joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412e90
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413058
sub esp, 0x18
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
movzx ecx, byte [esp + 0x2c]
test al, cl
je 0x412f2c
mov eax, dword [0x65e1dc]
test byte [eax], al
nop
mov ecx, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 0x16
mov dword [esp + 0x10], ecx
mov eax, dword [eax + ecx*4]
test byte [eax], al
mov eax, dword [eax + 0x408c0]
test byte [eax], al
shr edx, 0x19
and edx, 0x1ffff
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.00401b90
mov ecx, dword [esp + 0x10]
and ecx, 7
mov eax, 1
shl eax, cl
movzx ecx, byte [esp + 4]
test cl, al
je 0x412f13
mov byte [esp + 0x34], 1
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], al
call fcn.00401e70
mov byte [esp + 0x34], 0
add esp, 0x18
ret
call fcn.00435250
call fcn.00435250
lea eax, [0x568000]
mov dword [esp], eax
mov dword [esp + 4], 0x39
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435470
call fcn.004352c0
call fcn.00435250
lea eax, [0x561ddc]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55c26d]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55c2cb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
lea eax, [0x55c6f8]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
call fcn.0041b840
lea eax, [0x55c53e]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041b840
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 2
lea eax, [0x563d03]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00412e90
Function at 0x4130d0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413222
sub esp, 0x24
mov eax, dword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x4000
call fcn.00430eb0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x413121
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
jmp 0x41312b
add esp, 0x24
ret
sub edx, ecx
add eax, ecx
mov ecx, edx
test ecx, ecx
jbe 0x413145
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
mov edx, ecx
jmp 0x413151
cmp ecx, 0x1000
jae 0x413125
jmp 0x41319c
add esp, 0x24
ret
shr ecx, 1
and ecx, 0xfffff000
mov dword [esp + 0x1c], ecx
cmp ecx, 0x1000
jae 0x413161
xor ebx, ebx
jmp 0x413196
mov edx, dword [sym.imp.kernel32.dll_VirtualFree]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x4000
call fcn.00430eb0
mov eax, dword [esp + 0x10]
test eax, eax
sete al
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x20]
test bl, bl
jne 0x413149
jmp 0x41313b
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.00435250
lea eax, [0x561dc4]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x561e6c]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x564783]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004130d0
Function at 0x413230
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41341c
sub esp, 0x28
mov eax, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 4
call fcn.00430f00
mov eax, dword [esp + 0x2c]
mov ecx, eax
cmp dword [esp + 0x14], eax
je 0x41328b
mov eax, dword [esp + 0x30]
mov edx, eax
jmp 0x413295
add esp, 0x28
ret
sub ebx, eax
add ecx, eax
mov eax, ebx
test eax, eax
jbe 0x4132ae
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], ecx
mov ebx, eax
jmp 0x4132b9
cmp eax, 0x1000
jae 0x41328f
jmp 0x413311
add esp, 0x28
ret
shr eax, 1
and eax, 0xfffff000
mov dword [esp + 0x18], eax
cmp eax, 0x1000
jae 0x4132c8
xor ebp, ebp
jmp 0x413309
mov edx, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 4
call fcn.00430f00
mov eax, dword [esp + 0x14]
test eax, eax
sete al
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
mov ebp, eax
mov eax, dword [esp + 0x18]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4132b2
jmp 0x4132a5
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x20], eax
cmp eax, 8
jne 0x41339b
call fcn.00435250
lea eax, [0x562286]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x561e6c]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x55e571]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a80
cmp eax, 0x5af
je 0x413322
call fcn.00435250
lea eax, [0x562286]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x561e6c]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x563f12]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00413230
Function at 0x413430
Capabilities:
Delete volume shadow copies

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x20]
sub eax, ecx
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, 0
sbb edx, 0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0042d0e0
mov eax, dword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x8000
call fcn.00430eb0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413489
add esp, 0x18
ret
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x14], eax
call fcn.00435250
lea eax, [0x561dc4]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x561e6c]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x56422d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
nop
int3
Function at 0x413630
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413844
sub esp, 0x18
mov eax, dword [0x67e128]
test eax, eax
jne 0x41382d
nop
lea eax, [0x67e110]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [0x67e114]
test eax, eax
je 0x413679
cmp dword [eax + 8], 0xcc
jne 0x4136ef
mov edx, dword [0x67e108]
test edx, edx
jne 0x4136d1
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x67fb18]
mov dword [esp + 8], eax
call fcn.0040b600
mov eax, dword [esp + 0xc]
mov dword [0x67e108], eax
mov ecx, dword [0x67e0c4]
mov dword [eax], ecx
mov eax, dword [0x67e108]
mov dword [0x67e0c4], eax
movzx eax, byte [0x67e580]
test al, al
jne 0x4136d1
xor eax, eax
jmp 0x4137d9
mov edx, dword [0x67e108]
mov ebx, dword [edx + 4]
mov dword [0x67e108], ebx
mov ebx, dword [0x67e114]
mov dword [edx + 4], ebx
mov dword [0x67e114], edx
mov edx, dword [0x67e114]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4137c1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x67e2d0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41374d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41375a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045f450
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x413786
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4137a7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045f450
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045f450
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045f450
mov byte [0x67e08a], 1
nop
lea eax, [0x67e110]
mov dword [esp], eax
call fcn.00409310
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045f4e0
lea esi, [0x67e580]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4136d1
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413823
lea edx, [0x63c24c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4137cb
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045f4d0
mov ecx, 5
call fcn.0045f4d0
lea eax, [0x561d64]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00413630
Function at 0x4143e0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4144c1
sub esp, 8
mov ecx, dword [esp + 0x10]
cmp ecx, 0x4000
ja 0x4144aa
cmp ecx, 4
jae 0x414413
mov ecx, 4
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
mov ebx, dword [0x67e2d0]
test ebx, ebx
jne 0x414433
mov ebx, dword [esp + 0x14]
mov dword [edx + 4], ebx
mov ebx, dword [esp + 0x18]
mov dword [edx + 8], ebx
jmp 0x41444b
lea edi, [edx + 4]
mov eax, dword [esp + 0x14]
call fcn.0045f450
lea edi, [edx + 8]
mov eax, dword [esp + 0x18]
call fcn.0045f450
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
test ecx, ecx
je 0x4144a5
mov eax, 0x4000
xor edx, edx
div ecx
imul eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], 0
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x414491
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x20], eax
jmp 0x41449d
lea edi, [ecx + 0x20]
mov eax, dword [esp + 0x1c]
call fcn.0045f450
mov byte [ecx + 0x24], 1
add esp, 8
ret
call fcn.00432170
lea eax, [0x56424d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004143e0

Function at 0x4144d0
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4145d5
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x41459e
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x41452e
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
mov ecx, dword [eax]
add dword [eax + 0x1c], ecx
movzx ecx, byte [eax + 0x24]
test cl, cl
je 0x414526
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045fba0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
add esp, 0x18
ret
cmp dword [eax + 0x14], ecx
jae 0x414560
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], edx
call fcn.0040b600
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, ecx
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 4]
test edx, edx
je 0x414584
mov dword [esp + 0x14], ecx
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
mov dword [esp], ebp
mov dword [esp + 4], ecx
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add dword [eax + 0x10], edx
mov edx, dword [eax + 0x14]
sub edx, dword [eax]
mov dword [eax + 0x14], edx
mov edx, dword [eax]
add dword [eax + 0x1c], edx
mov dword [esp + 0x20], ecx
add esp, 0x18
ret
call fcn.00435250
lea eax, [0x567963]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00435e80
call fcn.004352c0
lea eax, [0x561834]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004144d0
Function at 0x4177d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x4179b7
sub esp, 0xc
mov eax, dword [0x67e128]
test eax, eax
jne 0x4179a0
nop
lea eax, [0x65e100]
mov dword [esp], eax
call fcn.00409110
add dword [0x65e190], 2
nop
nop
lea eax, [0x658034]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401df0
nop
lea eax, [0x65e1a8]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e40
mov eax, dword [0x65e204]
mov ecx, dword [0x65e208]
mov edx, dword [0x65e20c]
mov dword [0x65e214], ecx
mov dword [0x65e218], edx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x417874
mov dword [0x65e210], eax
jmp 0x41787f
lea edi, [0x65e210]
call fcn.0045f450
nop
lea eax, [0x65e1d0]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e40
nop
lea eax, [0x65e1d8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401c90
nop
nop
lea eax, [0x65e100]
mov dword [esp], eax
call fcn.00409310
lea eax, [0x658038]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401df0
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x41791a
nop
nop
lea eax, [0x65e100]
mov dword [esp], eax
call fcn.00409110
mov dword [0x65e1c0], 0
mov dword [0x65e1c4], 0
nop
nop
lea eax, [0x65e100]
mov dword [esp], eax
call fcn.00409310
jmp 0x417970
nop
lea eax, [0x658020]
mov dword [esp], eax
call fcn.00409110
movzx eax, byte [0x658028]
test al, al
je 0x417956
mov byte [0x658028], 0
mov eax, dword [0x658024]
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.00437b40
nop
nop
lea eax, [0x658020]
mov dword [esp], eax
call fcn.00409310
add esp, 0xc
ret
inc dword [0x658030]
call fcn.00421770
cmp dword [esp], 0xffffffff
jne 0x41796a
call fcn.004235b0
mov byte [esp], 0
call fcn.004236c0
movzx eax, byte [esp + 4]
test al, al
jne 0x417980
call fcn.0042b1d0
call fcn.0042b240
add esp, 0xc
ret
lea eax, [0x5661e2]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a80
nop
call fcn.0045cc20
jmp fcn.004177d0
Function at 0x41bc50
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 8
movzx edx, byte [0x67e093]
test dl, dl
jne 0x41bd23
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub eax, dword [edx + 0xc]
mov ebx, dword [edx + 0x34]
mov ecx, edx
mul ebx
nop
nop
nop
nop
nop
nop
mov ebx, edx
shr edx, 3
nop
add edx, dword [ecx + 0x2c]
mov dword [esp], edx
and ebx, 7
mov ecx, ebx
mov edx, 1
shl edx, cl
mov byte [esp + 4], dl
call fcn.00401e70
mov edx, dword [0x65e1dc]
test byte [edx], al
nop
nop
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
nop
mov eax, ecx
shr ecx, 0x16
mov edx, dword [edx + ecx*4]
test byte [edx], al
mov ecx, eax
shr eax, 0x10
and eax, 0x3f
movzx ebx, byte [edx + eax + 0x40840]
lea eax, [edx + eax + 0x40840]
shr ecx, 0xd
and ecx, 7
mov edx, 1
shl edx, cl
test dl, bl
jne 0x41bceb
mov dword [esp], eax
mov byte [esp + 4], dl
call fcn.00401e70
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x54]
mov ecx, dword [eax + 0x95c]
mov edx, dword [esp + 0x14]
add ecx, edx
mov edx, dword [eax + 0x960]
mov dword [eax + 0x95c], ecx
adc edx, 0
mov dword [eax + 0x960], edx
add esp, 8
ret
lea eax, [0x5669a8]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00433a80
nop
int3
Function at 0x41f8c0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41f967
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jbe 0x41f8ec
nop
mov edx, eax
sub eax, ecx
jmp 0x41f8f0
mov edx, eax
xor eax, eax
test eax, eax
je 0x41f94c
test ecx, 0x3fffff
jne 0x41f950
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ecx, [eax + 0x54]
mov dword [esp + 0xc], ecx
nop
mov dword [esp], ecx
call fcn.00409110
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x6c], eax
jne 0x41f93a
lea eax, [ecx + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.0042c2a0
nop
nop
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00409310
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0x563206]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0041f8c0

Function at 0x420310
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x420460
sub esp, 0x18
mov edx, dword [esp + 0x20]
lea ebx, [edx - 1]
test edx, ebx
jne 0x420410
test edx, edx
je 0x420410
cmp edx, 0x40
ja 0x4203c1
mov ebx, dword [esp + 0x1c]
mov eax, 7
jmp 0x42035f
mov ebp, dword [esp + 0x14]
lea eax, [ebp - 1]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
test eax, eax
jl 0x4203ae
test byte [ebx], al
cmp eax, 8
jae 0x4203b7
mov dword [esp + 0x14], eax
lea ecx, [ebx + eax*8 + 0x40]
mov ebp, dword [ecx]
mov ecx, dword [ecx + 4]
lea esi, [ebx + eax*8]
or ebp, dword [esi]
or ecx, dword [esi + 4]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov dword [esp + 8], edx
call fcn.00420070
cmp dword [esp + 0xc], 0xffffffff
setne al
cmp dword [esp + 0x10], 0xffffffff
setne cl
or ecx, eax
test cl, cl
je 0x420350
mov byte [esp + 0x24], 1
add esp, 0x18
ret
mov byte [esp + 0x24], 0
add esp, 0x18
ret
mov ecx, 8
call fcn.0045f4d0
call fcn.00435250
lea eax, [0x55ed51]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x55e557]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a80
call fcn.00435250
lea eax, [0x55ed51]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x56465a]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00420310
Function at 0x420ce0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x420df7
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 0xdc]
test ebx, ebx
jne 0x420d28
call fcn.004231f0
mov ebx, dword [esp]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 0x10]
mov dword [eax + 0xd8], ebx
mov dword [eax + 0xdc], ebx
mov edx, eax
mov ebp, dword [ebx + 0xc]
test ebp, ebp
jle 0x420d8b
mov esi, dword [edx + 0xc0]
mov edi, dword [esp + 0x14]
mov eax, edi
sub edi, esi
lea esi, [ebp - 1]
cmp esi, 0x65
jae 0x420dea
lea esi, [ebp + ebp*4]
mov ecx, edx
mov edx, dword [ebx + esi*4]
add edx, dword [ebx + esi*4 + 4]
cmp edx, edi
ja 0x420dd4
cmp ebp, 0x65
jne 0x420d91
mov dword [esp + 8], ebx
call fcn.004231f0
mov ebx, dword [esp]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 8]
mov dword [eax + 0x10], ebx
mov eax, dword [esp + 0x10]
mov dword [eax + 0xdc], ebx
mov ecx, eax
mov eax, dword [esp + 0x14]
jmp 0x420d91
mov eax, dword [esp + 0x14]
mov ecx, edx
mov edx, dword [ebx + 0xc]
cmp edx, 0x65
jae 0x420dc8
lea ebp, [edx + 1]
mov dword [ebx + 0xc], ebp
lea edx, [edx + edx*4]
mov ebp, dword [ecx + 0xc0]
sub eax, ebp
mov dword [ebx + edx*4 + 0x14], eax
mov eax, dword [esp + 0x18]
mov ebp, dword [eax + 4]
mov dword [ebx + edx*4 + 0x18], ebp
nop
mov dword [ebx + edx*4 + 0x1c], eax
inc dword [ecx + 0xe0]
add esp, 0xc
ret
mov eax, edx
mov ecx, 0x65
call fcn.0045f4d0
lea eax, [0x56625d]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a80
mov eax, esi
mov ecx, 0x65
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00420ce0
Function at 0x421160
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421372
sub esp, 0x34
mov eax, dword [esp + 0x3c]
cmp dword [0x65e190], eax
jne 0x42135b
mov eax, dword [esp + 0x38]
test byte [eax], al
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0x7fffffff
dec eax
cmp eax, 0x80000000
jae 0x421345
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea edx, [ecx - 1]
mov dword [esp + 8], edx
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
je 0x421189
mov eax, dword [esp + 0x30]
cmp eax, 0x80000000
jne 0x421341
mov eax, dword [0x67e450]
test eax, eax
jle 0x42133d
lea eax, [0x65e1a8]
mov dword [esp], eax
call fcn.00401e20
mov eax, dword [0x67e990]
mov dword [esp + 0x30], eax
mov ecx, dword [0x65e1b8]
mov dword [esp + 0x2c], ecx
sub eax, ecx
mov dword [esp + 0x28], eax
mov ebx, dword [0x67e994]
mov dword [esp + 0x24], ebx
mov ebp, dword [0x65e1bc]
mov dword [esp + 0x20], ebp
mov esi, dword [0x65e1c0]
mov dword [esp + 0x1c], esi
mov edi, dword [0x65e1c4]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 8]
mov dword [esp + 0x14], edi
mov esi, dword [esp + 4]
mov dword [esp + 0x10], esi
call fcn.00435250
lea eax, [0x563e39]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00435e80
mov eax, dword [esp + 0x24]
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov edx, dword [esp + 0x30]
shr edx, 0x14
or ecx, edx
mov dword [esp], ecx
call fcn.00435b20
lea eax, [0x55e75a]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e80
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub eax, ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
sbb eax, ecx
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov eax, dword [esp + 0x28]
shr eax, 0x14
or ecx, eax
mov dword [esp], ecx
call fcn.00435b20
lea eax, [0x561412]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e80
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55d660]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e80
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435510
lea eax, [0x55deb7]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e80
call fcn.004352c0
add esp, 0x34
ret
add esp, 0x34
ret
lea eax, [0x564ead]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a80
lea eax, [0x567669]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00421160