joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4213f0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4214ea
sub esp, 0x18
jmp 0x421411
inc dword [0x658030]
call fcn.00421770
cmp dword [esp], 0xffffffff
jne 0x42140b
nop
lea eax, [0x658034]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, 0x7fffffff
jne 0x4214d3
mov edx, dword [0x65e190]
mov dword [esp + 8], edx
xor eax, eax
jmp 0x421497
mov dword [esp + 0xc], eax
shl eax, 7
mov dword [esp + 0x14], eax
lea ebx, [0x65e234]
lea ebp, [ebx + eax]
lea edx, [edx + edx*2]
mov dword [esp + 0x10], edx
lea ebp, [ebp + edx*8 + 4]
mov dword [esp], ebp
call fcn.0042cd90
mov eax, dword [esp + 0x14]
lea ecx, [0x65e234]
lea eax, [ecx + eax + 0x34]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx*8]
mov dword [esp], eax
call fcn.0042cd90
mov eax, dword [esp + 0xc]
inc eax
mov ecx, dword [esp + 8]
mov edx, ecx
cmp eax, 0x88
jge 0x4214af
jae 0x4214c9
shr edx, 1
and edx, 1
dec edx
neg edx
cmp edx, 2
jb 0x421448
jmp 0x4214bd
call fcn.0041eb00
call fcn.00426370
add esp, 0x18
ret
mov eax, edx
mov ecx, 2
call fcn.0045f4e0
mov ecx, 0x88
call fcn.0045f4d0
lea eax, [0x566924]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004213f0
Function at 0x421770
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4219c9
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
lea ecx, [0x658034]
mov dword [esp], ecx
call fcn.004210e0
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], cl
test cl, cl
jne 0x4217d9
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
mov dword [esp + 0x38], 0xffffffff
add esp, 0x34
ret
lea eax, [0x65e100]
mov dword [esp], eax
call fcn.00420f90
mov eax, dword [esp + 4]
test eax, eax
je 0x421890
mov dword [esp + 0x18], eax
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
call fcn.00401b90
movzx eax, byte [esp + 4]
cmp al, 1
je 0x421827
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [esp + 0x28]
cmp edx, ecx
je 0x4217d9
lea ebx, [edx + 3]
cmp ecx, ebx
je 0x4217d9
jmp 0x421915
lea eax, [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00421660
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xc]
mov dword [esp + 0x14], eax
test cl, cl
je 0x4217d9
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.00421b20
movzx eax, byte [esp + 8]
test al, al
jne 0x421871
xor eax, eax
jmp 0x42188c
nop
lea eax, [0x65e1d8]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00401ca0
mov eax, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x4218aa
lea eax, [0x658034]
mov dword [esp], eax
call fcn.00421380
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, 0xffffffff
mov byte [esp + 0x12], cl
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x2c]
lea ebp, [0x658034]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov byte [esp + 8], bl
call fcn.00421160
movzx eax, byte [esp + 0x12]
test al, al
je 0x4218ff
lea eax, [0x57136c]
mov dword [esp], eax
call fcn.0045df70
nop
lea eax, [0x658010]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401df0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
add esp, 0x34
ret
mov byte [esp + 0x13], al
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.00435250
lea eax, [0x562790]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00435e80
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55dedb]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55d6b0]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x563e1a]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00421770
Function at 0x4219e0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421b0d
sub esp, 0x1c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x78]
test edx, edx
jne 0x421a1f
mov edx, dword [ecx + 0x68]
test edx, edx
jne 0x421a1f
cmp dword [ecx], eax
jne 0x421af6
lea eax, [0x658034]
mov dword [esp], eax
call fcn.004210e0
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], cl
test cl, cl
je 0x421ace
lea eax, [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00421660
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], ecx
test al, al
jne 0x421a8c
mov eax, dword [esp + 0x14]
movzx ecx, byte [esp + 0x18]
lea edx, [0x658034]
mov dword [esp], edx
mov dword [esp + 4], eax
mov byte [esp + 8], cl
call fcn.00421160
jmp 0x421ace
lea eax, [esp + 0x10]
mov dword [esp], eax
mov byte [esp + 4], 0
call fcn.00421b20
mov eax, dword [esp + 0x14]
movzx ecx, byte [esp + 0x18]
lea edx, [0x658034]
mov dword [esp], edx
mov dword [esp + 4], eax
mov byte [esp + 8], cl
call fcn.00421160
add esp, 0x1c
ret
lea eax, [0x571370]
mov dword [esp], eax
call fcn.0045df70
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.00401be0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
je 0x421af2
add ecx, 3
cmp eax, ecx
jne 0x421ac0
add esp, 0x1c
ret
lea eax, [0x564b0a]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004219e0
Function at 0x4235b0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4236ad
sub esp, 8
nop
lea eax, [0x658290]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [0x658244]
test eax, eax
setne al
mov ecx, dword [0x658240]
test ecx, ecx
setne cl
or eax, ecx
test al, al
jne 0x423696
mov dword [0x658248], 0
mov dword [0x65824c], 0
mov eax, dword [0x65829c]
test eax, eax
jne 0x423635
nop
nop
lea eax, [0x658290]
mov dword [esp], eax
call fcn.00409310
add esp, 8
ret
lea ecx, [0x658294]
mov dword [eax + 8], ecx
mov eax, dword [eax]
test eax, eax
jne 0x42362a
mov eax, dword [0x658294]
test eax, eax
je 0x423668
mov ecx, dword [0x6582a0]
mov dword [ecx], eax
mov eax, dword [0x658294]
mov ecx, dword [0x6582a0]
mov dword [eax + 4], ecx
mov eax, dword [0x65829c]
mov dword [0x658294], eax
jmp 0x423680
mov eax, dword [0x6582a0]
mov ecx, dword [0x65829c]
mov dword [0x658294], ecx
mov dword [0x658298], eax
mov dword [0x65829c], 0
mov dword [0x6582a0], 0
jmp 0x423616
lea eax, [0x565ee2]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004235b0

Function at 0x424480
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4245cb
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor edx, edx
jmp 0x4244b4
sub ebp, ecx
lea ecx, [ebp + edx]
shr ebp, 0xd
sub esi, ebp
mov eax, esi
mov edx, ebx
test eax, eax
jbe 0x42454c
mov ebx, dword [esp + 0x2c]
mov ebp, dword [ebx + 0xdc]
test byte [ebp], al
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x14], ecx
shr ecx, 0x16
mov ecx, dword [ebp + ecx*4]
test byte [ecx], al
add ecx, 0x408c4
mov dword [esp + 0x24], ecx
mov dword [esp], ecx
call fcn.00401c50
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, ecx
and ecx, 0x3fffff
cmp eax, ecx
seta bl
mov ebp, dword [esp + 0x20]
mov esi, ebp
shl ebp, 0xd
add ebp, ecx
movzx edi, byte [esp + 0x13]
or ebx, edi
cmp ebp, 0x400000
jbe 0x424524
mov ebp, 0x400000
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
mov byte [esp + 0x13], bl
jmp 0x424567
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
jmp 0x4244a5
mov byte [esp + 0x38], dl
add esp, 0x28
ret
mov ecx, edx
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp ebp, eax
jbe 0x4244a5
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
jne 0x424532
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00401c50
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jb 0x4245ae
mov edx, dword [esp + 0x1c]
cmp eax, edx
jbe 0x424554
jmp 0x4245b4
mov edx, dword [esp + 0x1c]
jmp 0x424554
lea eax, [0x5677f9]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00424480
Function at 0x4256a0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4257f0
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x18]
cmp edx, ecx
jne 0x425706
cmp dword [edx], eax
jne 0x4256d2
mov ecx, dword [eax]
mov dword [edx], ecx
jmp 0x4256d9
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [ecx], ebx
cmp dword [edx + 4], eax
jne 0x4256e6
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4256ee
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
add esp, 0x14
ret
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
call fcn.00435250
lea eax, [0x566c45]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55ca2e]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435e40
lea eax, [0x55ca28]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00435e40
lea eax, [0x55da61]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435e40
lea eax, [0x55ca04]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435e40
call fcn.00435470
call fcn.004352c0
lea eax, [0x55f0bb]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004256a0

Function at 0x425800
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4258dd
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x425854
mov edx, dword [eax + 4]
test edx, edx
jne 0x425854
mov edx, dword [eax + 8]
test edx, edx
jne 0x425854
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx]
test edx, edx
je 0x425848
mov dword [edx + 4], eax
jmp 0x42584b
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [eax + 8], ecx
add esp, 0x14
ret
mov ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esp + 8], edx
call fcn.00435250
lea eax, [0x564762]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00435e80
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435e40
call fcn.00435430
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435e40
call fcn.00435430
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435e40
call fcn.00435430
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00435e40
call fcn.00435470
call fcn.004352c0
lea eax, [0x55f0ab]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00425800
Function at 0x4259f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425b60
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423a50
mov eax, dword [esp + 4]
test eax, eax
je 0x425b49
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004219e0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409110
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x425a87
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x425aed
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x425a9c
cmp byte [ebp + 6], dl
je 0x425aa7
cmp esi, ebx
ja 0x425aed
jne 0x425a85
cmp byte [ebp + 6], dl
jbe 0x425a85
jmp 0x425aed
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409310
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425ae4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425ae4
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.004258f0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409310
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425b40
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425b40
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x56330a]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004259f0
Function at 0x425b70
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425c8a
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423a50
mov eax, dword [esp + 4]
test eax, eax
je 0x425c73
mov dword [esp + 8], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004219e0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
lea edx, [ecx + 0x48]
mov dword [esp + 0x18], edx
nop
mov dword [esp], edx
call fcn.00409110
mov eax, dword [esp + 8]
lea ecx, [eax + 0x4c]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0x24]
jmp 0x425bfb
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x425c15
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x425bf9
cmp byte [ebp + 6], bl
jne 0x425bf9
mov edx, dword [ebp]
mov dword [ecx], edx
jmp 0x425c17
xor ebp, ebp
mov dword [esp + 0xc], ebp
mov ecx, dword [eax + 0x4c]
test ecx, ecx
jne 0x425c2a
mov dword [esp], eax
call fcn.00425970
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409310
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425c67
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425c67
mov dword [eax + 8], 0xfffffade
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
lea eax, [0x5641cd]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00425b70
Function at 0x425ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425e93
sub esp, 0x28
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409110
lea eax, [0x662684]
mov dword [esp], eax
call fcn.004144d0
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x6626fc]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x425d0c
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
jmp 0x425d19
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.0045f450
mov eax, ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x425d3e
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
jmp 0x425d5c
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.0045f450
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.0045f450
mov eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004259f0
movzx eax, byte [esp + 8]
test al, al
je 0x425e45
mov eax, dword [0x67e128]
test eax, eax
je 0x425e3c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040f990
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0x954]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.0041b040
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x63c1c8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.0041af10
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425e3c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425e3c
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x40], 1
add esp, 0x28
ret
nop
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409110
nop
mov eax, dword [0x6626a0]
sub eax, dword [0x662684]
mov dword [0x6626a0], eax
mov eax, dword [0x662690]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x662690], ecx
nop
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409310
mov byte [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045e080
jmp fcn.00425ca0
Function at 0x425fd0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4260ec
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x426065
cmp cl, 2
je 0x42600d
cmp cl, 3
jne 0x4260d5
mov byte [eax + 8], 1
jmp 0x4260d1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042b520
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409110
nop
mov eax, dword [0x6626c8]
sub eax, dword [0x6626ac]
mov dword [0x6626c8], eax
mov eax, dword [0x6626b8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x6626b8], ecx
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409310
jmp 0x4260d1
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413630
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409110
nop
mov eax, dword [0x6626a0]
sub eax, dword [0x662684]
mov dword [0x6626a0], eax
mov eax, dword [0x662690]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x662690], ecx
nop
nop
lea eax, [0x6626fc]
mov dword [esp], eax
call fcn.00409310
add esp, 0x14
ret
lea eax, [0x55efdb]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00425fd0

Function at 0x426420
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4264d7
sub esp, 0x14
mov eax, dword [0x67e2e4]
test eax, eax
je 0x426466
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 4]
mov dword [0x67e2e4], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x10000
call fcn.0045fba0
mov eax, dword [esp + 0xc]
jmp 0x4264ab
nop
lea eax, [0x67e2e0]
mov dword [esp], eax
call fcn.00409310
mov dword [esp], 0x10000
lea eax, [0x67fb18]
mov dword [esp + 4], eax
call fcn.00413070
mov eax, dword [esp + 8]
test eax, eax
je 0x4264c0
mov dword [esp + 0x10], eax
nop
nop
lea eax, [0x67e2e0]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [esp + 0x10]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 0x18], eax
add esp, 0x14
ret
lea eax, [0x563ef3]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00426420
Function at 0x4264f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426639
sub esp, 0xc
mov ecx, dword [0x63c7b0]
cmp ecx, 0x12
ja 0x42659d
mov ecx, dword [esp + 0x10]
test byte [ecx], al
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x426534
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x84], eax
jmp 0x426543
lea edi, [ecx + 0x84]
mov eax, dword [esp + 0x18]
call fcn.0045f450
lea edx, [ecx + 0x40]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0042c080
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00428370
mov eax, dword [0x63c230]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x34], eax
mov eax, dword [0x67e2d0]
test eax, eax
jne 0x426581
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x80], eax
jmp 0x426590
lea edi, [ecx + 0x80]
mov eax, dword [esp + 0x14]
call fcn.0045f450
mov eax, dword [0x63c230]
mov dword [ecx + 0x78], eax
add esp, 0xc
ret
mov dword [esp + 8], ecx
call fcn.00435250
lea eax, [0x5642ad]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00435e80
mov ecx, dword [esp + 8]
cmp ecx, 0x20
sbb eax, eax
mov edx, 1
shl edx, cl
and edx, eax
mov eax, edx
sar edx, 0x1f
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00435c80
call fcn.00435470
call fcn.004352c0
call fcn.00435250
lea eax, [0x563670]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00435e80
mov dword [esp + 4], 0
mov dword [esp], 0x40000
call fcn.00435c80
call fcn.00435470
call fcn.004352c0
lea eax, [0x566775]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004264f0