joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4892ee
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
xor ebx, ebx
push esi
lea eax, [ebp - 0x4c]
push ebx
push eax
push 0x3c
push 0x1f
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [0x54e5f0], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RICHED20.DLL
call esi
test eax, eax
jne 0x489337
push str.RICHED32.DLL
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
mov dword [ebp - 0xc], 0x100
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x48944e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x54e554], eax
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0xe0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xdc], 5
jb 0x489444
cmp dword [ebp - 0xd8], 1
jb 0x489444
lea eax, [ebp - 0x26c]
push 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0048afe0
lea eax, [ebp - 0x26c]
push str..manifest
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
lea eax, [ebp - 0x168]
mov byte [ebp - 0x168], 0x88
push 0x4000
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x489444
push str.UxTheme.dll
call esi
mov edi, eax
cmp edi, ebx
je 0x489444
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenThemeData
push edi
call esi
push str.CloseThemeData
push edi
mov dword [ebp - 8], eax
call esi
push 0x535a2c
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [ebp - 8]
mov esi, eax
cmp esi, ebx
je 0x489444
mov eax, 0xfcfcfe
push eax
mov dword [0x5359bc], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push esi
mov dword [0x54e558], eax
call edi
call fcn.00487797
test eax, eax
pop edi
jne 0x489452
xor eax, eax
jmp 0x489493
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.WINMM.dll_midiOutOpen]
push dword [ebp - 4]
call dword [sym.imp.WINMM.dll_midiOutReset]
push dword [ebp - 4]
call dword [sym.imp.WINMM.dll_midiOutClose]
push ebx
push str.ibeam
push 0xc
call fcn.00489674
push ebx
push str.arrow
push 0x12
call fcn.00489674
add esp, 0x18
push 1
pop eax
pop esi
pop ebx
leave
ret
Function at 0x489b8e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x489c7b
cmp byte [edi], bl
je 0x489c7b
push 0xc
call fcn.0047f853
mov dword [esp], str..wav
push edi
mov esi, eax
call fcn.00486901
pop ecx
test eax, eax
pop ecx
je 0x489bcd
mov word [esi + 8], 1
jmp 0x489c14
push str..mid
push edi
call fcn.00486901
pop ecx
test eax, eax
pop ecx
je 0x489be6
mov word [esi + 8], 2
jmp 0x489c14
push str..midi
push edi
call fcn.00486901
pop ecx
test eax, eax
pop ecx
jne 0x489bde
push str..avi
push edi
call fcn.00486901
pop ecx
test eax, eax
pop ecx
je 0x489c10
mov word [esi + 8], 3
jmp 0x489c14
mov word [esi + 8], bx
movzx eax, word [esi + 8]
dec eax
je 0x489c49
dec eax
jne 0x489c7b
push ebx
push edi
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
test eax, eax
pop ecx
jne 0x489c7b
push edi
call sub.MSVCRT.dll_strlen
inc eax
push eax
call fcn.0047f853
push edi
push eax
mov dword [esi], eax
call sub.MSVCRT.dll_strcpy
add esp, 0x10
mov eax, esi
jmp 0x489c7d
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, ebx
je 0x489c7b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jne 0x489c82
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
call fcn.0047f853
pop ecx
mov dword [esi], eax
lea ecx, [ebp + 8]
push 0
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x489ca0
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x489c45
Function at 0x489e51
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call sub.MSVCRT.dll_strlen
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
mov dword [esp], str..phpw
push edi
lea ebx, [eax + edi - 5]
call esi
pop ecx
mov dword [ebp + 8], ebx
pop ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
cmp eax, ecx
jne 0x489f0e
lea eax, [ebp - 0x400]
push 0x3ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x489ec0
mov al, byte [eax]
cmp al, 0x6f
je 0x489f0e
cmp al, 0x4f
je 0x489f0e
cmp al, 0x63
je 0x489efa
cmp al, 0x43
je 0x489efa
cmp al, 0x77
je 0x489ed6
cmp al, 0x57
je 0x489ed6
lea eax, [ebp - 0x508]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
jne 0x489efa
lea eax, [ebp - 0x400]
push str..exe
push eax
call esi
mov byte [eax], bl
lea eax, [ebp - 0x400]
push str._win.exe
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
xor eax, eax
cmp dword [ebp + 0x10], ebx
setne al
push eax
push ebx
lea eax, [ebp - 0x400]
push edi
push eax
jmp 0x489f1c
xor eax, eax
cmp dword [ebp + 0x10], ebx
setne al
push eax
push ebx
push dword [ebp + 0xc]
push edi
push str.open
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb esi, esi
neg esi
cmp esi, ebx
jne 0x489f50
push edi
push str.Could_not_run_application__s
push 0x30
push 0x534e6c
call fcn.0047f4f4
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x489f57
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__access]
xor ebx, ebx
push edi
push ebx
push dword [ebp + 8]
call esi
pop ecx
test eax, eax
pop ecx
je 0x48a04f
mov edi, 0x103
lea eax, [ebp - 0x208]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
xor ecx, ecx
cmp byte [ebp + eax - 0x209], bl
sete cl
cmp ecx, 0x5c
je 0x489fbf
lea eax, [ebp - 0x208]
push 0x535c0c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
test eax, eax
je 0x48a03e
lea eax, [ebp - 0x208]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
xor ecx, ecx
cmp byte [ebp + eax - 0x209], bl
sete cl
cmp ecx, 0x5c
je 0x48a01e
lea eax, [ebp - 0x208]
push 0x535c0c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x48a054
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
jmp 0x48a06d
push dword [ebp + 8]
push str.File__s_was_not_found.
push 0x30
push 0x534e6c
call fcn.0047f4f4
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48a072
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0048a7b3
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x48a0c1
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x48a09e
cmp byte [edi], bl
je 0x48a09e
push edi
call fcn.0048a77c
pop ecx
jmp 0x48a0a0
xor edi, edi
push dword [ebp + 0xc]
call fcn.0048a77c
pop ecx
lea eax, [ebp + 8]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48a0c8
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
jmp 0x48a113
push dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push esi
push eax
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x48a0f2
push dword [ebp + 8]
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x48a115
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x48a111
cmp eax, 2
jbe 0x48a0ed
cmp eax, 4
je 0x48a11a
cmp eax, 7
je 0x48a0ed
mov byte [esi], bl
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0xa
push esi
push dword [esi]
call dword [sym.imp.MSVCRT.dll__ltoa]
add esp, 0xc
jmp 0x48a0ed

Function at 0x48a12a
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0048a7b3
mov edi, eax
xor ebx, ebx
cmp edi, ebx
pop ecx
jne 0x48a149
xor eax, eax
jmp 0x48a1d7
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x48a15d
cmp byte [esi], bl
je 0x48a15d
push esi
call fcn.0048a77c
pop ecx
jmp 0x48a15f
xor esi, esi
push dword [ebp + 0xc]
call fcn.0048a77c
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48a142
cmp dword [ebp + 0x1c], ebx
je 0x48a1ae
cmp dword [ebp + 0x14], ebx
jne 0x48a19d
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x48a1c1
push dword [ebp + 0x14]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp + 0x14]
push 1
jmp 0x48a1b6
lea eax, [ebp + 0x18]
push 4
push eax
push 4
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x48a142
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x490e88
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 8]
push esi
or esi, 0xffffffff
mov ecx, eax
dec eax
test ecx, ecx
je 0x490ec1
mov edx, dword [esp + 8]
push ebx
push edi
lea edi, [eax + 1]
mov ecx, 0xff
mov al, byte [edx]
mov ebx, esi
and eax, ecx
and ebx, ecx
xor eax, ebx
shr esi, 8
mov eax, dword [eax*4 + 0x5001b0]
xor esi, eax
inc edx
dec edi
jne 0x490ea5
pop edi
pop ebx
mov eax, esi
pop esi
not eax
ret

Function at 0x491686
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x200]
push dword [ebp + 8]
push 0x200
push eax
call sym.stub.exe_ap_php_vsnprintf
add esp, 0x10
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret

Function at 0x4919d5
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + eax]
mov eax, 0x811c9dc5
cmp ecx, edx
jae 0x4919fb
push esi
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
cmp ecx, edx
jb 0x4919ea
pop esi
ret
Function at 0x496afb
Capabilities:
Enumerate files on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ac
push ebx
push esi
xor esi, esi
push esi
call dword [sym.imp.MSVCRT.dll_time]
push eax
mov dword [ebp - 8], eax
call fcn.00491a69
mov eax, dword [ebp + 8]
mov ecx, dword [0x5593c4]
mov ebx, 0x104
mov eax, dword [eax]
mov eax, dword [eax + ecx*4 - 4]
push dword [eax + 0x10]
lea eax, [ebp - 0x3ac]
push str._smmcache_user
push ebx
push eax
call sym.stub.exe_ap_php_snprintf
add esp, 0x18
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x496cb3
push edi
mov edi, dword [sym.imp.MSVCRT.dll__get_osfhandle]
jmp 0x496b72
mov ebx, 0x104
mov eax, dword [ebp + 8]
mov ecx, dword [0x5593c4]
push 0x103
mov eax, dword [eax]
mov eax, dword [eax + ecx*4 - 4]
push dword [eax + 0x10]
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push ebx
lea eax, [ebp - 0x168]
push 0x535c0c
push eax
call sym.stub.exe_php_strlcat
lea eax, [ebp - 0x27c]
push ebx
push eax
lea eax, [ebp - 0x168]
push eax
call sym.stub.exe_php_strlcat
lea eax, [ebp - 0x168]
push 0x8000
push eax
call dword [sym.imp.MSVCRT.dll__open]
mov ebx, eax
add esp, 0x2c
cmp ebx, esi
jle 0x496c9a
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], esi
push eax
push esi
push 1
push esi
push esi
push ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_LockFileEx]
lea eax, [ebp - 0x64]
push 0x20
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, 0x20
jne 0x496c62
push 8
lea eax, [ebp - 0x64]
push str.MMCACHE
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x496c62
mov eax, dword [ebp - 0x4c]
cmp eax, esi
je 0x496c37
cmp eax, dword [ebp - 8]
jl 0x496c62
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
push esi
push 1
push esi
push ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
push ebx
call dword [sym.imp.MSVCRT.dll__close]
jmp 0x496c99
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push esi
push 1
push esi
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
push ebx
call dword [sym.imp.MSVCRT.dll__close]
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
pop ecx
lea eax, [ebp - 0x2a8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x496b6d
pop edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call fcn.004952a9
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x496cc9
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
push dword [0x54e640]
call sym.stub.exe_tsrm_mutex_lock
mov eax, dword [0x54e69c]
push 1
push dword [eax]
call fcn.004908af
add esp, 0xc
mov ebx, 0x428
push 0x28
pop edi
mov eax, dword [0x54e69c]
mov esi, dword [edi + eax]
test esi, esi
je 0x496d4a
mov ecx, esi
mov esi, dword [esi]
dec dword [eax + 0xc]
cmp dword [ecx + 0x20], 0
jg 0x496d23
mov eax, dword [0x54e69c]
push ecx
push dword [eax]
call fcn.004909e0
pop ecx
pop ecx
jmp 0x496d41
mov byte [ecx + 0x30], 1
mov eax, dword [0x54e69c]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
mov eax, dword [0x54e69c]
mov dword [eax + 0x20], ecx
mov eax, dword [0x54e69c]
inc dword [eax + 0x18]
mov eax, dword [0x54e69c]
test esi, esi
jne 0x496d05
and dword [edi + eax], 0
add edi, 4
cmp edi, ebx
jl 0x496cf9
mov edi, ebx
mov eax, dword [0x54e69c]
mov esi, dword [edi + eax]
test esi, esi
je 0x496d82
mov ecx, esi
mov esi, dword [esi]
dec dword [eax + 0x10]
mov eax, dword [0x54e69c]
push ecx
push dword [eax]
call fcn.004909e0
mov eax, dword [0x54e69c]
pop ecx
test esi, esi
pop ecx
jne 0x496d63
and dword [edi + eax], 0
add edi, 4
cmp edi, 0x828
jl 0x496d57
mov eax, dword [0x54e69c]
push dword [eax]
call fcn.004908e2
push dword [0x54e640]
call sym.stub.exe_tsrm_mutex_unlock
mov edi, dword [ebp + 8]
mov ecx, dword [0x5593c4]
mov esi, 0x104
mov eax, dword [edi]
mov eax, dword [eax + ecx*4 - 4]
push dword [eax + 0x10]
lea eax, [ebp - 0x348]
push str._smmcache
push esi
push eax
call sym.stub.exe_ap_php_snprintf
add esp, 0x18
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x496e58
mov eax, dword [edi]
mov ecx, dword [0x5593c4]
push 0x103
mov eax, dword [eax + ecx*4 - 4]
push dword [eax + 0x10]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push esi
lea eax, [ebp - 0x104]
push 0x535c0c
push eax
call sym.stub.exe_php_strlcat
lea eax, [ebp - 0x218]
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call sym.stub.exe_php_strlcat
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 0x28
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x496def
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x497235
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0x54e6ac
xor esi, esi
push 6
xor eax, eax
pop edx
mov edi, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
add eax, eax
movsx edi, byte [edi]
movsx edi, byte [edi + ebx]
mov ebx, dword [ebp + 0x10]
movsx ebx, byte [ebx]
xor edi, ebx
or eax, edi
inc dword [ebp + 0x10]
inc dword [ebp - 4]
dec edx
jne 0x49724f
movsx eax, byte [esi + eax + 0x538bf0]
push 4
add ecx, 4
pop edi
mov dl, al
dec ecx
and dl, 1
sar eax, 1
dec edi
mov byte [ecx], dl
jne 0x49727f
add esi, 0x40
add ecx, 4
cmp esi, 0x200
jl 0x49724a
mov eax, dword [ebp + 8]
push 0x20
mov ecx, 0x538bd0
pop esi
movsx edx, byte [ecx]
mov dl, byte [ebp + edx - 0x34]
xor byte [eax], dl
inc ecx
inc eax
dec esi
jne 0x4972a5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4972b8
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x30
push 0x538ba0
push 0x54e6ac
mov dword [ebp - 4], 0x7efc
xor esi, esi
call sub.MSVCRT.dll_memcpy
push 0x38
push str.80_
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00497209
mov eax, 0x54e6dc
mov ecx, 0x538af0
add esp, 0x1c
mov edi, eax
sub ecx, eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 4]
mov dword [ebp + 8], 0x30
and eax, 1
lea esi, [esi + eax + 1]
movsx eax, byte [ecx + edi]
cmp eax, 0x1c
jl 0x497334
add eax, esi
cmp eax, 0x38
jl 0x497343
add eax, 0xffffffe4
push 0x1c
cdq
pop ebx
idiv ebx
add edx, ebx
jmp 0x497341
add eax, esi
cmp eax, 0x1c
jl 0x497343
push 0x1c
cdq
pop ebx
idiv ebx
mov eax, edx
mov al, byte [ebp + eax - 0x40]
mov byte [edi], al
inc edi
dec dword [ebp + 8]
jne 0x497317
shr dword [ebp - 4], 1
sub ecx, 0x30
dec dword [ebp - 8]
jne 0x497306
pop edi
pop esi
pop ebx
leave
ret

Function at 0x497909
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x7e
jne 0x4979b3
mov ecx, dword [ebp + 0x14]
test byte [ecx + 0xd], 8
je 0x4979b3
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
lea esi, [eax + 2]
mov eax, edi
lea ebx, [edi + ecx*2 - 2]
cmp edi, ebx
jae 0x497953
mov cx, word [esi]
test cx, cx
je 0x497953
cmp cx, 0x2f
je 0x497953
mov byte [eax], cl
inc eax
inc esi
inc esi
cmp eax, ebx
jb 0x49793c
and byte [eax], 0
cmp byte [edi], 0
jne 0x49796d
push 0x538df0
call dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
pop ecx
jne 0x497980
jmp 0x497978
push edi
call sym.stub.exe__php_stream_sock_open_unix
test eax, eax
pop ecx
jne 0x49797d
mov eax, dword [ebp + 8]
jmp 0x4979b3
mov eax, dword [eax + 0x18]
cmp edi, ebx
mov ecx, edi
jae 0x4979ad
mov dl, byte [eax]
test dl, dl
je 0x49799a
movsx dx, dl
mov word [ecx], dx
inc ecx
inc ecx
inc eax
cmp ecx, ebx
jb 0x497986
cmp ecx, ebx
jae 0x4979ad
mov ax, word [esi]
mov word [ecx], ax
inc ecx
inc ecx
inc esi
inc esi
test ax, ax
jne 0x49799a
and word [ecx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x49970b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get hostname

Disassembly:
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x5593a0], eax
jne 0x499724
push 5
jmp 0x499791
push 0x100
push 0x5582a0
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x49973b
push 0xa
jmp 0x499791
push 0
push 0xa
push str.smtp_port
call sym.stub.exe_zend_ini_long
add esp, 0xc
test ax, ax
jne 0x499754
push 0x19
pop eax
push eax
mov word [0x5593b0], 2
call sub.WSOCK32.dll_htons
push 0x5581a0
mov word [0x5593b2], ax
call fcn.0049988a
pop ecx
mov dword [0x5593b4], eax
push 0x10
push 0x5593b0
push dword [0x5593a0]
call sub.WSOCK32.dll_connect
test eax, eax
je 0x499793
push 6
pop eax
ret
push 0
call fcn.004997da
pop ecx
ret

Function at 0x49979c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, eax
xor edi, edi
test esi, esi
jle 0x4997d4
push 0
lea eax, [edi + ebx]
push esi
push eax
push dword [0x5593a0]
call sub.WSOCK32.dll_send
cmp eax, 1
jl 0x4997cf
sub esi, eax
add edi, eax
jmp 0x4997ae
push 7
pop eax
jmp 0x4997d6
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x4997da
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
xor edi, edi
xor esi, esi
push esi
push 0xfff
push 0x54ea68
push dword [0x5593a0]
call sub.WSOCK32.dll_recv
cmp eax, 1
jl 0x499831
and byte [esi + eax + 0x54ea68], 0
add esi, eax
add edi, eax
cmp esi, 5
jl 0x49981e
cmp byte [esi + 0x54ea67], 0xa
jne 0x49981e
cmp byte [esi + 0x54ea66], 0xd
je 0x499835
mov eax, 0xfff
push 0
sub eax, esi
push eax
lea eax, [edi + 0x54ea68]
push eax
jmp 0x4997eb
push 8
jmp 0x499882
cmp byte [0x54ea68], 0x33
jle 0x499885
mov edi, dword [esp + 0xc]
test edi, edi
je 0x499880
xor ecx, ecx
cmp esi, 2
jle 0x49986f
mov al, byte [esi + 0x54ea67]
cmp al, 0xa
je 0x49985b
cmp al, 0xd
jne 0x49986f
mov al, byte [esi + 0x54ea66]
push 1
cmp al, 0xd
pop ecx
je 0x49986c
cmp al, 0xa
jne 0x49986f
push 2
pop ecx
sub esi, ecx
push esi
push 0x54ea68
call sym.stub.exe__estrndup
pop ecx
mov dword [edi], eax
pop ecx
push 9
pop eax
jmp 0x499887
xor eax, eax
pop edi
pop esi
ret

Function at 0x49988a
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
cmp byte [edi], 0
je 0x4998ca
push edi
call sub.WSOCK32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x4998ca
push str.255.255.255.255
push edi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x4998ca
push edi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4998c8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
jmp 0x4998ca
xor esi, esi
mov eax, esi
pop edi
pop esi
ret