Function at 0x11149950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e7510
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
cmp dword [0x1127acfc], edi
je 0x111499a1
mov ecx, dword [0x1127ab0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x64]
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x1127aa48], 0x120003
jl 0x11149b25
mov ecx, dword [0x1127aa68]
push edi
push edi
push str.DisableSendSAS
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x11149abc
push str.sas.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x11149abc
push str.SendSAS
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x11149aad
lea ecx, [ebp - 0x10]
call fcn.11143200
push edi
push edi
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.11143640
cmp eax, edi
jne 0x11149a9e
lea eax, [ebp - 0x14]
push eax
push str.SoftwareSASGeneration
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.11143790
mov edi, eax
mov eax, dword [ebp - 0x14]
test al, 1
jne 0x11149a67
push eax
push str.SoftwareSASGeneration
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push str.Set__HKLM_s__s1__from__d__n
call fcn.111bd7b0
add esp, 0x10
push 1
push str.SoftwareSASGeneration
lea ecx, [ebp - 0x10]
call fcn.11143a80
push str.SendSAS___n
call fcn.111bd7b0
add esp, 4
push 0
call esi
mov eax, dword [ebp - 0x14]
test al, 1
jne 0x11149a9e
lea ecx, [ebp - 0x10]
cmp edi, 2
jne 0x11149a93
push str.SoftwareSASGeneration
call fcn.11143bc0
jmp 0x11149a9e
push eax
push str.SoftwareSASGeneration
call fcn.11143a80
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.11143c00
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x11149b92
lea ecx, [ebp - 0x14]
call fcn.11113780
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.111137a0
test al, al
jne 0x11149ae4
push str.Error._CtrlAltDel_code_cannot_init_kbfilter_n
call fcn.111bd7b0
add esp, 4
lea ecx, [ebp - 0x14]
call fcn.11113ab0
test al, al
jne 0x11149af7
push str.Error._CtrlAltDel_not_generated_n
jmp 0x11149afc
push str.CtrlAltDel_generated_using_kbFilter_n
call fcn.111bd7b0
add esp, 4
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.11113790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xd0]
push 2
call eax
mov ecx, dword [0x1127aa68]
push edi
push edi
push str.NoGinaCAD
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x11149b69
push str.nsm_gina_sas
push edi
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, edi
je 0x11149b69
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x11149b8b
lea ecx, [ebp - 0x18]
push ecx
push edi
push edi
push 0x111498d0
push 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret