joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5eb0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c6020
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x30]
cmp ecx, eax
jne 0x4c6007
mov dword [esp + 0x10], eax
lea ecx, [0x547680]
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.00447590
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
lea ecx, [0x547680]
mov dword [esp], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.00447590
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
lea ecx, [0x551820]
mov dword [esp], ecx
call fcn.0040b170
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4c5f54
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
jmp 0x4c5f64
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x28]
call fcn.0045f450
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x4c5f81
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x14], edx
jmp 0x4c5f91
lea edi, [eax + 0x14]
mov edx, eax
mov eax, dword [esp + 0x1c]
call fcn.0045f450
mov eax, edx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x4c5faa
mov edx, dword [esp + 0x18]
mov dword [eax + 8], edx
jmp 0x4c5fba
lea edi, [eax + 8]
mov edx, eax
mov eax, dword [esp + 0x18]
call fcn.0045f450
mov eax, edx
mov dword [eax + 0x20], ecx
movzx ecx, byte [esp + 0x38]
mov byte [eax + 0x24], cl
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [esp + 0x30]
cmp ebx, edx
jl 0x4c5fd5
mov ebx, edx
mov edx, dword [esp + 0x2c]
cmp edx, ecx
je 0x4c5ff5
mov dword [esp + 0x14], eax
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.0045fd70
mov eax, dword [esp + 0x14]
lea ecx, [0x59a79c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x20
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a3bc]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004c5eb0
Function at 0x4c75d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c7802
sub esp, 0x38
mov ebx, dword [esp + 0x3c]
cmp dword [ebx], 2
jl 0x4c769e
mov ebp, dword [ebx + 0xa0038]
test ebp, ebp
jne 0x4c77e9
mov ebp, dword [ebx + 0xa0048]
test ebp, ebp
jne 0x4c77e9
mov ebp, dword [esp + 0x44]
cmp ebp, 0x8000
jle 0x4c7648
mov esi, dword [esp + 0x48]
sub esi, ebp
add esi, 0x8000
xchg esi, ebx
neg ebx
xchg esi, ebx
sar esi, 0x1f
add ebp, 0xffff8000
and esi, ebp
mov ebp, dword [esp + 0x40]
add ebp, esi
mov eax, 0x8000
jmp 0x4c764e
mov eax, ebp
mov ebp, dword [esp + 0x40]
mov esi, dword [ebx + 0xa003c]
mov edi, dword [ebx + 0xa0040]
cmp eax, edi
jl 0x4c7660
mov eax, edi
mov dword [esp + 0x20], eax
cmp ebp, esi
je 0x4c7680
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0045fd70
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x3c]
lea ebp, [eax + 0xfc]
sar ebp, 0x1f
shr ebp, 0x18
lea ebp, [eax + ebp + 0xfc]
sar ebp, 8
mov dword [esp + 0x24], ebp
xor ecx, ecx
jmp 0x4c76ab
add esp, 0x38
ret
lea ecx, [esi + 1]
mov ebx, dword [esp + 0x3c]
mov eax, edx
cmp ecx, ebp
jge 0x4c7773
mov esi, ecx
shl ecx, 8
lea edi, [ecx + 0x103]
cmp eax, edi
jge 0x4c76c6
mov edx, eax
jmp 0x4c76ca
mov edx, eax
mov eax, edi
mov edi, dword [ebx + 0xa0044]
mov ebx, dword [ebx + 0xa003c]
cmp eax, edi
ja 0x4c77e0
cmp eax, ecx
jb 0x4c77d5
sub eax, ecx
sub edi, ecx
mov dword [esp + 0x18], edi
xchg edi, ebx
neg ebx
xchg edi, ebx
sar edi, 0x1f
and edi, ecx
add ebx, edi
lea edi, [eax - 3]
test edi, edi
jle 0x4c76a2
cmp edi, 0x101
ja 0x4c77c9
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edi
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + 0x1c]
mov ebp, dword [edx]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
lea eax, [ecx + 0xa0078]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0x101
call ebp
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
xor edx, edx
xor ebp, ebp
jmp 0x4c77c3
mov dword [ecx + 0xa0068], ebp
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x34]
jmp 0x4c76a2
mov dword [ebx + 0xa0048], eax
mov dword [ebx + 0xa0038], eax
add esp, 0x38
ret
mov ebp, dword [ecx + edx*4 + 0xa0078]
mov dword [esp + 0x1c], ebp
lea esi, [edx + ebx]
mov dword [esp + 0x30], esi
and ebp, 0x1ffff
and esi, 0x7fff
mov edi, dword [ecx + ebp*4 + 0x34]
mov dword [ecx + esi*4 + 0x80034], edi
mov esi, dword [ecx + 0xa0034]
mov edi, dword [esp + 0x30]
add esi, edi
mov dword [ecx + ebp*4 + 0x34], esi
inc edx
mov esi, dword [esp + 0x1c]
mov ebp, esi
cmp edx, eax
jl 0x4c7783
jmp 0x4c775c
mov ecx, edi
mov edx, 0x101
call fcn.0045f4f0
mov edx, eax
mov eax, ecx
mov ecx, edx
call fcn.0045f530
mov ecx, eax
mov edx, edi
call fcn.0045f510
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a38c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004c75d0
Function at 0x4ca6e0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ca881
sub esp, 0x1c
mov ebx, dword [esp + 0x20]
mov ebp, dword [ebx + 0x18c]
test ebp, ebp
jne 0x4ca751
mov ebp, dword [ebx + 0x158]
mov esi, dword [ebx + 0x10]
test esi, 7
je 0x4ca779
lea ecx, [0x59a968]
mov dword [ebx + 0x18c], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4ca73c
lea eax, [0x59a39c]
mov dword [ebx + 0x190], eax
jmp 0x4ca74d
lea edi, [ebx + 0x190]
lea eax, [0x59a39c]
call fcn.0045f450
add esp, 0x1c
ret
add esp, 0x1c
ret
xchg esi, eax
mov byte [ebx + ebp + 0x14], al
xchg esi, eax
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
shr edi, 8
mov eax, esi
shl esi, 0x18
or edi, esi
mov dword [ebx + 8], edi
shr eax, 8
mov dword [ebx + 0xc], eax
add dword [ebx + 0x10], 0xfffffff8
inc ebp
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x4ca790
mov esi, dword [ebx + 8]
cmp ebp, 0xf8
jb 0x4ca755
jmp 0x4ca874
test ebp, ebp
je 0x4ca7fb
cmp ebp, 0xf8
ja 0x4ca868
mov eax, dword [ebx + 0x18c]
test eax, eax
jne 0x4ca7fb
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov eax, dword [eax + 0x10]
mov dword [esp], ecx
lea ecx, [ebx + 0x14]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 0xf8
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [edx + 0x18c], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4ca7ee
mov dword [edx + 0x190], eax
jmp 0x4ca7f9
lea edi, [edx + 0x190]
call fcn.0045f450
mov ebx, edx
mov dword [ebx + 0x158], 0
nop
mov eax, dword [ebx + 0x18c]
test eax, eax
jne 0x4ca864
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov eax, dword [eax + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [edx + 0x18c], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4ca859
mov dword [edx + 0x190], eax
jmp 0x4ca864
lea edi, [edx + 0x190]
call fcn.0045f450
add esp, 0x1c
ret
mov ecx, ebp
mov edx, 0xf8
call fcn.0045f4f0
mov eax, ebp
mov ecx, 0xf8
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004ca6e0
Function at 0x4cdaf0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cdbdb
sub esp, 0x28
mov eax, dword [esp + 0x34]
lea ecx, [eax + 2]
cmp ecx, 0xb
jbe 0x4cdb89
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], eax
call fcn.00408ad0
mov eax, dword [esp + 4]
lea ecx, [0x546d80]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
lea eax, [0x564e67]
mov dword [esp], eax
mov dword [esp + 4], 0x23
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004ab2d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x554ce0]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xc], ecx
call fcn.004cdbf0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045e080
jmp fcn.004cdaf0

Function at 0x4cdcc0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cdda2
sub esp, 0x1c
mov eax, dword [esp + 0x28]
cmp eax, 0xffff
jg 0x4cdd6f
mov ecx, dword [esp + 0x20]
mov word [ecx + 0x51], ax
mov edx, dword [ecx + 0x34]
mov ebx, dword [ecx + 0x38]
mov edx, dword [edx + 0x10]
mov dword [esp], ebx
lea ebx, [ecx + 0x51]
mov dword [esp + 4], ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], 0xa
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
test eax, eax
je 0x4cdd31
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
add esp, 0x1c
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0x38]
mov ecx, dword [ecx + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x1c
ret
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x23
lea ecx, [0x564e44]
mov dword [eax], ecx
lea ecx, [0x59a7d8]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x1c
ret
call fcn.0045e080
jmp fcn.004cdcc0
Function at 0x4d01f0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d02ec
sub esp, 0x1c
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4d0225
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0045fba0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [edx + 4]
mov dword [esp + 0x18], ebx
mov edx, dword [edx + 8]
mov dword [esp + 8], edx
mov ebp, dword [esp + 0x24]
mov eax, ecx
xor esi, esi
jmp 0x4d0246
inc esi
mov ebx, dword [esp + 0x18]
cmp esi, edx
jge 0x4d025d
mov edi, dword [ebx + esi*4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x4d02a8
test ecx, ecx
jge 0x4d0266
xor ecx, ecx
jmp 0x4d0266
inc ecx
cmp eax, ecx
jle 0x4d0275
jbe 0x4d0289
movzx edx, byte [ebp + ecx]
test dl, dl
je 0x4d0265
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov edx, eax
mov eax, ecx
mov ecx, edx
call fcn.0045f4d0
lea ecx, [ebx + 1]
shr edi, 8
mov ebx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov ecx, edx
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jge 0x4d0241
lea edx, [ecx - 1]
test edx, edx
jl 0x4d02c4
cmp eax, edx
jbe 0x4d02e2
xchg edi, eax
mov byte [ecx + ebp - 1], al
xchg edi, eax
jmp 0x4d0294
xchg edi, eax
test al, al
xchg edi, eax
je 0x4d0294
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a474]
mov dword [esp + 4], eax
call fcn.00433350
mov ecx, eax
mov eax, edx
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004d01f0
Function at 0x4dc530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4dc6f1
sub esp, 0x34
lea eax, [0x545620]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x4dc56f
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x4dc698
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x4dc6c3
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4dc567
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4dc567
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4dc567
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x4dc567
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x4dc642
cmp eax, ebp
jle 0x4dc642
jbe 0x4dc6e7
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x4dc69c
mov eax, esi
mov ecx, edx
call fcn.0045f4d0
mov ecx, eax
mov eax, ebp
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004dc530
Function at 0x4de290
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4de338
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4de2eb
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x4de322
