joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6727e0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
or edi, 0xffffffff
mov esi, eax
cmp dword [0x8241bc], edi
jne 0x67281f
mov eax, dword [0x867fc8]
test eax, eax
jne 0x672801
mov eax, 0x756320
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [0x8241bc], eax
test eax, eax
jne 0x67281f
mov dword [0x8241bc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0xa
jl 0x67283c
cmp esi, 0x12
jle 0x672835
cmp esi, 0x13
jne 0x67283c
mov esi, 2
jmp 0x672841
mov esi, 4
jmp 0x672841
mov esi, 1
call sym.postgres.exe_GetDatabaseEncoding
mov edi, eax
call sym.postgres.exe_GetPlatformEncoding
cmp edi, eax
je 0x6728a2
cmp dword [0x85f210], 2
jg 0x6728a2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push eax
push ecx
call sym.postgres.exe_pgwin32_toUTF16
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x6728a2
mov eax, dword [0x8241bc]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 1
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ecx, dword [ebp - 4]
push ecx
call sym.postgres.exe_pfree
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x8241bc]
push 0
lea edx, [ebp + 8]
push edx
push 0
push 1
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6776b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
inc dword [0x85f210]
mov eax, dword [sym.postgres.exe_ErrorContext]
push ebx
mov ebx, dword [0x8241b8]
inc ebx
push esi
push edi
mov dword [sym.postgres.exe_CurrentMemoryContext], eax
mov dword [0x8241b8], ebx
cmp ebx, 5
jl 0x67771a
push 0
push 0x756678
push 0x599
push str.src_backendutilserrorelog.c
push 0x16
mov dword [0x8241b8], 0xffffffff
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x677714
push str.ERRORDATA_STACK_SIZE_exceeded
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 8
mov ebx, dword [0x8241b8]
mov esi, dword [ebp + 8]
shl ebx, 6
add ebx, 0x85f0c0
mov ecx, 0x10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x677749
mov ecx, dword [sym.postgres.exe_CurrentMemoryContext]
push eax
push ecx
call sym.postgres.exe_MemoryContextStrdup
add esp, 8
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x677763
mov edx, dword [sym.postgres.exe_CurrentMemoryContext]
push eax
push edx
call sym.postgres.exe_MemoryContextStrdup
add esp, 8
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x67777c
push eax
mov eax, dword [sym.postgres.exe_CurrentMemoryContext]
push eax
call sym.postgres.exe_MemoryContextStrdup
add esp, 8
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x677796
mov ecx, dword [sym.postgres.exe_CurrentMemoryContext]
push eax
push ecx
call sym.postgres.exe_MemoryContextStrdup
add esp, 8
mov dword [ebx + 0x28], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x6777b0
mov edx, dword [sym.postgres.exe_CurrentMemoryContext]
push eax
push edx
call sym.postgres.exe_MemoryContextStrdup
add esp, 8
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x6777c9
push eax
mov eax, dword [sym.postgres.exe_CurrentMemoryContext]
push eax
call sym.postgres.exe_MemoryContextStrdup
add esp, 8
mov dword [ebx + 0x38], eax
dec dword [0x85f210]
call sym.postgres.exe_pg_re_throw
push 1
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x67de30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.postgres.exe_hash_any
Function at 0x684e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
sub edi, 2
neg edi
sbb edi, edi
and edi, 5
push 0x6b1fb8
add edi, 0xf
push str.global_config_exec_params.new
mov dword [ebp - 4], edi
call sym.postgres.exe_AllocateFile
mov esi, eax
add esp, 8
test esi, esi
jne 0x684ed9
push eax
push 0x76eba8
push 0x1d8d
push str.src_backendutilsmiscguc.c
push edi
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x685051
push str.global_config_exec_params.new
push str.could_not_write_to_file___s_:__m
call sym.postgres.exe_errmsg
add esp, 8
push eax
call sym.postgres.exe_errcode_for_file_access
push eax
call sym.postgres.exe_errfinish
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp + 8], eax
cmp dword [0x85fc98], eax
jle 0x685021
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fwrite]
mov ecx, dword [0x85fa4c]
mov edi, dword [ecx + eax*4]
cmp dword [edi + 0x20], 0
je 0x68500d
mov edx, dword [edi]
push edx
push 0x6ab5fc
push esi
call sym.postgres.exe_pg_fprintf
push esi
push 0
call dword [sym.imp.MSVCR100.dll_fputc]
mov eax, dword [edi + 0x18]
add esp, 0x14
cmp eax, 4
ja case.default.0x684f2a
jmp dword [eax*4 + 0x685058]
mov eax, dword [edi + 0x40]
cmp byte [eax], 0
je 0x684f49
push str.true
push esi
call sym.postgres.exe_pg_fprintf
add esp, 8
jmp case.default.0x684f2a
push str.false
push esi
call sym.postgres.exe_pg_fprintf
add esp, 8
jmp case.default.0x684f2a
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
push edx
push 0x6b3178
push esi
call sym.postgres.exe_pg_fprintf
add esp, 0xc
jmp case.default.0x684f2a
mov eax, dword [edi + 0x40]
fld qword [eax]
sub esp, 8
fstp qword [esp]
push str._.17g
push esi
call sym.postgres.exe_pg_fprintf
add esp, 0x10
jmp case.default.0x684f2a
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
push edx
push 0x6ab5fc
push esi
call sym.postgres.exe_pg_fprintf
add esp, 0xc
jmp case.default.0x684f2a
mov eax, dword [edi + 0x40]
mov ecx, dword [eax]
push ecx
push edi
call sym.postgres.exe_config_enum_lookup_by_value
push eax
push 0x6ab5fc
push esi
call sym.postgres.exe_pg_fprintf
add esp, 0x14
push esi
push 0
call dword [sym.imp.MSVCR100.dll_fputc]
mov eax, dword [edi + 0x38]
add esp, 8
test eax, eax
je 0x684fdd
push eax
push 0x6ab5fc
push esi
call sym.postgres.exe_pg_fprintf
add esp, 0xc
push esi
push 0
call dword [sym.imp.MSVCR100.dll_fputc]
push esi
push 4
lea edx, [edi + 0x3c]
push 1
push edx
call ebx
push esi
push 4
lea eax, [edi + 0x20]
push 1
push eax
call ebx
push esi
push 4
push 1
add edi, 0x28
push edi
call ebx
mov eax, dword [ebp + 8]
add esp, 0x38
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [0x85fc98]
jl 0x684ef1
mov edi, dword [ebp - 4]
pop ebx
push esi
call sym.postgres.exe_FreeFile
add esp, 4
test eax, eax
je 0x68503f
push 0
push 0x76eba8
push 0x1d9b
jmp 0x684e9c
push str.global_config_exec_params
push str.global_config_exec_params.new
call sym.postgres.exe_pgrename
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x689a80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.PGPORT
call esi
add esp, 4
test eax, eax
je 0x689abd
push 0
push 1
push 0
push 2
push 1
push eax
push str.port
call sym.postgres.exe_set_config_option
add esp, 0x1c
push str.PGDATESTYLE
call esi
add esp, 4
test eax, eax
je 0x689ae3
push 0
push 1
push 0
push 2
push 1
push eax
push str.datestyle
call sym.postgres.exe_set_config_option
add esp, 0x1c
push str.PGCLIENTENCODING
call esi
add esp, 4
pop esi
test eax, eax
je 0x689b0a
push 0
push 1
push 0
push 2
push 1
push eax
push str.client_encoding
call sym.postgres.exe_set_config_option
add esp, 0x1c
call sym.postgres.exe_get_stack_depth_rlimit
test eax, eax
jle 0x689b5f
add eax, 0xfff80000
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
cmp eax, 0x64
jle 0x689b5f
cmp eax, 0x800
jl 0x689b35
mov eax, 0x800
push eax
lea eax, [ebp - 0x14]
push 0x6c06cc
push eax
call sym.postgres.exe_pg_sprintf
push 0
push 1
push 0
push 2
push 1
lea ecx, [ebp - 0x14]
push ecx
push 0x76b7c0
call sym.postgres.exe_set_config_option
add esp, 0x28
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret

Function at 0x68b020
Capabilities:
Query environment variable

Disassembly:
push esi
call sym.postgres.exe_pg_timezone_initialize
call sym.postgres.exe_build_guc_variables
xor esi, esi
cmp dword [0x85fc98], esi
jle 0x68b056
jmp 0x68b040
mov eax, dword [0x85fa4c]
mov eax, dword [eax + esi*4]
call fcn.00686540
inc esi
cmp esi, dword [0x85fc98]
jl 0x68b040
push 0
push 1
push 0
push 9
push 1
push str.default
push str.transaction_isolation
mov byte [0x85fa79], 0
mov byte [0x85f9fa], 0
call sym.postgres.exe_set_config_option
push 0
push 1
push 0
push 9
push 1
push 0x72d1ac
push str.transaction_read_only
call sym.postgres.exe_set_config_option
push 0
push 1
push 0
push 9
push 1
push 0x72d1ac
push str.transaction_deferrable
call sym.postgres.exe_set_config_option
add esp, 0x54
pop esi
jmp fcn.00689a80
Function at 0x69a9c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x69a9e4
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 2
xor eax, eax
pop edi
pop ebp
ret
test al, 0x10
jne 0x69a9f9
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 0x14
xor eax, eax
pop edi
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_malloc]
push 0x114
call esi
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x69aa24
call dword [sym.imp.MSVCR100.dll__errno]
pop esi
pop ebx
mov dword [eax], 0xc
xor eax, eax
pop edi
pop ebp
ret
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x69aa30
sub eax, edx
add eax, 4
push eax
call esi
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x69aa65
call dword [sym.imp.MSVCR100.dll__errno]
push ebx
mov dword [eax], 0xc
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret
mov edx, edi
mov esi, eax
lea esp, [esp]
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x69aa70
mov ecx, eax
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x69aa80
sub ecx, esi
cmp byte [ecx + eax - 1], 0x2f
je 0x69aaba
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x69aa95
sub ecx, esi
cmp byte [ecx + eax - 1], 0x5c
je 0x69aaba
lea edi, [eax - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x69aaa8
mov cx, word [0x74a2e8]
mov word [edi], cx
dec eax
jmp 0x69aac0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x69aac0
mov dx, word [0x6bb410]
mov edi, eax
xor eax, eax
mov word [ebx + 8], ax
pop esi
mov dword [ebx + 0x110], 0xffffffff
mov dword [ebx + 4], 0
mov eax, ebx
pop ebx
mov word [edi], dx
pop edi
pop ebp
ret
Function at 0x69ab00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x110]
cmp eax, 0xffffffff
jne 0x69ab5a
mov ecx, dword [esi]
lea eax, [ebp - 0x144]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
jne 0x69abb2
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 2
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x144]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x69abb2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
jne 0x69ab96
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
call esi
push eax
call sym.postgres.exe__dosmaperr
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x118]
lea edx, [esi + 0xc]
mov ecx, eax
push edi
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x69abc0
lea eax, [esi + 0xc]
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x69abd1
mov ecx, dword [ebp - 4]
sub eax, edx
mov word [esi + 0xa], ax
lea eax, [esi + 4]
xor ecx, ebp
pop esi
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret

Function at 0x69ac40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 1
push ebx
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x69aca4
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call sym.postgres.exe__dosmaperr
add esp, 4
cmp esi, 5
je 0x69ac80
cmp esi, 0x20
je 0x69ac80
cmp esi, 0x21
jne 0x69acab
inc edi
cmp edi, 0x64
jg 0x69acab
push 0x186a0
call sym.postgres.exe_pg_usleep
mov ecx, dword [ebp + 8]
add esp, 4
push 1
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x69ac60
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x69ad20
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x2200000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x69af0b
cmp dword [esi], 0x5c3f3f5c
jne 0x69ad8c
lea edx, [ebp - 0x108]
mov eax, esi
sub edx, esi
jmp 0x69ad80
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x69ad80
jmp 0x69ada1
push esi
lea eax, [ebp - 0x108]
push str.___s
push eax
call sym.postgres.exe_pg_sprintf
add esp, 0xc
mov esi, dword [sym.imp.MSVCR100.dll_strchr]
lea ecx, [ebp - 0x108]
push 0x2f
push ecx
call esi
add esp, 8
test eax, eax
je 0x69add0
lea esp, [esp]
mov byte [eax], 0x5c
inc eax
push 0x2f
push eax
call esi
add esp, 8
test eax, eax
jne 0x69adc0
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x69ade0
sub eax, edx
add eax, eax
xor ecx, ecx
push 0x104
lea edx, [eax + 0xc]
mov dword [ebp - 0x31e], ecx
lea ecx, [ebp - 0x314]
push ecx
mov dword [ebp - 0x32c], eax
mov word [ebp - 0x31a], ax
add eax, 2
push 0xffffffffffffffff
mov word [ebp - 0x320], dx
lea edx, [ebp - 0x108]
mov word [ebp - 0x318], ax
xor eax, eax
push edx
push eax
push eax
mov dword [ebp - 0x324], 0xa0000003
mov word [ebp - 0x316], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx ecx, word [ebp - 0x320]
push 0
lea eax, [ebp - 0x32c]
push eax
push 0
push 0
add ecx, 8
push ecx
lea edx, [ebp - 0x324]
push edx
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x69af1f
call dword [sym.imp.MSVCR100.dll__errno]
push 0
mov dword [eax], 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0x409
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
push 0x772088
push 0x124
push str.srcportdirmod.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x69aef0
mov ecx, dword [ebp - 0x328]
push ecx
lea edx, [ebp - 0x108]
push edx
push str.could_not_set_junction_for___s_:__s
call sym.postgres.exe_errmsg
add esp, 0xc
push eax
call sym.postgres.exe_errcode_for_file_access
push eax
call sym.postgres.exe_errfinish
add esp, 8
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
Function at 0x69b170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x69b195
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.postgres.exe__dosmaperr
add esp, 4
xor al, al
pop ebp
ret
and eax, 0x400
xor ecx, ecx
cmp eax, 0x400
sete al
pop ebp
ret

Function at 0x69b410
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov bl, 1
call sym.postgres.exe_pgfnames
mov esi, eax
add esp, 4
mov dword [ebp - 0x450], esi
test esi, esi
jne 0x69b453
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0
je 0x69b582
lea esp, [esp]
mov eax, dword [esi]
push eax
push edi
push 0x6b04b0
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call sym.postgres.exe_pg_snprintf
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCR100.dll__stat32]
add esp, 0x1c
test eax, eax
js 0x69b4be
lea ecx, [ebp - 0x44c]
push ecx
push 0
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x69b4ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.postgres.exe__dosmaperr
add esp, 4
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 2
je 0x69b570
push 0x77210c
push 0x238
push str.srcportdirmod.c
call sym.postgres.exe_elog_start
lea ecx, [ebp - 0x404]
push ecx
push str.could_not_stat_file_or_directory___s_:__m
jmp 0x69b564
mov edx, dword [ebp - 0x422]
mov eax, dword [ebp - 0x42c]
and edx, 0xf000
mov dword [ebp - 0x414], eax
cmp edx, 0x4000
jne 0x69b526
lea eax, [ebp - 0x404]
push 1
push eax
call sym.postgres.exe_rmtree
add esp, 8
test al, al
jne 0x69b570
jmp 0x69b56e
lea ecx, [ebp - 0x404]
push ecx
call sym.postgres.exe_pgunlink
add esp, 4
test eax, eax
je 0x69b570
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 2
je 0x69b570
push 0x77210c
push 0x253
push str.srcportdirmod.c
call sym.postgres.exe_elog_start
lea edx, [ebp - 0x404]
push edx
push str.could_not_remove_file_or_directory___s_:__m
push 0x13
call sym.postgres.exe_elog_finish
add esp, 0x18
xor bl, bl
add esi, 4
cmp dword [esi], 0
jne 0x69b460
mov esi, dword [ebp - 0x450]
cmp byte [ebp + 0xc], 0
je 0x69b5c2
push edi
call dword [sym.imp.MSVCR100.dll__rmdir]
add esp, 4
test eax, eax
je 0x69b5bc
push 0x77210c
push 0x264
