Function at 0x11098fe0
Capabilities:
Check for time delay via gettickcount
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dfd85
mov eax, dword fs:[0]
push eax
sub esp, 0xa04
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
mov ebx, ecx
mov esi, dword [ebx + 4]
mov ecx, dword [esi + 0x30]
push 0
push str.DisablePowerShell
mov edi, edx
push str.Client
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x8a0], edi
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x840], esi
call fcn.110bbc00
test eax, eax
jne 0x11099df8
mov ecx, esi
call fcn.110c7040
mov ecx, dword [ebp - 0x830]
push eax
push ecx
push edi
lea ecx, [ebp - 0x8fc]
call fcn.1111aaf0
xor esi, esi
lea ecx, [ebp - 0x878]
mov dword [ebp - 4], esi
mov dword [ebp - 0x8a8], esi
call fcn.1113dd30
lea ecx, [ebp - 0x868]
mov byte [ebp - 4], 1
call fcn.1113dd30
mov ecx, dword [0x1127b21c]
xor edx, edx
xor eax, eax
mov word [ebp - 0x218], ax
mov dword [ebp - 0x81c], esi
mov word [ebp - 0x418], dx
mov dword [ebp - 0x8b4], 0x2e
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
mov byte [ebp - 4], 2
mov byte [ebp - 0x81d], 1
call eax
push eax
lea ecx, [ebp - 0x888]
call fcn.1113ccd0
mov edx, dword [ebp - 0x8fc]
mov eax, dword [edx + 0x58]
lea ecx, [ebp - 0x89c]
push ecx
lea ecx, [ebp - 0x8fc]
mov byte [ebp - 4], 3
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x58]
lea ecx, [ebp - 0x824]
push ecx
mov ecx, eax
call edx
cmp word [ebp - 0x824], 1
jne 0x11099537
mov edx, dword [ebp - 0x8fc]
lea eax, [ebp - 0x8a8]
push eax
mov eax, dword [edx + 0x5c]
lea ecx, [ebp - 0x8fc]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x68]
lea ecx, [ebp - 0x878]
push ecx
mov ecx, eax
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0x68]
lea ecx, [ebp - 0x868]
push ecx
mov ecx, eax
call edx
mov edx, dword [ebp - 0x8fc]
lea eax, [ebp - 0x834]
push eax
mov eax, dword [edx + 0x58]
lea ecx, [ebp - 0x8fc]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x58]
lea ecx, [ebp - 0x83c]
push ecx
mov ecx, eax
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0x58]
lea ecx, [ebp - 0x838]
push ecx
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x840]
call fcn.110c5f10
mov ecx, 0x1243
xor ax, cx
movzx eax, ax
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.110ea660
mov eax, dword [ebp - 0x878]
mov edx, dword [eax]
add esp, 8
lea ecx, [ebp - 0x878]
call edx
test al, al
jne 0x110991cf
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov eax, dword [ebp - 0x86c]
cmp word [eax], 0
je 0x11099227
mov edx, dword [ebp - 0x878]
mov eax, dword [edx]
lea ecx, [ebp - 0x878]
call eax
test al, al
jne 0x11099206
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov eax, dword [ebp - 0x86c]
push 8
lea ecx, [ebp - 0x18]
push ecx
push 0x100
lea edx, [ebp - 0x418]
push edx
push eax
call fcn.110ea730
add esp, 0x14
mov edx, dword [ebp - 0x868]
mov eax, dword [edx]
lea ecx, [ebp - 0x868]
call eax
test al, al
jne 0x11099252
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov ecx, dword [ebp - 0x85c]
cmp word [ecx], 0
je 0x110992aa
mov edx, dword [ebp - 0x868]
mov eax, dword [edx]
lea ecx, [ebp - 0x868]
call eax
test al, al
jne 0x11099289
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov eax, dword [ebp - 0x85c]
push 8
lea ecx, [ebp - 0x18]
push ecx
push 0x100
lea edx, [ebp - 0x218]
push edx
push eax
call fcn.110ea730
add esp, 0x14
mov esi, dword [sym.imp.MSVCR100.dll_wcschr]
lea ecx, [ebp - 0x418]
push 0x5c
push ecx
call esi
add esp, 8
test eax, eax
je 0x110992d2
xor edx, edx
mov word [eax], dx
lea esi, [ebp - 0x418]
lea edi, [eax + 2]
jmp 0x110992f2
lea edi, [ebp - 0x418]
mov eax, edi
push 0x40
push eax
call esi
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
not esi
lea ecx, [ebp - 0x8b4]
and esi, ecx
cmp word [edi], 0
je 0x11099537
lea edx, [ebp - 0x81c]
push edx
push 0
push 2
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.11161190
add esp, 0x18
test eax, eax
je 0x110993eb
push edi
push esi
push str.logged_on__s_s_interactive_for_powershell_n
call fcn.111bd7b0
add esp, 0xc
mov ecx, 0x200
lea eax, [ebp - 0x218]
lea ebx, [ebx]
mov byte [eax], 0
inc eax
dec ecx
jne 0x11099340
lea ecx, [ebp - 0x888]
call fcn.1103f220
test al, al
jne 0x1109948c
push edi
lea ecx, [ebp - 0x888]
call fcn.1102f630
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x1109948c
mov edx, dword [ebp - 0x81c]
xor eax, eax
lea ecx, [ebp - 0x938]
push ecx
mov dword [ebp - 0x930], eax
push edx
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x924], eax
mov dword [ebp - 0x920], eax
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x938], 0x20
mov dword [ebp - 0x930], edi
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x1109947d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Error_loading_user___s_s__profile__e_d_n
call fcn.111bd7b0
add esp, 0x10
jmp 0x1109948c
lea ecx, [ebp - 0x81c]
push ecx
push 0
push 3
lea edx, [ebp - 0x218]
push edx
push esi
push edi
call fcn.11161190
add esp, 0x18
test eax, eax
je 0x11099608
push edi
push esi
push str.logged_on__s_s_non_interactive_for_powershell_n
call fcn.111bd7b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0xc
push 2
push 0
push 0
lea eax, [ebp - 0x844]
push eax
mov byte [ebp - 0x81d], 0
mov dword [ebp - 0x844], 0
call ebx
mov ecx, dword [ebp - 0x81c]
push eax
push ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1109948c
cmp dword [ebp - 0x844], 0
je 0x1109948c
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x81c], eax
jmp 0x1109948c
push edi
push esi
push str.Loaded_profile_for_user__s_s_n
call fcn.111bd7b0
add esp, 0xc
push 0x11203288
lea ecx, [ebp - 0xa10]
call fcn.1113ccd0
push eax
lea eax, [ebp - 0xa00]
push esi
push eax
mov byte [ebp - 4], 5
call fcn.1113dfe0
push edi
push eax
lea ecx, [ebp - 0x918]
push ecx
mov byte [ebp - 4], 6
call fcn.1113dee0
add esp, 0x18
lea ecx, [ebp - 0xa00]
mov byte [ebp - 4], 8
call fcn.1113cd80
lea ecx, [ebp - 0xa10]
mov byte [ebp - 4], 9
call fcn.1113cd80
mov edx, dword [ebp - 0x918]
mov eax, dword [edx]
lea ecx, [ebp - 0x918]
call eax
test al, al
jne 0x1109950c
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov ecx, dword [ebp - 0x90c]
push ecx
call dword [sym.imp.MSVCR100.dll__wcsdup]
mov ebx, dword [ebp - 0x828]
add esp, 4
lea ecx, [ebp - 0x918]
mov dword [ebx + 0x4b8], eax
mov byte [ebp - 4], 3
call fcn.1113cd80
mov eax, dword [ebp - 0x81c]
xor ecx, ecx
mov word [ebp - 0x618], cx
test eax, eax
jne 0x11099561
mov ecx, dword [ebp - 0x840]
push 0x100
lea edx, [ebp - 0x618]
push edx
call fcn.1108d080
mov edi, eax
xor eax, eax
cmp word [ebp - 0x824], 1
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x82c], eax
jne 0x110997b3
test edi, edi
je 0x110995ac
push eax
push eax
push 6
call fcn.111bb9f0
add esp, 0xc
test eax, eax
je 0x110995ac
lea eax, [ebp - 0x93c]
push eax
push 4
lea ecx, [ebp - 0x82c]
push ecx
push 0x13
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [ebp - 0x888]
mov eax, dword [edx]
lea ecx, [ebp - 0x888]
call eax
test al, al
jne 0x110995d7
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov ecx, dword [ebp - 0x87c]
xor esi, esi
cmp word [ecx], si
je 0x110996ae
cmp byte [ebp - 0x81d], 0
je 0x110996ae
mov eax, dword [ebp - 0x82c]
cmp eax, esi
je 0x110997b3
jmp 0x110997b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.powershell___couldnt_log_on_user__s_s__e_d_n
call fcn.111bd7b0
mov ecx, dword [ebx + 4]
add esp, 0x10
call fcn.110c7040
push eax
push 0x80
lea ecx, [ebp - 0x9ac]
call fcn.1111a110
mov eax, dword [ebp - 0x9ac]
lea edx, [ebp - 0x8ac]
push edx
mov edx, dword [eax + 0xc]
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 4
mov dword [ebp - 0x890], 0xb
mov dword [ebp - 0x8ac], 0xe5
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [ebp - 0x890]
push ecx
mov ecx, eax
call edx
mov ecx, dword [ebx + 4]
push 1
lea eax, [ebp - 0x9ac]
push eax
call fcn.110825d0
mov ecx, 0x200
lea eax, [ebp - 0x218]
mov byte [eax], 0
inc eax
dec ecx
jne 0x11099693
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 3
call fcn.1111ab70
jmp 0x11099db9
cmp edi, esi
je 0x110996c9
push edi
call fcn.1108ceb0
add esp, 4
mov dword [ebp - 0x828], 1
test eax, eax
jne 0x110996cf
mov dword [ebp - 0x828], esi
cmp dword [ebp - 0x82c], esi
jne 0x1109978b
cmp dword [ebp - 0x828], esi
jne 0x1109978b
mov ecx, dword [ebx + 4]
call fcn.110c7040
push eax
push 0x80
lea ecx, [ebp - 0x974]
call fcn.1111a110
mov eax, dword [ebp - 0x974]
lea edx, [ebp - 0x898]
push edx
mov edx, dword [eax + 0xc]
lea ecx, [ebp - 0x974]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x8b8], 0xc
mov dword [ebp - 0x898], 0xe5
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [ebp - 0x8b8]
push ecx
mov ecx, eax
call edx
mov ecx, dword [ebx + 4]
push 1
lea eax, [ebp - 0x974]
push eax
call fcn.110825d0
mov eax, dword [ebp - 0x81c]
cmp eax, esi
je 0x11099762
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x200
lea eax, [ebp - 0x218]
lea ecx, [ecx]
mov byte [eax], 0
inc eax
dec ecx
jne 0x11099770
lea ecx, [ebp - 0x974]
mov byte [ebp - 4], 3
call fcn.1111ab70
jmp 0x11099db9
mov eax, dword [ebp - 0x81c]
cmp eax, esi
je 0x110997a2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x81c], esi
push esi
call fcn.1114cdd0
add esp, 4
mov dword [ebp - 0x81c], eax
mov edi, eax
lea ecx, [ebp - 0x8e0]
call fcn.1113dd30
mov esi, dword [ebx + 0x4b8]
mov byte [ebp - 4], 0xb
test esi, esi
jne 0x11099837
cmp byte [0x1127ad8d], 0
je 0x11099824
mov ecx, dword [ebx + 0x30]
mov edx, dword [ebx + 0x3c]
push ecx
push edx
lea eax, [ebp - 0x8e0]
push 0x1121287c
push eax
call fcn.1113d9c0
mov edx, dword [ebp - 0x8e0]
mov eax, dword [edx]
add esp, 0x10
lea ecx, [ebp - 0x8e0]
call eax
test al, al
jne 0x1109981c
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov esi, dword [ebp - 0x8d4]
jmp 0x11099837
cmp word [ebp - 0x618], 0
lea esi, [ebp - 0x618]
jne 0x11099837
mov esi, dword [ebx + 0x3c]
push esi
lea ecx, [ebp - 0x818]
push str.NSPowerShell___s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ax, word [ebp - 0x824]
add esp, 0xc
cmp ax, 1
jne 0x11099cb7
push 1
push str.nspowershell.exe
call fcn.111bb700
add esp, 8
mov dword [ebp - 0x848], eax
push 0x208
lea ecx, [ebp - 0x8d0]
mov byte [ebp - 4], 0xc
call fcn.1113c0e0
mov edx, dword [ebp - 0x848]
push edx
lea eax, [ebp - 0x8d0]
push str.__s_
push eax
mov byte [ebp - 4], 0xd
call fcn.1113d940
add esp, 0xc
cmp byte [0x1127ad8d], 0
je 0x110998bf
push 0x1121282c
lea ecx, [ebp - 0x8d0]
call fcn.1113dca0
mov dx, word [ebp - 0x834]
test dx, dx
je 0x11099903
mov cx, word [ebp - 0x83c]
test cx, cx
je 0x11099903
mov ax, word [ebp - 0x838]
test ax, ax
je 0x11099903
movzx eax, ax
push eax
movzx edx, dx
movzx eax, cx
push edx
push eax
lea ecx, [ebp - 0x8d0]
push str.__x_d__y_d__a_d
push ecx
call fcn.1113d9c0
add esp, 0x14
push esi
mov esi, dword [ebp - 0x840]
mov ecx, esi
call fcn.110c3840
push eax
lea edx, [ebp - 0x8d0]
push str.__d__s
push edx
call fcn.1113d9c0
mov ecx, dword [0x1127b21c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
add esp, 0x10
push 0x111fb618
lea edx, [ebp - 0x818]
push edx
push 0x1127aca4
call eax
test eax, eax
je 0x1109997d
lea ecx, [ebx + 0x4b0]
push ecx
push eax
mov dword [ebx + 0x4b4], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
mov ecx, esi
call fcn.110c3840
mov edx, dword [ebx + 0x4b4]
push eax
push 0x49c
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x11099bf8
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0x854], eax
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
lea eax, [ebp - 0x9ec]
push eax
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x9f0], 0x44
call sub.MSVCR100.dll_memset
mov ecx, 7
add esp, 0xc
mov word [ebp - 0x9c0], cx
push 0
lea ecx, [ebp - 0x8d0]
mov dword [ebp - 0x9c4], 0x19
mov dword [ebp - 0x9d0], 0x78
mov dword [ebp - 0x9cc], 0xbb8
mov dword [ebp - 0x9c8], 0x56
call fcn.1102f630
push eax
call fcn.111b7990
mov esi, eax
add esp, 8
mov dword [ebp - 0x8c0], esi
mov byte [ebp - 4], 0xe
test edi, edi
je 0x11099a4a
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc0]
call eax
test eax, eax
je 0x11099a4a
lea ecx, [ebp - 0x9f0]
push ecx
push 0x210
push 0
lea edx, [ebp - 0x858]
push edx
push 0
push 0
push esi
push edi
call fcn.110f0000
add esp, 0x20
jmp 0x11099a8f
mov ecx, dword [0x1127b21c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
lea edx, [ebp - 0x9f0]
push edx
push 1
push 0
push 0x210
push 0
lea edx, [ebp - 0x858]
push edx
push 0
push esi
call eax
push esi
test eax, eax
jne 0x11099a82
push str.Couldnt_create_nspowershell___s_n
jmp 0x11099a87
push str.created_nspowershell___s_n
call fcn.111bd7b0
add esp, 8
cmp dword [ebp - 0x858], 0
je 0x11099b69
mov ecx, dword [ebp - 0x850]
mov dword [ebx + 0x4b0], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x830], eax
xor esi, esi
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x830]
cmp eax, 0xfa0
jae 0x11099b30
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
push 0x111fb618
lea eax, [ebp - 0x818]
push eax
push 0x1127aca4
call edx
mov dword [ebx + 0x4b4], eax
test eax, eax
jne 0x11099b30
push eax
mov eax, dword [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x11099b1c
push 0xf
call edi
inc esi
cmp esi, 0x1f4
jl 0x11099ac0
jmp 0x11099b30
mov ecx, dword [ebp - 0x850]
push ecx
push str.Powershell_process__d_has_ended_n
call fcn.111bd7b0
add esp, 8
mov edx, dword [ebp - 0x858]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x854]
push eax
call esi
mov ecx, dword [ebx + 0x4b0]
mov edx, dword [ebx + 0x4b4]
push ecx
push edx
push str.PowerShell_wnd_x__pid_d_n
call fcn.111bd7b0
mov esi, dword [ebp - 0x8c0]
add esp, 0xc
cmp dword [ebx + 0x4b4], 0
jne 0x11099beb
mov ecx, dword [ebx + 4]
call fcn.110c7040
push eax
push 0x80
lea ecx, [ebp - 0x990]
call fcn.1111a110
mov edx, dword [ebp - 0x990]
lea eax, [ebp - 0x8a4]
push eax
mov eax, dword [edx + 0xc]
lea ecx, [ebp - 0x990]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x894], 0xd
mov dword [ebp - 0x8a4], 0xe5
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [ebp - 0x894]
push ecx
mov ecx, eax
call edx
mov ecx, dword [ebx + 4]
push 1
lea eax, [ebp - 0x990]
push eax
call fcn.110825d0
lea ecx, [ebp - 0x990]
mov byte [ebp - 4], 0xe
call fcn.1111ab70
push esi
mov byte [ebp - 4], 0xd
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [ebp - 0x82c], 0
jne 0x11099c0e
cmp dword [ebp - 0x828], 0
je 0x11099c94
push str.Report_PowerShell_isAdmin_n
call fcn.111bd7b0
mov ecx, dword [ebx + 4]
add esp, 4
call fcn.110c7040
push eax
push 0x80
lea ecx, [ebp - 0x958]
call fcn.1111a110
mov edx, dword [ebp - 0x958]
mov eax, dword [edx + 0xc]
lea ecx, [ebp - 0x8b0]
push ecx
lea ecx, [ebp - 0x958]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x8bc], 0xe
mov dword [ebp - 0x8b0], 0xe5
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [ebp - 0x8bc]
push ecx
mov ecx, eax
call edx
mov ecx, dword [ebx + 4]
push 1
lea eax, [ebp - 0x958]
push eax
call fcn.110825d0
lea ecx, [ebp - 0x958]
mov byte [ebp - 4], 0xd
call fcn.1111ab70
lea ecx, [ebp - 0x8d0]
mov byte [ebp - 4], 0xc
call fcn.1113cd80
mov ecx, dword [ebp - 0x848]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x11099d76
cmp ax, 4
je 0x11099cce
movzx edx, ax
push edx
push str.powershell_cmdx_x_n
call fcn.111bd7b0
add esp, 8
mov eax, dword [ebx + 0x4b4]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x11099ce5
push eax
call esi
test eax, eax
jne 0x11099d09
mov ecx, dword [0x1127b21c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
push 0x111fb618
lea edx, [ebp - 0x818]
push edx
push 0x1127aca4
call eax
mov dword [ebx + 0x4b4], eax
mov eax, dword [ebx + 0x4b4]
test eax, eax
je 0x11099d76
push eax
call esi
test eax, eax
je 0x11099d76
mov edx, dword [ebx + 0x4b4]
lea ecx, [ebp - 0x88c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x88c]
cmp eax, dword [ebx + 0x4b0]
jne 0x11099d76
mov ecx, dword [ebp - 0x830]
mov edx, dword [ebp - 0x8a0]
lea eax, [ebp - 0x908]
push eax
push 0
mov dword [ebp - 0x904], ecx
mov ecx, dword [ebx + 0x4b4]
push 0x4a
push ecx
mov dword [ebp - 0x900], edx
mov dword [ebp - 0x908], 0x49c
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x82c]
test eax, eax
je 0x11099d87
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x81c]
test eax, eax
je 0x11099d98
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x200
lea eax, [ebp - 0x218]
mov byte [eax], 0
inc eax
dec ecx
jne 0x11099da3
lea ecx, [ebp - 0x8e0]
mov byte [ebp - 4], 3
call fcn.1113cd80
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 2
call fcn.1113cd80
lea ecx, [ebp - 0x868]
mov byte [ebp - 4], 1
call fcn.1113cd80
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0
call fcn.1113cd80
lea ecx, [ebp - 0x8fc]
mov dword [ebp - 4], 0xffffffff
call fcn.1111ab70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret