joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a68f0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a69aa
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4a6991
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.0045b5c0
mov eax, dword [esp + 4]
test eax, eax
je 0x4a6979
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ecx + 8]
test ecx, 0x60
je 0x4a6942
mov ecx, 0x20
jmp 0x4a6944
xor ecx, ecx
movzx ebx, byte [edx + 0xf]
mov dword [esp], edx
and ebx, 0x1f
or ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004a6ba0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7f4]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7ec]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a68f0

Function at 0x4a69c0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6aa5
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4a6a8c
lea edx, [eax + 0xc]
mov dword [esp + 0xc], edx
mov ebx, dword [eax + 0x14]
test ebx, ebx
jne 0x4a6a23
mov ebx, dword [eax]
mov eax, dword [eax + 4]
cmp dword [ebx], 4
jne 0x4a6a74
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x4a6a74
test ecx, 0x80
je 0x4a6a11
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0045b520
jmp 0x4a6a3f
mov dword [esp], edx
call fcn.0045b590
mov eax, dword [esp + 4]
test eax, eax
je 0x4a6a5c
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0045b560
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0045b590
mov eax, dword [esp + 4]
test eax, eax
setne al
mov byte [esp + 0x18], al
add esp, 0x10
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d804]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d7fc]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a69c0

Function at 0x4a6c30
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6cb4
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a6c79
mov ecx, dword [esp + 0x14]
test ecx, 0x200
je 0x4a6c65
mov dword [esp + 0x18], 0
add esp, 8
ret
mov dword [esp], eax
call fcn.004a1dc0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
add esp, 8
ret
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x54d1a3]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a6c30
Function at 0x4a6d70
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a6f0f
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 0xc], eax
cmp eax, 0x15
ja 0x4a6e0d
cmp eax, 0x12
jne 0x4a6da9
mov eax, dword [esp + 0x14]
jmp 0x4a6e56
cmp eax, 0x13
jne 0x4a6dfe
test ecx, 0x200
jne 0x4a6df0
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x4a6ef6
mov eax, dword [eax + 4]
test eax, eax
je 0x4a6ef6
test ecx, 0x80
je 0x4a6dde
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x4a6de2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a6de8
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x4a8210]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x15
jne 0x4a6ea4
mov eax, dword [esp + 0x14]
jmp 0x4a6e56
cmp eax, 0x16
jne 0x4a6e48
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 4]
test edx, edx
jne 0x4a6e56
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.0045b7d0
movzx eax, byte [esp + 4]
test al, al
je 0x4a6ede
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x17
je 0x4a6e7e
cmp eax, 0x1a
jne 0x4a6ea4
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x4a6e8c
mov eax, dword [eax + 4]
test eax, eax
je 0x4a6e8c
test ecx, 0x80
je 0x4a6e72
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x4a6e76
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x15
lea ecx, [0x54c52e]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d80c]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d834]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a6d70
Function at 0x4a72c0
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a74ea
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov ecx, eax
and eax, 0x1f
cmp eax, 0x11
jne 0x4a7303
test ecx, 0x100
je 0x4a74d1
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x28]
mov eax, dword [eax + 0x24]
mov ebp, dword [esp + 0x20]
jmp 0x4a7319
cmp eax, 0x17
jne 0x4a73e9
mov ebx, dword [esp + 0x20]
mov ebp, dword [ebx]
mov edx, dword [ebx + 8]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
test ebx, ebx
jl 0x4a74b9
mov esi, dword [esp + 0x2c]
cmp esi, ebx
jl 0x4a74b9
cmp esi, edx
jg 0x4a74b9
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 8], edx
lea eax, [0x531b40]
mov dword [esp], eax
call fcn.0040b1a0
mov edi, dword [esp + 4]
mov dword [edi], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
sub eax, ecx
mov dword [edi + 4], eax
mov eax, dword [esp + 8]
sub eax, ecx
mov dword [edi + 8], eax
test eax, eax
jle 0x4a739f
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 0x20]
mov ebp, dword [0x6573b0]
mov ebx, dword [ebx]
imul ecx, ebx
mov ebx, dword [esp + 0x14]
lea eax, [ebx + ecx]
test ebp, ebp
jne 0x4a7398
mov dword [edi], eax
jmp 0x4a73be
call fcn.0045f3d0
jmp 0x4a73be
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x4a73b1
mov eax, dword [esp + 0x14]
mov dword [edi], eax
jmp 0x4a73ba
mov eax, dword [esp + 0x14]
call fcn.0045f3d0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
test eax, 0x60
je 0x4a73d0
mov eax, 0x20
jmp 0x4a73d2
xor eax, eax
test byte [edx], al
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
or eax, 0x97
mov dword [esp + 0x38], eax
add esp, 0x18
ret
cmp eax, 0x18
jne 0x4a747b
mov eax, dword [esp + 0x28]
test eax, eax
jl 0x4a7463
mov edx, dword [esp + 0x2c]
cmp edx, eax
jl 0x4a7463
mov ebx, dword [esp + 0x20]
cmp dword [ebx + 4], edx
jl 0x4a7463
lea eax, [0x539500]
mov dword [esp], eax
call fcn.0040b1a0
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 4], eax
jle 0x4a744b
mov ecx, dword [ecx]
mov edx, dword [esp + 0x2c]
sub edx, eax
nop
mov dword [edi + 4], edx
mov edx, dword [0x6573b0]
add eax, ecx
test edx, edx
jne 0x4a7446
mov dword [edi], eax
jmp 0x4a744b
call fcn.0045f3d0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], eax
add esp, 0x18
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d824]
mov dword [esp + 4], eax
call fcn.004332d0
mov dword [esp + 0xc], eax
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x54bae4]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d82c]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d81c]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a72c0
Function at 0x4a75f0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a772f
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a76f4
test eax, 0x200
je 0x4a76ae
sar eax, 0xa
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
cmp edx, 0x14
jne 0x4a7667
mov edx, dword [ecx + 0x24]
cmp dword [ecx + 0x28], eax
jbe 0x4a76dc
lea eax, [edx + eax*8 + 4]
mov eax, dword [eax]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045c720
mov eax, dword [esp + 8]
lea ecx, [0x57dfc0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.004a1d30
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 8], ecx
jbe 0x4a76c4
shl ecx, 4
mov eax, dword [eax + ecx + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045c720
mov eax, dword [esp + 8]
lea ecx, [0x57dfc0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x57dfc0]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8b4]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d8b4]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x54b3fb]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a75f0
Function at 0x4a7b80
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a7d04
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
call ecx
cmp dword [esp + 4], 0x17
jne 0x4a7ceb
mov eax, dword [esp + 0x1c]
test eax, eax
jl 0x4a7cd3
mov ecx, dword [esp + 0x20]
test ecx, ecx
jl 0x4a7cbb
cmp ecx, eax
jl 0x4a7ca3
lea eax, [0x53bf40]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x28]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
lea edx, [0x57dfc0]
cmp eax, edx
jne 0x4a7c87
mov dword [esp], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0045b4e0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edi + 8], ecx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x4a7c40
mov dword [edi], eax
jmp 0x4a7c45
call fcn.0045f3d0
mov eax, dword [esp + 0x14]
lea ecx, [0x57dfc0]
cmp eax, ecx
jne 0x4a7c6b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0x97
add esp, 0x10
ret
mov dword [esp], eax
lea eax, [0x545220]
mov dword [esp + 4], eax
lea eax, [0x5435e0]
mov dword [esp + 8], eax
call fcn.00408970
mov dword [esp], eax
lea eax, [0x545220]
mov dword [esp + 4], eax
lea eax, [0x5435e0]
mov dword [esp + 8], eax
call fcn.00408970
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d854]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d84c]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d844]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d83c]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004a7b80
Function at 0x4aa400
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aa65d
sub esp, 0xc
nop
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x14
ja 0x4aa43e
lea edx, [eax - 0x12]
cmp edx, 1
jbe 0x4aa461
cmp eax, 0x14
je 0x4aa448
jmp 0x4aa622
cmp eax, 0x16
jbe 0x4aa461
cmp eax, 0x17
jne 0x4aa458
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
setne al
xor eax, 1
jmp 0x4aa489
cmp eax, 0x1a
jne 0x4aa622
test ecx, 0x200
jne 0x4aa523
test ecx, 0x80
je 0x4aa47d
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4aa481
mov eax, dword [esp + 0x14]
test eax, eax
setne al
xor eax, 1
test al, al
je 0x4aa523
nop
mov eax, dword [esp + 0x24]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x14
ja 0x4aa4b6
lea edx, [eax - 0x12]
cmp edx, 1
jbe 0x4aa4d9
cmp eax, 0x14
je 0x4aa4c0
jmp 0x4aa5e8
cmp eax, 0x16
jbe 0x4aa4d9
cmp eax, 0x17
jne 0x4aa4d0
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
setne al
xor eax, 1
jmp 0x4aa4fd
cmp eax, 0x1a
jne 0x4aa5e8
test ecx, 0x200
jne 0x4aa501
test ecx, 0x80
je 0x4aa4f1
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
jmp 0x4aa4f5
mov eax, dword [esp + 0x20]
test eax, eax
setne al
xor eax, 1
test al, al
jne 0x4aa512
mov dword [esp + 0x28], 0xffffffff
mov byte [esp + 0x2c], 1
add esp, 0xc
ret
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 1
add esp, 0xc
ret
nop
mov eax, dword [esp + 0x24]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x14
ja 0x4aa545
lea edx, [eax - 0x12]
cmp edx, 1
jbe 0x4aa564
cmp eax, 0x14
je 0x4aa54f
jmp 0x4aa5ae
cmp eax, 0x16
jbe 0x4aa564
cmp eax, 0x17
jne 0x4aa55f
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
setne al
xor eax, 1
jmp 0x4aa588
cmp eax, 0x1a
jne 0x4aa5ae
test ecx, 0x200
jne 0x4aa58c
test ecx, 0x80
je 0x4aa57c
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
jmp 0x4aa580
mov eax, dword [esp + 0x20]
test eax, eax
setne al
xor eax, 1
test al, al
jne 0x4aa59d
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
add esp, 0xc
ret
mov dword [esp + 0x28], 1
mov byte [esp + 0x2c], 1
add esp, 0xc
ret
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x54bad1]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x54bad1]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x539800]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x54bad1]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x5367c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004aa400
Function at 0x4b5570
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b5772
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov ebx, dword [eax]
test ebx, ebx
je 0x4b559c
cmp eax, ebx
je 0x4b55b1
jmp 0x4b5759
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x4b55aa
mov dword [eax], eax
jmp 0x4b55b1
mov edi, eax
call fcn.0045f3d0
mov ebx, dword [esp + 0x34]
cmp ebx, 0x80
jae 0x4b5646
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0xc]
lea esi, [ecx + 1]
cmp ebp, esi
jae 0x4b5621
lea eax, [0x535200]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], esi
call fcn.004475d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov dword [ebx + 0xc], edx
mov edx, dword [0x6573b0]
test edx, edx
jne 0x4b5611
mov dword [ebx + 4], eax
jmp 0x4b5619
lea edi, [ebx + 4]
call fcn.0045f3d0
mov edx, eax
mov eax, ebx
mov ebx, dword [esp + 0x34]
lea ebp, [ecx + 1]
mov dword [eax + 8], ebp
mov byte [edx + ecx], bl
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x2c
ret
mov ebp, dword [eax + 8]
mov dword [esp + 0x20], ebp
mov esi, dword [eax + 0xc]
mov edi, esi
sub esi, ebp
cmp esi, 4
jge 0x4b56df
lea eax, [0x535200]
mov dword [esp], eax
mov dword [esp + 4], ebp
shl edi, 1
lea eax, [edi + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
call fcn.00447510
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jl 0x4b5694
mov ebx, ebp
cmp edx, eax
je 0x4b56b8
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.0045fce0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
mov dword [ecx + 8], ebp
mov ebx, dword [esp + 0x24]
mov dword [ecx + 0xc], ebx
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x4b56d1
mov dword [ecx + 4], eax
jmp 0x4b56d9
lea edi, [ecx + 4]
call fcn.0045f3d0
mov eax, ecx
mov ebx, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov esi, dword [eax + 4]
lea ecx, [ebp + 4]
cmp edx, ecx
jb 0x4b5754
cmp ebp, ecx
ja 0x4b574d
sub edx, ebp
mov eax, edx
neg edx
sar edx, 0x1f
and edx, ebp
lea ecx, [esi + edx]
mov dword [esp], ecx
mov dword [esp + 4], 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00483a70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
mov ebx, dword [esp + 0x20]
add ebx, eax
cmp edx, ebx
jb 0x4b5746
mov dword [ecx + 8], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x2c
ret
mov ecx, ebx
call fcn.0045f490
mov eax, ebp
call fcn.0045f4b0
call fcn.0045f490
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d6d4]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004b5570
Function at 0x4c00c0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c0230
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x30]
cmp ecx, eax
jne 0x4c0217
mov dword [esp + 0x10], eax
lea ecx, [0x535200]
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.00447510
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
lea ecx, [0x535200]
mov dword [esp], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.00447510
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
lea ecx, [0x53e0a0]
mov dword [esp], ecx
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x4c0164
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
jmp 0x4c0174
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x28]
call fcn.0045f3d0
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov edx, dword [0x6573b0]
test edx, edx
jne 0x4c0191
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x14], edx
jmp 0x4c01a1
lea edi, [eax + 0x14]
mov edx, eax
mov eax, dword [esp + 0x1c]
call fcn.0045f3d0
mov eax, edx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov edx, dword [0x6573b0]
test edx, edx
jne 0x4c01ba
mov edx, dword [esp + 0x18]
mov dword [eax + 8], edx
jmp 0x4c01ca
lea edi, [eax + 8]
mov edx, eax
mov eax, dword [esp + 0x18]
call fcn.0045f3d0
mov eax, edx
mov dword [eax + 0x20], ecx
movzx ecx, byte [esp + 0x38]
mov byte [eax + 0x24], cl
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [esp + 0x30]
cmp ebx, edx
jl 0x4c01e5
mov ebx, edx
mov edx, dword [esp + 0x2c]
cmp edx, ecx
je 0x4c0205
mov dword [esp + 0x14], eax
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.0045fce0
mov eax, dword [esp + 0x14]
lea ecx, [0x57da88]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x20
ret
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d68c]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.004c00c0
Function at 0x4c2d00
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c2dfc
sub esp, 0x1c
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4c2d35
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0045fb10
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [edx + 4]
mov dword [esp + 0x18], ebx
mov edx, dword [edx + 8]
mov dword [esp + 8], edx
mov ebp, dword [esp + 0x24]
mov eax, ecx
xor esi, esi
jmp 0x4c2d56
inc esi
mov ebx, dword [esp + 0x18]
cmp esi, edx
jge 0x4c2d6d
mov edi, dword [ebx + esi*4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x4c2db8
test ecx, ecx
jge 0x4c2d76
xor ecx, ecx
jmp 0x4c2d76
inc ecx
cmp eax, ecx
jle 0x4c2d85
jbe 0x4c2d99
movzx edx, byte [ebp + ecx]
test dl, dl
je 0x4c2d75
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov edx, eax
mov eax, ecx
mov ecx, edx
call fcn.0045f450
lea ecx, [ebx + 1]
shr edi, 8
mov ebx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov ecx, edx
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jge 0x4c2d51
lea edx, [ecx - 1]
test edx, edx
jl 0x4c2dd4
cmp eax, edx
jbe 0x4c2df2
xchg edi, eax
mov byte [ecx + ebp - 1], al
xchg edi, eax
jmp 0x4c2da4
xchg edi, eax
test al, al
xchg edi, eax
je 0x4c2da4
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d76c]
mov dword [esp + 4], eax
call fcn.004332d0
mov ecx, eax
mov eax, edx
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.004c2d00