joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428520
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428687
sub esp, 0x14
mov ebx, dword [esp + 0x1c]
test ebx, 0x3fffff
jne 0x42860d
mov ebp, dword [esp + 0x20]
test ebp, 0x3fffff
jne 0x42860d
mov ebx, dword [esp + 0x18]
mov eax, 3
jmp 0x42856d
dec eax
mov esi, dword [esp + 0x20]
mov ebx, ebp
mov ebp, esi
test eax, eax
jl 0x4285f8
nop
cmp eax, 4
jae 0x428603
test byte [ebx], al
lea esi, [0x63c7c0]
mov ecx, dword [esi + eax*4]
cmp ecx, 0x20
sbb edi, edi
mov dword [esp + 0x10], edi
lea esi, [0x63c7a0]
mov esi, dword [esi + eax*4]
cmp esi, 0x20
mov edx, esi
sbb esi, esi
mov dword [esp + 0xc], esi
nop
lea esi, [eax + eax*2]
mov dword [esp + 8], esi
mov edi, dword [ebx + esi*4 + 8]
lea ebx, [ebx + esi*4]
dec ebp
shr ebp, cl
mov esi, dword [esp + 0x10]
and ebp, esi
mov ecx, edx
mov esi, 1
shl esi, cl
mov ecx, dword [esp + 0xc]
and ecx, esi
nop
add ebp, ecx
neg ecx
and ecx, ebp
cmp dword [ebx + 4], ecx
jge 0x4285ef
cmp edi, ecx
jb 0x4285fc
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x18]
mov dword [ebp + ebx*4 + 4], ecx
jmp 0x428564
mov ebp, dword [esp + 0x18]
jmp 0x428564
add esp, 0x14
ret
mov edx, edi
call fcn.0045f510
mov ecx, 4
call fcn.0045f4d0
call fcn.00435250
lea eax, [0x55f16b]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55d700]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435470
call fcn.004352c0
lea eax, [0x566fda]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00428520
Function at 0x42cd90
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42cf0f
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
call fcn.00401e20
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp ecx, eax
ja 0x42ce8d
shr eax, 9
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 8], eax
jbe 0x42ce29
mov edx, dword [ecx + 4]
mov ebx, dword [edx + eax*4]
lea eax, [edx + eax*4]
test ebx, ebx
je 0x42ce29
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x42ce77
cmp edx, 0x200
je 0x42ce61
mov dword [esp + 0x18], ebx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401de0
lea eax, [0x67e218]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0042cf90
mov ecx, dword [esp + 0x20]
nop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e40
mov eax, dword [esp + 0x20]
add eax, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401c90
add esp, 0x1c
ret
lea eax, [0x56747f]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a80
lea eax, [0x567997]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00433a80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call fcn.00435250
lea eax, [0x55cef8]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55d3b1]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x564d4f]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0042cd90
Function at 0x42d0e0
Capabilities:
Clear windows event logs

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x42d184
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00401d50
mov eax, dword [esp + 0x28]
test eax, eax
setg cl
mov edx, dword [esp + 0x24]
test edx, edx
seta bl
test eax, eax
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], esi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x14], edi
and ebx, ebp
or ebx, ecx
test bl, bl
je 0x42d159
cmp eax, esi
setg cl
cmp edx, edi
seta bl
cmp eax, esi
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebx, ebp
or ebx, ecx
test bl, bl
jne 0x42d188
test eax, eax
jmp 0x42d15b
test eax, eax
jge 0x42d180
add edi, edx
adc esi, eax
cmp eax, esi
setg al
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp edi, edx
xchg esi, ebx
setb bl
xchg esi, ebx
and esi, ebp
or esi, eax
xchg esi, eax
test al, al
xchg esi, eax
jne 0x42d188
add esp, 0x1c
ret
add esp, 0x1c
ret
call fcn.00435250
lea eax, [0x55e5a5]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e80
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55c39d]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e80
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435c80
call fcn.00435470
call fcn.004352c0
lea eax, [0x560136]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a80
nop
int3
Function at 0x42d210
Capabilities:
Clear windows event logs

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x54]
test eax, eax
jne 0x42d240
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ecx, [eax + 0x73c]
mov dword [esp], ecx
call fcn.00409110
jmp 0x42d260
add eax, 0x117c
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 8]
test eax, 1
je 0x42d2ad
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ecx, [eax + 0x738]
mov dword [esp], ecx
call fcn.00401be0
mov eax, dword [esp + 4]
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
cmp ecx, 3
jae 0x42d2a1
imul eax, ecx, 0x268
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x18], eax
add esp, 0x10
ret
mov eax, ecx
mov ecx, 3
call fcn.0045f4e0
mov dword [esp + 0xc], eax
call fcn.00435250
lea eax, str.runtime:_seqruntime:_valsrmount_errortimer_expiredtraceStackTabtrailing_dataunimplementedunsupported:_value_method_xadd64_failedxchg64_failed_n_tschedpc:_but_progSize__nmidlelocked_on_zero_Value_out_of_range__procedure_in__to_finalizer__untyped_args__thread_limit_n1907348632812595367431640625:_extra_text:_CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC_assist_waitGC_worker_initGetConsoleModeGetProcAddressGetUserNameExWMB__allocated_NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad_allocCountbad_restart_PCbad_span_statedata_truncatedfile_too_largefinalizer_waitgcstoptheworldgetprotobynameinvalid_syntaxis_a_directorylevel_2_haltedlevel_3_haltedmemprofileratenil_elem_type_no_module_datano_such_devicepollCache.lockprotocol_errorruntime:_fulls.allocCount_semaRoot_queuestack_overflowstopm_spinningstore64_failedsync.Cond.Waittext_file_busytime.Location_timeEndPeriod
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x55fe8a]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a80
nop
int3
Function at 0x42d310
Capabilities:
Clear windows event logs

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x54]
test eax, eax
jne 0x42d340
mov eax, dword [esp + 0x14]
test byte [eax], al
add eax, 0x73c
nop
mov dword [esp], eax
call fcn.00409310
jmp 0x42d360
add eax, 0x117c
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 8]
test eax, 1
jne 0x42d364
add esp, 0x10
ret
mov dword [esp + 0xc], eax
call fcn.00435250
lea eax, str.runtime:_seqruntime:_valsrmount_errortimer_expiredtraceStackTabtrailing_dataunimplementedunsupported:_value_method_xadd64_failedxchg64_failed_n_tschedpc:_but_progSize__nmidlelocked_on_zero_Value_out_of_range__procedure_in__to_finalizer__untyped_args__thread_limit_n1907348632812595367431640625:_extra_text:_CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC_assist_waitGC_worker_initGetConsoleModeGetProcAddressGetUserNameExWMB__allocated_NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad_allocCountbad_restart_PCbad_span_statedata_truncatedfile_too_largefinalizer_waitgcstoptheworldgetprotobynameinvalid_syntaxis_a_directorylevel_2_haltedlevel_3_haltedmemprofileratenil_elem_type_no_module_datano_such_devicepollCache.lockprotocol_errorruntime:_fulls.allocCount_semaRoot_queuestack_overflowstopm_spinningstore64_failedsync.Cond.Waittext_file_busytime.Location_timeEndPeriod
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x55fe8a]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a80
nop
int3

Function at 0x42d3c0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42d422
sub esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [eax + 8]
mov dword [eax], ecx
movzx edx, byte [0x67e2d5]
test dl, dl
je 0x42d3f1
lea ecx, [eax + 0x10]
mov dword [eax + 4], ecx
jmp 0x42d3fa
add ecx, 0x800
mov dword [eax + 4], ecx
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
test ecx, 7
jne 0x42d40b
add esp, 8
ret
lea eax, [0x563ca6]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0042d3c0
Function at 0x42de50
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42df16
sub esp, 0x1c
mov eax, dword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0xffffffff
call fcn.00430f00
mov eax, dword [esp + 0x14]
mov dword [0x63c224], eax
test eax, eax
je 0x42dea9
add esp, 0x1c
ret
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.00435250
lea eax, [0x567150]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55c388]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e80
call fcn.004352c0
lea eax, [0x562c46]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0042de50

Function at 0x42df90
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42e079
sub esp, 0x1c
lea eax, [0x67e158]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
je 0x42e008
mov eax, dword [0x63c224]
mov ecx, dword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00430f00
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42e00c
add esp, 0x1c
ret
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.00435250
lea eax, [0x568212]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55c388]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e80
call fcn.004352c0
lea eax, [0x56782c]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0042df90
Function at 0x42e450
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42e4f8
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x18]
cmp ecx, 0x72
je 0x42e47a
cmp ecx, 0x77
jne 0x42e4a3
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x20], edx
mov eax, dword [eax + 0x14]
mov edx, dword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0042d960
add esp, 0x10
ret
mov dword [esp + 0xc], ecx
call fcn.00435250
lea eax, [0x5681d6]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00435e80
mov eax, dword [esp + 0xc]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
call fcn.00435470
call fcn.004352c0
lea eax, [0x561862]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0042e450
Function at 0x42f3c0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42f4f9
sub esp, 0x3c
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x42f3f1
lea edx, [0x460060]
mov dword [0x65763c], edx
jmp 0x42f402
lea edi, [0x65763c]
lea eax, [0x460060]
call fcn.0045f450
xor eax, eax
jmp 0x42f417
lea esi, [0x67e500]
mov byte [esi + eax], bl
inc dword [0x67e0d8]
mov eax, ebp
cmp eax, 0x36
jge 0x42f467
lea edx, [0x567c1a]
movzx ebx, byte [edx + eax]
cmp ebx, 0x80
jge 0x42f433
lea ebp, [eax + 1]
jmp 0x42f45d
mov dword [esp + 0x14], eax
mov dword [esp], edx
mov dword [esp + 4], 0x36
mov dword [esp + 8], eax
call fcn.0045a730
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea edx, [0x567c1a]
cmp eax, 0x64
jb 0x42f406
jmp 0x42f4ee
call fcn.0042e730
call fcn.004467a0
call fcn.00446800
call fcn.0042f0e0
mov byte [esp], 0
call fcn.0042f060
mov eax, dword [esp + 4]
mov dword [0x67e194], eax
call fcn.0042f150
call fcn.0042ef90
mov eax, dword [esp]
mov dword [0x67e148], eax
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f677
mov eax, dword [sym.imp.kernel32.dll_GetSystemInfo]
lea ecx, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00430e10
mov eax, dword [esp + 0x1c]
mov dword [0x67e174], eax
mov eax, dword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 1
call fcn.00430e60
add esp, 0x3c
ret
mov ecx, 0x64
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.0042f3c0
Function at 0x430760
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x28
mov eax, dword [sym.imp.kernel32.dll_CreateThread]
lea ecx, [0x460190]
mov edx, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00430fa0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4307c1
mov ecx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e10
add esp, 0x28
ret
lea eax, [0x67e0f4]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
jne 0x430884
mov eax, dword [0x658b08]
mov ecx, dword [0x658b18]
sub eax, ecx
mov dword [esp + 0x24], eax
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x20], eax
call fcn.00435250
lea eax, [0x566e6a]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00435e80
mov eax, dword [esp + 0x24]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
lea eax, [0x55edab]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55c2cb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
lea eax, [0x55f55d]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00433a80
nop
lea eax, [0x67e0ec]
mov dword [esp], eax
call fcn.00409110
nop
lea eax, [0x67e0ec]
mov dword [esp], eax
call fcn.00409110
jmp 0x4307db
Function at 0x4321d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43229d
sub esp, 0xc
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
jne 0x432286
mov dword [esp + 8], eax
call fcn.00432330
mov eax, dword [esp]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x432270
mov ecx, dword [0x67e2d0]
mov edx, dword [esp + 8]
mov ebx, dword [edx + 0x14]
test ecx, ecx
jne 0x432235
mov dword [eax + 0x14], ebx
mov dword [edx + 0x14], eax
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
jmp 0x432259
lea edi, [eax + 0x14]
mov ecx, eax
mov eax, ebx
call fcn.0045f450
lea edi, [edx + 0x14]
mov eax, ecx
call fcn.0045f450
lea edi, [eax + 0xc]
mov eax, dword [esp + 0x10]
call fcn.0045f450
mov eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x10]
mov dword [eax + 4], ecx
call fcn.0045f430
add esp, 0xc
ret
lea eax, [0x565f32]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a80
lea eax, [0x560a7d]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004321d0

Function at 0x4328a0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4329b8
sub esp, 0x1c
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
jmp 0x4328e2
mov dword [esp], edx
call fcn.00432560
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
call eax
mov eax, dword [esp + 0xc]
mov ecx, eax
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x43299d
lea ebx, [esp + 0x20]
cmp dword [edx + 4], ebx
jne 0x432999
lea edi, [ecx + 0x14]
mov dword [esp + 0x18], edi
movzx ebp, byte [edx + 2]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x432951
mov ebp, dword [edx + 0xc]
mov esi, dword [0x67e2d0]
test esi, esi
jne 0x432921
mov dword [edx + 0xc], 0
jmp 0x432931
lea esi, [edx + 0xc]
xor eax, eax
mov edi, esi
call fcn.0045f450
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ebp
mov esi, dword [0x67e2d0]
mov eax, dword [edx + 0x14]
test esi, esi
jne 0x432947
mov dword [ecx + 0x14], eax
jmp 0x4328cc
call fcn.0045f450
jmp 0x4328cc
mov dword [esp + 0x14], edx
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00432fd0
movzx eax, byte [esp + 8]
test al, al
je 0x4329a1
mov ecx, dword [0x67e2d0]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x14]
test ecx, ecx
jne 0x432984
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
jmp 0x43298d
mov edi, dword [esp + 0x18]
call fcn.0045f450
mov dword [esp], edx
call fcn.00432560
add esp, 0x1c
ret
add esp, 0x1c
ret
add esp, 0x1c
ret
lea eax, [0x5668a2]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004328a0
Function at 0x4329d0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x432a14
sub esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.00433a20
mov eax, dword [esp + 4]
test eax, eax
jne 0x4329fd
add esp, 0xc
ret
lea eax, [0x56416d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004329d0
Function at 0x437030
Capabilities:
Clear windows event logs

Disassembly:
sub esp, 0x10
mov eax, dword [0x653310]
mov ecx, dword [0x653314]
mov dword [esp], 2
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00452ec0
add esp, 0x10
ret

Function at 0x437060
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
sub esp, 0x10
mov eax, dword [0x653318]
mov ecx, dword [0x65331c]
mov dword [esp], 2
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00452ec0
add esp, 0x10
ret
Function at 0x437d10
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x437ec7
sub esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0x1001]
cmp ecx, 3
jbe 0x437d43
cmp eax, 0x1009
jne 0x437e1f
mov ecx, eax
and eax, 0xffffefff
mov edx, dword [esp + 0x1c]
cmp edx, eax
jne 0x437d78
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ebx, [eax + 0x48]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
je 0x437d78
add esp, 0x10
ret
call fcn.00435250
lea eax, [0x565d08]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.00435e80
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435e00
lea eax, [0x55d39f]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55d396]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435470
call fcn.004352c0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437680
lea eax, [0x56785f]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00433a80
call fcn.00435250
lea eax, [0x5667f6]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00435e80
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435e00
lea eax, [0x55d39f]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55d396]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435470
call fcn.004352c0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437680
lea eax, [0x567d2b]
mov dword [esp], eax
mov dword [esp + 4], 0x37
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00437d10
Function at 0x439b20
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x439ca0
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
nop
inc dword [ecx + 0x78]
test byte [eax], al
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
call fcn.004393c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x58], ecx
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
test ecx, ecx
je 0x439c50
mov ecx, dword [ecx + 0x18]
test ecx, ecx
je 0x439c50
mov dword [esp + 0x14], eax
mov edx, dword [ecx + 0x140]
test edx, edx
jne 0x439bbb
movzx ecx, byte [ecx + 0x88]
test cl, cl
je 0x439c50
nop
lea eax, [0x67e300]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [0x67e310]
test eax, eax
je 0x439c89
mov eax, dword [0x67e304]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0xb8], eax
nop
mov dword [0x67e304], ecx
movzx eax, byte [0x67e308]
test al, al
je 0x439c0f
mov byte [0x67e308], 0
lea eax, [0x67e30c]
mov dword [esp], eax
call fcn.00409400
nop
nop
lea eax, [0x67e300]
mov dword [esp], eax
call fcn.00409310
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x439c4c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x439c4c
mov dword [eax + 8], 0xfffffade
add esp, 0x18
ret
mov dword [esp], eax
call fcn.00439cb0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x439c85
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x439c85
mov dword [eax + 8], 0xfffffade
add esp, 0x18
ret
lea eax, [0x5664cb]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00439b20