joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5830
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bcc
mov eax, dword [ebp + 0x10]
call fcn.00405bcc
mov eax, dword [ebp + 0xc]
call fcn.00405bcc
xor eax, eax
push ebp
push 0x4c5ab2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0040b8e4
mov edx, dword [ebp - 0x50]
mov eax, 0x4c5ad0
call fcn.00406690
dec eax
jne 0x4c58c9
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4bb5c8]
call fcn.004bbaf8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x49000c]
call fcn.004a2598
mov edx, eax
mov esi, dword [ebp - 0xc]
mov eax, esi
call fcn.004c4a48
mov eax, esi
call fcn.004c4a3c
call fcn.004a6988
jmp 0x4c58da
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ba6d8]
call fcn.004bbaf8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c5a76
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ea830], 0
je 0x4c5947
mov eax, dword [ebp - 0xc]
add eax, 0x90
mov edx, dword [0x4ea830]
call fcn.00405be4
lea edx, [ebp - 0x54]
mov eax, dword [0x4ea834]
call fcn.0040c334
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0xc]
add eax, 0x94
call fcn.00405be4
mov eax, dword [ebp - 0xc]
add eax, 0xa8
mov edx, dword [0x4ea838]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
add eax, 0xac
mov edx, dword [0x4ea83c]
call fcn.00405be4
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.004035d8
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 8]
lea edx, [ebp - 0x4c]
mov ecx, 0x20
call fcn.00405dcc
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.004035d8
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
push dword [ebp - 8]
push 0x4c5af0
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x4c]
mov ecx, 0x20
call fcn.00405dcc
push dword [ebp - 0x58]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406184
push 0
push 0
mov eax, ebx
call fcn.00425454
cmp dword [ebp + 0xc], 0
je 0x4c59e2
mov eax, dword [ebp - 0xc]
add eax, 0xfc
mov edx, dword [ebp + 0xc]
call fcn.00405be4
cmp dword [ebp + 0x10], 0
je 0x4c59f8
mov eax, dword [ebp - 0xc]
add eax, 0x16c
mov edx, dword [ebp + 0x10]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x37c], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1a0], ebx
mov eax, dword [ebp - 0xc]
add eax, 0x118
mov edx, dword [ebp - 8]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
add eax, 0xec
mov edx, dword [ebp - 4]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x188], edi
xor eax, eax
push ebp
push 0x4c5a56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004c413c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5a7d
mov eax, dword [ebp - 0xc]
call fcn.00403d10
ret
Function at 0x4d93f4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d951c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004d92e0
mov eax, dword [esi]
call fcn.00407410
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40a13c]
call fcn.004075d8
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004031a0
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004031a0
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00407410
mov dword [ebp - 0xc], eax
mov eax, dword [0x4ec1cc]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004cb7c8
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004035d8
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00407410
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004cb670
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004cb66c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004cb7c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9523
lea eax, [ebp - 4]
mov edx, dword [0x40a13c]
call fcn.004075e4
ret

Function at 0x4dbbe4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bcc
mov eax, dword [ebp - 8]
call fcn.00405bcc
mov eax, dword [ebp - 0xc]
call fcn.00405bcc
xor eax, eax
push ebp
push 0x4dbd36
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.004caf54
xor edx, edx
push ebp
push 0x4dbd14
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4dbc3f
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4dbc46
mov dword [ebp - 0x10], 1
xor edx, edx
push ebp
push 0x4dbca7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405c70
mov edi, eax
push edi
mov eax, dword [ebp - 8]
call fcn.00405c70
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405c70
mov ebx, eax
push ebx
push 0x4dbd48
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4dbc9d
mov eax, dword [ebp - 0x10]
push eax
push edi
push esi
push ebx
push 0x4dbd48
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dbcfe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbd1b
mov eax, dword [ebp - 0x14]
call fcn.004caf84
ret
Function at 0x4ddc7c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ddd07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004035d8
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00414eb8
lea eax, [ebp - 0x24]
mov edx, 0x4ddd24
call fcn.00405fe0
mov eax, dword [ebp - 0x24]
call fcn.00405c70
mov dword [ebp - 0x16], eax
mov eax, 0x4ddd28
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddd0e
lea eax, [ebp - 0x24]
