joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4d4120
mov eax, edx
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x18]
mov ebx, 0x104
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x10]
lea ecx, [eax + 0x230]
mov dword [ebp - 0x38], edx
lea edx, [eax + 0x30]
mov edi, edx
cmp word [edi], 0
je 0x4cda5f
cmp word [edi + 2], 0
je 0x4cda3e
cmp word [edi + 4], 0
je 0x4cda43
cmp word [edi + 6], 0
je 0x4cda48
cmp word [edi + 8], 0
je 0x4cda4d
cmp word [edi + 0xa], 0
je 0x4cda52
cmp word [edi + 0xc], 0
je 0x4cda57
cmp word [edi + 0xe], 0
je 0x4cda5c
add ebx, 0xfffffff8
add edi, 0x10
cmp ebx, 7
ja 0x4cd9be
cmp word [ecx], 0
je 0x4cda61
cmp word [eax + 0x232], 0
je 0x4cdb5a
cmp word [eax + 0x234], 0
je 0x4cdb66
cmp word [eax + 0x236], 0
mov edi, 0x104
jne 0x4cda7a
add eax, 0x236
mov ecx, eax
jmp 0x4cda61
add edi, 2
jmp 0x4cda5f
add edi, 4
jmp 0x4cda5f
add edi, 6
jmp 0x4cda5f
add edi, 8
jmp 0x4cda5f
add edi, 0xa
jmp 0x4cda5f
add edi, 0xc
jmp 0x4cda5f
add edi, 0xe
mov ecx, edi
sub ecx, edx
mov dword [ebp - 0x10], 0xffffffff
mov edi, ecx
shr edi, 1
cmp ecx, 0x20a
jae 0x4cdb72
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x48]
push edi
call fcn.004c9580
add esp, 4
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
test esi, esi
mov dword [ebp - 0x20], eax
je 0x4cdae7
js 0x4cdb83
movzx eax, byte [0x537170]
mov eax, dword [0x5371d8]
test eax, eax
jne 0x4cdabf
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4cdacf
mov dword [0x5371d8], eax
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test eax, eax
jne 0x4cdaec
mov ecx, 1
mov edx, esi
mov dword [ebp - 0x10], 0
call fcn.004d6180
jmp 0x4cdb8f
mov edi, 1
push esi
push dword [ebp - 0x38]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x30]
push ebx
call fcn.004cdc00
add esp, 4
cmp dword [ebp - 0x48], 0
movsd xmm0, qword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x28]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
je 0x4cdb49
push dword [ebp - 0x20]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
add eax, 0x232
mov ecx, eax
jmp 0x4cda61
add eax, 0x234
mov ecx, eax
jmp 0x4cda61
mov ecx, edi
mov edx, 0x104
push 0x5341f8
call fcn.004d6430
mov dword [ebp - 0x10], 0
call fcn.0041f600
ud2
Function at 0x4cf760
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5370e8]
test eax, eax
je 0x4cf788
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4cf79e
cmp dword [eax + 4], 0
mov edi, eax
je 0x4cf79e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5370e8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x4cf778
mov eax, dword [0x5370e8]
test eax, eax
je 0x4cf852
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4cf86c
mov esi, eax
test eax, eax
jne 0x4cf819
movzx eax, byte [0x537170]
mov eax, dword [0x5371d8]
test eax, eax
jne 0x4cf7e5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4cf87f
mov dword [0x5371d8], eax
push 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4cf87f
mov dword [eax], 0x5370e8
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5370e8]
test eax, eax
je 0x4cf873
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4cf783
test ecx, ecx
je 0x4cf783
lock dec dword [ecx]
jne 0x4cf783
call fcn.00426ea0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5370e8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x4cf7bc
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5370e8
call fcn.004dccd0
jmp 0x4cf811
mov ecx, 4
mov edx, 0xc
call fcn.004d6180
int3

Function at 0x4d0540
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4d41d0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x4d05be
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x533d50
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x533d7c
mov dword [esi + 0x2c], 0x4cc050
mov dword [esi + 0x3c], 1
call fcn.004d6340
ud2
Function at 0x4d0630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5370c8]
test eax, eax
je 0x4d06d4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d0653
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4d06cd
mov eax, dword [0x5370c8]
test eax, eax
je 0x4d06f3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4d070d
mov esi, eax
test eax, eax
jne 0x4d06c7
movzx eax, byte [0x537170]
mov eax, dword [0x5371d8]
test eax, eax
jne 0x4d069a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4d071f
mov dword [0x5371d8], eax
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4d071f
mov dword [eax], 0x5370c8
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5370c8]
test eax, eax
je 0x4d0713
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x5370c8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x4d064b
jmp 0x4d0653
mov ecx, 0x5370c8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x4d0671
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x5370c8
call fcn.004dccd0
jmp 0x4d06bf
mov ecx, 4
mov edx, 8
call fcn.004d6180
int3
Function at 0x4d3950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x5370d8]
test eax, eax
je 0x4d397c
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d3992
cmp dword [eax + 4], 0
mov esi, eax
je 0x4d3992
add esi, 8
mov eax, esi
add esp, 8
pop esi
ret
mov ecx, 0x5370d8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x4d396a
mov eax, dword [0x5370d8]
test eax, eax
je 0x4d3a0d
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
cmp eax, 1
jne 0x4d39b1
mov eax, esi
add esp, 8
pop esi
ret
test eax, eax
mov esi, eax
jne 0x4d3a22
movzx eax, byte [0x537170]
mov eax, dword [0x5371d8]
test eax, eax
jne 0x4d39da
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4d3a65
mov dword [0x5371d8], eax
push 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4d3a65
mov dword [eax], 0x5370d8
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5370d8]
test eax, eax
jne 0x4d3a19
mov ecx, 0x5370d8
call fcn.004dccd0
jmp 0x4d3a1a
mov ecx, 0x5370d8
call fcn.004dccd0
jmp 0x4d399c
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.004dd110
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x4d3972
test ecx, ecx
je 0x4d3972
lock dec dword [ecx]
jne 0x4d3972
lea ecx, [esp + 4]
call fcn.00426fb0
jmp 0x4d3972
mov ecx, 4
mov edx, 0xc
call fcn.004d6180
int3
Function at 0x4d3bc0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5370f8]
test eax, eax
je 0x4d3cbb
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d3bf1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4d3cb6
mov eax, dword [0x5370f8]
test eax, eax
je 0x4d3cda
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4d3cf4
mov esi, eax
test eax, eax
jne 0x4d3c77
movzx eax, byte [0x537170]
mov eax, dword [0x5371d8]
test eax, eax
jne 0x4d3c38
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4d3d0d
mov dword [0x5371d8], eax
push 0x20
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4d3d0d
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x5370f8
mov esi, eax
mov eax, dword [0x5370f8]
test eax, eax
je 0x4d3cfe
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x4d3c97
movaps xmm0, xmmword [esp]
jmp 0x4d3ca5
lea ecx, [esp + 0x10]
call fcn.004d0540
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x4d3cf6
mov ecx, 0x5370f8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x4d3be4
jmp 0x4d3bf1
mov ecx, 0x5370f8
call fcn.004dccd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x4d3c0f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x5370f8
call fcn.004dccd0
jmp 0x4d3c6f
mov ecx, 8
mov edx, 0x20
call fcn.004d6180
int3

Function at 0x4d4af4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d4b33
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d4b33
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d4b33
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d4b33
cmp dword [ecx + 0x74], 0xe
jbe 0x4d4b33
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4dbba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebp, dword [edx]
mov esi, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
lea edi, [ebp - 1]
cmp edi, 2
jae 0x4dbbcd
cmp dword [edx + 0xc], esi
jbe 0x4dbc3c
mov edx, dword [edx + 8]
cmp byte [edx + esi], 0xc0
setge dl
jmp 0x4dbc3f
mov dword [esp], ecx
mov ecx, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebx, dword [edx + 0x10]
mov dword [esp + 4], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 8], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + 0x14]
movzx edx, byte [edx + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x48], ebp
mov ebp, ecx
mov ecx, dword [esp + 4]
cmp ebp, edi
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x60], dl
jae 0x4dbc53
mov edx, dword [esp + 0x7c]
cmp ebp, esi
jbe 0x4dbce9
mov ecx, dword [esp + 8]
cmp byte [ecx + esi], 0xbf
jg 0x4dbceb
jmp 0x4dbd0b
sete dl
movzx edx, dl
mov dword [ecx], edx
mov edx, dword [esp + 0x7c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x4dbd03
mov edx, dword [esp + 0x7c]
lea ecx, [edi + 1]
mov dword [esp + 4], ecx
cmp esi, ebp
jae 0x4dbc80
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, dword [esp + 8]
cmp byte [ecx + esi], 0xc0
jl 0x4dbc82
jmp 0x4dbceb
je 0x4dbceb
inc ebx
je 0x4dbd0e
cmp dword [esp + 4], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
jb 0x4dbd2a
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x58], ebx
push eax
push dword [esp + 0x8c]
call fcn.0043bf30
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, 1
jne 0x4dbcd7
mov edx, dword [esp + 0x28]
mov esi, edx
cmp esi, ebp
jae 0x4dbc80
jmp 0x4dbc70
cmp ecx, 2
jne 0x4dbcfc
mov ecx, dword [esp]
mov dword [ecx + 4], eax
mov eax, 2
jmp 0x4dbd01
jne 0x4dbd0b
mov ecx, dword [esp]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x4dbd03
mov ecx, dword [esp]
xor eax, eax
mov dword [ecx], eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
inc ebx
jne 0x4dbd22
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs
mov edx, 0x2b
push 0x4e72fc
call fcn.004d6490
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
lea eax, [esp + 0xc]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], 0x4e30fc
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x41f5a0
mov dword [esp + 0x40], edx
lea ecx, [esp + 0x20]
mov edx, 0x4e7380
mov dword [esp + 0x44], 0x41fd60
mov dword [esp + 0x2c], 2
call fcn.004d6340
int3
Function at 0x4dbd90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, dword [edx]
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
lea edi, [esi - 1]
cmp edi, 2
jae 0x4dbdc8
cmp dword [edx + 0xc], ebx
jbe 0x4dbeb3
mov edx, dword [edx + 8]
cmp byte [edx + ebx], 0xc0
setge dl
jmp 0x4dbeb6
mov dword [esp + 0xc], ebp
mov ebp, dword [edx + 0x10]
mov edi, dword [edx + 8]
mov dword [esp], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], ebp
mov dword [esp + 4], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x50], edi
mov dword [esp + 8], edi
mov ebp, dword [edx + 0x14]
movzx edx, byte [edx + 0x18]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x48], esi
mov esi, dword [esp + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x4c], esi
mov byte [esp + 0x60], dl
lea edx, [ebp - 1]
cmp edx, ecx
jbe 0x4dbe40
cmp ecx, ebx
jbe 0x4dbec6
mov ecx, dword [esp + 8]
cmp byte [ecx + ebx], 0xbf
jg 0x4dbec8
jmp 0x4dbee0
cmp ebx, ecx
jae 0x4dbe50
mov ecx, dword [esp + 8]
cmp byte [ecx + ebx], 0xc0
jl 0x4dbe52
jmp 0x4dbec8
je 0x4dbec8
xor ebx, ebx
test ebp, ebp
je 0x4dbf61
lea esi, [ebp - 1]
cmp ebp, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
jb 0x4dbef1
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x5c], esi
push eax
push dword [esp + 0x8c]
call fcn.0043f530
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, 1
jne 0x4dbf4f
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 4]
mov ebp, esi
mov dword [esp + 0xc], ebx
jmp 0x4dbe40
sete dl
movzx edx, dl
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebp
jmp 0x4dbf66
jne 0x4dbee0
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x4dbf66
mov ecx, dword [esp]
xor ebx, ebx
test ebp, ebp
je 0x4dbf64
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
mov eax, dword [esp + 4]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], 0x4e30fc
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x3c], 0x41f5a0
mov dword [esp + 0x40], edx
mov edx, 0x4e7380
mov dword [esp + 0x44], 0x41fd60
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 2
mov dword [esp + 0x1c], eax
call fcn.004d6340
cmp ecx, 2
mov ecx, dword [esp]
jne 0x4dbf64
mov dword [ecx + 4], eax
mov ebx, 2
jmp 0x4dbf64
mov ecx, dword [esp]
mov dword [ecx], ebx
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4dccd0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4dcd41
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4dcd78
cmp dword [esp + 4], 0
je 0x4dcd5f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4dcd8b
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5371e0]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x5371e0], esi
jne 0x4dcd20
mov byte [0x5371dc], 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x4dcd6f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x4dcdcc
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4dcd63
mov edi, dword [esp]
jmp 0x4dcd6f
mov edi, dword [esi]
jmp 0x4dcd6e
mov edi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.004dce00
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x534070
mov dword [esp + 8], 0x534038
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
call fcn.004d6340
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x534038
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004dce30
int3
Function at 0x40a09b
Capabilities:
Delete service
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.RemovePoweroffService_start
call fcn.00403cd9
mov ebx, dword [ebp + 0xc]
pop ecx
cmp dword [ebx + 0x750], 1
jne 0x40a0e9
push str.Deleting_WIN98_service
call fcn.00403cd9
mov dword [esp], str.P0WER0FF
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call fcn.004064b6
add esp, 0xc
test al, al
je 0x40a10a
push 0x41b2c0
jmp 0x40a169
push str.Deleting_NT_service
call fcn.00403cd9
mov dword [esp], 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40a117
push dword [ebp + 8]
push ebx
call fcn.00403ed4
pop ecx
pop ecx
jmp 0x40a191
push 0x10000
push str.P0WER0FF
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a142
push dword [ebp + 8]
push ebx
call fcn.00403ed4
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a191
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40a158
push dword [ebp + 8]
push ebx
call fcn.00403ed4
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str.Poweroff
push dword [ebp + 8]
push ebx
call fcn.00403df2
add esp, 0xc
push str.SYSTEMCurrentControlSetServicesP0WER0FFParameters
push reloc.WSOCK32.dll_bind
call fcn.00406503
push str.RemovePoweroffService_end
call fcn.00403cd9
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a460
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push str.IsPoweroffServiceRunning_start
call fcn.00403cd9
mov eax, dword [ebp + 0xc]
pop ecx
cmp dword [eax + 0x750], 1
je 0x40a4e9
push closesocket
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40a4e9
push 4
push str.P0WER0FF
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a4b1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a4e9
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x40a4ce
call esi
push edi
call esi
jmp 0x40a4e9
call esi
push edi
call esi
cmp dword [ebp - 0x18], 4
jne 0x40a4de
push 1
pop eax
jmp 0x40a4eb
push str.IsPoweroffServiceRunning_stop
call fcn.00403cd9
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4029d5
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2002c
call fcn.00442060
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0040a567
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
push 0x7fff
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [esp + 0x13]
push eax
push dword [ebp + 8]
call fcn.00402dda
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x442c13
mov eax, dword [0x4d13f0]
test eax, eax
je 0x442c2b
xor edi, edi
mov esi, 0x4d23b0
inc edi
cmp eax, edi
je 0x442c37
lea eax, [esp + 0x11]
push eax
push ecx
push 0x4d13f0
push 0x4d1408
mov ecx, esi
call fcn.00402d86
test al, al
je 0x442c56
mov al, byte [0x4d23b0]
mov byte [0x4d13f4], al
mov al, byte [0x4d23b1]
mov byte [esp + 0x12], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1003c]
push eax
push 0x7fff
push dword [0x4d1408]
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
push dword [esp + 0x14]
mov ecx, 0x4d13e0
call fcn.004067bd
mov bl, byte [esp + 0x11]
push dword [0x4d13f0]
push 0x4d1408
call fcn.00401ce6
test eax, eax
jne 0x442c61
cmp byte [esp + 0x12], 1
je 0x442c7e
call fcn.00402b26
call fcn.00402c06
cmp byte [0x4d13f4], 0
mov ebx, 0x4d19b0
jne 0x402ae7
mov ecx, ebx
call fcn.004037eb
push edi
mov ecx, 0x4d1420
call fcn.0040b360
cmp byte [0x4d13f4], 0
jne 0x402b02
mov ecx, ebx
call fcn.00403095
mov ecx, esi
call fcn.00403ccf
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
lea ecx, [esp + 0x28]
call fcn.004092c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x10
push 0x4c5998
push str.This_is_a_third_party_compiled_AutoIt_script.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b14
or dword [0x4d134c], 0xffffffff
jmp 0x402b09
push 0xffffffffffffffff
push dword [0x4d13f8]
mov ecx, esi
push edi
call fcn.00406fb9
mov al, byte [0x4d1354]
mov byte [0x4d23b2], al
jmp 0x402aa5
mov dword [0x4d134c], edi
jmp 0x402b09
mov ecx, esi
call fcn.00403ccf
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x4d134c], edi
jmp 0x402b14
call fcn.00461742
test al, al
jne 0x402ac8
cmp byte [esp + 0x13], al
jne 0x402ac8
lea ecx, [esp + 0x28]
call fcn.00403a0e
push 0x4c2224
lea ecx, [esp + 0x1c]
call fcn.0040970d
lea ecx, [esp + 0x18]
test bl, bl
je 0x442cdb
mov edi, 0x4c59cc
push edi
call fcn.0040337a
push 0x4d1408
lea ecx, [esp + 0x1c]
call fcn.00406140
push edi
lea ecx, [esp + 0x1c]
call fcn.0040337a
push 1
jmp 0x442ce4
push dword [ebp + 8]
call fcn.0040337a
push edi
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x34]
push 0x4c59d0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x18]
call fcn.004092c6
jmp 0x402b02