joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bc20
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bd8c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043b420
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43bd41
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43bd41
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43bca6
cmp byte [rcx + 0xe8], 0
nop
je 0x43bd41
nop
nop
lea rax, [0x00759380]
call fcn.0040b700
cmp dword [0x007593a0], 0
nop dword [rax + rax]
je 0x43bd7a
mov rcx, qword [0x00759388]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x00759388], rdx
cmp byte [0x00759390], 0
je 0x43bcfd
mov byte [0x00759390], 0
lea rax, [0x00759398]
call fcn.0040ba00
nop
nop
lea rax, [0x00759380]
call fcn.0040b920
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43bd37
cmp byte [r14 + 0xb1], 0
je 0x43bd37
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043bdc0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43bd70
cmp byte [r14 + 0xb1], 0
je 0x43bd70
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005b649d]
mov ebx, 0x2a
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043bc20
Function at 0x43c200
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c48a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], bl
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
nop
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
nop
lea rax, [0x00705b78]
nop
call fcn.0040b700
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x43c260
call fcn.00443f80
test rax, rax
je 0x43c352
mov rcx, rax
nop
mov rdx, qword [0x00705b80]
test rdx, rdx
je 0x43c284
mov rbx, qword [rdx + 0x128]
mov qword [0x00705b80], rbx
dec dword [0x00705b88]
test rdx, rdx
mov qword [rsp + 0x28], rcx
jne 0x43c305
call fcn.004394e0
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x00705b78]
nop
call fcn.0040b920
movzx eax, byte [rsp + 0x50]
movzx eax, al
test rax, rax
mov eax, 0
lea rcx, [0x005c5d50]
cmovne rax, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
call fcn.0043bc20
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43c2fb
cmp byte [r14 + 0xb1], 0
je 0x43c2fb
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x30], rdx
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rcx, qword [rsp + 0x30]
cmp byte [rcx + 0xe4], 0
jne 0x43c478
cmp qword [rcx + 0xa8], 0
jne 0x43c467
movzx edx, byte [rsp + 0x50]
nop dword [rax]
test dl, dl
je 0x43c34e
mov rsi, qword [rsp + 0x28]
jmp 0x43c421
xor eax, eax
jmp 0x43c3cb
nop
nop
lea rax, [0x00705b78]
nop dword [rax + rax]
call fcn.0040b920
movzx ecx, byte [rsp + 0x50]
test cl, cl
je 0x43c384
mov ecx, 0xffffffff
lea rdx, [0x00705bbc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43c3ba
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43c3b0
cmp byte [r14 + 0xb1], 0
je 0x43c3b0
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x005b20a6]
mov ebx, 0x1b
call fcn.00435b40
mov byte [rcx + 0xe4], al
mov rdx, qword [rsp + 0x28]
mov qword [rcx + 0xa8], rdx
lea rax, [rcx + 0x118]
call fcn.0040ba00
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43c417
cmp byte [r14 + 0xb1], 0
je 0x43c417
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edi, dword [rsi + 0x190]
mov r8d, dword [rsi + 0x194]
mov r9, qword [rsi + 0x998]
mov r10d, dword [rsi + 0x194]
nop dword [rax]
cmp r10d, r8d
jne 0x43c421
cmp r8d, edi
jne 0x43c456
test r9, r9
jne 0x43c456
mov eax, edx
jmp 0x43c3cb
lea rax, [0x005b14c9]
mov ebx, 0x19
call fcn.00435b40
lea rax, [0x005adb23]
mov ebx, 0xf
call fcn.00435b40
lea rax, [0x005afb9e]
mov ebx, 0x15
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.0045fba0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0043c200
Function at 0x43c820
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ca5d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43ca4b
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43ca4b
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43c875
call fcn.00442320
call fcn.0043c4c0
mov eax, 1
call fcn.00442480
nop
call fcn.0043ad60
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43c8d4
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.004421a0
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.004372e0
lea rax, [0x005b69ca]
mov ebx, 0x2b
call fcn.00437be0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.004378e0
lea rax, [0x005b4b4e]
mov ebx, 0x24
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.004372e0
lea rax, [0x005adf5f]
mov ebx, 0x10
call fcn.00437be0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005ae997]
mov ebx, 0x13
call fcn.00437be0
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.004372e0
lea rax, [0x005adf2f]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.004379e0
lea rax, [0x005ae984]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00437be0
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b14e2]
mov ebx, 0x19
call fcn.00435b40
lea rax, [0x005b4180]
mov ebx, 0x21
call fcn.00435b40
nop
nop dword [rax]
call fcn.0045fba0
jmp fcn.0043c820
Function at 0x43cb40
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43cc17
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x00705c40], 0
nop
je 0x43cc05
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x43cb90
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x00705bbc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43cbf4
call fcn.00442320
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x00705b78]
call fcn.0040b700
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x00705c44]
lea ecx, [rax - 1]
mov dword [0x00705c44], ecx
cmp eax, 1
jne 0x43cbd4
lea rax, [0x00705c48]
call fcn.0040ba00
nop
nop
lea rax, [0x00705b78]
nop dword [rax]
call fcn.0040b920
call fcn.0043c0c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005b2471]
mov ebx, 0x1c
call fcn.00435b40
lea rax, [0x005b1d97]
mov ebx, 0x1b
call fcn.00435b40
nop
call fcn.0045fba0
nop dword [rax]
jmp fcn.0043cb40
Function at 0x43dfa0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e017
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
nop
je 0x43e005
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x00705bbc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43dfef
nop
call fcn.0043c7a0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b3e47]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435b40
lea rax, [0x005b35c2]
mov ebx, 0x1f
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.0043dfa0
Function at 0x43eee0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x43f14c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x0070b1f0], 0
je 0x43ef17
mov eax, 0x14
xor ebx, ebx
call fcn.00454a60
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x43f025
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x43ef5e
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.0044f6a0
test rax, rax
je 0x43f00f
movzx edx, byte [rax + 0x25]
test dl, 2
jne 0x43efb4
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043a2e0
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax]
call fcn.00439a00
call fcn.0043e340
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0044fe20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.004372e0
lea rax, [0x005b5392]
mov ebx, 0x25
call fcn.00437be0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00437be0
lea rax, [0x005ae4b9]
mov ebx, 0x12
call fcn.00437be0
call fcn.00437360
lea rax, [0x005ada9c]
mov ebx, 0xf
call fcn.00435b40
lea rax, [0x005afa78]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004372e0
lea rax, [0x005adf5f]
mov ebx, 0x10
call fcn.00437be0
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005ae997]
mov ebx, 0x13
call fcn.00437be0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004372e0
lea rax, [0x005adf2f]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x18]
call fcn.004379e0
lea rax, [0x005ae984]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00437be0
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ace25]
mov ebx, 0xc
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.00464340
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0043eee0
Function at 0x43f5c0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x43f609
nop word [rax + rax]
cmp qword [rcx + 0x50], rdx
je 0x43f609
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
movups xmmword [rdx + 0x58], xmm15
cmp qword [rdx + 0x50], 0
je 0x43f5ff
call fcn.00438e20
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b26a1]
mov ebx, 0x1c
call fcn.00435b40
nop
int3
Function at 0x4424e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4427ad
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x00758ff2], 0
nop
jne 0x44250b
cmp byte [0x00758ff0], 0
je 0x442515
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp dword [0x00759050], 0
nop dword [rax]
ja 0x442610
cmp byte [0x00758ff1], 0
jne 0x442538
cmp byte [0x00758fe9], 0
jne 0x44253c
xor ecx, ecx
jmp 0x44255e
mov eax, 1
call fcn.0043bb20
nop
cmp dword [0x00759018], 0
lea rcx, [0x007590e0]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x00705b88]
mov rbx, qword [0x00705b90]
sub rbx, qword [0x00705ba0]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x00705b8c]
sub ebx, edi
mov r8d, dword [0x00705b9c]
sub ebx, r8d
cmp ecx, ebx
jge 0x442597
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test ebx, ebx
jl 0x442705
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004427c0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.00438fa0
cmp qword [rsp + 0x20], 0
je 0x4426e5
cmp qword [0x007590e8], 0
je 0x4425fe
call fcn.00452fc0
test rbx, rbx
je 0x4425fe
mov qword [0x007590e8], rax
lea rax, [0x00705bb0]
jmp 0x442672
mov rcx, qword [0x00704f30]
mov rdx, qword [0x00704f38]
xor eax, eax
jmp 0x442620
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x44263f
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2288], 0
je 0x44261a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [r14 + 0x30]
mov dword [rcx + 0xc4], 0xffffffff
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
lea rax, [0x005b503f]
mov ebx, 0x25
call fcn.00435b40
test byte [rcx], al
lea rax, [rcx + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x442686
cmp rbx, rcx
jne 0x44266c
mov rcx, qword [rbx + 8]
mov qword [rax], rcx
nop
mov rcx, qword [0x00705b80]
test rcx, rcx
je 0x4426aa
mov rdx, qword [rcx + 0x128]
mov qword [0x00705b80], rdx
dec dword [0x00705b88]
test rcx, rcx
je 0x4426cf
nop
mov qword [rcx + 0xa8], rbx
lea rax, [rcx + 0x118]
nop dword [rax + rax]
call fcn.0040ba00
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x005b123f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435b40
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
lea rax, [0x005b831a]
mov ebx, 0x36
nop
call fcn.00435b40
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.004372e0
lea rax, [0x005b1fe9]
mov ebx, 0x1b
call fcn.00437be0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.004379e0
lea rax, [0x005ad3f6]
mov ebx, 0xe
call fcn.00437be0
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.004379e0
lea rax, [0x005abcad]
mov ebx, 8
call fcn.00437be0
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.004379e0
lea rax, [0x005ab9b4]
mov ebx, 7
call fcn.00437be0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.004379e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b2f12]
mov ebx, 0x1e
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.004424e0
Function at 0x443e60
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443f5c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x443e78
cmp edx, ecx
jne 0x443f4a
nop dword [rax]
test rsi, rsi
jne 0x443f4a
mov qword [rsp + 0x20], rax
call fcn.00443d60
mov rcx, qword [0x00704f98]
mov rdx, qword [0x00704f90]
mov rbx, qword [rsp + 0x20]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
nop dword [rax]
test edi, edi
jl 0x443f45
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
nop dword [rax]
cmp rax, rsi
jbe 0x443f3a
lea rax, [rdx + rsi*4]
lock or dword [rax], r9d
mov rax, qword [0x00705bb0]
mov qword [rbx + 8], rax
nop
mov qword [0x00705bb0], rbx
mov eax, 1
lea rcx, [0x00705bb8]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov rax, rsi
call fcn.00462280
call fcn.00434060
lea rax, [0x005b4962]
mov ebx, 0x23
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.00443e60
Function at 0x4441a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x3b8]
cmp r12, qword [r14 + 0x10]
jbe 0x444357
sub rsp, 0x438
mov qword [rsp + 0x430], rbp
lea rbp, [rsp + 0x430]
movups xmmword [rsp + 0x28], xmm15
mov edx, edi
lea rdi, [rsp + 0x30]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00462400
mov rbp, qword [rbp]
sub edx, ecx
shr edx, 1
nop word [rax + rax]
cmp edx, 0x80
jne 0x444345
xor esi, esi
jmp 0x444228
test byte [rax], al
lea edi, [rsi + rcx]
movzx edi, dil
mov rdi, qword [rax + rdi*8 + 0x198]
mov qword [rsp + rsi*8 + 0x28], rdi
inc esi
cmp esi, edx
jb 0x444210
lea esi, [rdx + rcx]
mov rdi, rax
mov eax, ecx
lock cmpxchg dword [rdi + 0x190], esi
sete sil
test sil, sil
je 0x44424e
mov qword [rsp + rdx*8 + 0x28], rbx
xor eax, eax
jmp 0x44426d
xor eax, eax
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
nop
ret
mov rsi, qword [rsp + rax*8 + 0x28]
mov qword [rbx + 0xa0], rsi
cmp eax, edx
jae 0x44428d
mov rbx, qword [rsp + rax*8 + 0x28]
test byte [rbx], al
inc eax
nop word [rax + rax]
cmp rax, 0x81
jb 0x444261
jmp 0x44433b
mov dword [rsp + 0x14], edx
movups xmmword [rsp + 0x18], xmm15
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + rdx*8 + 0x28]
mov qword [rsp + 0x20], rcx
nop
nop
lea rax, [0x00705b78]
call fcn.0040b700
nop
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
test rcx, rcx
je 0x4442fc
mov rbx, rcx
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x00705bc8]
nop
test rcx, rcx
je 0x4442ee
mov qword [rcx + 0xa0], rdx
jmp 0x4442f5
mov qword [0x00705bc0], rdx
mov qword [0x00705bc8], rbx
mov ecx, dword [0x00705bd0]
mov edx, dword [rsp + 0x14]
lea ecx, [rcx + rdx]
lea ecx, [rcx + 1]
mov dword [0x00705bd0], ecx
movups xmmword [rsp + 0x18], xmm15
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov eax, 1
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
ret
mov ecx, 0x81
call fcn.00462280
lea rax, [0x005b3098]
mov ebx, 0x1e
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.004441a0
Function at 0x448840
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x00759050], 0
je 0x44887f
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.004317c0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov dword [0x00759050], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.004372e0
lea rax, [0x005ac4e4]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.00437a40
call fcn.00437500
mov rax, qword [rsp + 0x30]
call fcn.00437a40
nop
call fcn.00437500
mov rax, qword [rsp + 0x28]
call fcn.00437a40
call fcn.00437500
mov rax, qword [rsp + 0x20]
call fcn.00437a40
nop
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.004372e0
lea rax, [0x005ab22b]
mov ebx, 3
call fcn.00437be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x4489cd
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x4489d2
cmp qword [rcx + 0x90], 0
je 0x4489d2
cmp byte [0x00758ff1], 0
je 0x4489c0
nop
call fcn.004372e0
lea rax, [0x005b7370]
mov ebx, 0x2e
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x4489d5
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
call fcn.004372e0
nop
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 1
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x006e1194]
mov rdx, qword [r14 + 0x30]
movzx edx, byte [rdx + 0xf9]
shr eax, 2
test dl, dl
cmovne eax, edx
test eax, eax
jle 0x448a5e
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
call fcn.00457700
mov rax, qword [rsp + 0x40]
call fcn.00458680
mov rax, qword [rsp + 0x68]
call fcn.00407b60
mov eax, 2
call fcn.004317c0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x4499e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x449b53
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x449b45
lea rdi, [0x0072b450]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and esi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and eax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x20000]
test byte [rdx], al
test byte [rsi], al
mov dl, byte [r8 + 0x63]
cmp dl, 2
jne 0x449b2f
mov qword [rsp + 0x18], r8
mov rdx, qword [r8 + 0x28]
nop
test rdx, rdx
jne 0x449aa5
movzx eax, bl
cmp rax, 2
jae 0x449b25
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdi
shl rax, 6
lea rcx, [0x00759640]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.004277c0
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x18]
mov rdx, rdi
mov rsi, qword [r8 + 0x28]
mov qword [rdi], rsi
mov qword [r8 + 0x28], rdx
movzx edx, word [r8 + 0x60]
lea esi, [rdx - 1]
mov word [r8 + 0x60], si
cmp dword [0x00759034], 0
jne 0x449b11
cmp dx, 1
jne 0x449b11
movzx eax, bl
cmp rax, 2
jae 0x449b1b
shl rax, 6
lea rcx, [0x00759640]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00427640
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 0x28], 0
lea rax, [0x0071b2c0]
mov ecx, 1
call fcn.00427220
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov ecx, 2
call fcn.00462280
mov ecx, 2
call fcn.00462280
lea rax, [0x005b3eaa]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435b40
mov rax, rdx
mov ecx, 0x40
call fcn.004622a0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.0045fba0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004499e0