joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d980
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40dac8
sub esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40da41
mov ecx, dword [eax]
test ecx, ecx
je 0x40da41
movzx ecx, byte [eax + 4]
test cl, 4
jne 0x40dab1
movzx ecx, byte [eax + 5]
test cl, cl
jne 0x40d9d2
mov eax, dword [eax + 0xc]
mov ebp, dword [esp + 0x10]
mov ecx, eax
jmp 0x40da61
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x2c]
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 4], ebp
call ebx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
movzx ebx, byte [ecx + 5]
mov edx, ecx
mov ecx, ebx
mov ebp, 1
shl ebp, cl
lea ecx, [ebp - 1]
mov ebx, ecx
and ecx, eax
mov ebp, dword [esp + 0x10]
movzx esi, word [ebp + 0x32]
imul ecx, esi
mov edi, dword [edx + 0x10]
add ecx, dword [edx + 0xc]
test edi, edi
je 0x40da61
movzx edx, byte [edx + 4]
test dl, 8
jne 0x40da29
shr ebx, 1
and ebx, eax
imul ebx, esi
lea eax, [edi + ebx]
movzx edx, byte [edi + ebx]
add edx, 0xfffffffe
cmp dl, 3
jb 0x40da61
mov ecx, eax
jmp 0x40da61
lea eax, [0x657f80]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
add esp, 0xc
ret
movzx eax, word [ebp + 0x32]
lea eax, [ecx + eax - 4]
test byte [ebp], al
mov ecx, dword [eax]
test ecx, ecx
je 0x40da6d
nop
lea eax, [ecx + 8]
xor edx, edx
jmp 0x40da84
lea eax, [0x657f80]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
add esp, 0xc
ret
inc edx
add eax, 4
cmp edx, 8
jae 0x40da54
mov ebx, dword [eax]
cmp dword [esp + 0x18], ebx
jne 0x40da80
lea ebx, [ecx + edx]
cmp byte [ebx], 1
jbe 0x40da80
movzx eax, byte [ebp + 0x31]
imul edx, eax
lea eax, [edx + ecx + 0x28]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea eax, [0x54fcb1]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0040d980
Function at 0x40f760
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40f9a7
sub esp, 0x1c
call fcn.004351d0
call fcn.004351d0
lea eax, [0x54afbf]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435c80
call fcn.00435240
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40f8a1
call fcn.004351d0
call fcn.004353f0
call fcn.00435240
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x40f802
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 2
lea eax, [0x55378b]
mov dword [esp], eax
mov dword [esp + 4], 0x3e
call fcn.00433a00
call fcn.004351d0
lea eax, [0x54f336]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547e0d]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547e6b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
lea eax, [0x548640]
mov dword [esp], eax
mov dword [esp + 4], 6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.0041b870
jmp 0x40f7d5
nop
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
call fcn.00401bc0
movzx eax, byte [esp + 4]
mov byte [esp + 0x13], al
cmp al, 1
je 0x40f982
call fcn.004351d0
lea eax, [0x54bc28]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00435e00
call fcn.00435240
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
call fcn.004351d0
lea eax, [0x549daa]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x54991c]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x549928]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e00
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp], eax
call fcn.00435aa0
call fcn.00435240
jmp 0x40f7be
call fcn.004351d0
lea eax, [0x54d80a]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
call fcn.00435240
jmp 0x40f8df
call fcn.0045e000
jmp fcn.0040f760
Function at 0x4100c0
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ebx, eax
or eax, edx
mov ebp, dword [esp + 0x4c]
or eax, ebp
test eax, 3
jne 0x41023a
movzx eax, byte [0x6573b4]
test al, al
je 0x41014c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x54]
test byte [eax], al
mov esi, dword [0x6372dc]
test byte [esi], al
nop
mov edi, edx
shr edx, 0x16
mov esi, dword [esi + edx*4]
test esi, esi
je 0x410130
mov ecx, edi
shr edi, 4
and edi, 0x3ffff
add edi, esi
shr ecx, 2
and ecx, 3
add esi, 0x3ffff
jmp 0x410138
xor edx, edx
xor ecx, ecx
xor esi, esi
xor edi, edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
jmp 0x41015f
add esp, 0x40
ret
add edx, 4
mov dword [esp + 0x20], edx
mov edx, ecx
mov ecx, ebp
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x20]
cmp ebp, edx
jbe 0x410236
movzx ebp, byte [edi]
shr ebp, cl
test ebp, 1
je 0x4101e0
lea ebp, [edx + ebx]
mov ebx, dword [eax + 0x970]
mov ebp, dword [ebp]
mov dword [ebx], 0
mov dword [ebx + 4], ebp
mov ebx, dword [eax + 0x970]
add ebx, 8
mov dword [eax + 0x970], ebx
cmp dword [eax + 0x974], ebx
jne 0x4101dc
mov dword [esp + 0x24], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.0042d4a0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x48]
cmp ecx, 3
jae 0x4101ea
lea ebp, [ecx + 1]
jmp 0x4101f2
cmp esi, edi
je 0x4101fb
nop
inc edi
xor ebp, ebp
mov ecx, dword [esp + 0x28]
jmp 0x410150
mov dword [esp], edi
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
call fcn.0040fad0
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x48]
mov ecx, edx
mov edx, dword [esp + 0x20]
jmp 0x410150
add esp, 0x40
ret
lea eax, [0x55156e]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a00
nop
int3
Function at 0x4103b0
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4105e2
mov ecx, dword [esp + 0x38]
cmp dword [eax], ecx
jne 0x41051d
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x4104a5
movzx ecx, byte [0x6573b4]
test cl, cl
je 0x41040d
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x24], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
xor edi, edi
jmp 0x410414
add esp, 0x28
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x4104a1
test esi, 0x1f
jne 0x41042b
movzx edi, byte [edx]
inc edx
jmp 0x41042d
shr edi, 1
test edi, 1
je 0x410411
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x970]
mov ebp, dword [ebp]
mov ebx, dword [ebx]
mov dword [eax], ebp
mov dword [eax + 4], ebx
mov eax, dword [ecx + 0x970]
add eax, 8
mov dword [ecx + 0x970], eax
cmp dword [ecx + 0x974], eax
jne 0x410490
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.0042d4a0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
jmp 0x410411
add esp, 0x28
ret
mov dword [esp], eax
call fcn.00458720
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
call fcn.004351d0
lea eax, [0x5516d6]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00435e00
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x54a455]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435e00
call fcn.00435240
lea eax, [0x550a38]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00433a00
mov dword [esp], eax
call fcn.00458720
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x2c]
mov edx, dword [edx]
mov dword [esp + 0x14], edx
call fcn.004351d0
lea eax, [0x5516d6]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00435e00
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x5493d0]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54b0ad]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x550a38]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00433a00
lea eax, [0x55198d]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a00
nop
int3
Function at 0x412050
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41225e
sub esp, 0x20
mov edx, dword [esp + 0x24]
test byte [edx], al
movzx ebx, byte [esp + 0x28]
movzx eax, bl
cmp eax, 0x88
jae 0x412253
mov ecx, dword [edx + eax*4 + 0x14]
movzx ebp, word [ecx + 0x38]
cmp dword [ecx + 0x1c], ebp
jne 0x41223d
mov dword [esp + 0x18], eax
lea ebp, [0x657580]
cmp ecx, ebp
je 0x4120ce
mov ebp, dword [0x637290]
add ebp, 3
cmp dword [ecx + 0x30], ebp
jne 0x412227
shl eax, 7
lea ebx, [0x637334]
add eax, ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00412b20
mov eax, dword [esp + 0x18]
shl eax, 7
lea edx, [0x637334]
add eax, edx
mov dword [esp], eax
call fcn.00412770
mov eax, dword [esp + 4]
test eax, eax
je 0x412211
movzx ecx, word [eax + 0x38]
cmp dword [eax + 0x1c], ecx
je 0x4121fb
mov dword [esp + 0x14], eax
mov ecx, dword [0x637290]
add ecx, 3
mov dword [eax + 0x30], ecx
lea ecx, [0x65a190]
mov dword [esp], ecx
call fcn.0042d240
mov eax, dword [esp + 4]
test byte [eax], al
movzx ecx, byte [esp + 0x28]
shr cl, 1
movsx ecx, cl
cmp ecx, 0x44
jae 0x4121ef
mov dword [esp + 0x1c], eax
lea ecx, [eax + ecx*4 + 0x3c]
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 0x1c]
movzx ebp, word [edx + 0x38]
mov dword [esp], ecx
sub ebx, ebp
mov dword [esp + 4], ebx
call fcn.00401cd0
movzx eax, byte [esp + 0x28]
cmp al, 5
jne 0x412181
mov eax, dword [esp + 0x1c]
add eax, 0x30
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401cd0
mov eax, dword [esp + 0x24]
mov dword [eax + 0x10], 0
lea eax, [0x65a190]
mov dword [esp], eax
call fcn.0042d340
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0x38]
imul ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x10]
shl edx, 0xd
sub edx, ecx
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 4]
lea ebp, [0x657a00]
mov dword [esp], ebp
mov ebp, 0
sbb ebp, 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
call fcn.0041da40
mov eax, dword [esp + 0x24]
mov dword [eax + 4], 0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [eax + ecx*4 + 0x14], edx
add esp, 0x20
ret
mov eax, ecx
mov ecx, 0x44
call fcn.0045f450
lea eax, [0x54cb8f]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a00
lea eax, [0x549fcc]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a00
lea eax, [0x54c93d]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a00
lea eax, [0x55160e]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a00
mov ecx, 0x88
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00412050
Function at 0x412670
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41275d
sub esp, 0x10
mov eax, dword [0x637290]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x24c]
cmp edx, eax
je 0x4126d7
lea ebx, [eax - 2]
cmp edx, ebx
jne 0x4126db
mov dword [esp], ecx
call fcn.00412470
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044a410
mov eax, dword [esp + 0x14]
add eax, 0x24c
mov ecx, dword [0x637290]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401e20
add esp, 0x10
ret
add esp, 0x10
ret
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.004351d0
lea eax, str.bad_flushGen_bad_map_statecrypted_big:_dalTLDpSugct_empty_integerexchange_fullfatal_error:_gethostbynamegetservbynameinvalid_base_kernel32.dll
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54efd0]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x549af0]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00412670

Function at 0x412d50
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412e48
sub esp, 0x20
mov edx, dword [0x637304]
mov dword [esp + 0x1c], edx
mov ebx, dword [0x637308]
mov dword [esp + 0x18], ebx
xor eax, eax
jmp 0x412d90
mov ebp, dword [esp + 0x14]
lea eax, [ebp + 1]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp eax, ebx
jge 0x412dfb
mov ebp, dword [0x6372dc]
test byte [ebp], al
mov esi, dword [edx + eax*4]
cmp esi, 0x400
jae 0x412e3b
mov dword [esp + 0x14], eax
mov ebp, dword [ebp + esi*4]
test byte [ebp], al
mov esi, dword [ebp + 0x408c0]
test esi, esi
je 0x412dc5
xor ecx, ecx
jmp 0x412e21
mov dword [esp + 0x10], ebp
mov dword [esp], 0x20000
mov dword [esp + 4], 0
lea eax, [0x658bf8]
mov dword [esp + 8], eax
call fcn.0040b630
mov eax, dword [esp + 0xc]
test eax, eax
je 0x412e06
mov edx, dword [esp + 0x10]
mov dword [edx + 0x408c0], eax
jmp 0x412d81
mov byte [0x657192], 1
add esp, 0x20
ret
lea eax, [0x551b81]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00433a00
mov byte [esi + ecx], 0
inc ecx
cmp ecx, 0x20000
jge 0x412d81
jb 0x412e1c
mov eax, ecx
mov ecx, 0x20000
call fcn.0045f450
mov eax, esi
mov ecx, 0x400
call fcn.0045f460
nop
call fcn.0045e000
jmp fcn.00412d50
Function at 0x412ec0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413088
sub esp, 0x18
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
movzx ecx, byte [esp + 0x2c]
test al, cl
je 0x412f5c
mov eax, dword [0x6372dc]
test byte [eax], al
nop
mov ecx, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 0x16
mov dword [esp + 0x10], ecx
mov eax, dword [eax + ecx*4]
test byte [eax], al
mov eax, dword [eax + 0x408c0]
test byte [eax], al
shr edx, 0x19
and edx, 0x1ffff
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.00401bc0
mov ecx, dword [esp + 0x10]
and ecx, 7
mov eax, 1
shl eax, cl
movzx ecx, byte [esp + 4]
test cl, al
je 0x412f43
mov byte [esp + 0x34], 1
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], al
call fcn.00401ea0
mov byte [esp + 0x34], 0
add esp, 0x18
ret
call fcn.004351d0
call fcn.004351d0
lea eax, [0x5534fd]
mov dword [esp], eax
mov dword [esp + 4], 0x39
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353f0
call fcn.00435240
call fcn.004351d0
lea eax, [0x54d761]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547e0d]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547e6b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
lea eax, [0x5481e6]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
call fcn.0041b870
lea eax, [0x5480a8]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041b870
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 2
lea eax, [0x54f53f]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00412ec0
Function at 0x413100
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413252
sub esp, 0x24
mov eax, dword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x4000
call fcn.00430ee0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x413151
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
jmp 0x41315b
add esp, 0x24
ret
sub edx, ecx
add eax, ecx
mov ecx, edx
test ecx, ecx
jbe 0x413175
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
mov edx, ecx
jmp 0x413181
cmp ecx, 0x1000
jae 0x413155
jmp 0x4131cc
add esp, 0x24
ret
shr ecx, 1
and ecx, 0xfffff000
mov dword [esp + 0x1c], ecx
cmp ecx, 0x1000
jae 0x413191
xor ebx, ebx
jmp 0x4131c6
mov edx, dword [sym.imp.kernel32.dll_VirtualFree]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x4000
call fcn.00430ee0
mov eax, dword [esp + 0x10]
test eax, eax
sete al
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x20]
test bl, bl
jne 0x413179
jmp 0x41316b
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.004351d0
lea eax, [0x54d749]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54d7f1]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54fee2]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00413100
Function at 0x413260
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41344c
sub esp, 0x28
mov eax, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 4
call fcn.00430f30
mov eax, dword [esp + 0x2c]
mov ecx, eax
cmp dword [esp + 0x14], eax
je 0x4132bb
mov eax, dword [esp + 0x30]
mov edx, eax
jmp 0x4132c5
add esp, 0x28
ret
sub ebx, eax
add ecx, eax
mov eax, ebx
test eax, eax
jbe 0x4132de
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], ecx
mov ebx, eax
jmp 0x4132e9
cmp eax, 0x1000
jae 0x4132bf
jmp 0x413341
add esp, 0x28
ret
shr eax, 1
and eax, 0xfffff000
mov dword [esp + 0x18], eax
cmp eax, 0x1000
jae 0x4132f8
xor ebp, ebp
jmp 0x413339
mov edx, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 4
call fcn.00430f30
mov eax, dword [esp + 0x14]
test eax, eax
sete al
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
mov ebp, eax
mov eax, dword [esp + 0x18]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4132e2
jmp 0x4132d5
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x20], eax
cmp eax, 8
jne 0x4133cb
call fcn.004351d0
lea eax, [0x54dc0b]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54d7f1]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x549fcc]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a00
cmp eax, 0x5af
je 0x413352
call fcn.004351d0
lea eax, [0x54dc0b]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54d7f1]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54f710]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00413260
Function at 0x413460
Capabilities:
Delete volume shadow copies

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x20]
sub eax, ecx
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, 0
sbb edx, 0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0042d110
mov eax, dword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x8000
call fcn.00430ee0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4134b9
add esp, 0x18
ret
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x14], eax
call fcn.004351d0
lea eax, [0x54d749]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54d7f1]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x54f9ac]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
nop
int3