joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402eef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41007c]
jne 0x402ef9
repz ret
jmp fcn.00403ab0

Function at 0x406965
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41007c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040592d
and dword [ebp - 0x14], 0
cmp dword [0x411af8], 0
mov dword [ebp - 0x18], eax
jne 0x406a18
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406ac0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406ac0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411af8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411afc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411b00], eax
call edi
push eax
call esi
mov dword [0x411b08], eax
test eax, eax
je 0x406a18
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411b04], eax
mov eax, dword [0x411b04]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406a71
cmp dword [0x411b08], ecx
je 0x406a71
push eax
call esi
push dword [0x411b08]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406a71
test ebx, ebx
je 0x406a71
call edi
test eax, eax
je 0x406a68
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406a68
test byte [ebp - 8], 1
jne 0x406a71
or dword [ebp + 0x10], 0x200000
jmp 0x406aa4
mov eax, dword [0x411afc]
cmp eax, dword [ebp - 0x18]
je 0x406aa4
push eax
call esi
test eax, eax
je 0x406aa4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406aa4
mov eax, dword [0x411b00]
cmp eax, dword [ebp - 0x18]
je 0x406aa4
push eax
call esi
test eax, eax
je 0x406aa4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411af8]
call esi
test eax, eax
je 0x406ac0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406ac2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402eef
leave
ret

Function at 0x43b62e
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
add edx, edx
sub ecx, 0xd75a8d01
call fcn.0043b663
and edx, ecx
xor dword [eax], ebx
inc edx
sub edx, edx
add eax, 1
sub ecx, edx
add ecx, 0xedf71bd6
cmp eax, edi
jne fcn.0043b62e
dec edx
ret
Function at 0x40c4e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x49923c
call fcn.00488048
mov word [ebp - 0x14], 8
push dword [ebp + 8]
call sub.cppv32.dll__VObject__bctr_qv
pop ecx
inc dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], fcn.0040c5aa
cmp dword [0x499228], 0
jne 0x40c599
push str.image32
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x499228], eax
cmp dword [0x499228], 0
je 0x40c599
push str.LOADIMAGE
push dword [0x499228]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4b82cc], eax
push str.GETFORMAT
push dword [0x499228]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4b82d0], eax
push str.GETBITMAP
push dword [0x499228]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4b82d4], eax
push str.DRAWIMAGE
push dword [0x499228]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4b82d8], eax
push str.RELEASEIMAGE
push dword [0x499228]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4b82dc], eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4238f3
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
cmp dword [0x4affb4], 0
je 0x42390c
xor eax, eax
jmp 0x4239b3
cmp word [esi + 0x298], 0
jne 0x423920
mov eax, 1
jmp 0x4239b3
test byte [esi + 0x60], 8
je 0x42392d
xor eax, eax
jmp 0x4239b3
push 0
push dword [esi + 0x10c]
call sub.KERNEL32.dll_GetFileSize
mov dword [esi + 0x294], eax
push 0
push 0
push 0
push dword [esi + 0x10c]
call sub.KERNEL32.dll_SetFilePointer
cmp dword [esi + 0x294], 0
jne 0x42395e
xor eax, eax
jmp 0x4239b3
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
jmp 0x423999
push 0
push dword [esi + 0x294]
push 0
push 0
push dword [esi + 0x10c]
call sub.KERNEL32.dll_LockFile
test eax, eax
je 0x423986
xor eax, eax
jmp 0x4239b3
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x64
jb 0x42398d
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cmp eax, 0x1388
jb 0x423967
push esi
mov eax, dword [esi]
call dword [eax + 0x6c]
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4571d2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x176], 0
jne 0x45723a
push 0
push 0
push ebx
call fcn.004683b0
add esp, 0xc
mov dword [ebx + 0x176], eax
cmp dword [ebx + 0x176], 0
je 0x45723a
cmp dword [0x4aa89c], 0
jne 0x457212
mov dword [0x4aa89c], ebx
cmp ebx, dword [0x4aa89c]
jne 0x45723a
mov eax, dword [ebx + 0x176]
mov word [eax + 0x5d], 1
xor edx, edx
mov dword [eax + 0x59], edx
push ebx
push dword [ebx + 0x176]
call fcn.00469478
add esp, 8
mov ecx, dword [ebx + 0x15a]
mov eax, dword [ecx + 0x202]
push eax
mov edx, dword [eax]
call dword [edx + 0x48]
pop ecx
mov dword [ebp - 4], eax
xor esi, esi
jmp 0x457280
push esi
mov eax, dword [ebx + 0x15a]
mov edx, dword [eax + 0x202]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x78]
add esp, 8
mov edi, eax
test edi, edi
je 0x45727f
mov ax, word [ebp + 0xc]
push eax
push ebx
push edi
mov edx, dword [edi]
call dword [edx + 0x40]
add esp, 0xc
inc esi
mov ecx, dword [ebx + 0x15a]
cmp dword [ecx + 0x202], 0
je 0x457294
cmp esi, dword [ebp - 4]
jl 0x457254
cmp word [ebp + 0xc], 0
jne 0x4572b1
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebx + 0x15e]
cmp eax, 0x3e8
jbe 0x457331
cmp dword [0x4affb4], 0
jne 0x4572c8
mov ax, word [ebp + 0xc]
push eax
push ebx
call fcn.0045057f
add esp, 8
mov edx, dword [0x4b95ac]
mov ecx, dword [edx + 0x26]
mov dword [ebp - 8], ecx
xor edi, edi
jmp 0x457312
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x78]
add esp, 8
mov esi, eax
test esi, esi
je 0x457311
mov eax, dword [0x4a60f8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push esi
mov edx, dword [esi]
call dword [edx + 4]
pop ecx
push eax
call sub.cppv32.dll__VClass_isa_qp6VClass
add esp, 8
test eax, eax
je 0x457311
push esi
call fcn.0043ee0b
pop ecx
inc edi
cmp dword [ebp - 8], 0
je 0x457326
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x48]
pop ecx
cmp edi, eax
jl 0x4572d8
call sub.KERNEL32.dll_GetTickCount
mov dword [ebx + 0x15e], eax
mov eax, dword [ebx + 0x152]
test eax, eax
je 0x457342
push eax
call fcn.00449b4e
pop ecx
push ebx
call fcn.004564bc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fd25
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x4ae5fc
call fcn.00488048
mov word [ebp - 0x34], 8
lea edx, [ebp - 0x20]
push edx
call fcn.00461646
pop ecx
add dword [ebp - 0x28], 4
mov word [ebp - 0x34], 0x14
push dword [ebx + 0x2dc]
push dword [ebx + 0x2d8]
push dword [ebx + 0x2d4]
lea ecx, [ebp - 0x20]
push ecx
call fcn.0046171c
add esp, 0x10
test ax, ax
jne 0x45fd9f
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x45fe74
push dword [ebx + 0x2a2]
push 0x4af09c
lea ecx, [ebp - 0x20]
push ecx
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
mov eax, dword [ebx + 0x2a2]
movsx edx, word [eax + 0x18]
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.00461a27
add esp, 8
lea eax, [ebp - 0x20]
push eax
call fcn.004618a2
pop ecx
test ax, ax
jne 0x45fdfe
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x45fe74
lea ecx, [ebp - 0x20]
push ecx
call fcn.004618cd
pop ecx
test ax, ax
jne 0x45fe45
test esi, esi
je 0x45fe1c
push 0x1f72
call fcn.0046f4b9
pop ecx
push ebx
mov eax, dword [ebx]
call dword [eax + 0x5c]
pop ecx
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x45fe74
push esi
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.0045fb49
add esp, 0xc
movsx eax, ax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46010c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x20]
mov eax, 0x4ae6bc
call fcn.00488048
mov word [ebp - 0x34], 8
push edi
call fcn.00461646
pop ecx
add dword [ebp - 0x28], 4
mov word [ebp - 0x34], 0x14
push dword [ebx + 0x2dc]
push dword [ebx + 0x2d8]
push dword [ebx + 0x2d4]
push edi
call fcn.0046171c
add esp, 0x10
test ax, ax
jne 0x460181
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4602d8
push edi
push ebx
call fcn.0045fcbf
add esp, 8
push eax
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x68]
add esp, 8
push dword [ebx + 0x2a2]
push 0x4af108
push edi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
mov eax, dword [ebx + 0x2a2]
movsx edx, word [eax + 0x18]
push edx
push edi
call fcn.00461a27
add esp, 8
push str._ORDER_BY_Index__ASC
push edi
mov ecx, dword [edi]
call dword [ecx + 0x50]
add esp, 8
push edi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x4601f9
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4602d8
push edi
call fcn.004618cd
pop ecx
test ax, ax
jne 0x4602af
cmp dword [ebp + 0xc], 0
je 0x460286
push dword [ebx + 0x2a2]
push 0x4af13e
push edi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
push edi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x460251
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4602d8
push edi
call fcn.004618cd
pop ecx
test ax, ax
jne 0x4602af
push esi
push ebx
call fcn.0045f325
add esp, 8
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4602d8
push esi
push ebx
call fcn.0045f325
add esp, 8
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4602d8
push esi
push edi
push ebx
call fcn.0045fb49
add esp, 0xc
movsx eax, ax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4602df
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x20]
mov eax, 0x4ae6fc
call fcn.00488048
mov word [ebp - 0x34], 8
push edi
call fcn.00461646
pop ecx
add dword [ebp - 0x28], 4
mov word [ebp - 0x34], 0x14
push dword [ebx + 0x2dc]
push dword [ebx + 0x2d8]
push dword [ebx + 0x2d4]
push edi
call fcn.0046171c
add esp, 0x10
test ax, ax
jne 0x460354
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4604ab
push edi
push ebx
call fcn.0045fcbf
add esp, 8
push eax
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x68]
add esp, 8
push dword [ebx + 0x2a2]
push str.SELECT__FROM__s_WHERE_Index___
push edi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
mov eax, dword [ebx + 0x2a2]
movsx edx, word [eax + 0x18]
push edx
push edi
call fcn.00461a27
add esp, 8
push str._ORDER_BY_Index__DESC
push edi
mov ecx, dword [edi]
call dword [ecx + 0x50]
add esp, 8
push edi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x4603cc
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4604ab
push edi
call fcn.004618cd
pop ecx
test ax, ax
jne 0x460482
cmp dword [ebp + 0xc], 0
je 0x460459
push dword [ebx + 0x2a2]
push str.SELECT__FROM__s_ORDER_BY_Index__DESC
push edi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
push edi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x460424
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4604ab
push edi
call fcn.004618cd
pop ecx
test ax, ax
jne 0x460482
push esi
push ebx
call fcn.0045f325
add esp, 8
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4604ab
push esi
push ebx
call fcn.0045f325
add esp, 8
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4604ab
push esi
push edi
push ebx
call fcn.0045fb49
add esp, 0xc
movsx eax, ax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460734
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x20]
mov eax, 0x4ae77c
call fcn.00488048
mov word [ebp - 0x34], 8
push edi
call fcn.00461646
pop ecx
add dword [ebp - 0x28], 4
mov word [ebp - 0x34], 0x14
push dword [ebx + 0x2dc]
push dword [ebx + 0x2d8]
push dword [ebx + 0x2d4]
push edi
call fcn.0046171c
add esp, 0x10
test ax, ax
jne 0x4607a6
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x46091f
push edi
push ebx
call fcn.0045fcbf
add esp, 8
push eax
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x68]
add esp, 8
push dword [ebx + 0x2a2]
push 0x4af209
push edi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
mov eax, dword [ebx + 0x2a2]
movsx edx, word [eax + 0x18]
push edx
push edi
call fcn.00461a27
add esp, 8
push edi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x460810
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x46091f
push edi
call fcn.004618cd
pop ecx
test ax, ax
jne 0x460856
cmp dword [ebp + 0xc], 0
je 0x46082d
push 0x1f72
call fcn.0046f4b9
pop ecx
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x5c]
pop ecx
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x46091f
push dword [ebx + 0x2a2]
push 0x4af22a
push edi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
xor esi, esi
jmp 0x4608ca
mov eax, dword [ebx + 0x2a2]
movsx edx, word [eax + esi*4 + 0xb0]
push edx
push edi
call fcn.00461937
add esp, 8
push 0x4af239
push edi
mov ecx, dword [edi]
call dword [ecx + 0x50]
add esp, 8
mov eax, dword [ebx + 0x2a2]
movsx edx, word [eax + esi*4 + 0xb0]
push edx
push edi
call fcn.00461a27
add esp, 8
mov ecx, dword [ebx + 0x2a2]
movsx eax, word [ecx + 0x1a]
dec eax
cmp esi, eax
je 0x4608c9
push 0x4af23d
push edi
mov edx, dword [edi]
call dword [edx + 0x50]
add esp, 8
inc esi
mov ecx, dword [ebx + 0x2a2]
movsx eax, word [ecx + 0x1a]
cmp esi, eax
jl 0x46086e
push 0x4af23f
push edi
mov edx, dword [edi]
call dword [edx + 0x50]
add esp, 8
mov ecx, dword [ebx + 0x2a2]
movsx eax, word [ecx + 0x18]
push eax
push edi
call fcn.00461a27
add esp, 8
push edi
call fcn.004618a2
pop ecx
movsx eax, ax
push eax
sub dword [ebp - 0x28], 4
push 2
push edi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460926
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x4ae7bc
call fcn.00488048
mov edx, dword [ebx + 0x2a2]
movsx ecx, word [edx + 0x18]
push ecx
call fcn.00481b74
pop ecx
cmp eax, 5
je 0x460965
xor eax, eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460aae
mov word [ebp - 0x34], 8
lea ecx, [ebp - 0x20]
push ecx
call fcn.00461646
pop ecx
add dword [ebp - 0x28], 4
mov word [ebp - 0x34], 0x14
push dword [ebx + 0x2dc]
push dword [ebx + 0x2d8]
push dword [ebx + 0x2d4]
lea eax, [ebp - 0x20]
push eax
call fcn.0046171c
add esp, 0x10
test ax, ax
jne 0x4609c7
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460aae
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.0045fcbf
add esp, 8
push eax
push ebx
mov eax, dword [ebx]
call dword [eax + 0x68]
add esp, 8
mov edx, dword [ebx + 0x2a2]
movsx ecx, word [edx + 0x18]
push ecx
call fcn.00481b1f
pop ecx
push eax
push dword [ebx + 0x2a2]
push str.SELECT__FROM__s_WHERE_Index__LIKE__s___ORDER_BY_Index__ASC
lea eax, [ebp - 0x20]
push eax
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0x10
lea edx, [ebp - 0x20]
push edx
call fcn.004618a2
pop ecx
test ax, ax
jne 0x460a38
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460aae
lea ecx, [ebp - 0x20]
push ecx
call fcn.004618cd
pop ecx
test ax, ax
jne 0x460a7f
test esi, esi
je 0x460a56
push 0x1f72
call fcn.0046f4b9
pop ecx
push ebx
mov eax, dword [ebx]
call dword [eax + 0x5c]
pop ecx
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460aae
push esi
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.0045fb49
add esp, 0xc
movsx eax, ax
push eax
sub dword [ebp - 0x28], 4
push 2
lea edx, [ebp - 0x20]
push edx
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460ab4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x20]
mov eax, 0x4ae7fc
call fcn.00488048
mov word [ebp - 0x34], 8
push esi
call fcn.00461646
pop ecx
add dword [ebp - 0x28], 4
mov word [ebp - 0x34], 0x14
push dword [ebx + 0x2dc]
push dword [ebx + 0x2d8]
push dword [ebx + 0x2d4]
push esi
call fcn.0046171c
add esp, 0x10
test ax, ax
jne 0x460b25
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push esi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460c48
push dword [ebx + 0x2a2]
push 0x4af28e
push esi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
mov ecx, dword [ebx + 0x2a2]
movsx eax, word [ecx + 0x18]
push eax
push esi
call fcn.00461a27
add esp, 8
push esi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x460b7b
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push esi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460c48
push esi
call fcn.004618cd
pop ecx
test ax, ax
jne 0x460bc1
cmp dword [ebp + 0xc], 0
je 0x460b98
push 0x1f72
call fcn.0046f4b9
pop ecx
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x5c]
pop ecx
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push esi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460c48
push dword [ebx + 0x2a2]
push str.DELETE_FROM__s_WHERE_Index__
push esi
call sub.cppv32.dll__VString_concatPrints_qpxce
add esp, 0xc
mov ecx, dword [ebx + 0x2a2]
movsx eax, word [ecx + 0x18]
push eax
push esi
call fcn.00461a27
add esp, 8
push esi
call fcn.004618a2
pop ecx
test ax, ax
jne 0x460c14
xor eax, eax
push eax
sub dword [ebp - 0x28], 4
push 2
push esi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x460c48
push esi
push ebx
call fcn.0045fcbf
add esp, 8
push eax
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x68]
add esp, 8
mov eax, 1
push eax
sub dword [ebp - 0x28], 4
push 2
push esi
call fcn.004616a1
add esp, 8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46171c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [0x4ae3ec], 0
jne 0x461826
push str.cxsql
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
jne 0x461749
xor eax, eax
jmp 0x461844
push str.CXSQL_CONNECT
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae3f0], eax
cmp dword [0x4ae3f0], 0
jne 0x461769
xor eax, eax
jmp 0x461844
push str.CXSQL_CLOSE
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae3f4], eax
cmp dword [0x4ae3f4], 0
jne 0x461789
xor eax, eax
jmp 0x461844
push str.CXSQL_GETERROR
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae3f8], eax
cmp dword [0x4ae3f8], 0
jne 0x4617a9
xor eax, eax
jmp 0x461844
push str.CXSQL_EXECUTESQL
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae3fc], eax
cmp dword [0x4ae3fc], 0
jne 0x4617c6
xor eax, eax
jmp 0x461844
push str.CXSQL_FETCH
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae400], eax
cmp dword [0x4ae400], 0
jne 0x4617e3
xor eax, eax
jmp 0x461844
push str.CXSQL_GETCOLUMNCOUNT
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae404], eax
cmp dword [0x4ae404], 0
jne 0x461800
xor eax, eax
jmp 0x461844
push str.CXSQL_GETCOLUMN
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4ae408], eax
cmp dword [0x4ae408], 0
jne 0x46181d
xor eax, eax
jmp 0x461844
mov word [0x4ae3ec], 1
mov dx, word [0x4ae3ea]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
add esi, 0x10
push esi
call dword [0x4ae3f0]
add esp, 0x14
pop esi
pop ebx
pop ebp
ret