joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11317f74
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x1131804b
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
lea eax, [ebp - 0x18]
pop edi
mov dword [ebp - 0x18], ebx
push edi
push 0xc
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], 8
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x11318054
cmp dword [ebp - 0x18], ebx
jbe 0x11318057
cmp dword [ebp - 0x18], ebx
jbe 0x11318057
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x11318008
mov eax, dword [ebp - 0xc]
test byte [eax + 1], 0x10
jne 0x11318011
add eax, 8
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1131801a
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x11317fd1
jmp 0x11318057
mov dword [ebp - 4], 3
jmp 0x11318057
mov dword [ebp - 4], 4
jmp 0x11318057
cmp dword [ebp + 0x10], 0x10000000
mov dword [ebp - 8], 1
jne 0x11318057
mov eax, dword [ebp - 0xc]
cmp byte [eax], bl
jne 0x1131803f
mov ecx, dword [eax + 4]
mov eax, 0x1f0000
and ecx, eax
cmp ecx, eax
je 0x11318057
mov dword [ebp - 4], 5
mov dword [ebp - 8], ebx
jmp 0x11318057
mov dword [ebp - 4], 1
jmp 0x11318057
mov dword [ebp - 4], edi
cmp dword [0x115a41e0], ebx
je 0x11318088
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push str.CKSecurity::IsInAcl_____Inner___ret:__d___myerror:__d___Acl:__08x___Sid:__08x___Mask:__08x___Index:__d_
push str.Security
push 0xffffffffffffffff
push 0x115a394c
call fcn.113a7c00
add esp, 0x28
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x11318987
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x113189cf
mov eax, dword [esi + 8]
cmp dword [eax - 8], edi
je 0x113189cf
call fcn.11407990
push dword [esi + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x113189cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x113189c3
push 1
pop edi
jmp 0x113189cf
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x11318ae4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x11318b00
push 1
pop eax
jmp 0x11318c30
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
push str.OAgentTray.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.11301db5
push eax
lea eax, [ebp - 0x208]
push 0x115674b0
push eax
call fcn.11364437
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x11318c20
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1156c514
push eax
call edi
push str.Stop
mov dword [esi + 0x14], eax
push dword [esi + 0xc]
call edi
push str.UserAutoLogin
mov dword [esi + 0x18], eax
push dword [esi + 0xc]
call edi
push str.UserLogin
mov dword [esi + 0x1c], eax
push dword [esi + 0xc]
call edi
push str.UserLogout
mov dword [esi + 0x20], eax
push dword [esi + 0xc]
call edi
push str.GetUserInfo
mov dword [esi + 0x24], eax
push dword [esi + 0xc]
call edi
push str.UserLogonEx
mov dword [esi + 0x28], eax
push dword [esi + 0xc]
call edi
push str.UserLogoutEx
mov dword [esi + 0x2c], eax
push dword [esi + 0xc]
call edi
push str.CancelCommitUser
mov dword [esi + 0x30], eax
push dword [esi + 0xc]
call edi
push str.ChangePwd
mov dword [esi + 0x34], eax
push dword [esi + 0xc]
call edi
push str.UserRegister
mov dword [esi + 0x38], eax
push dword [esi + 0xc]
call edi
cmp dword [esi + 0x14], ebx
mov dword [esi + 0x3c], eax
je 0x11318c20
cmp dword [esi + 0x18], ebx
je 0x11318c20
cmp dword [esi + 0x1c], ebx
je 0x11318c20
cmp dword [esi + 0x20], ebx
je 0x11318c20
cmp dword [esi + 0x24], ebx
je 0x11318c20
cmp dword [esi + 0x28], ebx
je 0x11318c20
cmp dword [esi + 0x2c], ebx
je 0x11318c20
cmp dword [esi + 0x30], ebx
je 0x11318c20
cmp dword [esi + 0x34], ebx
je 0x11318c20
cmp dword [esi + 0x38], ebx
je 0x11318c20
cmp eax, ebx
je 0x11318c20
mov dword [esi + 0x10], 1
cmp dword [esi + 0x10], ebx
pop edi
jne 0x11318c2d
mov ecx, esi
call fcn.11318c34
mov eax, dword [esi + 0x10]
pop esi
pop ebx
leave
ret
Function at 0x1131e1ee
Capabilities:
Set registry value

Disassembly:
mov eax, 0x115047b8
call fcn.11364418
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
test eax, 0x80000000
jne 0x1131e27b
mov dword [ebp - 0x10], edi
push 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.1131ec2d
cmp eax, edi
jne 0x1131e250
push esi
mov esi, str.SDFileAttribute_Shell_Extension
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push edi
push str.3FCEF010_09A4_11D4_8D3B_D12F9D3D8B02
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
pop esi
je 0x1131e269
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x1131e262
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x1131e287
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x1131e27b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push 0x115a0568
call fcn.113200fa
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x1131e294
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x115047cc
call fcn.11364418
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
test eax, 0x80000000
jne 0x1131e2fd
mov dword [ebp - 0x10], edi
push 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.1131ec2d
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
jne 0x1131e2ef
push str.3FCEF010_09A4_11D4_8D3B_D12F9D3D8B02
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], edi
je 0x1131e2ef
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x1131e2fd
push dword [ebp - 0x10]
call esi
push edi
push edi
push 0x115a0568
call fcn.11320285
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1131ef83
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
and dword [ebp - 8], 0
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x1131efd0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x1131efc9
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1131f095
xor esi, esi
jmp 0x1131f095
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1131eff6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x1131f006
xor esi, esi
jmp 0x1131f08c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x1131f018
jmp 0x1131efe3
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1131f08c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x1131f04b
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.11365ad0
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.113647e0
add esp, 0xc
and byte [edi + esi], 0
test edi, edi
jne 0x1131f053
xor ebx, ebx
jmp 0x1131f07e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.11365ad0
mov ebx, esp
push esi
push ebx
xor eax, eax
push 0xffffffffffffffff
push edi
push eax
push eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ebx
call fcn.1131f0a1
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1131f9eb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x11504a64
call fcn.11364418
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.1131ec2d
mov edi, eax
cmp edi, esi
je 0x1131fa39
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x1131fa32
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1131fade
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x1131faae
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.1131f9eb
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x1131fa97
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x1131fa5c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x1131faa9
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x1131fade
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1131fac1
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x1131fadc
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1131faef
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.11365ad0
push ebx
push esi
push edi
lea eax, [ebp - 0x4018]
mov edi, ecx
push eax
mov dword [ebp - 0x18], edi
call fcn.1131f1fd
xor esi, esi
cmp eax, esi
jl 0x1131fc72
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x4018]
push eax
call fcn.1131fc7f
pop ecx
test eax, eax
pop ecx
jne 0x1131fb3a
mov eax, 0x80020009
jmp 0x1131fc72
mov ecx, edi
call fcn.1131f1d4
lea eax, [ebp - 0x2018]
mov ecx, edi
push eax
call fcn.1131f1fd
cmp eax, esi
jl 0x1131fc72
movzx eax, word [ebp - 0xe]
sub eax, 8
je 0x1131fc37
sub eax, 9
je 0x1131fb97
dec eax
dec eax
jne 0x1131fc61
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x2018]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x1131fc52
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
jne 0x1131fbcf
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.11365ad0
mov edi, esp
push ebx
push esi
push edi
call fcn.11364b20
add esp, 0xc
cmp edi, esi
jne 0x1131fbd9
mov eax, 0x80004005
jmp 0x1131fc72
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jle 0x1131fc27
lea eax, [ebp - 0x2018]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + edi]
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
call fcn.1131fd06
pop ecx
add dword [ebp - 0xc], 2
mov ecx, dword [ebp - 4]
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x1131fbea
xor esi, esi
mov eax, dword [ebp + 8]
push ebx
push edi
push 3
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
jmp 0x1131fc5b
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2018]
push eax
push 1
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.1131f1fd
cmp eax, esi
jl 0x1131fc72
xor eax, eax
lea esp, [ebp - 0x4024]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x113225a1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x115051b8
call fcn.11364418
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x25c], ebx
je 0x11322706
lea eax, [esi + 0x250]
mov edi, 0x115a0630
push ebx
push eax
mov ecx, edi
call fcn.11325d1b
mov ecx, dword [esi + 0x1f8]
lea eax, [esi + 0x258]
push eax
lea eax, [esi + 0x254]
push eax
lea eax, [esi + 0x250]
push eax
push ecx
mov ecx, edi
mov dword [esi + 0x25c], ebx
call fcn.11325edc
mov edi, eax
cmp edi, ebx
jne 0x11322611
push ebx
mov ecx, esi
call fcn.113210ce
jmp 0x11322706
cmp edi, 4
je 0x1132261b
cmp edi, 3
jne 0x1132265e
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.113aaae0
pop ecx
pop ecx
push dword [esi + 0x1f8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x11322646
test al, 1
je 0x11322646
mov edi, 0xf000000a
jmp 0x1132265e
cmp dword [ebp - 0x10], 5
jne 0x11322653
mov edi, 0xf000000b
jmp 0x1132265e
cmp dword [ebp - 0x10], 0x20
jne 0x1132265e
mov edi, 0xf000000c
mov eax, dword [0x1157c63c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
push 0x411
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.114f0d3f
push 0x4a0
lea ecx, [ebp - 0x14]
call fcn.114f0d3f
lea eax, [ebp - 0x10]
push edi
push eax
mov ecx, esi
call fcn.11322c95
push dword [eax]
mov esi, dword [esi + 0x1f8]
mov byte [ebp - 4], 3
push esi
call fcn.11397360
pop ecx
push eax
lea eax, [ebp - 0x1c]
push dword [ebp - 0x14]
push str._s___s__s__
push eax
call fcn.114e2e9b
add esp, 0x14
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1137e380
push 0x11010
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.114e9faf
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.114e9faf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.114e9faf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x11337bf6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, ecx
call ebx
cmp dword [0x115a41e0], 0
mov dword [ebp - 4], eax
mov edi, 0x115a394c
je 0x11337c2e
push eax
push str.CreateSearchRegionsObject_start__d_
push str.SearchObjTime
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x14
lea edx, [esi + 0x90]
lea eax, [esi + 0x80]
push edx
push eax
lea eax, [esi + 0x6c]
lea ecx, [esi + 0x5c]
push eax
lea eax, [esi + 0x48]
push ecx
push eax
lea eax, [esi + 0x38]
mov ecx, esi
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 4]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.11337585
cmp dword [0x115a41e0], 0
je 0x11337d57
call ebx
sub eax, dword [ebp - 4]
push eax
push str.CreateSearchRegionsObject_end_usingt_time__d_
push str.SearchObjTime
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x14
cmp dword [0x115a41e0], 0
je 0x11337d57
and dword [ebp + 0x24], 0
cmp dword [esi + 0x2c], 0
mov ebx, str.SearchObj
jle 0x11337d04
cmp dword [0x115a41e0], 0
je 0x11337cf9
mov eax, dword [ebp + 0x24]
mov ecx, dword [esi + 0x38]
shl eax, 2
push dword [ecx + eax]
mov ecx, dword [esi + 0x4c]
push dword [ecx + eax]
mov ecx, dword [esi + 0x14]
push dword [eax + ecx]
mov ecx, dword [esi + 4]
push dword [ecx + eax]
mov ecx, dword [esi + 0x28]
push dword [ecx + eax]
push str.CreateSearchRegionsObject_UserID__d__AliasName__s__UserName__s__UserPGroupID__d__UserPGroupName__s_
push ebx
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x24
inc dword [ebp + 0x24]
mov eax, dword [ebp + 0x24]
cmp eax, dword [esi + 0x2c]
jl 0x11337cbb
and dword [ebp + 0x24], 0
cmp dword [esi + 0x74], 0
jle 0x11337d57
cmp dword [0x115a41e0], 0
je 0x11337d4c
mov eax, dword [ebp + 0x24]
mov ecx, dword [esi + 0x80]
shl eax, 2
push dword [ecx + eax]
mov ecx, dword [esi + 0x94]
push dword [ecx + eax]
mov ecx, dword [esi + 0x5c]
push dword [eax + ecx]
mov ecx, dword [esi + 0x70]
push dword [ecx + eax]
push str.CreateSearchRegionsObject_GuUserID__d__GuAliasName__s__GuPGroupID__d__GuPGroupName__s_
push ebx
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x20
inc dword [ebp + 0x24]
mov eax, dword [ebp + 0x24]
cmp eax, dword [esi + 0x74]
jl 0x11337d0e
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x11337d5e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp dword [eax + 8], ebx
push edi
mov esi, ecx
jne 0x11337d9e
cmp dword [0x115a41e0], ebx
je 0x11337d92
push str.CreateBrowseRegionsObject_arrBrowsehObj_IsEmpty_
push str.SearchObj
push 0xffffffffffffffff
push 0x115a394c
call fcn.113a7c00
add esp, 0x10
mov ecx, esi
call fcn.11336e49
jmp 0x11337f2c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x115a41e0], ebx
mov dword [ebp - 4], eax
mov edi, 0x115a394c
je 0x11337dca
push eax
push str.CreateSearchRegionsObject_start__d_
push str.SearchObjTime
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x14
lea ebx, [esi + 0x1b4]
lea eax, [esi + 0x1a4]
push ebx
push eax
lea eax, [esi + 0x190]
lea ecx, [esi + 0x180]
push eax
lea eax, [esi + 0x16c]
push ecx
lea edx, [esi + 0x15c]
push eax
lea eax, [esi + 0x148]
push edx
push eax
lea eax, [esi + 0x138]
mov ecx, esi
push eax
lea eax, [esi + 0x128]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.11337585
xor ebx, ebx
cmp dword [0x115a41e0], ebx
je 0x11337f2c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
push eax
push str.CreateSearchRegionsObject_end_usingt_time__d_
push str.SearchObjTime
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x14
cmp dword [0x115a41e0], ebx
je 0x11337f2c
cmp dword [esi + 0x150], 0
mov dword [ebp + 8], ebx
mov ebx, str.SearchObj
jle 0x11337ecd
cmp dword [0x115a41e0], 0
je 0x11337ebf
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x15c]
shl eax, 2
push dword [ecx + eax]
mov ecx, dword [esi + 0x170]
push dword [ecx + eax]
mov ecx, dword [esi + 0x138]
push dword [eax + ecx]
mov ecx, dword [esi + 0x128]
push dword [ecx + eax]
mov ecx, dword [esi + 0x14c]
push dword [ecx + eax]
push str.CreateBrowseRegionsObject_UserID__d__AliasName__s__UserName__s__UserPGroupID__d__UserPGroupName__s_
push ebx
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x24
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x150]
jl 0x11337e72
and dword [ebp + 8], 0
cmp dword [esi + 0x198], 0
jle 0x11337f2c
cmp dword [0x115a41e0], 0
je 0x11337f1e
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x1a4]
shl eax, 2
push dword [ecx + eax]
mov ecx, dword [esi + 0x1b8]
push dword [ecx + eax]
mov ecx, dword [esi + 0x180]
push dword [eax + ecx]
mov ecx, dword [esi + 0x194]
push dword [ecx + eax]
push str.CreateBrowseRegionsObject_GuUserID__d__GuAliasName__s__GuPGroupID__d__GuPGroupName__s_
push ebx
push 0xffffffffffffffff
push edi
call fcn.113a7c00
add esp, 0x20
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x198]
jl 0x11337eda
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x1133ea24
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x11507a6b
call fcn.11364418
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.114fe591
mov ecx, dword [eax + 4]
call fcn.114eef76
mov edi, dword [ebp + 0x1c]
and dword [ebp - 4], 0
test edi, edi
mov dword [esi + 0x14], 2
je 0x1133ea57
mov dword [esi + 0x34], edi
mov eax, dword [ebp + 0x14]
push dword [esi + 0x38]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push pe_nt_image_headers32
call fcn.114ef26e
pop ecx
mov dword [ebp + 0x1c], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x1133ea8d
push edi
push esi
mov ecx, eax
call fcn.1133e24d
jmp 0x1133ea8f
xor eax, eax
push dword [ebp + 0xc]
and byte [ebp - 4], 0
lea ecx, [eax + 0xec]
mov dword [esi + 0x30], eax
call fcn.114ea146
push dword [esi + 4]
mov ecx, dword [esi + 0x30]
call fcn.1133e73e
mov eax, dword [esi + 8]
test eax, eax
jbe 0x1133eabf
mov ecx, dword [esi + 0x30]
push eax
call fcn.1133e74d
mov eax, dword [ebp + 0x10]
or edi, 0xffffffff
cmp eax, edi
mov dword [ebp + 0x1c], 1
je 0x1133ead5
sub eax, dword [esi + 0x10]
mov edi, eax
push 0x34
call fcn.114ef26e
pop ecx
mov dword [ebp + 0x14], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x1133eaf6
push edi
mov ecx, eax
push dword [ebp + 8]
push esi
call fcn.1133e0b0
jmp 0x1133eaf8
xor eax, eax
and byte [ebp - 4], 0
push ebx
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov dword [ebp + 0x14], eax
push 5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1133eb95
and dword [ebp - 0x28], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
push 1
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x28]
push edi
push eax
call ebx
test eax, eax
je 0x1133eb58
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
jmp 0x1133eb33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x10]
jb 0x1133eb0f
mov ecx, dword [esi + 0x2c]
call fcn.1138f5a0
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
call dword [eax + 0xb8]
cmp eax, 2
mov dword [ebp + 0x1c], eax
jne 0x1133eb95
mov ecx, dword [esi + 0x2c]
call fcn.1138f740
cmp eax, 2
jne 0x1133eb95
mov dword [ebp + 0x1c], 3
mov ecx, dword [esi + 0x2c]
pop ebx
test ecx, ecx
je 0x1133eba3
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x30]
and dword [esi + 0x2c], 0
test ecx, ecx
je 0x1133ebb5
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi + 0x30], 0
or dword [ebp - 4], 0xffffffff
call fcn.114fe591
mov ecx, dword [eax + 4]
call fcn.114eef8b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18