joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bc00
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bcb8
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 0x18]
test cl, cl
je 0x45bca1
nop
lea ecx, [eax + 0x10]
mov dword [esp], ecx
call fcn.00401c50
mov eax, dword [esp + 4]
test eax, eax
je 0x45bc3e
cmp eax, 1
jne 0x45bc8b
nop
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.00401c50
mov eax, dword [esp + 4]
test eax, eax
je 0x45bc5b
cmp eax, 1
jne 0x45bc75
lea eax, [0x67e1f8]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.0042d910
add esp, 8
ret
lea eax, [0x5662d8]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00433a80
lea eax, [0x566549]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00433a80
lea eax, [0x564fa2]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0045bc00
Function at 0x45c060
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x14
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
lea ecx, [esp + 0x18]
cmp dword [eax + 0x38], ecx
jb 0x45c21b
mov dword [esp + 0xc], eax
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x5c]
mov dword [esp + 0x10], edx
mov dword [ecx + 0x5c], 0
mov dword [esp], edx
call fcn.0043df90
movzx eax, byte [esp + 4]
test al, al
jne 0x45c0e7
mov eax, dword [esp + 0xc]
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0
movzx ecx, byte [0x662748]
test cl, cl
je 0x45c1a3
mov ecx, dword [esp + 0x10]
jmp 0x45c1e9
movzx eax, byte [0x662748]
test al, al
je 0x45c123
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov ebx, dword [esp + 0x10]
cmp edx, ebx
jne 0x45c10f
mov ecx, dword [ecx + 0x160]
cmp dword [edx + 0x10], ecx
je 0x45c127
lea eax, [0x57137c]
mov dword [esp], eax
call fcn.0045df70
mov eax, dword [esp + 0xc]
jmp 0x45c127
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
inc dword [ecx + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 3
mov dword [esp + 8], 2
call fcn.00437fc0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x38], 0
mov ecx, dword [eax + 0x18]
dec dword [ecx + 0x78]
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x45c16a
mov dword [eax + 8], 0xfffffade
jmp 0x45c175
mov ecx, dword [eax]
add ecx, 0xba0
mov dword [eax + 8], ecx
mov byte [eax + 0x6b], 0
movzx ecx, byte [0x658b3c]
test cl, cl
je 0x45c19f
mov dword [esp], eax
mov byte [esp + 4], 1
call fcn.004582a0
movzx eax, byte [esp + 8]
test al, al
jne 0x45c19f
call fcn.00436730
add esp, 0x14
ret
mov ecx, dword [eax + 0x18]
dec dword [ecx + 0x78]
lea ecx, [0x571264]
mov dword [esp], ecx
call fcn.0045df10
mov eax, dword [esp + 0xc]
mov dword [eax + 0x38], 0
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
inc dword [ecx + 0x10]
mov byte [eax + 0x6b], 0
add esp, 0x14
ret
lea eax, [0x571370]
mov dword [esp], eax
call fcn.0045df70
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x45c1fb
mov edx, dword [eax + 0x18]
mov ebx, dword [ecx + 0x10]
cmp dword [edx + 0x160], ebx
je 0x45c1d3
call fcn.0045f300
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [edx + 0x88], eax
mov dword [edx + 0x84], ecx
mov eax, edx
jmp 0x45c1a3
lea eax, [0x566b37]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00433a80
nop
int3
Function at 0x45cc20
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 8
lea eax, [0x56769a]
mov dword [esp], eax
mov dword [esp + 4], 0x32
call fcn.00433a80
nop
int3
Function at 0x45d6f0
Capabilities:
Disable automatic windows recovery features

Disassembly:
sub esp, 0x28
mov eax, 0
mov dword [esp + 0x24], eax
mov byte [esp + 0xf], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x34]
cmp edx, 4
jge 0x45d770
mov ebx, dword [esp + 0x30]
lea ebp, [esp + 0x10]
cmp ebx, ebp
je 0x45d765
mov dword [esp], ebp
mov dword [esp + 4], ebx
shl edx, 2
mov dword [esp + 8], edx
call fcn.0045fd70
mov edx, dword [esp + 0x34]
mov eax, 4
lea ecx, [esp + 0x10]
jmp 0x45d77f
cmp edx, 0x2a
jg 0x45d846
mov eax, edx
mov ecx, dword [esp + 0x30]
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x18]
nop
inc dword [ebx + 0x144]
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
nop
mov esi, ebx
mov dword [ebp + 0xbc], ebx
mov ebx, dword [esi + 0x18]
mov dword [esi + 0x98], ebx
lea ebx, [0x571384]
mov dword [esp + 0x24], ebx
mov byte [esp + 0xf], 1
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x18]
mov ebp, dword [esp + 0x2c]
mov dword [ebx + 0x18c], ebp
mov dword [ebx + 0x190], edx
test eax, eax
jbe 0x45d83d
mov dword [esp + 0x20], ebx
mov dword [ebx + 0x194], ecx
mov eax, dword [0x65763c]
mov dword [esp], eax
lea eax, [ebx + 0x18c]
mov dword [esp + 4], eax
call fcn.00403420
