joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499c44
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov dword [ebp - 4], edi
call sym.stub.exe_ts_resource_ex
pop ecx
mov esi, eax
pop ecx
mov eax, dword [esi]
mov ecx, dword [sym.stub.exe_php_win32_core_globals_id]
push 1
mov eax, dword [eax + ecx*4 - 4]
pop ebx
cmp dword [eax + 4], edi
jne 0x499c81
push 0x28
push ebx
push 0x518180
call fcn.00499cef
add esp, 0xc
mov eax, dword [ebp + 8]
dec eax
je 0x499c93
sub eax, 5
je 0x499c90
push 2
jmp 0x499c92
push 4
pop ebx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push dword [ebp + 0xc]
push edi
push eax
call sym.stub.exe_vspprintf
mov eax, dword [sym.stub.exe_php_win32_core_globals_id]
mov ecx, dword [esi]
shl eax, 2
add esp, 0x10
mov ecx, dword [ecx + eax - 4]
push edi
mov ecx, dword [ecx]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [esi]
push edi
push 2
mov eax, dword [ecx + eax - 4]
push edi
push 0x7d0
push dword [ebp + 8]
push ebx
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push dword [ebp - 4]
call sym.stub.exe__efree
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a96c5
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x1505
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 4]
jae 0x4a970a
mov edx, dword [ebp - 8]
shl edx, 5
mov eax, dword [ebp - 8]
add eax, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 8]
xor eax, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x4a96db
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4b7e87
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x54faa8], eax
push 0x54fa78
push 0
push 0
push 0x4b7ec8
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push 0xffffffffffffffff
mov eax, dword [0x54faa8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebp
ret
Function at 0x4b8f74
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
imul eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x4b8fbe
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x4b8fbe
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.FATAL:__ecalloc__:__Unable_to_allocate__ld___ld_bytes_n
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x10
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp - 8]
push ecx
call sym.stub.exe__emalloc
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b8fe5
mov edx, dword [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4ba7d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
call sym.stub.exe_ts_resource_ex
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [sym.stub.exe_executor_globals_id]
mov eax, dword [ecx + edx*4 - 4]
xor ecx, ecx
mov cl, byte [eax + 0x191]
test ecx, ecx
jne 0x4ba825
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s__d__:_Bailed_out_without_a_bailout_address_
push 1
call sym.stub.exe_zend_output_debug_string
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [sym.stub.exe_compiler_globals_id]
mov ecx, dword [edx + eax*4 - 4]
mov byte [ecx + 0x17a], 1
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [sym.stub.exe_executor_globals_id]
mov edx, dword [eax + ecx*4 - 4]
mov byte [edx + 0x190], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [sym.stub.exe_compiler_globals_id]
mov eax, dword [ecx + edx*4 - 4]
mov byte [eax + 0x164], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [sym.stub.exe_executor_globals_id]
mov ecx, dword [edx + eax*4 - 4]
mov dword [ecx + 0xd4], 0
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [sym.stub.exe_executor_globals_id]
mov edx, dword [eax + ecx*4 - 4]
add edx, 0x12c
push edx
call dword [sym.imp.MSVCRT.dll_longjmp]
mov esp, ebp
pop ebp
ret
Function at 0x4c17ba
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
call sym.stub.exe_lex_scan
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4c195b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x160
je 0x4c1826
cmp dword [ebp - 0x1c], 0x165
je 0x4c180e
cmp dword [ebp - 0x1c], 0x167
je 0x4c182c
jmp 0x4c18cc
cmp dword [ebp - 0x14], 0
jne 0x4c1826
push 0x20
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov dword [ebp - 0x14], 1
mov byte [ebp - 8], 0
jmp 0x4c17cb
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [sym.stub.exe_language_scanner_globals_id]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [sym.stub.exe_language_scanner_globals_id]
mov edx, dword [eax + ecx*4 - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.stub.exe_zend_write]
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
call sym.stub.exe__efree
add esp, 4
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10]
push eax
call sym.stub.exe_lex_scan
add esp, 8
cmp eax, 0x165
je 0x4c18ac
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [sym.stub.exe_language_scanner_globals_id]
mov ecx, dword [edx + eax*4 - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [sym.stub.exe_language_scanner_globals_id]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.stub.exe_zend_write]
add esp, 8
push 1
push 0x53a998
call dword [sym.stub.exe_zend_write]
add esp, 8
mov dword [ebp - 0x14], 1
mov byte [ebp - 8], 0
jmp 0x4c17cb
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
push edx
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [sym.stub.exe_language_scanner_globals_id]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [sym.stub.exe_language_scanner_globals_id]
mov edx, dword [eax + ecx*4 - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 8]
and ecx, 0xff
cmp ecx, 3
jne 0x4c1946
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x160
je 0x4c1938
cmp dword [ebp - 0x20], 0x161
jle 0x4c193a
cmp dword [ebp - 0x20], 0x165
jle 0x4c1938
jmp 0x4c193a
jmp 0x4c1946
mov eax, dword [ebp - 0x10]
push eax
call sym.stub.exe__efree
add esp, 4
mov byte [ebp - 8], 0
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov dword [ebp - 0x14], ecx
jmp 0x4c17cb
mov esp, ebp
pop ebp
ret
Function at 0x4dded3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0x546e58
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x40
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 2
call dword [sym.imp.MSVCRT.dll_exit]
pop ebp
ret

Function at 0x4e1d20
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x54fbb0], eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
mov dword [0x54fba0], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call sym.stub.exe_tsrm_error_set
add esp, 8
mov eax, dword [ebp + 8]
mov dword [0x54fbac], eax
push 4
mov ecx, dword [0x54fbac]
push ecx
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov dword [0x54fbc4], eax
cmp dword [0x54fbc4], 0
jne 0x4e1d77
xor eax, eax
jmp 0x4e1dec
mov dword [0x54fbb8], 0
mov edx, dword [ebp + 0xc]
mov dword [0x54fbc0], edx
push 0xc
mov eax, dword [0x54fbc0]
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov dword [0x54fbc8], eax
cmp dword [0x54fbc8], 0
jne 0x4e1dc7
mov ecx, dword [0x54fbc4]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [0x54fbc4], 0
xor eax, eax
jmp 0x4e1dec
call sym.stub.exe_tsrm_mutex_alloc
mov dword [0x54fba4], eax
mov dword [0x54fbb4], 0
mov edx, dword [0x54fbb4]
mov dword [0x54fbbc], edx
mov eax, 1
pop ebp
ret
Function at 0x4e210a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x4e2154
mov eax, dword [0x54fbb0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4e214a
cmp dword [ebp + 8], 0
jne 0x4e2139
mov eax, dword [ebp - 0xc]
jmp 0x4e2229
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [edx + eax*4 - 4]
jmp 0x4e2229
call sym.stub.exe_tsrm_thread_id
mov dword [ebp - 8], eax
jmp 0x4e215c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [0x54fba4]
push eax
call sym.stub.exe_tsrm_mutex_lock
add esp, 4
mov eax, dword [ebp - 8]
xor edx, edx
div dword [0x54fbac]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
mov edx, dword [0x54fbc4]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4e21b7
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x54fbc4]
lea ecx, [eax + edx*4]
push ecx
call fcn.004e222d
add esp, 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.stub.exe_ts_resource_ex
add esp, 8
jmp 0x4e2229
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 8]
jne 0x4e21c4
jmp 0x4e2203
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0
je 0x4e21d8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x4e21fd
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
push ecx
call fcn.004e222d
add esp, 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.stub.exe_ts_resource_ex
add esp, 8
jmp 0x4e2229
cmp dword [ebp - 0xc], 0
jne 0x4e21b7
mov ecx, dword [0x54fba4]
push ecx
call sym.stub.exe_tsrm_mutex_unlock
add esp, 4
cmp dword [ebp + 8], 0
jne 0x4e221d
mov eax, dword [ebp - 0xc]
jmp 0x4e2229
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4e222d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x10
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [0x54fbb8]
shl edx, 2
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x54fbb8]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [0x54fbb0]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x54fbbc], 0
je 0x4e22af
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x54fbbc]
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4e22c1
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x54fbb8]
jge 0x4e232e
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [0x54fbc8]
mov eax, dword [edx + ecx]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [edx]
mov edx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [0x54fbc8]
cmp dword [ecx + eax + 4], 0
je 0x4e232c
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [0x54fbc8]
call dword [ecx + eax + 4]
add esp, 8
jmp 0x4e22b8
cmp dword [0x54fbb4], 0
je 0x4e234a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x54fbb4]
add esp, 8
mov edx, dword [0x54fba4]
push edx
call sym.stub.exe_tsrm_mutex_unlock
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4e235d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call sym.stub.exe_tsrm_thread_id
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [0x54fba4]
push eax
call sym.stub.exe_tsrm_mutex_lock
add esp, 4
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [0x54fbac]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
mov edx, dword [0x54fbc4]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e24ae
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0x10]
jne 0x4e2491
mov dword [ebp - 0xc], 0
jmp 0x4e23c8
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 4]
jge 0x4e240b
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [0x54fbc8]
cmp dword [ecx + eax + 8], 0
je 0x4e2409
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + edx*4]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xc
mov edx, dword [0x54fbc8]
call dword [edx + ecx + 8]
add esp, 8
jmp 0x4e23bf
mov dword [ebp - 0xc], 0
jmp 0x4e241d
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 4]
jge 0x4e243f
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + edx*4]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
jmp 0x4e2414
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
cmp dword [ebp - 4], 0
je 0x4e2462
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
jmp 0x4e2474
mov eax, dword [ebp - 8]
mov ecx, dword [0x54fbc4]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0xc]
mov dword [ecx + eax*4], edx
push 0
mov eax, dword [0x54fbb0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
jmp 0x4e24ae
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0xc], 0
je 0x4e24a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
jmp 0x4e239d
mov eax, dword [0x54fba4]
push eax
call sym.stub.exe_tsrm_mutex_unlock
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4e36e6
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [0x54fbcc]
mov edx, dword [eax + ecx*4 - 4]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [0x54fbcc]
mov ecx, dword [edx + eax*4 - 4]
mov edx, dword [ecx + 4]
add edx, 1
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call sym.stub.exe_virtual_file_ex
add esp, 0x10
mov edx, dword [ebp - 8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [0x54fbcc]
mov edx, dword [eax + ecx*4 - 4]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [0x54fbcc]
mov ecx, dword [edx + eax*4 - 4]
mov edx, dword [ecx + 4]
add edx, 1
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call sym.stub.exe_virtual_file_ex
add esp, 0x10
mov edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4e3986
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [0x54fbcc]
mov edx, dword [eax + ecx*4 - 4]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [0x54fbcc]
mov ecx, dword [edx + eax*4 - 4]
mov edx, dword [ecx + 4]
add edx, 1
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 1
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call sym.stub.exe_virtual_file_ex
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4e3a2e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [0x54fbcc]
mov edx, dword [eax + ecx*4 - 4]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [0x54fbcc]
mov ecx, dword [edx + eax*4 - 4]
mov edx, dword [ecx + 4]
add edx, 1
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [0x54fbcc]
mov eax, dword [ecx + edx*4 - 4]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call sym.stub.exe_virtual_file_ex
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll__rmdir]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4e4e21
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [0x54fc18], 0
je 0x4e4e32
jmp 0x4e4eae
cmp dword [ebp + 8], 0
je 0x4e4e50
mov dword [0x54fc20], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004e99f0
add esp, 4
jmp 0x4e4eae
push str.MYSQL_DEBUG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e4eae
mov dword [0x54fc20], 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e99f0
add esp, 4
mov edx, dword [ebp - 4]
push edx
push str.libmysql:
lea eax, [ebp - 0x54]
push eax
call fcn.004eaec0
add esp, 8
push eax
call fcn.004eaec0
add esp, 8
push 0
lea ecx, [ebp - 0x54]
push ecx
push str.Debugging_variable_MYSQL_DEBUG_used
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret 4

Function at 0x4e51f2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movsx eax, byte [0x54fbd4]
test eax, eax
jne 0x4e52bf
mov byte [0x54fbd4], 1
call fcn.004ecee0
call fcn.004e99e0
cmp dword [0x54fbd8], 0
jne 0x4e5283
mov dword [0x54fbd8], 0xcea
push 0x547f80
push str.mysql
call sub.WSOCK32.dll_getservbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4e525a
mov ecx, dword [ebp - 8]
mov dx, word [ecx + 8]
push edx
call sub.WSOCK32.dll_ntohs
and eax, 0xffff
mov dword [0x54fbd8], eax
push str.MYSQL_TCP_PORT
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e5283
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [0x54fbd8], eax
cmp dword [0x54fbdc], 0
jne 0x4e52b6
mov dword [0x54fbdc], 0x547f9c
push str.MYSQL_UNIX_PORT
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4e52b6
mov ecx, dword [ebp - 0xc]
mov dword [0x54fbdc], ecx
push 0
call fcn.004e4e21
jmp 0x4e52c4
call fcn.004ecd20
mov esp, ebp
pop ebp
ret
Function at 0x4e62b9
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_connect
pop ebp
ret

Function at 0x4e62cf
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.USER
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e62f4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4e62fb
mov dword [ebp - 8], str.ODBC
push 0x10
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004eae70
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4e6311
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x548278
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e634c
push str.Windows_NT
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4e634c
mov dword [ebp - 8], 1
jmp 0x4e6353
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4eabdf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [str.dbug]
push ecx
push str._s:_debugger_aborting_because__s_n
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x40
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x10
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ebp
ret