call fcn.00405bd4
ret
Function at 0x4e1214
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e130a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx esi, ax
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e1324
mov edx, 0x59
mov eax, esi
call fcn.00412e04
push dword [ebp - 4]
push 0x4e1338
lea eax, [ebp - 8]
push eax
mov ecx, 0x4e1348
mov edx, 0x5a
mov eax, esi
call fcn.00412e04
push dword [ebp - 8]
lea eax, [ebx + 0x18]
mov edx, 3
call fcn.00406184
call fcn.00444ee4
test al, al
je 0x4e1292
lea eax, [ebx + 0x1c]
mov edx, 0x4e135c
call fcn.00405be4
jmp 0x4e12b9
mov eax, dword [0x4ebc34]
mov eax, dword [eax]
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [0x4ec068]
add eax, dword [edx]
lea edx, [ebp - 0xc]
call fcn.0040c334
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x1c]
call fcn.00405be4
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, dword [ebx + 0xc]
call fcn.004ddb74
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
call fcn.00405be4
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebx + 0xc]
call fcn.004ddb74
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x3c]
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1311
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405bdc
ret
Function at 0x4475d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00447630

Function at 0x447630
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x44b3a0]
test esi, esi
jle 0x447723
mov edi, dword [0x44b3a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x447664
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x44771c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x447650
mov dword [esp], eax
mov esi, eax
call fcn.00447f20
test eax, eax
mov edi, eax
je 0x447760
mov esi, dword [0x44b3a4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call fcn.00448030
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x44b3a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x447740
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x447715
sub eax, 4
and eax, 0xfffffffb
je 0x447715
add ebx, dword [0x44b3a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x44772a
add dword [0x44b3a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x44766e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004475d0
mov eax, dword [0x44b3a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004475d0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004475d0
Function at 0x447ba0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44b3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44b3b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x447bf5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x447bee
test esi, esi
je 0x447bee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x447bd0
mov dword [esp], 0x44b3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ed0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x698571c6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1ba47d8a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403110
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4031e0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403176
mov edx, dword [eax + 0x10]
test edx, edx
je 0x40317f
movzx eax, byte [eax + 0xf]
test al, 0x20
je 0x403156
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
sete al
mov byte [esp + 0x2c], al
add esp, 0x1c
ret
mov eax, dword [edx]
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
call eax
movzx eax, byte [esp + 8]
mov byte [esp + 0x2c], al
add esp, 0x1c
ret
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004587a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x562ef6]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x54a800]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00403110

Function at 0x4031f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4032c3
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403259
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x403262
movzx eax, byte [eax + 0xf]
test al, 0x20
je 0x403239
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
sete al
mov byte [esp + 0x2c], al
add esp, 0x1c
ret
mov eax, dword [edx]
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
call eax
movzx eax, byte [esp + 8]
mov byte [esp + 0x2c], al
add esp, 0x1c
ret
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004587a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x562ef6]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x54a800]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004031f0
Function at 0x404300
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4044c4
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x20]
mov eax, dword [ecx]
cmp eax, 0x10000
jae 0x4044ad
cmp byte [ecx + 0xd], 8
ja 0x404497
mov edx, dword [esp + 0x24]
mul edx
jo 0x40447f
cmp eax, 0xffffffc7
ja 0x40447f
mov edx, dword [esp + 0x24]
test edx, edx
jl 0x40447f
mov dword [esp + 0x14], ecx
test eax, eax
je 0x40440d
mov ebx, dword [ecx + 4]
test ebx, ebx
jne 0x4043b1
add eax, 0x38
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.0040a8f0
mov eax, dword [esp + 0xc]
test byte [eax], al
mov ecx, dword [0x67e2d0]
lea edx, [eax + 0x38]
test ecx, ecx
jne 0x40439e
mov dword [eax + 8], edx
jmp 0x404449
lea edi, [eax + 8]
mov ecx, eax
mov eax, edx
call fcn.0045f450
mov eax, ecx
jmp 0x404449
mov dword [esp + 0x10], eax
lea eax, [0x5557a0]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov byte [esp + 8], 1
call fcn.0040a8f0
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0xc]
test eax, eax
jne 0x4043fb
mov edx, dword [esp + 0x18]
mov dword [edx + 8], ecx
jmp 0x404409
mov edx, dword [esp + 0x18]
lea edi, [edx + 8]
mov eax, ecx
call fcn.0045f450
mov eax, edx
jmp 0x404449
mov dword [esp], 0x38
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.0040a8f0
mov eax, dword [esp + 0xc]
test byte [eax], al
mov ecx, dword [0x67e2d0]
lea edi, [eax + 8]
test ecx, ecx
jne 0x40443e
mov dword [eax + 8], edi
jmp 0x404449
mov ecx, eax
mov eax, edi
call fcn.0045f450
mov eax, ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov word [eax + 0xc], dx
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x404462
mov dword [eax + 0x14], ecx
jmp 0x404470
lea edi, [eax + 0x14]
mov edx, eax
mov eax, ecx
call fcn.0045f450
mov eax, edx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
lea eax, [0x54a860]
mov dword [esp], eax
lea eax, [0x59a64c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x561737]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a80
lea eax, [0x565ac5]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00404300
Function at 0x4082c0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4083d5
sub esp, 0x20
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x68]
test eax, eax
jne 0x4083be
mov eax, dword [0x652ea8]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ebx, edx
shr edx, 2
lea edx, [edx + edx*2]
cmp ecx, edx
jb 0x408394
mov dword [esp + 0x10], eax
shl ebx, 1
lea eax, [ebx + 2]
shl eax, 2
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.0040a8f0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [eax], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
lea edx, [0x460450]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
mov dword [esp], edx
call fcn.00408ee0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x10]
cmp dword [edx + 4], ecx
jne 0x4083a8
lea ecx, [0x652ea8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004033e0
mov eax, dword [0x652ea8]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.004083e0
add esp, 0x20
ret
lea eax, [0x565c6c]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.00433a80
lea eax, [0x55ec52]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004082c0

Function at 0x409480
Capabilities:
Clear windows event logs
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4095a9
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx], eax
jne 0x409592
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.00430670
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x1c]
test byte [edx], al
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x40951b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x85], 1
mov ecx, dword [0x652ea4]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x40957c
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call fcn.00430150
jmp 0x40953e
mov eax, dword [esp + 0x1c]
cmp dword [eax], 1
jne 0x409528
add esp, 0x18
ret
lea eax, [0x563483]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
add esp, 0x18
ret
mov dword [esp + 4], 0
mov dword [esp], 0x989680
call fcn.00430150
mov eax, dword [0x652ea4]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045f110
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00401c50
mov eax, dword [esp + 4]
test eax, eax
je 0x409550
jmp 0x40953e
lea eax, [0x55ffba]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00409480
Function at 0x40a490
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a5af
sub esp, 0x18
xor eax, eax
jmp 0x40a4ae
inc eax
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
lea ebp, [ebx + edx]
mov dword [esp + 0x14], ebp
mov dword [esp + 4], ebp
call fcn.00413550
mov eax, dword [esp + 8]
mov ecx, eax
test eax, eax
je 0x40a584
mov edx, dword [esp + 0x24]
lea ebx, [edx - 1]
test eax, ebx
je 0x40a574
mov dword [esp + 0x10], eax
mov dword [esp], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call fcn.00413430
nop
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax - 1]
neg ecx
and ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00413550
mov eax, dword [esp + 8]
mov ecx, eax
mov edx, dword [esp + 0x10]
cmp eax, edx
je 0x40a564
mov dword [esp], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call fcn.00413430
mov eax, dword [esp + 0xc]
cmp eax, 0x63
jne 0x40a4ad
jmp 0x40a598
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
add esp, 0x18
ret
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
add esp, 0x18
ret
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x18
ret
lea eax, [0x567e3e]
mov dword [esp], eax
mov dword [esp + 4], 0x38
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0040a490