joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10350a20
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push 0x18
test ebx, ebx
je 0x10350a58
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x10350a60
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
pop ecx
mov esi, eax
push edi
push 6
pop ecx
xor eax, eax
push 0x10548abc
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [0x10660b6c]
and dword [esi + 0xc], 0
push ebx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x18]
push esi
push 0x1064a554
mov byte [esi + 4], 1
mov dword [esi], eax
call sym.php5.dll__php_stream_alloc
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10350aaf
push esi
test ebx, ebx
je 0x10350aa7
call dword [sym.imp.MSVCR110.dll_free]
jmp 0x10350aac
call sym.php5.dll__efree
pop ecx
jmp 0x10350ab3
or dword [edi + 0x5c], 0x10
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x10350ce0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push dword [esp + 0x28]
xor ebp, ebp
push dword [esp + 0x24]
call sym.php5.dll_php_network_getaddresses
add esp, 0x10
test eax, eax
jne 0x10350d0d
or eax, 0xffffffff
jmp 0x10350ded
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov eax, ebx
mov dword [esp + 0x14], ebx
cmp dword [ebx], ebp
je 0x10350dc2
mov eax, dword [eax]
push 0
push dword [esp + 0x2c]
mov dword [esp + 0x18], eax
movzx eax, word [eax]
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x10350dae
mov eax, dword [esp + 0x10]
movzx eax, word [eax]
dec eax
dec eax
je 0x10350d5c
sub eax, 0x15
jne 0x10350da7
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_htons]
push 0x1c
jmp 0x10350d68
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov ecx, dword [esp + 0x14]
pop ebp
push 4
mov word [ecx + 2], ax
lea eax, [esp + 0x1c]
push eax
push 4
push 0xffff
push esi
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
push ebp
push dword [esp + 0x14]
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10350de2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
cmp dword [eax], 0
jne 0x10350d21
mov eax, dword [esp + 0x30]
or esi, 0xffffffff
test eax, eax
je 0x10350dcf
mov dword [eax], ebp
test edi, edi
je 0x10350de2
push 0
push 0
push ebp
call sym.php5.dll_php_socket_strerror
add esp, 0xc
mov dword [edi], eax
push ebx
call sym.php5.dll_php_network_freeaddresses
pop ecx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x10350ea0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, 0x80
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10350f19
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push ebx
push edi
push esi
push dword [esp + 0x20]
push eax
call sym.php5.dll_php_network_populate_name_from_sockaddr
add esp, 0x18
xor eax, eax
jmp 0x10350f1c
or eax, 0xffffffff
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10311bec
mov esp, ebp
pop ebp
ret
Function at 0x10350f40
Capabilities:
Convert ip address from string

Disassembly:
push ecx
and dword [esp], 0
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
or ebx, 0xffffffff
cmp byte [edi], 0x5b
jne 0x10350f7f
mov eax, dword [esp + 0x18]
inc edi
dec eax
push eax
push 0x5d
push edi
call dword [sym.imp.MSVCR110.dll_memchr]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10350f78
cmp byte [esi + 1], 0x3a
jne 0x10350f78
lea eax, [esi + 2]
jmp 0x10350f98
mov eax, ebx
jmp 0x10351088
push dword [esp + 0x18]
push 0x3a
push edi
call dword [sym.imp.MSVCR110.dll_memchr]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10350f78
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR110.dll_atoi]
pop ecx
push ebp
movzx eax, ax
sub esi, edi
push esi
push edi
mov dword [esp + 0x20], eax
call sym.php5.dll__estrndup
mov ebp, dword [esp + 0x28]
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x17
pop esi
push esi
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x10350fec
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp + 2], ax
mov eax, dword [esp + 0x24]
mov word [ebp], si
mov dword [eax], 0x1c
xor ebp, ebp
jmp 0x1035106a
lea eax, [ebp + 4]
push eax
push ebx
call sym.php5.dll_inet_aton
pop ecx
pop ecx
test eax, eax
jle 0x1035101d
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp + 2], ax
push 2
pop eax
mov word [ebp], ax
mov eax, dword [esp + 0x24]
mov dword [eax], 0x10
jmp 0x10350fe8
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 2
push ebx
call sym.php5.dll_php_network_getaddresses
add esp, 0x10
test eax, eax
jne 0x1035108d
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10351067
push esi
push ebx
push str.Failed_to_resolve___s:__s
push 2
push eax
call sym.php5.dll_php_error_docref0
add esp, 0x14
cmp esi, dword [0x106690bc]
jb 0x10351060
cmp esi, dword [0x106690c0]
jb 0x10351067
push esi
call sym.php5.dll__efree
pop ecx
or ebp, 0xffffffff
test ebx, ebx
je 0x10351085
cmp ebx, dword [0x106690bc]
jb 0x1035107e
cmp ebx, dword [0x106690c0]
jb 0x10351085
push ebx
call sym.php5.dll__efree
pop ecx
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x20]
mov esi, dword [eax]
movzx eax, word [esi]
dec eax
dec eax
je 0x103510c2
sub eax, 0x15
jne 0x103510e2
push 7
pop ecx
push dword [esp + 0x18]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp + 2], ax
mov eax, dword [esp + 0x24]
mov dword [eax], 0x1c
xor ebp, ebp
jmp 0x103510e5
push dword [esp + 0x18]
mov edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp + 2], ax
mov eax, dword [esp + 0x24]
mov dword [eax], 0x10
jmp 0x103510be
or ebp, 0xffffffff
push dword [esp + 0x20]
call sym.php5.dll_php_network_freeaddresses
pop ecx
jmp 0x1035106a
Function at 0x10353710
Capabilities:
Get common file path

Disassembly:
sub esp, 0x120
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x12c]
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
mov edi, edx
test esi, esi
je 0x1035375e
cmp byte [esi], 0
je 0x1035375e
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10353742
sub edx, ecx
mov ecx, edi
call fcn.1035fe50
test eax, eax
jne 0x1035377a
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10311bec
add esp, 0x120
ret
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll__getcwd]
neg eax
sbb al, al
and byte [esp + 0x28], al
lea eax, [esp + 0x28]
push eax
call sym.php5.dll__estrdup
lea ecx, [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x14], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x103537aa
push 2
push 0
lea eax, [esp + 0x1c]
sub ecx, edx
push esi
push eax
mov dword [esp + 0x28], ecx
call sym.php5.dll_virtual_file_ex
add esp, 0x10
test eax, eax
je 0x103537d9
push dword [esp + 0x14]
call sym.php5.dll__efree
pop ecx
jmp 0x1035375e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov al, byte [eax + ecx - 1]
cmp al, 0x2f
je 0x103537f2
cmp al, 0x5c
mov eax, 0x10622d94
jne 0x103537f7
mov eax, 0x1053ac9c
push edi
push eax
push ecx
push str._s_s_sXXXXXX
lea eax, [esp + 0x2c]
push 0
push eax
call sym.php5.dll_spprintf
add esp, 0x18
cmp eax, 0x104
jl 0x10353821
push dword [esp + 0x1c]
call sym.php5.dll__efree
pop ecx
jmp 0x103537cd
mov esi, dword [esp + 0x1c]
push esi
push 0
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1035386d
mov edi, 0x180
push edi
push esi
call dword [sym.imp.MSVCR110.dll__chmod]
pop ecx
pop ecx
test eax, eax
je 0x1035384d
push esi
jmp 0x10353819
push edi
push 0x8302
push esi
call dword [sym.imp.MSVCR110.dll__open]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x1035386d
test ebp, ebp
je 0x1035386d
mov dword [ebp], esi
jmp 0x10353874
push esi
call sym.php5.dll__efree
pop ecx
push dword [esp + 0x14]
call sym.php5.dll__efree
pop ecx
mov eax, ebx
jmp 0x10353761
Function at 0x103561f0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
push 2
pop eax
mov dword [esp + 8], 0x10
cmp dword [ebp + 8], eax
je 0x10356223
push 0x273a
jmp 0x1035630e
push dword [ebp + 0x10]
or dword [edi + 4], 0xffffffff
push dword [ebp + 0xc]
or dword [edi], 0xffffffff
push eax
or esi, 0xffffffff
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x103562f7
and dword [esp + 0x10], 0
push 2
pop ecx
mov word [esp + 0xc], cx
xor ecx, ecx
mov word [esp + 0xe], cx
push 0x10
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x103562f7
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x103562f7
push 2
pop eax
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x103562f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x103562f7
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x10], eax
push 0x10
lea eax, [esp + 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x103562f7
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x103562f7
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], esi
xor eax, eax
jmp 0x10356317
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi]
call esi
push dword [edi + 4]
call esi
push 0x2745
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.10311bec
mov esp, ebp
pop ebp
ret

Function at 0x10356710
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push 0x24
test esi, esi
je 0x10356747
call dword [sym.imp.MSVCR110.dll_malloc]
mov edx, eax
pop ecx
test edx, edx
jne 0x1035674f
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
pop ecx
mov edx, eax
push edi
push 9
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx + 0x10], esi
mov dword [edx + 4], ecx
mov eax, edx
pop esi
ret
Function at 0x103567b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x18
xor edx, edx
xor ecx, ecx
cmp dword [esp + 0x20], ecx
push ebx
setne cl
lea eax, [esp + 0x14]
push ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
push esi
mov ebx, dword [eax + 0x14]
inc ecx
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
lea edi, [esp + 0x18]
mov ebp, edx
test ebx, ebx
je 0x10356955
cmp dword [ebx + 8], edx
je 0x10356955
mov esi, dword [ebx + 8]
mov edx, eax
mov dword [esp + 0x30], eax
mov eax, dword [eax]
push ecx
push 0
push dword [esp + 0x18]
push edi
push edx
push esi
call dword [eax]
add esp, 0x18
cmp eax, 1
je 0x10356951
test eax, eax
je 0x10356955
mov edx, dword [esp + 0x30]
mov eax, edi
mov edi, dword [esp + 0x10]
and dword [eax], ebp
and dword [eax + 4], ebp
mov edx, dword [edx + 8]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], edx
test edx, edx
jne 0x10356802
mov edi, dword [edi]
mov eax, edi
test eax, eax
je 0x10356951
add ebp, dword [eax + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x10356858
test ebp, ebp
je 0x10356951
lea eax, [esi + 8]
cmp ebx, eax
jne 0x10356922
mov edx, dword [esi + 0x6c]
test edx, edx
jle 0x10356895
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
sub eax, edx
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.MSVCR110.dll_memcpy
add esp, 0xc
and dword [esi + 0x6c], 0
mov eax, dword [esi + 0x68]
sub eax, dword [esi + 0x70]
cmp ebp, eax
jbe 0x103568ed
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x70]
add eax, ebp
cmp dword [esi + 0x30], 0
je 0x103568dc
push eax
push dword [esi + 0x64]
call dword [sym.imp.MSVCR110.dll_realloc]
pop ecx
pop ecx
test eax, eax
jne 0x103568ea
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
push 0
push eax
push dword [esi + 0x64]
call sym.php5.dll__erealloc
add esp, 0xc
mov dword [esi + 0x64], eax
mov ebx, dword [esp + 0x14]
jmp 0x1035691a
push dword [edi + 0x10]
mov eax, dword [esi + 0x70]
push dword [edi + 0xc]
add eax, dword [esi + 0x64]
push eax
call sub.MSVCR110.dll_memcpy
mov eax, dword [edi + 0x10]
add dword [esi + 0x70], eax
push edi
call sym.php5.dll_php_stream_bucket_unlink
push edi
call sym.php5.dll_php_stream_bucket_delref
add esp, 0x14
mov edi, dword [ebx]
test edi, edi
jne 0x103568f3
jmp 0x10356951
lea eax, [esi + 0x14]
cmp ebx, eax
jne 0x10356951
test edi, edi
je 0x10356951
mov ebx, dword [esp + 0x14]
push dword [edi + 0x10]
mov eax, dword [esi]
push dword [edi + 0xc]
push esi
call dword [eax]
push edi
call sym.php5.dll_php_stream_bucket_unlink
push edi
call sym.php5.dll_php_stream_bucket_delref
mov edi, dword [ebx]
add esp, 0x14
test edi, edi
jne 0x10356931
xor eax, eax
jmp 0x10356958
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x103569f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push ebp
call sym.php5.dll_php_stream_bucket_unlink
cmp dword [ebp + 0x1c], 1
pop ecx
jne 0x10356a0c
cmp dword [ebp + 0x14], 0
je 0x10356a0c
mov eax, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
push ebx
push 0x20
je 0x10356a41
call dword [sym.imp.MSVCR110.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10356a49
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
pop ecx
mov ebx, eax
push esi
push edi
push 8
pop ecx
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x18], 0
pop edi
pop esi
push dword [ebx + 0x10]
je 0x10356a87
call dword [sym.imp.MSVCR110.dll_malloc]
pop ecx
test eax, eax
jne 0x10356a8d
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
xor eax, eax
pop ecx
inc eax
push eax
jmp 0x10356a3b
call sym.php5.dll__emalloc
pop ecx
push dword [ebx + 0x10]
mov dword [ebx + 0xc], eax
push dword [ebp + 0xc]
push eax
call sub.MSVCR110.dll_memcpy
xor eax, eax
inc eax
push ebp
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x14], eax
call sym.php5.dll_php_stream_bucket_delref
add esp, 0x10
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x10356ac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax + 0x30]
push 0x20
test edi, edi
je 0x10356afd
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x10356b09
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
mov esi, eax
pop ecx
test esi, esi
je 0x10356b69
and dword [esi + 4], 0
and dword [esi], 0
test edi, edi
je 0x10356b47
cmp dword [ebp + 0x18], 0
jne 0x10356b47
push ebx
mov ebx, dword [ebp + 0x10]
push ebx
call dword [sym.imp.MSVCR110.dll_malloc]
pop ecx
test eax, eax
je 0x10356ade
push ebx
push dword [ebp + 0xc]
mov dword [esi + 0xc], eax
push eax
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 1
pop ebx
jmp 0x10356b59
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ecx
and dword [esi + 8], 0
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], 1
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x10356dc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 8]
sub esp, 0x14
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ecx + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov eax, dword [ecx + 4]
test eax, eax
je 0x10356dec
mov dword [eax + 8], edi
jmp 0x10356dee
mov dword [ecx], edi
lea eax, [esi + 8]
mov dword [ecx + 4], edi
mov dword [edi + 0x14], ecx
cmp eax, ecx
jne 0x10356f16
mov eax, dword [esi + 0x70]
sub eax, dword [esi + 0x6c]
test eax, eax
jle 0x10356f16
push ebx
push ebx
push eax
mov eax, dword [esi + 0x64]
add eax, dword [esi + 0x6c]
mov dword [esp + 0x24], ebx
push eax
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
call sym.php5.dll_php_stream_bucket_new
add esp, 0x14
push eax
lea eax, [esp + 0x1c]
push eax
call sym.php5.dll_php_stream_bucket_append
mov eax, dword [edi]
push ebx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push edi
push esi
call dword [eax]
mov ecx, dword [esi + 0x6c]
add ecx, dword [esp + 0x2c]
xor edx, edx
add esp, 0x20
cmp ecx, dword [esi + 0x70]
cmova eax, edx
sub eax, ebx
je 0x10356f35
dec eax
je 0x10356f1f
dec eax
jne 0x10356f16
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
jmp 0x10356f0a
mov ecx, dword [esi + 0x68]
mov edx, dword [edi + 0x10]
mov eax, ecx
sub eax, dword [esi + 0x70]
cmp eax, edx
jae 0x10356ee1
lea eax, [edx + ecx]
mov dword [esi + 0x68], eax
cmp dword [esi + 0x30], ebx
je 0x10356ed1
push eax
push dword [esi + 0x64]
call dword [sym.imp.MSVCR110.dll_realloc]
pop ecx
pop ecx
test eax, eax
jne 0x10356ede
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
push ebx
push eax
push dword [esi + 0x64]
call sym.php5.dll__erealloc
add esp, 0xc
mov dword [esi + 0x64], eax
push dword [edi + 0x10]
mov eax, dword [esi + 0x70]
push dword [edi + 0xc]
add eax, dword [esi + 0x64]
push eax
call sub.MSVCR110.dll_memcpy
mov eax, dword [edi + 0x10]
add dword [esi + 0x70], eax
add esp, 0xc
push edi
call sym.php5.dll_php_stream_bucket_unlink
pop ecx
push edi
call sym.php5.dll_php_stream_bucket_delref
pop ecx
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x10356e88
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
jmp 0x10356f16
push esi
call sym.php5.dll_php_stream_bucket_unlink
pop ecx
push esi
call sym.php5.dll_php_stream_bucket_delref
pop ecx
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x10356f27
jmp 0x10356f4d
push esi
call sym.php5.dll_php_stream_bucket_unlink
pop ecx
push esi
call sym.php5.dll_php_stream_bucket_delref
pop ecx
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x10356f3f
push str.Filter_failed_to_process_pre_buffered_data
push 2
push ebx
call sym.php5.dll_php_error_docref0
add esp, 0xc
or eax, 0xffffffff
jmp 0x10356f18
Function at 0x1035d3f0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push dword [esp + 0x14]
mov esi, dword [sym.imp.MSVCR110.dll_strncmp]
push 0x10548fa4
push dword [esp + 0x18]
call esi
add esp, 0xc
test eax, eax
jne 0x1035d416
mov ebp, sym.php5.dll_php_stream_socket_ops
jmp 0x1035d435
push dword [esp + 0x14]
push 0x10548fa8
push dword [esp + 0x18]
call esi
add esp, 0xc
test eax, eax
jne 0x1035d4b8
mov ebp, 0x10649f2c
mov ebx, dword [esp + 0x20]
push 0x18
test ebx, ebx
je 0x1035d46b
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x1035d473
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
pop ecx
mov esi, eax
push edi
push 6
pop ecx
push 0x10548abc
xor eax, eax
push ebx
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [0x10660b6c]
and dword [esi + 0xc], 0
or dword [esi], 0xffffffff
push esi
push ebp
mov byte [esi + 4], 1
mov dword [esi + 8], eax
call sym.php5.dll__php_stream_alloc
add esp, 0x10
pop edi
test eax, eax
jne 0x1035d4ba
push esi
test ebx, ebx
je 0x1035d4b2
call dword [sym.imp.MSVCR110.dll_free]
jmp 0x1035d4b7
call sym.php5.dll__efree
pop ecx
xor eax, eax
pop esi
pop ebp
pop ebx
ret

Function at 0x1035e030
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp word [esi], 0x7e
mov edi, edx
jne 0x1035e0c8
mov eax, dword [esp + 0x18]
test dword [eax + 0xc], 0x800
je 0x1035e0c8
lea ebp, [edi + 0x3fe]
lea ebx, [esi + 2]
mov ecx, edi
cmp edi, ebp
jae 0x1035e077
movzx eax, word [ebx]
test ax, ax
je 0x1035e077
cmp eax, 0x2f
je 0x1035e077
mov al, byte [ebx]
mov byte [ecx], al
inc ecx
add ebx, 2
cmp ecx, ebp
jb 0x1035e05e
mov byte [ecx], 0
cmp byte [edi], 0
jne 0x1035e0c8
push str.HOME
call dword [sym.imp.MSVCR110.dll_getenv]
mov edx, eax
pop ecx
test edx, edx
je 0x1035e0c8
mov ecx, edi
cmp edi, ebp
jae 0x1035e0aa
mov al, byte [edx]
test al, al
je 0x1035e0aa
cbw
mov word [ecx], ax
add ecx, 2
inc edx
cmp ecx, ebp
jb 0x1035e097
sub ebx, ecx
cmp ecx, ebp
jae 0x1035e0bf
movzx eax, word [ebx + ecx]
mov word [ecx], ax
add ecx, 2
test ax, ax
jne 0x1035e0ac
xor eax, eax
mov word [ecx], ax
mov eax, edi
jmp 0x1035e0ca
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret