joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5770a0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push 0
push 0
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x5770f1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x5770e0
call fcn.00576b70
or eax, 0xffffffff
pop esi
pop ebp
ret
push 0xffffffffffffffff
push 0x10
push esi
call sym.postgres.exe_pgwin32_waitforsinglesocket
add esp, 0xc
test eax, eax
je 0x5770e0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x577100
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [sym.postgres.exe_pg_signal_queue]
mov dword [ebp - 4], eax
mov eax, dword [sym.postgres.exe_pg_signal_mask]
not eax
test eax, ecx
je 0x577135
call sym.postgres.exe_pgwin32_dispatch_queued_signals
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 0x2714
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSARecv]
push esi
mov esi, dword [ebp + 8]
push 0
push 0
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0xc], edx
lea edx, [ebp + 0x14]
push edx
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0xc]
push eax
push esi
call ebx
cmp eax, 0xffffffff
je 0x57718f
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x57723d
cmp dword [sym.postgres.exe_pgwin32_noblock], 0
je 0x5771aa
call dword [sym.imp.MSVCR100.dll__errno]
pop esi
mov dword [eax], 0x2733
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x577171
call fcn.00576b70
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push edi
xor edi, edi
lea ecx, [ecx]
push 0xffffffffffffffff
push 0x29
push esi
call sym.postgres.exe_pgwin32_waitforsinglesocket
add esp, 0xc
test eax, eax
je 0x577239
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp + 0x14]
push edx
push 1
lea eax, [ebp - 0xc]
push eax
push esi
call ebx
cmp eax, 0xffffffff
jne 0x577252
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x577243
push 0x2710
call sym.postgres.exe_pg_usleep
inc edi
add esp, 4
cmp edi, 5
jl 0x5771b0
push 0
push 0x732dcc
push 0x179
push str.src_backendportwin32_socket.c
push 0x12
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x57722d
push str.could_not_read_from_ready_socket__after_retries_
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 8
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 0x2733
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00576b70
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x577a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x822b58], 0xffffffff
jne 0x577b58
push esi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x836188], eax
test eax, eax
jne 0x577ae0
push 0
push 0x732f10
push 0x65
push str.src_backendportwin32_timer.c
push 0x15
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x577ae0
call esi
push eax
push str.could_not_create_timer_event:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
mov eax, 0x836178
xor eax, eax
push 0x83618c
mov dword [0x836184], eax
mov dword [0x836180], eax
mov dword [0x83617c], eax
mov dword [0x836178], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0x5779f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x822b58], eax
cmp eax, 0xffffffff
jne 0x577b57
push 0
push 0x732f10
push 0x6f
push str.src_backendportwin32_timer.c
push 0x15
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x577b57
call esi
push eax
push str.could_not_create_timer_thread:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
pop esi
push 0x83618c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x577b8d
mov ecx, dword [0x836178]
mov dword [eax], ecx
mov edx, dword [0x83617c]
mov dword [eax + 4], edx
mov ecx, dword [0x836180]
mov dword [eax + 8], ecx
mov edx, dword [0x836184]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [0x836178], ecx
mov edx, dword [eax + 4]
mov dword [0x83617c], edx
mov ecx, dword [eax + 8]
mov dword [0x836180], ecx
mov edx, dword [eax + 0xc]
push 0x83618c
mov dword [0x836184], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x836188]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop ebp
ret
Function at 0x57d010
Capabilities:
Terminate process

Disassembly:
mov byte [sym.postgres.exe_IsUnderPostmaster], 1
call dword [sym.imp.MSVCR100.dll__getpid]
push 0
mov dword [sym.postgres.exe_MyProcPid], eax
call dword [sym.imp.MSVCR100.dll__time32]
cdq
mov dword [sym.postgres.exe_MyStartTime], eax
mov dword [0x868004], edx
call sym.postgres.exe_InitializeLatchSupport
push 0x836250
call sym.postgres.exe_InitLatch
push 0x57c5d0
push 1
call sym.postgres.exe_pqsignal
push 1
push 2
call sym.postgres.exe_pqsignal
push 0x57c600
push 0xf
call sym.postgres.exe_pqsignal
push 0x57c5c0
push 3
call sym.postgres.exe_pqsignal
push 1
push 0xe
call sym.postgres.exe_pqsignal
push 1
push 0xd
call sym.postgres.exe_pqsignal
push 0x57c630
push 0x1e
call sym.postgres.exe_pqsignal
add esp, 0x40
push 0x57c660
push 0x1f
call sym.postgres.exe_pqsignal
push 0
push 0x14
call sym.postgres.exe_pqsignal
push 0
push 0x15
call sym.postgres.exe_pqsignal
push 0
push 0x16
call sym.postgres.exe_pqsignal
push 0
push 0x13
call sym.postgres.exe_pqsignal
push 0
push 0x1c
call sym.postgres.exe_pqsignal
mov eax, dword [0x869288]
push eax
call sym.postgres.exe_pqsigsetmask
push 0x6aaa59
push 0x6aaa59
push 0x6aaa59
push str.archiver_process
call sym.postgres.exe_init_ps_display
add esp, 0x44
call fcn.0057cdf0
push 0
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x57ed40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push esi
push edi
je 0x57ed62
mov edi, str.global_pgstat.stat
mov dword [ebp - 0x68], edi
jmp 0x57ed6c
mov eax, dword [sym.postgres.exe_pgstat_stat_filename]
mov dword [ebp - 0x68], eax
mov edi, eax
push 0x6bf9bc
push edi
call sym.postgres.exe_AllocateFile
mov esi, eax
add esp, 8
test esi, esi
jne 0x57edf1
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 2
je 0x57eed2
xor ecx, ecx
cmp byte [0x83638a], cl
push esi
sete cl
push str.pgstat_read_statsfile_timestamp
push 0xf2e
push str.src_backendpostmasterpgstat.c
lea ecx, [ecx*4 + 0xf]
push ecx
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x57eed2
push edi
push str.could_not_open_statistics_file___s_:__m
call sym.postgres.exe_errmsg
add esp, 8
push eax
call sym.postgres.exe_errcode_for_file_access
push eax
call sym.postgres.exe_errfinish
add esp, 8
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 4
lea edx, [ebp - 0x6c]
push 1
push edx
call edi
add esp, 0x10
cmp eax, 4
jne 0x57ee82
cmp dword [ebp - 0x6c], 0x1a5bc9a
jne 0x57ee82
push esi
push 0x60
lea eax, [ebp - 0x64]
push 1
push eax
call edi
add esp, 0x10
cmp eax, 0x60
je 0x57ee5c
xor ecx, ecx
cmp byte [0x83638a], cl
push 0
sete cl
push str.pgstat_read_statsfile_timestamp
push 0xf44
push str.src_backendpostmasterpgstat.c
lea ecx, [ecx*4 + 0xf]
push ecx
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x57eec9
mov edx, dword [ebp - 0x68]
push edx
jmp 0x57eeb6
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
push esi
mov dword [ebx], eax
mov dword [ebx + 4], ecx
call sym.postgres.exe_FreeFile
add esp, 4
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp byte [0x83638a], dl
push 0
sete dl
push str.pgstat_read_statsfile_timestamp
push 0xf39
push str.src_backendpostmasterpgstat.c
lea edx, [edx*4 + 0xf]
push edx
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x57eec9
mov eax, dword [ebp - 0x68]
push eax
push str.corrupted_statistics_file___s_
call sym.postgres.exe_errmsg
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
push esi
call sym.postgres.exe_FreeFile
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
Function at 0x5821d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x83694c], 0
jne 0x582216
nop
lea eax, [ebp - 8]
push 0
push eax
call sym.postgres.exe_gettimeofday
mov ecx, dword [ebp - 4]
mov eax, ecx
sar eax, 0x10
and eax, 0xffff
shl ecx, 0x10
or eax, ecx
add esp, 8
xor eax, dword [0x8364f4]
mov dword [0x83694c], eax
je 0x5821e0
push eax
call sym.postgres.exe_srandom
add esp, 4
call sym.postgres.exe_random
mov esp, ebp
pop ebp
ret
Function at 0x583a10
Capabilities:
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x15e4
call fcn.006a8ce0
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
push 0
push 0
push 0
mov edi, eax
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x583a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_map_view_of_backend_variables:_error_code__lu_n
call sym.postgres.exe_write_stderr
add esp, 8
push 1
call dword [sym.imp.MSVCR100.dll_exit]
push 0x15e0
lea eax, [ebp - 0x15e4]
push esi
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x583aa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_unmap_view_of_backend_variables:_error_code__lu_n
call sym.postgres.exe_write_stderr
add esp, 8
push 1
call dword [sym.imp.MSVCR100.dll_exit]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
test eax, eax
jne 0x583ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_close_handle_to_backend_parameter_variables:_error_code__lu_n
call sym.postgres.exe_write_stderr
add esp, 8
push 1
call dword [sym.imp.MSVCR100.dll_exit]
push ebx
lea eax, [ebp - 0x15e4]
call fcn.005824a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
Function at 0x587c10
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x836950]
test eax, eax
je 0x587c2d
push 2
mov dword [0x836950], 0
call sym.postgres.exe_ProcessConfigFile
add esp, 4
mov ecx, dword [0x836954]
test ecx, ecx
je 0x587c41
push 1
call sym.postgres.exe_proc_exit
add esp, 4
cmp byte [sym.postgres.exe_IsUnderPostmaster], 0
je 0x587c5b
call sym.postgres.exe_PostmasterIsAlive
test al, al
jne 0x587c5b
push 1
call dword [sym.imp.MSVCR100.dll_exit]
ret
Function at 0x588120
Capabilities:
Create directory
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [sym.postgres.exe_Logging_collector], 0
jne 0x588135
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp dword [sym.postgres.exe_syslogPipe], 0
jne 0x5881ae
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
push 0x8000
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x836dbc
push sym.postgres.exe_syslogPipe
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x5881ae
push eax
push 0x7363c8
push 0x23e
push str.src_backendpostmaster_syslogger.c
push 0x15
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x5881ae
push str.could_not_create_pipe_for_syslog:__m
call sym.postgres.exe_errmsg
add esp, 4
push eax
call sym.postgres.exe_errcode_for_file_access
push eax
call sym.postgres.exe_errfinish
add esp, 8
mov ecx, dword [sym.postgres.exe_Log_directory]
push esi
push ecx
call dword [sym.imp.MSVCR100.dll__mkdir]
push 0
call dword [sym.imp.MSVCR100.dll__time32]
cdq
push 0
push edx
push eax
mov dword [sym.postgres.exe_first_syslogger_file_time], eax
mov dword [0x836dac], edx
call fcn.00587f50
push 0
mov esi, eax
push 0x7362f4
push esi
call fcn.00587e80
push esi
mov dword [0x836da0], eax
call sym.postgres.exe_pfree
add esp, 0x24
call fcn.00587da0
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, 0xffffffff
je 0x5882f0
cmp byte [sym.postgres.exe_redirection_done], 0
jne 0x5882d0
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push ebx
push edi
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
mov edx, dword [0x836dbc]
push 0x8008
push edx
call dword [sym.imp.MSVCR100.dll__open_osfhandle]
mov edi, eax
call esi
mov ebx, dword [sym.imp.MSVCR100.dll__fileno]
add eax, 0x40
push eax
call ebx
push eax
push edi
call dword [sym.imp.MSVCR100.dll__dup2]
add esp, 0x18
test eax, eax
jns 0x588296
push 0
push 0x7363c8
push 0x298
push str.src_backendpostmaster_syslogger.c
push 0x15
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x588296
push str.could_not_redirect_stderr:__m
call sym.postgres.exe_errmsg
add esp, 4
push eax
call sym.postgres.exe_errcode_for_file_access
push eax
call sym.postgres.exe_errfinish
add esp, 8
push edi
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
push 0x8000
call esi
add eax, 0x40
push eax
call ebx
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__setmode]
mov esi, dword [ebp - 4]
add esp, 8
pop edi
mov dword [0x836dbc], 0
mov byte [sym.postgres.exe_redirection_done], 1
pop ebx
mov eax, dword [0x836da0]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov eax, esi
mov dword [0x836da0], 0
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0x7363c8
push 0x262
push str.src_backendpostmaster_syslogger.c
push 0xf
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x588322
push str.could_not_fork_system_logger:__m
call sym.postgres.exe_errmsg
push eax
call sym.postgres.exe_errfinish
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5886c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 8
jne 0x5886de
cmp dword [0x836da4], 0
jne 0x5886d7
call fcn.00588330
mov eax, dword [0x836da4]
jmp 0x5886e3
mov eax, dword [0x836da0]
push esi
mov esi, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, esi
pop esi
je 0x58871a
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCR100.dll_strerror]
push eax
push str.could_not_write_to_log_file:__s_n
call sym.postgres.exe_write_stderr
add esp, 0xc
pop ebp
ret
Function at 0x5889a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ecx, 0x836990
push esi
mov dword [ebp - 4], ecx
push edi
nop
mov eax, dword [ecx]
test eax, eax
je 0x588a1e
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x588a1e
lea ecx, [ecx]
mov esi, dword [ebx]
cmp dword [esi], 0
je 0x588a14
mov ecx, dword [0x836da0]
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
push ecx
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, edi
je 0x588a02
call dword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [eax]
push edx
call dword [sym.imp.MSVCR100.dll_strerror]
push eax
push str.could_not_write_to_log_file:__s_n
call sym.postgres.exe_write_stderr
add esp, 0xc
mov dword [esi], 0
mov eax, dword [esi + 4]
push eax
call sym.postgres.exe_pfree
add esp, 4
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x5889c0
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ecx, sym.postgres.exe_Logging_collector
jl 0x5889b0
mov edi, dword [ebp + 0xc]
mov esi, dword [edi]
test esi, esi
jle 0x588a6d
mov ecx, dword [0x836da0]
mov edx, dword [ebp + 8]
push ecx
push esi
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, esi
je 0x588a6d
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCR100.dll_strerror]
push eax
push str.could_not_write_to_log_file:__s_n
call sym.postgres.exe_write_stderr
add esp, 0xc
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58ff10
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, eax
call fcn.0058b9d0
cmp dword [esi + 0x14], 0
jne 0x58ff59
mov eax, dword [esi + 0x18]
test al, 4
je 0x58ff3b
mov dword [esi + 0x28], 3
mov dword [esi + 0x20], 0x6e
mov eax, esi
pop esi
jmp fcn.0058f010
and al, 1
movsx eax, al
neg eax
sbb eax, eax
add eax, 2
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], 0x6e
mov eax, esi
pop esi
jmp fcn.0058f010
pop esi
ret

Function at 0x5906b0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x6c], 0
je 0x5906bf
pop esi
jmp fcn.0058f010
mov eax, dword [esi + 0x60]
push ebx
push edi
call fcn.00589ee0
mov ebx, eax
mov eax, dword [esi + 0x60]
call fcn.00589ee0
cmp dword [esi + 0x14], 0
mov edi, eax
jne 0x590711
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword [esi + 0x10], ecx
mov dword [esi + 4], 0x7369b0
mov dword [esi + 8], 0x7369e0
call fcn.0058f010
call fcn.005905d0
mov eax, esi
call fcn.0058f010
cmp dword [esi + 0x14], 0
jne 0x590711
mov dword [esi + 0x6c], ebx
pop edi
pop ebx
pop esi
ret

Function at 0x591d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 4], ebx
jle 0x591d55
mov eax, dword [esi + 0x14]
test byte [eax + 8], 1
jne 0x591dc2
mov eax, dword [ebp + 8]
push eax
push esi
call fcn.00591bc0
add esp, 8
xor ecx, ecx
cmp dword [esi + 0x10], ebx
jle 0x591d7b
lea esp, [esp]
mov edx, dword [eax]
mov dword [edx + ecx*4], ebx
inc ecx
cmp ecx, dword [esi + 0x10]
jl 0x591d70
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx + 0xc]
mov edi, dword [eax]
mov edx, ecx
shr edx, 5
lea edx, [edi + edx*4]
and ecx, 0x1f
mov edi, 1
shl edi, cl
or dword [edx], edi
mov ecx, dword [esi + 0x10]
cmp ecx, 1
jne 0x591da5
mov ecx, dword [eax]
mov edx, dword [ecx]
jmp 0x591db8
xor edx, edx
cmp ecx, ebx
jle 0x591db8
mov ecx, dword [eax]
mov edi, dword [esi + 0x10]
xor edx, dword [ecx]
add ecx, 4
dec edi
jne 0x591db0
mov dword [eax + 4], edx
mov dword [eax + 8], 0xd
xor ecx, ecx
cmp dword [esi + 4], ebx
jle 0x591de0
xor edx, edx
jmp 0x591dd0
mov edi, dword [esi + 0x14]
mov dword [edx + edi + 0x14], ebx
inc ecx
add edx, 0x20
cmp ecx, dword [esi + 4]
jl 0x591dd0
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
pop edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
pop ebx
pop ebp
ret
Function at 0x596150
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push str.yy_fatal_error
push 0x6bf
push str.src_backend_replication_repl_scanner.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x596189
mov eax, dword [ebp + 8]
push eax
push 0x6ab5fc
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x59ac60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call sym.postgres.exe_initStringInfo
add esp, 4
xor ebx, ebx
jmp 0x59ac80
mov edi, dword [sym.postgres.exe_MyWalSnd]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x59acb6
push ebx
push 1
lea esi, [edi + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x59acb1
push 0x5b4
push str.src_backend_replicationwalsender.c
push esi
call sym.postgres.exe_s_lock
add esp, 0xc
mov dword [edi + 4], ebx
mov dword [esi], ebx
push ebx
push str.idle
call sym.postgres.exe_set_ps_display
add esp, 8
call sym.postgres.exe_pq_getbyte
mov esi, eax
call sym.postgres.exe_PostmasterIsAlive
test al, al
je 0x59adeb
mov edx, dword [0x836edc]
test edx, edx
je 0x59acf2
push 2
mov dword [0x836edc], ebx
call sym.postgres.exe_ProcessConfigFile
add esp, 4
cmp esi, 0xffffffff
je 0x59ad0f
lea eax, [ebp - 0x10]
push ebx
push eax
call sym.postgres.exe_pq_getmessage
add esp, 8
test eax, eax
je 0x59ada6
or esi, 0xffffffff
push ebx
push str.WalSndHandshake
push 0x10e
push str.src_backend_replicationwalsender.c
push 0x10
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x59ad51
push str.unexpected_EOF_on_standby_connection
call sym.postgres.exe_errmsg
add esp, 4
push eax
push 0x1020200
call sym.postgres.exe_errcode
add esp, 4
push eax
call sym.postgres.exe_errfinish
add esp, 8
push ebx
call sym.postgres.exe_proc_exit
add esp, 4
push ebx
push str.WalSndHandshake
push 0x114
push str.src_backend_replicationwalsender.c
push 0x15
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x59ac80
push esi
push str.invalid_standby_handshake_message_type__d
call sym.postgres.exe_errmsg
add esp, 8
push eax
push 0x1020200
call sym.postgres.exe_errcode
add esp, 4
push eax
call sym.postgres.exe_errfinish
add esp, 8
jmp 0x59ac80
cmp esi, 0x51
je 0x59adbe
cmp esi, 0x58
jne 0x59ad5a
push ebx
call sym.postgres.exe_proc_exit
add esp, 4
jmp 0x59ad0f
lea ecx, [ebp - 0x10]
push ecx
call sym.postgres.exe_pq_getmsgstring
lea edx, [ebp - 0x10]
push edx
mov esi, eax
call sym.postgres.exe_pq_getmsgend
add esp, 8
mov eax, esi
call fcn.0059a8f0
test al, al
je 0x59ac80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x59b350
Capabilities:
Terminate process

Disassembly:
call sym.postgres.exe_RecoveryInProgress
mov byte [sym.postgres.exe_am_cascading_walsender], al
call fcn.0059ab40
mov eax, dword [sym.postgres.exe_TopMemoryContext]
push 0x800000
push 0x2000
push 0
push str.Wal_Sender
push eax
call sym.postgres.exe_AllocSetContextCreate
push str.walsender_top_level_resource_owner
push 0
mov dword [sym.postgres.exe_CurrentMemoryContext], eax
call sym.postgres.exe_ResourceOwnerCreate
mov ecx, dword [0x869288]
push ecx
mov dword [sym.postgres.exe_CurrentResourceOwner], eax
call sym.postgres.exe_pqsigsetmask
add esp, 0x20
cmp byte [sym.postgres.exe_am_cascading_walsender], 0
je 0x59b3b3
call sym.postgres.exe_GetRecoveryTargetTLI
mov dword [sym.postgres.exe_ThisTimeLineID], eax
push esi
push edi
push 2
call sym.postgres.exe_ReadyForQuery
add esp, 4
call fcn.0059ac60
mov esi, dword [sym.postgres.exe_MyWalSnd]
push 0
push 1
lea edi, [esi + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x59b3ef
push 0xbc
push str.src_backend_replicationwalsender.c
push edi
call sym.postgres.exe_s_lock
add esp, 0xc
mov edx, dword [0x836ed4]
mov eax, dword [0x836ed8]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [edi], 0
call sym.postgres.exe_SyncRepInitConfig
pop edi
pop esi
jmp fcn.0059b000