joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1f70
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2001
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
jne 0x4a1fa0
mov eax, dword [eax + 0x24]
mov dword [esp + 0x24], eax
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x55028b]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x22
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a1f70

Function at 0x4a2010
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2152
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
ja 0x4a2085
cmp ecx, 0x11
jne 0x4a205d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a204d
lea ecx, [0x57dfc0]
jmp 0x4a2051
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
cmp ecx, 0x12
jne 0x4a20f1
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a2075
lea ecx, [0x57dfc0]
jmp 0x4a2079
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
cmp ecx, 0x15
jne 0x4a20a9
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4a2099
lea ecx, [0x57dfc0]
jmp 0x4a209d
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
cmp ecx, 0x16
jne 0x4a20cd
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a20bd
lea ecx, [0x57dfc0]
jmp 0x4a20c1
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
cmp ecx, 0x17
jne 0x4a20f1
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a20e1
lea ecx, [0x57dfc0]
jmp 0x4a20e5
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54f282]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a2010
Function at 0x4a2230
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2326
sub esp, 0x1c
mov ebp, dword [esp + 0x20]
movzx esi, byte [ebp + 0xf]
and esi, 0x1f
cmp esi, 0x13
jne 0x4a22c5
movzx esi, byte [ebp + 0xc]
xchg esi, eax
test al, 1
xchg esi, eax
je 0x4a226b
mov eax, 0x34
jmp 0x4a2270
mov eax, 0x24
movzx esi, word [ebp + 0x20]
test si, si
jne 0x4a227f
xor edx, edx
xor ebp, ebp
jmp 0x4a228c
movzx edx, si
add ebp, eax
cmp edx, 0x100000
ja 0x4a22bb
mov eax, dword [esp + 0x24]
cmp eax, edx
jae 0x4a22b4
mov eax, dword [ebp + eax*4]
test eax, eax
je 0x4a22a4
lea ecx, [0x57dfc0]
jmp 0x4a22a8
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
add esp, 0x1c
ret
mov ecx, edx
call fcn.0045f450
mov ebx, 0x100000
call fcn.0045f4d0
mov dword [esp], ebp
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54edc5]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a2230

Function at 0x4a2330
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a23d9
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x15
jne 0x4a2378
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a2368
lea ecx, [0x57dfc0]
jmp 0x4a236c
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54ede2]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a2330
Function at 0x4a23f0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2481
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x11
jne 0x4a2420
mov eax, dword [eax + 0x28]
mov dword [esp + 0x24], eax
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54f6b3]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1f
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a23f0

Function at 0x4a2530
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a25c6
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x13
jne 0x4a2565
movzx eax, word [eax + 0x20]
mov dword [esp + 0x24], eax
add esp, 0x1c
ret
mov dword [esp], eax
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54f92c]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a2530

Function at 0x4a25d0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a26a0
sub esp, 0x1c
mov ebp, dword [esp + 0x20]
movzx esi, byte [ebp + 0xf]
and esi, 0x1f
cmp esi, 0x13
jne 0x4a263f
movzx esi, word [ebp + 0x22]
and esi, 0x7fff
test si, si
jne 0x4a260c
xor edx, edx
jmp 0x4a2626
movzx ebp, word [ebp + 0x20]
add esi, ebp
movzx edx, si
cmp edx, 0x100000
ja 0x4a2635
movzx eax, bp
cmp eax, edx
ja 0x4a262e
sub edx, eax
mov dword [esp + 0x24], edx
add esp, 0x1c
ret
mov ecx, edx
call fcn.0045f500
mov ebx, 0x100000
call fcn.0045f4d0
mov dword [esp], ebp
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54fe3d]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x21
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a25d0
Function at 0x4a26b0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a27d5
sub esp, 0x1c
mov ebp, dword [esp + 0x20]
movzx esi, byte [ebp + 0xf]
and esi, 0x1f
cmp esi, 0x13
jne 0x4a2774
movzx esi, byte [ebp + 0xc]
xchg esi, eax
test al, 1
xchg esi, eax
je 0x4a26ef
mov eax, 0x34
jmp 0x4a26f4
mov eax, 0x24
movzx esi, word [ebp + 0x22]
and esi, 0x7fff
test si, si
jne 0x4a2709
xor ebx, ebx
xor edx, edx
jmp 0x4a2735
movzx edi, word [ebp + 0x20]
add esi, edi
movzx edx, si
add ebp, eax
cmp edx, 0x100000
ja 0x4a276a
movzx eax, di
cmp eax, edx
ja 0x4a2763
sub edx, eax
mov ebx, edx
neg edx
shl eax, 2
sar edx, 0x1f
and eax, edx
lea edx, [ebp + eax]
mov eax, dword [esp + 0x24]
cmp eax, ebx
jae 0x4a275c
mov eax, dword [edx + eax*4]
test eax, eax
je 0x4a274c
lea ecx, [0x57dfc0]
jmp 0x4a2750
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
add esp, 0x1c
ret
mov ecx, ebx
call fcn.0045f450
mov ecx, edx
call fcn.0045f500
mov ebx, 0x100000
call fcn.0045f4d0
mov dword [esp], ebp
call fcn.004a1c10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x54f2be]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a26b0
Function at 0x4a2af0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2c37
sub esp, 0x14
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045f5e3
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jl 0x4a2c1e
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0x24]
cmp dword [eax + 0x28], ecx
jle 0x4a2c1e
lea ebx, [ecx + ecx*2]
mov ebp, dword [edx + ebx*4 + 4]
test ebp, ebp
je 0x4a2b43
lea esi, [0x57dfc0]
jmp 0x4a2b47
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebp
mov eax, dword [edx + ebx*4]
mov dword [esp], eax
call fcn.004a13a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + eax*4 + 8]
test edx, 1
setne dl
mov byte [esp + 0x50], dl
mov edx, dword [ecx + eax*4]
movzx edx, byte [edx]
test dl, 1
jne 0x4a2bbd
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call fcn.004a13a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + eax*4]
mov dword [esp], edx
call fcn.004a1450
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test eax, eax
je 0x4a2bdc
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + eax*4 + 8]
shr eax, 1
mov dword [esp + 0x40], eax
lea eax, [0x532e60]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], 1
add esp, 0x14
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d884]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a2af0
Function at 0x4a4ea0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a4f9b
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4a4f3a
test eax, 0x60
jne 0x4a4ecc
add esp, 0x2c
ret
call fcn.004a4e30
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x54900e]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x551f84]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2c
call fcn.0044cec0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
call fcn.004a4e30
mov eax, dword [esp]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], ecx
lea edx, [0x539800]
mov dword [esp], edx
call fcn.0040b1a0
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
mov eax, dword [0x6573b0]
test eax, eax
jne 0x4a4f90
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov dword [edi + 8], 0
lea eax, [0x5367c0]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.004332d0
mov eax, dword [esp + 0x28]
call fcn.0045f3d0
jmp 0x4a4f77
call fcn.0045e000
jmp fcn.004a4ea0
Function at 0x4a4fb0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a5124
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4a50c3
test eax, 0x60
jne 0x4a5055
test eax, 0x100
je 0x4a4fe7
add esp, 0x2c
ret
call fcn.004a4e30
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x54900e]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x54dd05]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x1a
call fcn.0044cec0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
call fcn.004a4e30
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x54900e]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x551f84]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2c
call fcn.0044cec0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x535040]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
call fcn.004a4e30
mov eax, dword [esp]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], ecx
lea edx, [0x539800]
mov dword [esp], edx
call fcn.0040b1a0
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
mov eax, dword [0x6573b0]
test eax, eax
jne 0x4a5119
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov dword [edi + 8], 0
lea eax, [0x5367c0]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.004332d0
mov eax, dword [esp + 0x28]
call fcn.0045f3d0
jmp 0x4a5100
call fcn.0045e000
jmp fcn.004a4fb0

Function at 0x4a5130
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a5197
sub esp, 8
mov eax, dword [esp + 0x14]
test eax, 0x100
je 0x4a517e
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.004a2c50
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
and eax, 0x60
or eax, 0x16
mov dword [esp + 0x20], eax
add esp, 8
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d89c]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a5130
Function at 0x4a6280
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6364
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
cmp eax, 0x19
jne 0x4a6325
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x24]
mov ebx, dword [esp + 0x1c]
cmp dword [eax + 0x28], ebx
jbe 0x4a630d
lea eax, [ebx + ebx*2]
mov ebx, dword [edx + eax*4 + 4]
mov ebp, dword [edx + eax*4]
and ecx, 0x1a0
movzx esi, byte [ebx + 0xf]
and esi, 0x1f
or ecx, esi
movzx ebp, byte [ebp]
xchg ebp, eax
test al, 1
xchg ebp, eax
jne 0x4a62ef
mov ebp, dword [edx + eax*4 + 8]
test ebp, 1
je 0x4a62ec
or ecx, 0x40
jmp 0x4a62ef
or ecx, 0x20
nop
nop
mov eax, dword [edx + eax*4 + 8]
mov dword [esp + 0x20], ebx
shr eax, 1
mov edx, dword [esp + 0x14]
add eax, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0xc
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8e4]
mov dword [esp + 4], eax
call fcn.004332d0
mov dword [esp + 8], eax
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x54ba98]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a6280
Function at 0x4a6370
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6508
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
cmp eax, 0x11
jne 0x4a63e9
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
cmp dword [edx + 0x28], eax
jbe 0x4a64ef
mov edx, dword [edx + 0x20]
mov ebx, dword [edx]
imul eax, ebx
nop
mov ebx, dword [esp + 0x14]
add eax, ebx
test ecx, 0x60
je 0x4a63c6
mov ebx, 0x20
jmp 0x4a63c8
xor ebx, ebx
movzx ebp, byte [edx + 0xf]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
and ecx, 0x180
or ebx, ecx
and ebp, 0x1f
or ebp, ebx
mov dword [esp + 0x28], ebp
add esp, 0xc
ret
cmp eax, 0x17
jne 0x4a643d
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
cmp dword [edx + 4], eax
jbe 0x4a64d7
mov ebx, dword [esp + 0x10]
mov ebx, dword [ebx + 0x20]
mov ebp, dword [ebx]
imul eax, ebp
add eax, dword [edx]
test ecx, 0x60
je 0x4a641c
mov ecx, 0x20
jmp 0x4a641e
xor ecx, ecx
movzx edx, byte [ebx + 0xf]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
and edx, 0x1f
or ecx, edx
or ecx, 0x180
mov dword [esp + 0x28], ecx
add esp, 0xc
ret
cmp eax, 0x18
jne 0x4a6499
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
cmp dword [edx + 4], eax
jbe 0x4a6481
mov edx, dword [edx]
nop
add eax, edx
test ecx, 0x60
je 0x4a6463
mov ecx, 0x20
jmp 0x4a6465
xor ecx, ecx
mov edx, dword [0x630794]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
or ecx, 0x88
mov dword [esp + 0x28], ecx
add esp, 0xc
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8f4]
mov dword [esp + 4], eax
call fcn.004332d0
mov dword [esp + 8], eax
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x54babe]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d87c]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8ec]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a6370
Function at 0x4a6520
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6670
sub esp, 0x24
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4a6635
movzx ecx, byte [esp + 0x34]
test cl, cl
je 0x4a6559
test eax, 0x60
jne 0x4a661d
test eax, 0x200
jne 0x4a656c
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov eax, dword [esp + 0x28]
jmp 0x4a65a2
lea ecx, [0x548e5e]
mov dword [esp], ecx
mov dword [esp + 4], 9
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004a1180
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, edx
and edx, 0x1f
cmp edx, 0x14
jne 0x4a65f9
mov dword [esp + 0x20], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.004a6c30
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a65e4
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test ecx, ecx
je 0x4a65d8
mov ecx, dword [ecx + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.004a4b80
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8fc]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x54d18c]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a6520
Function at 0x4a66b0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6810
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x12
ja 0x4a6738
cmp eax, 0x11
je 0x4a6729
cmp eax, 0x12
jne 0x4a67a5
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4a67f7
mov eax, dword [eax + 4]
test eax, eax
je 0x4a67f7
test ecx, 0x80
je 0x4a6711
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4a6715
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b370
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x4a677d
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4a67df
mov eax, dword [eax + 4]
test eax, eax
je 0x4a67df
test ecx, 0x80
je 0x4a6765
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4a6769
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b5f0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x17
je 0x4a6796
cmp eax, 0x18
jne 0x4a67a5
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x54af48]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a66b0

Function at 0x4a6820
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a68da
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4a68c1
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.0045b590
mov eax, dword [esp + 4]
test eax, eax
je 0x4a68a9
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
mov ecx, dword [ecx + 8]
test ecx, 0x60
je 0x4a6872
mov ecx, 0x20
jmp 0x4a6874
xor ecx, ecx
movzx ebx, byte [edx + 0xf]
mov dword [esp], edx
and ebx, 0x1f
or ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004a6ba0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7e4]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7dc]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a6820