joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bd60
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44bee9
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax], 0
nop dword [rax]
je 0x44bed7
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x44bdbe
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop dword [rax]
cmp rax, rdx
jne 0x44bec6
mov rsi, r14
cmp rsi, rdx
je 0x44bec6
cmp ecx, 2
jne 0x44bec6
cmp qword [rax + 0x70], 0
jne 0x44bddf
cmp byte [rax + 0xb4], 0
je 0x44bdd2
xor ecx, ecx
jmp 0x44bde1
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x44bde1
xor ecx, ecx
test cl, cl
je 0x44beb5
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x44be08
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x2b0], 0
jne 0x44bea4
cmp dword [0x007594f4], 0
jg 0x44be9a
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x138]
mov rax, rcx
call fcn.0044f6a0
test rax, rax
je 0x44be3e
cmp byte [rax + 0x24], 6
jne 0x44be3e
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rbx, rcx
mov rcx, rbx
shr rbx, 1
cmp rbx, 0x2000
jb 0x44be90
mov rsi, qword [rax + 0x38]
sub rdx, rsi
add rdx, 0x320
shr rcx, 2
cmp rcx, rdx
ja 0x44be81
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
call fcn.0044acc0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b1a5a]
mov ebx, 0x1a
call fcn.00435b40
lea rax, [0x005b0970]
mov ebx, 0x17
call fcn.00435b40
lea rax, [0x005b11c2]
mov ebx, 0x19
call fcn.00435b40
lea rax, [0x005b24e1]
mov ebx, 0x1c
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.0044bd60
Function at 0x44c740
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44c866
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046250b
mov rbp, qword [rbp]
lea rcx, [0x00598160]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44c850
lea rdx, [0x00759280]
lea rax, [0x006e8040]
jmp 0x44c7d2
mov rax, qword [rax + 0x220]
test rax, rax
je 0x44c7f4
nop word [rax + rax]
cmp qword [rax + 0x130], rdx
ja 0x44c7cb
cmp qword [rax + 0x100], rdx
jbe 0x44c7cb
jmp 0x44c7f6
xor eax, eax
test rax, rax
je 0x44c83f
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x128]
mov dword [0x00759280], ebx
mov dword [0x00759284], edx
mov dword [0x00759288], esi
mov dword [0x0075928c], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x005b6770]
mov ebx, 0x2b
call fcn.00435b40
lea rax, [0x005b8aa2]
mov ebx, 0x3d
nop dword [rax]
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.0044c740
Function at 0x44c880
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44cad7
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
test rcx, rcx
je 0x44c8b7
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x44ca88
xor edx, edx
xor esi, esi
xor edi, edi
nop dword [rax]
test rdx, rdx
je 0x44c985
cmp rdx, 1
jne 0x44c922
test rax, rax
je 0x44c8e0
mov rdx, rsi
mov esi, 1
jmp 0x44c927
cmp rcx, rsi
jbe 0x44ca70
mov rdx, rsi
shl rsi, 4
mov r8, qword [rbx + rsi]
mov rsi, qword [rbx + rsi + 8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x58]
mov r8, qword [r14 + 8]
cmp qword [r14], rsi
ja 0x44c91a
cmp rsi, r8
setb sil
jmp 0x44c91c
xor esi, esi
xor esi, 1
nop
jmp 0x44c927
mov rdx, rsi
xor esi, esi
test sil, sil
jne 0x44c969
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov rbx, rdi
nop
call fcn.0044cfc0
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x44c99b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov r8, qword [rsp + 0x80]
xor r9d, r9d
jmp 0x44c9b5
cmp rcx, rdx
jbe 0x44c993
shl rdx, 4
mov rax, qword [rbx + rdx]
mov rbx, qword [rbx + rdx + 8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
call fcn.00462280
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
add r8, 0x10
mov rcx, rsi
mov rsi, r9
mov r9, rdi
mov rdi, r11
mov r10, qword [r8 + 8]
cmp rdi, r10
mov r11, rdi
cmovg rdi, r10
mov r12, qword [r8]
cmp rcx, r12
jne 0x44c9d0
cmp r11, r10
jmp 0x44ca35
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x18], r10
mov rax, rcx
mov rbx, r12
mov rcx, rdi
call fcn.00462be0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jb 0x44ca65
lea rdi, [r9 + 1]
sub rsi, r10
sub r11, r10
mov r9, rsi
neg rsi
sar rsi, 0x3f
and r10, rsi
lea rsi, [rcx + r10]
cmp rdx, rdi
jg 0x44c9a5
nop dword [rax + rax]
jmp 0x44c99b
mov rax, r10
mov rcx, r11
call fcn.00462340
mov rax, rsi
call fcn.00462280
add rbx, 0x10
mov r10, rsi
mov rsi, r9
mov r9, r8
mov r8, r10
mov r10, qword [rbx + 8]
test r10, r10
jne 0x44ca9f
mov r10, r9
mov r9, rsi
mov rsi, r8
mov r8, r10
jmp 0x44caae
lea r8, [r9 + r10]
cmp r9, r8
jg 0x44cac5
inc rdi
mov r9, rsi
inc r9
cmp rcx, r9
jg 0x44ca78
mov rbx, rdx
mov rdx, rdi
mov rdi, r8
nop
jmp 0x44c8c0
lea rax, [0x005b2ca0]
mov ebx, 0x1d
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044c880
Function at 0x44f1c0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov ecx, ebx
mov rdx, qword [rax + 0xb0]
lea rbx, [rdx + rcx]
mov rsi, qword [rax + 0x140]
mov rdi, qword [rax + 0x138]
cmp rsi, 1
jle 0x44f1f4
xor r8d, r8d
jmp 0x44f205
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
add rdi, 0x18
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi]
cmp r11, rcx
ja 0x44f21a
cmp r9, rcx
ja 0x44f234
lea r12, [rsi - 1]
nop
cmp r8, r12
jne 0x44f22a
cmp r9, rcx
je 0x44f234
inc r8
cmp rsi, r8
jg 0x44f201
jmp 0x44f23b
lea rbx, [r10 + rcx]
sub rbx, r11
mov rcx, qword [rax + 0xb8]
cmp rbx, rcx
jbe 0x44f1f4
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rbx
call fcn.004372e0
lea rax, [0x005ae8a9]
mov ebx, 0x12
call fcn.00437be0
mov rax, qword [rsp + 0x10]
call fcn.00437a40
lea rax, [0x005ad412]
mov ebx, 0xe
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.00437a40
lea rax, [0x005ab135]
mov ebx, 3
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x18]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005b40fc]
mov ebx, 0x21
call fcn.00435b40
nop
int3
Function at 0x4506a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450818
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4506dc
test r8b, r8b
jne 0x4506dc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4506ef
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4507d8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x4507c6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x4507bc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x450743
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x450786
mov eax, 1
cmp rax, rbx
ja 0x450775
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00462340
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x4507b4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x45077d
mov r8d, eax
mov eax, r10d
jmp 0x450748
mov rcx, rbx
call fcn.00462280
xor eax, eax
mov rcx, rbx
call fcn.00462280
mov eax, r8d
mov rcx, rbx
call fcn.00462340
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45080e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x4507d1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4506f5
mov eax, edx
mov rcx, rbx
call fcn.00462280
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00462280
nop
int3
Function at 0x4512e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45144a
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
cmp dword [0x00759040], 0
jne 0x45131a
call fcn.0042ed80
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x451438
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rdi, qword [rdx + 0x2288]
mov r8, qword [rdx + 0x2280]
mov r9, qword [rdx + 0x2290]
lea rsi, [rdi + 1]
cmp r9, rsi
jb 0x451352
mov rax, rdi
jmp 0x4513a7
mov qword [rsp + 0x40], rdi
lea rax, [0x00574360]
mov rbx, r8
mov rcx, rdi
mov rdi, r9
call fcn.004490a0
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x2290], rcx
cmp dword [0x007592a0], 0
nop
jne 0x45138b
mov qword [rdx + 0x2280], rax
jmp 0x451397
lea rdi, [rdx + 0x2280]
call fcn.00461de0
mov rdi, rbx
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
lea rsi, [rdi + 1]
mov qword [rdx + 0x2288], rsi
lea rsi, [r8 + rdi*8]
cmp dword [0x007592a0], 0
jne 0x4513c5
mov qword [r8 + rdi*8], rbx
jmp 0x4513cd
mov rdi, rsi
call fcn.00461f20
mov rsi, qword [rdx + 0x2280]
mov rbx, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
mov rdi, rax
mov rax, rsi
call fcn.004530a0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x2288]
mov rsi, qword [rdx + 0x2280]
test rcx, rcx
jbe 0x451431
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x45141a
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1208], rax
mov eax, 1
lock xadd dword [rdx + 0x2298], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
call fcn.00462280
lea rax, [0x005b43bb]
mov ebx, 0x22
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004512e0
Function at 0x457b00
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457c6f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
call fcn.004372e0
lea rax, [0x005b2375]
mov ebx, 0x1c
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004379e0
lea rax, [0x005ab25e]
mov ebx, 3
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
xor edx, edx
jmp 0x457b9a
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
cmp rdx, rcx
jge 0x457bef
mov qword [rsp + 0x20], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.0044f6a0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x20]
test rcx, rcx
sete dl
xor edi, edi
mov esi, edi
mov ecx, edx
call fcn.00458260
test al, al
je 0x457b87
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x18]
call fcn.00457cc0
jmp 0x457b87
cmp qword [rsp + 0x68], 0x64
jne 0x457c12
call fcn.004372e0
lea rax, [0x005b3220]
mov ebx, 0x1f
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x80]
call fcn.0044f6a0
nop
test rax, rax
jne 0x457c29
xor ecx, ecx
jmp 0x457c4a
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edi, edi
mov esi, edi
call fcn.00458260
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x457c65
cmp qword [rsp + 0x78], 1
je 0x457c65
mov rcx, qword [rsp + 0x80]
nop
call fcn.004574e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00457b00
Function at 0x457f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45803b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00458080]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457f80
Function at 0x459200
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459466
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x459229
mov dword [rsp + 0x60], ebx
lea rcx, [0x006e8040]
jmp 0x459240
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x220]
nop dword [rax]
test rcx, rcx
je 0x459277
mov rdx, qword [rcx + 0x118]
cmp rax, rdx
jb 0x459235
mov rsi, qword [rcx + 0x120]
cmp rax, rsi
jae 0x459235
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x4593d6
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x007050a0]
call fcn.0040b700
mov rbx, qword [0x007050b0]
lea rax, [0x005843e0]
mov ecx, dword [rsp + 0x60]
nop dword [rax]
call fcn.004109a0
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x007050a0]
nop dword [rax + rax]
call fcn.0040b920
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x459336
call fcn.004372e0
lea rax, [0x005ae3a7]
mov ebx, 0x11
nop
call fcn.00437be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00437a40
lea rax, [0x005ab6ff]
mov ebx, 6
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.00437a40
lea rax, [0x005adb8f]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
lea rax, [0x006e8040]
jmp 0x4593c0
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x28], rdx
call fcn.004372e0
lea rax, [0x005abb82]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00437a40
lea rax, [0x005abc95]
mov ebx, 8
call fcn.00437be0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
nop dword [rax + rax]
test rax, rax
jne 0x459345
lea rax, [0x005b72b8]
mov ebx, 0x2e
call fcn.00435b40
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.004372e0
lea rax, [0x005ae3a7]
mov ebx, 0x11
call fcn.00437be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00437a40
lea rax, [0x005ad412]
mov ebx, 0xe
call fcn.00437be0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005ab135]
mov ebx, 3
call fcn.00437be0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005b40db]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.00459200
Function at 0x4594a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45972b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x4594ce
nop dword [rax]
cmp ebx, 0xffffffff
je 0x4594ce
lea rcx, [0x006e8040]
jmp 0x4594e1
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x220]
test rcx, rcx
je 0x4594fa
cmp qword [rcx + 0x118], rax
ja 0x4594da
cmp qword [rcx + 0x120], rax
jbe 0x4594da
jmp 0x4594fc
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x459568
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x210]
lea rax, [0x00584560]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.00410800
mov rax, qword [rax]
test rax, rax
jne 0x45955e
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x118]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x120]
cmp rcx, rax
jb 0x4596a5
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x007050a0]
call fcn.0040b700
mov rbx, qword [0x007050b0]
lea rax, [0x005843e0]
mov ecx, dword [rsp + 0x60]
call fcn.00410800
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x007050a0]
call fcn.0040b920
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x459613
call fcn.004372e0
lea rax, [0x005ae3eb]
mov ebx, 0x11
call fcn.00437be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00437a40
lea rax, [0x005ab6ff]
mov ebx, 6
call fcn.00437be0
mov rax, qword [rsp + 0x18]
call fcn.00437a40
lea rax, [0x005adb8f]
mov ebx, 0x10
nop dword [rax]
call fcn.00437be0
call fcn.00437360
lea rax, [0x006e8040]
jmp 0x45968b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.004372e0
lea rax, [0x005abb82]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437a40
lea rax, [0x005abc95]
mov ebx, 8
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x220]
test rax, rax
jne 0x45961d
lea rax, [0x005b7342]
mov ebx, 0x2e
nop dword [rax]
call fcn.00435b40
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.004372e0
lea rax, [0x005ae3eb]
mov ebx, 0x11
call fcn.00437be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00437a40
lea rax, [0x005ad412]
mov ebx, 0xe
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437a40
lea rax, [0x005ab135]
mov ebx, 3
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005b411d]
mov ebx, 0x21
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.004594a0
Function at 0x459760
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45993b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp ebx, 0xffffffff
je 0x459786
lea rcx, [0x006e8040]
jmp 0x4597a0
lea rax, [0x0040b460]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x220]
nop
test rcx, rcx
je 0x4597b9
cmp qword [rcx + 0x118], rax
ja 0x459797
cmp qword [rcx + 0x120], rax
jbe 0x459797
jmp 0x4597c0
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
jne 0x459891
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x58], ebx
nop
nop
nop
lea rax, [0x007050a0]
nop dword [rax]
call fcn.0040b700
mov rbx, qword [0x007050b0]
lea rax, [0x005843e0]
mov ecx, dword [rsp + 0x58]
call fcn.00410800
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x007050a0]
call fcn.0040b920
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x459887
nop dword [rax]
call fcn.004372e0
lea rax, [0x005ae3da]
mov ebx, 0x11
call fcn.00437be0
mov eax, dword [rsp + 0x58]
movsxd rax, eax
nop dword [rax]
call fcn.00437a40
lea rax, [0x005ab6ff]
mov ebx, 6
call fcn.00437be0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005adb8f]
mov ebx, 0x10
call fcn.00437be0
call fcn.00437360
lea rax, [0x006e8040]
jmp 0x459920
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
call fcn.0044f1c0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.004372e0
lea rax, [0x005abb82]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005abc95]
mov ebx, 8
call fcn.00437be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x220]
nop dword [rax + rax]
test rax, rax
jne 0x4598a3
lea rax, [0x005b7314]
mov ebx, 0x2e
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.00459760