joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4acd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov eax, dword [ecx + 8]
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
jb 0x409cc0
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x409cea
mov esi, dword [ebp - 0x1c]
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x409cd3
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
push edx
push edi
push eax
call fcn.0040e150
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x53ece0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x409d38
mov eax, dword [ebp - 0x20]
cmp ecx, dword [eax + 4]
je 0x409d38
add ecx, 0x20
cmp dword [ecx + 0x14], 8
jb 0x409d20
mov ecx, dword [ecx]
lea eax, [ebp - 0x18]
push eax
sub esp, 0xc
push ecx
push ecx
mov ecx, esi
call fcn.00409530
add esp, 0x18
jmp 0x409dd1
cmp dword [edi + 0x14], 8
jb 0x409d40
mov edi, dword [edi]
lea eax, [ebp - 0x18]
push eax
sub esp, 0xc
push edi
push ecx
lea ecx, [ebp - 0x44]
call fcn.00409530
add esp, 0x18
push 1
push 0x5168c8
push 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.004029e0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x409dd1
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409dc7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409df0
push edx
push ecx
call fcn.0049855b
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
call fcn.004d076f
int3
Function at 0x40a7a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4c0d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x53d058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.004697d0
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x464]
mov eax, dword [ebp + 8]
mov dword [ebx], vtable.choose_install_view.1.0
mov dword [ebx + 0x14], vtable.choose_install_view.0
mov dword [ebx + 0x460], eax
call fcn.00409e00
mov byte [ebp - 4], 1
lea edi, [ebx + 0x498]
mov dword [ebp + 8], edi
lea esi, [edi + 0xc]
mov eax, dword [0x545524]
mov dword [edi], vtable.sciter::behavior_factory.0
mov dword [edi + 8], str.drag_window
mov dword [edi + 4], eax
mov dword [ebp + 8], esi
mov dword [0x545524], edi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0xc
lfence
call fcn.00498569
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi], eax
mov dword [edi], vtable.sciter::drag_window_factory.0
lea esi, [ebx + 0x4ac]
xor eax, eax
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 5
call fcn.0040b2c0
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebx + 0x24], 0x80080008
mov dword [ebx + 0x28], 0xc0000
mov dword [ebp + 8], esp
call fcn.00407730
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
call fcn.00407580
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.00407f90
add esp, 0x30
mov ecx, esi
push eax
call fcn.0040a9e0
lea ecx, [ebp - 0x34]
call fcn.004064a0
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x40a8f2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x50]
call fcn.004033a0
lea ecx, [ebp - 0x68]
call fcn.004033a0
mov eax, dword [ebx + 0x4dc]
lea ecx, [ebx + 0x478]
mov dword [0x5457f0], eax
mov dword [0x5457e8], eax
lea eax, [ebx + 0x4e0]
push eax
call fcn.0040b200
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa90
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4c4d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
call fcn.0046a3c0
lea ebx, [esi + 0x4ac]
push str.IDS_PRODUCT_NAME
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.00409330
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x40ab1a
push eax
push 0xfffffffffffffff2
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SetClassLongW]
cmp dword [esi + 0x4d8], 8
lea eax, [esi + 0x4c4]
mov ecx, dword [eax + 0x10]
jb 0x40ab2e
mov eax, dword [eax]
cmp ecx, 3
jne 0x40abaf
push ecx
push 0x5163b0
push eax
call fcn.0040c240
add esp, 0xc
test eax, eax
jne 0x40abaf
mov esi, dword [esi + 0x18]
mov dword [ebp - 0x30], eax
call fcn.00404140
lea ecx, [ebp - 0x30]
push ecx
push esi
mov eax, dword [eax + 0x84]
call eax
mov edi, dword [ebp - 0x30]
call fcn.00404140
push edi
mov eax, dword [eax + 0x7c]
call eax
xor esi, esi
test eax, eax
cmove esi, edi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
call fcn.00404140
push 0x5163b0
push 0x516980
push esi
mov eax, dword [eax + 0xb8]
call eax
mov byte [ebp - 4], 2
test esi, esi
je 0x40aba8
call fcn.00404140
push esi
mov eax, dword [eax + 0x80]
call eax
mov esi, dword [ebp - 0x34]
mov byte [ebp - 4], 0
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x40abba
mov ebx, dword [ebx]
cmp eax, 5
jne 0x40ac49
push eax
push 0x516984
push ebx
call fcn.0040c240
add esp, 0xc
test eax, eax
jne 0x40ac49
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x14]
call dword [eax]
mov esi, eax
mov dword [ebp - 0x30], 0
call fcn.00404140
mov ecx, dword [eax + 0x84]
lea eax, [ebp - 0x30]
push eax
push esi
call ecx
mov edi, dword [ebp - 0x30]
call fcn.00404140
push edi
mov eax, dword [eax + 0x7c]
call eax
xor esi, esi
test eax, eax
cmove esi, edi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x40ac45
call fcn.00404140
push 0x516990
push str.lang
push esi
mov eax, dword [eax + 0xb8]
call eax
mov byte [ebp - 4], 4
call fcn.00404140
push esi
mov eax, dword [eax + 0x80]
call eax
jmp 0x40ac45
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
add ecx, 0x14
push 0
push 0
push 0x464
mov eax, dword [ecx]
call dword [eax + 0x14]
lea ecx, [ebp - 0x2c]
call fcn.004033a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x40c660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x40c7ee
cmp dword [edx + 0x1c], 8
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x20], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x1c], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jb 0x40c69b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x40c6c4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x40c6b0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x1c]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov ebx, esi
mov dword [ebp - 0x18], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004033a0
lea ecx, [ebx + 8]
call fcn.004033a0
push 0x38
push ebx
call fcn.0049855b
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
je 0x40c738
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x40c6e0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x40c7e3
mov ecx, dword [ebp - 0x10]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
jne 0x40c74a
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x40c74d
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x40c7e3
nop dword [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x40c76e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x40c791
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x40c780
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov ebx, esi
mov dword [ebp - 0x14], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004033a0
lea ecx, [ebx + 8]
call fcn.004033a0
push 0x38
push ebx
call fcn.0049855b
mov ecx, dword [ebp - 8]
add esp, 8
mov eax, dword [ebp - 0x18]
dec dword [ecx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x40c7f4
cmp esi, eax
jne 0x40c7a8
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x20]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x40c760
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40e520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x40e54b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40e534
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x40f840
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
push esi
push 0x516c78
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [esi]
test eax, eax
jne 0x40f94b
push 0x5079f0
push 0xfffe
call fcn.00498a01
push 0xfffe
mov edi, eax
push 0
push edi
call fcn.004cdf10
add esp, 0x14
push 0x7fff
push edi
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40f938
push 0x5c
push edi
call fcn.004cd41d
add esp, 8
test eax, eax
je 0x40f938
mov edx, eax
mov ecx, 0x7fff
sub edx, edi
sar edx, 1
push str.log.dll
sub ecx, edx
push ecx
push eax
call fcn.004d0eb1
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
push edi
call fcn.004987f3
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x40fa36
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LogInit
push eax
call edi
test eax, eax
je 0x40f95f
call eax
push str.LogApplySettings
push dword [esi]
call edi
push str.LogSetSettingsFile
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.LogEnable
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.LogSetLevel
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.LogSetPath
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.LogSetType
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.LogSetMode
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.LogSetMaxSize
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
push str.LogSetDepth
push dword [esi]
mov dword [esi + 0x20], eax
call edi
push str.LogWrite
push dword [esi]
mov dword [esi + 0x24], eax
call edi
push str.LogIsEnabled
push dword [esi]
mov dword [esi + 0x28], eax
call edi
push str.LogMonitorSettings
push dword [esi]
mov dword [esi + 0x2c], eax
call edi
push str.LogGetLevel
push dword [esi]
mov dword [esi + 0x30], eax
call edi
push str.LogUninitDeskMetrics
push dword [esi]
mov dword [esi + 0x44], eax
call edi
push str.LogTrackEvent
push dword [esi]
mov dword [esi + 0x34], eax
call edi
push str.LogTrackEventData
push dword [esi]
mov dword [esi + 0x38], eax
call edi
push str.LogRemoveModule
push dword [esi]
mov dword [esi + 0x3c], eax
call edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x40], eax
mov eax, esi
je 0x40fa38
pop edi
pop esi
ret
mov eax, esi
pop edi
mov dword [esi + 0x28], 0x40fa80
pop esi
ret
Function at 0x410090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f529d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x38
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], edx
mov esi, ecx
mov dword [ebp - 0x20], esi
mov edx, dword [ebx + 0xc]
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
push eax
mov eax, dword [ebp - 0x3c]
push 0
push 0
push 2
push edx
push ecx
push dword [eax]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x41011a
mov dword [edi], eax
xor ecx, ecx
mov dword [edi + 4], 0x53ed5c
mov eax, dword [edi + 4]
jmp 0x41012f
mov ecx, dword [ebp - 0x20]
mov eax, 0x53ece0
mov dword [edi], 0
mov dword [edi + 4], 0x53ece0
mov eax, dword [eax + 4]
cmp eax, dword [0x53ece4]
jne 0x41029f
cmp dword [edi], 0
jne 0x41029f
xor eax, eax
test ecx, ecx
je 0x4102a1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
shr ecx, 1
push eax
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040b7b0
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x38]
add eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x3c]
push ecx
push 0
push 2
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4101b6
mov dword [edi], eax
xor ecx, ecx
mov dword [edi + 4], 0x53ed5c
mov eax, dword [edi + 4]
jmp 0x4101cb
mov ecx, dword [ebp - 0x20]
mov eax, 0x53ece0
mov dword [edi], 0
mov dword [edi + 4], 0x53ece0
mov eax, dword [eax + 4]
cmp eax, dword [0x53ece4]
jne 0x410237
cmp dword [edi], 0
jne 0x410237
shr ecx, 1
dec ecx
push 0
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040b7b0
lea ecx, [ebp - 0x38]
call fcn.0040b980
movups xmm0, xmmword [ebp - 0x38]
mov dword [esi], 0
lea ecx, [ebp - 0x38]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x38], ax
movq xmm0, qword [ebp - 0x28]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
call fcn.004033a0
jmp 0x4102b8
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x38]
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.004033a0
jmp 0x4102b8
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4102e0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f533a
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], vtable.icrash_controller.0
mov dword [esi], vtable.crash_controller.1.0
mov dword [esi + 4], vtable.crash_controller.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edi, [esi + 0x14]
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [edi + 0x18], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 6
call fcn.0040b2c0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
push str.89223539_4011_4E16_8CF4_ADEC5C2935B8
mov byte [ebp - 4], 8
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push ecx
push str.GlobalFF1EEC21_A47E_406E_83F2_916D80DC858E
lea ecx, [ebp - 0x1c]
call fcn.0040f2a0
mov ecx, eax
add esp, 0xc
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x4103da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 8], 0
mov eax, dword [ecx]
mov dword [ecx], 0
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4103f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
call fcn.0040f1a0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
call fcn.0040efe0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 8
call fcn.00407f90
add esp, 0x30
mov ecx, edi
push eax
call fcn.0040a9e0
lea ecx, [ebp - 0x44]
call fcn.004064a0
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x410442
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x60]
call fcn.004033a0
lea ecx, [ebp - 0x78]
call fcn.004033a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x410e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f54fb
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
cmp eax, 0x4c8
jne 0x410f10
push str.crash_controller::process_message
push str.WM_END_DIALOG
lea ecx, [ebp - 0x424]
call fcn.0040fba0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 8]
push 0
push 0
push 0x10
mov dword [ecx + 0x250], eax
add ecx, 0x14
mov eax, dword [ecx]
call dword [eax + 0x14]
lea ecx, [ebp - 0x424]
call fcn.0040fcc0
xor eax, eax
jmp 0x410fb6
cmp eax, 0x11
jne 0x410f32
push str.crash_controller::process_message
push str.WM_QUERYENDSESSION
lea ecx, [ebp - 0x424]
call fcn.0040fba0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 0x16
jne 0x410f5e
push str.crash_controller::process_message
push str.WM_ENDSESSION
lea ecx, [ebp - 0x424]
call fcn.0040fba0
lea ecx, [ebp - 0x424]
call fcn.0040fcc0
mov eax, 1
jmp 0x410fb6
cmp eax, dword [esi + 0xc]
jne 0x410fa9
push str.crash_controller::process_message
push str.global_close_msg
lea ecx, [ebp - 0x838]
call fcn.0040fba0
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
push 0
push 0
push 0x10
lea ecx, [eax + 0x14]
mov dword [eax + 0x250], 0xffffffff
mov eax, dword [ecx]
call dword [eax + 0x14]
lea ecx, [ebp - 0x838]
call fcn.0040fcc0
xor eax, eax
jmp 0x410fb6
push ecx
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
push eax
call fcn.00416f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411080
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f55ac
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.crash_controller::request_restart_device
lea ecx, [ebp - 0x434]
call fcn.0040fa90
lea eax, [ebp - 0x438]
mov dword [ebp - 4], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x438], 0
push 0x28
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 0x439], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x411149
push str.crash_controller::request_restart_device
lea edx, [eax + 4]
lea ecx, [ebp - 0x4e4]
call fcn.0040fef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 1
cmp byte [esi + 0x48], 0
je 0x411125
push str.OpenProcessToken_err
push esi
call fcn.00414f60
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x48], 0
je 0x411139
push eax
mov ecx, esi
call fcn.00413060
lea ecx, [ebp - 0x4e4]
call fcn.0040fdc0
jmp 0x411226
lea eax, [ebp - 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x411187
push str.crash_controller::request_restart_device
lea edx, [eax + 4]
lea ecx, [ebp - 0x4e4]
call fcn.0040fef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 2
cmp byte [esi + 0x48], 0
je 0x411125
push str.LookupPrivilegeValue_err
jmp 0x41111c
push 0
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 1
push eax
push 0
push dword [ebp - 0x438]
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4111e1
push str.crash_controller::request_restart_device
lea edx, [eax + 4]
lea ecx, [ebp - 0x4e4]
call fcn.0040fef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 3
cmp byte [esi + 0x48], 0
je 0x411125
push str.AdjustTokenPrivileges_err
jmp 0x41111c
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x41121f
push str.crash_controller::request_restart_device
lea edx, [eax + 4]
lea ecx, [ebp - 0x4e4]
call fcn.0040fef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 4
cmp byte [esi + 0x48], 0
je 0x411125
push str.ExitWindowsEx_err
jmp 0x41111c
mov byte [ebp - 0x439], 1
lea ecx, [ebp - 0x434]
call fcn.0040fcc0
mov al, byte [ebp - 0x439]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret