joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a6d0
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a8e0
sub esp, 0x1c
mov edx, dword [esp + 0x20]
test byte [edx], al
movzx ebx, byte [esp + 0x24]
movzx eax, bl
cmp eax, 0x88
jae 0x40a8d5
mov dword [esp + 0x18], eax
mov ecx, dword [edx + eax*4 + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
call fcn.0040f590
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x1c]
cmp edx, eax
jne 0x40a77b
mov dword [esp + 0x10], edx
movzx ecx, word [ecx + 0x38]
movzx ebx, cx
cmp edx, ebx
jne 0x40a853
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
movzx ecx, byte [esp + 0x24]
mov byte [esp + 4], cl
call fcn.00412020
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + eax*4 + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.0040f590
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
jmp 0x40a77d
mov ebx, eax
cmp dword [ecx + 0x1c], eax
jbe 0x40a83d
mov ebp, dword [ecx + 0x40]
imul eax, ebp
add eax, dword [ecx + 0xc]
movzx ebp, word [ecx + 0x38]
inc ebp
mov word [ecx + 0x38], bp
movzx esi, bp
mov edi, dword [ecx + 0x1c]
cmp edi, esi
jb 0x40a7b7
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
cmp edx, ebx
sete al
mov byte [esp + 0x30], al
add esp, 0x1c
ret
mov word [esp + 0xa], bp
mov dword [esp + 0x10], edi
call fcn.00435250
lea eax, [0x55e8fe]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e80
mov dword [esp + 4], 0
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55da4b]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x561890]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a80
lea eax, [0x560fcb]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
mov word [esp + 0xa], cx
call fcn.00435250
lea eax, [0x561879]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e80
mov dword [esp + 4], 0
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55da4b]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x567607]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a80
mov ecx, 0x88
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.0040a6d0
Function at 0x40b250
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b2d5
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x40b275
mov eax, dword [eax + 0x30]
jmp 0x40b27b
mov eax, dword [0x67e13c]
test eax, eax
je 0x40b2be
mov ecx, dword [0x67e0c0]
cmp ecx, 1
jne 0x40b28e
xor ecx, ecx
jmp 0x40b2a4
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.0040b2e0
mov eax, dword [esp + 4]
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0042b360
add esp, 0xc
ret
lea eax, [0x567ee6]
mov dword [esp], eax
mov dword [esp + 4], 0x38
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0040b250
Function at 0x40c150
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c322
sub esp, 0x18
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40c212
mov ecx, dword [eax]
test ecx, ecx
je 0x40c212
movzx ecx, byte [eax + 4]
test cl, 4
jne 0x40c30b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x2c]
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
mov esi, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], ebp
call ebx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
movzx ebx, byte [ecx + 5]
mov edx, ecx
mov ecx, ebx
mov ebp, 1
shl ebp, cl
lea ecx, [ebp - 1]
mov ebx, ecx
and ecx, eax
mov ebp, dword [esp + 0x1c]
movzx esi, word [ebp + 0x32]
imul ecx, esi
mov edi, dword [edx + 0x10]
add ecx, dword [edx + 0xc]
test edi, edi
je 0x40c201
movzx ebp, byte [edx + 4]
xchg ebp, eax
test al, 8
xchg ebp, eax
jne 0x40c1e5
shr ebx, 1
and ebx, eax
imul esi, ebx
lea ebx, [edi + esi]
movzx ebp, byte [edi + esi]
add ebp, 0xfffffffe
xchg ebp, eax
cmp al, 3
xchg ebp, eax
jb 0x40c1fd
mov ecx, ebx
mov ebp, dword [esp + 0x1c]
shr eax, 0x18
cmp al, 5
jae 0x40c20c
add eax, 5
mov byte [esp + 0xf], al
jmp 0x40c254
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x34]
test ecx, 0x10
je 0x40c237
mov edx, dword [eax + 0x2c]
mov eax, dword [edx]
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], 0
call eax
lea eax, [0x67eea0]
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], 0
add esp, 0x18
ret
movzx ebx, word [ebp + 0x32]
lea ebx, [ecx + ebx - 4]
mov ecx, dword [ebx]
test ecx, ecx
je 0x40c260
mov dword [esp + 0x14], ecx
xor edx, edx
jmp 0x40c274
lea eax, [0x67eea0]
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], 0
add esp, 0x18
ret
inc edx
cmp edx, 8
jae 0x40c24a
movzx ebx, byte [edx + ecx]
cmp al, bl
je 0x40c287
test bl, bl
jne 0x40c273
jmp 0x40c260
mov dword [esp + 0x10], edx
movzx ebx, byte [ebp + 0x30]
imul ebx, edx
lea ecx, [ebx + ecx + 8]
mov ebx, dword [ebp + 0x34]
test ebx, 1
je 0x40c2a3
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x20]
mov edx, dword [eax + 0x10]
mov eax, dword [edx]
mov ebx, dword [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call eax
movzx eax, byte [esp + 8]
test al, al
jne 0x40c2d4
movzx eax, byte [esp + 0xf]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
jmp 0x40c273
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x30]
movzx edx, byte [eax + 0x31]
mov ebx, dword [esp + 0x10]
imul edx, ebx
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x14]
lea ecx, [edx + ecx + 8]
mov eax, dword [eax + 0x34]
test eax, 2
je 0x40c2fe
mov ecx, dword [ecx]
mov dword [esp + 0x28], ecx
mov byte [esp + 0x2c], 1
add esp, 0x18
ret
lea eax, [0x564552]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0040c150
Function at 0x40d800
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d939
sub esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d8c1
mov ecx, dword [eax]
test ecx, ecx
je 0x40d8c1
movzx ecx, byte [eax + 4]
test cl, 4
jne 0x40d922
movzx ecx, byte [eax + 5]
test cl, cl
jne 0x40d852
mov eax, dword [eax + 0xc]
mov ebp, dword [esp + 0x10]
mov ecx, eax
jmp 0x40d8dc
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x2c]
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 4], ebp
call ebx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
movzx ebx, byte [ecx + 5]
mov edx, ecx
mov ecx, ebx
mov ebp, 1
shl ebp, cl
lea ecx, [ebp - 1]
mov ebx, ecx
and ecx, eax
mov ebp, dword [esp + 0x10]
movzx esi, word [ebp + 0x32]
imul ecx, esi
mov edi, dword [edx + 0x10]
add ecx, dword [edx + 0xc]
test edi, edi
je 0x40d8dc
movzx edx, byte [edx + 4]
test dl, 8
jne 0x40d8a9
shr ebx, 1
and ebx, eax
imul ebx, esi
lea eax, [edi + ebx]
movzx edx, byte [edi + ebx]
add edx, 0xfffffffe
cmp dl, 3
jb 0x40d8dc
mov ecx, eax
jmp 0x40d8dc
lea eax, [0x67eea0]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
movzx eax, word [ebp + 0x32]
lea eax, [ecx + eax - 4]
test byte [ebp], al
mov ecx, dword [eax]
test ecx, ecx
je 0x40d8e8
nop
lea eax, [ecx + 8]
xor edx, edx
jmp 0x40d8fa
lea eax, [0x67eea0]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
inc edx
add eax, 4
cmp edx, 8
jae 0x40d8cf
mov ebx, dword [eax]
cmp dword [esp + 0x18], ebx
jne 0x40d8f6
lea ebx, [ecx + edx]
cmp byte [ebx], 1
jbe 0x40d8f6
movzx eax, byte [ebp + 0x31]
imul edx, eax
lea eax, [edx + ecx + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x564552]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0040d800
Function at 0x40d950
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40da98
sub esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40da11
mov ecx, dword [eax]
test ecx, ecx
je 0x40da11
movzx ecx, byte [eax + 4]
test cl, 4
jne 0x40da81
movzx ecx, byte [eax + 5]
test cl, cl
jne 0x40d9a2
mov eax, dword [eax + 0xc]
mov ebp, dword [esp + 0x10]
mov ecx, eax
jmp 0x40da31
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x2c]
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 4], ebp
call ebx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
movzx ebx, byte [ecx + 5]
mov edx, ecx
mov ecx, ebx
mov ebp, 1
shl ebp, cl
lea ecx, [ebp - 1]
mov ebx, ecx
and ecx, eax
mov ebp, dword [esp + 0x10]
movzx esi, word [ebp + 0x32]
imul ecx, esi
mov edi, dword [edx + 0x10]
add ecx, dword [edx + 0xc]
test edi, edi
je 0x40da31
movzx edx, byte [edx + 4]
test dl, 8
jne 0x40d9f9
shr ebx, 1
and ebx, eax
imul ebx, esi
lea eax, [edi + ebx]
movzx edx, byte [edi + ebx]
add edx, 0xfffffffe
cmp dl, 3
jb 0x40da31
mov ecx, eax
jmp 0x40da31
lea eax, [0x67eea0]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
add esp, 0xc
ret
movzx eax, word [ebp + 0x32]
lea eax, [ecx + eax - 4]
test byte [ebp], al
mov ecx, dword [eax]
test ecx, ecx
je 0x40da3d
nop
lea eax, [ecx + 8]
xor edx, edx
jmp 0x40da54
lea eax, [0x67eea0]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
add esp, 0xc
ret
inc edx
add eax, 4
cmp edx, 8
jae 0x40da24
mov ebx, dword [eax]
cmp dword [esp + 0x18], ebx
jne 0x40da50
lea ebx, [ecx + edx]
cmp byte [ebx], 1
jbe 0x40da50
movzx eax, byte [ebp + 0x31]
imul edx, eax
lea eax, [edx + ecx + 0x28]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea eax, [0x564552]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0040d950
Function at 0x40f730
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40f977
sub esp, 0x1c
call fcn.00435250
call fcn.00435250
lea eax, [0x55f5a1]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00435d00
call fcn.004352c0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40f871
call fcn.00435250
call fcn.00435470
call fcn.004352c0
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x40f7d2
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 2
lea eax, [0x5682c9]
mov dword [esp], eax
mov dword [esp + 4], 0x3e
call fcn.00433a80
call fcn.00435250
lea eax, [0x563afa]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55c26d]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55c2cb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
lea eax, [0x55cbd2]
mov dword [esp], eax
mov dword [esp + 4], 6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.0041b840
jmp 0x40f7a5
nop
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
call fcn.00401b90
movzx eax, byte [esp + 4]
mov byte [esp + 0x13], al
cmp al, 1
je 0x40f952
call fcn.00435250
lea eax, [0x5601f5]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00435e80
call fcn.004352c0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
call fcn.00435250
lea eax, [0x55e369]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55dee7]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55def3]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435e80
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp], eax
call fcn.00435b20
call fcn.004352c0
jmp 0x40f78e
call fcn.00435250
lea eax, [0x561e85]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
call fcn.004352c0
jmp 0x40f8af
call fcn.0045e080
jmp fcn.0040f730
Function at 0x410090
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ebx, eax
or eax, edx
mov ebp, dword [esp + 0x4c]
or eax, ebp
test eax, 3
jne 0x41020a
movzx eax, byte [0x67e2d4]
test al, al
je 0x41011c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x54]
test byte [eax], al
mov esi, dword [0x65e1dc]
test byte [esi], al
nop
mov edi, edx
shr edx, 0x16
mov esi, dword [esi + edx*4]
test esi, esi
je 0x410100
mov ecx, edi
shr edi, 4
and edi, 0x3ffff
add edi, esi
shr ecx, 2
and ecx, 3
add esi, 0x3ffff
jmp 0x410108
xor edx, edx
xor ecx, ecx
xor esi, esi
xor edi, edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
jmp 0x41012f
add esp, 0x40
ret
add edx, 4
mov dword [esp + 0x20], edx
mov edx, ecx
mov ecx, ebp
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x20]
cmp ebp, edx
jbe 0x410206
movzx ebp, byte [edi]
shr ebp, cl
test ebp, 1
je 0x4101b0
lea ebp, [edx + ebx]
mov ebx, dword [eax + 0x970]
mov ebp, dword [ebp]
mov dword [ebx], 0
mov dword [ebx + 4], ebp
mov ebx, dword [eax + 0x970]
add ebx, 8
mov dword [eax + 0x970], ebx
cmp dword [eax + 0x974], ebx
jne 0x4101ac
mov dword [esp + 0x24], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.0042d470
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x48]
cmp ecx, 3
jae 0x4101ba
lea ebp, [ecx + 1]
jmp 0x4101c2
cmp esi, edi
je 0x4101cb
nop
inc edi
xor ebp, ebp
mov ecx, dword [esp + 0x28]
jmp 0x410120
mov dword [esp], edi
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
call fcn.0040faa0
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x48]
mov ecx, edx
mov edx, dword [esp + 0x20]
jmp 0x410120
add esp, 0x40
ret
lea eax, [0x565eba]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a80
nop
int3
Function at 0x410380
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4105b2
mov ecx, dword [esp + 0x38]
cmp dword [eax], ecx
jne 0x4104ed
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x410475
movzx ecx, byte [0x67e2d4]
test cl, cl
je 0x4103dd
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x24], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
xor edi, edi
jmp 0x4103e4
add esp, 0x28
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x410471
test esi, 0x1f
jne 0x4103fb
movzx edi, byte [edx]
inc edx
jmp 0x4103fd
shr edi, 1
test edi, 1
je 0x4103e1
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x970]
mov ebp, dword [ebp]
mov ebx, dword [ebx]
mov dword [eax], ebp
mov dword [eax + 4], ebx
mov eax, dword [ecx + 0x970]
add eax, 8
mov dword [ecx + 0x970], eax
cmp dword [ecx + 0x974], eax
jne 0x410460
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.0042d470
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
jmp 0x4103e1
add esp, 0x28
ret
mov dword [esp], eax
call fcn.004587a0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
call fcn.00435250
lea eax, [0x56604a]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00435e80
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55e9fa]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435e80
call fcn.004352c0
lea eax, [0x565388]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00433a80
mov dword [esp], eax
call fcn.004587a0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x2c]
mov edx, dword [edx]
mov dword [esp + 0x14], edx
call fcn.00435250
lea eax, [0x56604a]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00435e80
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55d9bc]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55f68f]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x565388]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00433a80
lea eax, [0x566301]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a80
nop
int3
Function at 0x412020
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41222e
sub esp, 0x20
mov edx, dword [esp + 0x24]
test byte [edx], al
movzx ebx, byte [esp + 0x28]
movzx eax, bl
cmp eax, 0x88
jae 0x412223
mov ecx, dword [edx + eax*4 + 0x14]
movzx ebp, word [ecx + 0x38]
cmp dword [ecx + 0x1c], ebp
jne 0x41220d
mov dword [esp + 0x18], eax
lea ebp, [0x67e4a0]
cmp ecx, ebp
je 0x41209e
mov ebp, dword [0x65e190]
add ebp, 3
cmp dword [ecx + 0x30], ebp
jne 0x4121f7
shl eax, 7
lea ebx, [0x65e234]
add eax, ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00412af0
mov eax, dword [esp + 0x18]
shl eax, 7
lea edx, [0x65e234]
add eax, edx
mov dword [esp], eax
call fcn.00412740
mov eax, dword [esp + 4]
test eax, eax
je 0x4121e1
movzx ecx, word [eax + 0x38]
cmp dword [eax + 0x1c], ecx
je 0x4121cb
mov dword [esp + 0x14], eax
mov ecx, dword [0x65e190]
add ecx, 3
mov dword [eax + 0x30], ecx
lea ecx, [0x6810b0]
mov dword [esp], ecx
call fcn.0042d210
mov eax, dword [esp + 4]
test byte [eax], al
movzx ecx, byte [esp + 0x28]
shr cl, 1
movsx ecx, cl
cmp ecx, 0x44
jae 0x4121bf
mov dword [esp + 0x1c], eax
lea ecx, [eax + ecx*4 + 0x3c]
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 0x1c]
movzx ebp, word [edx + 0x38]
mov dword [esp], ecx
sub ebx, ebp
mov dword [esp + 4], ebx
call fcn.00401ca0
movzx eax, byte [esp + 0x28]
cmp al, 5
jne 0x412151
mov eax, dword [esp + 0x1c]
add eax, 0x30
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401ca0
mov eax, dword [esp + 0x24]
mov dword [eax + 0x10], 0
lea eax, [0x6810b0]
mov dword [esp], eax
call fcn.0042d310
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0x38]
imul ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x10]
shl edx, 0xd
sub edx, ecx
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 4]
lea ebp, [0x67e920]
mov dword [esp], ebp
mov ebp, 0
sbb ebp, 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
call fcn.0041da10
mov eax, dword [esp + 0x24]
mov dword [eax + 4], 0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [eax + ecx*4 + 0x14], edx
add esp, 0x20
ret
mov eax, ecx
mov ecx, 0x44
call fcn.0045f4d0
lea eax, [0x5611db]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
lea eax, [0x55e571]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a80
lea eax, [0x560f5d]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
lea eax, [0x565f82]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a80
mov ecx, 0x88
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00412020
Function at 0x412640
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41272d
sub esp, 0x10
mov eax, dword [0x65e190]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x24c]
cmp edx, eax
je 0x4126a7
lea ebx, [eax - 2]
cmp edx, ebx
jne 0x4126ab
mov dword [esp], ecx
call fcn.00412440
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044a490
mov eax, dword [esp + 0x14]
add eax, 0x24c
mov ecx, dword [0x65e190]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401df0
add esp, 0x10
ret
add esp, 0x10
ret
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.00435250
lea eax, str.bad_flushGen_bad_map_statedalTLDpSugct_empty_integerexchange_fullfatal_error:_gethostbynamegetservbynameinvalid_base_kernel32.dll
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x563776]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x55e0d3]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00412640

Function at 0x412d20
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412e18
sub esp, 0x20
mov edx, dword [0x65e204]
mov dword [esp + 0x1c], edx
mov ebx, dword [0x65e208]
mov dword [esp + 0x18], ebx
xor eax, eax
jmp 0x412d60
mov ebp, dword [esp + 0x14]
lea eax, [ebp + 1]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp eax, ebx
jge 0x412dcb
mov ebp, dword [0x65e1dc]
test byte [ebp], al
mov esi, dword [edx + eax*4]
cmp esi, 0x400
jae 0x412e0b
mov dword [esp + 0x14], eax
mov ebp, dword [ebp + esi*4]
test byte [ebp], al
mov esi, dword [ebp + 0x408c0]
test esi, esi
je 0x412d95
xor ecx, ecx
jmp 0x412df1
mov dword [esp + 0x10], ebp
mov dword [esp], 0x20000
mov dword [esp + 4], 0
lea eax, [0x67fb18]
mov dword [esp + 8], eax
call fcn.0040b600
mov eax, dword [esp + 0xc]
test eax, eax
je 0x412dd6
mov edx, dword [esp + 0x10]
mov dword [edx + 0x408c0], eax
jmp 0x412d51
mov byte [0x67e093], 1
add esp, 0x20
ret
lea eax, [0x5664f5]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00433a80
mov byte [esi + ecx], 0
inc ecx
cmp ecx, 0x20000
jge 0x412d51
jb 0x412dec
mov eax, ecx
mov ecx, 0x20000
call fcn.0045f4d0
mov eax, esi
mov ecx, 0x400
call fcn.0045f4e0
nop
call fcn.0045e080
jmp fcn.00412d20