joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7180
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a72d0
sub esp, 0x24
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4a7295
movzx ecx, byte [esp + 0x34]
test cl, cl
je 0x4a71b9
test eax, 0x60
jne 0x4a727d
test eax, 0x200
jne 0x4a71cc
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov eax, dword [esp + 0x28]
jmp 0x4a7202
lea ecx, [0x55d42f]
mov dword [esp], ecx
mov dword [esp + 4], 9
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004a1de0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, edx
and edx, 0x1f
cmp edx, 0x14
jne 0x4a7259
mov dword [esp + 0x20], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.004a7890
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a7244
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test ecx, ecx
je 0x4a7238
mov ecx, dword [ecx + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.004a57e0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a604]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x5617ef]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7180
Function at 0x4a7310
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a7470
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x12
ja 0x4a7398
cmp eax, 0x11
je 0x4a7389
cmp eax, 0x12
jne 0x4a7405
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4a7457
mov eax, dword [eax + 4]
test eax, eax
je 0x4a7457
test ecx, 0x80
je 0x4a7371
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4a7375
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b3f0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x4a73dd
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4a743f
mov eax, dword [eax + 4]
test eax, eax
je 0x4a743f
test ecx, 0x80
je 0x4a73c5
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4a73c9
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b670
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x17
je 0x4a73f6
cmp eax, 0x18
jne 0x4a7405
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x55f52a]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7310

Function at 0x4a7480
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a753a
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4a7521
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.0045b610
mov eax, dword [esp + 4]
test eax, eax
je 0x4a7509
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
mov ecx, dword [ecx + 8]
test ecx, 0x60
je 0x4a74d2
mov ecx, 0x20
jmp 0x4a74d4
xor ecx, ecx
movzx ebx, byte [edx + 0xf]
mov dword [esp], edx
and ebx, 0x1f
or ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004a7800
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a4ec]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a4e4]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7480
Function at 0x4a7550
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a760a
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4a75f1
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.0045b640
mov eax, dword [esp + 4]
test eax, eax
je 0x4a75d9
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ecx + 8]
test ecx, 0x60
je 0x4a75a2
mov ecx, 0x20
jmp 0x4a75a4
xor ecx, ecx
movzx ebx, byte [edx + 0xf]
mov dword [esp], edx
and ebx, 0x1f
or ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004a7800
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a4fc]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a4f4]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7550

Function at 0x4a7620
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a7705
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4a76ec
lea edx, [eax + 0xc]
mov dword [esp + 0xc], edx
mov ebx, dword [eax + 0x14]
test ebx, ebx
jne 0x4a7683
mov ebx, dword [eax]
mov eax, dword [eax + 4]
cmp dword [ebx], 4
jne 0x4a76d4
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x4a76d4
test ecx, 0x80
je 0x4a7671
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0045b5a0
jmp 0x4a769f
mov dword [esp], edx
call fcn.0045b610
mov eax, dword [esp + 4]
test eax, eax
je 0x4a76bc
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0045b5e0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0045b610
mov eax, dword [esp + 4]
test eax, eax
setne al
mov byte [esp + 0x18], al
add esp, 0x10
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a50c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a504]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7620

Function at 0x4a7890
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a7914
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a78d9
mov ecx, dword [esp + 0x14]
test ecx, 0x200
je 0x4a78c5
mov dword [esp + 0x18], 0
add esp, 8
ret
mov dword [esp], eax
call fcn.004a2a20
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
add esp, 8
ret
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x561806]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7890
Function at 0x4a79d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a7b6f
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 0xc], eax
cmp eax, 0x15
ja 0x4a7a6d
cmp eax, 0x12
jne 0x4a7a09
mov eax, dword [esp + 0x14]
jmp 0x4a7ab6
cmp eax, 0x13
jne 0x4a7a5e
test ecx, 0x200
jne 0x4a7a50
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x4a7b56
mov eax, dword [eax + 4]
test eax, eax
je 0x4a7b56
test ecx, 0x80
je 0x4a7a3e
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x4a7a42
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a7a48
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x4a8e70]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x15
jne 0x4a7b04
mov eax, dword [esp + 0x14]
jmp 0x4a7ab6
cmp eax, 0x16
jne 0x4a7aa8
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 4]
test edx, edx
jne 0x4a7ab6
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.0045b850
movzx eax, byte [esp + 4]
test al, al
je 0x4a7b3e
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x17
je 0x4a7ade
cmp eax, 0x1a
jne 0x4a7b04
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x4a7aec
mov eax, dword [eax + 4]
test eax, eax
je 0x4a7aec
test ecx, 0x80
je 0x4a7ad2
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x4a7ad6
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x15
lea ecx, [0x560b64]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a514]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a79d0
Function at 0x4a7f20
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a814a
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov ecx, eax
and eax, 0x1f
cmp eax, 0x11
jne 0x4a7f63
test ecx, 0x100
je 0x4a8131
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x28]
mov eax, dword [eax + 0x24]
mov ebp, dword [esp + 0x20]
jmp 0x4a7f79
cmp eax, 0x17
jne 0x4a8049
mov ebx, dword [esp + 0x20]
mov ebp, dword [ebx]
mov edx, dword [ebx + 8]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
test ebx, ebx
jl 0x4a8119
mov esi, dword [esp + 0x2c]
cmp esi, ebx
jl 0x4a8119
cmp esi, edx
jg 0x4a8119
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 8], edx
lea eax, [0x543c60]
mov dword [esp], eax
call fcn.0040b170
mov edi, dword [esp + 4]
mov dword [edi], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
sub eax, ecx
mov dword [edi + 4], eax
mov eax, dword [esp + 8]
sub eax, ecx
mov dword [edi + 8], eax
test eax, eax
jle 0x4a7fff
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 0x20]
mov ebp, dword [0x67e2d0]
mov ebx, dword [ebx]
imul ecx, ebx
mov ebx, dword [esp + 0x14]
lea eax, [ebx + ecx]
test ebp, ebp
jne 0x4a7ff8
mov dword [edi], eax
jmp 0x4a801e
call fcn.0045f450
jmp 0x4a801e
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4a8011
mov eax, dword [esp + 0x14]
mov dword [edi], eax
jmp 0x4a801a
mov eax, dword [esp + 0x14]
call fcn.0045f450
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
test eax, 0x60
je 0x4a8030
mov eax, 0x20
jmp 0x4a8032
xor eax, eax
test byte [edx], al
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
or eax, 0x97
mov dword [esp + 0x38], eax
add esp, 0x18
ret
cmp eax, 0x18
jne 0x4a80db
mov eax, dword [esp + 0x28]
test eax, eax
jl 0x4a80c3
mov edx, dword [esp + 0x2c]
cmp edx, eax
jl 0x4a80c3
mov ebx, dword [esp + 0x20]
cmp dword [ebx + 4], edx
jl 0x4a80c3
lea eax, [0x54c0c0]
mov dword [esp], eax
call fcn.0040b170
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 4], eax
jle 0x4a80ab
mov ecx, dword [ecx]
mov edx, dword [esp + 0x2c]
sub edx, eax
nop
mov dword [edi + 4], edx
mov edx, dword [0x67e2d0]
add eax, ecx
test edx, edx
jne 0x4a80a6
mov dword [edi], eax
jmp 0x4a80ab
call fcn.0045f450
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], eax
add esp, 0x18
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a52c]
mov dword [esp + 4], eax
call fcn.00433350
mov dword [esp + 0xc], eax
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x5600b1]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a534]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a524]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a7f20
Function at 0x4a8250
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a838f
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a8354
test eax, 0x200
je 0x4a830e
sar eax, 0xa
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
cmp edx, 0x14
jne 0x4a82c7
mov edx, dword [ecx + 0x24]
cmp dword [ecx + 0x28], eax
jbe 0x4a833c
lea eax, [edx + eax*8 + 4]
mov eax, dword [eax]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045c7a0
mov eax, dword [esp + 8]
lea ecx, [0x59ada0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.004a2990
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 8], ecx
jbe 0x4a8324
shl ecx, 4
mov eax, dword [eax + ecx + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045c7a0
mov eax, dword [esp + 8]
lea ecx, [0x59ada0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x59ada0]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a5bc]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a5bc]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x55fa01]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a8250
Function at 0x4a87e0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a8964
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
call ecx
cmp dword [esp + 4], 0x17
jne 0x4a894b
mov eax, dword [esp + 0x1c]
test eax, eax
jl 0x4a8933
mov ecx, dword [esp + 0x20]
test ecx, ecx
jl 0x4a891b
cmp ecx, eax
jl 0x4a8903
lea eax, [0x54efc0]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x28]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
lea edx, [0x59ada0]
cmp eax, edx
jne 0x4a88e7
mov dword [esp], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0045b560
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edi + 8], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4a88a0
mov dword [edi], eax
jmp 0x4a88a5
call fcn.0045f450
mov eax, dword [esp + 0x14]
lea ecx, [0x59ada0]
cmp eax, ecx
jne 0x4a88cb
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0x97
add esp, 0x10
ret
mov dword [esp], eax
lea eax, [0x559680]
mov dword [esp + 4], eax
lea eax, [0x557620]
mov dword [esp + 8], eax
call fcn.00408940
mov dword [esp], eax
lea eax, [0x559680]
mov dword [esp + 4], eax
lea eax, [0x557620]
mov dword [esp + 8], eax
call fcn.00408940
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a55c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a554]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a54c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a544]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a87e0
Function at 0x4ab060
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ab2bd
sub esp, 0xc
nop
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x14
ja 0x4ab09e
lea edx, [eax - 0x12]
cmp edx, 1
jbe 0x4ab0c1
cmp eax, 0x14
je 0x4ab0a8
jmp 0x4ab282
cmp eax, 0x16
jbe 0x4ab0c1
cmp eax, 0x17
jne 0x4ab0b8
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
setne al
xor eax, 1
jmp 0x4ab0e9
cmp eax, 0x1a
jne 0x4ab282
test ecx, 0x200
jne 0x4ab183
test ecx, 0x80
je 0x4ab0dd
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4ab0e1
mov eax, dword [esp + 0x14]
test eax, eax
setne al
xor eax, 1
test al, al
je 0x4ab183
nop
mov eax, dword [esp + 0x24]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x14
ja 0x4ab116
lea edx, [eax - 0x12]
cmp edx, 1
jbe 0x4ab139
cmp eax, 0x14
je 0x4ab120
jmp 0x4ab248
cmp eax, 0x16
jbe 0x4ab139
cmp eax, 0x17
jne 0x4ab130
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
setne al
xor eax, 1
jmp 0x4ab15d
cmp eax, 0x1a
jne 0x4ab248
test ecx, 0x200
jne 0x4ab161
test ecx, 0x80
je 0x4ab151
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
jmp 0x4ab155
mov eax, dword [esp + 0x20]
test eax, eax
setne al
xor eax, 1
test al, al
jne 0x4ab172
mov dword [esp + 0x28], 0xffffffff
mov byte [esp + 0x2c], 1
add esp, 0xc
ret
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 1
add esp, 0xc
ret
nop
mov eax, dword [esp + 0x24]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x14
ja 0x4ab1a5
lea edx, [eax - 0x12]
cmp edx, 1
jbe 0x4ab1c4
cmp eax, 0x14
je 0x4ab1af
jmp 0x4ab20e
cmp eax, 0x16
jbe 0x4ab1c4
cmp eax, 0x17
jne 0x4ab1bf
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
setne al
xor eax, 1
jmp 0x4ab1e8
cmp eax, 0x1a
jne 0x4ab20e
test ecx, 0x200
jne 0x4ab1ec
test ecx, 0x80
je 0x4ab1dc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
jmp 0x4ab1e0
mov eax, dword [esp + 0x20]
test eax, eax
setne al
xor eax, 1
test al, al
jne 0x4ab1fd
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
add esp, 0xc
ret
mov dword [esp + 0x28], 1
mov byte [esp + 0x2c], 1
add esp, 0xc
ret
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x56009e]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x56009e]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x54c480]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x56009e]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x548f60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004ab060
Function at 0x4bb200
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bb402
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov ebx, dword [eax]
test ebx, ebx
je 0x4bb22c
cmp eax, ebx
je 0x4bb241
jmp 0x4bb3e9
mov ebx, dword [0x67e2d0]
test ebx, ebx
jne 0x4bb23a
mov dword [eax], eax
jmp 0x4bb241
mov edi, eax
call fcn.0045f450
mov ebx, dword [esp + 0x34]
cmp ebx, 0x80
jae 0x4bb2d6
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0xc]
lea esi, [ecx + 1]
cmp ebp, esi
jae 0x4bb2b1
lea eax, [0x547680]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], esi
call fcn.00447650
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov dword [ebx + 0xc], edx
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x4bb2a1
mov dword [ebx + 4], eax
jmp 0x4bb2a9
lea edi, [ebx + 4]
call fcn.0045f450
mov edx, eax
mov eax, ebx
mov ebx, dword [esp + 0x34]
lea ebp, [ecx + 1]
mov dword [eax + 8], ebp
mov byte [edx + ecx], bl
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x2c
ret
mov ebp, dword [eax + 8]
mov dword [esp + 0x20], ebp
mov esi, dword [eax + 0xc]
mov edi, esi
sub esi, ebp
cmp esi, 4
jge 0x4bb36f
lea eax, [0x547680]
mov dword [esp], eax
mov dword [esp + 4], ebp
shl edi, 1
lea eax, [edi + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
call fcn.00447590
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jl 0x4bb324
mov ebx, ebp
cmp edx, eax
je 0x4bb348
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.0045fd70
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
mov dword [ecx + 8], ebp
mov ebx, dword [esp + 0x24]
mov dword [ecx + 0xc], ebx
mov ebx, dword [0x67e2d0]
test ebx, ebx
jne 0x4bb361
mov dword [ecx + 4], eax
jmp 0x4bb369
lea edi, [ecx + 4]
call fcn.0045f450
mov eax, ecx
mov ebx, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov esi, dword [eax + 4]
lea ecx, [ebp + 4]
cmp edx, ecx
jb 0x4bb3e4
cmp ebp, ecx
ja 0x4bb3dd
sub edx, ebp
mov eax, edx
neg edx
sar edx, 0x1f
and edx, ebp
lea ecx, [esi + edx]
mov dword [esp], ecx
mov dword [esp + 4], 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00484200
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
mov ebx, dword [esp + 0x20]
add ebx, eax
cmp edx, ebx
jb 0x4bb3d6
mov dword [ecx + 8], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x2c
ret
mov ecx, ebx
call fcn.0045f510
mov eax, ebp
call fcn.0045f530
call fcn.0045f510
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a404]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004bb200