joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cbc0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40cdb3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x40cda5
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.00413580
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40cc6f
mov qword [rsp + 0x20], rdx
movzx ecx, word [rcx + 0x60]
cmp rdx, rcx
jne 0x40cd36
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x50]
nop dword [rax]
call fcn.00416340
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x28], rax
call fcn.00413580
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
jmp 0x40cc72
mov rbx, rax
cmp qword [rcx + 0x38], rax
jbe 0x40cd25
mov rsi, qword [rcx + 0x68]
imul rax, rsi
add rax, qword [rcx + 0x18]
movzx esi, word [rcx + 0x60]
inc esi
mov word [rcx + 0x60], si
movzx edi, si
mov r8, qword [rcx + 0x38]
cmp r8, rdi
jb 0x40ccb3
cmp rbx, rdx
sete dl
mov rbx, rcx
mov ecx, edx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 0x16], si
mov qword [rsp + 0x20], r8
nop dword [rax]
call fcn.004372e0
lea rax, [0x005ad6b2]
mov ebx, 0xe
call fcn.00437be0
movzx eax, word [rsp + 0x16]
movzx eax, ax
nop
call fcn.004378e0
lea rax, [0x005ac7c2]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b092b]
mov ebx, 0x17
nop dword [rax + rax]
call fcn.00435b40
lea rax, [0x005affe0]
mov ebx, 0x16
call fcn.00435b40
mov word [rsp + 0x16], cx
nop dword [rax + rax]
call fcn.004372e0
lea rax, [0x005b0914]
mov ebx, 0x17
call fcn.00437be0
movzx eax, word [rsp + 0x16]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005ac7c2]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b7b47]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00435b40
mov rax, rdx
mov ecx, 0x88
call fcn.00462280
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.0045fba0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040cbc0
Function at 0x40d840
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d8cd
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40d89c
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40d8b9
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40d8b9
nop dword [rax + rax]
test rbx, rbx
jl 0x40d8b9
mov rbx, rcx
mov ecx, 1
call fcn.0040cde0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040cde0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00586de0]
lea rbx, [0x005f6b30]
call fcn.004353c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040d840

Function at 0x40d900
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d9a6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [rax + 0xa0]
nop
test rdx, rdx
je 0x40d92b
mov rdx, qword [rdx + 0x40]
jmp 0x40d932
mov rdx, qword [0x00759138]
test rdx, rdx
je 0x40d98f
mov rax, qword [0x00759080]
nop
cmp rax, 1
jne 0x40d94a
xor eax, eax
jmp 0x40d973
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
call fcn.0040d9e0
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
nop dword [rax]
call fcn.0042c8e0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005b868a]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d900
Function at 0x40dc60
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40def7
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40dee5
test rbx, rbx
je 0x40dcae
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40ded0
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40dcb3
jmp 0x40debf
mov ebx, 8
cmp rax, 0x10000
jae 0x40dd85
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40dcfe
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40dcfe
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40dd27
nop
nop
lea rax, [0x007592d0]
call fcn.0040b700
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x007592d8]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40dd59
cmp qword [rsi], 0
jne 0x40dd97
mov eax, 0x40000
lea rbx, [0x0075ae00]
call fcn.00417420
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40de43
nop dword [rax]
jmp 0x40de92
mov rbx, rcx
call fcn.00417420
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40ddd8
cmp byte [r14 + 0xb1], 0
je 0x40ddd8
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x007592d8]
cmp rsi, rdi
jne 0x40de06
nop
nop
lea rax, [0x007592d0]
call fcn.0040b920
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x0075ae00]
cmp rcx, rsi
je 0x40de36
mov rbx, rax
mov rax, rcx
call fcn.0042e700
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x0075ae00]
call fcn.0042e700
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x00759168]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x00759168]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40de43
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40dd97
lea rdx, [0x007592d8]
cmp rcx, rdx
je 0x40deaf
lea rax, [0x005b35e1]
mov ebx, 0x1f
call fcn.00435b40
nop
nop
lea rax, [0x007592d0]
call fcn.0040b920
jmp 0x40de9e
lea rax, [0x005b493f]
mov ebx, 0x23
call fcn.00435b40
lea rax, [0x005b64f1]
mov ebx, 0x2a
nop dword [rax]
call fcn.00435b40
lea rax, [0x005b198a]
mov ebx, 0x1a
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040dc60
Function at 0x40e9e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ebe6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rbx, rbx
je 0x40eac2
cmp qword [rbx], 0
je 0x40eac2
movzx esi, byte [rbx + 8]
nop word [rax + rax]
test sil, 4
jne 0x40ebcf
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x48]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x40]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40eab1
movzx r10d, byte [rdx + 8]
test r10b, 8
jne 0x40ea94
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rsi, [r9 + r8]
movzx r8d, byte [r9 + r8]
add r8d, 0xfffffffe
cmp r8b, 3
jb 0x40eab1
mov rcx, rsi
shr rax, 0x38
cmp al, 5
jae 0x40eabc
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40eb00
mov esi, dword [rax + 0x54]
bt esi, 4
jae 0x40ead9
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov rax, rcx
xor ebx, ebx
call rsi
lea rax, [0x0075a180]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
nop dword [rax + rax]
test rcx, rcx
je 0x40eb0e
mov qword [rsp + 0x20], rcx
xor edx, edx
jmp 0x40eb24
lea rax, [0x0075a180]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
inc rdx
cmp rdx, 8
jae 0x40eaec
movzx esi, byte [rdx + rcx]
cmp al, sil
je 0x40eb3a
test sil, sil
jne 0x40eb21
jmp 0x40eb0e
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40eb5b
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x28]
mov rbx, rcx
call rsi
test al, al
jne 0x40eb8a
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x40]
jmp 0x40eb21
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx + 0x50]
movzx esi, byte [rcx + 0x51]
mov rdi, qword [rsp + 0x18]
imul rsi, rdi
lea rdx, [rsi + rdx*8]
mov rsi, qword [rsp + 0x20]
lea rdx, [rsi + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40ebbd
mov rdx, qword [rdx]
mov rax, rdx
mov ebx, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x005b3e05]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040e9e0
Function at 0x410800
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41096a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x4108dd
cmp qword [rbx], 0
je 0x4108dd
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x410958
cmp byte [rbx + 9], 0
jne 0x410858
mov rcx, qword [rbx + 0x10]
jmp 0x410900
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x4108d8
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x4108bd
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx ebx, byte [r9 + r8]
add ebx, 0xfffffffe
cmp bl, 3
jb 0x4108d8
mov rcx, rdx
mov rax, rdi
jmp 0x410900
lea rax, [0x0075a180]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
nop
test rcx, rcx
je 0x41090e
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x410926
lea rax, [0x0075a180]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x4108ee
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x41091f
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x41091f
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b3e05]
mov ebx, 0x21
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.00410800
Function at 0x4109a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x410b17
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x410a7e
cmp qword [rbx], 0
je 0x410a7e
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x410b05
cmp byte [rbx + 9], 0
jne 0x4109f8
mov rcx, qword [rbx + 0x10]
jmp 0x410aa2
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x410a79
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x410a5d
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
cmp sil, 3
jb 0x410a79
mov rcx, rdx
mov rax, rdi
jmp 0x410aa2
lea rax, [0x0075a180]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x410ab0
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x410aca
lea rax, [0x0075a180]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x410a91
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x410ac3
movzx esi, byte [rbx + rcx]
nop dword [rax]
cmp sil, 1
jbe 0x410ac3
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b3e05]
mov ebx, 0x21
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.004109a0
Function at 0x4136e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4138cf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.004372e0
call fcn.004372e0
lea rax, [0x005ae3b8]
mov ebx, 0x11
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.00437a40
call fcn.00437360
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x4137f7
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4138aa
call fcn.004372e0
lea rax, [0x005af06e]
mov ebx, 0x14
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.004372e0
lea rax, [0x005ad110]
mov ebx, 0xd
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437a40
lea rax, [0x005acc69]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.00437a40
lea rax, [0x005acc75]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437be0
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.004378e0
call fcn.00437360
call fcn.004372e0
nop dword [rax]
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x413830
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x005b8b1c]
mov ebx, 0x3e
call fcn.00435b40
call fcn.004372e0
lea rax, [0x005b30f2]
mov ebx, 0x1e
call fcn.00437be0
mov rax, qword [rsp + 0x60]
call fcn.00437a40
lea rax, [0x005ab02f]
mov ebx, 1
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.00437a40
lea rax, [0x005ab06d]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
lea rax, [0x005ab909]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.0041f320
jmp 0x413814
call fcn.004372e0
lea rax, [0x005b0f38]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
jmp 0x413775
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004136e0
Function at 0x414120
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x414305
cmp byte [0x007592a4], 0
je 0x4141ef
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x4142f5
lea r10, [0x0072b450]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x4141d0
mov r11, rax
shr rax, 5
and eax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11d, 3
add r8, 0x1ffff
jmp 0x4141dc
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x414200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x4142eb
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x414293
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x1260]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x1260]
add r9, 0x10
mov qword [rsi + 0x1260], r9
cmp qword [rsi + 0x1268], r9
jne 0x414293
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.0042ea00
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x4142a5
lea r9d, [r11 + 1]
nop dword [rax]
jmp 0x4141f9
cmp r8, r12
je 0x4142b5
inc r12
xor r9d, r9d
jmp 0x4141f9
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.00413a80
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x4141f9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.004622a0
lea rax, [0x005b5baa]
mov ebx, 0x28
call fcn.00435b40
nop
int3
Function at 0x416340
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41654a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x41653c
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x41652b
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdx
lea rsi, [0x007596c0]
nop
cmp rcx, rsi
je 0x4163d7
mov esi, dword [0x0072b3f0]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x41651a
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x0072b6f8]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00416e00
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x0072b6f8]
lea rax, [rcx + rbx]
call fcn.00416a80
test rax, rax
je 0x416509
movzx ecx, word [rax + 0x60]
nop dword [rax]
cmp qword [rax + 0x38], rcx
je 0x4164f8
mov qword [rsp + 0x18], rax
mov ecx, dword [0x0072b3f0]
add ecx, 3
mov dword [rax + 0x58], ecx
lea rax, [0x0075c4a8]
call fcn.0042e7c0
test byte [rax], al
movzx ecx, byte [rsp + 0x40]
mov edx, ecx
shr cl, 1
movsx rcx, cl
nop word [rax + rax]
nop
cmp rcx, 0x44
jae 0x4164eb
lea rcx, [rax + rcx*8]
lea rcx, [rcx + 0x48]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rbx + 0x38]
movzx edi, word [rbx + 0x60]
sub rsi, rdi
lock xadd qword [rcx], rsi
cmp dl, 5
jne 0x416483
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x20]
lock xadd qword [rax + 0x30], rdx
mov qword [rcx + 0x20], 0
lea rax, [0x0075c4a8]
call fcn.0042e8a0
mov rcx, qword [rsp + 0x18]
movzx edx, word [rcx + 0x60]
mov rbx, qword [rcx + 0x68]
imul rdx, rbx
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx + 8]
lea rax, [0x007599c0]
mov rcx, rsi
nop
call fcn.00420700
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], 0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov qword [rcx + rdx*8 + 0x28], rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov ecx, 0x44
call fcn.00462280
lea rax, [0x005b0232]
mov ebx, 0x16
call fcn.00435b40
lea rax, [0x005ad33f]
mov ebx, 0xd
call fcn.00435b40
lea rax, [0x005aff1a]
mov ebx, 0x16
call fcn.00435b40
lea rax, [0x005b5c9a]
mov ebx, 0x28
call fcn.00435b40
mov rax, rdx
mov ecx, 0x88
call fcn.00462280
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.0045fba0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00416340
Function at 0x4169a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416a6a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x0072b3f0]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x416a01
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x416a0b
mov qword [rsp + 0x28], rax
call fcn.004167c0
mov rax, qword [rsp + 0x28]
nop
call fcn.00449de0
mov ecx, dword [0x0072b3f0]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x10], ecx
mov dword [rsp + 0x14], edx
call fcn.004372e0
lea rax, [0x005ad26f]
mov ebx, 0xd
call fcn.00437be0
mov eax, dword [rsp + 0x14]
call fcn.004378e0
lea rax, [0x005b2d8c]
mov ebx, 0x1e
nop
call fcn.00437be0
mov eax, dword [rsp + 0x10]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ace19]
mov ebx, 0xc
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.004169a0

Function at 0x416e00
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416ec6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x416eb3
mov ecx, dword [0x0072b3f0]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x416e42
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x416e49
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x416e8f
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x416e75
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042e160
jmp 0x416ea9
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042e160
jmp 0x416ea9
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
call fcn.00423960
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005b4f3e]
mov ebx, 0x24
nop
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416e00