joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f2d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6574a0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45da8b
je 0x45dade
cmp ebx, 0x20
jbe 0x45dae4
cmp ebx, 0x40
jbe 0x45db2a
jmp 0x45dbcb
test ebx, ebx
je 0x45dad4
add eax, 0x10
test ax, 0xff0
je 0x45dac0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x57e120]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x57e220]
jmp 0x45daa8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45daa8
pxor xmm1, xmmword [0x6574b0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6574b0]
pxor xmm2, xmmword [0x6574c0]
pxor xmm3, xmmword [0x6574d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6574b0]
pxor xmm2, xmmword [0x6574c0]
pxor xmm3, xmmword [0x6574d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45dc2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x657191], 0
je 0x45f2ea
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45da50
jmp fcn.00407c20
Function at 0x45f2f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4024be
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407c20
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045e000
jmp 0x402480
cmp byte [0x657191], 0
je 0x45f30b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45da50
jmp 0x402480

Function at 0x463590
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x463696
sub esp, 0x10
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46367d
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
call fcn.00463740
mov eax, dword [esp + 4]
test eax, eax
je 0x4635d7
lea ecx, [0x657198]
cmp eax, ecx
je 0x4635b5
jmp 0x463610
call fcn.0045c200
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
lea ecx, [0x657198]
mov dword [esp + 8], ecx
call fcn.0045b310
movzx eax, byte [esp + 0xc]
test al, al
jne 0x463631
call fcn.0045c220
lea ecx, [0x657198]
jmp 0x4635b5
cmp dword [esp + 0x18], eax
jne 0x463665
mov eax, dword [esp + 0x14]
add eax, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0045b2d0
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
lea ecx, [eax + 4]
mov edx, dword [esp + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0045b2d0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045b2d0
call fcn.0045c220
add esp, 0x10
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57da24]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57da1c]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00463590
Function at 0x4645a0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46469a
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
ja 0x464615
cmp ecx, 0x11
jne 0x4645ed
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4645dd
lea ecx, [0x57df44]
jmp 0x4645e1
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x12
jne 0x464681
mov eax, dword [eax + 0x20]
test eax, eax
je 0x464605
lea ecx, [0x57df44]
jmp 0x464609
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x15
jne 0x464639
mov eax, dword [eax + 0x24]
test eax, eax
je 0x464629
lea ecx, [0x57df44]
jmp 0x46462d
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x16
jne 0x46465d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x46464d
lea ecx, [0x57df44]
jmp 0x464651
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x17
jne 0x464681
mov eax, dword [eax + 0x20]
test eax, eax
je 0x464671
lea ecx, [0x57df44]
jmp 0x464675
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d704]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004645a0
Function at 0x464880
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4649e0
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x12
ja 0x464908
cmp eax, 0x11
je 0x4648f9
cmp eax, 0x12
jne 0x464975
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4649c7
mov eax, dword [eax + 4]
test eax, eax
je 0x4649c7
test ecx, 0x80
je 0x4648e1
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4648e5
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b3b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x46494d
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4649af
mov eax, dword [eax + 4]
test eax, eax
je 0x4649af
test ecx, 0x80
je 0x464935
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x464939
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b630
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x17
je 0x464966
cmp eax, 0x18
jne 0x464975
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x5394a0]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x54af48]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x536520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00464880
Function at 0x465bd0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x465c9d
sub esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [eax + 1]
test ecx, 1
jne 0x465c12
lea eax, [0x54f3ae]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.0045bf60
mov eax, dword [esp + 0x18]
test eax, 4
jne 0x465c1f
mov ecx, dword [esp + 0x14]
jmp 0x465c47
mov eax, dword [esp + 0x14]
test byte [eax], al
add eax, 4
mov dword [esp], eax
mov byte [esp + 4], 1
mov dword [esp + 8], 1
call fcn.0045c9e0
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, eax
sar eax, 3
test eax, eax
je 0x465c99
test edx, 7
jne 0x465c99
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], edx
lea eax, [edx - 8]
or eax, 2
mov dword [esp + 8], eax
call fcn.004636b0
movzx eax, byte [esp + 0xc]
test al, al
je 0x465c41
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp], eax
mov byte [esp + 4], 0
mov dword [esp + 8], 1
call fcn.0045c9e0
add esp, 0x10
ret
add esp, 0x10
ret
call fcn.0045e000
jmp fcn.00465bd0

Function at 0x466cd0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x466df1
sub esp, 0x20
mov eax, dword [esp + 0x24]
test byte [eax], al
mov ecx, eax
test eax, 7
jne 0x466cfd
lea eax, [ecx + 8]
jmp 0x466d06
lea edx, [ecx + 4]
mov ecx, edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov dword [esp], ecx
mov edx, dword [esp + 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
call fcn.004636f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jl 0x466dd8
test eax, eax
je 0x466d4e
mov edx, dword [esp + 0x28]
test edx, edx
jle 0x466d4a
cmp edx, ecx
je 0x466dc0
test ecx, ecx
jmp 0x466d50
test ecx, ecx
jmp 0x466d50
test ecx, ecx
jg 0x466d7a
test eax, eax
je 0x466d7a
mov edx, dword [esp + 0x18]
cmp dword [edx], eax
setne bl
cmp dword [edx + 4], ecx
setne cl
or ecx, ebx
test cl, cl
jne 0x466da8
mov dword [edx], 0
mov dword [edx + 4], 0
jmp 0x466da0
add esp, 0x20
ret
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov byte [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0045c9e0
mov eax, dword [esp + 0x14]
dec eax
test eax, eax
jne 0x466d7e
add esp, 0x20
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57da0c]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57da0c]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57da04]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00466cd0
Function at 0x488760
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x488892
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x48880c
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0045bcf0
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
cmp eax, 1
jg 0x4887dc
test eax, eax
jne 0x4887ae
xor eax, eax
xor ecx, ecx
jmp 0x488800
cmp eax, 1
jne 0x48883f
movzx eax, byte [esp + 0x1c]
test al, al
je 0x4887ce
mov eax, dword [0x630c00]
mov ecx, dword [0x630c04]
jmp 0x488800
lea eax, [0x57dc54]
lea ecx, [0x6572a0]
jmp 0x488800
cmp eax, 2
jne 0x4887ef
mov eax, dword [0x62c6a8]
mov ecx, dword [0x62c6ac]
jmp 0x488800
cmp eax, 3
jne 0x48883f
mov eax, dword [0x630c10]
mov ecx, dword [0x630c14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
add esp, 0x10
ret
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x21
lea ecx, [0x5500b0]
mov dword [eax], ecx
lea ecx, [0x57dac4]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
add esp, 0x10
ret
call fcn.004351d0
lea eax, [0x54a40f]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e00
mov eax, dword [esp + 0xc]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c00
call fcn.004353f0
call fcn.00435240
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d6fc]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00488760
Function at 0x48fdd0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48fe28
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x48fe03
call fcn.00486470
movzx eax, byte [esp]
test al, al
jne 0x48fe0f
call fcn.0045bfa0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0045c2d0
add esp, 8
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7c4]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.0048fdd0
Function at 0x498730
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49882a
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4987f2
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x498811
shl ecx, 4
lea edx, [0x629740]
mov ebx, dword [edx + ecx + 8]
mov ecx, dword [edx + ecx + 0xc]
test eax, eax
jge 0x498782
add ebx, 1
adc ecx, 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
call fcn.00491980
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shl eax, 7
mov ebx, edx
shr edx, 0x19
or edx, eax
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x1a935
sar eax, 0xf
mov edx, dword [esp + 0x28]
lea eax, [eax + edx - 6]
mov dword [esp + 0x34], eax
shl ebx, 7
mov eax, ecx
shr ecx, 0x19
or ecx, ebx
test ecx, ecx
sete cl
shl eax, 7
test eax, eax
sete al
and ecx, eax
mov byte [esp + 0x38], cl
add esp, 0x20
ret
mov eax, dword [esp + 0x24]
shl eax, 6
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffffa
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], 1
add esp, 0x20
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d9dc]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00498730
Function at 0x498840
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4989ff
sub esp, 0x40
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4989b5
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x4989e6
shl ecx, 4
lea edx, [0x629740]
lea esi, [edx + ecx]
lea edi, [esp + 0x30]
call fcn.0045fad8
test eax, eax
jge 0x4988a6
mov ecx, dword [esp + 0x30]
add ecx, 1
mov edx, dword [esp + 0x34]
mov dword [esp + 0x30], ecx
adc edx, 0
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00491980
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], esi
mov edi, dword [esp + 0x48]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x44]
mov dword [esp], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00491980
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ebx, eax
adc eax, edx
mov ebp, dword [esp + 0x10]
mov esi, edx
and edx, ebx
or esi, ebx
mov ebx, eax
not eax
and eax, esi
or eax, edx
shr eax, 0x1f
add eax, ebp
mov edx, dword [esp + 0x14]
adc edx, 0
mov ebp, ebx
shl ebx, 9
mov esi, ecx
shr ecx, 0x17
or ecx, ebx
test ecx, ecx
sete cl
shl esi, 9
test esi, esi
sete bl
mov esi, dword [esp + 0x50]
imul esi, esi, 0x1a935
sar esi, 0xf
mov edi, dword [esp + 0x4c]
lea esi, [esi + edi - 8]
nop
and ebx, ecx
test bl, bl
je 0x49898d
mov ecx, dword [esp + 0x2c]
test ecx, ecx
sete cl
mov ebx, dword [esp + 0x28]
test ebx, ebx
sete bl
and ebx, ecx
jmp 0x49898f
xor ebx, ebx
shl edx, 9
mov ecx, eax
shr eax, 0x17
or eax, edx
mov dword [esp + 0x58], eax
shl ecx, 9
shr ebp, 0x17
or ebp, ecx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x5c], esi
mov byte [esp + 0x60], bl
add esp, 0x40
ret
mov eax, dword [esp + 0x48]
shl eax, 8
mov ecx, dword [esp + 0x44]
mov edx, ecx
shr ecx, 0x18
or ecx, eax
mov dword [esp + 0x58], ecx
shl edx, 8
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff8
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], 1
add esp, 0x40
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d9e4]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00498840
Function at 0x4a0850
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a0a0a
sub esp, 0x3c
mov edx, dword [esp + 0x4c]
cmp edx, 8
ja 0x4a09f1
movzx ebx, byte [esp + 0x50]
test bl, bl
je 0x4a088d
mov ebp, dword [esp + 0x48]
cmp ebp, 4
je 0x4a0891
jmp 0x4a09d9
mov ebp, dword [esp + 0x48]
mov eax, ebp
mov ebp, dword [esp + 0x40]
mov ecx, ebp
mov ebp, dword [ebp + 0x1c]
add ebp, edx
cmp dword [0x6571ac], ebp
jl 0x4a08ae
mov ebp, dword [esp + 0x44]
xor esi, esi
jmp 0x4a08f3
mov byte [esp + 0x54], 0
add esp, 0x3c
ret
mov ebx, ecx
inc ecx
mov ebp, dword [esp + 0x40]
mov dword [ebp + 4], ecx
lea ecx, [ebx + ebx*2]
lea ecx, [edx + ecx*8]
mov edi, ecx
mov ebx, esi
lea esi, [esp + 0x24]
call fcn.0045fac4
inc dword [ebp + 0x1c]
mov ecx, dword [esp + 0x20]
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x4c]
mov eax, ebx
mov ecx, ebp
mov edx, dword [esp + 0x4c]
movzx ebx, byte [esp + 0x50]
mov ebp, dword [esp + 0x44]
cmp edx, esi
jle 0x4a09cb
test esi, esi
jl 0x4a09d4
cmp esi, 0x20
mov edi, edx
sbb edx, edx
mov ecx, esi
mov ebp, 1
shl ebp, cl
and ebp, edx
xchg ebp, eax
test bl, al
xchg ebp, eax
je 0x4a0922
mov edx, 3
jmp 0x4a0927
mov edx, 2
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x24]
xor eax, eax
call fcn.0045f5ea
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x48]
imul esi, ecx
mov eax, ebx
mov ebx, dword [esp + 0x44]
mov edi, ebx
add ebx, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ecx
mov ebx, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebx + 4]
lea ebp, [ecx + 1]
mov edx, dword [ebx]
mov ebx, dword [ebx + 8]
cmp ebx, ebp
jae 0x4a08b7
lea eax, [0x53f540]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004475d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x40]
mov dword [edi + 8], edx
mov edx, dword [0x6573b0]
test edx, edx
jne 0x4a09b2
mov dword [edi], eax
jmp 0x4a09b7
call fcn.0045f3d0
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov edx, eax
movzx eax, byte [esp + 0x50]
jmp 0x4a08b7
mov byte [esp + 0x54], 1
add esp, 0x3c
ret
call fcn.00432090
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8ac]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7cc]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a0850
Function at 0x4a1180
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xb8]
cmp eax, dword [ecx + 8]
jbe 0x4a138d
sub esp, 0x138
mov eax, dword [esp + 0x14c]
test eax, 0x200
je 0x4a1374
mov ecx, dword [esp + 0x144]
movzx edx, byte [ecx + 0xf]
mov byte [esp + 0x6f], dl
mov dword [esp], ecx
mov ebx, dword [esp + 0x148]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.004a75f0
mov eax, dword [esp + 0x14c]
and eax, 0x1e0
movzx edx, byte [esp + 0x6f]
and edx, 0x1f
or edx, eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
lea ebp, [0x57dfc0]
cmp ebx, ebp
jne 0x4a1358
mov dword [esp + 0x7c], eax
mov dword [esp + 0x74], edx
nop
lea ecx, [0x4a8210]
mov dword [esp + 0x70], ecx
lea edi, [esp + 0xdc]
mov edx, eax
xor eax, eax
call fcn.0045f5d9
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.004a40a0
lea edi, [esp + 0xdc]
lea esi, [esp + 0x10]
call fcn.0045fa1a
lea edi, [esp + 0x80]
lea esi, [esp + 0xdc]
call fcn.0045fa1a
lea ecx, [0x53c2c0]
mov dword [esp], ecx
call fcn.0040b1a0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x70]
mov dword [ecx], edx
mov edx, dword [0x6573b0]
mov eax, dword [esp + 0xd4]
test edx, edx
jne 0x4a128b
mov dword [ecx + 4], eax
jmp 0x4a1293
lea edi, [ecx + 4]
call fcn.0045f3d0
mov dword [esp + 0x78], ecx
mov edx, dword [esp + 0xc8]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x14c]
sar edx, 0xa
mov dword [ecx + 0x10], edx
mov ebp, dword [esp + 0x74]
mov dword [ecx + 0x1c], ebp
mov esi, dword [0x6573b0]
test esi, esi
jne 0x4a12d5
mov eax, dword [esp + 0x144]
mov dword [ecx + 0x14], eax
mov esi, dword [esp + 0x148]
mov dword [ecx + 0x18], esi
jmp 0x4a12fb
lea edi, [ecx + 0x14]
mov eax, dword [esp + 0x144]
call fcn.0045f3d0
lea edi, [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x148]
call fcn.0045f3d0
mov edi, eax
mov eax, esi
mov esi, edi
mov ecx, dword [esp + 0x13c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x140]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
call fcn.004a5340
mov eax, dword [esp + 0x7c]
test byte [eax], al
mov dword [esp + 0x150], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x14c]
and eax, 0x60
or eax, 0x13
mov dword [esp + 0x158], eax
add esp, 0x138
ret
mov dword [esp], ebx
lea eax, [0x545220]
mov dword [esp + 4], eax
lea eax, [0x5435e0]
mov dword [esp + 8], eax
call fcn.00408970
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d874]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a1180