joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9320
Capabilities:
Get disk information

Disassembly:
push 0x158
mov eax, 0x6227e9
call fcn.0060322d
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
mov edi, dword [ebp + 0x10]
setne al
mov dword [ebp - 0x158], esi
test eax, eax
jne 0x4f934e
call fcn.004e3de7
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x4f9349
lea eax, [ebp - 0x154]
push eax
push esi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x4f9396
push 0xffffffffffffffff
push ebx
push 0x104
push esi
call fcn.006025fe
push eax
call fcn.004e3095
add esp, 0x14
push ebx
push edi
call fcn.004f92f3
xor eax, eax
jmp 0x4f94b7
cmp eax, 0x104
jb 0x4f93b3
test edi, edi
je 0x4f938f
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.004e2a4a
jmp 0x4f938f
call fcn.004e4479
push eax
lea ecx, [ebp - 0x15c]
call fcn.00419440
and dword [ebp - 4], 0
lea eax, [ebp - 0x15c]
push eax
push esi
call fcn.004f8cc9
mov esi, dword [ebp - 0x15c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x4f94ac
xor ecx, ecx
lea eax, [ebp - 0x160]
push ecx
push ecx
push eax
lea eax, [ebp - 0x164]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4f941e
push ebx
push edi
call fcn.004f92f3
lea ecx, [esi - 0x10]
call fcn.004195a0
jmp 0x4f938f
mov eax, dword [ebp - 0x160]
test al, 2
jne 0x4f943a
push dword [ebp - 0x158]
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x160]
test al, 4
jne 0x4f94ac
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4f94ac
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x4f940a
cmp eax, dword [ebp - 0x158]
jbe 0x4f940a
lea eax, [ebp - 0x124]
push eax
call fcn.00603800
mov edx, dword [ebp - 0x154]
sub edx, dword [ebp - 0x158]
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x4f94bf
lea eax, [ebp - 0x124]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x154]
call fcn.006060d4
push eax
call fcn.004e3095
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.004195a0
xor eax, eax
inc eax
call fcn.006031dc
ret 0xc
test edi, edi
je 0x4f9411
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.004e2a4a
jmp 0x4f9411
Function at 0x4fa831
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004ef578
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4fa86d
call fcn.004faa50
mov dword [esi + 0xc], 1
jmp 0x4fa872
call fcn.004faa50
cmp dword [esi], 0
je 0x4fa8bb
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4fa895
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004e4045
jmp 0x4fa8a6
push 0xff
mov ecx, esi
call fcn.00419700
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004e4068
jmp 0x4fa8df
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4fa8df
push dword [esi]
push dword [ebp - 4]
call fcn.004f5b6f
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4fa9a5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004faa50
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4fa9ed
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004e4045
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004e4068
jmp 0x4fa9f8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004f5b6f
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4faa94
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 0x48], esi
call fcn.004faa50
cmp dword [edi], 0
mov ebx, eax
mov dword [edi + 0xc], 1
je 0x4fab05
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x44]
push 0x40
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
push dword [ebp - 0x48]
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00606d1f
add esp, 0x10
cmp eax, 1
je 0x4fab53
push 0xffffffffffffffff
push 0
push dword [ebp + 0x14]
call fcn.004f2330
mov ecx, edi
call fcn.004fa9fe
jmp 0x4fab53
call fcn.006039b5
mov edi, dword [eax]
call fcn.006039b5
and dword [eax], 0
lea eax, [ebp + 0x18]
push eax
push esi
push 0x3f
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00600def
add esp, 0x14
call fcn.006039b5
cmp dword [eax], 0
je 0x4fab42
call fcn.006039b5
push dword [eax]
call fcn.004e3564
pop ecx
jmp 0x4fab49
call fcn.006039b5
mov dword [eax], edi
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.004f5b6f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060052c
mov esp, ebp
pop ebp
ret
Function at 0x4fb272
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4fb2c0
push esi
mov ebx, 0x811c9dc5
xor edi, edi
call fcn.00603800
xor edx, edx
mov dword [ebp + 8], 0xa
pop ecx
mov ecx, eax
div dword [ebp + 8]
inc eax
test ecx, ecx
je 0x4fb2b5
mov edx, ecx
movsx ecx, byte [edi + esi]
add edi, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
cmp edi, edx
jb 0x4fb2a3
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004e3de7
int3

