eax, edi
call fcn.00502a30
movzx eax, byte [ebx + 6]
mov byte [edi + 6], al
movzx edx, byte [ebx + 7]
mov eax, edi
call fcn.00502a68
movzx eax, byte [ebx + 8]
mov byte [edi + 8], al
movzx edx, byte [ebx + 9]
mov eax, edi
call fcn.00502b24
movzx eax, byte [ebx + 0xa]
mov byte [edi + 0xa], al
movzx edx, byte [ebx + 0xb]
mov eax, edi
call fcn.00502a78
movzx edx, byte [ebx + 0xc]
mov eax, edi
call fcn.00502a8c
movzx edx, byte [ebx + 0xd]
mov eax, edi
call fcn.00502aa0
movzx edx, byte [ebx + 0xf]
mov eax, edi
call fcn.00502b40
mov edx, dword [ebx + 0x14]
mov eax, edi
call fcn.00502bb4
movzx eax, byte [ebx + 4]
mov byte [edi + 4], al
movzx eax, byte [ebx + 0x10]
mov byte [edi + 0x10], al
movzx edx, byte [ebx + 0x18]
mov eax, edi
call fcn.00502bd8
jmp 0x502a2a
mov edx, esi
mov eax, ebx
call fcn.00420a18
pop edi
pop esi
pop ebx
ret

Function at 0x507490
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405090
push 0
push 0
push 0x5074e4
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5074dd
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.004057dc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405554
push eax
push 0x5074e4
call sub.kernel32.dll_GetEnvironmentVariableA
pop ecx
pop ecx
pop ebp
ret
Function at 0x5074ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405544
xor eax, eax
push ebp
push 0x507686
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405090
mov word [0x55e960], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4d8aac]
call fcn.00406a08
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x507655
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x507694
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5075fd
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, 4
call fcn.00403070
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.0040a8fc
lea eax, [ebp - 0x24]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.004055b4
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 4
mov edx, 5
mov eax, dword [ebp - 0x20]
call fcn.004055b4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
pop ecx
call fcn.004053a0
jmp 0x50760a
lea eax, [ebp - 0x20]
mov edx, 0x5076b8
call fcn.00405128
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5076cc
push dword [ebp - 0x20]
push 0x5076e8
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00405414
mov eax, dword [ebp - 0x2c]
call fcn.00405554
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x507655
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4d8b30]
call fcn.004d8ea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50768d
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004050b4
lea eax, [ebp - 0xc]
mov edx, dword [0x4d8aac]
call fcn.00406b28
lea eax, [ebp - 4]
call fcn.00405090
ret
Function at 0x5076f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
xor edx, edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405544
xor eax, eax
push ebp
push 0x507881
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x55e980], 0xa
jge 0x507860
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 4]
mov edx, 0x507894
call fcn.004053a0
mov eax, dword [ebp - 0x184]
call fcn.00405554
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x507860
mov dword [ebp - 0xc], 0x64
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x7d]
push eax
push 0
push 0
push 0x5078a8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x507857
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x17d]
push eax
push 0
push 0
push 0x5078bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x507857
mov byte [ebp - 0x11], 0
mov eax, dword [0x55e980]
dec eax
test eax, eax
jl 0x507802
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x55e9d8]
call fcn.00405554
lea edx, [ebp - 0x7d]
call fcn.00409e54
test eax, eax
jne 0x5077fa
mov byte [ebp - 0x11], 1
jmp 0x507802
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x5077d9
cmp byte [ebp - 0x11], 0
jne 0x507857
inc dword [0x55e980]
mov eax, dword [0x55e980]
lea eax, [eax*4 + 0x55e984]
lea edx, [ebp - 0x17d]
mov ecx, pe_nt_image_headers32
call fcn.00405300
mov eax, dword [0x55e980]
lea eax, [eax*4 + 0x55e9ac]
mov edx, dword [ebp - 4]
call fcn.004050e4
mov eax, dword [0x55e980]
lea eax, [eax*4 + 0x55e9d4]
lea edx, [ebp - 0x7d]
mov ecx, 0x65
call fcn.00405300
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507888
lea eax, [ebp - 0x184]
call fcn.00405090
lea eax, [ebp - 4]
call fcn.00405090
ret
Function at 0x50a870
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x50a9fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x557ba4]
cmp byte [eax], 0
jne 0x50a899
call fcn.0050acb0
mov byte [0x55e96a], 0
cmp dword [0x55e980], 1
jle 0x50a95e
cmp dword [0x55e978], 0
je 0x50a95e
lea eax, [ebp - 4]
call fcn.00507490
lea edx, [ebp - 0x10]
mov eax, dword [0x55e954]
call fcn.0040b260
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x50aa14
call fcn.004053a0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405698
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x50a95e
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405350
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00405350
sub ebx, eax
sub ebx, dword [ebp - 0xc]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.00405350
mov edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
pop ecx
call fcn.004055b4
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004055b4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.004053a0
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
push 0x50aa18
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [0x55ea08], 0
jbe 0x50a979
mov eax, dword [0x55ea08]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x55ea08], eax
cmp dword [0x55ea0c], 0
jbe 0x50a994
mov eax, dword [0x55ea0c]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x55ea0c], eax
mov eax, 0x55e954
call fcn.00405090
mov eax, 0x55e958
call fcn.00405090
mov eax, 0x55e95c
call fcn.00405090
mov word [0x55e960], 0
mov byte [0x55e962], 0
mov al, byte [0x50aa20]
mov byte [0x55e963], al
mov eax, 0x55e978
call fcn.00405090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50aa05
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004050b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050b4
ret
Function at 0x50deb4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x50debc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50e0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x55839c]
cmp byte [eax], 0
jne 0x50e093
mov eax, dword [ebp - 4]
cmp dword [eax + 0x50], 0
jne 0x50e083
xor eax, eax
push ebp
push 0x50e059
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c], 1
je 0x50df1b
mov eax, dword [0x558404]
test byte [eax], 2
jne 0x50dfa3
mov eax, dword [ebp - 4]
call fcn.0050dd18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, 0x50e0e4
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.004f17ec
mov dword [ebp - 0x10], eax
mov dx, 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx]
mov dl, 2
mov eax, dword [ebp - 0x10]
call fcn.004f15e8
mov edx, 0x41
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.004f17ec
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 8]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.00416584
jmp 0x50e04f
mov edx, 0xff
mov eax, dword [0x4d8b30]
call fcn.004d8dc4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50e02a
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
push 0xff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
push eax
mov eax, dword [0x557d18]
mov eax, dword [eax]
call eax
add esp, 0x14
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4d8b30]
call fcn.004d8ea0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.004050e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e031
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4d8b30]
call fcn.004d8de0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50e083
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x50]
call fcn.004050e4
jmp 0x50e0a8
mov edx, dword [0x557e54]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov ecx, 0x50e15c
call fcn.004053a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e0d2
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004050b4
lea eax, [ebp - 0x24]
call fcn.00412ff4
ret
Function at 0x50f334
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 1
jne 0x50f377
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
cmp byte [ebp - 9], 0
je 0x50f39c
push 1
push 0x400
push 0x400
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.user32.dll_PeekMessageA
mov byte [ebp - 0xa], 1
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x533f50
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x533fb9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x533f88
lea eax, [ebp - 0x10]
mov edx, 0x533fd0
call fcn.00405128
jmp 0x533f95
lea eax, [ebp - 0x10]
mov edx, 0x534050
call fcn.00405128
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005346fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533fc0
lea eax, [ebp - 0x10]
call fcn.00405090
ret