joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422be0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422d3a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x422c45
call fcn.00425100
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x422cc8
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
nop
cmp rdi, 0x3f
jae 0x422d2c
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
nop dword [rax + rax]
cmp r9d, ebx
ja 0x422d1b
cmp rsi, 0x3f
jne 0x422ccb
mov qword [rsp + 0x10], rdx
call fcn.00425100
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x422ccb
mov r8, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x422d0e
lea rsi, [rbx + 1]
mov qword [rdx + 0x10], rsi
shl rbx, 5
mov rsi, qword [rax + 0x100]
sub r8, rsi
mov dword [rdx + rbx + 0x20], r8d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00462280
lea rax, [0x005b6066]
mov ebx, 0x29
call fcn.00435b40
mov rax, rdi
mov ecx, 0x3f
call fcn.00462280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00422be0
Function at 0x423060
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4231e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
cmp dword [0x0072b3f0], ebx
je 0x423090
jmp 0x4231cf
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x4231be
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42308d
nop
cmp edx, 0x80000000
jne 0x4231b4
cmp dword [0x007594f0], 0
jle 0x4231aa
mov rax, qword [0x0072b418]
mov qword [rsp + 0x10], rax
mov rcx, qword [0x00759a38]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x0072b428]
mov qword [rsp + 0x20], rdx
movsd xmm0, qword [0x0072b430]
movsd qword [rsp + 0x18], xmm0
call fcn.004372e0
lea rax, [0x005b34e9]
mov ebx, 0x1f
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005ad50e]
mov ebx, 0xe
nop
call fcn.00437be0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rax, rcx
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005b04c4]
mov ebx, 0x17
call fcn.00437be0
mov rax, qword [rsp + 0x10]
call fcn.004378e0
lea rax, [0x005ac3ae]
mov ebx, 0xa
call fcn.00437be0
movsd xmm0, qword [rsp + 0x18]
call fcn.004375e0
lea rax, [0x005acc39]
mov ebx, 0xc
nop
call fcn.00437be0
call fcn.00437360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x005b48d6]
mov ebx, 0x23
call fcn.00435b40
lea rax, [0x005b7c3c]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00423060
Function at 0x4235a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4237ea
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
nop
mov ecx, dword [0x007051bc]
mov eax, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x4235f9
lea edx, [rax + 1]
lea rbx, [0x007051bc]
lock cmpxchg dword [rbx], edx
sete dl
test dl, dl
je 0x4235c7
mov edx, dword [0x0072b3f0]
test ecx, ecx
jmp 0x423606
mov edx, dword [0x0072b3f0]
lea rbx, [0x007051bc]
mov dword [rsp + 0x20], edx
sete byte [rsp + 0x24]
je 0x423631
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
dec dword [rcx + 0xd8]
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0071b2c0]
call fcn.00422ea0
nop dword [rax]
test rax, rax
je 0x4236b1
mov cl, byte [rax + 0x63]
cmp cl, 1
je 0x423665
mov edx, dword [rax + 0x58]
mov ebx, dword [rsp + 0x20]
cmp ebx, edx
je 0x423631
lea esi, [rbx + 3]
cmp edx, esi
je 0x423631
nop
jmp 0x423769
mov rbx, rax
lea rax, [rsp + 0x20]
call fcn.004234a0
mov qword [rsp + 0x28], rax
test bl, bl
je 0x423631
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x28]
xor ebx, ebx
call fcn.00423960
test al, al
je 0x4236ab
nop
mov rcx, qword [rsp + 0x30]
lea rdx, [0x0072b448]
mov rsi, rcx
lock xadd qword [rdx], rcx
jmp 0x4236ad
xor esi, esi
xor edx, edx
jmp 0x4236f1
nop
mov edx, dword [0x007051bc]
mov eax, edx
and edx, 0x80000000
test edx, edx
jne 0x4236e7
mov esi, eax
bts eax, 0x1f
mov ecx, eax
mov eax, esi
lea rdi, [0x007051bc]
lock cmpxchg dword [rdi], ecx
sete sil
nop dword [rax]
test sil, sil
je 0x4236b1
test edx, edx
sete dl
mov rsi, 0xffffffffffffffff
mov byte [rsp + 0x16], dl
mov qword [rsp + 0x30], rsi
mov ebx, dword [rsp + 0x20]
movzx ecx, byte [rsp + 0x24]
lea rax, [0x007051bc]
call fcn.00423060
movzx edx, byte [rsp + 0x16]
test dl, dl
je 0x42374b
lea rax, [0x005c5e58]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
nop
mov eax, 1
lea rcx, [0x00705180]
xchg dword [rcx], eax
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
dec dword [rcx + 0xd8]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov byte [rsp + 0x17], cl
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], ebx
call fcn.004372e0
lea rax, [0x005b1a0c]
mov ebx, 0x1a
call fcn.00437be0
movzx eax, byte [rsp + 0x17]
movzx eax, al
call fcn.004378e0
lea rax, [0x005acc5d]
mov ebx, 0xc
call fcn.00437be0
mov eax, dword [rsp + 0x1c]
call fcn.004378e0
lea rax, [0x005ac3fe]
mov ebx, 0xa
nop
call fcn.00437be0
mov eax, dword [rsp + 0x18]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b34ca]
mov ebx, 0x1f
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.004235a0
Function at 0x423800
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423949
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x42383a
cmp dword [rcx + 0xc0], 0
jne 0x42383a
mov rdx, r14
cmp qword [rcx], rdx
jne 0x423937
jmp 0x42383f
mov rax, rbx
nop
mov ecx, dword [0x007051bc]
mov edx, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x423876
lea esi, [rdx + 1]
mov rbx, rax
mov eax, edx
lea rdi, [0x007051bc]
lock cmpxchg dword [rdi], esi
sete dl
test dl, dl
je 0x42383c
mov edx, dword [0x0072b3f0]
test ecx, ecx
jmp 0x42387f
mov edx, dword [0x0072b3f0]
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
sete byte [rsp + 0x14]
jne 0x42391b
lea rax, [rsp + 0x10]
call fcn.004234a0
mov qword [rsp + 0x18], rax
test bl, bl
jne 0x4238c2
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x007051bc]
call fcn.00423060
mov rbx, qword [rsp + 0x20]
jmp 0x42391b
lea rax, [rsp + 0x18]
xor ebx, ebx
call fcn.00423960
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x007051bc]
nop
call fcn.00423060
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005c5e60]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbx, rax
mov eax, dword [rbx + 0x58]
mov ecx, dword [rsp + 0x10]
cmp eax, ecx
je 0x42392d
add ecx, 3
cmp eax, ecx
jne 0x4238ef
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005b4443]
mov ebx, 0x22
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.00423800
Function at 0x4255a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42568c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x00705610]
call fcn.0040b700
cmp qword [0x007055c0], 0
jne 0x42567a
mov qword [0x007055c8], 0
mov rcx, qword [0x00705628]
test rcx, rcx
jne 0x425610
nop
nop
lea rax, [0x00705610]
call fcn.0040b920
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rdx, [0x00705618]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x425602
mov rcx, qword [0x00705618]
nop dword [rax]
test rcx, rcx
je 0x425651
mov rdx, qword [0x00705630]
mov qword [rdx], rcx
mov rcx, qword [0x00705618]
mov rdx, qword [0x00705630]
mov qword [rcx + 8], rdx
mov rcx, qword [0x00705628]
mov qword [0x00705618], rcx
jmp 0x42566d
mov rcx, qword [0x00705630]
mov rdx, qword [0x00705628]
mov qword [0x00705618], rdx
mov qword [0x00705620], rcx
movups xmmword [0x00705628], xmm15
jmp 0x4255ea
lea rax, [0x005b5bd2]
mov ebx, 0x28
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.004255a0

Function at 0x426440
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42647b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x426469
xor edi, edi
call fcn.00426800
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005b89b1]
mov ebx, 0x3c
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00464340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00426440

Function at 0x4265a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4266ba
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
xor edx, edx
jmp 0x4265d3
sub r12, rbx
lea rbx, [r12 + r9]
shr r12, 0xd
sub r11, r12
mov rax, rcx
mov rcx, r11
mov edx, r10d
test rcx, rcx
jbe 0x426659
test byte [rax], al
nop
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
cmp rdi, 0x40
jae 0x4266ac
mov rdi, qword [rax + rdi*8 + 0x10190]
test byte [rdi], al
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x210c8]
mov r9, rbx
and ebx, 0x3fffff
cmp r8, rbx
seta r10b
mov r11, rcx
shl rcx, 0xd
lea r12, [rcx + rbx]
or r10d, edx
nop
cmp r12, 0x400000
jbe 0x42666b
mov r12d, 0x400000
jmp 0x42666b
mov rcx, rax
jmp 0x4265bc
mov eax, edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rcx
mov r8, rdx
cmp r12, r8
jbe 0x426651
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x210c8], r12
sete dl
test dl, dl
jne 0x4265bc
mov rdx, qword [rdi + 0x210c8]
cmp rdx, r12
ja 0x426665
cmp rdx, rbx
jbe 0x426665
lea rax, [0x005b7e95]
mov ebx, 0x33
call fcn.00435b40
mov rax, rdi
mov ecx, 0x40
call fcn.004622a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004265a0
Function at 0x426e60
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4270f1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
test byte [rax], al
add rbx, 0x1ff
and rbx, 0xfffffffffffffe00
shl rbx, 0xd
mov rdx, qword [rax + 0x10420]
lea rsi, [rbx + rdx]
mov rdi, qword [0x00759180]
lea r8, [rdi + rsi]
lea r8, [r8 - 1]
neg rdi
and rdi, r8
cmp qword [rax + 0x10428], rdi
jb 0x426ec9
nop word [rax + rax]
cmp rdx, rsi
jbe 0x427049
mov qword [rsp + 0x40], rbx
call fcn.0040c3c0
test rax, rax
je 0x426fd6
mov rdx, rax
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsi + 0x10428]
cmp rax, rdi
jne 0x426f05
lea rdx, [rax + rbx]
mov qword [rsi + 0x10428], rdx
xor eax, eax
nop dword [rax]
jmp 0x426fb0
mov rax, qword [rsi + 0x10420]
sub rdi, rax
test rdi, rdi
jne 0x426f1b
xor eax, eax
jmp 0x426f9b
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov rbx, rdi
lea rcx, [0x0075ad90]
call fcn.00417b20
mov rdx, qword [rsp + 0x28]
lea rsi, [0x0075ada0]
lock xadd qword [rsi], rdx
lea rax, [0x0075c4a8]
call fcn.0042e7c0
mov rdx, qword [rsp + 0x28]
lock xadd qword [rax + 8], rdx
lea rax, [0x0075c4a8]
call fcn.0042e8a0
mov rdx, qword [rsp + 0x60]
lea rax, [rdx + 8]
mov rbx, qword [rdx + 0x10420]
mov rcx, qword [rsp + 0x28]
call fcn.00428840
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x28]
mov rdi, rdx
mov qword [rsi + 0x10420], rdx
lea rdx, [rdi + rbx]
mov qword [rsi + 0x10428], rdx
mov rdi, qword [0x00759180]
mov rdx, qword [rsi + 0x10420]
mov r8, qword [rsp + 0x40]
add rdx, r8
lea rdx, [rdi + rdx]
lea rdx, [rdx - 1]
neg rdi
and rdi, rdx
jmp 0x42704e
mov rax, qword [0x0075ad90]
mov qword [rsp + 0x38], rax
call fcn.004372e0
lea rax, [0x005b5e02]
mov ebx, 0x28
call fcn.00437be0
mov rax, qword [rsp + 0x40]
nop dword [rax]
call fcn.004378e0
lea rax, [0x005ad16b]
mov ebx, 0xd
call fcn.00437be0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005ac053]
mov ebx, 9
call fcn.00437be0
call fcn.00437360
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov rdx, qword [rsi + 0x10420]
mov qword [rsp + 0x18], rdx
mov qword [rsi + 0x10420], rdi
mov r8, rdx
sub rdi, r8
mov qword [rsp + 0x40], rdi
mov rbx, rdi
lea rcx, [0x0075ad90]
mov rax, rdx
nop
call fcn.00417b20
mov rdx, qword [rsp + 0x40]
lea rsi, [0x0075ada0]
lock xadd qword [rsi], rdx
lea rax, [0x0075c4a8]
nop dword [rax]
call fcn.0042e7c0
mov rdx, qword [rsp + 0x40]
lock xadd qword [rax + 8], rdx
lea rax, [0x0075c4a8]
call fcn.0042e8a0
mov rdx, qword [rsp + 0x60]
lea rax, [rdx + 8]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x40]
call fcn.00428840
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
lea rax, [rsi + rdx]
mov ebx, 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00426e60
Function at 0x427640
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42778b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx + 0x10]
nop dword [rax]
cmp rax, rcx
jne 0x4276b1
cmp qword [rax], rbx
jne 0x427672
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x427680
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
nop dword [rax]
cmp qword [rax + 8], rbx
jne 0x427690
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x42769b
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.004372e0
lea rax, [0x005b6f7f]
mov ebx, 0x2d
call fcn.00437be0
mov rax, qword [rsp + 0x18]
call fcn.004378e0
lea rax, [0x005ab753]
mov ebx, 6
nop
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.00437ba0
lea rax, [0x005ab74d]
mov ebx, 6
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x10]
call fcn.00437ba0
lea rax, [0x005ac7d8]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.00437ba0
lea rax, [0x005ab729]
mov ebx, 6
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.00437ba0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ade8f]
mov ebx, 0x10
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00427640

Function at 0x4277c0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4278a6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x427821
cmp qword [rbx + 8], 0
jne 0x427821
cmp qword [rbx + 0x10], 0
jne 0x427821
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rcx, qword [rax]
nop dword [rax]
test rcx, rcx
je 0x42780b
mov qword [rcx + 8], rbx
jmp 0x42780f
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov qword [rbx + 0x10], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rbx + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x10], rcx
call fcn.004372e0
lea rax, [0x005b4057]
mov ebx, 0x21
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.00437ba0
call fcn.00437500
mov rax, qword [rsp + 0x20]
call fcn.00437ba0
call fcn.00437500
mov rax, qword [rsp + 0x18]
call fcn.00437ba0
call fcn.00437500
mov rax, qword [rsp + 0x10]
call fcn.00437ba0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ade7f]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004277c0
Function at 0x4278e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x427aea
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
call fcn.00425aa0
test rax, rax
je 0x427ad8
mov qword [rsp + 0x18], rax
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.00423800
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x18]
sub rcx, qword [rdx + 0x18]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rbx + 0xa]
mov byte [rsp + 0x17], sil
lea rax, [rdx + 0x78]
mov qword [rsp + 0x30], rax
nop
call fcn.0040b700
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx + 0x80]
movzx ebx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x20]
jmp 0x427979
mov rdx, rdi
mov rdi, qword [rdx]
nop dword [rax]
test rdi, rdi
je 0x4279eb
movzx r8d, word [rdi + 8]
cmp r8, rsi
jne 0x427997
cmp byte [rdi + 0xa], bl
je 0x4279a7
cmp r8, rsi
ja 0x4279eb
jne 0x427976
nop dword [rax + rax]
cmp byte [rdi + 0xa], bl
jbe 0x427976
jmp 0x4279eb
nop
nop
mov rax, qword [rsp + 0x30]
call fcn.0040b920
nop
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x4279df
cmp byte [r14 + 0xb1], 0
je 0x4279df
mov qword [r14 + 0x10], 0xfffffffffffffade
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x50]
mov word [rbx + 8], si
mov rsi, qword [rdx]
mov qword [rbx], rsi
mov qword [rdx], rbx
nop
nop
mov rax, qword [rcx + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop word [rax + rax]
cmp rdx, 0x40
jae 0x427acb
lea rsi, [0x0072b450]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and eax, 0x1ff
shr rax, 3
cmp rax, 0x40
jae 0x427ac1
lea rdx, [rdx + rax]
lea rdx, [rdx + 0x21080]
and ecx, 7
mov ebx, 1
shl ebx, cl
lock or byte [rdx], bl
nop
nop
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.0040b920
nop
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rdx + 0xd8]
lea esi, [rbx - 1]
mov dword [rdx + 0xd8], esi
cmp ebx, 1
jne 0x427ab1
cmp byte [r14 + 0xb1], 0
je 0x427ab1
mov qword [r14 + 0x10], 0xfffffffffffffade
mov eax, 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov ecx, 0x40
call fcn.004622a0
mov rax, rdx
mov ecx, 0x40
call fcn.004622a0
lea rax, [0x005b28a9]
mov ebx, 0x1d
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004278e0
Function at 0x427fe0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42806a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rax
nop
lea rax, [0x00731e60]
call fcn.0040b700
lea rax, [0x00731dd0]
call fcn.00418b60
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x00731e60]
call fcn.0040b920
mov rbx, qword [rsp + 0x10]
mov byte [rbx + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rax, qword [rsp + 0x18]
call fcn.004278e0
test al, al
je 0x428058
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005b53b7]
mov ebx, 0x25
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00427fe0

Function at 0x428600
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4286a6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x00759348]
nop
test rax, rax
je 0x428646
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 8]
mov qword [0x00759348], rcx
mov ebx, 0x10000
call fcn.00462920
mov rax, qword [rsp + 0x10]
jmp 0x428682
nop
nop
lea rax, [0x00759340]
call fcn.0040b920
mov eax, 0x10000
lea rbx, [0x0075adf8]
call fcn.00417420
test rax, rax
je 0x428690
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x00759340]
call fcn.0040b700
mov rax, qword [rsp + 0x18]
movups xmmword [rax], xmm15
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005b35e1]
mov ebx, 0x1f
nop dword [rax]
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.00428600
Function at 0x4286c0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428806
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [0x006e2920]
nop
cmp rdx, 0x15
ja 0x428783
mov qword [rsp + 0x30], rbx
test byte [rax], al
cmp dword [0x007592a0], 0
jne 0x428703
mov qword [rax + 0x10118], rcx
jmp 0x42870f
lea rdi, [rax + 0x10118]
call fcn.00461ee0
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.0042d580
mov rax, qword [rsp + 0x28]
call fcn.0042a9c0
mov rcx, qword [0x006e1328]
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x10078], rcx
cmp dword [0x007592a0], 0
jne 0x42875a
mov rax, qword [rsp + 0x30]
mov qword [rdx + 0x10110], rax
jmp 0x42876b
lea rdi, [rdx + 0x10110]
mov rax, qword [rsp + 0x30]
call fcn.00461de0
mov rax, qword [0x006e1328]
mov qword [rdx + 0x10100], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rdx
call fcn.004372e0
lea rax, [0x005b3a99]
mov ebx, 0x20
call fcn.00437be0
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x40
sbb rax, rax
mov edx, 1
shl rdx, cl
and rax, rdx
call fcn.004379e0
call fcn.00437540
nop
call fcn.00437360
call fcn.004372e0
lea rax, [0x005b2c66]
mov ebx, 0x1d
call fcn.00437be0
mov eax, 0x200000
call fcn.004379e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b68c8]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004286c0