joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4235e0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4236dd
sub esp, 8
nop
lea eax, [0x631390]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [0x631344]
test eax, eax
setne al
mov ecx, dword [0x631340]
test ecx, ecx
setne cl
or eax, ecx
test al, al
jne 0x4236c6
mov dword [0x631348], 0
mov dword [0x63134c], 0
mov eax, dword [0x63139c]
test eax, eax
jne 0x423665
nop
nop
lea eax, [0x631390]
mov dword [esp], eax
call fcn.00409340
add esp, 8
ret
lea ecx, [0x631394]
mov dword [eax + 8], ecx
mov eax, dword [eax]
test eax, eax
jne 0x42365a
mov eax, dword [0x631394]
test eax, eax
je 0x423698
mov ecx, dword [0x6313a0]
mov dword [ecx], eax
mov eax, dword [0x631394]
mov ecx, dword [0x6313a0]
mov dword [eax + 4], ecx
mov eax, dword [0x63139c]
mov dword [0x631394], eax
jmp 0x4236b0
mov eax, dword [0x6313a0]
mov ecx, dword [0x63139c]
mov dword [0x631394], ecx
mov dword [0x631398], eax
mov dword [0x63139c], 0
mov dword [0x6313a0], 0
jmp 0x423646
lea eax, [0x551596]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004235e0

Function at 0x4244b0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4245fb
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor edx, edx
jmp 0x4244e4
sub ebp, ecx
lea ecx, [ebp + edx]
shr ebp, 0xd
sub esi, ebp
mov eax, esi
mov edx, ebx
test eax, eax
jbe 0x42457c
mov ebx, dword [esp + 0x2c]
mov ebp, dword [ebx + 0xdc]
test byte [ebp], al
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x14], ecx
shr ecx, 0x16
mov ecx, dword [ebp + ecx*4]
test byte [ecx], al
add ecx, 0x408c4
mov dword [esp + 0x24], ecx
mov dword [esp], ecx
call fcn.00401c80
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, ecx
and ecx, 0x3fffff
cmp eax, ecx
seta bl
mov ebp, dword [esp + 0x20]
mov esi, ebp
shl ebp, 0xd
add ebp, ecx
movzx edi, byte [esp + 0x13]
or ebx, edi
cmp ebp, 0x400000
jbe 0x424554
mov ebp, 0x400000
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
mov byte [esp + 0x13], bl
jmp 0x424597
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
jmp 0x4244d5
mov byte [esp + 0x38], dl
add esp, 0x28
ret
mov ecx, edx
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp ebp, eax
jbe 0x4244d5
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.00401c60
movzx eax, byte [esp + 0xc]
test al, al
jne 0x424562
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00401c80
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jb 0x4245de
mov edx, dword [esp + 0x1c]
cmp eax, edx
jbe 0x424584
jmp 0x4245e4
mov edx, dword [esp + 0x1c]
jmp 0x424584
lea eax, [0x552d98]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004244b0
Function at 0x4256d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425820
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x18]
cmp edx, ecx
jne 0x425736
cmp dword [edx], eax
jne 0x425702
mov ecx, dword [eax]
mov dword [edx], ecx
jmp 0x425709
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [ecx], ebx
cmp dword [edx + 4], eax
jne 0x425716
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x42571e
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
add esp, 0x14
ret
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
call fcn.004351d0
lea eax, [0x5522a4]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x5484ba]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435dc0
lea eax, [0x5484b4]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00435dc0
lea eax, [0x549475]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e00
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435dc0
lea eax, [0x548490]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435dc0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54aaea]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004256d0

Function at 0x425830
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42590d
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x425884
mov edx, dword [eax + 4]
test edx, edx
jne 0x425884
mov edx, dword [eax + 8]
test edx, edx
jne 0x425884
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx]
test edx, edx
je 0x425878
mov dword [edx + 4], eax
jmp 0x42587b
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [eax + 8], ecx
add esp, 0x14
ret
mov ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esp + 8], edx
call fcn.004351d0
lea eax, [0x54fec1]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00435e00
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435dc0
call fcn.004353b0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435dc0
call fcn.004353b0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435dc0
call fcn.004353b0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00435dc0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54aada]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00425830
Function at 0x425a20
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425b90
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423a80
mov eax, dword [esp + 4]
test eax, eax
je 0x425b79
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00421a10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409140
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x425ab7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x425b1d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x425acc
cmp byte [ebp + 6], dl
je 0x425ad7
cmp esi, ebx
ja 0x425b1d
jne 0x425ab5
cmp byte [ebp + 6], dl
jbe 0x425ab5
jmp 0x425b1d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409340
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425b14
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425b14
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00425920
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409340
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425b70
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425b70
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x54eb9e]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00425a20
Function at 0x425ba0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425cba
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423a80
mov eax, dword [esp + 4]
test eax, eax
je 0x425ca3
mov dword [esp + 8], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00421a10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
lea edx, [ecx + 0x48]
mov dword [esp + 0x18], edx
nop
mov dword [esp], edx
call fcn.00409140
mov eax, dword [esp + 8]
lea ecx, [eax + 0x4c]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0x24]
jmp 0x425c2b
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x425c45
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x425c29
cmp byte [ebp + 6], bl
jne 0x425c29
mov edx, dword [ebp]
mov dword [ecx], edx
jmp 0x425c47
xor ebp, ebp
mov dword [esp + 0xc], ebp
mov ecx, dword [eax + 0x4c]
test ecx, ecx
jne 0x425c5a
mov dword [esp], eax
call fcn.004259a0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409340
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425c97
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425c97
mov dword [eax + 8], 0xfffffade
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
lea eax, [0x54f94c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00425ba0
Function at 0x425cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425ec3
sub esp, 0x28
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409140
lea eax, [0x63b784]
mov dword [esp], eax
call fcn.00414500
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x63b7fc]
mov dword [esp], ecx
call fcn.00409340
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x425d3c
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
jmp 0x425d49
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.0045f3d0
mov eax, ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x425d6e
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
jmp 0x425d8c
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.0045f3d0
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.0045f3d0
mov eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00425a20
movzx eax, byte [esp + 8]
test al, al
je 0x425e75
mov eax, dword [0x657220]
test eax, eax
je 0x425e6c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040f9c0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0x954]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.0041b070
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x616186]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.0041af40
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x425e6c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425e6c
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x40], 1
add esp, 0x28
ret
nop
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409140
nop
mov eax, dword [0x63b7a0]
sub eax, dword [0x63b784]
mov dword [0x63b7a0], eax
mov eax, dword [0x63b790]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x63b790], ecx
nop
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409340
mov byte [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045e000
jmp fcn.00425cd0
Function at 0x426000
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42611c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x426095
cmp cl, 2
je 0x42603d
cmp cl, 3
jne 0x426105
mov byte [eax + 8], 1
jmp 0x426101
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042b550
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409140
nop
mov eax, dword [0x63b7c8]
sub eax, dword [0x63b7ac]
mov dword [0x63b7c8], eax
mov eax, dword [0x63b7b8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x63b7b8], ecx
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409340
jmp 0x426101
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413660
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409140
nop
mov eax, dword [0x63b7a0]
sub eax, dword [0x63b784]
mov dword [0x63b7a0], eax
mov eax, dword [0x63b790]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x63b790], ecx
nop
nop
lea eax, [0x63b7fc]
mov dword [esp], eax
call fcn.00409340
add esp, 0x14
ret
lea eax, [0x54aa0a]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00426000

Function at 0x426450
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426507
sub esp, 0x14
mov eax, dword [0x6573c4]
test eax, eax
je 0x426496
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 4]
mov dword [0x6573c4], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x10000
call fcn.0045fb10
mov eax, dword [esp + 0xc]
jmp 0x4264db
nop
lea eax, [0x6573c0]
mov dword [esp], eax
call fcn.00409340
mov dword [esp], 0x10000
lea eax, [0x658bf8]
mov dword [esp + 4], eax
call fcn.004130a0
mov eax, dword [esp + 8]
test eax, eax
je 0x4264f0
mov dword [esp + 0x10], eax
nop
nop
lea eax, [0x6573c0]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [esp + 0x10]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 0x18], eax
add esp, 0x14
ret
lea eax, [0x54f6f1]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00426450
Function at 0x426520
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426669
sub esp, 0xc
mov ecx, dword [0x616760]
cmp ecx, 0x12
ja 0x4265cd
mov ecx, dword [esp + 0x10]
test byte [ecx], al
mov edx, dword [0x6573b0]
test edx, edx
jne 0x426564
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x84], eax
jmp 0x426573
lea edi, [ecx + 0x84]
mov eax, dword [esp + 0x18]
call fcn.0045f3d0
lea edx, [ecx + 0x40]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0042c0b0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.004283a0
mov eax, dword [0x6161d8]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x34], eax
mov eax, dword [0x6573b0]
test eax, eax
jne 0x4265b1
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x80], eax
jmp 0x4265c0
lea edi, [ecx + 0x80]
mov eax, dword [esp + 0x14]
call fcn.0045f3d0
mov eax, dword [0x6161d8]
mov dword [ecx + 0x78], eax
add esp, 0xc
ret
mov dword [esp + 8], ecx
call fcn.004351d0
lea eax, [0x54fa2c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00435e00
mov ecx, dword [esp + 8]
cmp ecx, 0x20
sbb eax, eax
mov edx, 1
shl edx, cl
and edx, eax
mov eax, edx
sar edx, 0x1f
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00435c00
call fcn.004353f0
call fcn.00435240
call fcn.004351d0
lea eax, [0x54eeca]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00435e00
mov dword [esp + 4], 0
mov dword [esp], 0x40000
call fcn.00435c00
call fcn.004353f0
call fcn.00435240
lea eax, [0x551e01]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00426520
Function at 0x428550
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4286b7
sub esp, 0x14
mov ebx, dword [esp + 0x1c]
test ebx, 0x3fffff
jne 0x42863d
mov ebp, dword [esp + 0x20]
test ebp, 0x3fffff
jne 0x42863d
mov ebx, dword [esp + 0x18]
mov eax, 3
jmp 0x42859d
dec eax
mov esi, dword [esp + 0x20]
mov ebx, ebp
mov ebp, esi
test eax, eax
jl 0x428628
nop
cmp eax, 4
jae 0x428633
test byte [ebx], al
lea esi, [0x616770]
mov ecx, dword [esi + eax*4]
cmp ecx, 0x20
sbb edi, edi
mov dword [esp + 0x10], edi
lea esi, [0x616750]
mov esi, dword [esi + eax*4]
cmp esi, 0x20
mov edx, esi
sbb esi, esi
mov dword [esp + 0xc], esi
nop
lea esi, [eax + eax*2]
mov dword [esp + 8], esi
mov edi, dword [ebx + esi*4 + 8]
lea ebx, [ebx + esi*4]
dec ebp
shr ebp, cl
mov esi, dword [esp + 0x10]
and ebp, esi
mov ecx, edx
mov esi, 1
shl esi, cl
mov ecx, dword [esp + 0xc]
and ecx, esi
nop
add ebp, ecx
neg ecx
and ecx, ebp
cmp dword [ebx + 4], ecx
jge 0x42861f
cmp edi, ecx
jb 0x42862c
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x18]
mov dword [ebp + ebx*4 + 4], ecx
jmp 0x428594
mov ebp, dword [esp + 0x18]
jmp 0x428594
add esp, 0x14
ret
mov edx, edi
call fcn.0045f490
mov ecx, 4
call fcn.0045f450
call fcn.004351d0
lea eax, [0x54ab9a]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x549114]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353f0
call fcn.00435240
lea eax, [0x552639]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00428550
Function at 0x42cdc0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42cf3f
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
call fcn.00401e50
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp ecx, eax
ja 0x42cebd
shr eax, 9
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 8], eax
jbe 0x42ce59
mov edx, dword [ecx + 4]
mov ebx, dword [edx + eax*4]
lea eax, [edx + eax*4]
test ebx, ebx
je 0x42ce59
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x42cea7
cmp edx, 0x200
je 0x42ce91
mov dword [esp + 0x18], ebx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e10
lea eax, [0x657310]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0042cfc0
mov ecx, dword [esp + 0x20]
nop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e70
mov eax, dword [esp + 0x20]
add eax, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401cc0
add esp, 0x1c
ret
lea eax, [0x552a4f]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a00
lea eax, [0x552f36]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00433a00
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call fcn.004351d0
lea eax, [0x54893d]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x548de9]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x55048c]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0042cdc0
Function at 0x42d110
Capabilities:
Clear windows event logs

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x42d1b4
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00401d80
mov eax, dword [esp + 0x28]
test eax, eax
setg cl
mov edx, dword [esp + 0x24]
test edx, edx
seta bl
test eax, eax
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], esi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x14], edi
and ebx, ebp
or ebx, ecx
test bl, bl
je 0x42d189
cmp eax, esi
setg cl
cmp edx, edi
seta bl
cmp eax, esi
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebx, ebp
or ebx, ecx
test bl, bl
jne 0x42d1b8
test eax, eax
jmp 0x42d18b
test eax, eax
jge 0x42d1b0
add edi, edx
adc esi, eax
cmp eax, esi
setg al
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp edi, edx
xchg esi, ebx
setb bl
xchg esi, ebx
and esi, ebp
or esi, eax
xchg esi, eax
test al, al
xchg esi, eax
jne 0x42d1b8
add esp, 0x1c
ret
add esp, 0x1c
ret
call fcn.004351d0
lea eax, [0x54a000]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e00
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x547f0d]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e00
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435c00
call fcn.004353f0
call fcn.00435240
lea eax, [0x54bb69]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a00
nop
int3