joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417220
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4173c6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x4172da
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x4172cd
lea rsi, [0x0072b450]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x4172bd
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004622a0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.004372e0
call fcn.004372e0
lea rax, [0x005b87dc]
mov ebx, 0x39
nop
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
call fcn.004372e0
lea rax, [0x005b0e5e]
mov ebx, 0x18
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437a40
lea rax, [0x005ab02f]
mov ebx, 1
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.00437a40
lea rax, [0x005ab06d]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
lea rax, [0x005ab3c9]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041f320
lea rax, [0x005ab29a]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041f320
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x005b33b3]
mov ebx, 0x1f
nop dword [rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00417220
Function at 0x4174a0
Capabilities:
Access peb ldr_data
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41764b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x006e1068]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41750e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417521
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417545
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417559
cmp rbx, 0x1000
jae 0x417518
nop
jmp 0x4175c9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41756d
xor edx, edx
jmp 0x4175c0
mov rcx, qword [0x006e1068]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41754f
jmp 0x417535
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004372e0
lea rax, [0x005b0e46]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.004378e0
lea rax, [0x005b0f1f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b4078]
mov ebx, 0x21
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004174a0
Function at 0x417680
Capabilities:
Access peb ldr_data
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4178aa
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x006e1070]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4176fb
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41770e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417730
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417744
cmp rbx, 0x1000
jae 0x417705
jmp 0x4177ce
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417756
xor esi, esi
jmp 0x4177c0
mov rax, qword [0x006e1070]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41773a
jmp 0x417722
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417849
call fcn.004372e0
lea rax, [0x005b144c]
mov ebx, 0x19
call fcn.00437be0
mov rax, qword [rsp + 0x68]
call fcn.004378e0
lea rax, [0x005b0f1f]
mov ebx, 0x19
nop
call fcn.00437be0
mov eax, dword [rsp + 0x34]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ad33f]
mov ebx, 0xd
call fcn.00435b40
cmp eax, 0x5af
je 0x4177f3
call fcn.004372e0
lea rax, [0x005b144c]
mov ebx, 0x19
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.004378e0
lea rax, [0x005b0f1f]
mov ebx, 0x19
nop dword [rax]
call fcn.00437be0
mov eax, dword [rsp + 0x34]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b3600]
mov ebx, 0x1f
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417680
Function at 0x4178e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
neg rbx
mov rax, rcx
nop
call fcn.0042e700
mov rcx, qword [0x006e1068]
mov rdx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x417957
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.004372e0
lea rax, [0x005b0e46]
mov ebx, 0x18
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004378e0
lea rax, [0x005b0f1f]
mov ebx, 0x19
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b3a19]
mov ebx, 0x20
call fcn.00435b40
nop
int3

Function at 0x418a40
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418b17
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop dword [rax + rax]
cmp rbx, 0x4000
ja 0x418b05
cmp rbx, 8
mov edx, 8
cmovb rbx, rdx
mov qword [rax], rbx
cmp dword [0x007592a0], 0
jne 0x418a90
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
jmp 0x418aa8
lea rdx, [rax + 8]
mov r8, rdi
mov rdi, rdx
call fcn.00461ee0
lea rdi, [rax + 0x10]
call fcn.00461f60
movups xmmword [rax + 0x18], xmm15
mov dword [rax + 0x28], 0
test rbx, rbx
je 0x418afb
mov rcx, rax
mov eax, 0x4000
xor edx, edx
div rbx
imul rax, rbx
mov dword [rcx + 0x2c], eax
mov qword [rcx + 0x30], 0
cmp dword [0x007592a0], 0
jne 0x418ae4
mov qword [rcx + 0x38], rsi
jmp 0x418aed
lea rdi, [rcx + 0x38]
call fcn.00461f40
mov byte [rcx + 0x40], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
nop dword [rax + rax]
call fcn.004340c0
lea rax, [0x005b3a39]
mov ebx, 0x20
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00418a40
Function at 0x418b60
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418c6e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x418c41
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x418bc8
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x418bbb
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00462920
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x418bf8
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040db40
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x418c20
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004372e0
lea rax, [0x005b809b]
mov ebx, 0x34
call fcn.00437be0
call fcn.00437360
lea rax, [0x005b08cf]
mov ebx, 0x17
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00418b60
Function at 0x41cc00
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41ce90
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov edx, dword [0x0072b3f0]
mov rcx, qword [0x0072b6d0]
mov rsi, qword [0x0072b6c8]
cmp rbx, rcx
jae 0x41ce87
mov rbx, qword [rsi + rbx*8]
mov rsi, rbx
shr rbx, 0x14
cmp rbx, 0x40
jae 0x41ce7a
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x68], rax
lea rdi, [0x0072b450]
mov rbx, qword [rdi + rbx*8]
test byte [rbx], al
and esi, 0xfffff
mov rbx, qword [rbx + rsi*8]
mov qword [rsp + 0x50], rbx
test byte [rbx], al
xor ecx, ecx
jmp 0x41cc78
inc rcx
cmp rcx, 0x40
jge 0x41cc9f
lea rsi, [rbx + rcx]
lea rsi, [rsi + 0x21080]
mov sil, byte [rsi]
test sil, sil
je 0x41cc75
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2e], sil
xor edi, edi
jmp 0x41ccb0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41cc75
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41cca9
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41ce6d
mov r9, qword [rbx + r9*8 + 0x20000]
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41ce29
mov qword [rsp + 0x58], rcx
cmp byte [0x00758ff7], 0
jne 0x41cd15
mov r10d, dword [r9 + 0x58]
cmp r10d, edx
je 0x41cd15
lea r11d, [rdx + 3]
cmp r10d, r11d
jne 0x41cdd7
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x60], rax
nop
call fcn.0040b700
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x80]
jmp 0x41cd6d
nop
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.0040b920
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rsp + 0x2e]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41cca9
mov rdx, qword [rdx]
test rdx, rdx
je 0x41cd37
cmp byte [rdx + 0xa], 1
jne 0x41cd6a
movzx eax, word [rdx + 8]
mov rsi, qword [rcx + 0x68]
mov rdi, qword [rcx + 0x18]
test rsi, rsi
je 0x41cdd2
mov qword [rsp + 0x38], rdx
xor edx, edx
div rsi
imul rax, rsi
add rax, rdi
mov rbx, qword [rsp + 0x68]
nop
call fcn.0041e9c0
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + 0x10]
mov ebx, 8
mov rdi, qword [rsp + 0x68]
xor esi, esi
lea rcx, [0x006e1181]
call fcn.0041e820
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41cd6a
call fcn.004340c0
mov dword [rsp + 0x34], r10d
nop dword [rax]
call fcn.004372e0
lea rax, [0x005ab94b]
mov ebx, 6
call fcn.00437be0
mov eax, dword [rsp + 0x34]
call fcn.004378e0
nop
call fcn.00437500
mov eax, dword [rsp + 0x30]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ade1f]
mov ebx, 0x10
call fcn.00435b40
mov byte [rsp + 0x2f], r10b
call fcn.004372e0
lea rax, [0x005ac6a6]
mov ebx, 0xa
nop
call fcn.00437be0
movzx eax, byte [rsp + 0x2f]
movzx eax, al
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b681c]
mov ebx, 0x2b
call fcn.00435b40
mov rax, r9
mov ecx, 0x200
call fcn.004622a0
mov rax, rbx
mov ecx, 0x40
call fcn.004622a0
mov rax, rbx
call fcn.00462280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041cc00
Function at 0x41f760
Capabilities:
Delete volume shadow copies
Hash data using murmur3
Run powershell expression

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00758ff7], 0
jne 0x41f84f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41f845
lea rbx, [0x0072b450]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41f827
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.004622a0
lea rax, [0x005b6b52]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00435b40
nop
int3
Function at 0x420320
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42057d
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
cmp dword [0x0075902c], 0
nop
je 0x42056b
test rbx, rbx
je 0x420373
mov rdx, qword [rbx + 0x1238]
test rdx, rdx
je 0x420373
cmp qword [rdx + 0x10], 0
jne 0x42036c
mov rdx, qword [rbx + 0x1240]
cmp qword [rdx + 0x10], 0
je 0x420373
mov ecx, 1
jmp 0x4203a0
mov rdx, qword [0x007055c0]
test rdx, rdx
jne 0x420398
mov edx, dword [0x00705648]
cmp dword [0x0070564c], edx
jbe 0x420394
mov ecx, 1
jmp 0x4203a0
xor ecx, ecx
jmp 0x4203a0
mov ecx, 1
nop dword [rax]
test cl, cl
je 0x4203a6
jmp 0x4203b5
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov rdx, qword [0x00759110]
nop dword [rax]
test rdx, rdx
je 0x4203f1
mov rsi, rdx
sar rdx, 0x13
shl rdx, 3
nop
mov rdi, qword [rdx]
mov rcx, rax
mov rax, rsi
lea r8, [0x00759110]
lock cmpxchg qword [r8], rdi
sete sil
test sil, sil
je 0x4203b2
jmp 0x420400
mov rcx, rax
lea r8, [0x00759110]
xor edx, edx
nop dword [rax]
test rdx, rdx
je 0x420409
test byte [rcx], al
jmp 0x420415
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rsi, qword [rcx + 0xf8]
nop dword [rax]
test rsi, rsi
jle 0x420443
lea rdi, [rsi - 1]
mov rax, rsi
lock cmpxchg qword [rcx + 0xf8], rdi
sete dil
test dil, dil
je 0x420415
nop
test rsi, rsi
jg 0x420522
movsd xmm0, qword [rcx + 0x110]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x420466
nop word [rax + rax]
jnp 0x42050b
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x10], rdx
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x20]
sub rax, qword [rcx + 0xf0]
nop
test rax, rax
jle 0x4204f2
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov rsi, qword [rdx + 0x1220]
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [rcx + 0x110]
ucomisd xmm0, xmm1
jbe 0x4204f7
lea rax, [0x00759110]
mov rbx, qword [rsp + 0x10]
call fcn.0040b4a0
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov qword [rdx + 0x1228], 2
mov rdx, qword [rsp + 0x10]
jmp 0x42052f
mov rax, r8
mov rbx, rdx
call fcn.0040b4a0
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test byte [rbx], al
mov qword [rbx + 0x1228], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x18], rax
mov ebx, 4
mov ecx, 1
call fcn.00439ea0
cmp byte [0x0070b1f0], 0
je 0x42055c
mov rax, qword [rsp + 0x18]
xor ebx, ebx
call fcn.00454ae0
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005b8278]
mov ebx, 0x36
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00420320
Function at 0x4219e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421ab1
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x800000000000
lea rsi, [rdx + rbx]
add rdx, rcx
cmp rdx, rsi
jbe 0x421a17
nop
mov rdx, rcx
sub rcx, rbx
jmp 0x421a20
mov rdx, rcx
xor ecx, ecx
nop dword [rax]
test rcx, rcx
je 0x421a95
test rbx, 0x3fffff
jne 0x421a9f
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rdx
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov qword [rsp + 0x28], rcx
nop
mov rax, rcx
call fcn.0040b700
mov ecx, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
cmp dword [rdx + 0x100e8], ecx
jne 0x421a7f
lea rax, [rdx + 0x100c0]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
call fcn.0042d860
nop
nop
mov rax, qword [rsp + 0x28]
call fcn.0040b920
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x005b26bd]
mov ebx, 0x1c
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
nop dword [rax]
jmp fcn.004219e0
Function at 0x421b00
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x421d86
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x800000000000
lea r8, [rdx + rbx]
lea r9, [rdx + rcx]
cmp r9, r8
jbe 0x421b38
nop
mov r8, rcx
sub rcx, rbx
jmp 0x421b40
mov r8, rcx
xor ecx, ecx
nop dword [rax]
test rcx, rcx
je 0x421bed
test rbx, 0x3fffff
jne 0x421d70
mov qword [rsp + 0x80], rax
mov rdx, qword [0x00759180]
shr rdx, 0xd
cmp rdx, 1
mov r9d, 1
cmovb rdx, r9
mov qword [rsp + 0x30], rdx
mov rsi, rdi
shr rsi, 0xd
lea r9, [rsi + 1]
test rdi, 0x1fff
cmovne rsi, r9
mov qword [rsp + 0x38], rsi
mov rcx, r8
mov rdi, rdx
nop dword [rax]
call fcn.00421f40
test rax, rax
jne 0x421be3
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x58], xmm15
mov qword [rsp + 0x68], 0
lea rsi, [0x00421dc0]
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x60], rsi
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x68], rdi
jmp 0x421c3a
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
mov rcx, r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx + 0x10110]
nop
call fcn.0040b920
nop
mov rcx, qword [rsp + 0x40]
shl rcx, 0x16
movabs rdx, 0xffff800000000000
add rcx, rdx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x30]
movabs r8, 0x800000000000
lea r9, [r8 + rbx]
lea r10, [rcx + r8]
cmp r10, r9
jbe 0x421c5a
nop
mov r9, rcx
sub rcx, rbx
jmp 0x421c60
mov r9, rcx
xor ecx, ecx
nop
test rcx, rcx
je 0x421d57
mov rcx, qword [rsp + 0x58]
mov rax, rbx
mov rbx, r9
lea rdx, [rsp + 0x58]
call rcx
nop dword [rax + rax]
test bl, bl
je 0x421d4f
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rax, qword [rcx + 0x10110]
nop
nop
call fcn.0040b700
nop
mov rax, qword [rsp + 0x40]
mov rcx, rax
shr rax, 0xd
cmp rax, 0x2000
jae 0x421d66
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx + rax*8 + 0x78]
test byte [rsi], al
and ecx, 0x1fff
shl rcx, 7
lea rax, [rsi + rcx]
mov ebx, 0x1ff
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call fcn.00422620
test rbx, rbx
jbe 0x421bfc
mov qword [rsp + 0x28], rbx
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x40]
call fcn.00422120
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x10110]
nop
mov rax, rdx
call fcn.0040b920
mov rax, qword [rsp + 0x28]
shl rax, 0xd
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbx, qword [rsp + 0x50]
mov r9, rbx
xor eax, eax
mov rcx, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov ecx, 0x2000
call fcn.004622a0
lea rax, [0x005b6fac]
mov ebx, 0x2d
nop dword [rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00421b00
Function at 0x4224e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4225f7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx - 1]
test rcx, rbx
jne 0x4225b6
test rbx, rbx
je 0x4225b6
cmp rbx, 0x40
ja 0x422576
mov qword [rsp + 0x28], rax
mov ecx, 7
jmp 0x422538
mov rdx, qword [rsp + 0x10]
lea rcx, [rdx - 1]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rcx, rcx
jl 0x42256a
mov qword [rsp + 0x10], rcx
test byte [rax], al
mov rdx, qword [rax + rcx*8 + 0x40]
or rdx, qword [rax + rcx*8]
mov rax, rdx
call fcn.00422320
cmp rax, 0xffffffffffffffff
je 0x422525
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004372e0
lea rax, [0x005adaf6]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004378e0
call fcn.00437540
nop dword [rax + rax]
call fcn.00437360
lea rax, [0x005ad325]
mov ebx, 0xd
call fcn.00435b40
call fcn.004372e0
lea rax, [0x005adaf6]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004378e0
call fcn.00437540
nop dword [rax + rax]
call fcn.00437360
lea rax, [0x005b3f2e]
mov ebx, 0x21
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004224e0