joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.0043d650
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.00437f40
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x43d723
cmp dword [eax + 4], ecx
jae 0x43d751
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x43d880]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.0045def0
mov eax, dword [esp + 0xc]
movzx ecx, byte [0x63b848]
test cl, cl
je 0x43d77e
lea eax, [0x556288]
mov dword [esp], eax
call fcn.0045def0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043d650
lea eax, [0x631c7c]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
je 0x43d7b6
lea eax, [0x556164]
mov dword [esp], eax
call fcn.0045def0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043d650
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x1178]
test ecx, ecx
je 0x43d7f2
lea eax, [0x556240]
mov dword [esp], eax
call fcn.0045def0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043d650
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x160], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.00401e20
mov eax, dword [0x631c70]
test eax, eax
je 0x43d863
lea eax, [0x556160]
mov dword [esp], eax
call fcn.0045def0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0043d650
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
Function at 0x43ec60
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43ee17
sub esp, 0x2c
mov eax, dword [esp + 0x34]
test byte [eax], al
lea ecx, [eax + 0x48]
mov dword [esp], ecx
call fcn.00401c10
cmp dword [esp + 4], 6
jne 0x43ee00
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ebx, ecx
sub ecx, edx
cmp ecx, 0x1000
je 0x43ecce
mov dword [esp], edx
mov dword [esp + 4], ebx
call fcn.0044a790
mov eax, dword [esp + 0x34]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x4f4]
mov dword [eax + 0x58], edx
nop
mov dword [ecx + 0x4f4], eax
mov eax, dword [ecx + 0x4f8]
inc eax
mov dword [ecx + 0x4f8], eax
cmp eax, 0x40
jl 0x43ed18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
xor eax, eax
jmp 0x43ed1d
add esp, 0x2c
ret
inc eax
cmp dword [ecx + 0x4f8], 0x20
jl 0x43ed80
nop
mov edx, dword [ecx + 0x4f4]
test edx, edx
je 0x43ed3a
mov ebx, dword [edx + 0x58]
mov dword [ecx + 0x4f4], ebx
dec dword [ecx + 0x4f8]
mov ebx, dword [edx]
test ebx, ebx
jne 0x43ed63
nop
mov ebx, dword [esp + 0x24]
mov dword [edx + 0x58], ebx
nop
mov ebx, edx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x43ed1c
mov dword [esp + 0x28], ebx
jmp 0x43ed1c
nop
mov ebx, dword [esp + 0xc]
mov dword [edx + 0x58], ebx
nop
mov ebx, edx
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x43ed1c
mov dword [esp + 0x10], ebx
jmp 0x43ed1c
mov dword [esp + 8], eax
nop
lea eax, [0x631c4c]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
test ecx, ecx
je 0x43edba
mov ecx, dword [0x631c54]
mov dword [eax + 0x58], ecx
mov eax, dword [esp + 0x1c]
mov dword [0x631c54], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x43ede1
mov ecx, dword [0x631c50]
mov dword [eax + 0x58], ecx
mov eax, dword [esp + 0x14]
mov dword [0x631c50], eax
mov eax, dword [esp + 8]
add dword [0x631c58], eax
nop
nop
lea eax, [0x631c4c]
mov dword [esp], eax
call fcn.00409340
jmp 0x43ed18
lea eax, [0x54ec12]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0043ec60
Function at 0x43f0f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
sub esp, 8
lea eax, [0x6573f0]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
jne 0x43f10e
call fcn.00439d20
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x140]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x140]
test ecx, ecx
je 0x43f157
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
nop
mov edx, eax
mov dword [ecx + 0xbc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x98], eax
add esp, 8
ret
dec ecx
mov dword [eax + 0x140], ecx
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d98c]
mov dword [esp + 4], eax
call fcn.004332d0
nop
int3
Function at 0x441f40
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x442020
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00442120
movzx eax, byte [esp + 4]
test al, al
je 0x442009
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00441e90
mov eax, dword [0x631004]
mov ecx, dword [0x631000]
mov edx, dword [esp + 0x10]
mov ebx, dword [edx]
mov ebp, ebx
sar ebx, 0x1f
shr ebx, 0x1b
add ebx, ebp
sar ebx, 5
mov esi, ebx
shl ebx, 5
sub ebp, ebx
test ebp, ebp
jl 0x442004
cmp ebp, 0x20
sbb ebx, ebx
mov edi, ecx
mov ecx, ebp
mov edx, 1
shl edx, cl
and edx, ebx
cmp eax, esi
jbe 0x441ffb
lea eax, [edi + esi*4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401ed0
mov eax, dword [0x631c24]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], eax
nop
mov dword [0x631c24], ecx
lea eax, [0x631c28]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
add esp, 0xc
ret
mov ecx, eax
mov eax, esi
call fcn.0045f450
call fcn.00432090
lea eax, [0x55060d]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00441f40
Function at 0x4422d0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x1a0]
cmp eax, dword [ecx + 8]
jbe 0x442476
sub esp, 0x220
lea edi, [esp + 0x1c]
mov ecx, 0x81
xor eax, eax
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x230]
mov ebx, dword [esp + 0x22c]
sub edx, ebx
shr edx, 1
cmp edx, 0x80
jne 0x44245f
mov eax, dword [esp + 0x224]
xor ecx, ecx
jmp 0x442340
test byte [eax], al
lea ebp, [ecx + ebx]
and ebp, 0xff
mov ebp, dword [eax + ebp*4 + 0xf0]
mov dword [esp + ecx*4 + 0x1c], ebp
inc ecx
cmp ecx, edx
jb 0x442329
mov dword [esp + 0x10], edx
test byte [eax], al
add eax, 0xe8
mov dword [esp], eax
mov dword [esp + 4], ebx
lea eax, [edx + ebx]
mov dword [esp + 8], eax
call fcn.00401c70
movzx eax, byte [esp + 0xc]
test al, al
je 0x44237e
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x228]
mov dword [esp + edx*4 + 0x1c], ebx
xor eax, eax
jmp 0x442396
mov byte [esp + 0x234], 0
add esp, 0x220
ret
mov esi, dword [esp + eax*4 + 0x20]
mov dword [ebx + 0x58], esi
mov eax, ebp
cmp eax, edx
jae 0x4423b0
mov ebx, dword [esp + eax*4 + 0x1c]
test byte [ebx], al
lea ebp, [eax + 1]
cmp ebp, 0x81
jb 0x44238d
jmp 0x442453
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + edx*4 + 0x1c]
mov dword [esp + 0x18], eax
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409140
nop
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
test eax, eax
je 0x442410
mov edx, eax
mov dword [eax + 0x58], 0
mov eax, dword [0x631c34]
test eax, eax
je 0x442404
mov dword [eax + 0x58], ecx
jmp 0x44240a
mov dword [0x631c30], ecx
mov dword [0x631c34], edx
mov eax, dword [0x631c38]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx + 1]
mov dword [0x631c38], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
nop
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
mov byte [esp + 0x234], 1
add esp, 0x220
ret
mov eax, ebp
mov ecx, 0x81
call fcn.0045f460
lea eax, [0x54f2dc]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004422d0
Function at 0x445ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x445d9e
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x633340]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
je 0x445d83
mov eax, dword [esp + 0x1c]
lea ecx, [0x633340]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00409140
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
je 0x445d71
mov eax, dword [esp + 0x1c]
lea ecx, [0x633340]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.004461b0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x445c94
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x24]
test eax, eax
je 0x445d6d
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x445cf1
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.0045b870
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x445d87
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x445d2b
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445db0
movzx eax, byte [esp + 4]
test al, al
je 0x445d27
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x445d2b
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.00445820
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x445d6d
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x445d6d
lea eax, [0x5561c8]
mov dword [esp], eax
call fcn.0045de90
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409340
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x54df27]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00445ba0
Function at 0x4464e0
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4465f1
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0x28]
mov ebx, dword [ecx + 8]
mov ebp, dword [0x6573b0]
test ebp, ebp
jne 0x44651b
mov dword [ecx + 8], eax
mov dword [eax + 0x28], ecx
mov dword [eax + 4], ebx
jmp 0x44653b
lea edi, [ecx + 8]
call fcn.0045f3d0
lea edi, [eax + 0x28]
mov ebp, eax
mov eax, ecx
call fcn.0045f3d0
lea edi, [ebp + 4]
mov eax, ebx
call fcn.0045f3d0
mov eax, ebp
test ebx, ebx
je 0x446556
mov ebp, dword [0x6573b0]
test ebp, ebp
jne 0x44654e
mov dword [ebx + 0x28], eax
jmp 0x446556
lea edi, [ebx + 0x28]
call fcn.0045f3d0
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x446565
mov dword [ecx + 0x28], edx
jmp 0x446573
lea edi, [ecx + 0x28]
mov ebx, eax
mov eax, edx
call fcn.0045f3d0
mov eax, ebx
test edx, edx
je 0x4465b7
cmp dword [edx + 8], eax
jne 0x446597
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x44658b
mov dword [edx + 8], ecx
jmp 0x4465d6
lea edi, [edx + 8]
mov eax, ecx
call fcn.0045f3d0
jmp 0x4465d6
cmp dword [edx + 4], eax
jne 0x4465da
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x4465ab
mov dword [edx + 4], ecx
jmp 0x4465d6
lea edi, [edx + 4]
mov eax, ecx
call fcn.0045f3d0
jmp 0x4465d6
mov edx, dword [esp + 0xc]
test byte [edx], al
mov ebx, dword [0x6573b0]
test ebx, ebx
jne 0x4465cc
mov dword [edx + 4], ecx
jmp 0x4465d6
lea edi, [edx + 4]
mov eax, ecx
call fcn.0045f3d0
add esp, 8
ret
lea eax, [0x54bb30]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004464e0
Function at 0x447200
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4473b4
sub esp, 0x18
mov eax, dword [esp + 0x1c]
cmp eax, 0x60
jae 0x447295
lea eax, [0x657518]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x1c]
shr eax, 5
cmp eax, 3
jae 0x4473a9
mov dword [esp + 0x14], eax
lea ecx, [0x6574f0]
lea ecx, [ecx + eax*4]
mov dword [esp], ecx
call fcn.00401c10
mov ecx, dword [esp + 0x1c]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 4]
test ecx, eax
je 0x447276
mov dword [esp + 0x10], eax
jmp 0x4472a2
lea eax, [0x657518]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
mov byte [esp + 0x20], 0
add esp, 0x18
ret
mov byte [esp + 0x20], 0
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [0x6574e4]
mov ebx, dword [edx + ecx*4]
test eax, ebx
jne 0x4472d3
lea edx, [edx + ecx*4]
mov dword [esp], edx
mov dword [esp + 4], ebx
or ebx, eax
mov dword [esp + 8], ebx
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x44729e
jmp 0x4472f2
lea eax, [0x657518]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
mov byte [esp + 0x20], 1
add esp, 0x18
ret
lea eax, [0x657514]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
je 0x447336
cmp eax, 1
jne 0x44736f
lea eax, [0x657514]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 0
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x4472f2
jmp 0x44735f
lea eax, [0x657514]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x4472f2
jmp 0x447374
lea eax, [0x6574e0]
mov dword [esp], eax
call fcn.00409430
jmp 0x447374
cmp eax, 2
jne 0x447393
lea eax, [0x657518]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
mov byte [esp + 0x20], 1
add esp, 0x18
ret
lea eax, [0x54e57e]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00433a00
mov ecx, 3
call fcn.0045f460
nop
call fcn.0045e000
jmp fcn.00447200
Function at 0x449f80
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44a0ef
sub esp, 0x1c
movzx edx, byte [esp + 0x20]
movzx eax, dl
cmp eax, 3
jae 0x44a0e4
shl eax, 6
lea ecx, [0x657820]
lea ebx, [ecx + eax + 4]
mov eax, dword [ecx + eax + 4]
test eax, eax
jne 0x44a015
mov dword [esp + 0x14], ebx
lea eax, [0x637200]
mov dword [esp], eax
mov dword [esp + 4], 4
mov byte [esp + 8], 1
call fcn.004243b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44a0ce
movzx edx, word [eax + 0x38]
test dx, dx
jne 0x44a0b8
mov edx, dword [eax + 0x14]
test edx, edx
jne 0x44a0a2
movzx ecx, byte [esp + 0x20]
mov edx, 0x1000
shl edx, cl
mov dword [eax + 0x40], edx
xor ecx, ecx
jmp 0x44a079
mov ecx, dword [eax + 0x14]
mov edx, ecx
test ecx, ecx
je 0x44a04f
mov ecx, dword [ecx]
mov dword [eax + 0x14], ecx
movzx ecx, word [eax + 0x38]
inc ecx
mov word [eax + 0x38], cx
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x44a047
mov dword [esp + 0x18], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004256d0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], edx
add esp, 0x1c
ret
lea eax, [0x54d289]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a00
mov edx, dword [eax + 0xc]
add edx, ecx
mov ebx, edx
mov ebp, dword [eax + 0x14]
mov dword [edx], ebp
mov dword [eax + 0x14], ebx
mov edx, dword [eax + 0x40]
add ecx, edx
cmp ecx, 0x8000
jb 0x44a065
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00425830
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x44a015
lea eax, [0x54b2b7]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00433a00
lea eax, [0x54a24f]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00433a00
lea eax, [0x549fcc]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a00
mov ecx, 3
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00449f80
Function at 0x44a100
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44a236
sub esp, 0x10
mov eax, dword [0x6372dc]
test byte [eax], al
nop
nop
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr ecx, 0x16
mov eax, dword [eax + ecx*4]
shr edx, 0xd
and edx, 0x1ff
mov edx, dword [eax + edx*4 + 0x40000]
mov dword [esp + 0xc], edx
test byte [edx], al
test byte [eax], al
lea eax, [edx + 0x3b]
mov dword [esp], eax
call fcn.00401bc0
cmp byte [esp + 4], 2
jne 0x44a21f
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + 0x14]
test ebx, ebx
jne 0x44a196
movzx ebx, byte [esp + 0x18]
movzx eax, bl
cmp eax, 3
jae 0x44a215
shl eax, 6
lea ecx, [0x657820]
lea eax, [ecx + eax + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00425830
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
mov ebp, ebx
mov esi, dword [edx + 0x14]
mov dword [ebx], esi
mov dword [edx + 0x14], ebp
movzx ebx, word [edx + 0x38]
lea ebp, [ebx - 1]
mov word [edx + 0x38], bp
mov ebp, dword [0x657220]
test ebp, ebp
jne 0x44a207
cmp bx, 1
jne 0x44a207
movzx ebx, byte [esp + 0x18]
movzx eax, bl
cmp eax, 3
jae 0x44a20b
shl eax, 6
lea ecx, [0x657820]
lea eax, [ecx + eax + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004256d0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x14], 0
lea ecx, [0x637200]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov byte [esp + 8], 1
call fcn.00425180
add esp, 0x10
ret
mov ecx, 3
call fcn.0045f450
mov ecx, 3
call fcn.0045f450
lea eax, [0x54fd35]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0044a100
Function at 0x44c1a0
Capabilities:
Clear windows event logs
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c336
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x44c31f
lea ecx, [eax + 0x48]
mov dword [esp], ecx
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, 0x1000
jne 0x44c20e
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x4c]
mov ebx, dword [esp + 0x10]
cmp ebx, edx
jne 0x44c309
cmp ecx, edx
je 0x44c309
cmp eax, 2
je 0x44c212
jmp 0x44c309
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x44c240
movzx eax, byte [ebx + 0x68]
test al, al
je 0x44c225
xor eax, eax
jmp 0x44c242
lea eax, [ebx + 0x6d]
mov dword [esp], eax
call fcn.00401bc0
movzx eax, byte [esp + 4]
test al, al
sete al
mov ebx, dword [esp + 0x10]
jmp 0x44c242
xor eax, eax
test al, al
je 0x44c2f3
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
cmp dword [eax + 0x4c], ebx
jne 0x44c26c
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x184]
test eax, eax
jne 0x44c2dd
mov eax, dword [0x657534]
test eax, eax
jg 0x44c2d9
mov eax, dword [ebx + 0xc0]
mov dword [esp], eax
call fcn.0044f440
mov eax, dword [esp + 4]
test eax, eax
je 0x44c296
cmp byte [eax + 0x24], 6
jne 0x44c296
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ebx, ecx
sub ecx, edx
mov edx, ecx
shr ecx, 1
cmp ecx, 0x1000
jb 0x44c2d5
mov ebp, dword [eax + 0x1c]
sub ebx, ebp
add ebx, 0x320
shr edx, 2
cmp edx, ebx
ja 0x44c2c5
add esp, 0xc
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0044b190
add esp, 0xc
ret
add esp, 0xc
ret
add esp, 0xc
ret
lea eax, [0x54e115]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00433a00
lea eax, [0x54d272]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a00
lea eax, [0x54da49]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a00
lea eax, [0x54e94a]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0044c1a0
Function at 0x44cb20
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44cbe9
sub esp, 0x10
lea eax, [0x53d1a0]
mov dword [esp + 8], eax
lea eax, [0x6572a0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x44cbd2
lea ecx, [0x6573a0]
lea edx, [0x61b240]
jmp 0x44cb6e
mov edx, dword [edx + 0x110]
test edx, edx
je 0x44cb84
cmp dword [edx + 0x98], ecx
ja 0x44cb68
cmp dword [edx + 0x80], ecx
jbe 0x44cb68
jmp 0x44cb86
xor edx, edx
test edx, edx
je 0x44cbbc
mov ecx, dword [eax]
lea ebx, [ecx + 7]
and ebx, 0xfffffff8
neg ebx
mov ebp, dword [eax + 4]
mov eax, dword [eax + 0x14]
sub eax, dword [edx + 0x94]
mov dword [0x6573a0], ebx
mov dword [0x6573a4], ecx
mov dword [0x6573a8], ebp
mov dword [0x6573ac], eax
add esp, 0x10
ret
lea eax, [0x551d55]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a00
lea eax, [0x553710]
mov dword [esp], eax
mov dword [esp + 4], 0x3d
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0044cb20
Function at 0x44efa0
Capabilities:
Delete volume shadow copies

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x58]
mov edx, dword [esp + 0x20]
lea ebx, [ecx + edx]
mov ebp, dword [eax + 0xa0]
mov esi, dword [eax + 0x9c]
cmp ebp, 1
jle 0x44efce
mov dword [esp + 0x14], ecx
mov dword [esp + 8], ebx
xor edi, edi
jmp 0x44efe7
mov dword [esp + 0x24], ebx
add esp, 0x18
ret
add esi, 0xc
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 8]
mov edi, eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esi]
cmp edx, eax
jb 0x44eff7
cmp edx, ecx
jb 0x44f013
mov dword [esp + 0x10], eax
lea eax, [ebp - 1]
cmp edi, eax
jne 0x44f006
cmp edx, ecx
je 0x44f00f
lea eax, [edi + 1]
cmp ebp, eax
jg 0x44efd6
jmp 0x44f019
mov eax, dword [esp + 0x10]
add ebx, edx
sub ebx, eax
jmp 0x44f01d
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x5c]
cmp ebx, eax
jbe 0x44efce
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
call fcn.004351d0
lea eax, [0x54b479]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x54a0b9]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547efe]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353f0
call fcn.00435240
lea eax, [0x54ff66]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
nop
int3