joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004e3d0
Capabilities:
Terminate process

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push 0x40
jne 0x103b016e
call sym.php5.dll__emalloc
pop ecx
mov esi, eax
push 0x40
push 0
push esi
call sub.MSVCR110.dll_memset
and dword [esi], 0
and dword [esi + 8], 0xfffffffc
and dword [esi + 0x10], 0
push edi
push dword [esp + 0x20]
mov dword [esi + 0xc], 8
push esi
push sym.php5.dll_php_stream_stdio_ops
mov dword [esi + 4], ebx
call sym.php5.dll__php_stream_alloc
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.MSVCR110.dll_malloc]
pop ecx
mov esi, eax
test esi, esi
jne 0x1004e3ec
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
int3

Function at 0x1004e430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, 0x80
push ebx
test edi, edi
jne 0x103b0444
call sym.php5.dll__emalloc
pop ecx
mov esi, eax
push ebx
xor ebx, ebx
push ebx
push esi
call sub.MSVCR110.dll_memset
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
xor eax, eax
add esp, 0xc
test edi, edi
setne al
mov dword [esi + 0x10], esi
mov dword [esi + 0x1c], esi
mov dword [esi + 0x30], eax
mov eax, dword [0x10660b64]
mov dword [esi + 0x74], eax
cmp dword [0x10660b68], ebx
jne 0x1004e4d1
test edi, edi
jne 0x103b0474
mov eax, dword [0x10649ef8]
push eax
push esi
call sym.php5.dll_zend_list_insert
push 0x10
push dword [ebp + 0x14]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x34]
push eax
call sym.php5.dll_php_strlcpy
add esp, 0x14
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x7c], ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
or dword [esi + 0x5c], 4
jmp 0x1004e48a
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x1004e452
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
mov eax, dword [0x10649ef4]
mov ecx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x103b0487
push 1
push ebx
push 0xc
sub ecx, edx
lea eax, [ebp - 0xc]
push eax
lea eax, [ecx + 1]
push eax
push edi
push 0x1066933c
call sym.php5.dll__zend_hash_add_or_update
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x103b04bf
push esi
call dword [sym.imp.MSVCR110.dll_free]
pop ecx
xor eax, eax
jmp 0x1004e4cc
mov eax, dword [0x10649ef4]
jmp 0x1004e497
Function at 0x1004e860
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
add eax, 0xb
cmp byte [esi + 0x14], 0
push eax
jne 0x103a25b4
call sym.php5.dll__emalloc
pop ecx
mov ecx, eax
mov eax, dword [esi]
and dword [ecx + 4], 0
mov dword [ecx], eax
mov eax, dword [esi]
test eax, eax
je 0x1004e8a9
mov dword [eax + 4], ecx
push dword [esi + 0xc]
lea eax, [ecx + 8]
push dword [esp + 0x10]
mov dword [esi], ecx
push eax
call sub.MSVCR110.dll_memcpy
add esp, 0xc
inc dword [esi + 8]
pop esi
ret
mov dword [esi + 4], ecx
jmp 0x1004e88f
call dword [sym.imp.MSVCR110.dll_malloc]
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x1004e87e
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
int3
Function at 0x1004f840
Capabilities:
Terminate process

Disassembly:
sub esp, 0x30
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], esi
test ebx, ebx
je 0x103b04c9
xor ecx, ecx
cmp ebx, 0xffffffff
cmove ebx, ecx
push ebp
test ebx, ebx
jne 0x103b04d0
lea ecx, [esp + 0x18]
push ecx
push eax
call sym.php5.dll__php_stream_stat
pop ecx
pop ecx
test eax, eax
jne 0x1004f934
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jle 0x1004f934
add ebx, 0x2000
push ebx
cmp dword [esp + 0x54], edi
jne 0x103b0557
call sym.php5.dll__emalloc
pop ecx
mov ebp, eax
mov dword [esi], ebp
mov eax, ebx
sub eax, edi
push eax
push ebp
push dword [esp + 0x18]
call sym.php5.dll__php_stream_read
add esp, 0xc
test eax, eax
jne 0x1004f90c
test edi, edi
je 0x1004f920
cmp dword [esp + 0x50], 0
lea eax, [edi + 1]
jne 0x103b05a6
push 0
push eax
push dword [esi]
call sym.php5.dll__erealloc
add esp, 0xc
mov dword [esi], eax
mov byte [eax + edi], 0
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10311bec
add esp, 0x30
ret
add edi, eax
lea ecx, [edi + 0x800]
cmp ecx, ebx
jae 0x103b056d
add ebp, eax
jmp 0x1004f8bc
cmp dword [esp + 0x50], 0
push dword [esi]
jne 0x1004f93e
call sym.php5.dll__efree
and dword [esi], 0
pop ecx
jmp 0x1004f8f7
mov ebx, 0x2000
jmp 0x1004f8a7
call dword [sym.imp.MSVCR110.dll_free]
jmp 0x1004f92e
xor eax, eax
jmp 0x1004f8fa
lea eax, [ebx + 1]
push eax
cmp dword [esp + 0x54], ecx
je 0x103b0506
call dword [sym.imp.MSVCR110.dll_malloc]
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x103b050e
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
pop ecx
mov ebp, eax
mov dword [esi], ebp
test ebx, ebx
je 0x1004f920
mov esi, dword [esp + 0x10]
push esi
call sym.php5.dll__php_stream_eof
pop ecx
test eax, eax
jne 0x103b0542
mov eax, ebx
sub eax, edi
push eax
push ebp
push esi
call sym.php5.dll__php_stream_read
add esp, 0xc
test eax, eax
je 0x103b0542
add edi, eax
add ebp, eax
cmp edi, ebx
jb 0x103b051c
mov esi, dword [esp + 0x14]
test edi, edi
je 0x1004f920
mov byte [ebp], 0
jmp 0x1004f8f7
call dword [sym.imp.MSVCR110.dll_malloc]
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x1004f8ba
jmp 0x103b04e7
add ebx, 0x2000
cmp dword [esp + 0x50], 0
je 0x103b058f
push ebx
push dword [esi]
call dword [sym.imp.MSVCR110.dll_realloc]
pop ecx
pop ecx
test eax, eax
je 0x103b04e7
jmp 0x103b059c
push 0
push ebx
push dword [esi]
call sym.php5.dll__erealloc
add esp, 0xc
mov dword [esi], eax
lea ebp, [eax + edi]
jmp 0x1004f8bc
push eax
push dword [esi]
call dword [sym.imp.MSVCR110.dll_realloc]
pop ecx
pop ecx
test eax, eax
jne 0x1004f8f1
jmp 0x103b04e7
Function at 0x10054fa0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
push ebx
xor esi, esi
mov dword [ebp - 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
mov edi, dword [ebp + 0x20]
test eax, eax
je 0x100550be
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
test edi, edi
je 0x10054ff0
mov dword [edi], eax
cmp eax, 0x2733
jne 0x103abf39
cmp dword [ebp + 0x14], esi
jne 0x100550a8
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x410
test ecx, ecx
je 0x100550ac
mov eax, dword [ecx + 4]
cdq
mov dword [ebp - 0x10], 0x3e8
idiv dword [ebp - 0x10]
mov ecx, dword [ecx]
imul ecx, ecx, 0x3e8
add eax, ecx
push eax
lea eax, [ebp - 0x1c]
push 1
push eax
call sym.php5.dll_php_poll2
mov ecx, eax
add esp, 0xc
test ecx, ecx
jle 0x1005504a
movsx ecx, word [ebp - 0x16]
mov eax, dword [ebp - 8]
mov edx, 0x274c
test ecx, ecx
cmove eax, edx
mov dword [ebp - 8], eax
jle 0x100550b6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x1007
push 0xffff
push ebx
mov dword [ebp - 0x14], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x100550b1
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 8]
test edi, edi
je 0x10055099
mov dword [edi], eax
test eax, eax
jne 0x103abf66
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x100550a3
or eax, 0xffffffff
jmp 0x10055031
or esi, 0xffffffff
jmp 0x10055080
or esi, 0xffffffff
jmp 0x103abf57
mov eax, dword [ebp - 8]
jmp 0x103abf57
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x103abf4f
push 0
push 0
push eax
call sym.php5.dll_php_socket_strerror
add esp, 0xc
mov dword [esi], eax
or eax, 0xffffffff
jmp 0x100550a3
cmp dword [ebp + 0x14], 0
jne 0x10055093
jmp 0x10055080
mov edi, dword [ebp + 0x1c]
or esi, 0xffffffff
test edi, edi
je 0x100550a1
push 0
push 0
push eax
call sym.php5.dll_php_socket_strerror
add esp, 0xc
mov dword [edi], eax
jmp 0x100550a1
Function at 0x10055540
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
xor eax, eax
push ebx
push esi
push edi
cmp dword [ebp + 8], eax
je 0x1005560c
push 8
pop ecx
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push 2
mov dword [esp + 0x1c], eax
mov eax, dword [0x10649dd4]
pop edi
inc esi
xor ebx, ebx
mov dword [esp + 0x14], edi
cmp eax, 0xffffffff
je 0x10055613
test eax, eax
jne 0x1005563f
mov dword [esp + 0x14], ebx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x103ac15e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x103ac1bb
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x10055648
push ebx
lea eax, [esi + 1]
push 4
push eax
call sym.php5.dll__safe_emalloc
mov ecx, dword [ebp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, eax
add esp, 0xc
mov dword [ecx], ebx
push dword [edi + 0x10]
call sym.php5.dll__emalloc
pop ecx
mov dword [ebx], eax
push dword [edi + 0x10]
push dword [edi + 0x18]
push eax
call sub.MSVCR110.dll_memcpy
mov edi, dword [edi + 0x1c]
add esp, 0xc
lea ebx, [ebx + 4]
test edi, edi
jne 0x100555da
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
and dword [ebx], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x10055639
push eax
mov dword [0x10649dd4], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x10649dd4]
jmp 0x10055581
mov dword [0x10649dd4], esi
mov dword [esp + 0x14], edi
jmp 0x1005558d
inc esi
jmp 0x100555b5
mov esi, dword [ebp + 0x14]
mov ecx, eax
call fcn.10350b10
push eax
push str.php_network_getaddresses:_getaddrinfo_failed:__s
test esi, esi
jne 0x103ac18b
push edi
push ebx
call sym.php5.dll_php_error_docref0
add esp, 0x10
jmp 0x103ac1b4
call dword [sym.imp.MSVCR110.dll__errno]
push dword [eax]
push str.php_network_getaddresses:_getaddrinfo_failed__null_result_pointer__errno_d
push ebx
push esi
call sym.php5.dll_spprintf
push dword [esi]
push 0x1053ad10
push edi
push ebx
call sym.php5.dll_php_error_docref0
add esp, 0x20
jmp 0x103ac1b4
push str.php_network_getaddresses:_getaddrinfo_failed__null_result_pointer_
push edi
push ebx
call sym.php5.dll_php_error_docref0
add esp, 0xc
xor eax, eax
jmp 0x1005560c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x103ac1a5
jmp 0x103ac17e
Function at 0x10058220
Capabilities:
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x1505
cmp esi, 8
jb switch.0x1005828a
push edi
mov edi, esi
shr edi, 3
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 1]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 2]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 3]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 4]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 5]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 6]
imul edx, edx, 0x21
add edx, eax
movsx eax, byte [ecx + 7]
imul edx, edx, 0x21
add edx, eax
add ecx, 8
sub esi, 8
dec edi
jne 0x10058239
pop edi
jmp dword [esi*4 + 0x100582d4]
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
inc ecx
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
inc ecx
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
inc ecx
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
inc ecx
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
inc ecx
movsx eax, byte [ecx]
imul edx, edx, 0x21
add edx, eax
inc ecx
movsx ecx, byte [ecx]
imul edx, edx, 0x21
add edx, ecx
mov eax, edx
pop esi
ret
Function at 0x10058870
Capabilities:
Hash data using djb2

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebx, ecx
xor ecx, ecx
mov ebp, edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
test edi, edi
je 0x10058903
mov eax, dword [ebx + 0x30]
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x100588ba
mov esi, dword [ebx + 0x2c]
cmp dword [esi], ebp
je 0x10058972
cmp dword [esi + 8], edi
je 0x10058955
mov edx, dword [esp + 0x18]
inc ecx
add esi, 0xc
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x10058899
inc eax
mov dword [ebx + 0x30], eax
mov ecx, dword [0x10669090]
cmp eax, ecx
jg 0x10058933
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
inc eax
imul esi, esi, 0xc
push 1
push eax
push ebp
call dword [sym.php5.dll_zend_new_interned_string]
mov ecx, dword [ebx + 0x2c]
add esp, 0xc
mov dword [esi + ecx], eax
mov ecx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x18]
mov dword [ecx + esi + 4], eax
mov ecx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x1c]
mov dword [ecx + esi + 8], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea esi, [edx + 1]
mov ecx, ebp
mov edi, 0x1505
cmp esi, 8
jae case.default.0x10058912
jmp dword [esi*4 + 0x10058a0c]
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
inc ecx
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
mov ecx, dword [esp + 0x10]
jmp 0x1005888b
add ecx, 0x10
mov dword [0x10669090], ecx
imul ecx, ecx, 0xc
push 0
push ecx
push dword [ebx + 0x2c]
call sym.php5.dll__erealloc
add esp, 0xc
mov dword [ebx + 0x2c], eax
jmp 0x100588c8
cmp dword [esi + 4], edx
jne 0x100588aa
push edx
push ebp
push dword [esi]
call sub.MSVCR110.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x103766ed
cmp ebp, dword [0x106690c0]
jb 0x100589f8
push ebp
call sym.php5.dll__efree
pop ecx
mov eax, dword [esp + 0x10]
jmp 0x100588fd
mov eax, esi
shr eax, 3
mov edx, eax
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 1]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 2]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 3]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 4]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 5]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 6]
imul edi, edi, 0x21
add edi, eax
movsx eax, byte [ecx + 7]
imul edi, edi, 0x21
add edi, eax
add ecx, 8
sub esi, 8
dec edx
jne 0x10058991
mov edx, dword [esp + 0x18]
jmp switch.0x10058912
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
inc ecx
jmp case.0x10058912.1
cmp ebp, dword [0x106690bc]
jb 0x1005897a
jmp 0x10058981
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
inc ecx
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
inc ecx
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
inc ecx
movsx eax, byte [ecx]
imul edi, edi, 0x21
add edi, eax
inc ecx
jmp case.0x10058912.2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
jmp 0x100588aa
Function at 0x1005b3b0
Capabilities:
Hash data using djb2

Disassembly:
push ecx
push ecx
mov eax, dword [0x10668f3c]
push ebp
mov eax, dword [eax + 0x14]
mov ebp, ecx
mov ecx, 0x120
and eax, ecx
push esi
mov esi, edx
cmp eax, ecx
je 0x10378669
push ebx
push edi
push 0x18
call sym.php5.dll__emalloc
and dword [eax + 0x10], 0
add esi, 8
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push 0
inc eax
lea ebx, [ebp + 8]
push eax
push dword [ebx]
call dword [sym.php5.dll_zend_new_interned_string]
mov edi, eax
add esp, 0x10
cmp edi, dword [0x106690c0]
jae 0x1005b473
cmp edi, dword [0x106690bc]
jb 0x1005b473
mov ecx, dword [edi - 0x24]
push 2
push 0
push 4
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ebp + 0xc]
push ecx
inc eax
push eax
mov eax, dword [0x10668f3c]
add eax, 0x74
push edi
push eax
call sym.php5.dll__zend_hash_quick_add_or_update
add esp, 0x20
cmp eax, 0xffffffff
je 0x1037867c
cmp byte [ebx + 0xc], 3
jbe 0x1005b44c
push ebx
call sym.php5.dll__zval_dtor_func
pop ecx
mov eax, dword [0x10669044]
test eax, eax
jne 0x1005b45c
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret
push eax
call sym.php5.dll__efree
and dword [0x10669044], 0
and dword [0x10669048], 0
pop ecx
jmp 0x1005b455
mov esi, dword [ebp + 0xc]
inc esi
mov edx, edi
mov ecx, 0x1505
cmp esi, 8
jb switch.0x1005b4dd
mov eax, esi
shr eax, 3
mov ebx, eax
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 1]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 2]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 3]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 4]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 5]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 6]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 7]
imul ecx, ecx, 0x21
add ecx, eax
add edx, 8
sub esi, 8
dec ebx
jne 0x1005b48a
lea ebx, [ebp + 8]
jmp dword [esi*4 + 0x1005b52c]
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
jmp 0x1005b413
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
jmp case.0x1005b4dd.2
push str.Traits_cannot_have_constants
push 0x40
call sym.php5.dll_zend_error
pop ecx
pop ecx
jmp 0x1005b457
mov esi, dword [esp + 0x10]
test dword [esi + 0x10], 0xfffffffc
je 0x10378690
push esi
call sym.php5.dll_gc_remove_zval_from_buffer
pop ecx
push esi
call sym.php5.dll__efree
push dword [ebx]
mov eax, dword [0x10668f3c]
push dword [eax + 4]
push str.Cannot_redefine_class_constant__s::_s
push 0x40
call sym.php5.dll_zend_error
add esp, 0x14
jmp 0x1005b43f
Function at 0x10061960
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
lea esi, [ebx + 1]
mov ecx, 0x1505
cmp esi, 8
jb switch.0x100619ce
push edi
mov edi, esi
shr edi, 3
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 1]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 2]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 3]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 4]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 5]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 6]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 7]
imul ecx, ecx, 0x21
add ecx, eax
add edx, 8
sub esi, 8
dec edi
jne 0x1006197d
pop edi
jmp dword [esi*4 + 0x100619f0]
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
push ecx
push ebx
push dword [esp + 0x14]
call sym.php5.dll_zend_delete_global_variable_ex
add esp, 0xc
pop esi
pop ebx
ret
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
jmp case.0x100619ce.0
Function at 0x10064bb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
inc edi
mov ebx, edi
mov ecx, 0x1505
cmp edi, 8
jb switch.0x10064c1e
mov esi, edi
shr esi, 3
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 1]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 2]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 3]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 4]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 5]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 6]
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx + 7]
imul ecx, ecx, 0x21
add ecx, eax
add edx, 8
sub ebx, 8
dec esi
jne 0x10064bce
jmp dword [ebx*4 + 0x10064c80]
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [ebp + 0x14], edx
test eax, eax
je 0x10064c5b
mov ebx, dword [0x10669254]
cmp dword [edx + 8], eax
jne 0x10064c6d
cmp ebx, eax
jne 0x10064c6d
test edx, edx
je 0x10064c5b
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
jmp case.0x10064c1e.1
mov eax, dword [eax + 0xc]
test eax, eax
je 0x103a2679
jmp 0x103a263d
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
movsx eax, byte [edx]
imul ecx, ecx, 0x21
add ecx, eax
inc edx
jmp case.0x10064c1e.2
cmp eax, ebx
jne 0x10064c6d
lea edx, [ebp + 0x14]
push edx
push ecx
push edi
push dword [ebp + 0x10]
add eax, 0x18
push eax
call sym.php5.dll_zend_hash_quick_find
add esp, 0x14
test eax, eax
jne 0x103a2679
mov edx, dword [ebp + 0x14]
test dword [edx + 0xc], 0x400
je 0x103a2679
mov eax, dword [edx + 8]
cmp eax, dword [0x10669254]
je 0x10064c54
mov edx, esi
jmp 0x10064c54
Function at 0x10069290
Capabilities:
Hash data using djb2

Disassembly:
xor edx, edx
mov ecx, dword [esp + 4]
jmp fcn.10045ec0

Function at 0x10069570
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x10669234]
test eax, eax
je 0x1036f988
xor ecx, ecx
push 0xffffffffffffffff
push eax
mov byte [0x10668fe8], 1
mov dword [0x10668f3c], ecx
mov byte [0x10669268], cl
mov byte [0x10668fd1], cl
mov dword [0x10669434], ecx
call dword [sym.imp.MSVCR110.dll_longjmp]
int3
push dword [esp + 8]
push dword [esp + 8]
push str._s__d__:_Bailed_out_without_a_bailout_address_
push 1
call sym.php5.dll_php_module_shutdown_for_exec
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCR110.dll_exit]
int3

Function at 0x10069e00
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x106499c8]
xor eax, ebp
mov dword [ebp + 0x84], eax
mov eax, dword [0x10660658]
test eax, eax
je 0x10069e39
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.10311bec
add ebp, 0x88
leave
ret
mov edx, dword [0x10667688]
test edx, edx
jne 0x10069e70
lea eax, [ebp - 0x80]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp + eax - 0x81], 0x5c
jne 0x10069e5d
dec eax
push eax
lea eax, [ebp - 0x80]
push eax
call sym.php5.dll_zend_strndup
pop ecx
mov dword [0x10660658], eax
pop ecx
jmp 0x10069e24
mov ecx, edx
push esi
lea esi, [ecx + 1]
jmp 0x103ae3b0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x103ae3b0
sub ecx, esi
pop esi
cmp ecx, 2
jl 0x103ae3d3
cmp byte [ecx + edx - 1], 0x5c
jne 0x103ae3d3
lea eax, [ecx - 1]
push eax
jmp 0x103ae3cd
push ecx
push edx
jmp 0x10069e62
cmp ecx, 1
jl 0x10069e43
cmp byte [ecx + edx - 1], 0x5c
je 0x10069e43
jmp 0x103ae3cc

Function at 0x1006a080
Capabilities:
Hash data using djb2

Disassembly:
mov edx, 0x80
mov ecx, dword [esp + 4]
jmp fcn.10045ec0

Function at 0x1006c280
Capabilities:
Terminate process

Disassembly:
push str.bcmath:_out_of_memory__n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
int3