joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a9c0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42aaee
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rdx, qword [0x006e2960]
mov qword [rsp + 0x38], rdx
movups xmm0, xmmword [0x006e2968]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x006e2978]
movups xmmword [rsp + 0x50], xmm0
xor ecx, ecx
jmp 0x42aa0c
lea rcx, [r8 + 1]
mov rax, rsi
cmp rcx, 5
jge 0x42aad2
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + rcx*8 + 0x38]
add rdx, 0xffffffffffffffd0
neg rdx
cmp rdx, 0x40
sbb rsi, rsi
mov rcx, rdx
mov edi, 1
shl rdi, cl
and rdi, rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [0x00759180]
lea rdx, [rbx + rdi*8]
lea rdx, [rdx - 1]
neg rbx
and rbx, rdx
xor eax, eax
call fcn.00417a20
nop dword [rax]
test rax, rax
je 0x42aadc
movups xmmword [rsp + 0x20], xmm15
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x30], rdx
mov rsi, qword [rsp + 0x70]
test byte [rsi], al
mov r8, qword [rsp + 0x10]
lea r9, [r8 + r8*2]
mov r10, qword [rsp + 0x20]
mov qword [rsi + r9*8 + 8], 0
mov qword [rsi + r9*8 + 0x10], rdx
lea rdi, [rsi + r9*8]
cmp dword [0x007592a0], 0
jne 0x42aac5
mov qword [rsi + r9*8], r10
jmp 0x42aa05
mov rdx, r10
call fcn.00461f00
jmp 0x42aa05
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x005b518c]
mov ebx, 0x25
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0042a9c0
Function at 0x42d380
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d3d1
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x42d3bf
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b8975]
mov ebx, 0x3c
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042d380
Function at 0x42e940
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42e9a6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
cmp byte [0x007592a5], 0
je 0x42e96e
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
jmp 0x42e979
add rcx, 0x1000
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x42e993
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b3337]
mov ebx, 0x1f
nop
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.0042e940
Function at 0x42eac0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42ed66
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42ed5a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x00758ff7], 0
jne 0x42eb22
xor edx, edx
xor ebx, ebx
nop
jmp 0x42eb6b
xor edx, edx
jmp 0x42eb4e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041ef80
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42eb26
add rax, 0x1260
call fcn.0042e940
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42ecf2
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42eb68
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00413920
test rax, rax
jne 0x42ebc2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42eb68
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42ec05
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42eb68
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42ed4d
lea r10, [0x0072b450]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42ec8b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42ecc5
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x1248]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x1248], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42eb68
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42ed45
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x1270], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42eb68
cmp rbx, 0x200
ja 0x42ed37
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424ba0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x1260]
call fcn.0042e940
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00462300
mov rax, r8
call fcn.00462280
mov rax, r8
mov ecx, 0x40
call fcn.004622a0
mov edx, 0x200
nop
call fcn.004622e0
nop
mov qword [rsp + 8], rax
call fcn.00464340
mov rax, qword [rsp + 8]
jmp fcn.0042eac0
Function at 0x42f640
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f71d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [0x006e1150]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00432e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x006e1310], rax
test rax, rax
je 0x42f6b4
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004372e0
lea rax, [0x005b75fe]
mov ebx, 0x2f
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004378e0
lea rax, [0x005ab12f]
mov ebx, 3
call fcn.00437be0
call fcn.00437360
lea rax, [0x005b201f]
mov ebx, 0x1b
call fcn.00435b40
nop
nop dword [rax]
call fcn.0045fba0
jmp fcn.0042f640

Function at 0x42f800
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f8ed
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x00759048]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x42f878
mov rax, qword [0x006e1310]
mov rcx, qword [0x006e10c0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00432e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x42f882
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004372e0
lea rax, [0x005b8a29]
mov ebx, 0x3c
call fcn.00437be0
mov rax, qword [rsp + 0x30]
nop
call fcn.004378e0
lea rax, [0x005ab12f]
mov ebx, 3
call fcn.00437be0
call fcn.00437360
lea rax, [0x005b7ec8]
mov ebx, 0x33
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.0042f800
Function at 0x42fca0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42fd27
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x42fcca
cmp edx, 0x77
jne 0x42fce5
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.0042ee80
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.004372e0
lea rax, [0x005b89ed]
mov ebx, 0x3c
call fcn.00437be0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.004379e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b08fd]
mov ebx, 0x17
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.0042fca0
Function at 0x42fe20
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43000f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
cmp qword [0x007591d0], 0
jne 0x42febf
mov rax, qword [0x006e10f0]
lea rcx, [0x007598a0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x104
call fcn.00432d60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x42fffd
cmp rax, 0x104
ja 0x42fffd
lea rbx, [0x007598a0]
mov byte [rbx + rax], 0x5c
lea r8, [rax + 1]
mov qword [0x007591d0], r8
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
cmp byte [0x00758ff8], 0
je 0x42ff1b
test rbx, rbx
jbe 0x42fff3
mov rcx, qword [0x00703f40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x007591d0]
cmp rcx, 0x105
ja 0x42ffe9
lea rsi, [rcx + rbx]
mov qword [rsp + 0x28], rsi
nop dword [rax + rax]
cmp rsi, 0x105
ja 0x42ff52
lea rdx, [0x007598a0]
jmp 0x42ff81
mov qword [rsp + 0x30], rcx
lea rax, [0x005798a0]
lea rbx, [0x007598a0]
mov edi, 0x105
call fcn.004490a0
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdx
lea rsi, [rdx + rcx]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call fcn.00462be0
mov rcx, qword [rsp + 0x28]
nop dword [rax]
test rcx, rcx
jbe 0x42ffe2
mov rax, qword [0x006e10c8]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
call fcn.00462280
mov edx, 0x105
call fcn.004622e0
xor eax, eax
mov rcx, rbx
call fcn.00462280
lea rax, [0x005b4c26]
mov ebx, 0x24
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0042fe20
Function at 0x430c00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430e9d
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x00703f78]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x430d0e
nop
jne 0x430c96
cmp dword [rsp + 0x4c], 0
jne 0x430c96
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x430d0e
mov rax, qword [0x00703f70]
nop dword [rax]
call fcn.00432c80
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x00759f0a]
mov ebx, 0x20
mov ecx, 0x21
call fcn.004314c0
mov rcx, qword [0x007591d0]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x430e92
mov qword [rsp + 0x58], rcx
lea rax, [0x00759d20]
lea rbx, [0x007598a0]
call fcn.00462be0
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x430d20
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x430d8e
lea rdx, [rcx + rax*2]
lea rbx, [0x00759d20]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x005adbdf]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x430e85
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x430d18
jmp 0x430e75
lea rdx, [rcx + 0x40]
jmp 0x430da2
lea rbx, [0x00759d20]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x430db9
cmp rdx, 0x20b
jb 0x430d94
jmp 0x430e68
mov rax, qword [0x006e1158]
lea rcx, [0x00759d20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00432fe0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x430e57
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.004372e0
lea rax, [0x005b935f]
mov ebx, 0x5f
call fcn.00437be0
call fcn.00437360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x00758fe7], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00462280
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.00462280
mov rax, rdx
mov ecx, 0x20b
call fcn.00462280
mov edx, 0x105
call fcn.004622e0
nop
nop dword [rax]
call fcn.0045fba0
jmp fcn.00430c00
Function at 0x4311e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x431499
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x43125c
mov qword [0x00703f38], rax
jmp 0x431268
lea rdi, [0x00703f38]
call fcn.00461de0
test rax, rax
je 0x431487
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x4312c7
mov qword [0x00703f58], rax
jmp 0x4312d3
lea rdi, [0x00703f58]
call fcn.00461de0
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x43133b
mov qword [0x00703f60], rax
jmp 0x431347
lea rdi, [0x00703f60]
call fcn.00461de0
cmp qword [0x00703f58], 0
je 0x431476
test rax, rax
je 0x431476
mov qword [rsp + 0x20], 0
mov rax, qword [0x00703f60]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00432ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x431465
cmp rax, 0x7fffffff
jg 0x431451
mov qword [rsp + 0x28], rax
mov rax, qword [0x00703f58]
lea rcx, [0x007591a8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x431403
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x431422
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x4313fd
sub rbx, rsi
bts edi, ecx
nop
jmp 0x4313fd
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x007591a0], rax
mov byte [0x00758ff9], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x005b92b3]
mov ebx, 0x56
nop dword [rax]
call fcn.00435b40
lea rax, [0x005b920e]
mov ebx, 0x50
call fcn.00435b40
lea rax, [0x005b1d2b]
mov ebx, 0x1b
call fcn.00435b40
lea rax, [0x005b774c]
mov ebx, 0x30
call fcn.00435b40
nop
mov qword [rsp + 8], rax
nop
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.004311e0
Function at 0x4324a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [0x006e1148]
lea rdx, [0x00463920]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00432f60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x43252c
mov rcx, qword [0x006e1168]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00432ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x00759014]
test ecx, ecx
jne 0x4325db
mov rax, qword [0x00705b90]
sub rax, qword [0x00705ba0]
mov qword [rsp + 0x48], rax
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.004372e0
lea rax, [0x005b728a]
mov ebx, 0x2e
nop
call fcn.00437be0
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.004379e0
lea rax, [0x005adb6f]
mov ebx, 0x10
nop
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.004378e0
lea rax, [0x005ab06d]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
lea rax, [0x005ae374]
mov ebx, 0x11
call fcn.00435b40
nop
nop
lea rax, [0x007590d0]
call fcn.0040b700
nop
nop
lea rax, [0x007590d0]
call fcn.0040b700
jmp 0x43253a
Function at 0x434980
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4349c6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [rsp + 0x20]
call fcn.00435b00
nop
test rax, rax
jne 0x4349af
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005b3939]
mov ebx, 0x20
nop dword [rax + rax]
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.00434980

Function at 0x436060
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4361bd
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x00731d40], 0
jne 0x4360a5
call fcn.004372e0
lea rax, [0x005b72e6]
mov ebx, 0x2e
call fcn.00437be0
nop dword [rax]
call fcn.00437360
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x4360cc
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x436167
nop
cmp edx, 1
je 0x436131
cmp edx, 2
jne 0x436119
mov dword [rcx + 0xdc], 3
call fcn.004372e0
lea rax, [0x005b0ebe]
mov ebx, 0x18
call fcn.00437be0
call fcn.00437360
mov eax, 4
call fcn.004317c0
mov eax, 5
nop
call fcn.004317c0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.004372e0
lea rax, [0x005aee31]
mov ebx, 0x13
call fcn.00437be0
call fcn.00437360
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
mov ecx, 1
lea rdx, [0x00759050]
lock xadd dword [rdx], ecx
lea rax, [0x00759160]
call fcn.0040b6c0
cmp dword [0x00759510], 0
jg 0x43619f
cmp dword [0x0075950c], 0
jle 0x4361a9
mov eax, 1
call fcn.00443280
call fcn.00439960
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop dword [rax]
call fcn.0045fba0
jmp fcn.00436060
Function at 0x439dc0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x439e6c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x2c], ecx
lea edx, [rbx - 1]
cmp edx, 3
ja 0x439e0e
mov edx, ebx
bts ebx, 0xc
cmp ecx, ebx
jne 0x439e0e
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x90], ecx
sete cl
mov eax, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004372e0
lea rax, [0x005b4036]
mov ebx, 0x21
nop
call fcn.00437be0
mov eax, dword [rsp + 0x28]
mov eax, eax
call fcn.00437a40
lea rax, [0x005abccd]
mov ebx, 8
nop dword [rax]
call fcn.00437be0
mov eax, dword [rsp + 0x2c]
mov eax, eax
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005adddf]
mov ebx, 0x10
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
jmp fcn.00439dc0
Function at 0x43a9a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ab66
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x00759040]
test edx, edx
je 0x43a9f4
xor eax, eax
nop dword [rax]
call fcn.0042f900
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043e020
nop
nop
lea rax, [0x00705b78]
nop dword [rax]
call fcn.0040b700
mov ecx, dword [0x00759038]
mov edx, dword [0x0075904c]
test edx, edx
je 0x43aa22
mov dword [0x0075904c], 0
nop
jmp 0x43aa24
mov edx, ecx
mov eax, edx
call fcn.00441960
mov qword [rsp + 0x40], rax
mov dword [0x00705c40], 0
cmp dword [0x00705c50], 0
je 0x43aa59
mov dword [0x00705c50], 0
lea rax, [0x00705c58]
call fcn.0040ba00
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rcx, qword [rsp + 0x40]
jmp 0x43aa73
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43aacf
mov rdx, qword [rcx + 8]
mov rsi, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rsi, rsi
je 0x43aabc
nop
mov qword [rcx + 0x38], 0
cmp qword [rsi + 0xa8], 0
nop dword [rax + rax]
jne 0x43ab54
nop
mov qword [rsi + 0xa8], rcx
lea rax, [rsi + 0x118]
call fcn.0040ba00
jmp 0x43aa6e
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043bc20
jmp 0x43aa6e
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43ab14
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00453680
call fcn.0043c7a0
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43ab45
cmp byte [r14 + 0xb1], 0
je 0x43ab45
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x005b53dc]
mov ebx, 0x25
call fcn.00435b40
nop
mov byte [rsp + 8], al
call fcn.0045fba0
movzx eax, byte [rsp + 8]
jmp fcn.0043a9a0