joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5135df
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 1
xor edi, edi
test byte [esp + 0x28], 4
pop ebx
mov esi, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
je 0x51360c
call fcn.00513c42
test eax, 0x10000000
mov dword [esp + 0x10], ebx
je 0x513610
mov dword [esp + 0x10], edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 0x24], 0x18
mov dword [esp + 0x1c], eax
call fcn.0051479d
mov ebx, dword [sym.imp.USER32.dll_UpdateWindow]
mov ebp, eax
add ebp, 0x30
cmp dword [esp + 0x18], edi
je 0x5136ad
push edi
push edi
push edi
push edi
push ebp
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x5136ad
cmp dword [esp + 0x10], edi
je 0x51365e
push 1
mov ecx, esi
call fcn.00513daa
push dword [esi + 0x1c]
call ebx
mov dword [esp + 0x10], edi
test byte [esp + 0x24], 1
jne 0x513684
cmp dword [esp + 0x1c], edi
je 0x513684
cmp dword [esp + 0x14], edi
jne 0x513684
push dword [esi + 0x1c]
push edi
push 0x121
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SendMessageA]
test byte [esp + 0x24], 2
jne 0x5136a7
mov eax, dword [esp + 0x14]
inc dword [esp + 0x14]
push eax
push edi
push 0x36a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x513631
mov dword [esp + 0x18], edi
jmp 0x513631
call fcn.0051479d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x5c]
test eax, eax
je 0x513722
cmp dword [esp + 0x10], edi
je 0x5136e6
mov eax, dword [ebp + 4]
cmp eax, 0x118
je 0x5136d4
cmp eax, 0x104
jne 0x5136e6
push 1
mov ecx, esi
call fcn.00513daa
push dword [esi + 0x1c]
call ebx
mov dword [esp + 0x10], edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x70]
test eax, eax
je 0x51372d
call fcn.0051479d
mov edx, dword [eax]
push ebp
mov ecx, eax
call dword [edx + 0x64]
test eax, eax
je 0x51370e
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], edi
push edi
push edi
push edi
push edi
push ebp
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x5136ad
jmp 0x513631
push edi
call fcn.0051aba3
or eax, 0xffffffff
jmp 0x513734
and dword [esi + 0x24], 0xffffffe7
mov eax, dword [esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x51376e
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov dword [esi + 0x24], eax
call fcn.005196c6
movzx ecx, word [esp + 0x14]
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x5137a4
push 0x7f00
push eax
call edi
mov dword [esi + 0x14], eax
push esi
call fcn.00511ebf
pop edi
pop esi
ret 0xc
Function at 0x5146e5
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x514729
cmp dword [esi + 0x10], 0
jne 0x514738
mov ecx, dword [esi + 8]
push edi
mov edi, 0x400
push edi
push ecx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetMenuState]
push dword [esp + 0xc]
and ax, 0xf6fb
or eax, edi
push dword [esi + 4]
push eax
mov eax, dword [esi + 0xc]
push dword [esi + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ModifyMenuA]
pop edi
jmp 0x514738
push dword [esp + 8]
mov eax, dword [esi + 0x14]
push dword [eax + 0x1c]
call fcn.005170ca
pop esi
ret 4

Function at 0x515dd1
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetBkColor]
cmp ecx, dword [esi + 8]
je 0x515ded
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515dfb
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4

Function at 0x515e00
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetBkMode]
cmp ecx, dword [esi + 8]
je 0x515e1b
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515e29
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4

Function at 0x515e2e
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
cmp ecx, dword [esi + 8]
je 0x515e49
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515e57
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4

Function at 0x515e5c
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetROP2]
cmp ecx, dword [esi + 8]
je 0x515e77
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515e85
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4

Function at 0x515e8a
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetStretchBltMode]
cmp ecx, dword [esi + 8]
je 0x515ea5
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515eb3
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4

Function at 0x515eb8
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetTextColor]
cmp ecx, dword [esi + 8]
je 0x515ed4
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515ee2
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4
Function at 0x515ee7
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetMapMode]
cmp ecx, dword [esi + 8]
je 0x515f02
push dword [esp + 0xc]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x515f10
push dword [esp + 0xc]
push esi
call edi
pop edi
pop esi
ret 4

Function at 0x5161d3
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, dword [sym.imp.GDI32.dll_ExcludeClipRect]
push edi
mov edi, ecx
xor eax, eax
mov ecx, dword [edi + 4]
cmp ecx, dword [edi + 8]
je 0x5161fa
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push ecx
call ebx
mov edi, dword [edi + 8]
test edi, edi
je 0x51620f
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push edi
call ebx
pop edi
pop esi
pop ebx
ret 4

Function at 0x516f68
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x521138
call fcn.00500e48
push ecx
push ecx
push esi
push 0x10
call fcn.0050f5f7
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x516fb5
mov ecx, esi
call fcn.0050fe07
mov eax, dword [0x94f978]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.0050f9f3
jmp 0x516fb7
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x936aa0
push eax
mov dword [ebp - 0x10], esi
call fcn.005008dc
pop esi
mov eax, dword [ecx + 0x1c]
push 0
push 0
push 0x10
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
ret

Function at 0x5182ac
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x520e74
call fcn.00500e48
sub esp, 0x24
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
mov dword [esi], vtable._AFX_CHECKLIST_STATE.0
mov dword [ebp - 0x18], 0x92b7d4
cmp dword [0x99fee4], 0
mov byte [ebp - 4], 1
jne 0x5182e6
call fcn.0051a739
cmp dword [eax + 0x20], 0
jne 0x5182e6
push 0x7913
jmp 0x5182eb
push 0x7914
lea ecx, [ebp - 0x18]
call fcn.004fd3bb
lea eax, [ebp - 0x30]
push eax
push 0x18
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x2c]
push 3
cdq
pop ecx
idiv ecx
lea ecx, [ebp - 0x18]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0xc], eax
call fcn.005166fd
mov dword [esi + 4], eax
mov dword [ebp - 0x18], vtable.CGdiObject.0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00516727
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x518445
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x520e88
call fcn.00500e48
sub esp, 0x4c
push esi
mov esi, ecx
push edi
push 0x5193bc
mov ecx, 0x99fdac
call fcn.00519ce3
mov ecx, esi
mov edi, eax
call fcn.00513c42
and eax, 0x50
cmp al, 0x50
jne 0x5184bf
push ebx
push esi
lea ecx, [ebp - 0x20]
call fcn.00516428
and dword [ebp - 4], 0
mov ecx, esi
call fcn.004fd3df
push eax
lea ecx, [ebp - 0x20]
call fcn.00515d24
mov ebx, eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
push ebx
lea ecx, [ebp - 0x20]
call fcn.00515d24
mov ecx, dword [ebp - 0x58]
pop ebx
mov dword [esi + 0x3c], ecx
mov eax, dword [edi + 0xc]
inc eax
cmp eax, ecx
mov edi, eax
jg 0x5184b1
mov edi, ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0051649a
jmp 0x5184c3
mov edi, dword [edi + 0xc]
inc edi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x519bf6
Capabilities:
Get thread local storage value
Reference http user-agent string

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x519c24
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x519c42
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00519b5c
jmp 0x519c42
mov eax, dword [esi + 0x14]
test eax, eax
je 0x519c42
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00519b5c
test edi, edi
mov eax, edi
jne 0x519c2c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x51aa92
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.0051a9fe
mov edi, eax
cmp edi, esi
jne 0x51aaad
xor eax, eax
jmp 0x51aad2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x40a020
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a0cb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e394
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e38c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40a0b5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xf2a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f2a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf2a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2a06a
add dl, dl
jne 0xf2a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2a0dc
xor eax, eax
add dl, dl
jne 0xf2a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2a17d
add dl, dl
jne 0xf2a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf2a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf2a075
mov eax, 1
add dl, dl
jne 0xf2a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2a0e1
sub eax, ebx
mov ebx, 1
jne 0xf2a128
mov ecx, 1
add dl, dl
jne 0xf2a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf2a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2a136
cmp eax, 0x7d00
jae 0xf2a16d
cmp eax, 0x500
jb 0xf2a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2a075
cmp eax, 0x7f
ja 0xf2a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf2a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf2a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401f20
Capabilities:
Lock the desktop

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x401f3a
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401f52
push eax
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x401f58
push eax
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x401f99
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_lock_the_computer.
push 0xfffe
push 0x20
push dword [ebp + 8]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401fb0
call fcn.004fbfa0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Unable_to_lock_the_computer.
push 0x5cd020
push 0x10
push dword [ebp + 8]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x401fc0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x401fde
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
mov edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401ff2
push eax
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x401ff8
push eax
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x402039
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_log_off_the_computer.
push 0xfffe
push 0x20
push dword [ebp + 8]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402050
call fcn.004fbfa0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Unable_to_log_off_the_computer.
push 0x5cd020
push 0x10
push dword [ebp + 8]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x402840
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0xc
dec eax
push esi
cmp eax, 5
ja case.0x402853.4
jmp dword [eax*4 + 0x4029f8]
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
mov esi, dword [ebp + 8]
test eax, eax
je 0x402893
push 0
push 0
push str.the_computer
push str.shut_down
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.0x402853.4
mov ecx, dword [ebp + 0x10]
or ecx, 2
call fcn.0050abc0
mov edi, edi
test eax, eax
je 0x4029ee
push eax
push 0
push str.Unable_to_shut_down_the_computer.
push esi
call sym.SystemInformer.exe_PhShowStatus
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.shut_down
push str.preforms_a_hard
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004017e0
mov esi, dword [ebp + 8]
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.shut_down
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.0x402853.4
push 2
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
lea ebx, [ebx]
test eax, eax
jns 0x4029ee
push 0
push eax
push str.Unable_to_shut_down_the_computer.
push esi
lfence
call sym.SystemInformer.exe_PhShowStatus
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.shut_down
push str.forces_a_critical
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004017e0
mov esi, dword [ebp + 8]
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.shut_down
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.0x402853.4
push 0x80000000
push 6
push 6
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x4029ee
push 0
push eax
push str.Unable_to_shut_down_the_computer.
push esi
lfence
call sym.SystemInformer.exe_PhShowStatus
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
mov esi, dword [ebp + 8]
test eax, eax
je 0x4029cd
push 0
push 0
push str.the_computer
push str.update_and_shutdown
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.0x402853.4
push 0x80000000
push 0x49
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
jne 0x4028a8
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402a20
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edx
push eax
mov edi, ecx
mov dword [ebp - 0xc], 0x1c
mov esi, 0xc0000001
mov dword [ebp - 8], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x402a6d
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x402c22
lea eax, ds:[ebp - 0xc]
mov dword [ebp - 0xc], 0x34
push eax
mov dword [ebp - 8], str.EnableBootObjectsEnumerate
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
mov dword [ebp - 0xc], 0x48
lea eax, [ebp - 0xc]
mov dword [ebp - 8], str.EnableUpdateDefaultFirmwareBootEntry
push eax
setne bl
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
mov cl, bl
setne bh
call fcn.0051f0a0
mov dword [ebp - 8], eax
test eax, eax
je 0x402b8c
mov ecx, dword ds:[ebp - 4]
cmp ecx, dword [eax]
jae 0x402af4
lfence
mov eax, dword [eax + 8]
sub esp, 0x10
mov edx, esp
mov esi, dword [eax + ecx*4]
mov cl, bh
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
call fcn.0051e840
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, eax
mov ebx, esi
call fcn.0051f240
lea ecx, [ecx]
test esi, esi
js 0x402b6c
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402c22
push eax
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x402c0d
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402c22
mov edi, edi
call fcn.004fbfa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, ebx
cmp ebx, 0xc0000022
je 0x402b7e
cmp esi, 0xc0000005
jne 0x402b8c
mov esi, ebx
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x402baf
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x402b9f
movzx eax, si
jmp 0x402baf
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x402bbe
mov eax, esi
test eax, eax
je 0x402bbe
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x402bc7
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
mov esi, eax
test esi, esi
je 0x402c0d
lfence
lfence
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402c22
lfence
call fcn.004fbfa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Unable_to_configure_the_boot_application.
push 0x5cd020
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret