joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4595d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x817724]
push esi
test eax, eax
mov esi, ecx
jne 0x459716
call fcn.004fb6d0
test eax, eax
je 0x459716
call fcn.00472bd0
test eax, eax
jne 0x459716
push 0x21
push str.In_order_to_use_this_function__you_need_run_PowerISO_as_administrator._Do_you_want_to_continue_
push 0x21e
mov dword [esi + 0xf44], 1
call fcn.0051faa0
add esp, 8
push eax
call fcn.004f3450
add esp, 8
cmp eax, 1
mov dword [esi + 0xf44], 0
je 0x459639
mov eax, 1
pop esi
ret 4
push 0x20000
call fcn.004f56f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x459655
mov eax, 1
pop esi
ret 4
mov eax, dword [esp + 8]
cmp eax, 0x81e4
jne 0x459667
push str._ii1__vrudisk
jmp 0x4596da
cmp eax, 0x81e5
jne 0x4596b2
push str._ii1__vwudisk
push esi
call fcn.0053f406
mov eax, dword [0x7378fc]
add esp, 8
test eax, eax
je 0x4596e3
mov ecx, dword [eax]
test ecx, ecx
je 0x4596e3
mov edx, dword [eax + 0x1324]
test edx, edx
jne 0x4596e3
push ecx
push str.___s_
push esi
call fcn.0053f454
add esp, 4
lea eax, [esi + eax*2]
push eax
call fcn.0053f7f2
add esp, 0xc
jmp 0x4596e3
cmp eax, 0x8275
jne 0x4596c0
push str._ii1__vcudisk
jmp 0x4596da
cmp eax, 0x82e2
jne 0x4596ce
push str._ii1__vdismtool
jmp 0x4596da
cmp eax, 0x827a
jne 0x4596e3
push str._ii1__vclonedrive
push esi
call fcn.0053f406
add esp, 8
push esi
call fcn.004f7710
push esi
call fcn.004f5720
mov eax, dword [0x7378fc]
add esp, 8
test eax, eax
je 0x45970e
mov ecx, dword [eax + 0x1324]
test ecx, ecx
je 0x45970e
mov eax, 1
pop esi
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop esi
ret 4
Function at 0x45a020
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x57750c
push eax
mov eax, 0x3be84
mov dword fs:[0], esp
call fcn.0053f480
mov eax, dword [0x733f14]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x3be9c], ebx
mov dword [esp + 0x14], eax
mov byte [esp + 0x3be9c], 1
call fcn.004fb5a0
cmp eax, 2
jl 0x45a29f
lea ebp, [esi + 0xf8]
push 0x73768c
mov ecx, ebp
call fcn.0055af82
mov ecx, 0xeef8
xor eax, eax
lea edi, [esp + 0x2b4]
mov word [esp + 0x28], bx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esi + 0x68]
push eax
call fcn.004e1810
mov ecx, dword [esp + 0x10]
push 0x73768c
push ecx
call fcn.0053fb55
add esp, 8
cmp eax, ebx
je 0x45a24a
lea edx, [esp + 0x10]
push edx
call fcn.004f7d50
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x45a24a
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xa8]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xac]
push 0x7c82f0
push eax
call fcn.00540068
lea ecx, [esp + 0xb4]
push ecx
call fcn.004f5c50
add esp, 0x10
cmp eax, ebx
je 0x45a11f
mov word [eax + 2], bx
jmp 0x45a139
push ebx
lea edx, [esp + 0xac]
push 5
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45a24a
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x28]
push 0x40
push eax
push edi
mov word [esp + 0x34], bx
call fcn.004f83b0
mov dx, word [edi]
lea ecx, [esp + 0x2c0]
push ecx
push edx
call fcn.00514b40
add esp, 0x14
test eax, eax
je 0x45a24a
cmp dword [esp + 0x328c], ebx
je 0x45a1a8
push 0x408
push 0x409
push 0x407
mov ecx, esi
mov dword [esi + 0x264], 1
call fcn.0055efef
push ebx
push 0x47a
mov ecx, esi
call fcn.0055f021
mov ecx, eax
call fcn.0055f2d5
cmp word [esp + 0x28], bx
je 0x45a23e
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
call fcn.0055af82
mov ecx, dword [esi + 0x264]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
call fcn.004f7ae0
add esp, 8
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0055ab58
push ecx
lea eax, [esp + 0xb0]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x3bea8], 2
call fcn.0055ae5f
lea ecx, [esp + 0x24]
mov byte [esp + 0x3bea4], 1
push ecx
call fcn.004f7b50
add esp, 0xc
push eax
mov ecx, ebp
mov byte [esp + 0x3bea0], 3
call fcn.0055af32
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3be9c], 1
call fcn.0055adeb
jmp 0x45a24a
push 0x73768c
mov ecx, ebp
call fcn.0055af82
cmp dword [esp + 0x328c], ebx
jne 0x45a292
push 1
push 0x407
mov ecx, esi
call fcn.0055f021
mov ecx, eax
call fcn.0055f2d5
push 1
push 0x408
mov ecx, esi
call fcn.0055f021
mov ecx, eax
call fcn.0055f2d5
push 1
push 0x409
mov ecx, esi
call fcn.0055f021
mov ecx, eax
call fcn.0055f2d5
mov edx, dword [esp + 0x18]
push edx
call fcn.004f5720
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x3be9c], bl
call fcn.0055adeb
lea ecx, [esp + 0x10]
mov dword [esp + 0x3be9c], 0xffffffff
call fcn.0055adeb
mov ecx, dword [esp + 0x3be94]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3be90
ret
Function at 0x45c0a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov esi, ebx
shl esi, 0xb
test eax, eax
mov dword [esp + 0x24], 0
je 0x45c103
mov ecx, dword [eax + 0x2fdc]
test ecx, ecx
je 0x45c103
push 0
push 0x800
push 0
push edi
call fcn.0053f700
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.004f57a0
mov edx, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esp + 0x24]
push 0
push ecx
push esi
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x45c119
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push esi
push ebp
push ebx
push edi
push ecx
call fcn.0050bf60
add esp, 0x18
test eax, eax
je 0x45c14d
mov edx, dword [esp + 0x24]
cmp edx, esi
jae 0x45c14d
mov ecx, edx
shr ecx, 0xb
add edi, ecx
sub ebx, ecx
shl ecx, 0xb
add ebp, ecx
test ebx, ebx
jbe 0x45c14d
cmp edx, 0x800
jae 0x45c0b0
push 0x1e
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x45cbe0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5776b1
push eax
mov eax, 0x2270
mov dword fs:[0], esp
call fcn.0053f480
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x10]
call fcn.004e3e50
push 0x73768c
lea ecx, [esp + 8]
mov dword [esp + 0x2280], 0
call fcn.0055ae5f
mov byte [esp + 0x227c], 1
call fcn.004e2d50
cmp dword [0x733bd8], 5
jne 0x45cc70
push str.Ripping...
push 0x1dd
call fcn.0051faa0
push eax
lea eax, [esp + 0x1200]
push eax
call fcn.0053f406
push str.Rip_to:
push 0x1dc
call fcn.0051faa0
add esp, 0x18
jmp 0x45cd2c
mov eax, dword [0x7378fc]
test eax, eax
je 0x45ccf2
cmp dword [eax], 0
je 0x45ccc2
push ecx
mov dword [esp + 0xc], esp
mov edx, dword [eax]
mov ecx, esp
push edx
call fcn.0055ae5f
lea eax, [esp + 0xc]
push eax
call fcn.004f7c80
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x2280], 2
call fcn.0055af32
lea ecx, [esp + 8]
mov byte [esp + 0x227c], 1
call fcn.0055adeb
mov eax, dword [0x7378fc]
test eax, eax
je 0x45ccf2
mov ecx, dword [eax + 0x3ac4]
test ecx, ecx
je 0x45ccf2
mov ecx, dword [esp + 4]
push ecx
push str.Testing__s...
push 0x4ea
call fcn.0051faa0
add esp, 8
lea edx, [esp + 0x11f8]
push eax
push edx
jmp 0x45cd12
mov eax, dword [esp + 4]
push eax
push str.Extracting__s...
push 0x4e9
call fcn.0051faa0
add esp, 8
lea ecx, [esp + 0x11f8]
push eax
push ecx
call fcn.0053f7f2
add esp, 0xc
push 0x69e75c
push 0xb4
call fcn.0051faa0
add esp, 8
push eax
lea ecx, [esp + 0x21f8]
call fcn.0055af82
add esi, 0x10
lea ecx, [esp + 0x21f4]
push esi
call fcn.0055b218
mov eax, dword [0x78a9f0]
mov dword [esp + 0x11ec], 0
test eax, eax
mov dword [esp + 0x2270], 0x45ce20
je 0x45cd79
mov edx, dword [0x7378fc]
mov eax, dword [edx + 0x1418]
mov dword [0x78b9fc], eax
lea ecx, [esp + 0xc]
call fcn.0055b97c
mov eax, dword [0x7378fc]
test eax, eax
je 0x45cdd6
mov ecx, dword [eax + 0x3ac4]
test ecx, ecx
je 0x45cdd1
mov eax, dword [0x85ac64]
test eax, eax
jne 0x45cdd1
push 0x40
push str.No_errors_found_during_test.
push 0x2d5
call fcn.0051faa0
add esp, 8
push eax
call fcn.004f3450
add esp, 8
mov ecx, 0x78caa8
call fcn.004f5e40
test eax, eax
je 0x45cdd6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004e2db0
lea ecx, [esp + 4]
mov byte [esp + 0x227c], 0
call fcn.0055adeb
lea ecx, [esp + 0xc]
mov dword [esp + 0x227c], 0xffffffff
call fcn.004e3f70
mov ecx, dword [esp + 0x2274]
pop esi
mov dword fs:[0], ecx
add esp, 0x227c
ret
Function at 0x45f040
Capabilities:
Timestomp file

Disassembly:
mov eax, dword [0x817700]
sub esp, 0x28
cmp eax, 3
jl 0x45f118
push esi
mov esi, dword [esp + 0x34]
xor eax, eax
movsx cx, byte [esi + 0xc6]
movsx dx, byte [esi + 0xc7]
mov dword [esp + 0xc], eax
add ecx, 0x76c
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
movsx cx, byte [esi + 0xc9]
mov dword [esp + 0x14], eax
mov word [esp + 0xe], dx
movsx dx, byte [esi + 0xca]
mov dword [esp + 0x18], eax
mov word [esp + 0x14], cx
movsx ax, byte [esi + 0xc8]
mov word [esp + 0x12], ax
mov word [esp + 0x16], dx
movsx ax, byte [esi + 0xcb]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push edx
mov word [esp + 0x20], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 4]
push eax
call fcn.00422c40
lea ecx, [esp + 8]
push ecx
movsx ecx, byte [esi + 0xcc]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [ecx + ecx*8]
shl edx, 2
sub eax, edx
push eax
call fcn.00422c10
add esp, 0xc
lea eax, [esp + 4]
lea ecx, [esp + 4]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x18], ecx
movsx dx, byte [eax + 0xc6]
mov dword [esp + 0x1c], ecx
add edx, 0x76c
mov dword [esp + 0x20], ecx
mov word [esp + 0x18], dx
movsx dx, byte [eax + 0xc8]
mov dword [esp + 0x24], ecx
mov word [esp + 0x1e], dx
movsx cx, byte [eax + 0xc7]
movsx dx, byte [eax + 0xca]
mov word [esp + 0x1a], cx
mov word [esp + 0x22], dx
movsx cx, byte [eax + 0xc9]
movsx ax, byte [eax + 0xcb]
mov word [esp + 0x20], cx
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
mov word [esp + 0x2c], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea edx, [esp]
lea eax, [esp]
push edx
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
add esp, 0x28
ret
Function at 0x462bb0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x577c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x733f14]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
call fcn.004f6180
mov edx, dword [esp + 0x20]
mov si, word [eax + edx*2]
cmp si, 0x44
jb 0x462c2f
cmp si, 0x5a
ja 0x462c2f
lea ecx, [esi - 0x41]
mov eax, 1
shl eax, cl
test ebx, eax
jne 0x462c2f
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.0055adeb
mov ax, si
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, 1
mov edi, 0x41
cmp di, 0x43
jbe 0x462c43
test ebx, eax
je 0x462c72
inc edi
shl eax, 1
cmp di, 0x5a
jbe 0x462c39
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.0055adeb
pop edi
pop esi
xor ax, ax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
cmp si, 0x41
je 0x462cba
cmp di, si
je 0x462cba
mov ecx, edi
and esi, 0xffff
and ecx, 0xffff
push ecx
push esi
push edx
push 0x69f664
push 0xab
call fcn.0051faa0
add esp, 8
lea edx, [esp + 0x18]
push eax
push edx
call fcn.00557b5d
mov eax, dword [esp + 0x20]
push 0x40
push eax
call fcn.004f3450
add esp, 0x1c
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.0055adeb
mov ecx, dword [esp + 0x10]
mov ax, di
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4635c0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x577d2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [0x672700]
mov cx, word [0x672704]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], cx
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x32]
mov dword [esp + 0x14], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
stosw word es:[edi], ax
call fcn.004f5d50
mov edx, dword [esp + 0x15c]
mov dword [esp + 0x154], 0
push edx
call fcn.00463570
lea eax, [esp + 0xd0]
push str.DeviceSCDEmuSCDEmuCd
push eax
call fcn.0053f7f2
lea ecx, [esp + 0xd8]
push ecx
call fcn.0053f454
add esp, 0x10
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, 0x41
mov dword [esp + 0x28], eax
mov ebp, ebx
cmp bx, 0x43
jbe 0x463729
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
test edx, eax
je 0x463729
lea eax, [esp + 0x4c]
push 0x40
lea ecx, [esp + 0x30]
push eax
push ecx
mov word [esp + 0x38], bx
call dword [0x736444]
test eax, eax
jle 0x463729
cmp eax, 0x3f
jge 0x463729
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x4c]
lea esi, [esp + 0xcc]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x463729
lea eax, [esp + 0x4c]
push eax
call fcn.0053f454
mov edx, dword [esp + 0x14]
add esp, 4
sub eax, edx
cmp eax, 1
je 0x4636d7
cmp eax, 2
jne 0x463729
mov ecx, dword [esp + 0x10]
lea edx, [esp + ecx*2 + 0x4c]
push edx
call fcn.0053f5fc
mov edi, eax
add esp, 4
test edi, edi
jl 0x463729
cmp edi, 0x17
jge 0x463729
push 0x30
call fcn.004f56f0
mov esi, eax
add esp, 4
test esi, esi
je 0x463729
push ebp
lea eax, [esi + 0xc]
push str.._c:
push eax
mov dword [esi + 0x2c], edi
call fcn.0053f7f2
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esi + 8], 0
push esi
call fcn.004f5dc0
mov ecx, dword [esp + 0x14]
inc ebx
inc ebp
shl ecx, 1
cmp bx, 0x5a
mov dword [esp + 0x14], ecx
jbe 0x463663
lea ecx, [esp + 0x18]
xor edi, edi
call fcn.004f5e40
test eax, eax
jle 0x4637a6
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.004f5e40
test eax, eax
jle 0x463793
push esi
lea ecx, [esp + 0x1c]
call fcn.004f5e00
cmp dword [eax + 0x2c], edi
jle 0x46377c
lea ecx, [esp + 0x18]
inc esi
call fcn.004f5e40
cmp esi, eax
jl 0x46375d
jmp 0x463793
mov ecx, dword [esp + 0x15c]
push eax
call fcn.004f5dc0
push esi
lea ecx, [esp + 0x1c]
call fcn.004f5ec0
inc edi
cmp edi, 0x17
jge 0x4637a6
lea ecx, [esp + 0x18]
call fcn.004f5e40
test eax, eax
jg 0x46374e
lea ecx, [esp + 0x18]
mov dword [esp + 0x154], 0xffffffff
call fcn.004f5d90
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x465870
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x577ef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.004f5d50
lea eax, [esp + 0xc]
push 1
push eax
mov dword [esp + 0x2c], 0
xor esi, esi
xor edi, edi
call fcn.00463a30
add esp, 8
lea ecx, [esp + 0xc]
call fcn.004f5e40
mov ebx, dword [esp + 0x30]
cmp ebx, eax
jge 0x465939
mov eax, dword [0x7378fc]
test eax, eax
je 0x4658dd
mov ecx, dword [eax + 0x3acc]
test ecx, ecx
jne 0x4658dd
mov dword [0x7c8af4], 1
push 0
call fcn.004f8740
mov esi, dword [esp + 0x38]
add esp, 4
test esi, esi
mov edi, eax
jne 0x46590a
mov ecx, dword [esp + 0x2c]
push 0x674154
push edi
push ecx
call fcn.004f3e60
mov esi, eax
add esp, 0xc
test esi, esi
je 0x46592a
push ebx
call fcn.00465e30
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea edx, [esp + 0x10]
push ebx
push edx
call fcn.00465820
add esp, 0xc
mov dword [0x7c8af4], 0
mov esi, 1
lea eax, [esp + 0xc]
push eax
call fcn.00463570
push edi
call fcn.004f5720
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004f5d90
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x465980
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x577f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.004f5d50
lea eax, [esp + 0x10]
xor esi, esi
push 1
push eax
mov dword [esp + 0x30], esi
xor ebp, ebp
call fcn.00463a30
add esp, 8
lea ecx, [esp + 0x10]
call fcn.004f5e40
mov edi, eax
cmp edi, esi
jle 0x465a21
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.00464170
push eax
push ebx
call fcn.004f83e0
add esp, 0x10
cmp eax, 1
je 0x4659f0
inc esi
cmp esi, edi
jl 0x4659cf
jmp 0x465a21
push esi
call fcn.00465e30
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x10]
push edx
push esi
push eax
call fcn.00465820
add esp, 0xc
test eax, eax
je 0x465a21
cmp esi, edi
jge 0x465a21
mov ebp, 1
lea ecx, [esp + 0x10]
push ecx
call fcn.00463570
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.004f5d90
mov ecx, dword [esp + 0x20]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x465b50
Capabilities:
Unmount volume via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x577f5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x324]
push esi
push edi
xor esi, esi
push ebx
mov ecx, ebp
mov dword [esp + 0x1c], esi
call fcn.004f5e00
mov edi, eax
test edi, edi
je 0x465cfe
push edi
call fcn.00463500
mov esi, eax
add esp, 4
test esi, esi
jne 0x465c38
push 0x73768c
lea ecx, [esp + 0x18]
call fcn.0055ae5f
mov dword [esp + 0x324], esi
call fcn.004fb6d0
test eax, eax
je 0x465c1f
mov eax, dword [0x69fed4]
test eax, eax
je 0x465c1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x465c1f
push esi
call fcn.004f5730
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call fcn.00463ef0
mov ecx, dword [esp + 0x24]
push 0x73768c
push ecx
call fcn.0053fb55
add esp, 0x18
test eax, eax
je 0x465c1f
push ebx
lea edx, [esp + 0x20]
push str._ii1__vunmount__d
push edx
call fcn.0053f7f2
lea eax, [esp + 0x28]
push eax
call fcn.004f7710
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x324], 0xffffffff
call fcn.0055adeb
jmp 0x465cfe
lea ecx, [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x90018
push esi
call ebx
lea edx, [esp + 0x10]
push 0
push edx
push 0
push 0
push 0
push 0
push 0x80002004
push esi
call ebx
test eax, eax
push 0
jne 0x465c89
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
push esi
call ebx
jmp 0x465cfe
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0x90020
push esi
call ebx
lea edx, [esp + 0x10]
push 0
push edx
push 0
push 0
push 0
push 0
push 0x9001c
push esi
call ebx
mov eax, dword [edi + 0x2c]
lea ecx, [esp + 0x11c]
push eax
push str.ImageName
push str._s_d
push ecx
call fcn.0053f7f2
push str.SoftwarePowerISOSCDEmu_
lea edx, [esp + 0x130]
push 0x73768c
push edx
call fcn.004f64f0
mov ax, word [edi + 0x14]
push 0
push eax
call fcn.00466ad0
add esp, 0x24
mov dword [esp + 0x18], 1
push esi
call fcn.004f5730
mov ecx, dword [esp + 0x320]
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
Function at 0x467060
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0xa48
push ebx
push esi
push edi
xor esi, esi
call fcn.00466be0
mov ebx, eax
call fcn.004f6020
mov edi, eax
cmp word [edi], si
je 0x46725f
push edi
call fcn.0053f454
push str.PWRISOVM.EXE
mov esi, eax
call fcn.0053f454
add esi, eax
lea eax, [esi + esi + 0x80]
push eax
call fcn.004f56f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x46725f
push ebp
push edi
push esi
call fcn.0053f406
push 0x66d0a8
push esi
call fcn.0053f3dc
push str.PWRISOVM.EXE
push esi
call fcn.0053f3dc
push str.__startup
push esi
call fcn.0053f3dc
add esp, 0x20
call fcn.004fb6d0
mov ebp, dword [0x73631c]
test eax, eax
je 0x46718d
mov edx, dword [0x7ca37c]
mov ecx, 0x280
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
or edx, 0x20019
push ecx
push edx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call ebp
test eax, eax
jne 0x467167
lea eax, [esp + 0x18]
lea ecx, [esp + 0x58]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.PWRISOVM.EXE
push eax
mov dword [esp + 0x30], 0x800
call dword [0x736324]
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x467160
cmp dword [esp + 0x14], 1
je 0x467167
mov word [esp + 0x58], 0
test bl, 1
je 0x46718d
lea edx, [esp + 0x58]
push esi
push edx
call fcn.0053f51d
add esp, 8
test eax, eax
je 0x46718d
push str._ii1__vset_autorun
call fcn.004f7710
add esp, 4
jmp 0x4671f6
mov ecx, dword [0x7ca37c]
lea eax, [esp + 0x10]
or ecx, 0x20006
push eax
push ecx
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call ebp
test eax, eax
jne 0x4671f6
test bl, 1
je 0x4671db
push esi
call fcn.0053f454
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push esi
push 1
push 0
push str.PWRISOVM.EXE
push eax
call dword [0x73632c]
jmp 0x4671eb
mov ecx, dword [esp + 0x10]
push str.PWRISOVM.EXE
push ecx
call dword [0x736310]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SCDEMUAPP_C2C80BFA_WNDCLASS
call dword [0x7364c4]
test bl, 1
pop ebp
je 0x46725f
test eax, eax
jne 0x46725f
mov ecx, 0xf
lea edi, [esp + 0x18]
push 0x20
push esi
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x2c], str.open
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], 1
call fcn.0053f4dd
add esp, 8
test eax, eax
je 0x467250
mov word [eax], 0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
push eax
call dword [0x736494]
push esi
call fcn.004f5720
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xa48
ret
Function at 0x467280
Capabilities:
Persist via run registry key

Disassembly:
push ecx
push ebx
push esi
push edi
xor esi, esi
call fcn.00466be0
mov ebx, eax
call fcn.004f6020
mov edi, eax
cmp word [edi], si
je 0x4672ee
push edi
call fcn.0053f454
push str.PWRISOVM.EXE
mov esi, eax
call fcn.0053f454
add esi, eax
lea eax, [esi + esi + 0x80]
push eax
call fcn.004f56f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4672ee
push edi
push esi
call fcn.0053f406
push 0x66d0a8
push esi
call fcn.0053f3dc
push str.PWRISOVM.EXE
push esi
call fcn.0053f3dc
push str.__startup
push esi
call fcn.0053f3dc
add esp, 0x20
mov edx, dword [0x7ca37c]
lea ecx, [esp + 0xc]
or edx, 0x20006
push ecx
push edx
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [0x73631c]
test eax, eax
jne 0x467349
test bl, 1
je 0x46733e
push esi
call fcn.0053f454
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.PWRISOVM.EXE
push ecx
call dword [0x73632c]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004f5720
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x46c8b0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x578526
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 8]
call fcn.00559027
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.00559027
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.00559027
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi], 0x629f90
mov dword [esi + 4], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x46c8c6
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x578526
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 8]
call fcn.00559027
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.00559027
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.00559027
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi], 0x629f90
mov dword [esi + 4], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret