joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413660
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413874
sub esp, 0x18
mov eax, dword [0x657220]
test eax, eax
jne 0x41385d
nop
lea eax, [0x657208]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [0x65720c]
test eax, eax
je 0x4136a9
cmp dword [eax + 8], 0xcc
jne 0x41371f
mov edx, dword [0x657200]
test edx, edx
jne 0x413701
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x658bf8]
mov dword [esp + 8], eax
call fcn.0040b630
mov eax, dword [esp + 0xc]
mov dword [0x657200], eax
mov ecx, dword [0x6571bc]
mov dword [eax], ecx
mov eax, dword [0x657200]
mov dword [0x6571bc], eax
movzx eax, byte [0x657660]
test al, al
jne 0x413701
xor eax, eax
jmp 0x413809
mov edx, dword [0x657200]
mov ebx, dword [edx + 4]
mov dword [0x657200], ebx
mov ebx, dword [0x65720c]
mov dword [edx + 4], ebx
mov dword [0x65720c], edx
mov edx, dword [0x65720c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4137f1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x6573b0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41377d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41378a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045f3d0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x6573b0]
test edx, edx
jne 0x4137b6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4137d7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045f3d0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045f3d0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045f3d0
mov byte [0x657189], 1
nop
lea eax, [0x657208]
mov dword [esp], eax
call fcn.00409340
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045f460
lea esi, [0x657660]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413701
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413853
lea edx, [0x6161f4]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4137fb
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045f450
mov ecx, 5
call fcn.0045f450
lea eax, [0x54d6e9]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00413660
Function at 0x414410
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4144f1
sub esp, 8
mov ecx, dword [esp + 0x10]
cmp ecx, 0x4000
ja 0x4144da
cmp ecx, 4
jae 0x414443
mov ecx, 4
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x414463
mov ebx, dword [esp + 0x14]
mov dword [edx + 4], ebx
mov ebx, dword [esp + 0x18]
mov dword [edx + 8], ebx
jmp 0x41447b
lea edi, [edx + 4]
mov eax, dword [esp + 0x14]
call fcn.0045f3d0
lea edi, [edx + 8]
mov eax, dword [esp + 0x18]
call fcn.0045f3d0
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
test ecx, ecx
je 0x4144d5
mov eax, 0x4000
xor edx, edx
div ecx
imul eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], 0
mov edx, dword [0x6573b0]
test edx, edx
jne 0x4144c1
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x20], eax
jmp 0x4144cd
lea edi, [ecx + 0x20]
mov eax, dword [esp + 0x1c]
call fcn.0045f3d0
mov byte [ecx + 0x24], 1
add esp, 8
ret
call fcn.004320f0
lea eax, [0x54f9cc]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00414410

Function at 0x414500
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414605
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x4145ce
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x41455e
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
mov ecx, dword [eax]
add dword [eax + 0x1c], ecx
movzx ecx, byte [eax + 0x24]
test cl, cl
je 0x414556
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045fb10
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
add esp, 0x18
ret
cmp dword [eax + 0x14], ecx
jae 0x414590
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], edx
call fcn.0040b630
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, ecx
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 4]
test edx, edx
je 0x4145b4
mov dword [esp + 0x14], ecx
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
mov dword [esp], ebp
mov dword [esp + 4], ecx
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add dword [eax + 0x10], edx
mov edx, dword [eax + 0x14]
sub edx, dword [eax]
mov dword [eax + 0x14], edx
mov edx, dword [eax]
add dword [eax + 0x1c], edx
mov dword [esp + 0x20], ecx
add esp, 0x18
ret
call fcn.004351d0
lea eax, [0x552f02]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00435e00
call fcn.00435240
lea eax, [0x54d1d1]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00414500
Function at 0x417800
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x4179e7
sub esp, 0xc
mov eax, dword [0x657220]
test eax, eax
jne 0x4179d0
nop
lea eax, [0x637200]
mov dword [esp], eax
call fcn.00409140
add dword [0x637290], 2
nop
nop
lea eax, [0x631124]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e20
nop
lea eax, [0x6372a8]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e70
mov eax, dword [0x637304]
mov ecx, dword [0x637308]
mov edx, dword [0x63730c]
mov dword [0x637314], ecx
mov dword [0x637318], edx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x4178a4
mov dword [0x637310], eax
jmp 0x4178af
lea edi, [0x637310]
call fcn.0045f3d0
nop
lea eax, [0x6372d0]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e70
nop
lea eax, [0x6372d8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401cc0
nop
nop
lea eax, [0x637200]
mov dword [esp], eax
call fcn.00409340
lea eax, [0x631128]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e20
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x41794a
nop
nop
lea eax, [0x637200]
mov dword [esp], eax
call fcn.00409140
mov dword [0x6372c0], 0
mov dword [0x6372c4], 0
nop
nop
lea eax, [0x637200]
mov dword [esp], eax
call fcn.00409340
jmp 0x4179a0
nop
lea eax, [0x631110]
mov dword [esp], eax
call fcn.00409140
movzx eax, byte [0x631118]
test al, al
je 0x417986
mov byte [0x631118], 0
mov eax, dword [0x631114]
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.00437ac0
nop
nop
lea eax, [0x631110]
mov dword [esp], eax
call fcn.00409340
add esp, 0xc
ret
inc dword [0x631120]
call fcn.004217a0
cmp dword [esp], 0xffffffff
jne 0x41799a
call fcn.004235e0
mov byte [esp], 0
call fcn.004236f0
movzx eax, byte [esp + 4]
test al, al
jne 0x4179b0
call fcn.0042b200
call fcn.0042b270
add esp, 0xc
ret
lea eax, [0x55186e]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a00
nop
call fcn.0045cba0
jmp fcn.00417800
Function at 0x41bc80
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 8
movzx edx, byte [0x657192]
test dl, dl
jne 0x41bd53
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub eax, dword [edx + 0xc]
mov ebx, dword [edx + 0x34]
mov ecx, edx
mul ebx
nop
nop
nop
nop
nop
nop
mov ebx, edx
shr edx, 3
nop
add edx, dword [ecx + 0x2c]
mov dword [esp], edx
and ebx, 7
mov ecx, ebx
mov edx, 1
shl edx, cl
mov byte [esp + 4], dl
call fcn.00401ea0
mov edx, dword [0x6372dc]
test byte [edx], al
nop
nop
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
nop
mov eax, ecx
shr ecx, 0x16
mov edx, dword [edx + ecx*4]
test byte [edx], al
mov ecx, eax
shr eax, 0x10
and eax, 0x3f
movzx ebx, byte [edx + eax + 0x40840]
lea eax, [edx + eax + 0x40840]
shr ecx, 0xd
and ecx, 7
mov edx, 1
shl edx, cl
test dl, bl
jne 0x41bd1b
mov dword [esp], eax
mov byte [esp + 4], dl
call fcn.00401ea0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x54]
mov ecx, dword [eax + 0x95c]
mov edx, dword [esp + 0x14]
add ecx, edx
mov edx, dword [eax + 0x960]
mov dword [eax + 0x95c], ecx
adc edx, 0
mov dword [eax + 0x960], edx
add esp, 8
ret
lea eax, [0x552034]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00433a00
nop
int3
Function at 0x41f8f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41f997
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jbe 0x41f91c
nop
mov edx, eax
sub eax, ecx
jmp 0x41f920
mov edx, eax
xor eax, eax
test eax, eax
je 0x41f97c
test ecx, 0x3fffff
jne 0x41f980
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ecx, [eax + 0x54]
mov dword [esp + 0xc], ecx
nop
mov dword [esp], ecx
call fcn.00409140
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x6c], eax
jne 0x41f96a
lea eax, [ecx + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.0042c2d0
nop
nop
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00409340
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0x54ea9a]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0041f8f0

Function at 0x420340
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x420490
sub esp, 0x18
mov edx, dword [esp + 0x20]
lea ebx, [edx - 1]
test edx, ebx
jne 0x420440
test edx, edx
je 0x420440
cmp edx, 0x40
ja 0x4203f1
mov ebx, dword [esp + 0x1c]
mov eax, 7
jmp 0x42038f
mov ebp, dword [esp + 0x14]
lea eax, [ebp - 1]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
test eax, eax
jl 0x4203de
test byte [ebx], al
cmp eax, 8
jae 0x4203e7
mov dword [esp + 0x14], eax
lea ecx, [ebx + eax*8 + 0x40]
mov ebp, dword [ecx]
mov ecx, dword [ecx + 4]
lea esi, [ebx + eax*8]
or ebp, dword [esi]
or ecx, dword [esi + 4]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov dword [esp + 8], edx
call fcn.004200a0
cmp dword [esp + 0xc], 0xffffffff
setne al
cmp dword [esp + 0x10], 0xffffffff
setne cl
or ecx, eax
test cl, cl
je 0x420380
mov byte [esp + 0x24], 1
add esp, 0x18
ret
mov byte [esp + 0x24], 0
add esp, 0x18
ret
mov ecx, 8
call fcn.0045f450
call fcn.004351d0
lea eax, [0x54a77f]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x549fb2]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a00
call fcn.004351d0
lea eax, [0x54a77f]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54fdb9]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00420340
Function at 0x420d10
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x420e27
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 0xdc]
test ebx, ebx
jne 0x420d58
call fcn.00423220
mov ebx, dword [esp]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 0x10]
mov dword [eax + 0xd8], ebx
mov dword [eax + 0xdc], ebx
mov edx, eax
mov ebp, dword [ebx + 0xc]
test ebp, ebp
jle 0x420dbb
mov esi, dword [edx + 0xc0]
mov edi, dword [esp + 0x14]
mov eax, edi
sub edi, esi
lea esi, [ebp - 1]
cmp esi, 0x65
jae 0x420e1a
lea esi, [ebp + ebp*4]
mov ecx, edx
mov edx, dword [ebx + esi*4]
add edx, dword [ebx + esi*4 + 4]
cmp edx, edi
ja 0x420e04
cmp ebp, 0x65
jne 0x420dc1
mov dword [esp + 8], ebx
call fcn.00423220
mov ebx, dword [esp]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 8]
mov dword [eax + 0x10], ebx
mov eax, dword [esp + 0x10]
mov dword [eax + 0xdc], ebx
mov ecx, eax
mov eax, dword [esp + 0x14]
jmp 0x420dc1
mov eax, dword [esp + 0x14]
mov ecx, edx
mov edx, dword [ebx + 0xc]
cmp edx, 0x65
jae 0x420df8
lea ebp, [edx + 1]
mov dword [ebx + 0xc], ebp
lea edx, [edx + edx*4]
mov ebp, dword [ecx + 0xc0]
sub eax, ebp
mov dword [ebx + edx*4 + 0x14], eax
mov eax, dword [esp + 0x18]
mov ebp, dword [eax + 4]
mov dword [ebx + edx*4 + 0x18], ebp
nop
mov dword [ebx + edx*4 + 0x1c], eax
inc dword [ecx + 0xe0]
add esp, 0xc
ret
mov eax, edx
mov ecx, 0x65
call fcn.0045f450
lea eax, [0x5518e9]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a00
mov eax, esi
mov ecx, 0x65
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00420d10
Function at 0x421190
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4213a2
sub esp, 0x34
mov eax, dword [esp + 0x3c]
cmp dword [0x637290], eax
jne 0x42138b
mov eax, dword [esp + 0x38]
test byte [eax], al
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0x7fffffff
dec eax
cmp eax, 0x80000000
jae 0x421375
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea edx, [ecx - 1]
mov dword [esp + 8], edx
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x4211b9
mov eax, dword [esp + 0x30]
cmp eax, 0x80000000
jne 0x421371
mov eax, dword [0x657530]
test eax, eax
jle 0x42136d
lea eax, [0x6372a8]
mov dword [esp], eax
call fcn.00401e50
mov eax, dword [0x657a70]
mov dword [esp + 0x30], eax
mov ecx, dword [0x6372b8]
mov dword [esp + 0x2c], ecx
sub eax, ecx
mov dword [esp + 0x28], eax
mov ebx, dword [0x657a74]
mov dword [esp + 0x24], ebx
mov ebp, dword [0x6372bc]
mov dword [esp + 0x20], ebp
mov esi, dword [0x6372c0]
mov dword [esp + 0x1c], esi
mov edi, dword [0x6372c4]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 8]
mov dword [esp + 0x14], edi
mov esi, dword [esp + 4]
mov dword [esp + 0x10], esi
call fcn.004351d0
lea eax, [0x54f637]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00435e00
mov eax, dword [esp + 0x24]
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov edx, dword [esp + 0x30]
shr edx, 0x14
or ecx, edx
mov dword [esp], ecx
call fcn.00435aa0
lea eax, [0x54a1b5]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e00
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub eax, ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
sbb eax, ecx
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov eax, dword [esp + 0x28]
shr eax, 0x14
or ecx, eax
mov dword [esp], ecx
call fcn.00435aa0
lea eax, [0x54cdc6]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e00
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x549074]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e00
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435490
lea eax, [0x5498ec]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e00
call fcn.00435240
add esp, 0x34
ret
add esp, 0x34
ret
lea eax, [0x550581]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a00
lea eax, [0x552c08]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00421190
Function at 0x421420
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42151a
sub esp, 0x18
jmp 0x421441
inc dword [0x631120]
call fcn.004217a0
cmp dword [esp], 0xffffffff
jne 0x42143b
nop
lea eax, [0x631124]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, 0x7fffffff
jne 0x421503
mov edx, dword [0x637290]
mov dword [esp + 8], edx
xor eax, eax
jmp 0x4214c7
mov dword [esp + 0xc], eax
shl eax, 7
mov dword [esp + 0x14], eax
lea ebx, [0x637334]
lea ebp, [ebx + eax]
lea edx, [edx + edx*2]
mov dword [esp + 0x10], edx
lea ebp, [ebp + edx*8 + 4]
mov dword [esp], ebp
call fcn.0042cdc0
mov eax, dword [esp + 0x14]
lea ecx, [0x637334]
lea eax, [ecx + eax + 0x34]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx*8]
mov dword [esp], eax
call fcn.0042cdc0
mov eax, dword [esp + 0xc]
inc eax
mov ecx, dword [esp + 8]
mov edx, ecx
cmp eax, 0x88
jge 0x4214df
jae 0x4214f9
shr edx, 1
and edx, 1
dec edx
neg edx
cmp edx, 2
jb 0x421478
jmp 0x4214ed
call fcn.0041eb30
call fcn.004263a0
add esp, 0x18
ret
mov eax, edx
mov ecx, 2
call fcn.0045f460
mov ecx, 0x88
call fcn.0045f450
lea eax, [0x551fb0]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00421420
Function at 0x4217a0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4219f9
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
lea ecx, [0x631124]
mov dword [esp], ecx
call fcn.00421110
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], cl
test cl, cl
jne 0x421809
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
mov dword [esp + 0x38], 0xffffffff
add esp, 0x34
ret
lea eax, [0x637200]
mov dword [esp], eax
call fcn.00420fc0
mov eax, dword [esp + 4]
test eax, eax
je 0x4218c0
mov dword [esp + 0x18], eax
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
call fcn.00401bc0
movzx eax, byte [esp + 4]
cmp al, 1
je 0x421857
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [esp + 0x28]
cmp edx, ecx
je 0x421809
lea ebx, [edx + 3]
cmp ecx, ebx
je 0x421809
jmp 0x421945
lea eax, [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00421690
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xc]
mov dword [esp + 0x14], eax
test cl, cl
je 0x421809
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.00421b50
movzx eax, byte [esp + 8]
test al, al
jne 0x4218a1
xor eax, eax
jmp 0x4218bc
nop
lea eax, [0x6372d8]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00401cd0
mov eax, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x4218da
lea eax, [0x631124]
mov dword [esp], eax
call fcn.004213b0
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, 0xffffffff
mov byte [esp + 0x12], cl
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x2c]
lea ebp, [0x631124]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov byte [esp + 8], bl
call fcn.00421190
movzx eax, byte [esp + 0x12]
test al, al
je 0x42192f
lea eax, [0x556274]
mov dword [esp], eax
call fcn.0045def0
nop
lea eax, [0x631100]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401e20
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
add esp, 0x34
ret
mov byte [esp + 0x13], al
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.004351d0
lea eax, [0x54e0c7]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00435e00
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x549910]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x5490c4]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54f618]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004217a0
Function at 0x421a10
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421b3d
sub esp, 0x1c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x78]
test edx, edx
jne 0x421a4f
mov edx, dword [ecx + 0x68]
test edx, edx
jne 0x421a4f
cmp dword [ecx], eax
jne 0x421b26
lea eax, [0x631124]
mov dword [esp], eax
call fcn.00421110
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], cl
test cl, cl
je 0x421afe
lea eax, [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00421690
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], ecx
test al, al
jne 0x421abc
mov eax, dword [esp + 0x14]
movzx ecx, byte [esp + 0x18]
lea edx, [0x631124]
mov dword [esp], edx
mov dword [esp + 4], eax
mov byte [esp + 8], cl
call fcn.00421190
jmp 0x421afe
lea eax, [esp + 0x10]
mov dword [esp], eax
mov byte [esp + 4], 0
call fcn.00421b50
mov eax, dword [esp + 0x14]
movzx ecx, byte [esp + 0x18]
lea edx, [0x631124]
mov dword [esp], edx
mov dword [esp + 4], eax
mov byte [esp + 8], cl
call fcn.00421190
add esp, 0x1c
ret
lea eax, [0x556278]
mov dword [esp], eax
call fcn.0045def0
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.00401c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
je 0x421b22
add ecx, 3
cmp eax, ecx
jne 0x421af0
add esp, 0x1c
ret
lea eax, [0x550247]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00421a10