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x198]
mov edx, dword [eax + 0x19c]
mov eax, dword [eax + 0x1a0]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov byte [esp + 0xf], 0
call fcn.0043f260
add esp, 0x28
ret
mov ecx, eax
xor eax, eax
call fcn.0045f4d0
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a644]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.004328a0
add esp, 0x28
ret
Function at 0x45f350
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x67e3c0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45db0b
je 0x45db5e
cmp ebx, 0x20
jbe 0x45db64
cmp ebx, 0x40
jbe 0x45dbaa
jmp 0x45dc4b
test ebx, ebx
je 0x45db54
add eax, 0x10
test ax, 0xff0
je 0x45db40
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x59af40]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x59b040]
jmp 0x45db28
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45db28
pxor xmm1, xmmword [0x67e3d0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x67e3d0]
pxor xmm2, xmmword [0x67e3e0]
pxor xmm3, xmmword [0x67e3f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x67e3d0]
pxor xmm2, xmmword [0x67e3e0]
pxor xmm3, xmmword [0x67e3f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45dcaa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x67e092], 0
je 0x45f36a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45dad0
jmp fcn.00407bf0
Function at 0x45f370
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40248e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407bf0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045e080
jmp 0x402450
cmp byte [0x67e092], 0
je 0x45f38b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45dad0
jmp 0x402450

Function at 0x463620
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x463726
sub esp, 0x10
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46370d
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
call fcn.004637d0
mov eax, dword [esp + 4]
test eax, eax
je 0x463667
lea ecx, [0x67e099]
cmp eax, ecx
je 0x463645
jmp 0x4636a0
call fcn.0045c280
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
lea ecx, [0x67e099]
mov dword [esp + 8], ecx
call fcn.0045b390
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4636c1
call fcn.0045c2a0
lea ecx, [0x67e099]
jmp 0x463645
cmp dword [esp + 0x18], eax
jne 0x4636f5
mov eax, dword [esp + 0x14]
add eax, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0045b350
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
lea ecx, [eax + 4]
mov edx, dword [esp + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0045b350
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045b350
call fcn.0045c2a0
add esp, 0x10
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a724]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a71c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00463620
Function at 0x464630
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46472a
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
ja 0x4646a5
cmp ecx, 0x11
jne 0x46467d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x46466d
lea ecx, [0x59ad24]
jmp 0x464671
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x12
jne 0x464711
mov eax, dword [eax + 0x20]
test eax, eax
je 0x464695
lea ecx, [0x59ad24]
jmp 0x464699
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x15
jne 0x4646c9
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4646b9
lea ecx, [0x59ad24]
jmp 0x4646bd
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x16
jne 0x4646ed
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4646dd
lea ecx, [0x59ad24]
jmp 0x4646e1
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
cmp ecx, 0x17
jne 0x464711
mov eax, dword [eax + 0x20]
test eax, eax
je 0x464701
lea ecx, [0x59ad24]
jmp 0x464705
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
add esp, 8
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a434]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00464630
Function at 0x464910
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x464a70
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x12
ja 0x464998
cmp eax, 0x11
je 0x464989
cmp eax, 0x12
jne 0x464a05
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x464a57
mov eax, dword [eax + 4]
test eax, eax
je 0x464a57
test ecx, 0x80
je 0x464971
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x464975
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b430
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x4649dd
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x464a3f
mov eax, dword [eax + 4]
test eax, eax
je 0x464a3f
test ecx, 0x80
je 0x4649c5
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4649c9
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045b6b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x17
je 0x4649f6
cmp eax, 0x18
jne 0x464a05
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x54c000]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x55f52a]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x548c00]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a53c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00464910
Function at 0x465c60
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x465d2d
sub esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [eax + 1]
test ecx, 1
jne 0x465ca2
lea eax, [0x563b72]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.0045bfe0
mov eax, dword [esp + 0x18]
test eax, 4
jne 0x465caf
mov ecx, dword [esp + 0x14]
jmp 0x465cd7
mov eax, dword [esp + 0x14]
test byte [eax], al
add eax, 4
mov dword [esp], eax
mov byte [esp + 4], 1
mov dword [esp + 8], 1
call fcn.0045ca60
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, eax
sar eax, 3
test eax, eax
je 0x465d29
test edx, 7
jne 0x465d29
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], edx
lea eax, [edx - 8]
or eax, 2
mov dword [esp + 8], eax
call fcn.00463740
movzx eax, byte [esp + 0xc]
test al, al
je 0x465cd1
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp], eax
mov byte [esp + 4], 0
mov dword [esp + 8], 1
call fcn.0045ca60
add esp, 0x10
ret
add esp, 0x10
ret
call fcn.0045e080
jmp fcn.00465c60

Function at 0x466df0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x466e8e
sub esp, 0x14
mov eax, dword [esp + 0x18]
test byte [eax], al
lea ecx, [eax + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], 0x40000000
call fcn.00463770
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
cmp eax, 0x40000000
jl 0x466e4b
lea eax, [0x56442d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.0045bfe0
mov eax, dword [esp + 0xc]
xor ecx, ecx
jmp 0x466e7a
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0xc]
mov dword [esp], ecx
mov byte [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0045ca60
mov eax, dword [esp + 0x10]
lea ecx, [eax + 1]
mov eax, dword [esp + 0xc]
cmp ecx, eax
jl 0x466e4f
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00465c10
add esp, 0x14
ret
call fcn.0045e080
jmp fcn.00466df0
Function at 0x466ea0
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x466fc1
sub esp, 0x20
mov eax, dword [esp + 0x24]
test byte [eax], al
mov ecx, eax
test eax, 7
jne 0x466ecd
lea eax, [ecx + 8]
jmp 0x466ed6
lea edx, [ecx + 4]
mov ecx, edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov dword [esp], ecx
mov edx, dword [esp + 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
call fcn.00463780
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jl 0x466fa8
test eax, eax
je 0x466f1e
mov edx, dword [esp + 0x28]
test edx, edx
jle 0x466f1a
cmp edx, ecx
je 0x466f90
test ecx, ecx
jmp 0x466f20
test ecx, ecx
jmp 0x466f20
test ecx, ecx
jg 0x466f4a
test eax, eax
je 0x466f4a
mov edx, dword [esp + 0x18]
cmp dword [edx], eax
setne bl
cmp dword [edx + 4], ecx
setne cl
or ecx, ebx
test cl, cl
jne 0x466f78
mov dword [edx], 0
mov dword [edx + 4], 0
jmp 0x466f70
add esp, 0x20
ret
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov byte [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0045ca60
mov eax, dword [esp + 0x14]
dec eax
test eax, eax
jne 0x466f4e
add esp, 0x20
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a70c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a70c]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a704]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00466ea0
Function at 0x46b2f0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46b355
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0046b110
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test edx, edx
jne 0x46b33c
test ecx, ecx
jbe 0x46b335
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
xor eax, eax
call fcn.0045f4d0
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a72c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.0046b2f0
Function at 0x489030
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x489162
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x4890dc
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0045bd70
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
cmp eax, 1
jg 0x4890ac
test eax, eax
jne 0x48907e
xor eax, eax
xor ecx, ecx
