joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9b6cb0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x9fe230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9b6d41
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.009b6c20
mov ecx, esi
push 8
push ecx
call fcn.009bc350
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x9b6d52
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009640f1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.009640f1
mov esp, ebp
pop ebp
ret

Function at 0x9b8820
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x9b8853
push 0x2e
push esi
call fcn.00964200
add esp, 8
test eax, eax
je 0x9b8851
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x9bc3a0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9bc3d9
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
ret
Function at 0x9bd860
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x9ff33c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x9bd88b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x9bd8d2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x9bd8d5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x9bd936
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x9bd900
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x9bd96f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push str.6_
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x9f312b
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x9bd940
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x9bda40
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9bda73
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x9bfc05
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9bfc2c
call fcn.00962138
mov dword [eax], esi
call fcn.00962125
push 0x16
pop esi
mov dword [eax], esi
call fcn.00962d7a
mov eax, esi
jmp 0x9bfc81
test dword [ebp + 0xc], 0xfffffff9
jne 0x9bfc12
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9bfc59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096214b
pop ecx
call fcn.00962125
mov eax, dword [eax]
jmp 0x9bfc81
test al, 0x10
jne 0x9bfc7f
test al, 1
je 0x9bfc7f
test byte [ebp + 0xc], 2
je 0x9bfc7f
call fcn.00962138
mov dword [eax], 5
call fcn.00962125
mov dword [eax], 0xd
jmp 0x9bfc50
xor eax, eax
pop esi
pop ebp
ret
Function at 0x427660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
jmp 0x42767a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427681
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427670
mov eax, 1
add ebx, ebx
jne 0x427693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427688
jne 0x4276a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427688
xor ecx, ecx
sub eax, 3
jb 0x4276b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42772a
mov ebp, eax
add ebx, ebx
jne 0x4276c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4276d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4276f4
inc ecx
add ebx, ebx
jne 0x4276e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4276d5
jne 0x4276f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4276d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427714
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427705
jmp 0x427676
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427714
add edi, ecx
jmp 0x427676
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427732
cmp byte [edi], 9
jne 0x427732
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x427737
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x4277af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a044]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a124]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x427764
mov ecx, edi
jns 0x427793
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a12c]
or eax, eax
je 0x4277a9
mov dword [ebx], eax
add ebx, 4
jmp 0x427781
call dword [esi + 0x2a128]
mov ebp, dword [esi + 0x2a130]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4277e3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x40dad0
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x7b
stosd dword es:[edi], eax
ret
jnp 0x40dabc
dec edx
test ch, dh
pop ebp
or al, byte [edi - 0x15eb46b]
mov ch, 0x17
mov ebx, 0x31231822
sub esi, dword [ebp - 0x7e]
jmp 0xd5b8d7c2
movsd dword es:[edi], dword [esi]
or dl, byte [eax + 4]
xchg edi, eax
lodsb al, byte [esi]
lahf
invalid
imul dword [edx + 0x31b2a4e3]
xor eax, 0x612b954e
jae 0x40da6d
jp 0x40da9a
insb byte es:[edi], dx
mov edi, 0x158a24b6
rcr byte [ebx + 0x41], cl
push ebx
adc eax, 0x53415bd2
sub eax, dword [ebp - 0x15]
dec ebx
xchg edi, eax
fucompi st(6)
adc byte [ebp + 0x13], bh
xchg dl, ah
mov ebx, 0x8b3269d6
push ebp
xor dword [ebx + eax + 0x5bdb6310], 0x5f
or eax, 0xe6340235
jae 0x40db4f
adc ecx, dword [esi + 0x16]
jecxz 0x40dae4
imul ebx, dword [edx], 0xffffffba
stosd dword es:[edi], eax
rcl dword [edi + eax - 0x4c7bebf0]
adc al, 0xbd
mov bl, 0x2e
adc al, 0xbd
mov ebx, 0x4d79115
mov byte [eax], dl
xor byte [ebp - 0x76], 0xa5
xchg ebp, eax
mov dh, 0xb5
push ecx
xor eax, 0x2fcd735c
stosb byte es:[edi], al
inc eax
sub eax, dword [ecx]
or ecx, edi
mov dword [0x44e528d0], eax
sbb al, 0xd0
inc edx
rcl byte [ecx]
dec esp
lds ebx, [edx + 0x34]
pushal
add al, 0xe6
pop ebp
sub ebp, edi
loopne 0x40db19
invalid

Function at 0x629cf5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323c0
cmp edx, dword [eax]
je 0x629d17
add eax, 8
inc ecx
cmp eax, 0x632450
jl 0x629d08
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323c0]
jne 0x629e45
mov eax, dword [0x63ad68]
cmp eax, 1
je 0x629e1f
test eax, eax
jne 0x629d48
cmp dword [0x6322e8], 1
je 0x629e1f
cmp edx, 0xfc
je 0x629e45
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629d7f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062a6e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062ab70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629dc2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062ab70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea4c
push edi
call fcn.0062ca40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062a6e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a6f0
lea eax, [ebp - 0xa0]
push 0x62ea2c
push eax
call fcn.0062a6f0
push dword [esi + 0x6323c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a6f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c9b4
add esp, 0x2c
pop edi
jmp 0x629e45
lea eax, [ebp + 8]
lea esi, [esi + 0x6323c4]
push 0
push eax
push dword [esi]
call fcn.0062ab70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42e001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x70d45c8a
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x66d65ef2
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405ead
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 1
xor eax, eax
pop edi
cmp dword [ebp + 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
jne 0x405edf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_connect
jmp 0x405fc1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
mov ebx, 0x8004667e
push eax
push ebx
push esi
call sub.WSOCK32.dll_ioctlsocket
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x405f0f
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x405f51
push dword [ebp + 0x14]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], edi
push 0
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x210], esi
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x214], edi
call sub.WSOCK32.dll_select
test eax, eax
jne 0x405f56
push 0x274c
call sub.WSOCK32.dll_WSASetLastError
or eax, 0xffffffff
jmp 0x405fc1
or edi, 0xffffffff
cmp eax, edi
je 0x405fbb
lea eax, [ebp - 0x110]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x405f7f
lea eax, [ebp - 0x214]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x405fbb
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0x1007
push 0xffff
push esi
call sub.WSOCK32.dll_getsockopt
cmp eax, edi
je 0x405fbb
lea eax, [ebp - 8]
push eax
push ebx
push esi
call sub.WSOCK32.dll_ioctlsocket
cmp dword [ebp - 4], 0
je 0x405fbf
push dword [ebp - 4]
call sub.WSOCK32.dll_WSASetLastError
mov eax, edi
jmp 0x405fc1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4060ee
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x406129
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00448165
pop ecx
test eax, eax
pop ecx
jne 0x406137
push dword [ebp + 8]
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x40612d
push str.php_network_getaddresses:_gethostbyname_failed
push 2
push dword [ebp + 0x14]
push eax
call sym.stub.exe_php_error_docref0
add esp, 0x10
xor eax, eax
leave
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push esi
push 8
call sym.stub.exe__emalloc
mov esi, eax
mov eax, dword [ebp + 0x10]
push 0x10
mov dword [eax], esi
call sym.stub.exe__emalloc
pop ecx
mov dword [esi], eax
pop ecx
mov word [eax], 2
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
push 1
mov dword [eax + 4], ecx
and dword [esi + 4], 0
pop eax
pop esi
leave
ret
Function at 0x406467
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push esi
mov eax, dword [ebx]
and byte [ebx + 0x10], 0
mov dword [ebp - 0x108], eax
mov eax, dword [ebx + 8]
inc eax
push edi
neg eax
sbb eax, eax
mov dword [ebp - 0x10c], 1
and eax, ecx
mov dword [ebp + 0xc], eax
jmp 0x4064a1
mov eax, dword [ebp + 0xc]
push 0x41
lea esi, [ebp - 0x10c]
pop ecx
lea edi, [ebp - 0x210]
push eax
push 0
lea eax, [ebp - 0x210]
push 0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 8]
push eax
mov eax, dword [ebx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebx + 0xc]
inc eax
push eax
mov dword [ebp - 4], ecx
call sub.WSOCK32.dll_select
test eax, eax
jne 0x4064db
mov byte [ebx + 0x10], 1
jl 0x40649e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406600
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 4]
push 1
pop edi
xor ebx, ebx
mov esi, dword [eax]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x110]
push ebx
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], edi
call sub.WSOCK32.dll_select
test eax, eax
jle 0x406677
lea eax, [ebp - 0x110]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x406677
push 2
lea eax, [ebp + 0xb]
push edi
push eax
push esi
call sub.WSOCK32.dll_recv
test eax, eax
jne 0x406677
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0xb
je 0x406677
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408b7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
test esi, esi
je 0x408bd4
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x408ba7
mov al, byte [eax + esi - 1]
cmp al, 0x2f
je 0x408ba7
cmp al, 0x5c
mov eax, 0x517eb8
jne 0x408bac
mov eax, 0x54dd08
push dword [ebp + 0xc]
push eax
push esi
push str._s_s_sXXXXXX
lea eax, [ebp + 8]
push 0
push eax
call sym.stub.exe_spprintf
add esp, 0x18
cmp eax, 0x104
push dword [ebp + 8]
jl 0x408bd9
call sym.stub.exe__efree
pop ecx
or eax, 0xffffffff
jmp 0x408c2e
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x408c23
push dword [ebp + 0x14]
mov esi, 0x180
push esi
push dword [ebp + 8]
call sym.stub.exe_virtual_chmod
push esi
push 0x8302
push dword [ebp + 0x14]
push dword [ebp + 8]
call sym.stub.exe_virtual_open
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x408c23
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x408c23
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x408c2c
push dword [ebp + 8]
call sym.stub.exe__efree
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x410c4a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004fba70
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x18]
push edi
push 0
or al, 0x20
and dword [ebp - 4], 0
push ebx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.stub.exe__php_stream_open_wrapper_ex
mov esi, eax
add esp, 0x18
test esi, esi
je 0x410d4b
test byte [ebp + 0x10], 0x80
je 0x410d14
cmp dword [esi], 0x514300
jne 0x410d14
push edi
push 0
push 0x518180
push 0
call sym.stub.exe_php_open_temporary_file
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x410d14
push edi
push esi
call sym.stub.exe__php_stream_eof
pop ecx
pop ecx
test eax, eax
jne 0x410cf7
push edi
lea eax, [ebp - 0x2004]
push 0x2000
push eax
push esi
call sym.stub.exe__php_stream_read
add esp, 0x10
test eax, eax
jbe 0x410cf7
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push esi
call sym.stub.exe__php_stream_eof
add esp, 0x18
jmp 0x410cba
push edi
push 3
push esi
call sym.stub.exe__php_stream_free
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_rewind]
add esp, 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
push edi
lea eax, [ebp - 4]
push 8
push eax
push 0xc0000000
push esi
call sym.stub.exe__php_stream_cast
add esp, 0x14
cmp eax, 0xffffffff
jne 0x410d0c
push edi
push 3
push esi
call sym.stub.exe__php_stream_free
add esp, 0xc
test ebx, ebx
je 0x410d4b
mov eax, dword [ebx]
test eax, eax
je 0x410d4b
push eax
call sym.stub.exe__efree
pop ecx
xor eax, eax
jmp 0x410d0f
Function at 0x41f45f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0041f4fb
mov dword [esp], str.ISO_8859_1
call sym.stub.exe_XML_ParserCreate
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
call sym.stub.exe_XML_SetUserData
push 0x41fd08
push 0x41f5a9
push esi
call sym.stub.exe_XML_SetElementHandler
push fcn.00420223
push esi
call sym.stub.exe_XML_SetCharacterDataHandler
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call sym.stub.exe_XML_Parse
push esi
call sym.stub.exe_XML_ParserFree
add esp, 0x34
cmp dword [ebp - 0x18], 1
jne 0x41f4e9
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041f52d
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
push dword [ebp + 0x10]
mov esi, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.stub.exe__zval_copy_ctor
add esp, 0xc
xor esi, esi
pop edi
jmp 0x41f4ec
or esi, 0xffffffff
lea eax, [ebp - 0x18]
push eax
call fcn.0041f552
pop ecx
mov eax, esi
pop esi
leave
ret

Function at 0x42314a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x2140
push 1
call sym.stub.exe__ecalloc
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp word [ebp + 0xc], bx
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ebx
je 0x42317a
movsx eax, word [ebp + 0xc]
jmp 0x42317d
push 0x15
pop eax
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push ecx
push 1
push eax
push dword [ebp + 8]
call sym.stub.exe_php_hostconnect
add esp, 0x14
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4231f5
mov eax, 0x80
mov dword [esi + 0x2120], edi
lea edi, [esi + 4]
push eax
push ebx
mov dword [esi + 0x2128], ebx
push edi
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
push dword [esi]
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
jne 0x423210
mov edi, dword [sym.imp.MSVCRT.dll__errno]
call edi
push dword [eax]
call edi
push dword [eax]
call dword [sym.imp.MSVCRT.dll_strerror]
pop ecx
push eax
push str.getsockname_failed:__s___d__n
push 2
push dword [ebp + 0x14]
push ebx
call sym.stub.exe_php_error_docref0
add esp, 0x18
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x423202
push eax
call sub.WSOCK32.dll_closesocket
push esi
call sym.stub.exe__efree
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push esi
call fcn.00423e96
test eax, eax
pop ecx
je 0x4231f5
cmp dword [esi + 0x84], 0xdc
jne 0x4231f5
mov eax, esi
jmp 0x42320b