joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110ba1f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push str.ThumbWL
call fcn.11123360
mov eax, dword [0x1127aa44]
push str._thumb:
push eax
call fcn.11198bf0
add esp, 0xc
test eax, eax
je 0x110ba34e
push edi
add eax, 0xe
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x110ba34d
push esi
push 0
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x110ba345
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x10]
push ebx
push 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x110ba33d
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x110ba331
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
push ecx
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [esi + 0x14]
push ecx
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
test ebx, ebx
je 0x110ba327
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 4]
mov edx, dword [ebp - 4]
push 0xcc0020
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push ecx
push eax
mov eax, dword [ebp - 0x10]
push edx
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp dword [ebp - 0x14], 0
jne 0x110ba30f
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d_blitting_from_winlogon__took__d_ms_n
call fcn.111bd7b0
add esp, 0xc
call dword [sym.imp.GDI32.dll_GdiFlush]
mov ecx, dword [ebp - 0x18]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [ebp - 4]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x110ba360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, dword [ebp + 8]
push esi
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x84]
push str.Winsta0_s
push eax
call ebx
push 0x44
lea ecx, [ebp - 0x4e8]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
push edi
lea edx, [ebp - 0x84]
push 0x1127ad98
push 0
mov dword [ebp - 0x4e8], 0x44
mov dword [ebp - 0x4e0], edx
mov dword [ebp - 0x4bc], 0x80
call fcn.111bb510
add esp, 4
push eax
lea eax, [ebp - 0x494]
push str.__s_s___thumb:_s
push eax
call ebx
lea ecx, [ebp - 0x494]
push ecx
push esi
push str.creating___s__s_n
call fcn.111bd7b0
add esp, 0x20
lea edx, [ebp - 0x4a4]
push edx
lea eax, [ebp - 0x4e8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x494]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x110ba47c
mov edx, dword [ebp - 0x4a0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x4a4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x4a4]
push ecx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x110be400
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e1abb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov edi, dword [eax + 8]
lea ebx, [eax + 0xc]
push ebx
mov dword [ebp - 0x224], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x11c]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [edi + 0x118]
mov dword [ebp - 4], 0
call fcn.110bdb70
mov eax, dword [edi + 0x11c]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x11c]
mov dword [eax], eax
mov eax, dword [edi + 0x11c]
mov dword [eax + 8], eax
mov dword [edi + 0x120], 0
test byte [edi], 1
jne 0x110be57c
cmp dword [edi + 0x114], 0
jne 0x110be57c
mov edi, dword [edi + 0x10]
test edi, edi
je 0x110be57c
push 0
push 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x110be4e6
push 0x3c6
push str...ctl32Config.cpp
push str.err__0
call fcn.11067750
add esp, 0xc
mov esi, 0x100
cmp dword [ebp - 0x21c], esi
jb 0x110be50a
push 0x3c7
push str...ctl32Config.cpp
push str.maxname____tsizeof__keybuf_
call fcn.11067750
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0x214], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push edi
call esi
test eax, eax
jne 0x110be57c
lea ebx, [ebx]
lea ecx, [ebp - 0x210]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
push 0
lea edx, [ebp - 0x218]
push edx
push 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push edi
mov dword [ebp - 0x214], 0x100
call esi
test eax, eax
je 0x110be540
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x110beef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x231c
call fcn.111d92c0
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
lea edx, [ebp - 0x2308]
push edx
push 0x20119
push 0
push edi
push esi
mov dword [ebp - 0x2318], eax
mov dword [ebp - 0x2314], ecx
call ebx
test eax, eax
je 0x110bef58
lea eax, [ebp - 0x2308]
push eax
push 0x20019
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x110bf0bc
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [ebp - 0x2310]
push ecx
lea edx, [ebp - 0x2304]
push edx
lea eax, [ebp - 0x231c]
push eax
mov eax, dword [ebp - 0x2308]
xor esi, esi
push esi
lea ecx, [ebp - 0x230c]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x230c], 0x100
mov dword [ebp - 0x2310], 0x2100
call edi
test eax, eax
jne 0x110bf0af
lea ebx, [ebx]
lea ecx, [ebp - 0x204]
push 0
push ecx
call dword [sym.imp.MSVCR100.dll_wcschr]
lea edx, [ebp - 0x204]
add esp, 8
cmp eax, edx
jbe 0x110befeb
lea esp, [esp]
movzx ecx, word [eax - 2]
test cx, cx
je 0x110befeb
cmp ecx, 0x20
ja 0x110befeb
add eax, 0xfffffffe
lea ecx, [ebp - 0x204]
cmp eax, ecx
ja 0x110befd0
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x204]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x110bf03b
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x204]
mov ebx, ecx
lea edx, [eax + 2]
cmp eax, ebx
jbe 0x110bf034
lea ebx, [ebx]
cmp word [eax - 2], 0x20
jne 0x110bf034
add eax, 0xfffffffe
lea ebx, [ebp - 0x204]
cmp eax, ebx
ja 0x110bf020
xor ebx, ebx
mov word [eax], bx
jmp 0x110bf04b
mov ecx, dword [ebp - 0x2314]
test ecx, ecx
je 0x110bf063
lea edx, [ebp - 0x204]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x2304]
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2318]
call fcn.110bbcf0
lea ecx, [ebp - 0x2310]
push ecx
lea edx, [ebp - 0x2304]
push edx
lea eax, [ebp - 0x231c]
push eax
mov eax, dword [ebp - 0x2308]
push 0
lea ecx, [ebp - 0x230c]
push ecx
lea edx, [ebp - 0x204]
push edx
inc esi
push esi
push eax
mov dword [ebp - 0x230c], 0x100
mov dword [ebp - 0x2310], 0x2100
call edi
test eax, eax
je 0x110befb0
mov ecx, dword [ebp - 0x2308]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x110bf510
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x210], eax
xor esi, esi
call fcn.111babb0
test al, al
jne 0x110bf6fe
push ebx
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x218], esi
push edi
nop
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20c]
push ecx
push 0x20119
push 0
push str.SoftwarePoliciesNetSupportClient
push ebx
call edi
test eax, eax
je 0x110bf58e
lea edx, [ebp - 0x20c]
push edx
push 0x20019
push 0
push str.SoftwarePoliciesNetSupportClient
push ebx
call edi
test eax, eax
jne 0x110bf6b8
mov eax, dword [ebp - 0x210]
push str.Client
push str.SoftwarePoliciesNetSupportClientStandard
push ebx
push 3
push eax
call fcn.110beef0
mov eax, dword [ebp - 0x20c]
add esp, 0x14
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov ebx, 0x1388
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x110bf6a4
jmp 0x110bf5f0
lea ecx, [ebp - 0x204]
push str.Standard
inc esi
push ecx
mov dword [ebp - 0x21c], esi
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x110bf66e
lea edx, [ebp - 0x204]
push edx
push ebx
push str.Client._04d._s
call fcn.111be4a0
mov esi, eax
lea eax, [ebp - 0x204]
push eax
push 0x11206280
push str.SoftwarePoliciesNetSupport
push str._s_s_s_
call fcn.111be4a0
mov ecx, dword [ebp - 0x208]
mov edx, dword [ebp - 0x210]
push esi
mov edi, eax
push edi
push ecx
push 3
push edx
call fcn.110beef0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov esi, dword [ebp - 0x21c]
add esp, 0x38
inc ebx
mov edx, dword [ebp - 0x20c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push edx
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x110bf5f0
mov eax, dword [ebp - 0x20c]
push eax
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x208]
mov edi, dword [ebp - 0x218]
test edi, edi
jne 0x110bf6ec
mov ecx, dword [ebp - 0x210]
push edi
push edi
push str.DisableUserPolicies
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x110bf6fc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x208], eax
test eax, eax
je 0x110bf6fc
mov ebx, eax
inc edi
mov dword [ebp - 0x218], edi
cmp edi, 2
jl 0x110bf550
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x110bf710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e1bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1113ccd0
push str._base
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
xor ebx, ebx
push edx
mov dword [ebp - 4], ebx
call fcn.1113dee0
add esp, 0xc
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
mov byte [ebp - 4], 1
call edx
test al, al
jne 0x110bf789
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov esi, dword [esi + 0xc]
push esi
mov ecx, edi
call fcn.110bead0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.1113cd80
push str._defaults
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.1113dee0
add esp, 0xc
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov byte [ebp - 4], 2
call eax
test al, al
jne 0x110bf7dd
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov esi, dword [esi + 0xc]
mov ecx, dword [edi + 0x2c]
push esi
call fcn.110bead0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.1113cd80
push str._enforce
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.1113dee0
add esp, 0xc
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
mov byte [ebp - 4], 3
call edx
test al, al
jne 0x110bf832
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov esi, dword [esi + 0xc]
mov ecx, dword [edi + 0x30]
push esi
call fcn.110bead0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.1113cd80
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x110c2190
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 1
jne 0x110c22ee
lea ecx, [ebp - 0x11c]
push ecx
push 0
push 0
push str.SystemCurrentControlSetServicesWinsockAutodial
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x110c22ee
cmp dword [ebp + 8], eax
je 0x110c2275
mov eax, dword [0x1127bedc]
mov edx, eax
inc eax
mov dword [0x1127bedc], eax
test edx, edx
jne 0x110c22e1
lea eax, [ebp - 0x120]
push eax
push 0x1127bebe
lea ecx, [ebp - 0x124]
push ecx
push edx
mov edx, dword [ebp - 0x11c]
push str.AutodialDllName32
push edx
mov dword [ebp - 0x120], 0x1e
call fcn.111b8970
mov ax, word [0x1127bebe]
add esp, 0x18
test ax, ax
je 0x110c22e1
cmp ax, 0x21
je 0x110c22e1
mov ecx, dword [ebp - 0x120]
add ecx, 2
mov eax, 0x21
push ecx
mov word [0x1127bebc], ax
push 0x1127bebc
jmp 0x110c22c6
dec dword [0x1127bedc]
jne 0x110c22e1
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x120]
push ecx
push 0x1127bebc
lea edx, [ebp - 0x124]
push edx
push 0
push str.AutodialDllName32
push eax
mov dword [ebp - 0x120], 0x20
call fcn.111b8970
add esp, 0x18
cmp word [0x1127bebc], 0x21
jne 0x110c22e1
mov ecx, dword [ebp - 0x120]
push ecx
push 0x1127bebe
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x11c]
push edx
push 0
push str.AutodialDllName32
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x110c3290
Capabilities:
Check for time delay via gettickcount
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 1
jne 0x110c32f5
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.110c2fe0
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8
push edi
push str.netapi32.dll
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x12c], edi
cmp edi, ebx
jne 0x110c3328
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetWkstaGetInfo
push edi
call esi
push 0x1121a8c4
push edi
mov dword [ebp - 0x128], eax
call esi
mov dword [ebp - 0x124], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x134], eax
xor edi, edi
jmp 0x110c3360
lea edx, [ebp - 0x11c]
push edx
push 0x64
push 0
call dword [ebp - 0x128]
mov ebx, eax
test ebx, ebx
je 0x110c33f0
cmp ebx, 0x85a
jne 0x110c33f0
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x110c33c0
push 4
push str.lanmanworkstation
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x110c33ac
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x110c33b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x110c33e9
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x110c33d2
push edi
push str.Info:_waiting_for_lanmanworkstation_to_start___d__n
call fcn.111bd7b0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x110c3360
jmp 0x110c33f0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x134]
cmp eax, 0xfa
jb 0x110c3411
push eax
push str.Info:_GetDomain_took__d_ms_n
call fcn.111bd7b0
add esp, 8
test ebx, ebx
jne 0x110c3437
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x11c]
push eax
mov eax, dword [edx + 8]
push ecx
push eax
call fcn.111b7fd0
add esp, 0xc
lea esi, [ebx + 1]
jmp 0x110c343d
mov esi, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [ebp - 0x124]
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8
Function at 0x110c3d30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ecx + 0x2c], 0
push esi
mov esi, dword [ecx + 0x28]
push edi
mov dword [ebp - 8], ecx
jne 0x110c3d5b
push 0x20f6
push str...ctl32Connect.cpp
push str.m_lookup
call fcn.11067750
add esp, 0xc
mov eax, dword [esi + 0x27c]
mov dword [ebp - 4], eax
test eax, eax
jne 0x110c3d7f
push 0x20f8
push str...ctl32Connect.cpp
push 0x1121aa80
call fcn.11067750
add esp, 0xc
mov edi, dword [ebp + 0x10]
mov eax, edi
and eax, 0xfffff800
shl eax, 0x14
cmp dword [esi + 0x138], 0
mov dword [ebp - 0xc], eax
jne 0x110c3ea3
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
and eax, 0xfff
add eax, 0xffffffbc
mov byte [ebp + 0x13], 0
cmp eax, 2
ja 0x110c3db8
mov byte [ebp + 0x13], 1
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0xa00], 0
mov dword [esi + 0x69c], eax
je 0x110c3e33
test edi, 0x200
jne 0x110c3e33
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esi + 0xa00]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
and edi, 0x400
cmp edi, 0x400
sete al
movzx eax, al
push eax
lea eax, [ebp + 0xc]
push eax
push ebx
call edx
mov edi, eax
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp - 0x18]
add dword [esi + 0x7f0], ecx
adc dword [esi + 0x7f4], edx
jmp 0x110c3e36
mov edi, dword [ebp + 8]
cmp byte [ebp + 0x13], 0
je 0x110c3e75
mov eax, dword [ebp - 4]
cmp dword [eax + 0xd4], 0
je 0x110c3e75
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x8c]
call eax
test al, al
je 0x110c3e75
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x278]
mov eax, dword [ebp - 4]
push ecx
mov ecx, dword [eax + 0xd4]
push ebx
push edx
call ecx
add esp, 0xc
jmp 0x110c3e90
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x278]
push edx
mov edx, dword [ebp - 4]
push eax
mov eax, dword [edx + 0x58]
push ebx
push ecx
call eax
add esp, 0x10
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp + 0xc]
add esp, 4
add dword [esi + 0x7d8], ecx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110c4b70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0xaec]
push esi
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov edi, dword [edi + 0xb18]
mov ecx, eax
mov ebx, edx
mov eax, edi
cdq
add esp, 4
mov dword [ebp - 0x18], ecx
cmp ebx, edx
jl 0x110c4bd1
jg 0x110c4baf
cmp ecx, eax
jb 0x110c4bd1
test edi, edi
je 0x110c4bd1
test ebx, ebx
jg 0x110c4bc6
jl 0x110c4bbe
cmp ecx, 0xffffffff
ja 0x110c4bc6
test edi, edi
jns 0x110c4c74
push esi
push 1
push 0xc
lea eax, [ebp - 0x10]
push eax
jmp 0x110c4bda
push esi
push 1
push 0xc
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jle 0x110c4c74
cmp dword [ebp + 8], 0
jne 0x110c4c2c
mov edx, dword [ebp - 0x18]
push 0
push ebx
push edx
push esi
call dword [sym.imp.MSVCR100.dll__fseeki64]
push 0xc
call dword [sym.imp.MSVCR100.dll_malloc]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add esp, 0x14
pop edi
mov dword [eax + 4], edx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 8], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x10]
test bx, bx
je 0x110c4c74
movzx edx, bx
push edx
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
mov dword [edi], ebx
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov ecx, dword [ebp - 8]
mov dword [edi + 8], ecx
movzx edx, word [ebp - 0x10]
push esi
push 1
sub edx, 0xc
push edx
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x14
test eax, eax
jg 0x110c4c87
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret