joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cf201
sub esp, 0x34
lea eax, [0x5332a0]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x4cf07f
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x4cf1a8
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x4cf1d3
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4cf077
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4cf077
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4cf077
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x4cf077
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x4cf152
cmp eax, ebp
jle 0x4cf152
jbe 0x4cf1f7
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x4cf1ac
mov eax, esi
mov ecx, edx
call fcn.0045f450
mov ecx, eax
mov eax, ebp
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.004cf040
Function at 0x4d0da0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d0e48
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4d0dfb
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x4d0e32
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.0045e000
jmp fcn.004d0da0
Function at 0x4d40e0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d41f6
sub esp, 0x10
mov ecx, dword [esp + 0x18]
cmp ecx, 0x40
jne 0x4d41dd
mov edx, dword [esp + 0x14]
xor eax, eax
jmp 0x4d410f
inc eax
cmp ecx, eax
jle 0x4d4130
jbe 0x4d41d8
movzx ebx, byte [edx + eax]
cmp bl, 0xa
je 0x4d41c0
cmp bl, 0xd
jne 0x4d410e
jmp 0x4d41c0
lea eax, [0x53fa40]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 0x140], 0x3d
mov ecx, dword [esp + 0x14]
cmp ecx, eax
je 0x4d4174
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
call fcn.0045fce0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
xor edx, edx
jmp 0x4d417e
mov byte [eax + edx + 0x40], 0xff
inc edx
cmp edx, 0x100
jge 0x4d418a
jb 0x4d4178
jmp 0x4d41b4
mov edx, dword [esp + 0x18]
xor ebx, ebx
jmp 0x4d419b
movzx ebp, byte [ecx + ebx]
mov byte [eax + ebp + 0x40], bl
inc ebx
cmp edx, ebx
jle 0x4d41a3
ja 0x4d4192
jmp 0x4d41ab
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
mov eax, ebx
mov ecx, edx
call fcn.0045f450
mov eax, edx
mov ecx, 0x100
call fcn.0045f450
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d6c4]
mov dword [esp + 4], eax
call fcn.004332d0
call fcn.0045f450
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d6bc]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004d40e0
Function at 0x4d4600
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d479b
sub esp, 0x48
mov ecx, dword [esp + 0x54]
cmp ecx, 0x1c
jne 0x4d462a
mov edx, dword [esp + 0x50]
xor eax, eax
jmp 0x4d4666
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x54e8be]
mov dword [eax], ecx
mov dword [esp + 0x5c], 0
lea ecx, [0x57dac4]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], eax
add esp, 0x48
ret
inc eax
cmp ecx, eax
jle 0x4d46cf
jbe 0x4d4795
movzx ebx, byte [edx + eax]
mov ebp, dword [0x630ea4]
mov esi, dword [0x630ea0]
cmp eax, ebp
jae 0x4d478e
movzx ebp, byte [esi + eax]
xchg ebp, eax
cmp al, bl
xchg ebp, eax
ja 0x4d46cf
jae 0x4d4665
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x54e8be]
mov dword [eax], ecx
mov dword [esp + 0x5c], 0
lea ecx, [0x57dac4]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], eax
add esp, 0x48
ret
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f5e9
lea ecx, [esp + 0xc]
cmp edx, ecx
je 0x4d46f6
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1c
call fcn.0045fce0
xor eax, eax
jmp 0x4d470c
movzx ebp, byte [esp + edx + 0xc]
xchg ebp, ebx
mov byte [esp + eax + 0xc], bl
xchg ebp, ebx
mov byte [esp + edx + 0xc], bl
inc eax
cmp eax, 0xe
jge 0x4d4727
cmp eax, 0x1c
jae 0x4d4784
lea edx, [eax - 0x1b]
neg edx
movzx ebx, byte [esp + eax + 0xc]
cmp edx, 0x1c
jb 0x4d46fa
jmp 0x4d4778
lea edi, [esp + 0x28]
xor eax, eax
call fcn.0045f5e8
lea ecx, [esp + 0x28]
mov dword [esp], ecx
lea edx, [esp + 0xc]
mov dword [esp + 4], edx
call fcn.004dbbe0
mov ecx, dword [esp + 0x4c]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0x28]
mov dword [esp + 4], edx
call fcn.004d9cb0
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
add esp, 0x48
ret
mov eax, edx
mov ecx, 0x1c
call fcn.0045f450
mov ecx, 0x1c
call fcn.0045f450
mov ecx, ebp
call fcn.0045f450
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.004d4600
Function at 0x4dc1d0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4dc386
sub esp, 0x6c
mov ecx, dword [esp + 0x78]
cmp ecx, 0x30
jne 0x4dc1fa
mov edx, dword [esp + 0x74]
xor eax, eax
jmp 0x4dc23f
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x54e8da]
mov dword [eax], ecx
mov dword [esp + 0x80], 0
lea ecx, [0x57dac4]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
add esp, 0x6c
ret
inc eax
cmp ecx, eax
jle 0x4dc2b1
jbe 0x4dc380
movzx ebx, byte [edx + eax]
mov ebp, dword [0x630ec4]
mov esi, dword [0x630ec0]
cmp eax, ebp
jae 0x4dc379
movzx ebp, byte [esi + eax]
xchg ebp, eax
cmp al, bl
xchg ebp, eax
ja 0x4dc2b1
jae 0x4dc23e
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x54e8da]
mov dword [eax], ecx
mov dword [esp + 0x80], 0
lea ecx, [0x57dac4]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
add esp, 0x6c
ret
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f5e4
lea ecx, [esp + 0x3c]
cmp edx, ecx
je 0x4dc2d8
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 0x30
call fcn.0045fce0
xor eax, eax
jmp 0x4dc2ee
movzx ebp, byte [esp + edx + 0x3c]
xchg ebp, ebx
mov byte [esp + eax + 0x3c], bl
xchg ebp, ebx
mov byte [esp + edx + 0x3c], bl
inc eax
cmp eax, 0x18
jge 0x4dc309
cmp eax, 0x30
jae 0x4dc36f
lea edx, [eax - 0x2f]
neg edx
movzx ebx, byte [esp + eax + 0x3c]
cmp edx, 0x30
jb 0x4dc2dc
jmp 0x4dc363
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f5e4
lea ecx, [esp + 0xc]
mov dword [esp], ecx
lea edx, [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.004ed9e0
mov ecx, dword [esp + 0x70]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0xc]
mov dword [esp + 4], edx
call fcn.004e94a0
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
add esp, 0x6c
ret
mov eax, edx
mov ecx, 0x30
call fcn.0045f450
mov ecx, 0x30
call fcn.0045f450
mov ecx, ebp
call fcn.0045f450
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.004dc1d0
Function at 0x4ee370
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x18]
cmp eax, dword [ecx + 8]
jbe 0x4ee54e
sub esp, 0x98
mov ecx, dword [esp + 0xa4]
cmp ecx, 0x42
jne 0x4ee3a7
mov edx, dword [esp + 0xa0]
xor eax, eax
jmp 0x4ee3ef
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x54e8f6]
mov dword [eax], ecx
mov dword [esp + 0xac], 0
lea ecx, [0x57dac4]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], eax
add esp, 0x98
ret
inc eax
cmp ecx, eax
jle 0x4ee464
jbe 0x4ee548
movzx ebx, byte [edx + eax]
mov ebp, dword [0x630ee4]
mov esi, dword [0x630ee0]
cmp eax, ebp
jae 0x4ee541
movzx ebp, byte [esi + eax]
xchg ebp, eax
cmp al, bl
xchg ebp, eax
ja 0x4ee464
jae 0x4ee3ee
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x54e8f6]
mov dword [eax], ecx
mov dword [esp + 0xac], 0
lea ecx, [0x57dac4]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], eax
add esp, 0x98
ret
mov dword [esp + 0xe], 0
lea edi, [esp + 0x10]
xor eax, eax
call fcn.0045f5e0
lea ecx, [esp + 0xe]
cmp edx, ecx
je 0x4ee493
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 0x42
call fcn.0045fce0
xor eax, eax
jmp 0x4ee4a9
movzx ebp, byte [esp + edx + 0xe]
xchg ebp, ebx
mov byte [esp + eax + 0xe], bl
xchg ebp, ebx
mov byte [esp + edx + 0xe], bl
inc eax
cmp eax, 0x21
jge 0x4ee4c8
cmp eax, 0x42
jae 0x4ee537
lea edx, [eax - 0x41]
neg edx
movzx ebx, byte [esp + eax + 0xe]
cmp edx, 0x42
jb 0x4ee497
jmp 0x4ee52b
lea edi, [esp + 0x50]
xor eax, eax
call fcn.0045f5de
lea ecx, [esp + 0x50]
mov dword [esp], ecx
lea edx, [esp + 0xe]
mov dword [esp + 4], edx
call fcn.00511bb0
mov ecx, dword [esp + 0x9c]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0x50]
mov dword [esp + 4], edx
call fcn.0050bf00
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
add esp, 0x98
ret
mov eax, edx
mov ecx, 0x42
call fcn.0045f450
mov ecx, 0x42
call fcn.0045f450
mov ecx, ebp
call fcn.0045f450
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.004ee370
Function at 0x5145c0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5147d6
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x514659
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x5147b7
cmp ecx, 0xe
jne 0x5146d2
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5147b7
cmp ecx, 0xf
jne 0x514748
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5147b7
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.0045e000
jmp fcn.005145c0
Function at 0x5163f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x516592
sub esp, 0x34
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x516487
cmp eax, 1
jne 0x516423
mov ecx, dword [esp + 0x38]
xor edx, edx
xor ebx, ebx
jmp 0x5164c1
mov ecx, dword [esp + 0x38]
movzx edx, byte [ecx]
test dl, dl
jne 0x516437
movzx ebx, byte [ecx + 1]
test bl, 0x80
je 0x516445
cmp dl, 0xff
jne 0x516481
movzx edx, byte [ecx + 1]
test dl, 0x80
je 0x516481
lea eax, [0x54ec2f]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x1d
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00408c10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x38]
lea edx, [0x57dc18]
mov ebx, eax
mov eax, dword [esp + 0x3c]
jmp 0x5164c1
xor edx, edx
xor ebx, ebx
jmp 0x5164c1
lea eax, [0x549f3d]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0xd
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00408c10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x38]
lea edx, [0x57dc18]
mov ebx, eax
mov eax, dword [esp + 0x3c]
test edx, edx
jne 0x51657e
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.00516180
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x51656a
cmp ebx, esi
setne al
mov ecx, esi
sar esi, 0x1f
cmp ebp, esi
setne dl
or edx, eax
test dl, dl
je 0x516552
lea eax, [0x54ae9e]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x11
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00408c10
mov eax, dword [esp + 8]
mov dword [esp + 0x44], 0
lea ecx, [0x57dc18]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x34
ret
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x34
ret
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
add esp, 0x34
ret
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
add esp, 0x34
ret
call fcn.0045e000
jmp fcn.005163f0
Function at 0x516b70
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x516d5a
sub esp, 0x3c
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x4c]
xor eax, eax
xor ecx, ecx
xor esi, esi
jmp 0x516ba4
inc eax
mov edi, ecx
mov ecx, esi
mov esi, edi
mov dword [esp + 0x18], ebp
cmp edx, ebp
jle 0x516d04
cmp eax, 5
je 0x516cb8
shl esi, 7
mov edi, ecx
shr ecx, 0x19
or ecx, esi
cmp edx, ebp
jbe 0x516d50
movzx esi, byte [ebx + ebp]
test eax, eax
jne 0x516bda
xchg esi, eax
cmp al, 0x80
xchg esi, eax
je 0x516bf7
xchg esi, eax
mov byte [esp + 0xf], al
xchg esi, eax
shl edi, 7
and esi, 0x7f
or esi, edi
inc ebp
movzx edi, byte [esp + 0xf]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x516b9d
jmp 0x516c43
lea eax, [0x54f8ac]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00408c10
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
lea ecx, [0x57dc2c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x3c
ret
cmp esi, 0x7fffffff
seta al
test ecx, ecx
sete cl
setg dl
and ecx, eax
or edx, ecx
test dl, dl
jne 0x516c62
xor eax, eax
xor ecx, ecx
jmp 0x516ca4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebp
lea eax, [0x54df0d]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x1a
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00408c10
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, eax
lea eax, [0x57dc18]
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
add esp, 0x3c
ret
lea eax, [0x54df0d]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x1a
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00408c10
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
lea ecx, [0x57dc18]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x3c
ret
lea eax, [0x54e149]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x1a
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00408c10
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
lea ecx, [0x57dc2c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x3c
ret
mov eax, ebp
mov ecx, edx
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00516b70
Function at 0x517300
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x517406
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor edx, edx
jmp 0x517326
inc edx
cmp eax, edx
jle 0x5173ce
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x61]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x517325
lea ebp, [ebx - 0x41]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x517325
lea ebp, [ebx - 0x30]
xchg ebp, eax
cmp al, 9
xchg ebp, eax
jbe 0x517325
lea ebp, [ebx - 0x27]
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jbe 0x517325
lea ebp, [ebx - 0x2b]
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jbe 0x517325
cmp bl, 0x20
je 0x517325
cmp bl, 0x3a
je 0x517325
cmp bl, 0x3d
je 0x517325
cmp bl, 0x3f
je 0x517325
cmp bl, 0x2a
je 0x517325
cmp bl, 0x26
je 0x517325
lea eax, [0x551aaf]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2a
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00408c10
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [0x57dc2c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d0d0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
add esp, 0x1c
ret
call fcn.0045e000
jmp fcn.00517300
Function at 0x517410
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5175ee
sub esp, 0x38
mov ecx, dword [esp + 0x40]
test ecx, 1
jne 0x51749f
cmp ecx, 2
jl 0x51745f
mov edx, dword [esp + 0x3c]
movzx ebx, byte [ecx + edx - 1]
test bl, bl
jne 0x517463
lea eax, [ecx - 2]
cmp ecx, eax
jbe 0x5175e8
movzx ebx, byte [ecx + edx - 2]
test bl, bl
jne 0x517463
mov ecx, eax
jmp 0x517463
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x30], ecx
lea eax, [0x535140]
mov dword [esp], eax
mov dword [esp + 4], 0
shr ecx, 1
mov dword [esp + 0x28], ecx
mov dword [esp + 8], ecx
call fcn.00447510
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x30]
xor esi, esi
jmp 0x51750e
lea eax, [0x537a20]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1d
lea ecx, [0x54ed51]
mov dword [eax], ecx
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea ecx, [0x57dac4]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
add esp, 0x38
ret
mov word [eax + esi*2], bx
add edx, 0xfffffffe
mov edi, edx
neg edx
sar edx, 0x1f
and edx, 2
mov ebx, edi
mov edi, dword [esp + 0x34]
add edi, edx
mov edx, edi
mov edi, dword [esp + 0x30]
add edi, 0xfffffffe
mov esi, ebp
mov ebp, edi
mov edi, ebx
mov ebx, edx
mov edx, edi
test ebp, ebp
je 0x517584
movzx edi, byte [ebx]
cmp ebp, 1
jbe 0x5175dc
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
lea ebp, [esi + 1]
shl edi, 8
movzx ebx, byte [ebx + 1]
add ebx, edi
cmp ecx, ebp
jae 0x5174e2
mov dword [esp + 0x24], esi
mov word [esp + 0x22], bx
mov dword [esp + 0x2c], edx
lea edx, [0x535140]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.004475d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [ecx + 1]
movzx ebx, word [esp + 0x22]
mov esi, dword [esp + 0x24]
mov ecx, edx
mov edx, dword [esp + 0x2c]
jmp 0x5174e2
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.00467ef0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.0044d420
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
add esp, 0x38
ret
mov eax, 1
mov ecx, ebp
call fcn.0045f450
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00517410