Function at 0x50c5e7
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x50c63c
xor eax, eax
test esi, esi
sete al
or eax, 0x4000
push eax
push 0x160
lea eax, [ebp - 0x26c]
push eax
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0060052c
mov esp, ebp
pop ebp
ret 4
Function at 0x50c778
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x71c
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test edx, edx
je 0x50c997
test esi, esi
je 0x50c997
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x320], ebx
sub eax, ebx
je 0x50c968
dec eax
je 0x50c80a
dec eax
je 0x50c8d0
dec eax
jne 0x50c982
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x108]
push eax
push dword [edx + 4]
call edi
test eax, eax
je 0x50c963
push ebx
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004f9b97
test eax, eax
je 0x50c963
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x50c8c8
push ebx
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004f9b97
test eax, eax
je 0x50c8c8
cmp dword [ebp + 0x10], 1
jne 0x50c928
test byte [ebp - 0x43c], 0x10
jne 0x50c963
test byte [ebp - 0x314], 0x10
jne 0x50c8c8
mov ecx, dword [ebp - 0x318]
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x440], ecx
ja 0x50c8c8
jb 0x50c963
cmp dword [ebp - 0x444], eax
jb 0x50c963
cmp dword [ebp - 0x440], ecx
jb 0x50c982
ja 0x50c8c8
cmp dword [ebp - 0x444], eax
jbe 0x50c982
xor ebx, ebx
inc ebx
jmp 0x50c982
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea eax, [ebp - 0x71c]
push 0x408
push 0x160
push eax
push ebx
push dword [edx + 4]
call edi
test eax, eax
je 0x50c982
push 0x408
push 0x160
lea eax, [ebp - 0x5bc]
push eax
push ebx
push dword [esi + 4]
call edi
test eax, eax
je 0x50c982
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebx, eax
jmp 0x50c982
push dword [ebp - 0x328]
lea ecx, [ebp - 0x454]
push dword [ebp - 0x32c]
call fcn.0050bec7
test al, al
jne 0x50c963
push dword [ebp - 0x328]
lea ecx, [ebp - 0x454]
push dword [ebp - 0x32c]
call fcn.0050bee6
xor ebx, ebx
test al, al
setne bl
jmp 0x50c982
or ebx, 0xffffffff
jmp 0x50c982
push dword [esi + 8]
mov eax, dword [edx]
push dword [edx + 8]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jns 0x50c97f
xor eax, eax
jmp 0x50c984
movsx ebx, ax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060052c
mov esp, ebp
pop ebp
ret 0xc
call fcn.004e3de7
int3
Function at 0x5108de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004e2d9d
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x510915
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00510936
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5a1d36
Capabilities:
Get file system object information

Disassembly:
push 0x270
mov eax, 0x62de2b
call fcn.0060322d
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004e4567
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x66a460
call fcn.004f5827
cmp eax, 0xffffffff
jne 0x5a1dea
push 0
push 0x63fed4
lea ecx, [ebp - 0x278]
call fcn.004f5827
cmp eax, 0xffffffff
jne 0x5a1dea
push 0
push 0x63a780
lea ecx, [ebp - 0x278]
call fcn.004f5827
cmp eax, 0xffffffff
jne 0x5a1dea
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004e4567
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x27c], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x114]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x5a1dc6
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.004195a0
jmp 0x5a1e19
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.004e2a4a
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.004195a0
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x5a1e10
mov ebx, dword [ebp - 0x274]
jmp 0x5a1e19
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.004195a0
mov eax, ebx
call fcn.006031dc
ret
Function at 0x5c6980
Capabilities:
Get common file path

Disassembly:
push 0x120
mov eax, 0x6303d7
call fcn.0060322d
mov ebx, ecx
mov dword [ebp - 0x12c], ebx
call fcn.005e5f58
push 0x1c4
call fcn.004e126d
pop ecx
mov dword [ebp - 0x128], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5c69c3
push 0
push dword [ebx + 0x60]
mov ecx, eax
call fcn.005e6591
jmp 0x5c69c5
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push eax
call fcn.005e53d3
call fcn.004e2d9d
mov esi, 0x104
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x8c]
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x114]
push eax
call fcn.00603800
mov edi, eax
pop ecx
mov byte [ebp + edi - 0x114], 0x5c
inc edi
cmp edi, esi
jae 0x5c6be2
xor eax, eax
mov byte [ebp + edi - 0x114], 0
mov dword [ebp - 0x128], eax
test ebx, ebx
je 0x5c6bdc
xor esi, esi
mov dword [ebp - 0x120], esi
cmp dword [ebx + 4], eax
jle 0x5c6bdc
call fcn.004e4479
push eax
lea ecx, [ebp - 0x118]
call fcn.00419440
mov eax, dword [ebx]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x114]
push edi
push ecx
push esi
lea ecx, [ebp - 0x118]
push ecx
mov ecx, ebx
call dword [eax + 0xc]
test eax, eax
je 0x5c6bba
push 0x647a00
mov esi, 0x647a04
lea ecx, [ebp - 0x118]
push esi
call fcn.005139a7
push esi
push 0x63fe18
lea ecx, [ebp - 0x118]
call fcn.005139a7
push esi
push 0x647a00
lea ecx, [ebp - 0x118]
call fcn.005139a7
call fcn.004e4479
push eax
lea ecx, [ebp - 0x124]
call fcn.00419440
mov eax, dword [ebp - 0x128]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x5c6ae6
push dword [ebp - 0x118]
lea eax, [ebp - 0x124]
push str.10__s
push eax
call fcn.004e248d
add esp, 0xc
jmp 0x5c6b18
jge 0x5c6b06
push dword [ebp - 0x118]
inc eax
push eax
lea eax, [ebp - 0x124]
push str._d__s
push eax
call fcn.004e248d
add esp, 0x10
jmp 0x5c6b18
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x124]
call fcn.004e43d9
push 0x1c4
call fcn.004e126d
pop ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x5c6b42
mov ecx, eax
call fcn.0056ca90
mov ecx, eax
mov dword [ebp - 0x11c], eax
jmp 0x5c6b4a
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov eax, dword [ecx]
mov esi, dword [ebp - 0x124]
push esi
mov byte [ebp - 4], 2
call dword [eax + 0xb4]
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x120]
add eax, 0xe110
push eax
mov edx, dword [ecx]
call dword [edx + 0xb0]
push dword [ebp - 0x120]
mov ecx, ebx
call fcn.004f5930
mov ecx, dword [ebp - 0x11c]
push dword [eax]
mov edx, dword [ecx]
call dword [edx + 0xc8]
mov ecx, dword [ebp - 0x11c]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.005e53d3
inc dword [ebp - 0x128]
lea ecx, [esi - 0x10]
call fcn.004195a0
mov esi, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x118]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.004195a0
inc esi
mov dword [ebp - 0x120], esi
cmp esi, dword [ebx + 4]
jl 0x5c6a3b
call fcn.006031dc
ret
call fcn.00601346
int3
Function at 0x617466
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0060ac3e
mov dword [ebp - 0x14], eax
cmp dword [0x6c8758], esi
jne 0x617559
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x6174e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x617639
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x617639
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x617639
push eax
call ebx
push 0x6625d8
push edi
mov dword [0x6c8758], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x6625e8
push edi
mov dword [0x6c875c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x6c8760], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x6c8768], eax
test eax, eax
je 0x617556
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x6c8764], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x61757e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x617571
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x617593
push 4
pop eax
jmp 0x61763b
cmp dword [ebp - 0x14], esi
je 0x617593
push dword [0x6c8758]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x617578
mov eax, dword [0x6c8764]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x6175f1
cmp dword [0x6c8768], edi
je 0x6175f1
push eax
call ebx
push dword [0x6c8768]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x6175f1
test eax, eax
je 0x6175f1
call ecx
test eax, eax
je 0x6175e6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x6175e6
test byte [ebp - 8], 1
jne 0x6175f1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x617621
mov eax, dword [0x6c875c]
cmp eax, edi
je 0x61761e
push eax
call ebx
test eax, eax
je 0x61761e
call eax
mov esi, eax
test esi, esi
je 0x61761e
mov eax, dword [0x6c8760]
cmp eax, edi
je 0x61761e
push eax
call ebx
test eax, eax
je 0x61761e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x6c8758]
call ebx
test eax, eax
je 0x617639
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x61763b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060052c
mov esp, ebp
pop ebp
ret
Function at 0x401a50
Capabilities:
Lock the desktop

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x401a6a
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401a7c
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x401a82
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x401aa8
push str.Unable_to_lock_the_computer
push 0x532664
push 0x10
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 4]
push 0x52304c
push str.Unable_to_lock_the_computer
push 0xfffe
push 0x20
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401ada
call fcn.004a2a20
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x401af0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x401b0e
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401b20
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x401b26
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x401b4c
push str.Unable_to_log_off_the_computer
push 0x532664
push 0x10
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 4]
push 0x52304c
push str.Unable_to_log_off_the_computer
push 0xfffe
push 0x20
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401b7e
call fcn.004a2a20
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401d10
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
push str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov edi, dword [ebp + 8]
test eax, eax
je 0x401d48
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x401dd2
mov eax, dword [ebp + 0xc]
push 0
or eax, 2
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x401d65
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401d77
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x401d7d
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x401da2
push str.Unable_to_restart_the_computer
push 0x532664
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [esi + 4]
push 0x52304c
push str.Unable_to_restart_the_computer
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401dd2
call fcn.004a2a20
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x401de0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
push str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov edi, dword [ebp + 8]
test eax, eax
je 0x401e18
push 0
push 0
push str.the_computer
push str.shut_down
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x401ead
mov esi, dword [ebp + 0xc]
mov eax, esi
push 0
or eax, 8
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x401eb7
push eax
or esi, 1
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x401eb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401e52
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x401e58
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x401e7d
push str.Unable_to_shut_down_the_computer
push 0x532664
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [esi + 4]
push 0x52304c
push str.Unable_to_shut_down_the_computer
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401ead
call fcn.004a2a20
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8