joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a1430
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov esi, ebp
test ebp, ebp
je 0x100a14a0
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
lea esp, [esp]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov eax, dword [eax + 0x2120]
imul eax, eax, 0x3e8
push eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x20], 0x10
call sym.php5.dll_php_poll2
add esp, 0xc
test eax, eax
jle 0x100a1485
movsx eax, word [esp + 0x16]
cmp eax, 1
jl 0x100a14aa
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100a14aa
add edi, eax
sub esi, eax
jne 0x100a1450
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret

Function at 0x100a1580
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebx, 0x1000
mov ecx, dword [edi + 0x1088]
test ecx, ecx
je 0x100a15b9
push dword [edi + 0x108c]
lea eax, [edi + 0x88]
push ecx
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
mov eax, dword [edi + 0x108c]
add esp, 0xc
lea esi, [edi + 0x88]
nop
sub ebx, eax
test eax, eax
je 0x100a15d6
mov cl, byte [esi]
cmp cl, 0xd
je 0x100a163f
cmp cl, 0xa
je 0x100a162e
inc esi
dec eax
jne 0x100a15c6
mov eax, dword [edi + 0x2120]
mov ebp, dword [edi]
imul eax, eax, 0x3e8
push eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x303
xor ecx, ecx
call sym.php5.dll_php_poll2
add esp, 0xc
test eax, eax
jle 0x100a160b
movsx eax, word [esp + 0x16]
cmp eax, 1
jl 0x100a1624
push 0
push ebx
push esi
push ebp
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
jl 0x100a1624
test ebx, ebx
jne 0x100a15c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
dec eax
mov byte [esi], 0
lea ecx, [esi + 1]
mov dword [edi + 0x108c], eax
mov eax, ecx
jmp 0x100a166a
lea ecx, [esi + 1]
mov byte [esi], 0
mov dword [edi + 0x1088], ecx
cmp eax, 1
jle 0x100a165d
cmp byte [ecx], 0xa
jne 0x100a165d
inc ecx
mov dword [edi + 0x1088], ecx
dec eax
dec eax
mov dword [edi + 0x108c], eax
mov eax, dword [edi + 0x1088]
mov ecx, 0
cmove eax, ecx
mov dword [edi + 0x1088], eax
pop edi
pop esi
pop ebp
lea eax, [ecx + 1]
pop ebx
add esp, 8
ret

Function at 0x100a6bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
test ebx, ebx
je 0x100a6be7
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
movzx edx, byte [eax + ebp]
mov ecx, esi
shr ecx, 0x18
xor edx, ecx
shl esi, 8
xor esi, dword [edx*4 + 0x10472ac0]
inc eax
mov dword [edi], esi
cmp eax, ebx
jb 0x100a6bc6
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100a6bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
je 0x100a6c26
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
movzx ecx, byte [eax + ebx]
mov edx, dword [esi]
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x10472ec0]
inc eax
mov dword [esi], edx
cmp eax, edi
jb 0x100a6c05
pop esi
pop ebx
pop edi
ret

Function at 0x100a6cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
add esi, edx
mov eax, dword [edi]
cmp edx, esi
jae 0x100a6cd6
movzx ecx, byte [edx]
imul eax, eax, 0x1000193
inc edx
xor eax, ecx
cmp edx, esi
jb 0x100a6cc6
mov dword [edi], eax
pop edi
pop esi
ret

Function at 0x100a6ce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
add esi, edx
mov eax, dword [edi]
cmp edx, esi
jae 0x100a6d06
movzx ecx, byte [edx]
xor eax, ecx
inc edx
imul eax, eax, 0x1000193
cmp edx, esi
jb 0x100a6cf6
mov dword [edi], eax
pop edi
pop esi
ret

Function at 0x100a6e40
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
add ebx, esi
cmp esi, ebx
jae 0x100a6ea5
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
mov edi, edi
push 0x100
push 0x1b3
test ebp, ebp
jne 0x100a6e84
push ecx
push edi
call fcn.10312160
mov edi, eax
movzx eax, byte [esi]
mov ecx, edx
cdq
xor edi, eax
xor ecx, edx
inc esi
jmp 0x100a6e98
movzx eax, byte [esi]
cdq
xor ecx, edx
xor edi, eax
push ecx
push edi
inc esi
call fcn.10312160
mov edi, eax
mov ecx, edx
cmp esi, ebx
jb 0x100a6e60
mov eax, edi
pop edi
pop ebp
pop esi
mov edx, ecx
pop ebx
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop esi
pop ebx
ret
Function at 0x100b1050
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
xor edx, edx
test esi, esi
je 0x100b1089
push edi
mov edi, dword [esp + 0x14]
jmp 0x100b1070
movzx ecx, byte [edx + edi]
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
inc edx
xor eax, ecx
cmp edx, esi
jb 0x100b1070
pop edi
lea eax, [eax + eax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
pop esi
mov dword [ebx], ecx
pop ebx
ret

Function at 0x100b12f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov al, byte [ebp + 0x50]
lea esi, [ebx + ecx]
mov dword [esp + 0xc], esi
test al, al
je 0x100b1367
movsx edx, al
lea eax, [edx + ecx]
cmp eax, 0x10
jae 0x100b1335
push ecx
lea eax, [ebp + 0x40]
add eax, edx
push ebx
push eax
call sub.MSVCR110.dll_memcpy
mov eax, dword [esp + 0x28]
add esp, 0xc
add byte [ebp + 0x50], al
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, 0x10
sub eax, edx
push eax
lea eax, [ebp + 0x40]
add eax, edx
push ebx
push eax
call sub.MSVCR110.dll_memcpy
lea eax, [ebp + 0x40]
push eax
push ebp
call fcn.100b1b80
movsx eax, byte [ebp + 0x50]
sub ebx, eax
add esp, 0x14
add ebx, 0x10
mov dword [esp + 0x18], ebx
mov byte [ebp + 0x50], 0
lea eax, [ebx + 0x10]
cmp eax, esi
ja 0x100b1422
lea ecx, [ebp + 0x20]
mov dword [esp + 0x1c], ecx
push edi
lea ebx, [ebx]
xor al, al
mov ebp, ebx
mov esi, ecx
mov edi, 0x10
jmp 0x100b1390
mov dl, byte [ebp]
mov cl, byte [esi - 0x20]
xor cl, dl
inc ebp
mov byte [esi - 0x10], dl
mov byte [esi], cl
lea esi, [esi + 1]
dec edi
jne 0x100b1390
mov edi, dword [esp + 0x18]
xor bl, bl
lea ebx, [ebx]
mov edx, edi
mov esi, 0x30
movzx ecx, byte [edx]
movzx eax, al
inc edx
movzx eax, byte [eax + str._.C]
xor eax, ecx
mov byte [edx - 1], al
dec esi
jne 0x100b13b7
add al, bl
inc bl
cmp bl, 0x12
jb 0x100b13b0
mov dl, byte [edi + 0x3f]
mov ebx, dword [esp + 0x1c]
lea esi, [edi + 0x30]
mov edi, 0x10
movzx ecx, byte [ebx]
movzx eax, dl
xor ecx, eax
movzx eax, byte [esi]
movzx edx, byte [ecx + str._.C]
xor edx, eax
mov byte [esi], dl
lea ebx, [ebx + 1]
lea esi, [esi + 1]
dec edi
jne 0x100b13e5
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ebx, ebp
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x10]
cmp eax, esi
jbe 0x100b1380
mov ebp, dword [esp + 0x18]
pop edi
cmp ebx, esi
jae 0x100b1441
mov eax, esi
sub eax, ebx
push eax
lea eax, [ebp + 0x40]
push ebx
push eax
call sub.MSVCR110.dll_memcpy
mov eax, dword [esp + 0x18]
add esp, 0xc
sub al, bl
mov byte [ebp + 0x50], al
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100b1b80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
xor al, al
mov edi, ebp
add esi, 0x20
mov ebx, 0x10
mov dl, byte [edi]
mov cl, byte [esi - 0x20]
xor cl, dl
mov byte [esi - 0x10], dl
mov byte [esi], cl
lea edi, [edi + 1]
lea esi, [esi + 1]
dec ebx
jne 0x100b1b98
mov edi, dword [esp + 0x14]
xor bl, bl
mov edx, edi
mov esi, 0x30
lea ebx, [ebx]
movzx ecx, byte [edx]
movzx eax, al
inc edx
movzx eax, byte [eax + str._.C]
xor eax, ecx
mov byte [edx - 1], al
dec esi
jne 0x100b1bc0
add al, bl
inc bl
cmp bl, 0x12
jb 0x100b1bb3
mov dl, byte [edi + 0x3f]
lea esi, [edi + 0x30]
mov edi, 0x10
lea ebx, [ebx]
movzx ecx, byte [ebp]
movzx eax, dl
xor ecx, eax
movzx eax, byte [esi]
movzx edx, byte [ecx + str._.C]
xor edx, eax
mov byte [esi], dl
lea ebp, [ebp + 1]
lea esi, [esi + 1]
dec edi
jne 0x100b1bf0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100b3bc0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
ret
Function at 0x100b40e0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x100b4600
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
ret

Function at 0x100b4860
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
ret
Function at 0x100d3360
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x20]
lea eax, [ebx + 1]
push eax
test esi, esi
je 0x100d339f
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
test eax, eax
jne 0x100d33a7
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
add esp, 4
push edi
mov edi, dword [esp + 0x10]
mov dword [edi + 8], eax
test eax, eax
jne 0x100d33bc
pop edi
pop esi
mov eax, 8
pop ebx
ret
push ebp
mov ebp, dword [esp + 0x24]
mov dword [edi + 0xc], ebx
lea eax, [ebp + 1]
push eax
test esi, esi
je 0x100d33f9
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
test eax, eax
jne 0x100d3401
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
call sym.php5.dll__emalloc
add esp, 4
mov dword [edi + 0x10], eax
test eax, eax
jne 0x100d3434
push dword [edi + 8]
test esi, esi
je 0x100d3422
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
mov eax, 8
pop ebp
pop edi
pop esi
pop ebx
ret
call sym.php5.dll__efree
add esp, 4
mov eax, 8
pop ebp
pop edi
pop esi
pop ebx
ret
push ebx
push dword [esp + 0x1c]
mov dword [edi + 0x14], ebp
push dword [edi + 8]
call sub.MSVCR110.dll_memcpy
mov eax, dword [edi + 8]
push ebp
push dword [esp + 0x30]
mov byte [ebx + eax], 0
push dword [edi + 0x10]
call sub.MSVCR110.dll_memcpy
mov eax, dword [edi + 0x10]
mov byte [eax + ebp], 0
push dword [edi + 0x10]
push dword [edi + 8]
call sym.php5.dll_libiconv_open
add esp, 0x20
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x100d34af
push dword [edi + 0x10]
test esi, esi
je 0x100d3495
mov esi, dword [sym.imp.MSVCR110.dll_free]
call esi
push dword [edi + 8]
call esi
add esp, 8
mov eax, 6
pop ebp
pop edi
pop esi
pop ebx
ret
call sym.php5.dll__efree
push dword [edi + 8]
call sym.php5.dll__efree
add esp, 8
mov eax, 6
pop ebp
pop edi
pop esi
pop ebx
ret
pop ebp
mov dword [edi + 4], esi
mov dword [edi + 0x98], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100e1df0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
cmp byte [esp + 0x10], 0
mov al, byte [0x106621e1]
push esi
mov esi, dword [esp + 0x10]
push edi
mov byte [esp + 0xb], al
je 0x100e1e42
test al, al
lea eax, [esi + 4]
jne 0x100e1e12
mov eax, esi
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100e1e56
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
test al, al
lea eax, [esi + 4]
jne 0x100e1e4b
mov eax, esi
push eax
call sym.php5.dll__emalloc
add esp, 4
mov edi, eax
mov cl, byte [esp + 0x18]
movzx eax, cl
push eax
push edi
push esi
push str.size_lu_ptr_p_persistent_u
call fcn.100e2d40
add esp, 0x10
test edi, edi
je 0x100e1f33
cmp byte [esp + 0xb], 0
je 0x100e1f41
mov dword [edi], esi
cmp byte [sym.php5.dll_mysqlnd_globals], 0
push ebx
mov ebx, dword [sym.php5.dll_mysqlnd_global_stats]
je 0x100e1f32
test ebx, ebx
je 0x100e1f32
xor eax, eax
test cl, cl
setne al
xor edx, edx
test cl, cl
setne dl
lea eax, [eax*8 + 0x41]
mov dword [esp + 0x1c], eax
lea edx, [edx*8 + 0x42]
mov dword [esp + 0x10], edx
cmp eax, dword [ebx + 8]
je 0x100e1eff
mov eax, dword [ebx]
mov ecx, dword [esp + 0x1c]
add dword [eax + ecx*8], 1
adc dword [eax + ecx*8 + 4], 0
mov eax, dword [ebx + 4]
cmp dword [eax + ecx*4], 0
je 0x100e1eff
cmp byte [ebx + 0xc], 0
jne 0x100e1eff
push 0
push 1
push ecx
mov byte [ebx + 0xc], 1
mov eax, dword [eax + ecx*4]
push ebx
call eax
mov edx, dword [esp + 0x20]
add esp, 0x10
mov byte [ebx + 0xc], 0
cmp edx, dword [ebx + 8]
je 0x100e1f32
mov eax, dword [ebx]
add dword [eax + edx*8], esi
adc dword [eax + edx*8 + 4], 0
mov eax, dword [ebx + 4]
cmp dword [eax + edx*4], 0
je 0x100e1f32
cmp byte [ebx + 0xc], 0
jne 0x100e1f32
push 0
push esi
push edx
mov byte [ebx + 0xc], 1
mov eax, dword [eax + edx*4]
push ebx
call eax
add esp, 0x10
mov byte [ebx + 0xc], 0
pop ebx
cmp byte [esp + 0xb], 0
je 0x100e1f41
test edi, edi
je 0x100e1f41
add edi, 4
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x100e22d0
Capabilities:
Terminate process

Disassembly:
push ecx
mov dl, byte [0x106621e1]
mov ecx, dword [esp + 8]
push ebx
push esi
mov byte [esp + 0xb], dl
test dl, dl
je 0x100e22ee
test ecx, ecx
je 0x100e22ee
mov esi, dword [ecx - 4]
jmp 0x100e22f0
xor esi, esi
mov dh, byte [esp + 0x18]
mov ebx, dword [esp + 0x14]
movzx eax, dh
push eax
push ebx
push esi
push ecx
push str.ptr_p_old_size_lu_new_size_lu___persistent_u
call fcn.100e2d40
add esp, 0x14
test dh, dh
je 0x100e2353
test dl, dl
je 0x100e2320
lea eax, [ebx + 4]
test ecx, ecx
je 0x100e2322
add ecx, 0xfffffffc
jmp 0x100e2322
mov eax, ebx
push eax
push ecx
call dword [sym.imp.MSVCR110.dll_realloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100e2373
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
test dl, dl
je 0x100e2363
lea eax, [ebx + 4]
test ecx, ecx
je 0x100e2365
add ecx, 0xfffffffc
jmp 0x100e2365
mov eax, ebx
push 0
push eax
push ecx
call sym.php5.dll__erealloc
add esp, 0xc
mov esi, eax
push esi
push str.new_ptr_p
call fcn.100e2d40
add esp, 8
test esi, esi
je 0x100e2443
cmp byte [esp + 0xb], 0
je 0x100e2451
mov dword [esi], ebx
cmp byte [sym.php5.dll_mysqlnd_globals], 0
push edi
mov edi, dword [sym.php5.dll_mysqlnd_global_stats]
je 0x100e2442
test edi, edi
je 0x100e2442
mov al, byte [esp + 0x1c]
xor edx, edx
test al, al
setne dl
xor ecx, ecx
test al, al
setne cl
lea edx, [edx*8 + 0x45]
lea ecx, [ecx*8 + 0x46]
mov dword [esp + 0x1c], ecx
cmp edx, dword [edi + 8]
je 0x100e240f
mov eax, dword [edi]
add dword [eax + edx*8], 1
adc dword [eax + edx*8 + 4], 0
mov eax, dword [edi + 4]
cmp dword [eax + edx*4], 0
je 0x100e240f
cmp byte [edi + 0xc], 0
jne 0x100e240f
push 0
push 1
push edx
mov byte [edi + 0xc], 1
mov eax, dword [eax + edx*4]
push edi
call eax
mov ecx, dword [esp + 0x2c]
add esp, 0x10
mov byte [edi + 0xc], 0
cmp ecx, dword [edi + 8]
je 0x100e2442
mov eax, dword [edi]
add dword [eax + ecx*8], ebx
adc dword [eax + ecx*8 + 4], 0
mov eax, dword [edi + 4]
cmp dword [eax + ecx*4], 0
je 0x100e2442
cmp byte [edi + 0xc], 0
jne 0x100e2442
push 0
push ebx
push ecx
mov byte [edi + 0xc], 1
mov eax, dword [eax + ecx*4]
push edi
call eax
add esp, 0x10
mov byte [edi + 0xc], 0
pop edi
cmp byte [esp + 0xb], 0
je 0x100e2451
test esi, esi
je 0x100e2451
add esi, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x100e2a80
Capabilities:
Terminate process

Disassembly:
push ecx
mov al, byte [0x106621e1]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push str.ptr_p
mov byte [esp + 0x17], al
call fcn.100e2d40
mov ebx, dword [esp + 0x20]
add esp, 8
cmp byte [esp + 0x1c], 0
je 0x100e2ae4
test al, al
lea eax, [ebx + 5]
jne 0x100e2ab4
lea eax, [ebx + 1]
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100e2af9
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
test al, al
lea eax, [ebx + 5]
jne 0x100e2aee
lea eax, [ebx + 1]
push eax
call sym.php5.dll__emalloc
add esp, 4
mov edi, eax
mov al, byte [esp + 0xf]
mov edx, ebx
test al, al
je 0x100e2b0a
lea ecx, [edi + 4]
test edi, edi
jne 0x100e2b0c
mov ecx, edi
cmp byte [esi], 0
je 0x100e2b2a
sub esi, ecx
mov eax, edx
dec edx
test eax, eax
je 0x100e2b26
mov al, byte [esi + ecx]
mov byte [ecx], al
inc ecx
cmp byte [esi + ecx], 0
jne 0x100e2b13
mov al, byte [esp + 0xf]
mov byte [ecx], 0
test al, al
je 0x100e2b8a
xor ecx, ecx
cmp byte [esp + 0x1c], cl
mov dword [edi], ebx
mov esi, dword [sym.php5.dll_mysqlnd_global_stats]
setne cl
add ecx, 0x51
cmp byte [sym.php5.dll_mysqlnd_globals], 0
je 0x100e2b87
test esi, esi
je 0x100e2b87
cmp ecx, dword [esi + 8]
je 0x100e2b87
mov eax, dword [esi]
add dword [eax + ecx*8], 1
adc dword [eax + ecx*8 + 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + ecx*4], 0
je 0x100e2b87
cmp byte [esi + 0xc], 0
jne 0x100e2b87
push 0
push 1
push ecx
mov byte [esi + 0xc], 1
mov eax, dword [eax + ecx*4]
push esi
call eax
add esp, 0x10
mov byte [esi + 0xc], 0
add edi, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100e2ba0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x106621e1]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
push str.ptr_p
xor edi, edi
xor esi, esi
xor ebx, ebx
mov byte [esp + 0x1c], al
call fcn.100e2d40
add esp, 8
test edi, edi
jne 0x100e2bda
push edi
push 0x801
lea esi, [edi + 1]
mov ebx, 0x800
push edi
jmp 0x100e2bec
inc esi
cmp esi, ebx
jb 0x100e2bf6
lea ebx, [esi + 0x200]
push 0
lea eax, [ebx + 1]
push eax
push edi
call sym.php5.dll__erealloc
mov edi, eax
add esp, 0xc
movzx eax, byte [ebp]
mov byte [esi + edi - 1], al
movzx eax, byte [ebp]
inc ebp
test al, al
jne 0x100e2bc5
cmp byte [esp + 0x18], al
je 0x100e2c40
lea eax, [esi + 4]
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100e2c58
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
cmp byte [esp + 0x14], 0
lea eax, [esi + 8]
jne 0x100e2c4d
lea eax, [esi + 4]
push eax
call sym.php5.dll__emalloc
add esp, 4
mov ebx, eax
cmp byte [esp + 0x14], 0
je 0x100e2c66
lea eax, [ebx + 4]
test ebx, ebx
jne 0x100e2c68
mov eax, ebx
push esi
push edi
push eax
call sub.MSVCR110.dll_memcpy
add esp, 0xc
test ebx, ebx
je 0x100e2cd4
cmp byte [esp + 0x14], 0
je 0x100e2cd4
xor ecx, ecx
cmp byte [esp + 0x18], cl
mov dword [ebx], esi
mov esi, dword [sym.php5.dll_mysqlnd_global_stats]
setne cl
add ecx, 0x53
cmp byte [sym.php5.dll_mysqlnd_globals], 0
je 0x100e2cd4
test esi, esi
je 0x100e2cd4
cmp ecx, dword [esi + 8]
je 0x100e2cd4
mov eax, dword [esi]
add dword [eax + ecx*8], 1
adc dword [eax + ecx*8 + 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + ecx*4], 0
je 0x100e2cd4
cmp byte [esi + 0xc], 0
jne 0x100e2cd4
push 0
push 1
push ecx
mov byte [esi + 0xc], 1
mov eax, dword [eax + ecx*4]
push esi
call eax
add esp, 0x10
mov byte [esi + 0xc], 0
test edi, edi
je 0x100e2ce1
push edi
call sym.php5.dll__efree
add esp, 4
cmp byte [esp + 0x14], 0
je 0x100e2cef
test ebx, ebx
je 0x100e2cef
add ebx, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x100e2d60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x94]
push esi
mov esi, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0xc]
push eax
call sym.php5.dll_PHP_SHA1Init
push dword [esp + 0xa8]
lea eax, [esp + 0x14]
push edi
push eax
call sym.php5.dll_PHP_SHA1Update
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x7c]
push eax
call sym.php5.dll_PHP_SHA1Final
lea eax, [esp + 0x24]
push eax
call sym.php5.dll_PHP_SHA1Init
push 0x14
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x30]
push eax
call sym.php5.dll_PHP_SHA1Update
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0xa8]
push eax
call sym.php5.dll_PHP_SHA1Final
lea eax, [esp + 0x3c]
push eax
call sym.php5.dll_PHP_SHA1Init
push 0x14
lea eax, [esp + 0x44]
push ebx
push eax
call sym.php5.dll_PHP_SHA1Update
add esp, 0x40
lea eax, [esp + 0x7c]
push 0x14
push eax
lea eax, [esp + 0x14]
push eax
call sym.php5.dll_PHP_SHA1Update
lea eax, [esp + 0x18]
push eax
push esi
call sym.php5.dll_PHP_SHA1Final
lea edx, [esi + 0x14]
add esp, 0x14
cmp esi, edx
jae 0x100e2e3a
lea ecx, [esp + 0x68]
sub ecx, esi
lea ecx, [ecx]
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
cmp esi, edx
jb 0x100e2e30
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10311bec
add esp, 0x88
ret