Function at 0x1102d900
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Get hostname
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111800a4
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
push 0x1119b510
call fcn.11147060
add esp, 8
call fcn.11145ef0
mov ebx, 1
test eax, eax
je 0x1102d979
push 0x111ee4b8
call dword [sym.imp.KeRneL32.DLl_InterlockedIncrement]
cmp eax, ebx
jle 0x1102d979
push 0x1119b4f0
call fcn.11147060
mov esi, dword [sym.imp.KeRneL32.DLl_Sleep]
add esp, 4
nop
push 0xea60
call esi
jmp 0x1102d970
push 0x20
call dword [sym.imp.KeRneL32.DLl_GetCurrentProcess]
push eax
call dword [sym.imp.KeRneL32.DLl_SetPriorityClass]
mov ecx, dword [0x111ee308]
mov byte [0x111ee282], bl
xor edi, edi
mov dword [0x111ee10c], ebx
mov dword [0x111ee108], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x138]
push edi
call edx
mov eax, dword [0x111ee260]
cmp eax, edi
je 0x1102d9bd
push eax
call dword [sym.imp.KeRneL32.DLl_SetEvent]
cmp esi, edi
jg 0x1102d9f7
cmp dword [0x111ee0e4], edi
jne 0x1102d9f7
cmp dword [0x111ee254], edi
jne 0x1102d9f7
push edi
push edi
push 0x3e9
call fcn.11029990
mov eax, dword [0x111ee308]
push 0x111ee124
push ebx
push 0x2af9
push edi
push eax
call fcn.110ffd70
add esp, 0x20
mov ecx, dword [0x111ee308]
cmp ecx, edi
je 0x1102da11
cmp dword [0x111ee254], edi
je 0x1102da11
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push edi
call eax
mov ecx, dword [0x111efb7c]
cmp ecx, edi
je 0x1102da22
push 3
call fcn.1109f5f0
mov eax, dword [0x111ee218]
cmp eax, edi
je 0x1102da2e
mov dword [eax + 0x5c], ebx
call fcn.11029490
call fcn.11028690
mov ecx, dword [0x111ee28c]
cmp ecx, edi
je 0x1102da4d
mov dword [0x111ee28c], edi
call fcn.110eccf0
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0x114]
push ebx
push ebx
push ebx
call eax
mov ecx, dword [0x111ee218]
cmp ecx, edi
je 0x1102da6f
call fcn.11059fb0
cmp dword [0x111ee1c8], edi
je 0x1102daae
cmp dword [0x111ee0e0], 0x30001
jg 0x1102daae
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
push ebx
call eax
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
push 0x81
call eax
push 0x7d0
call dword [sym.imp.KeRneL32.DLl_Sleep]
push 0x1119b4e0
call fcn.11147060
mov ecx, dword [0x111ee308]
add esp, 4
cmp ecx, edi
je 0x1102dacd
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push edi
call eax
mov ecx, dword [0x111ee100]
cmp ecx, edi
je 0x1102daf6
push edi
push edi
push 0x1119b4d0
push 0x111a0f18
call fcn.1105e820
cmp eax, ebx
jne 0x1102daf6
push ebx
push edi
call fcn.1102d750
add esp, 8
cmp dword [0x111ee254], edi
jne 0x1102db06
cmp dword [0x111ee268], edi
je 0x1102db5a
cmp byte [0x111ee281], 0
je 0x1102db5a
lea ecx, [ebp - 0x274]
call fcn.110b0470
push eax
push 6
mov dword [ebp - 4], edi
call fcn.110eb4a0
add esp, 8
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], 0xffffffff
call fcn.110b0660
cmp dword [0x111ee190], edi
je 0x1102de54
push 2
call fcn.111361c0
add esp, 4
mov dword [0x111ee190], eax
jmp 0x1102de54
push ebx
call fcn.11027580
add esp, 4
cmp dword [0x111ee434], edi
je 0x1102db9b
mov dword [0x111ee448], ebx
cmp dword [0x111ee438], edi
jne 0x1102db9b
mov esi, dword [sym.imp.uSEr32.dll_PostThreadMessageA]
mov ecx, dword [0x111ee434]
push 0
push 0
push 0
push ecx
call esi
call fcn.11110130
cmp dword [0x111ee438], edi
je 0x1102db7f
mov ecx, dword [0x111ee218]
xor edi, edi
cmp ecx, edi
je 0x1102dbe3
cmp dword [ecx + 0x10], edi
jne 0x1102dbc0
lea esp, [esp]
call fcn.11110130
mov ecx, dword [0x111ee218]
cmp dword [ecx + 0x10], edi
je 0x1102dbb0
mov esi, ecx
call fcn.11059f10
push esi
call fcn.11162777
add esp, 4
mov dword [0x111ee218], edi
cmp dword [0x111ee254], edi
jne 0x1102dbe3
call fcn.11029490
cmp dword [0x111ee288], edi
je 0x1102dc24
cmp dword [0x111ee254], edi
jne 0x1102dc24
push 0x1119b4b4
call fcn.11147060
mov ecx, dword [0x111ee288]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esp, 4
push 0x4e20
call eax
mov ecx, dword [0x111ee288]
cmp ecx, edi
je 0x1102dc24
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp dword [0x111ee258], edi
je 0x1102dc3b
call fcn.11106190
call fcn.111089e0
call fcn.11106830
mov ecx, dword [0x111ee134]
cmp ecx, edi
je 0x1102dc51
push 1
push 0x11195264
call fcn.11075fe0
push 0x1119b4a8
call fcn.11147060
call fcn.1113d850
push 0x1119b4a0
call fcn.11147060
mov ecx, dword [0x111ee270]
add esp, 8
mov esi, ecx
cmp ecx, edi
je 0x1102dc87
call fcn.1109dd40
push esi
call fcn.11162777
add esp, 4
push 0x1119b490
call fcn.11147060
mov ecx, dword [0x111ee1d8]
add esp, 4
mov esi, ecx
cmp ecx, edi
je 0x1102dcae
call fcn.1110f350
push esi
call fcn.11162777
add esp, 4
mov ecx, dword [0x111ee134]
cmp ecx, edi
je 0x1102dcc0
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [0x111ee420]
cmp ecx, edi
je 0x1102dd25
call fcn.11110920
mov esi, eax
cmp esi, edi
je 0x1102dd1f
mov eax, dword [esi]
cmp eax, 1
jne 0x1102dcf0
mov ecx, dword [esi + 0x10]
movzx edx, word [ecx]
and edx, 0xff
push edx
push 0x1119b464
jmp 0x1102dcf6
push eax
push 0x1119b43c
call fcn.11147060
add esp, 8
mov ecx, esi
call fcn.11067690
push esi
call fcn.11162777
mov ecx, dword [0x111ee420]
add esp, 4
call fcn.11110920
mov esi, eax
cmp esi, edi
jne 0x1102dcd5
mov ecx, dword [0x111ee420]
mov esi, ecx
cmp ecx, edi
je 0x1102dd39
call fcn.11110980
push esi
call fcn.11162777
add esp, 4
cmp dword [0x111ee0fc], edi
je 0x1102ddb2
mov ecx, dword [0x111ee0f8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x11054610
push 0x20000105
call edx
mov ecx, dword [0x111ee0f8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x110285e0
push 0x3000010c
call edx
mov ecx, dword [0x111ee0f8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x11028760
push 0x30000110
call edx
mov ecx, dword [0x111ee0fc]
mov esi, ecx
cmp ecx, edi
je 0x1102ddb2
call fcn.11110980
push esi
call fcn.11162777
add esp, 4
push 0x1119b428
call fcn.11147060
mov ecx, dword [0x111ee0f8]
add esp, 4
mov esi, ecx
cmp ecx, edi
je 0x1102ddd9
call fcn.1108a980
push esi
call fcn.11162777
add esp, 4
mov eax, dword [0x111ee424]
push eax
mov dword [0x111ee0f8], edi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
mov eax, dword [0x111ee1bc]
cmp eax, edi
je 0x1102ddfd
push eax
call fcn.11163aa5
add esp, 4
mov ecx, dword [0x111ee1d4]
cmp ecx, edi
je 0x1102de42
call fcn.11110920
cmp eax, edi
je 0x1102de28
push eax
call fcn.11163aa5
mov ecx, dword [0x111ee1d4]
add esp, 4
call fcn.11110920
cmp eax, edi
jne 0x1102de10
mov ecx, dword [0x111ee1d4]
mov esi, ecx
cmp ecx, edi
je 0x1102de42
call fcn.11110980
push esi
call fcn.11162777
add esp, 4
mov ecx, dword [0x111ee0f4]
cmp ecx, edi
je 0x1102de54
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
call fcn.1100d620
xor ebx, ebx
cmp eax, ebx
je 0x1102de73
push eax
call fcn.1100d330
push eax
push 0x1119b404
call fcn.11147060
add esp, 0xc
cmp dword [0x111ee23c], ebx
je 0x1102dfca
cmp dword [0x111ee0e4], ebx
jne 0x1102dfca
cmp dword [0x111ee240], ebx
jne 0x1102dfca
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push ebx
call dword [sym.imp.KeRneL32.DLl_GetModuleFileNameA]
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KeRneL32.DLl_GetFileAttributesA]
test al, 1
jne 0x1102dfca
push 8
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], 1
cmp eax, ebx
je 0x1102deec
mov ecx, dword [0x111ee0dc]
push ecx
mov ecx, eax
call fcn.11143630
mov esi, eax
jmp 0x1102deee
xor esi, esi
mov dword [ebp - 0x258], esi
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.11143770
push ebx
push ebx
push 0x4b
mov ecx, esi
call fcn.11143780
test eax, eax
jne 0x1102dfb6
lea edx, [ebp - 0x114]
push 0x5c
push edx
call fcn.11081e00
add esp, 8
test eax, eax
jne 0x1102df3e
push 0xdb4
push 0x1119a7b0
push 0x1119b3fc
call fcn.11029a70
push 0x140
mov dword [eax + 1], 0x2a2e2a
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.11162be0
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x114]
push edx
xor edi, edi
call dword [sym.imp.KeRneL32.DLl_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1102dfaa
mov ebx, dword [sym.imp.KeRneL32.DLl_FindNextFileA]
mov edi, edi
test byte [ebp - 0x254], 0x10
jne 0x1102df8a
inc edi
lea eax, [ebp - 0x254]
push eax
push esi
call ebx
test eax, eax
jne 0x1102df80
push esi
call dword [sym.imp.KeRneL32.DLl_FindClose]
cmp edi, 0xe
jl 0x1102dfaa
push 0
push 0
jmp 0x1102dfae
push 1
push 1
call fcn.111273e0
add esp, 8
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0xffffffff
call fcn.11028950
xor ebx, ebx
mov ecx, dword [0x111ee308]
mov edi, dword [ebp + 8]
cmp ecx, ebx
je 0x1102e000
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [edi + 1]
neg eax
sbb eax, eax
and eax, edi
push eax
call edx
mov ecx, dword [0x111ee308]
cmp ecx, ebx
je 0x1102dffa
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x111ee308], ebx
cmp dword [0x111ee254], ebx
jne 0x1102e058
cmp dword [0x111ee268], ebx
jne 0x1102e058
mov ecx, dword [0x111ee100]
cmp ecx, ebx
je 0x1102e022
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [0x111ee104]
mov dword [0x111ee100], ebx
cmp ecx, ebx
je 0x1102e03a
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [0x111ee0f0]
mov dword [0x111ee104], ebx
cmp ecx, ebx
je 0x1102e052
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x111ee0f0], ebx
push 0x1119b3d8
call fcn.11147060
add esp, 4
call fcn.11147020
cmp dword [0x111ee1c8], ebx
je 0x1102e0a6
cmp dword [0x111ee0e0], 0xa0003
mov esi, dword [sym.imp.uSEr32.dll_ExitWindowsEx]
jl 0x1102e094
push ebx
push 2
call esi
push 0x2710
call dword [sym.imp.KeRneL32.DLl_Sleep]
cmp dword [0x111ee1c8], 2
push ebx
jne 0x1102e0a2
push 5
jmp 0x1102e0a4
push 6
call esi
cmp edi, 0xffffffff
jne 0x1102e0b6
push 0x7d0
call dword [sym.imp.KeRneL32.DLl_Sleep]
push 0x1119b3c4
call fcn.11147060
add esp, 4
push edi
call dword [sym.imp.KeRneL32.DLl_ExitProcess]