joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454fbc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x455074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00454f50
test al, al
je 0x455056
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004071dc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x455056
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040712c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040712c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040725c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x45500f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45507b
lea eax, [ebp - 0x2c]
call fcn.00407090
lea eax, [ebp - 4]
call fcn.00407090
ret

Function at 0x45532c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040712c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.00454cc8
test al, al
jne 0x45538d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bca90]
mov dl, 1
mov eax, dword [0x4539a4]
call fcn.0041a890
call fcn.00405ad8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00454bf4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f0f4
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f249
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x45f212
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004047e8
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xc], 1
mov eax, esi
call fcn.0040712c
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffd
sub eax, 2
jb 0x45f197
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], 0x11
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov ecx, 0x45f264
mov dl, 1
mov eax, dword [0x45610c]
call fcn.0045a300
call fcn.00405ad8
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x5c], eax
movzx eax, word [ebp - 0x24]
mov dword [ebx + 0x58], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
mov edx, esi
mov ecx, 0
call fcn.004072dc
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x2c]
sub edx, edi
sar edx, 1
jns 0x45f1c6
adc edx, 0
inc edx
mov ecx, dword [ebp - 0x28]
call fcn.0045c734
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x50]
call fcn.004062f4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
mov edx, esi
mov ecx, 0
call fcn.004072dc
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x10]
sub edx, edi
sar edx, 1
jns 0x45f1fc
adc edx, 0
inc edx
mov ecx, dword [ebp - 0xc]
call fcn.0045c734
mov edx, dword [ebp - 0x50]
lea eax, [ebx + 0x54]
call fcn.004062f4
jmp 0x45f22e
mov dword [ebx + 0x58], 0x50
lea eax, [ebx + 0x50]
call fcn.004062a0
lea eax, [ebx + 0x54]
call fcn.004062a0
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f250
lea eax, [ebp - 0x54]
mov edx, 4
call fcn.004062c4
ret
Function at 0x45f3e4
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4d], 0
jne 0x45f52e
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x45f40b
call fcn.0041a790
push ebp
call fcn.0045f3b8
pop ecx
push eax
push ebp
call fcn.0045f38c
pop ecx
push eax
push ebp
call fcn.0045f2f0
pop ecx
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x48]
mov eax, dword [eax*4 + 0x49f4f4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x90]
call fcn.004069f0
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x60], ebx
test ebx, ebx
setne dl
xor dl, 1
mov eax, dword [ebp - 4]
call fcn.0045ef0c
xor edx, edx
push ebp
push 0x45f50b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0x6a], 0
jne 0x45f483
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x45f4a2
push 0x45ed50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
push eax
call sub.wininet.dll_InternetSetStatusCallback
cmp eax, 0xffffffff
sete dl
mov eax, dword [ebp - 4]
call fcn.0045ef0c
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.004069f0
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.004069f0
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.004069f0
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
push eax
call sub.wininet.dll_InternetConnectA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x64], ebx
test ebx, ebx
setne dl
xor dl, 1
mov eax, dword [ebp - 4]
call fcn.0045ef0c
mov eax, dword [ebp - 4]
mov byte [eax + 0x4d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45f52e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x466fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x467111
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, esi
call fcn.0046674c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004072b4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004667e4
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004667e4
lea eax, [ebx + 0x14]
mov edx, esi
call fcn.004667e4
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0046674c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x1c]
call fcn.004072b4
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0046674c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x20]
call fcn.004072b4
lea edx, [ebx + 0x24]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0046674c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x28]
call fcn.004072b4
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0046674c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x2c]
call fcn.004072b4
mov eax, esi
call fcn.00468a24
mov dword [ebx + 0x30], eax
mov eax, esi
call fcn.00468a24
mov dword [ebx + 0x34], eax
mov eax, esi
call fcn.00468a24
mov dword [ebx + 0x38], eax
mov eax, esi
call fcn.00468a24
mov dword [ebx + 0x3c], eax
mov eax, esi
call fcn.00468a24
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x44]
mov edx, esi
call fcn.00466870
mov eax, esi
call fcn.00468a24
push eax
lea eax, [ebx + 0x6c]
mov ecx, 1
mov edx, dword [0x463ff0]
call fcn.00408a78
add esp, 4
mov eax, dword [ebx + 0x6c]
call fcn.004088b0
mov edi, eax
dec edi
test edi, edi
jl 0x4670f6
inc edi
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov edx, eax
add eax, eax
add eax, eax
add eax, eax
sub eax, edx
mov edx, dword [ebx + 0x6c]
lea eax, [edx + eax*4]
mov edx, esi
call fcn.00469aac
inc dword [ebp - 4]
dec edi
jne 0x4670d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467118
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004062c4
ret
Function at 0x47040c
Capabilities:
Get session integrity level

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407088
xor eax, eax
push ebp
push 0x47058a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c26ac], 0xffffffff
je 0x470464
cmp dword [0x4c26b0], 0xffffffff
je 0x470464
cmp dword [0x4c26bc], 0
je 0x470464
cmp dword [0x4c26b4], 0
je 0x470464
cmp dword [0x4c26b8], 0
jne 0x470468
xor ebx, ebx
jmp 0x47046a
mov bl, 1
test bl, bl
jne 0x4704e8
call fcn.0044c6fc
test al, al
je 0x47056f
mov eax, dword [ebp - 4]
test eax, eax
je 0x470498
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x470498
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040648c
mov ebx, eax
test ebx, ebx
je 0x4704a3
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040712c
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, ebx
call fcn.004071dc
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0044c778
mov ebx, eax
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
test bl, bl
je 0x47056f
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x47056f
mov eax, dword [ebp - 4]
test eax, eax
je 0x470505
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x470505
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040648c
test eax, eax
je 0x47050e
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [0x4c26bc]
call fcn.00416b4c
mov eax, dword [0x4c26b4]
push eax
call sub.kernel32.dll_SetEvent
mov eax, dword [0x4c26b8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4c26ac]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call sub.kernel32.dll_WaitForMultipleObjects
test eax, eax
jne 0x47056d
lea eax, [ebp - 8]
mov edx, dword [0x4c26bc]
call fcn.0040725c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00416188
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
jmp 0x47056f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470591
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407098
ret
Function at 0x470998
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4709a0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.00407088
xor eax, eax
push ebp
push 0x470c58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040712c
push eax
call sub.kernel32.dll_DeleteFileW
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00416818
mov eax, dword [ebp - 0x24]
call fcn.0044b478
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x470be3
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x470b5f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x470b4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + 0x70]
mov eax, ebx
call fcn.004088b8
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.0047e620
mov edx, dword [ebp - 0x28]
mov ecx, ebx
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
mov edx, 0x8c4
mov eax, 0x470c78
call fcn.0046b4c4
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040756c
push 0xff00
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x42c114]
call fcn.004350d0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
mov edx, 0x8c6
mov eax, 0x470c90
call fcn.0046b4c4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4c2698]
mov ecx, dword [eax + 0x5c]
lea eax, [ebp - 0x10]
call fcn.0040756c
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00407090
mov ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00462dfc
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x470b35
cmp dword [ebp - 0x14], 0
je 0x470b15
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 1
mov edx, 0x8cb
mov eax, 0x470cb8
call fcn.0046b4c4
mov eax, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
xor ecx, ecx
mov edx, 0x8cb
mov eax, 0x470cd8
call fcn.0046b4c4
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x18]
pop ecx
call fcn.0046d700
jmp 0x470b35
lea eax, [ebp - 0x3c]
push eax
xor ecx, ecx
mov edx, 0x8cd
mov eax, 0x470d10
call fcn.0046b4c4
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
call fcn.0046d6b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470b52
mov eax, dword [ebp - 0x20]
call fcn.00405020
ret
cmp byte [ebp - 0x19], 0
je 0x470c23
mov eax, dword [ebp - 4]
call fcn.0040712c
push eax
lea eax, [ebp - 0x58]
push eax
xor ecx, ecx
mov edx, 0x8dc
mov eax, 0x470de8
call fcn.0046b4c4
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.0040756c
mov eax, dword [ebp - 0x54]
call fcn.0040712c
push eax
call sub.kernel32.dll_MoveFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470c5f
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00407098
lea eax, [ebp - 0x48]
mov edx, 0xa
call fcn.00407098
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00407098
ret
Function at 0x47e960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [esp]
call fcn.004062a0
push 0xe
push ebx
mov eax, dword [0x4bfc38]
push eax
call sub.kernel32.dll_FindResourceW
mov ebp, eax
test ebp, ebp
je 0x47eb3e
push ebp
mov eax, dword [0x4bfc38]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x47eb3e
lea edx, [ebx + 6]
sub edx, ebx
movzx eax, word [ebx + 4]
movzx ecx, ax
shl ecx, 4
add edx, ecx
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
mov dword [esp + 0xc], edx
movzx edi, ax
dec edi
test edi, edi
jl 0x47e9ee
inc edi
xor esi, esi
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
add dword [esp + 0xc], eax
inc esi
dec edi
jne 0x47e9d8
mov eax, dword [esp]
xor ecx, ecx
mov edx, dword [esp + 0xc]
call fcn.00406c64
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
lea eax, [ebx + 6]
sub eax, ebx
mov dword [esp + 8], eax
movzx edi, word [ebx + 4]
dec edi
test edi, edi
jl 0x47eb29
inc edi
xor esi, esi
push 3
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
movzx eax, word [ebx + eax*2 + 0x12]
push eax
mov eax, dword [0x4bfc38]
push eax
call sub.kernel32.dll_FindResourceW
mov ebp, eax
test ebp, ebp
je 0x47eb0f
push ebp
mov eax, dword [0x4bfc38]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [esp + 0x14], eax
push ebp
mov eax, dword [0x4bfc38]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_LockResource
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x47eb05
lea edx, [esp + 0x18]
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
lea eax, [ebx + eax*2 + 6]
mov ecx, 0xe
call fcn.00404350
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp]
call fcn.00406a68
mov edx, esi
shl edx, 4
add edx, dword [esp + 8]
lea edx, [eax + edx]
lea eax, [esp + 0x18]
mov ecx, 0x10
call fcn.00404350
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
cmp eax, dword [esp + 0x14]
jae 0x47eae9
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
call fcn.00406a68
mov edx, dword [esp + 0xc]
lea edx, [eax + edx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
call fcn.00404350
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_FreeResource
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
add dword [esp + 0xc], eax
inc esi
dec edi
jne 0x47ea1d
mov eax, dword [esp]
call fcn.00406a68
mov edx, eax
mov eax, ebx
mov ecx, dword [esp + 8]
call fcn.00404350
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48a9e4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48aa82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x104
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x48aa9c
mov edx, ebx
call fcn.0040756c
mov eax, dword [ebp - 0x10]
call fcn.0040712c
push eax
call sub.kernel32.dll_GetVolumeInformationW
push esi
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x741
mov eax, 0x48aaac
call fcn.00487008
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
call fcn.00416ea8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aa89
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407098
ret

Function at 0x48fd6c
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x48fe95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x44]
mov dl, 2
call fcn.0040d578
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov ebx, eax
lea edx, [ebp - 4]
mov eax, 7
call fcn.0044d254
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040e5f0
mov eax, 0x10
call fcn.004874cc
push eax
mov eax, ebx
call fcn.0040f090
mov edx, 4
pop ecx
call fcn.0040c088
mov eax, dword [ebx + 0x30]
call fcn.0040f198
mov edx, eax
mov eax, ebx
call fcn.0040eb18
mov eax, 0x18
call fcn.004874b8
mov edx, eax
mov eax, ebx
call fcn.0040eb5c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x44]
mov dl, 2
call fcn.0040d578
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov ebx, eax
mov eax, 0xc
call fcn.004874cc
push eax
mov eax, ebx
call fcn.0040f090
mov edx, 4
pop ecx
call fcn.0040c088
mov eax, 0x120
call fcn.004874a4
mov edx, eax
mov eax, ebx
call fcn.0040eb18
mov eax, 0x18
call fcn.004874b8
mov edx, eax
mov eax, ebx
call fcn.0040eac8
mov eax, dword [ebx + 0x30]
call fcn.0040f198
push eax
mov eax, ebx
call fcn.0040eab0
pop edx
sub edx, eax
mov eax, ebx
call fcn.0040eb5c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fe9c
lea eax, [ebp - 4]
call fcn.00407090
ret
Function at 0x48fea0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49008f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4900a8
mov edx, 0x4900b8
mov eax, dword [0x4c26e0]
call fcn.00474460
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x60]
push eax
call sub.user32.dll_ShowWindow
push 0x4900e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x60]
push eax
call sub.user32.dll_SetWindowTextW
lea edx, [ebp - 4]
mov eax, 0x18
call fcn.0044d254
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040cec4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ebx, eax
mov eax, 2
call fcn.004874b8
mov edx, eax
mov eax, ebx
call fcn.0040eac8
mov dl, 1
mov eax, ebx
call fcn.0040f4e8
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
mov edx, dword [0x486c14]
xor eax, eax
call fcn.00488b98
mov esi, eax
mov dword [ebx + 0xee], esi
mov eax, esi
xor ecx, ecx
mov edx, 0xf
call fcn.00488c10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
push 0x48a778
mov eax, ebx
call fcn.0040f790
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
push 0x48f940
mov eax, ebx
call fcn.0040f034
mov eax, dword [esi + 0x38]
mov edx, dword [eax + 0x18]
mov eax, ebx
call fcn.0040eb18
mov eax, dword [esi + 0x38]
mov edx, dword [eax + 0x1c]
shr edx, 3
mov eax, ebx
call fcn.0040eb5c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040cf54
mov ebx, eax
mov eax, 2
call fcn.004874b8
mov edx, eax
mov eax, ebx
call fcn.0040eac8
mov eax, dword [ebp - 8]
call fcn.0040ea64
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.0040eafc
add esi, eax
mov eax, 8
call fcn.004874a4
add esi, eax
mov edx, esi
mov eax, ebx
call fcn.0040ea7c
mov eax, dword [ebx + 0x30]
call fcn.0040f198
push eax
mov eax, ebx
call fcn.0040ea64
pop edx
sub edx, eax
mov eax, ebx
call fcn.0040eb18
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, 1
mov eax, ebx
call fcn.0040fde8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c]
test eax, eax
je 0x490054
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
cmp dword [eax + 0xee], 0
je 0x490054
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov edx, dword [edx + 0x8c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 8]
mov eax, dword [eax + 0xee]
mov dword [eax + 0x38], edx
lea edx, [ebp - 4]
mov eax, 0x19
call fcn.0044d254
mov eax, dword [ebp - 4]
call fcn.0040712c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x58]
push eax
call sub.user32.dll_SetWindowTextW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490096
lea eax, [ebp - 4]
call fcn.00407090
ret
Function at 0x4925ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebp, edx
mov ebx, eax
push 0
call sub.kernel32.dll_GetModuleHandleW_3
mov esi, eax
push 0
push ebp
mov eax, dword [esp + 8]
push eax
push esi
call sub.kernel32.dll_FindResourceExW_1
mov edi, eax
mov dword [ebx + 0xc], edi
test edi, edi
je 0x4925fe
push edi
push esi
call sub.kernel32.dll_LoadResource
mov ebp, eax
mov dword [ebx + 0x10], ebp
test ebp, ebp
je 0x4925fe
push ebp
call sub.kernel32.dll_LockResource
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0xc]
push eax
push esi
call sub.kernel32.dll_SizeofResource
mov dword [ebx + 0x20], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44af80
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x4d2398
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44afe5
mov edx, dword [0x4d19b8]
push 0x4d16bc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalIsoBuster_1102_2
push 0
lea eax, [esp + 0x18]
push 1
push eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
mov dword [0x4d19b4], eax
pop esi
add esp, 0x14
ret