joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64b800
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x64b835
push esi
lea ecx, [ecx]
movsx ecx, cl
mov esi, ecx
xor esi, eax
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add esi, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
mov eax, esi
jne 0x64b810
pop esi
ret

Function at 0x64cc70
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
jmp 0x64cc80
mov esi, dword [edi + 0x158]
mov ecx, dword [0x977b10]
xor eax, eax
cmp esi, 0xa
setne al
add eax, ecx
jne 0x64ccc5
push 0x1dc
push str.._row_row0mysql.c
push str.err___DB_SUCCESS
call fcn.00651650
mov ecx, dword [0x977b18]
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x64ccc5
mov dword [0x977b18], 0
mov eax, dword [0x977b14]
test eax, eax
je 0x64cce0
push 0x1dc
push str.._row_row0mysql.c
call fcn.006516c0
add esp, 8
cmp esi, 0x11
mov dword [edi + 0x158], 0xa
je 0x64cd61
cmp esi, 0x22
je 0x64cd61
cmp esi, 0x25
je 0x64cd61
cmp esi, 0x24
je 0x64cd61
cmp esi, 0x26
je 0x64cd61
cmp esi, 0xe
jne 0x64cd3d
push ebx
call fcn.00646910
mov eax, dword [edi + 0x158]
add esp, 4
cmp eax, 0xa
je 0x64cd2a
push ebx
call fcn.006a1240
add esp, 4
jmp 0x64cc80
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [edx], 0xe
mov eax, 1
pop ebx
ret
cmp esi, 0xf
je 0x64ce18
cmp esi, 0x2d
je 0x64ce18
cmp esi, 0x23
jne 0x64cd9a
mov eax, dword [0x977b08]
test eax, eax
jne 0x64ce18
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x64cd75
push eax
push 1
push edi
call fcn.0065f520
add esp, 0xc
mov eax, dword [edi + 0x158]
cmp eax, 0xa
je 0x64ce21
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov dword [edi + 0x158], 0xa
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp esi, 0xd
je 0x64cd61
cmp esi, 0x20
jne 0x64cdbd
push 0x93e408
push str.InnoDB:_The_database_cannot_continue_operation_because_of_nInnoDB:_lack_of_space._You_must_add_a_new_data_file_to_nInnoDB:_my.cnf_and_restart_the_database._n
call fcn.006d079c
add esp, 8
push 1
call fcn.006cf0c8
cmp esi, 0x27
jne 0x64cdd6
push 0x93e408
push str.InnoDB:_We_detected_index_corruption_in_an_InnoDB_type_table._nInnoDB:_You_have_to_dump__drop__reimport_the_table_or__in_nInnoDB:_a_case_of_widespread_corruption__dump_all_InnoDB_nInnoDB:_tables_and_recreate_the_whole_InnoDB_tablespace._nInnoDB:_If_the_mysqld_server_crashes_after_the_startup_or_when_nInnoDB:_you_dump_the_tables__look_at_nInnoDB:_http:__dev.mysql.com_doc_refman_5.0_en_forcing_recovery.html_for_help._n
call fcn.006d079c
add esp, 8
jmp 0x64cd75
push esi
push str.InnoDB:_unknown_error_code__lu_n
push 0x93e408
call fcn.006cf108
push 0x235
push str.._row_row0mysql.c
push 0
call fcn.00651650
mov eax, dword [0x977b18]
mov ecx, dword [eax]
add esp, 0x18
test ecx, ecx
je 0x64cd75
mov dword [0x977b18], 0
jmp 0x64cd75
push 0
push 0
jmp 0x64cd6c
mov edx, dword [esp + 0x10]
mov dword [edx], esi
mov dword [edi + 0x158], 0xa
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x653460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
test eax, eax
mov dword [esp], 0
je 0x653475
mov dword [esp], 1
push ebp
mov ebp, dword [esi + 4]
push edi
mov edi, dword [esi + 0xc0]
test edi, edi
mov dword [esp + 0xc], ebp
je 0x6534c0
jmp 0x653490
mov eax, dword [edi + 0x38]
mov eax, dword [eax + 8]
cmp dword [eax], 0x10
jne 0x6534b0
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x6534b9
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [ecx + 0x10]
mov dword [eax + 0x10], ecx
jmp 0x6534b9
push eax
call fcn.006baaa0
add esp, 4
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x653490
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x653576
push ebx
mov ebx, dword [eax + 4]
cmp dword [esi + 0x94], ebx
jae 0x653507
mov edx, dword [esi + 0x88]
mov eax, dword [edx + ebx*4 - 4]
cmp dword [eax], 0x10
jne 0x6534fe
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x653507
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [ecx + 0x10]
mov dword [eax + 0x10], ecx
jmp 0x653507
push eax
call fcn.006baaa0
add esp, 4
xor edx, edx
test ebx, ebx
jbe 0x65353e
xor edi, edi
nop
mov eax, dword [esi + 0x88]
mov eax, dword [eax + edx*4]
mov ecx, dword [esi + 0x8c]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [eax + 0xc]
add eax, 0xc
add ecx, edi
mov dword [ecx], ebp
mov eax, dword [eax + 4]
inc edx
add edi, 0x20
cmp edx, ebx
mov dword [ecx + 4], eax
jb 0x653510
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x4c]
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x8c]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
lea edi, [esi + 8]
push edi
push eax
push ecx
push edx
push 0
push ebp
mov dword [edi + 0x38], eax
mov dword [edi + 0x5c], ecx
call fcn.0066bc40
add esp, 0x20
pop ebx
jmp 0x6535a5
mov ecx, dword [esi + 0x78]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x4c]
xor edx, edx
test ecx, ecx
sete dl
lea edi, [esi + 8]
mov dword [edi + 0x38], eax
lea edx, [edx + edx + 1]
mov dword [edi + 0x5c], edx
mov edx, dword [esp + 0x18]
push edx
push edi
push eax
push ebp
push ecx
call fcn.0066c270
add esp, 0x14
mov dword [edi + 0x60], 0
mov dword [edi + 0x3c], 0x7514483
mov dword [edi + 0x58], 0x7711e160
pop edi
mov dword [esi + 0x7c], 1
pop ebp
add esp, 8
ret
Function at 0x65ab50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea esi, [ecx + eax]
xor eax, eax
cmp ecx, esi
jae 0x65ab85
push edi
movzx edx, byte [ecx]
mov edi, edx
xor edi, eax
xor edi, 0xff946a4f
shl edi, 8
add edi, eax
xor edi, 0x573ed587
add edi, edx
inc ecx
cmp ecx, esi
mov eax, edi
jb 0x65ab63
pop edi
pop esi
ret
Function at 0x661e30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x30]
push ebx
push ebp
xor eax, eax
cmp edx, eax
push esi
push edi
mov dword [esp + 0x14], eax
jbe 0x661fa3
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x20]
mov ebp, dword [edx + 0x34]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp + edi + 4]
mov al, byte [ecx]
add ebp, edi
xor edx, edx
test al, al
je 0x661e94
lea esp, [esp]
movsx eax, al
mov esi, eax
xor esi, edx
xor esi, 0xff946a4f
shl esi, 8
add esi, edx
xor esi, 0x573ed587
add esi, eax
mov al, byte [ecx + 1]
inc ecx
test al, al
mov edx, esi
jne 0x661e70
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x10]
mov esi, ebx
mov al, byte [esi]
xor ecx, ecx
test al, al
je 0x661ec9
movsx eax, al
mov edi, eax
xor edi, ecx
xor edi, 0xff946a4f
shl edi, 8
add edi, ecx
xor edi, 0x573ed587
add edi, eax
mov al, byte [esi + 1]
inc esi
test al, al
mov ecx, edi
jne 0x661ea5
mov eax, dword [0x978ea0]
mov esi, dword [eax + 0x38]
mov eax, ecx
xor eax, edx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, edx
xor eax, 0x62946a4f
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi + 8]
mov edi, dword [ecx + edx*4]
test edi, edi
je 0x661f73
lea ebx, [ebx]
mov esi, dword [ebp + 4]
mov eax, dword [edi + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x661f2a
test cl, cl
je 0x661f26
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x661f2a
add eax, 2
add esi, 2
test cl, cl
jne 0x661f06
xor eax, eax
jmp 0x661f2f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x661f6d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x10]
mov esi, ebx
jmp 0x661f40
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x661f64
test cl, cl
je 0x661f60
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x661f64
add eax, 2
add esi, 2
test cl, cl
jne 0x661f40
xor eax, eax
jmp 0x661f69
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x661f7d
mov edi, dword [edi]
test edi, edi
jne 0x661f00
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [ebp], edi
mov edx, dword [ecx + 0x30]
inc eax
add esi, 0x18
cmp eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jb 0x661e50
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x67d580
Capabilities:
Terminate process

Disassembly:
push 0
call fcn.0067d4c0
add esp, 4
cmp eax, 0x48
jne 0x67d5ec
mov eax, dword [0x978f20]
test eax, eax
jne 0x67d5e9
test esi, esi
je 0x67d5b9
push 0x93e408
call fcn.00658930
push esi
push str.__InnoDB:_Encountered_a_problem_with_file__s_n
push 0x93e408
call fcn.006cf108
add esp, 0x10
push 0x93e408
call fcn.00658930
push str.__InnoDB:_Disk_is_full._Try_to_clean_the_disk_to_free_space._n
push 0x93e408
call fcn.006cf108
push 0x93e408
mov dword [0x978f20], 1
call fcn.006d188b
add esp, 0x10
xor eax, eax
ret
cmp eax, 0x4b
jne 0x67d5f7
mov eax, 1
ret
cmp eax, 0x49
je 0x67d5e9
cmp eax, 0x4a
je 0x67d5e9
test esi, esi
je 0x67d618
push esi
push str.InnoDB:_File_name__s_n
push 0x93e408
call fcn.006cf108
add esp, 0xc
mov eax, dword [esp + 4]
push eax
push str.InnoDB:_File_operation_call:__s._n
push 0x93e408
call fcn.006cf108
mov eax, dword [esp + 0x14]
add esp, 0xc
test eax, eax
je 0x67d5e9
push str.InnoDB:_Cannot_continue_operation._n
push 0x93e408
call fcn.006cf108
push 0x93e408
call fcn.006d188b
add esp, 0xc
push 1
call fcn.006cf0c8
int3

Function at 0x67df00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x977b10]
push esi
mov esi, dword [esp + 8]
add eax, esi
jne 0x67df3b
push 0x60d
push str..osos0file.c
push str.file
call fcn.00651650
mov ecx, dword [0x977b18]
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x67df3b
mov dword [0x977b18], 0
mov eax, dword [0x977b14]
test eax, eax
je 0x67df56
push 0x60d
push str..osos0file.c
call fcn.006516c0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
pop esi
je 0x67df68
mov eax, 1
ret
push 0
call fcn.0067d4c0
add esp, 4
cmp eax, 0x48
jne 0x67dfb3
mov eax, dword [0x978f20]
test eax, eax
jne 0x67dfb0
push 0x93e408
call fcn.00658930
push str.__InnoDB:_Disk_is_full._Try_to_clean_the_disk_to_free_space._n
push 0x93e408
call fcn.006cf108
push 0x93e408
mov dword [0x978f20], 1
call fcn.006d188b
add esp, 0x10
xor eax, eax
ret
cmp eax, 0x4b
je 0x67dfb0
cmp eax, 0x49
je 0x67dfb0
cmp eax, 0x4a
je 0x67dfb0
push str.close
push str.InnoDB:_File_operation_call:__s._n
push 0x93e408
call fcn.006cf108
push str.InnoDB:_Cannot_continue_operation._n
push 0x93e408
call fcn.006cf108
push 0x93e408
call fcn.006d188b
add esp, 0x18
push 1
call fcn.006cf0c8
int3

Function at 0x67e100
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.006e44d0
push eax
call fcn.006d3694
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
ret
Function at 0x67e120
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x977b10]
push esi
mov esi, dword [esp + 8]
add eax, esi
jne 0x67e15b
push 0x707
push str..osos0file.c
push str.file
call fcn.00651650
mov ecx, dword [0x977b18]
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x67e15b
mov dword [0x977b18], 0
mov eax, dword [0x977b14]
test eax, eax
je 0x67e176
push 0x707
push str..osos0file.c
call fcn.006516c0
add esp, 8
mov eax, dword [0x978f10]
inc eax
push esi
mov dword [0x978f10], eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
pop esi
jne 0x67e1a1
mov eax, dword [0x978e74]
test eax, eax
je 0x67e1a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne 0x67e1a7
mov eax, 1
ret
push 0
call fcn.0067d4c0
add esp, 4
cmp eax, 0x48
jne 0x67e21c
mov eax, dword [0x978f20]
test eax, eax
jne 0x67e1ef
push 0x93e408
call fcn.00658930
push str.__InnoDB:_Disk_is_full._Try_to_clean_the_disk_to_free_space._n
push 0x93e408
call fcn.006cf108
push 0x93e408
mov dword [0x978f20], 1
call fcn.006d188b
add esp, 0x10
push 0x71e
push str..osos0file.c
push 0
call fcn.00651650
mov edx, dword [0x977b18]
mov eax, dword [edx]
add esp, 0xc
test eax, eax
je 0x67e219
mov dword [0x977b18], 0
xor eax, eax
ret
cmp eax, 0x4b
je 0x67e1ef
cmp eax, 0x49
je 0x67e1ef
cmp eax, 0x4a
je 0x67e1ef
push str.flush
push str.InnoDB:_File_operation_call:__s._n
push 0x93e408
call fcn.006cf108
push str.InnoDB:_Cannot_continue_operation._n
push 0x93e408
call fcn.006cf108
push 0x93e408
call fcn.006d188b
add esp, 0x18
push 1
call fcn.006cf0c8
int3
Function at 0x67e270
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [0x977b10]
sub esp, 8
inc eax
jne 0x67e2a8
push 0x841
push str..osos0file.c
push str._offset__0xFFFFFFFFUL___offset
call fcn.00651650
mov ecx, dword [0x977b18]
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x67e2a8
mov dword [0x977b18], 0
mov eax, dword [0x977b14]
test eax, eax
je 0x67e2c3
push 0x841
push str..osos0file.c
call fcn.006516c0
add esp, 8
mov edx, dword [0x978f04]
mov ecx, dword [0x978f08]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
push esi
inc edx
add ecx, ebp
mov esi, ebx
push edi
mov dword [0x978f04], edx
mov dword [0x978f08], ecx
and esi, 0xf
nop
mov eax, dword [0x978ed8]
mov edx, dword [esp + 0x28]
push eax
mov dword [esp + 0x14], edx
call fcn.00687ff0
mov edi, dword [0x978f30]
mov ecx, dword [0x978ed8]
inc edi
push ecx
mov dword [0x978f30], edi
call fcn.00688110
mov edx, dword [esi*4 + 0x97b000]
push edx
call fcn.00687ff0
mov ecx, dword [esp + 0x30]
add esp, 0xc
push 0
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x67e384
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x67e384
mov edx, dword [esi*4 + 0x97b000]
push edx
call fcn.00688110
mov eax, dword [0x978ed8]
push eax
call fcn.00687ff0
mov edi, dword [0x978f30]
mov ecx, dword [0x978ed8]
dec edi
push ecx
mov dword [0x978f30], edi
call fcn.00688110
add esp, 0xc
jmp 0x67e3d5
mov eax, dword [esp + 0x20]
push 0
lea edx, [esp + 0x18]
push edx
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esi*4 + 0x97b000]
push ecx
mov edi, eax
call fcn.00688110
mov edx, dword [0x978ed8]
push edx
call fcn.00687ff0
dec dword [0x978f30]
mov eax, dword [0x978ed8]
push eax
call fcn.00688110
add esp, 0xc
test edi, edi
je 0x67e3d5
cmp dword [esp + 0x14], ebp
je 0x67e48d
push 0
call fcn.0067d4c0
add esp, 4
cmp eax, 0x48
je 0x67e44f
cmp eax, 0x4b
je 0x67e2f0
cmp eax, 0x49
je 0x67e3fb
cmp eax, 0x4a
jne 0x67e49a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InnoDB:_Fatal_error:_cannot_read_from_file._OS_error_number__lu._n
push 0x93e408
call fcn.006cf108
push 0x93e408
call fcn.006d188b
push 0x895
push str..osos0file.c
push 0
call fcn.00651650
mov ecx, dword [0x977b18]
mov eax, dword [ecx]
add esp, 0x1c
test eax, eax
je 0x67e445
mov dword [0x977b18], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [0x978f20]
test eax, eax
jne 0x67e3fb
push 0x93e408
call fcn.00658930
push str.__InnoDB:_Disk_is_full._Try_to_clean_the_disk_to_free_space._n
push 0x93e408
call fcn.006cf108
push 0x93e408
mov dword [0x978f20], 1
call fcn.006d188b
add esp, 0x10
jmp 0x67e3fb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push str.read
push str.InnoDB:_File_operation_call:__s._n
push 0x93e408
call fcn.006cf108
push str.InnoDB:_Cannot_continue_operation._n
push 0x93e408
call fcn.006cf108
push 0x93e408
call fcn.006d188b
add esp, 0x18
push 1
call fcn.006cf0c8
int3
Function at 0x688cd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
movzx eax, byte [esi + 0x14]
movzx ecx, byte [esi + 0x15]
movzx edx, byte [esi + 0x16]
shl eax, 8
add eax, ecx
movzx ecx, byte [esi + 0x17]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0x3ffc]
shl eax, 8
add eax, ecx
movzx ecx, byte [esi + 0x3ffd]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 0x3ffe]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 0x3fff]
shl edx, 8
add edx, ecx
cmp eax, edx
je 0x688d30
mov eax, 1
pop esi
add esp, 0x10
ret
mov eax, dword [0x979814]
test eax, eax
push edi
je 0x688dcb
lea edx, [esp + 8]
push edx
call fcn.0065ddf0
add esp, 4
test eax, eax
je 0x688dcb
lea edi, [esi + 0x10]
push edi
call fcn.0066dd00
mov ecx, dword [esp + 0xc]
add esp, 4
cmp ecx, eax
ja 0x688dcb
jb 0x688d6d
mov eax, dword [esp + 0xc]
cmp eax, edx
jae 0x688dcb
push 0x93e408
call fcn.00658930
push edi
call fcn.0066dd00
mov ecx, dword [esp + 0x10]
add esp, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
push eax
push ecx
push edx
push edi
call fcn.0066dd00
movzx edx, byte [esi + 4]
movzx ecx, byte [esi + 6]
add esp, 4
push eax
movzx eax, byte [esi + 5]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 7]
shl edx, 8
add edx, ecx
shl edx, 8
add edx, eax
push edx
push str.__InnoDB:_Error:_page__lu_log_sequence_number__lu__lu_nInnoDB:_is_in_the_future__Current_system_log_sequence_number__lu__lu._nInnoDB:_Your_database_may_be_corrupt_or_you_may_have_copied_the_InnoDB_nInnoDB:_tablespace_but_not_the_InnoDB_log_files._See_nInnoDB:_http:__dev.mysql.com_doc_refman_5.0_en_forcing_recovery.html_nInnoDB:_for_more_information._n
push 0x93e408
call fcn.006cf108
add esp, 0x1c
mov eax, dword [0x93afb8]
test eax, eax
je 0x688e96
movzx edi, byte [esi + 0x3ff8]
movzx ecx, byte [esi + 0x3ff9]
movzx edx, byte [esi + 0x3ffa]
movzx eax, byte [esi + 0x3ffb]
shl edi, 8
add edi, ecx
movzx ecx, byte [esi + 0x10]
shl edi, 8
add edi, edx
movzx edx, byte [esi + 0x11]
shl ecx, 8
add ecx, edx
movzx edx, byte [esi + 0x13]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x12]
shl ecx, 8
add ecx, eax
shl ecx, 8
add ecx, edx
cmp edi, ecx
je 0x688e48
push 0x1a
push esi
call fcn.0065ab50
add esp, 8
cmp edi, eax
je 0x688e48
cmp edi, 0xdeadbeef
je 0x688e48
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret
movzx edi, byte [esi]
movzx eax, byte [esi + 1]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl edi, 8
add edi, eax
shl edi, 8
add edi, ecx
shl edi, 8
add edi, edx
je 0x688e96
push ebx
lea eax, [esi + 4]
push 0x16
push eax
call fcn.0065ab50
push 0x3fd2
add esi, 0x26
push esi
mov ebx, eax
call fcn.0065ab50
add ebx, eax
add esp, 0x10
cmp edi, ebx
pop ebx
je 0x688e96
cmp edi, 0xdeadbeef
jne 0x688e3d
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x68dac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, eax
xor esi, ecx
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
mov eax, dword [esp + 0x14]
xor esi, 0x573ed587
add esi, ecx
xor ebx, ebx
test eax, eax
jbe 0x68db62
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
mov ebx, eax
push edi
mov edi, edi
mov ecx, dword [edx + 4]
cmp ecx, 0xffffffff
je 0x68db4f
mov eax, dword [edx]
lea edi, [eax + ecx]
xor ecx, ecx
cmp eax, edi
jae 0x68db38
movzx edx, byte [eax]
mov ebp, edx
xor ebp, ecx
xor ebp, 0xff946a4f
shl ebp, 8
add ebp, ecx
xor ebp, 0x573ed587
add ebp, edx
inc eax
cmp eax, edi
mov ecx, ebp
jb 0x68db13
mov edx, dword [esp + 0x18]
mov eax, ecx
xor eax, esi
xor eax, 0xff946a4f
shl eax, 8
add eax, esi
xor eax, 0x573ed587
add eax, ecx
mov esi, eax
mov eax, dword [esp + 0x20]
add edx, 0x20
dec eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jne 0x68db00
pop edi
mov edx, dword [esp + 0x18]
test edx, edx
jbe 0x68dbab
mov ecx, dword [esp + 0x10]
mov ebp, dword [ecx + 0xc]
shl ebx, 5
add ebx, ebp
mov eax, ebx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x68dbab
cmp eax, edx
jbe 0x68db88
mov eax, edx
push eax
push ecx
call fcn.0065ab50
mov ecx, eax
xor eax, esi
xor eax, 0xff946a4f
add esp, 8
shl eax, 8
add eax, esi
pop esi
xor eax, 0x573ed587
pop ebp
add eax, ecx
pop ebx
ret
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x68dbf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp + 4]
push esi
push edi
mov edi, dword [esp + 0x1c]
cmp edi, eax
jbe 0x68dc0b
mov dword [esp + 0x1c], eax
mov edi, eax
jmp 0x68dc0d
jne 0x68dc15
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov esi, eax
xor esi, ecx
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add esi, ecx
xor ebx, ebx
test edi, edi
jbe 0x68dcc0
test ebx, ebx
jne 0x68dc4a
mov ecx, edx
jmp 0x68dc56
mov ecx, dword [ebp + ebx*4 + 8]
and ecx, 0x3fffffff
add ecx, edx
mov eax, dword [ebp + ebx*4 + 0xc]
test eax, eax
js 0x68dcbb
and eax, 0x3fffffff
sub eax, ecx
add eax, edx
cmp eax, 0xffffffff
je 0x68dcbb
lea edi, [eax + ecx]
xor eax, eax
cmp ecx, edi
jae 0x68dc9e
movzx edx, byte [ecx]
mov ebp, edx
xor ebp, eax
xor ebp, 0xff946a4f
shl ebp, 8
add ebp, eax
xor ebp, 0x573ed587
add ebp, edx
inc ecx
cmp ecx, edi
mov eax, ebp
jb 0x68dc75
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov ecx, eax
xor ecx, esi
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, esi
xor ecx, 0x573ed587
add ecx, eax
mov esi, ecx
inc ebx
cmp ebx, edi
jb 0x68dc42
mov edi, dword [esp + 0x20]
test edi, edi
jbe 0x68dd21
test ebx, ebx
jne 0x68dcd0
mov ecx, edx
jmp 0x68dcdc
mov ecx, dword [ebp + ebx*4 + 8]
and ecx, 0x3fffffff
add ecx, edx
mov eax, dword [ebp + ebx*4 + 0xc]
test eax, eax
jns 0x68dce9
or eax, 0xffffffff
jmp 0x68dcf2
and eax, 0x3fffffff
sub eax, ecx
add eax, edx
cmp eax, 0xffffffff
je 0x68dd21
cmp eax, edi
jbe 0x68dcfd
mov eax, edi
push eax
push ecx
call fcn.0065ab50
mov ecx, eax
xor eax, esi
add esp, 8
xor eax, 0xff946a4f
shl eax, 8
pop edi
add eax, esi
pop esi
xor eax, 0x573ed587
pop ebp
add eax, ecx
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x6a8620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x670
mov eax, dword [0x93e25c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x680]
push edi
mov edi, ecx
mov dword [esp + 0x67c], eax
mov eax, dword [edi + 0x28]
xor ebx, ebx
xor ecx, ecx
cmp eax, ebx
mov dword [esp + 0x10], 0xa
mov dword [esp + 0x14], ebx
lea ebp, [esp + 0x90]
mov dword [esp + 0x90], 0x64
jbe 0x6a8681
mov edx, dword [esi + 0xc]
add edx, 4
mov edi, edi
cmp dword [edx], 0xffffffff
je 0x6a8741
inc ecx
add edx, 0x20
cmp ecx, eax
jb 0x6a8670
mov ecx, dword [esi + 8]
lea edx, [esp + 0x220]
push edx
push ebx
mov dword [esi + 8], eax
lea eax, [esp + 0x28]
push eax
push 1
push 2
push esi
push ebx
push edi
mov dword [esp + 0x244], ebx
mov dword [esp + 0x248], ebx
mov dword [esp + 0x460], ebx
mov dword [esp + 0x464], ebx
mov dword [esp + 0x684], 0x15
mov dword [esp + 0x67c], ebx
mov dword [esp + 0x680], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x7c], 0x7514483
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], 2
call fcn.0066bc40
add esp, 0x20
mov dword [esp + 0x78], 0x7711e160
mov dword [esp + 0x80], ebx
add eax, 0x63
jmp 0x6a8760
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
mov ecx, dword [esp + 0x66c]
call fcn.006cedd0
add esp, 0x670
ret
mov ecx, dword [esp + 0x688]
push ecx
push ebx
push 5
push ebp
push edi
push esi
push ebx
call fcn.00687000
jmp 0x6a87e7
Function at 0x6c1e10
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x9779c4]
push edi
mov edi, dword [esp + 0x10]
inc esi
mov dword [0x9779c4], esi
mov eax, dword [edi + 0x38]
mov esi, dword [edi + 0x5c]
mov ebx, dword [eax + 0x3c]
push edi
call fcn.006c1cb0
mov esi, eax
add esp, 4
cmp esi, 0xa
mov dword [ebx + 0x158], esi
je 0x6c1ea4
push esi
push str.InnoDB:_Fatal_error__lu_in_rollback._n
push 0x93e408
call fcn.006cf108
add esp, 0xc
cmp esi, 0xd
jne 0x6c1e74
push str.InnoDB:_Error_13_means_out_of_tablespace._nInnoDB:_Consider_increasing_your_tablespace._n
push 0x93e408
call fcn.006cf108
add esp, 8
push 1
call fcn.006cf0c8
push 0x158
push str.._row_row0undo.c
push 0
call fcn.00651650
mov ecx, dword [0x977b18]
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x6c1e9e
mov dword [0x977b18], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebx
ret