joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11199410
Capabilities:
Continue service
Pause service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x11199457
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1119944e
push 0x112619ec
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push ecx
call sub.MSVCR100.dll__CxxThrowException
mov dword [ebp - 0x24], 1
jmp 0x111994ca
cmp eax, 2
jne 0x1119947c
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x111994c3
push 0x112619ec
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], eax
call sub.MSVCR100.dll__CxxThrowException
cmp eax, 3
jne 0x1119949b
lea eax, [ebp - 0x20]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x11199439
mov dword [ebp - 0x24], 7
jmp 0x111994ca
cmp eax, 4
jne 0x1119954a
lea edx, [ebp - 0x20]
push edx
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x111994c3
mov dword [ebp - 0x24], eax
push 0x112619ec
lea eax, [ebp - 0x24]
push eax
jmp 0x11199449
mov dword [ebp - 0x24], 4
push esi
lea ecx, [ebp - 0x20]
push ecx
push edi
mov esi, 0x64
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x111994f4
push 0x112619ec
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
jmp 0x11199449
mov ecx, dword [ebp - 8]
push ebx
test ecx, ecx
je 0x1119950c
mov eax, 0x51eb851f
mul ecx
mov esi, edx
shr esi, 4
test esi, esi
je 0x11199530
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x111994df
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], ecx
je 0x11199548
push 0x64
call ebx
dec esi
jne 0x11199512
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], eax
je 0x11199548
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x11199439
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x111998f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.MSVCR100.dll_wcschr]
push edi
lea eax, [ebx + 2]
push 0x5c
push eax
call esi
add esp, 8
test eax, eax
je 0x111999c7
add eax, 2
push 0x5c
push eax
call esi
mov edi, eax
add esp, 8
test edi, edi
je 0x111999c7
movzx ecx, word [edi]
xor edx, edx
mov word [edi], dx
mov eax, dword [0x1123a2d8]
push 0x202
push edx
mov dword [ebp - 0x418], ecx
mov cx, word [0x1123a2dc]
lea edx, [ebp - 0x206]
push edx
mov dword [ebp - 0x20c], eax
mov word [ebp - 0x208], cx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, 0x41
push 0x104
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
xor eax, eax
push edx
mov word [ebp - 0x20c], si
mov word [ebp - 0x414], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x111999b6
lea eax, [ebp - 0x414]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x111999dc
inc esi
cmp si, 0x5a
jb 0x11199974
mov dx, word [ebp - 0x418]
mov word [edi], dx
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_wcscat_s]
push 0x11203288
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call esi
add edi, 2
push edi
lea edx, [ebp - 0x20c]
push 0x104
push edx
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push ecx
push ebx
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov ecx, dword [ebp - 4]
add esp, 0x24
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x1119b620
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ac], eax
mov eax, dword [0x1127f654]
push esi
or esi, 0xffffffff
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], esi
test eax, eax
jne 0x1119b671
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1127f654], eax
test eax, eax
je 0x1119b755
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push edi
push str.WSAStartup
push eax
call esi
mov ecx, dword [0x1127f654]
push str.WSACleanup
push ecx
mov edi, eax
call esi
mov edx, dword [0x1127f654]
push str.socket
push edx
mov dword [ebp - 0x1a4], eax
call esi
mov ebx, eax
mov eax, dword [0x1127f654]
push str.closesocket
push eax
call esi
mov ecx, dword [0x1127f654]
push str.WSAIoctl
push ecx
mov dword [ebp - 0x1a8], eax
call esi
lea edx, [ebp - 0x194]
push edx
push 2
mov dword [ebp - 0x1a0], eax
call edi
test eax, eax
jne 0x1119b73e
push eax
push 2
push 2
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1119b738
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1ac]
push 0
push 0
lea eax, [ebp - 0x19c]
push eax
push ecx
push edx
push 0
push 0
push 0x4004747f
push esi
call dword [ebp - 0x1a0]
test eax, eax
jne 0x1119b731
mov ecx, dword [ebp - 0x19c]
mov eax, 0xaf286bcb
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 6
mov dword [ebp - 0x198], ecx
push esi
call dword [ebp - 0x1a8]
call dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x198]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x1119c8c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push str.snmpapi.dll
mov dword [ebp - 0x328], eax
call ebx
mov edi, eax
mov dword [ebp - 0x32c], edi
test edi, edi
jne 0x1119c907
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SnmpUtilOidCpy
push edi
call esi
push str.SnmpUtilOidNCmp
push edi
mov dword [0x11285ddc], eax
call esi
push str.SnmpUtilVarBindFree
push edi
mov dword [0x11285dd4], eax
call esi
cmp dword [0x11285ddc], 0
mov dword [0x11285dcc], eax
je 0x1119ca8a
cmp dword [0x11285dd4], 0
je 0x1119ca8a
test eax, eax
je 0x1119ca8a
push str.INETMIB1.DLL
call ebx
mov ebx, eax
mov dword [ebp - 0x330], ebx
test ebx, ebx
je 0x1119ca8a
push str.SnmpExtensionInit
push ebx
call esi
push str.SnmpExtensionQuery
push ebx
mov dword [0x11285dd0], eax
call esi
cmp dword [0x11285dd0], 0
mov dword [0x11285dd8], eax
je 0x1119ca6b
test eax, eax
je 0x1119ca6b
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [0x11285dd0]
lea ebx, [ebp - 0x324]
call fcn.1119c6f0
lea ebx, [ebp - 0x194]
mov edi, eax
call fcn.1119c7d0
mov eax, dword [ebp - 0x328]
push 8
push edi
mov dword [eax], edi
call dword [sym.imp.MSVCR100.dll_calloc]
mov ebx, eax
add esp, 8
mov esi, ebx
test ebx, ebx
jne 0x1119ca03
push 0x15f
push str...CTL32_tcputil.c
push str.result
call fcn.11067750
add esp, 0xc
xor ecx, ecx
test edi, edi
jle 0x1119ca40
lea esp, [esp]
mov eax, dword [ebp + ecx*4 - 0x324]
mov edx, dword [ebp + ecx*4 - 0x194]
mov dword [esi], eax
mov dword [esi + 4], edx
cmp eax, 0x7f000001
je 0x1119ca33
test eax, eax
je 0x1119ca33
add esi, 8
jmp 0x1119ca3b
mov eax, dword [ebp - 0x328]
dec dword [eax]
inc ecx
cmp ecx, edi
jl 0x1119ca10
mov eax, dword [ebp - 0x330]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov ecx, dword [ebp - 0x32c]
push ecx
call esi
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
push edi
call esi
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x1119e260
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
mov dword [ebp - 0x18], eax
cmp ebx, 0x200
jne 0x1119e350
mov eax, dword [esi + 0xbc]
cmp eax, 1
je 0x1119e2b1
cmp eax, 2
jne 0x1119e350
push 0x11
call edi
test ax, ax
js 0x1119e350
cmp dword [esi + 0xc], 0
jne 0x1119e2ce
push 0x171
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 0x14]
push 0x1e
mov ebx, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
lea eax, [eax + eax*2]
cmp dword [ebp - 0x14], eax
jne 0x1119e302
sub ebx, eax
sub ebx, edi
mov eax, ebx
cmp dword [esi + 0xc], 0
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ebx, eax
jne 0x1119e327
push 0x165
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov eax, dword [esi + 0xc]
push 0x11
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x1119e368
cmp eax, 2
jne 0x1119e388
push 0x11
call edi
test ax, ax
jns 0x1119e388
cmp ebx, 0x84
jne 0x1119e388
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x113
jne 0x1119e447
mov ecx, dword [esi + 0xc]
push 0x429
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [esi + 0xc], 0
mov edi, eax
jne 0x1119e3c2
push 0x1e0
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov edx, dword [esi + 0xc]
push 1
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1119e40e
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xc], 0
jne 0x1119e3ff
push 0x1dd
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov eax, dword [esi + 0xc]
push 0
push 0x1f4
push 1
push eax
jmp 0x1119e441
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xc], 0
jne 0x1119e434
push 0x1dd
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov ecx, dword [esi + 0xc]
push 0
push 0x2ee
push 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
push edx
push eax
push ebx
push ecx
mov ecx, esi
call fcn.111d6c50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1119efb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov esi, ecx
call fcn.1113a880
push 0
call fcn.111ba880
add esp, 4
test al, al
je 0x1119efec
push 0
push 3
push 1
mov ecx, esi
call fcn.11136c50
cmp dword [0x1127abec], 0
je 0x1119f06e
mov eax, dword [esi + 0xc]
push 0x43b
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [0x1127abf8]
push ecx
mov ebx, eax
call fcn.111bd190
mov edi, eax
push 0x3a
push edi
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 0xc
test eax, eax
je 0x1119f029
xor edx, edx
mov word [eax], dx
mov ecx, dword [0x1127aa68]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0
push 0x100
lea edx, [ebp - 0x104]
push edx
push str.Modem
push str.Bridge
call eax
lea ecx, [ebp - 0x104]
push ecx
push edi
call fcn.111b8750
push eax
push ebx
call fcn.110640e0
add esp, 0x10
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0xc]
push 0x41d
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
mov dword [ebp - 0x10c], esi
test esi, esi
jne 0x1119f0a0
push 0x1443
push str.UI.CPP
push str.hListbox
call fcn.11067750
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push 1
push 0x192
push esi
mov dword [ebp - 0x110], 0x32
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x1127ab0c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ebx, eax
movzx esi, byte [ebx]
test esi, esi
je 0x1119f18d
lea esp, [esp]
push 0
inc ebx
push esi
mov dword [ebp - 0x108], ebx
call fcn.111bd190
add esp, 4
push eax
call fcn.111b7990
mov ecx, dword [0x1127ab0c]
mov edx, dword [ecx]
add esp, 8
mov edi, eax
mov eax, dword [edx + 0xc]
push esi
call eax
mov esi, eax
mov edx, 0x1122272c
test esi, esi
je 0x1119f164
cmp word [esi], 0
je 0x1119f164
lea esp, [esp]
push esi
push edx
push edi
push str._s_s_s
call fcn.111be4a0
push edi
mov ebx, eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, esi
mov edi, ebx
add esp, 0x14
mov edx, 0x111f9564
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1119f144
sub eax, ebx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x1119f120
mov ebx, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x10c]
push edi
push 0
push 0x180
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
movzx esi, byte [ebx]
add esp, 4
test esi, esi
jne 0x1119f0e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret 4
Function at 0x111a2a10
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [0x1127ac44]
mov esi, ecx
test eax, eax
je 0x111a2a40
test ecx, ecx
jne 0x111a2a4e
mov dword [0x1127ac44], 1
jmp 0x111a2a4e
test ecx, ecx
je 0x111a2a4e
mov dword [0x1127ac44], 0
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.DisableRunplugin
push str.Client
call fcn.110bbc00
test eax, eax
jne 0x111a2ad4
mov eax, dword [0x1127ac44]
cmp esi, eax
je 0x111a2aad
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 4], 0
mov dword [0x1127f7e4], 0
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push str.Check9xLogon_____bLoggedIn:__u__send_command__d_to_connections_n
mov dword [ebp - 8], ecx
call fcn.111bd7b0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x111a29a0
jmp 0x111a2ac4
test eax, eax
je 0x111a2ad4
cmp dword [0x1127ad00], 0
jne 0x111a2ad4
push 0x1127f7e4
push 0x111a29f0
mov ecx, dword [0x1127ab0c]
push 0xd0
call fcn.110ca780
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x111a2d80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1127f6c0], 0
jne 0x111a2dcb
mov ecx, dword [0x1127aa68]
push 0
push 1
push str.AutoICFConfig
push str.Client
call fcn.110bbc00
test eax, eax
je 0x111a2dcb
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x111a2bd0
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x111a3db0
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1127f7f0], 0
jne 0x111a3f12
call fcn.111b8710
cmp eax, 0x14
jl 0x111a3df7
mov eax, 1
mov dword [0x1127f7ec], eax
mov dword [0x1127f7f0], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
call fcn.111babb0
test al, al
mov eax, str.CICPlugin.exe
jne 0x111a3e0a
mov eax, str.runplugin.exe
push esi
push eax
push 0
call fcn.111bb510
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push 0x111fb8fc
push eax
call esi
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.111be4e0
add esp, 0x18
test eax, eax
je 0x111a3eb7
mov dword [0x1127f7ec], 1
call fcn.11123260
test eax, eax
jne 0x111a3ef4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push edi
call esi
lea edx, [ebp - 0x414]
push edx
push 0
push 0
push 0x2b
push 0
mov edi, eax
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
mov ebx, eax
call esi
sub eax, edi
cmp eax, 0x64
jb 0x111a3e91
push eax
push str.Warning._SHGetFolderPath_took__d_ms_r_n
call fcn.111bd7b0
add esp, 8
pop edi
test ebx, ebx
pop ebx
js 0x111a3ef4
lea eax, [ebp - 0x414]
push eax
push str.CommonPath
push str.SoftwareNSL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.11143df0
add esp, 0x10
jmp 0x111a3ef4
push str.schplayer.exe
push 0
call fcn.111bb510
add esp, 4
push eax
lea ecx, [ebp - 0x20c]
push 0x111fb8fc
push ecx
call esi
lea edx, [ebp - 0x20c]
push 0
push edx
call fcn.111be4e0
add esp, 0x18
test eax, eax
je 0x111a3ef4
mov dword [0x1127f7ec], 1
mov eax, dword [0x1127f7ec]
push eax
push str.HasStudentComponents_d_n
call fcn.111bd7b0
add esp, 8
mov dword [0x1127f7f0], 1
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x1127f7ec]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x111a5250
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x1127f6ac], 0
jne 0x111a5358
cmp byte [0x1127f81c], 0
jne 0x111a5358
cmp dword [0x1127f818], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x111a5281
call esi
mov dword [0x1127f818], eax
call esi
mov esi, eax
sub eax, dword [0x1127f818]
cmp eax, 0x493e0
jae 0x111a533c
mov ecx, dword [0x1127aa68]
push 0
push 0
push 0x1120cc50
push str.Client
call fcn.110bbc00
test eax, eax
je 0x111a5350
push 2
push 1
push 5
call fcn.111bb9f0
add esp, 0xc
test eax, eax
je 0x111a5350
cmp dword [0x1127acfc], 0
jne 0x111a5350
cmp dword [0x1127ad10], 0
jne 0x111a5350
cmp dword [0x1127f814], 0
je 0x111a5300
mov ecx, dword [0x1127ac60]
test ecx, ecx
je 0x111a5300
call fcn.110b6a20
test eax, eax
mov eax, 0x7d0
jne 0x111a5305
mov eax, 0x4e20
mov ecx, dword [0x1127f814]
test ecx, ecx
je 0x111a5317
mov edx, esi
sub edx, ecx
cmp edx, eax
jb 0x111a5357
mov dword [0x1127f814], esi
call fcn.111a2d80
test eax, eax
jne 0x111a5357
push str.DoICFConfig___OK_n
call fcn.111bd7b0
add esp, 4
mov byte [0x1127f6ac], 1
pop esi
ret
push str.DesktopTimerProc___Further_ICF_config_checking_will_not_be_performed_n
call fcn.111bd7b0
mov byte [0x1127f81c], 1
add esp, 4
mov byte [0x1127f6ac], 1
pop esi
ret
Function at 0x111a5fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.UnresponsiveTime
push str._debug
call fcn.110bbc00
test eax, eax
je 0x111a6011
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x111a5e90
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x111a9ce0
Capabilities:
Hide graphical window
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetWindowBand
push str.user32.dll
mov esi, ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [ebp - 8], 0xffffffff
test eax, eax
je 0x111a9d1b
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 8]
push ecx
push edx
call eax
push str.GetWindowDisplayAffinity
push str.user32.dll
call edi
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x111a9d3f
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 4]
push ecx
push edx
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
push str.Showing_blankwnd_cmd_d__band_d__affinity_d_n
call fcn.111bd7b0
add esp, 0x10
cmp dword [ebp - 4], 0x11
je 0x111a9d93
push str.SetWindowDisplayAffinity
push str.user32.dll
call edi
push eax
call ebx
test eax, eax
je 0x111a9d93
mov ecx, dword [esi + 0xc]
push 0x11
push ecx
call eax
test eax, eax
jne 0x111a9d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push str.setaffinity_ret__d__gle_d_n
call fcn.111bd7b0
add esp, 0xc
mov edx, dword [esi + 0xc]
push edx
xor edi, edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x111a9e2c
cmp dword [ebp + 8], edi
jne 0x111a9ed9
push str.Hiding_blankwnd_n
call fcn.111bd7b0
add esp, 4
cmp dword [esi + 0x1d4], edi
jne 0x111a9dd9
mov eax, dword [esi + 0x1d0]
push str.DwmEnableComposition
push eax
call ebx
mov dword [esi + 0x1d4], eax
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x111a9de7
push 1
call eax
mov ecx, dword [esi + 0xc]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xc], 0
mov edi, eax
jne 0x111a9e12
push 0x1e0
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov edx, dword [esi + 0xc]
push 0x81
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], edi
je 0x111a9ed9
push str.Showng_blankwnd_n
call fcn.111bd7b0
add esp, 4
mov ecx, esi
call fcn.111a32e0
mov eax, dword [esi + 0xc]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xc], 0
mov edi, eax
jne 0x111a9e74
push 0x139
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x1d4], 0
jne 0x111a9e9b
mov edx, dword [esi + 0x1d0]
push str.DwmEnableComposition
push edx
call ebx
mov dword [esi + 0x1d4], eax
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x111a9ea9
push 0
call eax
cmp dword [esi + 0xc], 0
jne 0x111a9ec6
push 0x1dd
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov eax, dword [esi + 0xc]
push 0
push 0x14
push 0x81
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x111ab370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x111ab3da
push str.create_focus_handler_n
call fcn.111bd7b0
add esp, 4
cmp byte [0x1127f834], 0
jne 0x111ab450
cmp dword [0x1127aa48], 0x160003
mov byte [0x1127f834], 1
jl 0x111ab450
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x111ab130
push 0
push 0
mov dword [0x1127f830], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1127f82c], eax
pop ebp
ret
cmp byte [0x1127f834], 0
je 0x111ab450
push esi
push str.stop_focus_n
mov byte [0x1127f834], 0
call fcn.111bd7b0
mov edx, dword [0x1127f830]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x1127f82c]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.stopped_n
call fcn.111bd7b0
mov ecx, dword [0x1127f82c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push ecx
call esi
mov edx, dword [0x1127f830]
push edx
mov dword [0x1127f82c], 0
call esi
mov dword [0x1127f830], 0
pop esi
pop ebp
ret