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.0045e080
jmp fcn.004de290
Function at 0x4e15d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e16e6
sub esp, 0x10
mov ecx, dword [esp + 0x18]
cmp ecx, 0x40
jne 0x4e16cd
mov edx, dword [esp + 0x14]
xor eax, eax
jmp 0x4e15ff
inc eax
cmp ecx, eax
jle 0x4e1620
jbe 0x4e16c8
movzx ebx, byte [edx + eax]
cmp bl, 0xa
je 0x4e16b0
cmp bl, 0xd
jne 0x4e15fe
jmp 0x4e16b0
lea eax, [0x553460]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 0x140], 0x3d
mov ecx, dword [esp + 0x14]
cmp ecx, eax
je 0x4e1664
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
call fcn.0045fd70
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
xor edx, edx
jmp 0x4e166e
mov byte [eax + edx + 0x40], 0xff
inc edx
cmp edx, 0x100
jge 0x4e167a
jb 0x4e1668
jmp 0x4e16a4
mov edx, dword [esp + 0x18]
xor ebx, ebx
jmp 0x4e168b
movzx ebp, byte [ecx + ebx]
mov byte [eax + ebp + 0x40], bl
inc ebx
cmp edx, ebx
jle 0x4e1693
ja 0x4e1682
jmp 0x4e169b
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
mov eax, ebx
mov ecx, edx
call fcn.0045f4d0
mov eax, edx
mov ecx, 0x100
call fcn.0045f4d0
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a3f4]
mov dword [esp + 4], eax
call fcn.00433350
call fcn.0045f4d0
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a3ec]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004e15d0
Function at 0x4e1af0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e1c8b
sub esp, 0x48
mov ecx, dword [esp + 0x54]
cmp ecx, 0x1c
jne 0x4e1b1a
mov edx, dword [esp + 0x50]
xor eax, eax
jmp 0x4e1b56
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x56302a]
mov dword [eax], ecx
mov dword [esp + 0x5c], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], eax
add esp, 0x48
ret
inc eax
cmp ecx, eax
jle 0x4e1bbf
jbe 0x4e1c85
movzx ebx, byte [edx + eax]
mov ebp, dword [0x657d94]
mov esi, dword [0x657d90]
cmp eax, ebp
jae 0x4e1c7e
movzx ebp, byte [esi + eax]
xchg ebp, eax
cmp al, bl
xchg ebp, eax
ja 0x4e1bbf
jae 0x4e1b55
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x56302a]
mov dword [eax], ecx
mov dword [esp + 0x5c], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], eax
add esp, 0x48
ret
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f679
lea ecx, [esp + 0xc]
cmp edx, ecx
je 0x4e1be6
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1c
call fcn.0045fd70
xor eax, eax
jmp 0x4e1bfc
movzx ebp, byte [esp + edx + 0xc]
xchg ebp, ebx
mov byte [esp + eax + 0xc], bl
xchg ebp, ebx
mov byte [esp + edx + 0xc], bl
inc eax
cmp eax, 0xe
jge 0x4e1c17
cmp eax, 0x1c
jae 0x4e1c74
lea edx, [eax - 0x1b]
neg edx
movzx ebx, byte [esp + eax + 0xc]
cmp edx, 0x1c
jb 0x4e1bea
jmp 0x4e1c68
lea edi, [esp + 0x28]
xor eax, eax
call fcn.0045f678
lea ecx, [esp + 0x28]
mov dword [esp], ecx
lea edx, [esp + 0xc]
mov dword [esp + 4], edx
call fcn.004e90d0
mov ecx, dword [esp + 0x4c]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0x28]
mov dword [esp + 4], edx
call fcn.004e71a0
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
add esp, 0x48
ret
mov eax, edx
mov ecx, 0x1c
call fcn.0045f4d0
mov ecx, 0x1c
call fcn.0045f4d0
mov ecx, ebp
call fcn.0045f4d0
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004e1af0
Function at 0x4e96c0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e9876
sub esp, 0x6c
mov ecx, dword [esp + 0x78]
cmp ecx, 0x30
jne 0x4e96ea
mov edx, dword [esp + 0x74]
xor eax, eax
jmp 0x4e972f
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x563046]
mov dword [eax], ecx
mov dword [esp + 0x80], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
add esp, 0x6c
ret
inc eax
cmp ecx, eax
jle 0x4e97a1
jbe 0x4e9870
movzx ebx, byte [edx + eax]
mov ebp, dword [0x657db4]
mov esi, dword [0x657db0]
cmp eax, ebp
jae 0x4e9869
movzx ebp, byte [esi + eax]
xchg ebp, eax
cmp al, bl
xchg ebp, eax
ja 0x4e97a1
jae 0x4e972e
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x563046]
mov dword [eax], ecx
mov dword [esp + 0x80], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
add esp, 0x6c
ret
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f674
lea ecx, [esp + 0x3c]
cmp edx, ecx
je 0x4e97c8
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 0x30
call fcn.0045fd70
xor eax, eax
jmp 0x4e97de
movzx ebp, byte [esp + edx + 0x3c]
xchg ebp, ebx
mov byte [esp + eax + 0x3c], bl
xchg ebp, ebx
mov byte [esp + edx + 0x3c], bl
inc eax
cmp eax, 0x18
jge 0x4e97f9
cmp eax, 0x30
jae 0x4e985f
lea edx, [eax - 0x2f]
neg edx
movzx ebx, byte [esp + eax + 0x3c]
cmp edx, 0x30
jb 0x4e97cc
jmp 0x4e9853
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f674
lea ecx, [esp + 0xc]
mov dword [esp], ecx
lea edx, [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.004faed0
mov ecx, dword [esp + 0x70]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0xc]
mov dword [esp + 4], edx
call fcn.004f6990
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
add esp, 0x6c
ret
mov eax, edx
mov ecx, 0x30
call fcn.0045f4d0
mov ecx, 0x30
call fcn.0045f4d0
mov ecx, ebp
call fcn.0045f4d0
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004e96c0
Function at 0x4fb860
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x18]
cmp eax, dword [ecx + 8]
jbe 0x4fba3e
sub esp, 0x98
mov ecx, dword [esp + 0xa4]
cmp ecx, 0x42
jne 0x4fb897
mov edx, dword [esp + 0xa0]
xor eax, eax
jmp 0x4fb8df
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x563062]
mov dword [eax], ecx
mov dword [esp + 0xac], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], eax
add esp, 0x98
ret
inc eax
cmp ecx, eax
jle 0x4fb954
jbe 0x4fba38
movzx ebx, byte [edx + eax]
mov ebp, dword [0x657dd4]
mov esi, dword [0x657dd0]
cmp eax, ebp
jae 0x4fba31
movzx ebp, byte [esi + eax]
xchg ebp, eax
cmp al, bl
xchg ebp, eax
ja 0x4fb954
jae 0x4fb8de
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1c
lea ecx, [0x563062]
mov dword [eax], ecx
mov dword [esp + 0xac], 0
lea ecx, [0x59a7d8]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], eax
add esp, 0x98
ret
mov dword [esp + 0xe], 0
lea edi, [esp + 0x10]
xor eax, eax
call fcn.0045f670
lea ecx, [esp + 0xe]
cmp edx, ecx
je 0x4fb983
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 0x42
call fcn.0045fd70
xor eax, eax
jmp 0x4fb999
movzx ebp, byte [esp + edx + 0xe]
xchg ebp, ebx
mov byte [esp + eax + 0xe], bl
xchg ebp, ebx
mov byte [esp + edx + 0xe], bl
inc eax
cmp eax, 0x21
jge 0x4fb9b8
cmp eax, 0x42
jae 0x4fba27
lea edx, [eax - 0x41]
neg edx
movzx ebx, byte [esp + eax + 0xe]
cmp edx, 0x42
jb 0x4fb987
jmp 0x4fba1b
lea edi, [esp + 0x50]
xor eax, eax
call fcn.0045f66e
lea ecx, [esp + 0x50]
mov dword [esp], ecx
lea edx, [esp + 0xe]
mov dword [esp + 4], edx
call fcn.0051f0a0
mov ecx, dword [esp + 0x9c]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0x50]
mov dword [esp + 4], edx
call fcn.005193f0
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
add esp, 0x98
ret
mov eax, edx
mov ecx, 0x42
call fcn.0045f4d0
mov ecx, 0x42
call fcn.0045f4d0
mov ecx, ebp
call fcn.0045f4d0
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004fb860