joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110673b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x1127b888
push 0
push 0
push 0x11064700
push 0x1000
or esi, 0xffffffff
push 0
mov dword [0x1127b88c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x1127b884], eax
cmp dword [0x1127b88c], esi
jne 0x110673fc
lea esp, [esp]
push 0x32
call edi
cmp dword [0x1127b88c], esi
je 0x110673f0
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x1127b88c], esi
mov eax, dword [0x1127b888]
push 0
push ebx
push 0x500
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x32
call edi
mov esi, dword [0x1127b88c]
cmp esi, 0xffffffff
je 0x11067406
pop ebx
test esi, esi
je 0x1106743f
cmp esi, 0x64
jge 0x1106743f
push 0
call fcn.110645f0
add esp, 4
jmp 0x11067467
mov ecx, dword [0x1127abec]
mov edx, dword [0x1127abf8]
push ecx
mov ecx, dword [0x1127ab0c]
push edx
call fcn.110c20b0
mov dword [0x1127abf4], 1
call fcn.11067350
test esi, esi
je 0x110674f8
mov dword [0x1127b88c], esi
test esi, 0x8000
je 0x110674c1
and esi, 0xffff7fff
or esi, 0x80000000
push esi
mov dword [0x1127b88c], esi
call fcn.111b8780
mov edx, dword [0x1127b88c]
push edx
mov esi, eax
mov eax, dword [0x1127aa58]
mov ecx, dword [eax]
push 0
push 0x192b
push eax
mov eax, dword [ecx + 4]
call eax
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 0x18
pop edi
xor eax, eax
pop esi
pop ebp
ret
cmp esi, 0xffff
jne 0x110674d0
mov esi, 0x42d
jmp 0x110674de
cmp esi, 0x65
jl 0x110674d8
sub esi, 0x5b
add esi, 0x42d
mov edx, dword [0x1127b890]
mov eax, dword [0x1127aa58]
mov ecx, dword [eax]
push edx
push 0
push esi
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 0x10
mov eax, dword [0x1127abf4]
pop edi
pop esi
pop ebp
ret
Function at 0x11067750
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.111ba020
mov eax, dword [ebp + 0x10]
push ebx
push edi
push eax
push esi
push str.Assert._File__hs__line__d__err__d__Expr__s_n
call fcn.111bd7b0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x110677a1
push 0x19
call fcn.111b9ff0
add esp, 4
cmp dword [0x1127b8a4], 0
je 0x11067870
call fcn.11123260
test eax, eax
je 0x11067855
mov ecx, dword [0x1127b8a0]
mov edx, dword [0x1127b8a4]
push ebx
push 0x111fa863
push edi
push ecx
push edx
lea eax, [ebp - 0x204]
push str.Assert_failed__file__hs__line__d__error_code__d_n_nBuild:__hs_n_nExpression:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x1127aa48]
add esp, 0x1c
xor esi, esi
cmp eax, 0xa0003
jl 0x1106780c
xor ecx, ecx
cmp eax, 0xc0003
setl cl
lea esi, [ecx - 1]
and esi, 0x1c0000
add esi, 0x40000
push 0x111233a0
push 0x1388
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push esi
push str.Client32
lea edx, [ebp - 0x204]
push edx
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x12
push 0x12
push 0
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp dword [0x1127acec], 0
je 0x11067868
push 0
call fcn.11064f30
add esp, 4
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x1127b21c]
test ecx, ecx
je 0x11067894
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push 2
call eax
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x60]
push 7
push 0
call eax
mov ecx, dword [ebp + 0x10]
push 0x5c
push esi
mov dword [0x1127b8a4], esi
mov dword [0x1127b8a0], ecx
call dword [sym.imp.MSVCR100.dll_strrchr]
add esp, 8
test eax, eax
je 0x110678b9
inc eax
mov dword [0x1127b8a4], eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x110678d3
call fcn.11123260
test eax, eax
jne 0x110678d3
mov edi, 0x11
mov edx, dword [ebp + 0x10]
push edi
push edx
push esi
push ebx
call fcn.111233b0
add esp, 0x10
cmp dword [0x1127acec], 0
je 0x110678ff
push str.Info._assert__restarting..._n
call fcn.111bd7b0
push 0
call fcn.11064f30
add esp, 8
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x11067cb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dcece
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1127ad00], 0
jne 0x11067e7f
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.DisableInventory
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x11067e7f
mov ecx, dword [0x1127aa68]
push eax
push eax
push str.DisablePreInventory
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x11067e7f
cmp byte [0x1127b8d0], al
jne 0x11067e7f
push 0x834
mov byte [0x1127b8d0], 1
xor esi, esi
call fcn.111709c0
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x11067d61
mov ecx, eax
call fcn.1107ce10
jmp 0x11067d63
xor eax, eax
mov dword [0x1127ac3c], eax
lea eax, [ebp - 0x218]
push eax
push 0x1000048
mov dword [ebp - 4], 0xffffffff
call fcn.1107cfd0
lea ecx, [ebp - 0x218]
push 0
push ecx
call fcn.111be4e0
add esp, 0x10
test eax, eax
jne 0x11067d9a
mov esi, 0x1000048
lea edx, [ebp - 0x218]
push edx
push 0x1000028
call fcn.1107cfd0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.111be4e0
add esp, 0x10
test eax, eax
jne 0x11067dc6
or esi, 0x1000028
lea ecx, [ebp - 0x218]
push ecx
push 0x1000018
call fcn.1107cfd0
lea edx, [ebp - 0x218]
push 0
push edx
call fcn.111be4e0
add esp, 0x10
test eax, eax
jne 0x11067df2
or esi, 0x1000018
test esi, esi
je 0x11067e47
lea eax, [ebp - 0x218]
push eax
push esi
push str.Pregenerating_inventory_x_x___s_etc_n
call fcn.111bd7b0
lea ecx, [ebp - 0x218]
push 0x5c
push ecx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
xor edx, edx
add esp, 0x14
mov word [eax], dx
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [0x1127ac3c]
push esi
push 0x65d
push 0x1127ab38
push 0
call fcn.1107ce60
jmp 0x11067e7f
lea ecx, [ebp - 0x218]
push ecx
push str.Inventory_already_generated___s_etc_n
call fcn.111bd7b0
mov ecx, dword [0x1127ac3c]
add esp, 8
mov esi, ecx
test ecx, ecx
je 0x11067e75
call fcn.1107ce20
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [0x1127ac3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x11068890
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dcfbb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, ecx
lea ecx, [ebp - 0xa4]
call fcn.1113dd30
mov ecx, dword [edi + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
push 0
lea edx, [ebp - 0xa4]
push edx
push str.channel
push str.Client
mov dword [ebp - 4], 0
call eax
mov edx, dword [ebp - 0xa4]
mov eax, dword [edx]
lea ecx, [ebp - 0xa4]
mov dword [esi], 0x400
mov dword [esi + 4], 0x800
call eax
test al, al
jne 0x1106892a
push 0x264
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
cmp dword [ebp - 0x9c], 0
jle 0x1106893a
or dword [esi + 4], 0x200
push ebx
lea ecx, [esi + 8]
call fcn.1113dbf0
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [esi + 0x28]
call fcn.1113db60
mov dl, byte [edi + 0x68]
mov byte [esi + 0x48], dl
cmp dword [0x1127ad10], 0
setne al
mov byte [esi + 0x49], al
test al, al
je 0x11068996
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x90]
push ecx
mov dword [ebp - 0x94], 0x40
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edx, [ebp - 0x90]
push edx
lea ecx, [esi + 0x4c]
call fcn.1113dbf0
mov ecx, dword [0x1127aa68]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 0
lea edi, [esi + 0x60]
push edi
push str.Macaddress
push 0x11218828
call edx
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
test al, al
jne 0x110689d3
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
mov eax, dword [edi + 0xc]
cmp word [eax], 0
jne 0x110689f6
mov ecx, dword [0x1127aa68]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 0
push edi
push str.Macaddress
push str.Client
call edx
mov ecx, dword [0x1127aa68]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 0
add esi, 0x70
push esi
push 0x11207680
push str.Client
call edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1106c9a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dfdf8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp eax, 0x12
ja case.0x1106c9db.5
movzx eax, byte [eax + 0x1106cbac]
jmp dword [eax*4 + 0x1106cb98]
mov ecx, dword [0x1127ab0c]
push 0xd0
push ecx
lea ecx, [ebp - 0x34]
xor bl, bl
call fcn.110c9fe0
push 1
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.110c6240
test eax, eax
je 0x1106ca3d
lea ecx, [ecx]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x30]
push 0
push 0
push str.DisableStandby
push str.Client
call fcn.110bbc00
test eax, eax
je 0x1106ca2f
mov bl, 1
push 1
lea ecx, [ebp - 0x34]
call fcn.110c6240
test eax, eax
jne 0x1106ca10
movzx esi, bl
neg esi
sbb esi, esi
lea ecx, [ebp - 0x34]
and esi, 0x424d5143
mov dword [ebp - 4], 0xffffffff
call fcn.110ca040
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1127aa80]
mov ecx, dword [0x1127aa7c]
mov edx, dword [0x1127aa78]
push eax
push ecx
push edx
push str.APMSUSPEND__suspended_u__suspending_u__resuming_u_n
call fcn.111bd7b0
xor esi, esi
add esp, 0x10
cmp dword [0x1127aa80], esi
je 0x1106caac
push str.Stop_resuming_n
call fcn.111bd7b0
add esp, 4
mov dword [0x1127aa80], esi
cmp dword [0x1127aa78], esi
jne case.0x1106c9db.5
cmp dword [0x1127aa7c], esi
jne case.0x1106c9db.5
cmp dword [0x1127acfc], esi
jne case.0x1106c9db.5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1127aa80], esi
call edi
or eax, 1
mov dword [0x1127aa7c], eax
call fcn.110672c0
mov eax, dword [0x1127abf4]
push esi
mov dword [0x1127b878], eax
call fcn.110645f0
add esp, 4
call fcn.111babb0
mov ecx, dword [0x1127ab0c]
push esi
push esi
push esi
push 1
push 0xa
push 3
test al, al
je 0x1106cb1d
call fcn.110c5980
jmp 0x1106cb2d
call fcn.110c5980
push esi
push esi
push esi
call fcn.11068bd0
add esp, 0xc
mov dword [0x1127aa84], esi
call edi
or eax, 1
mov dword [0x1127aa78], eax
mov dword [0x1127aa7c], esi
jmp case.0x1106c9db.5
cmp dword [ebp + 0xc], 0
je case.0x1106c9db.2
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.IgnorePowerResume
push str._debug
call fcn.110bbc00
test eax, eax
jne case.0x1106c9db.5
cmp dword [0x1127aa78], 0
je case.0x1106c9db.5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or eax, 1
mov dword [0x1127aa80], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1106d160
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1127ad00], 0
jne 0x1106d1eb
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jne 0x1106d1eb
call fcn.111a3db0
test eax, eax
je 0x1106d1eb
mov eax, dword [0x1127b834]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push eax
push esi
push edi
push str.EnableAudioHook__d___d___gCount_d_n
call fcn.111bd7b0
add esp, 0x10
test edi, edi
je 0x1106d1c7
test esi, esi
jne 0x1106d1b4
push 0x1127b834
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x1106d1e9
push 1
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetEnum
call fcn.11069730
add esp, 8
pop edi
pop esi
pop ebp
ret
test esi, esi
jne 0x1106d1da
push 0x1127b834
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1106d1e9
push 0
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetEnum
call fcn.11069730
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x1106fe40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e1ddb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.DisableGeolocation
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x1106fefd
cmp dword [0x1127b1a4], eax
jne 0x1106fee4
push 0x28
call fcn.111709c0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x1106fec7
push 0
push 0
mov ecx, esi
call fcn.11170ad0
push 0
push 0
push 0
push 0
mov byte [esi + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
mov ecx, esi
jmp 0x1106fec9
xor ecx, ecx
push 0
push 1
push 0x1106ede0
mov dword [ebp - 4], 0xffffffff
mov dword [0x1127b1a4], ecx
call fcn.11170830
mov eax, dword [0x1127b1a4]
mov byte [eax + 0x20], 1
mov ecx, dword [0x1127b1a4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1107bff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111de660
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push str.Client32
call fcn.11123360
add esp, 4
push 0x11078be0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x11067910
call fcn.11123210
add esp, 4
mov dword [ebp - 4], 0
call fcn.110fe3d0
mov dword [0x1127aa10], eax
mov dword [0x1127aa44], esi
call fcn.111babb0
mov edx, str.CICWClass
test al, al
jne 0x1107c073
mov edx, 0x111fa894
mov ecx, 0x1127ac64
jmp 0x1107c080
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
test ax, ax
jne 0x1107c080
mov ecx, str.NSPowerShellWndClass
mov edx, 0x1127aca4
jmp 0x1107c0a0
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1107c0a0
mov eax, dword [0x1127aa44]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1107c0c0
sub eax, edx
sar eax, 1
jne 0x1107c0db
mov dword [0x1127aa44], 0x1124b64c
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x1127ad98
push 0
lea ecx, [ebp - 0x21c]
push 0
push ecx
call dword [sym.imp.MSVCR100.dll__wsplitpath]
add esp, 0x14
mov ecx, 0x1127ad98
mov edx, 0x1127ae98
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1107c114
mov esi, dword [sym.imp.MSVCR100.dll__wcsicmp]
push 0x1120c91c
push 0x1127ad98
call esi
add esp, 8
test eax, eax
je 0x1107c16f
push str.cicStudent
push 0x1127ad98
call esi
add esp, 8
test eax, eax
je 0x1107c16f
push str.dnarc
push 0x1127ad98
call esi
add esp, 8
test eax, eax
je 0x1107c16f
push 0xf0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x1127ad98
add eax, 0xfffffffe
jmp 0x1107c180
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1107c180
mov edx, dword [str..exe]
mov ecx, dword [0x1120c8f0]
mov dword [eax], edx
mov dx, word [0x1120c8f4]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
call fcn.1107b130
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8
Function at 0x1107c380
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111eb43b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
test esi, esi
je 0x1107c48b
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setae al
test al, al
je 0x1107c458
mov ecx, edi
call fcn.1107c2b0
test eax, eax
jne 0x1107c458
mov ecx, 0x111fa894
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1107c40d
test dx, dx
je 0x1107c409
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1107c40d
add eax, 4
add ecx, 4
test dx, dx
jne 0x1107c3e7
xor eax, eax
jmp 0x1107c412
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1107c41d
mov esi, str.NSMWClassVista
jmp 0x1107c458
mov ecx, str.CICWClass
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1107c44a
test dx, dx
je 0x1107c446
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1107c44a
add eax, 4
add ecx, 4
test dx, dx
jne 0x1107c424
xor eax, eax
jmp 0x1107c44f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1107c458
mov esi, str.CICWClassVista
push esi
call dword [sym.imp.MSVCR100.dll__wcsdup]
push 0x318
mov dword [edi + 4], eax
call fcn.111709c0
add esp, 8
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1107c487
push esi
mov ecx, eax
call fcn.11106be0
jmp 0x1107c489
xor eax, eax
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1107d130
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x30], eax
call fcn.110c2eb0
push eax
call fcn.11170a40
add esp, 4
mov ecx, edi
mov esi, eax
xor ebx, ebx
call fcn.110c2eb0
mov ecx, dword [ebp - 0x30]
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
sub eax, 0x18
push ecx
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x40], ecx
cmp eax, 0xffffffff
je 0x1107d26c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x34], eax
call fcn.11170a40
mov ecx, dword [ebp - 0x34]
add esp, 4
push ebx
lea edx, [ebp - 0x40]
push edx
mov edx, dword [ebp - 0x30]
push ecx
push eax
push edx
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x40], eax
jne 0x1107d26c
mov ecx, dword [ebp - 0x3c]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
or eax, 1
mov dword [esi], 0x40092
mov dword [esi + 4], eax
mov dword [esi + 0xc], ecx
lea ecx, [ecx]
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x3c]
mov edx, eax
sub edx, ebx
cmp edx, edi
ja 0x1107d206
mov edi, eax
sub edi, ebx
or dword [esi + 4], 2
mov eax, dword [ebp - 0x38]
add eax, ebx
push edi
push eax
lea eax, [esi + 0x14]
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], edi
call sub.MSVCR100.dll_memcpy
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov edx, dword [edx + 0x48]
add esp, 0xc
push 5
lea eax, [edi + 0x18]
push eax
push esi
call edx
add ebx, edi
cmp ebx, dword [ebp - 0x34]
jae 0x1107d23d
and dword [esi + 4], 0xfffffffe
jmp 0x1107d1f0
mov eax, dword [ebp - 0x38]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp - 0x30]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [edi]
mov edx, dword [edx + 0x48]
xor eax, eax
push 5
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
push 0x18
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
mov dword [ebp - 0x2c], 0x30092
call edx
mov eax, dword [ebp - 0x38]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp - 0x30]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1107d7a0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 9
xor esi, esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1107d7be
push 9
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
mov eax, dword [ebp + 8]
push 0
push esi
push eax
call fcn.111464f0
add esp, 0xc
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edi, dword [ebp + 0x10]
push eax
mov dword [edi], eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, dword [ebp + 0xc]
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x1107d7f3
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [edi]
mov edx, dword [ebx]
push ecx
push eax
push edx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x1107d910
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 6]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x1107d92e
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [edi + 6]
mov edx, dword [edi + 2]
push ecx
push edx
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 9
xor edi, edi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1107d965
push 9
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
push edi
push esi
call fcn.11146da0
add esp, 8
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x1107e0e0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 3
push 0
mov esi, ecx
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0
push str.unicodeText
push str.clip
call edx
mov eax, dword [ebp + 8]
inc dword [esi + 0x28]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
test edi, edi
jne 0x1107e126
dec dword [esi + 0x28]
push str.Error_Opening_Clip_n
call fcn.111bd7b0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret 4