jmp 0x4890d0
cmp eax, 1
jne 0x48910f
movzx eax, byte [esp + 0x1c]
test al, al
je 0x48909e
mov eax, dword [0x657ac8]
mov ecx, dword [0x657acc]
jmp 0x4890d0
lea eax, [0x59a9cc]
lea ecx, [0x67e1a8]
jmp 0x4890d0
cmp eax, 2
jne 0x4890bf
mov eax, dword [0x653268]
mov ecx, dword [0x65326c]
jmp 0x4890d0
cmp eax, 3
jne 0x48910f
mov eax, dword [0x657ad8]
mov ecx, dword [0x657adc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
add esp, 0x10
ret
lea eax, [0x54a280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x21
lea ecx, [0x564951]
mov dword [eax], ecx
lea ecx, [0x59a7d8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
add esp, 0x10
ret
call fcn.00435250
lea eax, [0x55e9b4]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e80
mov eax, dword [esp + 0xc]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
call fcn.00435470
call fcn.004352c0
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a42c]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00489030
Function at 0x490a30
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490a88
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x490a63
call fcn.00486c00
movzx eax, byte [esp]
test al, al
jne 0x490a6f
call fcn.0045c020
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0045c350
add esp, 8
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a4cc]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00490a30
Function at 0x499390
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49948a
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x499452
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x499471
shl ecx, 4
lea edx, [0x650300]
mov ebx, dword [edx + ecx + 8]
mov ecx, dword [edx + ecx + 0xc]
test eax, eax
jge 0x4993e2
add ebx, 1
adc ecx, 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
call fcn.004925e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shl eax, 7
mov ebx, edx
shr edx, 0x19
or edx, eax
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x1a935
sar eax, 0xf
mov edx, dword [esp + 0x28]
lea eax, [eax + edx - 6]
mov dword [esp + 0x34], eax
shl ebx, 7
mov eax, ecx
shr ecx, 0x19
or ecx, ebx
test ecx, ecx
sete cl
shl eax, 7
test eax, eax
sete al
and ecx, eax
mov byte [esp + 0x38], cl
add esp, 0x20
ret
mov eax, dword [esp + 0x24]
shl eax, 6
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffffa
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], 1
add esp, 0x20
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a6e4]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.00499390
Function at 0x4994a0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49965f
sub esp, 0x40
mov eax, dword [esp + 0x50]
test eax, eax
je 0x499615
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x499646
shl ecx, 4
lea edx, [0x650300]
lea esi, [edx + ecx]
lea edi, [esp + 0x30]
call fcn.0045fb68
test eax, eax
jge 0x499506
mov ecx, dword [esp + 0x30]
add ecx, 1
mov edx, dword [esp + 0x34]
mov dword [esp + 0x30], ecx
adc edx, 0
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.004925e0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], esi
mov edi, dword [esp + 0x48]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x44]
mov dword [esp], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.004925e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ebx, eax
adc eax, edx
mov ebp, dword [esp + 0x10]
mov esi, edx
and edx, ebx
or esi, ebx
mov ebx, eax
not eax
and eax, esi
or eax, edx
shr eax, 0x1f
add eax, ebp
mov edx, dword [esp + 0x14]
adc edx, 0
mov ebp, ebx
shl ebx, 9
mov esi, ecx
shr ecx, 0x17
or ecx, ebx
test ecx, ecx
sete cl
shl esi, 9
test esi, esi
sete bl
mov esi, dword [esp + 0x50]
imul esi, esi, 0x1a935
sar esi, 0xf
mov edi, dword [esp + 0x4c]
lea esi, [esi + edi - 8]
nop
and ebx, ecx
test bl, bl
je 0x4995ed
mov ecx, dword [esp + 0x2c]
test ecx, ecx
sete cl
mov ebx, dword [esp + 0x28]
test ebx, ebx
sete bl
and ebx, ecx
jmp 0x4995ef
xor ebx, ebx
shl edx, 9
mov ecx, eax
shr eax, 0x17
or eax, edx
mov dword [esp + 0x58], eax
shl ecx, 9
shr ebp, 0x17
or ebp, ecx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x5c], esi
mov byte [esp + 0x60], bl
add esp, 0x40
ret
mov eax, dword [esp + 0x48]
shl eax, 8
mov ecx, dword [esp + 0x44]
mov edx, ecx
shr ecx, 0x18
or ecx, eax
mov dword [esp + 0x58], ecx
shl edx, 8
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff8
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], 1
add esp, 0x40
ret
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a6ec]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004994a0