joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [0x455c9c], esi
mov dword [0x455ca0], ebx
mov eax, dword [esi]
test eax, eax
je 0x414f82
push dword [eax]
jmp 0x414f85
push dword [esi + 4]
call fcn.00415480
mov eax, dword [esi + 0x20]
add esp, 4
lea eax, [eax*2 + 1]
mov dword [0x455c88], eax
call fcn.00416540
mov edi, eax
mov eax, dword [0x455c88]
lea eax, [eax - 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x20], eax
sub edi, 0
je 0x415000
dec edi
je 0x414ff2
dec edi
je 0x414fdd
push str.invalid_yylex_result_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
mov eax, dword [ebp + 0x10]
mov edx, 1
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, edx
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor edx, edx
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov eax, edx
pop ebp
ret
cmp eax, 0xb
ja case.default.0x415009
jmp dword [eax*4 + 0x4150dc]
cmp dword [esi + 0x24], 0
mov eax, dword [ebp + 0x10]
jle 0x41502b
pop edi
mov edx, 2
mov dword [eax], 6
pop esi
mov eax, edx
pop ebx
pop ebp
ret
cmp dword [ebx + 4], 0
jbe 0x415043
pop edi
mov edx, 3
mov dword [eax], 1
pop esi
mov eax, edx
pop ebx
pop ebp
ret
pop edi
mov edx, 2
mov dword [eax], 0
pop esi
mov eax, edx
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov edx, 2
pop edi
pop esi
pop ebx
mov dword [eax], 3
mov eax, edx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov edx, 2
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov eax, edx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov edx, 2
pop edi
pop esi
pop ebx
mov dword [eax], 4
mov eax, edx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov edx, 2
pop edi
pop esi
pop ebx
mov dword [eax], 5
mov eax, edx
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, 2
pop edi
pop esi
mov eax, edx
mov dword [ecx], 3
pop ebx
pop ebp
ret
push str.invalid_YY_START_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
lea ecx, [ecx]
adc byte [eax + 0x41], dl
add byte [ebp + 80], dl
inc ecx
add byte [edx + 0x50], ch
inc ecx
add byte [ebx + 0x50], bh
inc ecx
add byte [ebp + 0x50], dl
inc ecx
add byte [ebp + 0x50], dl
inc ecx
add byte [ebp + 0x50], dl
inc ecx
add byte [eax + 0x7b004150], dl
push eax
inc ecx
add byte [eax], dl
push eax
inc ecx
add byte [ebp + 0x10004150], ah
push eax
inc ecx
add ah, cl
int3
Function at 0x4151b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
test eax, eax
push ebx
lea ebx, [ebp - 1]
cmovne ebx, eax
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp + 0x10], ebx
mov byte [ebx], 0
call sub.LIBPQ.dll_Ordinal_69
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
add esp, 4
mov dword [0x455ca0], ecx
mov dword [0x455c9c], eax
mov ecx, dword [eax]
mov dword [0x455ca4], edi
mov dword [0x455ca8], ebx
mov dword [0x455cac], 0
test ecx, ecx
je 0x41520a
push dword [ecx]
jmp 0x41520d
push dword [eax + 4]
call fcn.00415480
add esp, 4
mov ecx, 0x25
cmp edi, 4
mov eax, 0x1b
cmove eax, ecx
mov dword [0x455c88], eax
call fcn.00416540
mov eax, dword [0x455c88]
dec eax
cdq
sub eax, edx
sar eax, 1
add eax, 0xfffffff3
cmp eax, 5
ja case.default.0x415246
jmp dword [eax*4 + 0x415380]
cmp byte [ebp + 0x14], 0
je 0x41528b
mov ecx, dword [0x455cac]
test ecx, ecx
jle 0x415284
lea ecx, [ecx]
mov eax, dword [ebp - 0xc]
dec ecx
mov esi, dword [ebp - 0x10]
mov dword [0x455cac], ecx
test eax, eax
je 0x415291
cmp byte [esi + eax - 1], 0x3b
jne 0x415291
dec eax
mov dword [ebp - 0xc], eax
mov byte [esi + eax], 0
test ecx, ecx
jg 0x415260
dec ecx
mov dword [0x455cac], ecx
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp edi, 1
je 0x41529b
cmp edi, 2
jne 0x415314
xor bl, bl
cmp byte [esi], bl
je 0x415311
mov al, byte [esi]
cmp al, 0x22
jne 0x4152e1
test bl, bl
je 0x4152b5
cmp byte [esi + 1], al
jne 0x4152b3
inc esi
jmp 0x4152b8
test bl, bl
sete bl
mov ecx, esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4152c0
sub ecx, edx
lea eax, [esi + 1]
push ecx
push eax
push esi
call dword [sym.imp.MSVCR120.dll_memmove]
mov eax, dword [ebp - 0xc]
add esp, 0xc
dec eax
mov dword [ebp - 0xc], eax
jmp 0x415309
test bl, bl
jne 0x4152f5
cmp edi, 1
jne 0x4152f5
push eax
call fcn.004261f0
add esp, 4
mov byte [esi], al
push dword [0x456304]
push esi
call sub.LIBPQ.dll_Ordinal_64
add esp, 8
add esi, eax
mov eax, dword [ebp - 0xc]
cmp byte [esi], 0
jne 0x4152a1
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x415358
cmp byte [ebx], al
jne 0x415358
lea eax, [ebp - 0x10]
push eax
call sub.LIBPQ.dll_Ordinal_67
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unterminated_quoted_string_n
call fcn.00408fb0
lea eax, [ebp - 0x10]
push eax
call sub.LIBPQ.dll_Ordinal_67
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
jmp 0x415314
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.invalid_YY_START_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
push eax
push ebx
inc ecx
add byte [ebp + 0x52], cl
inc ecx
add byte [ecx], dh
push ebx
inc ecx
add byte [ecx], dh
push ebx
inc ecx
add byte [ecx], dh
push ebx
inc ecx
add byte [eax + 0x53], dl
inc ecx
add ah, cl
int3
Function at 0x415df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x42b7e0
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 0xc
push 2
call dword [sym.imp.MSVCR120.dll_exit]
int3

Function at 0x415e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x455c20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x455ca0]
push ebx
push esi
push edi
mov edi, dword [eax]
xor bl, bl
add edi, dword [0x455cb0]
lea eax, [ebp - 0x210]
push eax
call sub.LIBPQ.dll_Ordinal_69
push 0x42e1ec
push edi
call fcn.004290d0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x415ef0
lea esp, [esp]
push esi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
push esi
mov dword [ebp - 0x214], eax
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 0x14
test eax, eax
jne 0x415ec2
push dword [ebp - 0x214]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.LIBPQ.dll_Ordinal_74
push esi
call dword [sym.imp.MSVCR120.dll_feof]
add esp, 0x10
test eax, eax
je 0x415e70
jmp 0x415ee1
call dword [sym.imp.MSVCR120.dll__errno]
push dword [eax]
call dword [sym.imp.MSVCR120.dll_strerror]
push eax
push edi
push str._s:__s_n
call fcn.00408fb0
add esp, 0x10
mov bl, 1
push esi
call dword [sym.imp.MSVCR120.dll__pclose]
add esp, 4
cmp eax, 0xffffffff
jne 0x415f0f
call dword [sym.imp.MSVCR120.dll__errno]
push dword [eax]
call dword [sym.imp.MSVCR120.dll_strerror]
push eax
push edi
push str._s:__s_n
call fcn.00408fb0
mov bl, 1
add esp, 0x10
cmp dword [ebp - 0x208], 0
jne 0x415f28
push edi
push str._s:_out_of_memory_n
call fcn.00408fb0
add esp, 8
mov bl, 1
mov edx, dword [0x455ca0]
test bl, bl
mov ecx, dword [0x455cb0]
pop edi
pop esi
mov eax, dword [edx]
mov dword [edx + 4], ecx
pop ebx
mov byte [ecx + eax], 0
jne 0x415f6d
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x210]
test eax, eax
je 0x415f62
cmp byte [ecx + eax - 1], 0xa
jne 0x415f62
dec eax
mov dword [ebp - 0x20c], eax
push eax
push ecx
push edx
call sub.LIBPQ.dll_Ordinal_74
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call sub.LIBPQ.dll_Ordinal_67
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.00429e54
mov esp, ebp
pop ebp
ret
Function at 0x417380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 8
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax]
push edi
xor edi, edi
cmp byte [ebx], 0
je 0x41750e
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41750b
push dword [ebp + 0x10]
push ebx
call sub.LIBPQ.dll_Ordinal_64
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], eax
jb 0x417508
push dword [ebp + 0x10]
push ebx
call sub.LIBPQ.dll_Ordinal_112
mov edx, dword [ebp - 4]
add esp, 8
mov dword [ebp - 8], eax
cmp edx, 1
jne 0x41747a
mov cl, byte [ebx]
cmp cl, 0xa
jne 0x41740f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov byte [esi], 0
dec ecx
inc esi
mov dword [ebp + 8], ecx
mov dword [eax + 4], edi
add eax, 8
xor edi, edi
mov dword [ebp + 0x14], eax
test ecx, ecx
jle 0x41751b
mov dword [eax], esi
jmp 0x4174f3
cmp cl, 0xd
jne 0x417430
mov ax, word [0x43ed3c]
add edi, 2
mov word [esi], ax
mov al, byte [0x43ed3e]
mov byte [esi + 2], al
add esi, 2
jmp 0x4174f0
cmp cl, 9
jne 0x41744f
inc edi
mov byte [esi], 0x20
mov eax, edi
inc esi
and eax, reloc.LIBPQ.dll_Ordinal_7
jns 0x417448
dec eax
or eax, 0xfffffff8
inc eax
jne 0x417435
jmp 0x4174f0
test eax, eax
jns 0x417473
movzx eax, cl
push eax
push str.x_02X
push esi
call fcn.00426340
mov edx, dword [ebp - 4]
add esp, 0xc
add edi, 4
add esi, 4
jmp 0x4174f0
add edi, eax
mov byte [esi], cl
inc esi
jmp 0x4174f0
test eax, eax
jns 0x4174d7
mov eax, dword [0x455948]
test eax, eax
jns 0x417499
push str.utf8
call sub.LIBPQ.dll_Ordinal_115
add esp, 4
mov dword [0x455948], eax
cmp dword [ebp + 0x10], eax
jne 0x4174be
push ebx
call fcn.00417660
push eax
push str.u_04X
push esi
call fcn.00426340
mov edx, dword [ebp - 4]
add esp, 0x10
add esi, 6
add edi, 6
jmp 0x4174f0
push str.u____
push esi
call fcn.00426340
mov edx, dword [ebp - 4]
add esp, 8
add esi, 6
add edi, 6
jmp 0x4174f0
xor ecx, ecx
test edx, edx
jle 0x4174ee
lea ecx, [ecx]
mov al, byte [ecx + ebx]
inc ecx
mov byte [esi], al
inc esi
cmp ecx, edx
jl 0x4174e0
mov eax, dword [ebp - 8]
add edi, eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
add ebx, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
cmp byte [ebx], 0
jne 0x4173a5
jmp 0x41750b
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], edi
mov byte [esi], 0
pop edi
pop esi
pop ebx
test ecx, ecx
jg 0x417523
push 1
call dword [sym.imp.MSVCR120.dll_exit]
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x4179f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.MSVCR120.dll___iob_func]
test eax, eax
je 0x417a60
cmp word [eax + 8], 0
je 0x417a60
call esi
push eax
call dword [sym.imp.MSVCR120.dll__fileno]
push eax
call dword [sym.imp.MSVCR120.dll__isatty]
add esp, 8
test eax, eax
je 0x417a60
call esi
add eax, 0x20
push eax
call dword [sym.imp.MSVCR120.dll__fileno]
push eax
call dword [sym.imp.MSVCR120.dll__isatty]
add esp, 8
test eax, eax
je 0x417a60
push str.PAGER
call dword [sym.imp.MSVCR120.dll_getenv]
test eax, eax
mov ecx, str.more
push 0x42dc78
cmovne ecx, eax
push ecx
call fcn.004290d0
add esp, 0xc
test eax, eax
jne 0x417a65
call esi
add eax, 0x20
pop esi
pop ebp
ret

Function at 0x417c50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x10]
lea eax, [eax + ecx*4]
cmp dword [esi + 0x14], eax
jb 0x417c8e
push ecx
push str.Cannot_add_header_to_table_content:_column_count_of__d_exceeded._n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 0xc
push 1
call dword [sym.imp.MSVCR120.dll_exit]
mov eax, dword [esi]
push dword [eax + 0x34]
push dword [ebp + 0xc]
call fcn.004172e0
mov ecx, dword [esi + 0x14]
add esp, 8
cmp byte [ebp + 0x10], 0
mov dword [ecx], eax
je 0x417cbb
mov eax, dword [esi + 0x14]
push dword [eax]
call sub.libintl_8.dll_libintl_gettext
mov ecx, dword [esi + 0x14]
add esp, 4
mov dword [ecx], eax
mov ecx, dword [esi + 0x34]
add dword [esi + 0x14], 4
mov al, byte [ebp + 0x14]
mov byte [ecx], al
inc dword [esi + 0x34]
pop esi
pop ebp
ret

Function at 0x417cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
imul eax, dword [esi + 0xc]
cmp dword [esi + 0x20], eax
jl 0x417d0c
push eax
push str.Cannot_add_cell_to_table_content:_total_cell_count_of__d_exceeded._n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 0xc
push 1
call dword [sym.imp.MSVCR120.dll_exit]
mov eax, dword [esi]
push dword [eax + 0x34]
push dword [ebp + 0xc]
call fcn.004172e0
mov ecx, dword [esi + 0x1c]
add esp, 8
cmp byte [ebp + 0x10], 0
mov dword [ecx], eax
je 0x417d39
mov eax, dword [esi + 0x1c]
push dword [eax]
call sub.libintl_8.dll_libintl_gettext
mov ecx, dword [esi + 0x1c]
add esp, 4
mov dword [ecx], eax
cmp byte [ebp + 0x14], 0
je 0x417d63
cmp dword [esi + 0x24], 0
jne 0x417d59
mov eax, dword [esi + 8]
imul eax, dword [esi + 0xc]
inc eax
push eax
call fcn.00424df0
add esp, 4
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov byte [ecx + eax], 1
add dword [esi + 0x1c], 4
inc dword [esi + 0x20]
pop esi
pop ebp
ret
Function at 0x417ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x455cb8], 0
mov byte [ebp - 1], 0
jne 0x418054
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, dword [ecx]
test eax, eax
je 0x418053
push ebx
mov ebx, dword [ebp + 0x10]
push esi
test bl, bl
jne 0x417f3d
cmp eax, 2
je 0x417f3d
cmp eax, 3
je 0x417f3d
cmp word [ecx + 4], 1
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
sete al
movzx eax, al
push eax
push 0
push edi
call fcn.00418520
mov ebx, dword [ebp + 0x10]
add esp, 0x14
mov byte [ebp - 1], bl
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x417f50
push 0
push eax
push edi
call fcn.00419750
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [ecx - 1]
cmp edx, 7
ja case.default.0x417f60
jmp dword [edx*4 + 0x418084]
cmp word [eax + 4], 1
mov esi, dword [ebp + 0xc]
push esi
push edi
jne 0x417f7d
call fcn.00419410
jmp 0x41803f
call fcn.004191e0
jmp 0x41803f
movzx eax, word [eax + 4]
cmp eax, 1
je 0x417fac
cmp eax, 2
jne 0x417f99
test bl, bl
jne 0x417fac
mov esi, dword [ebp + 0xc]
push ebx
push esi
push edi
call fcn.00419750
add esp, 0xc
jmp 0x418042
mov esi, dword [ebp + 0xc]
push ebx
push esi
push edi
call fcn.004185d0
add esp, 0xc
jmp 0x418042
cmp word [eax + 4], 1
mov esi, dword [ebp + 0xc]
push esi
push edi
jne 0x417fd2
call fcn.0041ab20
jmp 0x41803f
call fcn.0041a8c0
jmp 0x41803f
cmp word [eax + 4], 1
mov esi, dword [ebp + 0xc]
push esi
push edi
jne 0x417fec
call fcn.0041b090
jmp 0x41803f
call fcn.0041ad70
jmp 0x41803f
cmp word [eax + 4], 1
mov esi, dword [ebp + 0xc]
push esi
push edi
jne 0x418006
call fcn.0041ba60
jmp 0x41803f
call fcn.0041b3e0
jmp 0x41803f
cmp word [eax + 4], 1
mov esi, dword [ebp + 0xc]
push esi
push edi
jne 0x418020
call fcn.0041ba60
jmp 0x41803f
call fcn.0041b660
jmp 0x41803f
cmp word [eax + 4], 1
mov esi, dword [ebp + 0xc]
push esi
push edi
jne 0x41803a
call fcn.0041bf70
jmp 0x41803f
call fcn.0041bc90
add esp, 8
cmp byte [ebp - 1], 0
je 0x418051
push esi
call fcn.00417a70
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push ecx
push str.invalid_output_format__internal_error_:__d
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 0xc
push 1
call dword [sym.imp.MSVCR120.dll_exit]
lea ecx, [ecx]
jg 0x4180c8
add byte [edi - 0x78ffbe81], al
jg 0x4180d0
add byte [edi - 0x26ffbe81], bh
jg 0x4180d8
add bl, dh
jg 0x4180dc
add byte [0x27004180], cl
add byte [ecx], 0xcc
int3
les eax, [eax + edx*2]
add byte [ebx - 0x3b7cf383], cl
add al, 0x50
Function at 0x418520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.MSVCR120.dll___iob_func]
push edi
call esi
mov edi, dword [ebp + 0x14]
add eax, 0x20
cmp dword [edi], eax
jne 0x4185bd
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x4185a3
cmp word [ecx + 8], 0
je 0x4185a3
call esi
push eax
call dword [sym.imp.MSVCR120.dll__fileno]
push eax
call dword [sym.imp.MSVCR120.dll__isatty]
add esp, 8
test eax, eax
je 0x4185a3
call esi
add eax, 0x20
push eax
call dword [sym.imp.MSVCR120.dll__fileno]
push eax
call dword [sym.imp.MSVCR120.dll__isatty]
add esp, 8
test eax, eax
je 0x4185a3
push str.PAGER
call dword [sym.imp.MSVCR120.dll_getenv]
test eax, eax
mov ecx, str.more
push 0x42dc78
cmovne ecx, eax
push ecx
call fcn.004290d0
add esp, 0xc
test eax, eax
jne 0x4185a8
call esi
add eax, 0x20
mov dword [edi], eax
call esi
add eax, 0x20
cmp dword [edi], eax
mov eax, dword [ebp + 0x18]
setne cl
pop edi
pop esi
mov byte [eax], cl
pop ebp
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
mov byte [eax], 0
pop ebp
ret
Function at 0x423520
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0042a330
mov eax, dword [0x455c20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str.PSQLRC
call dword [sym.imp.MSVCR120.dll_getenv]
mov edi, eax
lea eax, [ebp - 0x804]
push eax
push esi
call fcn.004254e0
add esp, 0xc
test eax, eax
jns 0x423586
push esi
push str._s:_could_not_find_own_program_executable_n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 0xc
push 1
call dword [sym.imp.MSVCR120.dll_exit]
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00428340
push str.psqlrc
lea eax, [ebp - 0xc04]
push eax
push 0x44b598
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.004262e0
lea eax, [ebp - 0x404]
push eax
call fcn.00423670
add esp, 0x20
test edi, edi
je 0x423614
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4235d3
sub ecx, edx
je 0x423614
push edi
call fcn.00424e90
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1008]
push eax
call fcn.00409af0
push dword [ebp - 0x1008]
call fcn.00423670
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e54
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1004]
push eax
call fcn.00428480
add esp, 4
test al, al
je 0x423658
push str.psqlrc.conf
lea eax, [ebp - 0x1004]
push eax
push 0x44b598
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.004262e0
lea eax, [ebp - 0x404]
push eax
call fcn.00423670
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429e54
mov esp, ebp
pop ebp
ret
Function at 0x424d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x424db2
push str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
push eax
call dword [sym.imp.MSVCR120.dll__strdup]
add esp, 4
test eax, eax
jne 0x424dc7
push str.out_of_memory_n
jmp 0x424d8f
pop ebp
ret

Function at 0x424e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x424e37
test eax, eax
mov edx, 1
cmove eax, edx
push eax
push ecx
call dword [sym.imp.MSVCR120.dll_realloc]
add esp, 8
test eax, eax
jne 0x424e6e
push str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
pop ebp
ret

Function at 0x424e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x424ec2
push str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
push eax
call dword [sym.imp.MSVCR120.dll__strdup]
add esp, 4
test eax, eax
jne 0x424ed7
push str.out_of_memory_n
jmp 0x424e9f
pop ebp
ret

Function at 0x424fa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, 1
test ebx, ebx
cmove ebx, eax
push ebx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x424ff5
test byte [ebp + 0xc], 2
jne 0x424ff0
push str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
xor eax, eax
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 4
je 0x425051
push esi
test al, 3
jne 0x425041
test bl, 3
jne 0x425041
cmp ebx, 0x400
ja 0x425041
mov ecx, eax
xor edx, edx
add eax, ebx
xor ebx, ebx
mov esi, eax
sub esi, dword [ebp + 8]
add esi, 3
shr esi, 2
cmp dword [ebp + 8], eax
push edi
cmova esi, ebx
pop edi
test esi, esi
je 0x42504d
lea esp, [esp]
inc edx
mov dword [ecx], ebx
lea ecx, [ecx + 4]
cmp edx, esi
jb 0x425030
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop ebp
ret
push ebx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x425060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll__errno]
push esi
push edi
mov edi, 0x80
push edi
call fcn.00424ee0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
call ebx
mov dword [eax], 0
lea eax, [ebp + 0xc]
push eax
push esi
push edi
push dword [ebp - 4]
call fcn.00426280
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x4250d6
call ebx
cmp dword [eax], 0
je 0x4250ab
call ebx
cmp dword [eax], 0xc
jne 0x4250ee
cmp edi, 0x3fffffff
jae 0x425125
mov esi, 0x3fffffff
cmp edi, 0x1fffffff
jae 0x4250c3
lea esi, [edi + edi]
cmp esi, edi
jb 0x42511b
push dword [ebp - 4]
call fcn.00424f80
add esp, 4
mov edi, esi
jmp 0x425072
lea eax, [edi - 1]
cmp esi, eax
jb 0x4250c3
cmp esi, edi
jbe 0x4250ab
cmp esi, 0x3ffffffd
ja 0x4250ab
add esi, 2
jmp 0x4250c3
call ebx
push dword [eax]
call dword [sym.imp.MSVCR120.dll_strerror]
add esp, 4
push eax
push str.vsnprintf_failed:__s_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 0xc
push 1
call dword [sym.imp.MSVCR120.dll_exit]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00426490
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
int3

Function at 0x4252b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x455e40
mov dword [ebp - 4], 0x101
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4252fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.user_name_lookup_failure:_error_code__lu
call sub.libintl_8.dll_libintl_gettext
add esp, 4
push eax
call fcn.00425060
add esp, 8
mov dword [esi], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x455e40
pop esi
mov esp, ebp
pop ebp
ret