push str.srcportdirmod.c
call sym.postgres.exe_elog_start
push edi
push str.could_not_remove_file_or_directory___s_:__m
push 0x13
call sym.postgres.exe_elog_finish
add esp, 0x18
xor bl, bl
mov esi, dword [ebp - 0x450]
mov eax, dword [esi]
test eax, eax
je 0x69b5e1
push eax
call sym.postgres.exe_pfree
mov eax, dword [esi + 4]
add esi, 4
add esp, 4
test eax, eax
jne 0x69b5c8
mov esi, dword [ebp - 0x450]
push esi
call sym.postgres.exe_pfree
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
Function at 0x69c050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ecx, str.postgres_9.2
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x69c092
test dl, dl
je 0x69c08e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x69c092
add eax, 2
add ecx, 2
test dl, dl
jne 0x69c072
xor eax, eax
jmp 0x69c097
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x69c0aa
push 0x6aaa59
push 0
call sym.postgres.exe_pgwin32_setlocale
add esp, 8
lea eax, [ebp - 0xc14]
push eax
push edi
call sym.postgres.exe_find_my_exec
add esp, 8
test eax, eax
js 0x69c199
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0xc14]
push edx
call sym.postgres.exe_get_locale_path
lea eax, [ebp - 0x814]
push eax
push esi
call sub.libintl.dll_libintl_bindtextdomain
push esi
call sub.libintl.dll_libintl_textdomain
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.PGLOCALEDIR
call esi
mov edi, dword [sym.imp.MSVCR100.dll__strdup]
add esp, 0x18
test eax, eax
jne 0x69c13d
lea ecx, [ebp - 0x814]
push ecx
push str.PGLOCALEDIR_s
lea edx, [ebp - 0x414]
push 0x40e
push edx
call sym.postgres.exe_pg_snprintf
lea eax, [ebp - 0x408]
push eax
call sym.postgres.exe_canonicalize_path
lea ecx, [ebp - 0x414]
push ecx
call edi
push eax
call sym.postgres.exe_pgwin32_putenv
add esp, 0x1c
push str.PGSYSCONFDIR
call esi
add esp, 4
test eax, eax
jne 0x69c199
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0xc14]
push eax
call sym.postgres.exe_get_etc_path
lea ecx, [ebp - 0x814]
push ecx
push str.PGSYSCONFDIR_s
lea edx, [ebp - 0x414]
push 0x40e
push edx
call sym.postgres.exe_pg_snprintf
lea eax, [ebp - 0x407]
push eax
call sym.postgres.exe_canonicalize_path
lea ecx, [ebp - 0x414]
push ecx
call edi
push eax
call sym.postgres.exe_pgwin32_putenv
add esp, 0x24
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
Function at 0x69d6f0
Capabilities:
Check if file exists
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 0x86], bl
mov byte [ebp - 0x85], 0
cmp ebx, 0x1f
ja 0x69d826
mov eax, dword [ebp + 8]
test eax, eax
jle 0x69d826
push eax
push str..pipepgsignal__u
lea eax, [ebp - 0x84]
push 0x80
push eax
call sym.postgres.exe_pg_snprintf
add esp, 0x10
push 0x3e8
lea ecx, [ebp - 0x8c]
push ecx
push 1
lea edx, [ebp - 0x85]
push edx
push 1
lea eax, [ebp - 0x86]
push eax
lea ecx, [ebp - 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x69d7b4
cmp dword [ebp - 0x8c], 1
jne 0x69d796
movzx edx, byte [ebp - 0x85]
cmp edx, ebx
jne 0x69d796
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 3
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
jne 0x69d7e1
call dword [sym.imp.MSVCR100.dll__errno]
pop esi
mov dword [eax], 3
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
call esi
cmp eax, 5
jne 0x69d807
call dword [sym.imp.MSVCR100.dll__errno]
pop esi
mov dword [eax], 1
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCR100.dll__errno]
pop esi
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [ebp - 4]
mov dword [eax], 0x16
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret

Function at 0x69e0b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.APPDATA
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
jne 0x69e0c9
xor al, al
pop ebp
ret
push eax
mov eax, dword [ebp + 8]
push str._s_postgresql
push 0x400
push eax
call sym.postgres.exe_pg_snprintf
add esp, 0x10
mov al, 1
pop ebp
ret