joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8560
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
shl eax, 5
lea ebp, [eax + 0x628e30]
jmp 0x4c8579
mov edi, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push ecx
push edx
push edi
or esi, 0xffffffff
call fcn.0059ba99
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4c85bc
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
push eax
push edi
call fcn.005a38a0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x4c85bc
xor edi, edi
jmp 0x4c85c1
mov edi, 1
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
mov ebx, dword [esp + 0x28]
je 0x4c865e
call fcn.00599936
mov edi, eax
call fcn.004c7060
test esi, esi
mov ecx, dword [edi]
mov dword [eax], ecx
jne 0x4c85f2
call fcn.00599936
cmp dword [eax], 4
je 0x4c8575
test bl, 0x1a
je 0x4c864c
cmp esi, 0xffffffff
jne 0x4c8625
call fcn.004c7060
mov edx, dword [eax]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.004d3fc0
add esp, 4
push eax
push 0x24
push 2
call fcn.004c6390
add esp, 0x10
pop edi
or eax, esi
pop esi
pop ebp
pop ebx
ret
test bl, 6
je 0x4c864c
call fcn.004c7060
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
push ecx
push edx
call fcn.004d3fc0
add esp, 4
push eax
push 0x24
push 9
call fcn.004c6390
add esp, 0x10
cmp esi, 0xffffffff
je 0x4c8656
test bl, 6
je 0x4c865e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
and bl, 6
neg bl
pop edi
sbb ebx, ebx
not ebx
and ebx, esi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x4cf480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa04
push 0x6244e8
push 2
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x10], 0x400
call fcn.0059cdfb
push 0x5f508c
call fcn.0059cd46
add esp, 0xc
call fcn.0059c79c
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMySQL
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf588
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov esi, 1
call edi
cmp eax, 0x103
je 0x4cf57b
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x51c]
push edx
call fcn.004cf460
lea eax, [esp + 0x520]
push eax
call fcn.005a7752
push eax
call fcn.0059cd46
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
mov eax, esi
push edx
push eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 0x400
inc esi
call edi
cmp eax, 0x103
jne 0x4cf50e
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xa04
ret
Function at 0x4cf590
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
call fcn.004cf5f0
test al, al
je 0x4cf5df
lea eax, [esp]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4cf5bb
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp]
push ecx
jmp 0x4cf5cd
cmp word [esp], 2
je 0x4cf5d8
call sub.WSOCK32.dll_WSACleanup
lea edx, [esp]
push edx
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x4cf5df
mov byte [0x6312f4], 1
xor al, al
add esp, 0x190
ret

Function at 0x4d0ba0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0xc
call fcn.0059a181
mov esi, eax
add esp, 4
test esi, esi
jne 0x4d0bba
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 0x631328
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx]
test eax, eax
jne 0x4d0be2
mov eax, 0xffff
push esi
push eax
push 0x4d0c30
call fcn.0059b411
mov edx, dword [esp + 0x1c]
mov edi, eax
add esp, 0xc
mov dword [esi], edi
push 0x631328
mov dword [edx], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0xffffffff
jne 0x4d0c1c
call fcn.00599936
mov eax, dword [eax]
test eax, eax
jne 0x4d0c29
or eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4d1770
Capabilities:
Get socket status

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
mov eax, 0x431bde83
mul ecx
shr edx, 0x12
mov dword [esp], edx
mov eax, ecx
xor edx, edx
mov ecx, 0xf4240
div ecx
mov dword [esp + 4], edx
lea edx, [esp]
push edx
push 0
push 0
push 0
push 0
call sub.WSOCK32.dll_select
add esp, 8
ret

Function at 0x4d5be0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x58]
test ebx, ebx
push ebp
push edi
jge 0x4d5c32
cmp ebx, 0xffffffdc
jl 0x4d5cf9
cmp ebx, 0xfffffffe
jg 0x4d5cf9
mov ecx, dword [esp + 0x58]
test ecx, ecx
mov edi, dword [esp + 0x54]
jg 0x4d5c2a
jl 0x4d5c12
test edi, edi
jae 0x4d5c2a
mov ebp, dword [esp + 0x5c]
inc ebp
mov byte [ebp - 1], 0x2d
neg edi
adc ecx, 0
neg ecx
mov dword [esp + 0x5c], ebp
neg ebx
jmp 0x4d5c50
mov ebp, dword [esp + 0x5c]
neg ebx
jmp 0x4d5c50
cmp ebx, 0x24
jg 0x4d5cf9
cmp ebx, 2
jl 0x4d5cf9
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x5c]
mov eax, edi
or eax, ecx
jne 0x4d5c68
mov byte [ebp], 0x30
inc ebp
pop edi
mov byte [ebp], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x44
ret
test ecx, ecx
push esi
lea esi, [esp + 0x50]
mov byte [esp + 0x50], 0
ja 0x4d5c7e
cmp edi, 0x7fffffff
jbe 0x4d5cb0
xor eax, eax
push eax
push ebx
push ecx
push edi
call fcn.00599a40
mov ecx, eax
imul ecx, ebx
sub edi, ecx
mov ebp, edx
mov dl, byte [edi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
dec esi
test ebp, ebp
mov byte [esi], dl
mov edi, eax
mov ecx, ebp
ja 0x4d5c7e
jb 0x4d5cac
cmp eax, 0x7fffffff
ja 0x4d5c7e
mov ebp, dword [esp + 0x60]
test edi, edi
mov ecx, edi
je 0x4d5cd8
mov eax, ecx
cdq
idiv ebx
dec esi
mov edx, eax
mov al, bl
imul dl
sub cl, al
and ecx, 0xff
test edx, edx
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [esi], al
mov ecx, edx
jne 0x4d5cb6
mov al, byte [esi]
mov byte [ebp], al
inc ebp
inc esi
test al, al
je 0x4d5cee
mov al, byte [esi]
mov byte [ebp], al
inc ebp
inc esi
test al, al
jne 0x4d5ce3
pop esi
pop edi
lea eax, [ebp - 1]
pop ebp
pop ebx
add esp, 0x44
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret
Function at 0x4dd840
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x631354]
sub esp, 0xc38
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x4dd9f7
xor eax, eax
mov ecx, 0xc
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [0x5f5f90]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov dword [0x631354], 1
mov edx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x44]
mov ecx, 1
mov ebp, dword [esp + 0x10]
mov eax, ecx
and eax, 0xff
mov al, byte [eax + ebp + 1]
test al, 7
je 0x4dd8af
mov ebp, dword [esp + 0x18]
mov byte [esp + ebp + 0x48], cl
inc ebp
mov dword [esp + 0x18], ebp
test al, 3
je 0x4dd8c3
mov ebp, dword [esp + 0x1c]
mov byte [esp + ebp + 0x148], cl
inc ebp
mov dword [esp + 0x1c], ebp
test al, 0x20
je 0x4dd8d7
mov ebp, dword [esp + 0x24]
mov byte [esp + ebp + 0x348], cl
inc ebp
mov dword [esp + 0x24], ebp
test al, 4
je 0x4dd8eb
mov ebp, dword [esp + 0x28]
mov byte [esp + ebp + 0x448], cl
inc ebp
mov dword [esp + 0x28], ebp
test al, 0x17
je 0x4dd8ff
mov ebp, dword [esp + 0x2c]
mov byte [esp + ebp + 0x548], cl
inc ebp
mov dword [esp + 0x2c], ebp
test al, 2
je 0x4dd913
mov ebp, dword [esp + 0x30]
mov byte [esp + ebp + 0x648], cl
inc ebp
mov dword [esp + 0x30], ebp
test al, 0x57
je 0x4dd927
mov ebp, dword [esp + 0x34]
mov byte [esp + ebp + 0x748], cl
inc ebp
mov dword [esp + 0x34], ebp
test al, 0x10
je 0x4dd933
mov byte [esp + ebx + 0x848], cl
inc ebx
test al, 8
je 0x4dd93f
mov byte [esp + edi + 0x948], cl
inc edi
test al, 1
je 0x4dd94b
mov byte [esp + esi + 0xa48], cl
inc esi
test al, 0x80
je 0x4dd957
mov byte [esp + edx + 0xb48], cl
inc edx
inc ecx
cmp ecx, 0xff
jbe 0x4dd88f
mov dword [esp + 0x44], edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x48]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], edi
mov byte [esp + 0x248], 0x20
mov byte [esp + 0x249], 9
mov dword [esp + 0x20], 2
mov ebx, 0x60603c
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
mov ebp, dword [eax]
lea ecx, [ebp + 1]
push ecx
call fcn.0059a181
add esp, 4
test eax, eax
je 0x4dda02
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov byte [eax + ebp], 0
mov dword [ebx], eax
add esi, 0x100
add edx, 4
add ebx, 0xc
cmp ebx, 0x6060cc
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
jb 0x4dd9a1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc38
ret
push str.Fatal_error:_Cant_allocate_memory_in_regex_init_n
push 0x620ad0
call fcn.00599e71
add esp, 8
push 1
call fcn.0059b255
nop
nop
nop
nop
nop
Function at 0x4df440
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
lea ecx, [ecx + ecx*4]
lea ecx, [ebp + ecx*4]
cmp ebp, ecx
push esi
mov eax, 1
mov esi, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ecx
jae 0x4df509
push ebx
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [ebp + 4]
mov edx, dword [ebp + 0xc]
mov ecx, edi
add edi, ebx
test edx, edx
je 0x4df494
mov dl, byte [ecx]
inc edi
test dl, dl
je 0x4df493
lea edx, [eax + eax]
or edx, 1
xor eax, edx
jmp 0x4df4f4
inc ecx
cmp dword [ebp + 8], 1
jne 0x4df4d1
cmp ecx, edi
jae 0x4df4f4
mov edx, dword [0x5f5f90]
mov ebp, dword [edx + 0x14]
xor edx, edx
mov dl, byte [ecx]
xor ebx, ebx
mov bl, byte [edx + ebp]
mov edx, eax
and edx, 0x3f
add edx, esi
add esi, 3
imul ebx, edx
mov edx, eax
shl edx, 8
add ebx, edx
xor eax, ebx
inc ecx
cmp ecx, edi
jb 0x4df4a7
mov ebp, dword [esp + 0x18]
jmp 0x4df4f4
cmp ecx, edi
jae 0x4df4f4
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0x3f
add edx, esi
add esi, 3
imul edx, ebx
mov ebx, eax
shl ebx, 8
add edx, ebx
xor eax, edx
inc ecx
cmp ecx, edi
jb 0x4df4d5
mov ecx, dword [esp + 0x10]
add ebp, 0x14
cmp ebp, ecx
mov dword [esp + 0x18], ebp
jb 0x4df474
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x4df510
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
lea ecx, [ecx + ecx*4]
lea ecx, [ebp + ecx*4]
cmp ebp, ecx
push edi
mov eax, 1
mov edi, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ecx
jae 0x4df5e4
push ebx
push esi
mov ebx, dword [esp + 0x1c]
mov ecx, dword [ebp]
mov esi, dword [ebp + 4]
mov edx, dword [ebp + 0xc]
add ecx, ebx
add esi, ecx
test edx, edx
je 0x4df56f
mov ebp, dword [ebp + 0x10]
test byte [ebx + ebp], dl
je 0x4df56b
mov ebp, dword [esp + 0x18]
lea edx, [eax + eax]
or edx, 1
xor eax, edx
jmp 0x4df5cf
mov ebp, dword [esp + 0x18]
cmp dword [ebp + 8], 1
jne 0x4df5ac
cmp ecx, esi
jae 0x4df5cf
mov edx, dword [0x5f5f90]
mov ebp, dword [edx + 0x14]
xor edx, edx
mov dl, byte [ecx]
xor ebx, ebx
mov bl, byte [edx + ebp]
mov edx, eax
and edx, 0x3f
add edx, edi
add edi, 3
imul ebx, edx
mov edx, eax
shl edx, 8
add ebx, edx
xor eax, ebx
inc ecx
cmp ecx, esi
jb 0x4df582
mov ebp, dword [esp + 0x18]
jmp 0x4df5cf
cmp ecx, esi
jae 0x4df5cf
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0x3f
add edx, edi
add edi, 3
imul edx, ebx
mov ebx, eax
shl ebx, 8
add edx, ebx
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x4df5b0
mov ecx, dword [esp + 0x10]
add ebp, 0x14
cmp ebp, ecx
mov dword [esp + 0x18], ebp
jb 0x4df540
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
Function at 0x4e6e80
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x6321ec]
push esi
push eax
call fcn.0051f690
mov esi, dword [0x631548]
mov ecx, dword [0x6321ec]
inc esi
push ecx
mov dword [0x631548], esi
call fcn.0051f940
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add esp, 8
lea edx, [esp + 4]
push edx
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [0x6065d0]
test eax, eax
je 0x4e6fc9
mov edx, dword [0x6313b4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
add eax, dword [0x631438]
jne 0x4e6f70
push 0x620ad0
call fcn.004e70c0
add esp, 4
push 0x7a
push str.C:4017_buildmysql_4.0.17innobaseosos0thread.c
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
call fcn.004d1950
add esp, 4
push eax
push str.__InnoDB:_Assertion_failure_in_thread__lu_in_file__s_line__lu_n
push 0x620ad0
call fcn.00599e71
push str.InnoDB:_Failing_assertion:_SetThreadPriority_thread__srv_query_thread_priority_
push 0x620ad0
call fcn.00599e71
push str._nInnoDB:_We_intentionally_generate_a_memory_trap._n
push 0x620ad0
call fcn.00599e71
push str.InnoDB:_Send_a_detailed_bug_report_to_mysql_lists.mysql.com_n
push 0x620ad0
call fcn.00599e71
mov eax, dword [0x631440]
mov dword [0x63143c], 1
mov ecx, dword [eax]
add esp, 0x2c
test ecx, ecx
je 0x4e6f79
mov dword [0x631440], 0
jmp 0x4e6f79
mov eax, dword [0x63143c]
test eax, eax
je 0x4e6fba
push 0x7a
push str.C:4017_buildmysql_4.0.17innobaseosos0thread.c
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
call fcn.004d1950
add esp, 4
push eax
push str.InnoDB:_Thread__lu_stopped_in_file__s_line__lu_n
push 0x620ad0
call fcn.00599e71
push 0x3b9aca00
call fcn.004e7040
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
add esp, 0x18
mov eax, esi
mov dword [ecx], edx
pop esi
pop ecx
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, esi
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov dword [edx], eax
mov eax, esi
pop esi
pop ecx
ret
Function at 0x4f1270
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4f12a2
push esi
movsx ecx, cl
mov esi, ecx
xor esi, eax
xor esi, 0x946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add esi, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
mov eax, esi
jne 0x4f127d
pop esi
ret
Function at 0x4f5640
Capabilities:
Terminate process

Disassembly:
call fcn.004f5580
cmp eax, 0x48
jne 0x4f56b1
mov eax, dword [0x6314d0]
test eax, eax
jne 0x4f5713
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4f567d
push 0x620ad0
call fcn.004e70c0
push esi
push str.__InnoDB:_Encountered_a_problem_with_file__s_n
push 0x620ad0
call fcn.00599e71
add esp, 0x10
push 0x620ad0
call fcn.004e70c0
push str.__InnoDB:_Disk_is_full._Try_to_clean_the_disk_to_free_space._n
push 0x620ad0
call fcn.00599e71
push 0x620ad0
mov dword [0x6314d0], 1
call fcn.0059aafb
add esp, 0x10
xor eax, eax
pop esi
ret
cmp eax, 0x4a
jne 0x4f56bc
mov eax, 1
ret
cmp eax, 0x49
je 0x4f5713
mov eax, dword [esp + 8]
test eax, eax
je 0x4f56dc
push eax
push str.InnoDB:_File_name__s_n
push 0x620ad0
call fcn.00599e71
add esp, 0xc
mov eax, dword [esp + 0xc]
push eax
push str.InnoDB:_File_operation_call:__s._n
push 0x620ad0
call fcn.00599e71
push str.InnoDB:_Cannot_continue_operation._n
push 0x620ad0
call fcn.00599e71
push 0x620ad0
call fcn.0059aafb
add esp, 0x18
push 1
call fcn.0059b255
xor eax, eax
ret

Function at 0x4f5ae0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
push esi
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f5b06
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4f5b06
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov dword [edx], esi
mov dword [eax], ecx
mov eax, 1
pop esi
ret
Function at 0x50ba00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6314ec]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, 1
xchg dword [ecx], edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x50ba32
mov dword [eax + 0x14], str.C:4017_buildmysql_4.0.17innobasedictdict0dict.c
mov dword [eax + 0x18], 0x2a7
jmp 0x50ba45
push 0x2a7
push str.C:4017_buildmysql_4.0.17innobasedictdict0dict.c
push eax
call fcn.0051e0f0
add esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [ebx]
xor eax, eax
test cl, cl
push esi
mov edx, ebx
je 0x50ba78
movsx ecx, cl
mov esi, ecx
xor esi, eax
xor esi, 0x946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add esi, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
mov eax, esi
jne 0x50ba54
mov ecx, dword [0x6314ec]
mov ecx, dword [ecx + 0x34]
xor eax, 0x62946a4f
xor edx, edx
div dword [ecx]
mov eax, dword [ecx + 4]
push edi
mov edi, dword [eax + edx*4]
test edi, edi
je 0x50bace
mov eax, dword [edi + 0x10]
mov esi, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x50babe
test cl, cl
je 0x50baba
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x50babe
add eax, 2
add esi, 2
test cl, cl
jne 0x50ba9a
xor eax, eax
jmp 0x50bac3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x50bace
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x50ba95
mov esi, edi
test edi, edi
pop edi
jne 0x50bae0
push ebx
call fcn.0053f150
add esp, 4
mov esi, eax
mov eax, dword [0x6314ec]
mov dword [ebp + 8], eax
mov edx, 0
mov ecx, dword [ebp + 8]
xchg dword [ecx], edx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x50bb02
push eax
call fcn.0051e330
add esp, 4
test esi, esi
je 0x50bb19
mov eax, dword [esi + 0xb8]
test eax, eax
jne 0x50bb19
push esi
call fcn.00511990
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50bb30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6314ec]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, 1
xchg dword [ecx], edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x50bb62
mov dword [eax + 0x14], str.C:4017_buildmysql_4.0.17innobasedictdict0dict.c
mov dword [eax + 0x18], 0x2c4
jmp 0x50bb75
push 0x2c4
push str.C:4017_buildmysql_4.0.17innobasedictdict0dict.c
push eax
call fcn.0051e0f0
add esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [ebx]
xor eax, eax
test cl, cl
push esi
mov edx, ebx
je 0x50bba8
movsx ecx, cl
mov esi, ecx
xor esi, eax
xor esi, 0x946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add esi, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
mov eax, esi
jne 0x50bb84
mov ecx, dword [0x6314ec]
mov ecx, dword [ecx + 0x34]
xor eax, 0x62946a4f
xor edx, edx
div dword [ecx]
mov eax, dword [ecx + 4]
push edi
mov edi, dword [eax + edx*4]
test edi, edi
je 0x50bbfe
mov eax, dword [edi + 0x10]
mov esi, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x50bbee
test cl, cl
je 0x50bbea
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x50bbee
add eax, 2
add esi, 2
test cl, cl
jne 0x50bbca
xor eax, eax
jmp 0x50bbf3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x50bbfe
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x50bbc5
mov esi, edi
test edi, edi
pop edi
jne 0x50bc14
push ebx
call fcn.0053f150
mov esi, eax
add esp, 4
test esi, esi
je 0x50bc17
inc dword [esi + 0x5c]
mov eax, dword [0x6314ec]
mov dword [ebp + 8], eax
mov edx, 0
mov ecx, dword [ebp + 8]
xchg dword [ecx], edx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x50bc39
push eax
call fcn.0051e330
add esp, 4
test esi, esi
je 0x50bc50
mov eax, dword [esi + 0xb8]
test eax, eax
jne 0x50bc50
push esi
call fcn.00511990
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50cae0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x10]
mov al, byte [ecx]
xor edx, edx
test al, al
je 0x50cb15
movsx eax, al
mov esi, eax
xor esi, edx
xor esi, 0x946a4f
shl esi, 8
add esi, edx
xor esi, 0x573ed587
add esi, eax
mov al, byte [ecx + 1]
inc ecx
test al, al
mov edx, esi
jne 0x50caf1
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 0x10]
mov al, byte [esi]
xor ecx, ecx
test al, al
je 0x50cb4a
push ebx
movsx eax, al
mov ebx, eax
xor ebx, ecx
xor ebx, 0x946a4f
shl ebx, 8
add ebx, ecx
xor ebx, 0x573ed587
add ebx, eax
mov al, byte [esi + 1]
inc esi
test al, al
mov ecx, ebx
jne 0x50cb25
pop ebx
mov eax, dword [0x6314ec]
mov esi, dword [eax + 0x3c]
mov eax, ecx
xor eax, edx
xor eax, 0x946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, edx
xor eax, 0x62946a4f
xor edx, edx
div dword [esi]
mov ecx, dword [esi + 4]
lea eax, [ecx + edx*4]
mov ecx, dword [eax]
cmp ecx, edi
jne 0x50cb83
mov edx, dword [edi]
pop edi
mov dword [eax], edx
pop esi
ret
mov eax, dword [ecx]
cmp eax, edi
je 0x50cb91
mov ecx, eax
mov eax, dword [ecx]
cmp eax, edi
jne 0x50cb89
mov eax, dword [edi]
pop edi
mov dword [ecx], eax
pop esi
ret
Function at 0x50d200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x34]
push ebx
push ebp
xor eax, eax
cmp edx, eax
push esi
push edi
mov dword [esp + 0x14], eax
jbe 0x50d36b
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x20]
mov edi, dword [edx + 0x38]
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + edi + 4]
mov al, byte [ecx]
add ebp, edi
xor edx, edx
test al, al
je 0x50d25d
movsx eax, al
mov esi, eax
xor esi, edx
xor esi, 0x946a4f
shl esi, 8
add esi, edx
xor esi, 0x573ed587
add esi, eax
mov al, byte [ecx + 1]
inc ecx
test al, al
mov edx, esi
jne 0x50d239
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x10]
mov esi, ebx
mov al, byte [esi]
xor ecx, ecx
test al, al
je 0x50d292
movsx eax, al
mov edi, eax
xor edi, ecx
xor edi, 0x946a4f
shl edi, 8
add edi, ecx
xor edi, 0x573ed587
add edi, eax
mov al, byte [esi + 1]
inc esi
test al, al
mov ecx, edi
jne 0x50d26e
mov eax, dword [0x6314ec]
mov esi, dword [eax + 0x3c]
mov eax, ecx
xor eax, edx
xor eax, 0x946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, edx
xor eax, 0x62946a4f
xor edx, edx
div dword [esi]
mov ecx, dword [esi + 4]
mov edi, dword [ecx + edx*4]
test edi, edi
je 0x50d361
mov esi, dword [ebp + 4]
mov eax, dword [edi + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x50d2f0
test cl, cl
je 0x50d2ec
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x50d2f0
add eax, 2
add esi, 2
test cl, cl
jne 0x50d2cc
xor eax, eax
jmp 0x50d2f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50d32e
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 0x10]
mov esi, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x50d325
test cl, cl
je 0x50d321
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x50d325
add eax, 2
add esi, 2
test cl, cl
jne 0x50d301
xor eax, eax
jmp 0x50d32a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x50d336
mov edi, dword [edi]
test edi, edi
je 0x50d361
jmp 0x50d2c6
test edi, edi
je 0x50d361
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [ebp], edi
mov edx, dword [ecx + 0x34]
inc eax
add esi, 0x10
cmp eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jae 0x50d36b
jmp 0x50d220
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret