joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11018460
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117ee4b
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 2
push 6
mov dword [ebp - 0x138], eax
call fcn.11145c70
add esp, 0xc
test eax, eax
je 0x1101866a
call fcn.110183b0
test al, al
je 0x1101866a
push 0
push 0x1119809c
call dword [sym.imp.uSEr32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x1101865d
lea ecx, [ebp - 0x124]
push ecx
push esi
call dword [sym.imp.uSEr32.dll_GetWindowRect]
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
push edx
mov edx, dword [ebp - 0x124]
push eax
push ecx
push edx
push 0x111982cc
call fcn.11147060
mov ebx, dword [sym.imp.uSEr32.dll_GetWindowLongA]
add esp, 0x14
push 0xfffffffffffffff0
push esi
call ebx
push 0xffffffffffffffec
push esi
mov edi, eax
call ebx
test edi, 0x10000000
je 0x1101852e
test edi, 0x8000000
je 0x1101866a
push 0x104
lea ecx, [ebp - 0x134]
mov byte [ebp - 0x114], 0
call fcn.110cfe80
lea eax, [ebp - 0x134]
push eax
push 0x11195264
push 0x1119828c
push reloc.wsOcK32.dll_bind
mov dword [ebp - 4], 0
call fcn.110edbe0
mov edx, dword [ebp - 0x134]
mov eax, dword [edx]
add esp, 0x10
lea ecx, [ebp - 0x134]
call eax
test al, al
jne 0x11018595
push 0x255
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov ecx, dword [ebp - 0x128]
cmp byte [ecx], 0
je 0x110185c0
push 0x104
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x134]
call fcn.110094d0
push eax
call dword [sym.imp.KeRneL32.DLl_ExpandEnvironmentStringsA]
jmp 0x110185d4
mov ecx, 0xf
mov esi, 0x1119824c
lea edi, [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x138]
test eax, eax
je 0x11018627
cmp dword [ebp + 0xc], 0x104
jge 0x110185fb
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
jmp 0x1101866a
lea ecx, [ebp - 0x114]
push ecx
push 0x11198248
push eax
call dword [sym.imp.uSEr32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
mov al, 1
jmp 0x1101866c
push 1
push 0
push 0
lea edx, [ebp - 0x114]
push edx
push 0x11198240
push 0
call dword [sym.imp.ShELL32.dll_ShellExecuteA]
cmp eax, 0x20
lea ecx, [ebp - 0x134]
setg bl
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
mov al, bl
jmp 0x1101866c
push 0x11198228
call fcn.11147060
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x1101cd70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 1
push 3
push 0
push 1
push bind
push edi
mov dword [ebp - 8], ecx
call dword [sym.imp.KeRneL32.DLl_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1101cdc4
push edi
call fcn.110efec0
add esp, 4
test eax, eax
jne 0x1101cdce
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push 0x30
push 0x83a
push eax
call edx
add esp, 0xc
push esi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
mov dword [ebp + 8], 0
cmp eax, 3
jne 0x1101ce37
push 0x11198dd8
call dword [sym.imp.KeRneL32.DLl_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x1101ce13
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push 0x30
push 0x83b
push eax
call edx
add esp, 0xc
push esi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11198dc0
push ebx
call dword [sym.imp.KeRneL32.DLl_GetProcAddress]
test eax, eax
je 0x1101ce01
push edi
call eax
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1101ce01
push ebx
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
push 0
push esi
call dword [sym.imp.KeRneL32.DLl_GetFileSize]
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KeRneL32.DLl_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KeRneL32.DLl_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KeRneL32.DLl_ReadFile]
push ebx
call dword [sym.imp.KeRneL32.DLl_GlobalUnlock]
push esi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
lea edx, [ebp - 4]
push edx
push 1
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.OLE32.dlL_CreateStreamOnHGlobal]
test eax, eax
jne 0x1101cef5
mov esi, dword [ebp - 8]
add esi, 0x1c
mov ecx, esi
call fcn.110cfbe0
mov eax, dword [ebp - 4]
push esi
push 0x111c1acc
push 0
push edi
push eax
call dword [sym.imp.OLeAuT32.dLL_OleCreatePictureIndirect]
test eax, eax
je 0x1101cf00
cmp dword [ebp + 8], 0
je 0x1101cee0
call fcn.110f0060
mov ecx, dword [ebp + 8]
push 1
mov edi, eax
push edi
push ecx
mov ecx, esi
call fcn.110cfc10
push edi
mov esi, eax
call dword [sym.imp.Gdi32.Dll_DeleteObject]
test esi, esi
jne 0x1101cf00
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
push 0x30
push 0x8bc
push eax
mov eax, dword [edx + 4]
call eax
add esp, 0xc
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KeRneL32.DLl_GlobalFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1101cf16
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1101fa00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117f56b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x70]
mov dword [ebp - 0x270], eax
call fcn.1101e540
mov esi, eax
mov dword [ebp - 0x268], esi
push esi
mov dword [ebp - 4], 0
call fcn.1101e580
add esp, 4
test esi, esi
je 0x1101fbf8
cmp byte [esi], 0
je 0x1101fbf8
push 0x64
lea ecx, [ebp - 0x2d4]
push 0
push ecx
call fcn.11162be0
mov edx, dword [edi + 8]
lea eax, [ebp - 0x264]
push 3
mov dword [ebp - 0x2d4], 0x58
mov dword [ebp - 0x290], 0x1101e480
mov dword [ebp - 0x2d0], edx
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], 0x100
mov byte [ebp - 0x264], 0
mov dword [ebp - 0x2a0], 0xe88826
call fcn.111457a0
push 0x1393
mov dword [ebp - 0x2a8], eax
call fcn.11146710
lea edx, [ebp - 0x60]
add esp, 0x14
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1101fae0
lea ecx, [ebp - 0x60]
mov edx, ecx
push 0x7c
push edx
mov dword [ebp - 0x2c8], ecx
call fcn.11081d30
add esp, 8
test eax, eax
je 0x1101fb17
mov byte [eax], 0
inc eax
push 0x7c
push eax
call fcn.11081d30
add esp, 8
test eax, eax
jne 0x1101fb04
mov ecx, dword [edi + 0x1c]
mov dword [ebp - 0x298], 0x11199400
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
lea edx, [ebp - 0x26c]
push edx
call eax
test eax, eax
je 0x1101fbf8
mov ecx, dword [ebp - 0x270]
mov ecx, dword [ecx + 0x48]
mov byte [ebp - 0x164], 0
test ecx, ecx
je 0x1101fb76
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push 0
push 0x104
lea eax, [ebp - 0x164]
push eax
push 0x111993f4
push 0x111a0fc0
call edx
cmp byte [ebp - 0x164], 0
jne 0x1101fb94
lea eax, [ebp - 0x164]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.sHFOlDer.dLl_SHGetFolderPathA]
cmp byte [ebp - 0x164], 0
je 0x1101fba0
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x2a8], ecx
lea edx, [ebp - 0x2d4]
push edx
call dword [sym.imp.COmdlG32.DlL_GetSaveFileNameA]
test eax, eax
je 0x1101fbe7
lea eax, [ebp - 0x264]
push 0x111993f0
push eax
call fcn.11164ead
mov esi, eax
add esp, 8
test esi, esi
je 0x1101fbe1
mov ecx, dword [ebp - 0x268]
push esi
push ecx
call fcn.11164ceb
push esi
call fcn.11164c77
add esp, 0xc
mov esi, dword [ebp - 0x268]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x26c]
mov edx, dword [edx + 0x44]
push eax
call edx
push esi
call fcn.11162777
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x1101fc20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
mov esi, ecx
call fcn.1101e540
mov ebx, eax
test ebx, ebx
je 0x1101fca1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1101fc32
sub eax, edx
push edi
mov edi, eax
test edi, edi
jle 0x1101fca0
mov eax, dword [esi + 8]
push eax
inc edi
call dword [sym.imp.uSEr32.dll_OpenClipboard]
test eax, eax
je 0x1101fca0
push edi
push 0x2002
call dword [sym.imp.KeRneL32.DLl_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KeRneL32.DLl_GlobalLock]
push edi
push ebx
push eax
call fcn.11162c60
add esp, 0xc
push esi
call dword [sym.imp.KeRneL32.DLl_GlobalUnlock]
call dword [sym.imp.uSEr32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.uSEr32.dll_SetClipboardData]
test eax, eax
jne 0x1101fc9a
push esi
call dword [sym.imp.KeRneL32.DLl_GlobalFree]
push 0x30
call dword [sym.imp.uSEr32.dll_MessageBeep]
call dword [sym.imp.uSEr32.dll_CloseClipboard]
pop edi
push ebx
call fcn.11162777
add esp, 4
pop esi
pop ebx
ret
Function at 0x11023470
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp eax, 0x400
je 0x1102348b
cmp eax, 0x300
jne 0x1102357f
mov eax, dword [ebp + 8]
push ebx
push edi
push eax
call dword [sym.imp.uSEr32.dll_GetWindowTextLengthA]
mov edi, 0x80
sub edi, eax
mov dword [ebp + 0xc], eax
cmp edi, 9
ja 0x110234f3
cmp dword [esi + 8], 0
jne 0x110234c3
push 0x95
push 0x11198f04
push 0x1119511c
call fcn.11029a70
add esp, 0xc
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.uSEr32.dll_GetDlgItem]
push 5
push 0x13ab
push ecx
call ebx
push eax
call dword [sym.imp.uSEr32.dll_ShowWindow]
push edi
push 0x1392
push 0x13ab
push esi
call fcn.110cb950
add esp, 0x10
jmp 0x1102352a
cmp dword [esi + 8], 0
jne 0x11023510
push 0x95
push 0x11198f04
push 0x1119511c
call fcn.11029a70
add esp, 0xc
mov edx, dword [esi + 8]
mov ebx, dword [sym.imp.uSEr32.dll_GetDlgItem]
push 0
push 0x13ab
push edx
call ebx
push eax
call dword [sym.imp.uSEr32.dll_ShowWindow]
cmp dword [ebp + 0xc], 0x80
jle 0x11023543
cmp dword [esi + 0xd4], 1
jne 0x11023543
mov ecx, esi
call fcn.110232a0
cmp dword [esi + 8], 0
mov edi, dword [esi + 0xe0]
jne 0x11023566
push 0x8f
push 0x11198f04
push 0x1119511c
call fcn.11029a70
add esp, 0xc
mov eax, dword [esi + 8]
push edi
push eax
call ebx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setg cl
push ecx
push eax
call dword [sym.imp.uSEr32.dll_EnableWindow]
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x11026830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
xor eax, eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
inc dword [esi + 0x58]
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
mov ax, word [ebp + 8]
mov dword [esi + 0x5c], edx
push 6
lea edx, [ebp - 0x2c]
push edx
mov word [ebp - 0x2c], ax
mov eax, dword [esi + 0x58]
push ecx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2a], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
push ecx
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x60], ebx
call edx
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov edi, eax
lea eax, [edi + 0xfa0]
mov dword [ebp - 0x34], eax
cmp dword [esi + 0x60], ebx
jne 0x110268fe
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov ebx, eax
mov ecx, ebx
sub ecx, dword [ebp - 0x34]
test ecx, ecx
jg 0x110268f5
push 0x32
call dword [sym.imp.KeRneL32.DLl_Sleep]
mov edx, ebx
sub edx, edi
cmp edx, 0x3e8
jb 0x110268ef
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
push 6
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [eax + 0x20]
push ecx
mov ecx, esi
call edx
mov edi, ebx
cmp dword [esi + 0x60], 0
je 0x110268b1
mov dword [esi + 0x5c], 0
jmp 0x11026901
mov dword [esi + 0x5c], ebx
mov eax, dword [esi + 0x60]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 0x10

Function at 0x110271a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.1116476e
add esp, 4
test eax, eax
je 0x110271dd
cmp byte [esi + 1], 0x3a
jne 0x110271dd
mov cl, byte [esi]
lea edx, [ebp + 8]
mov dword [ebp + 8], 0x5c3a3f
push edx
mov byte [ebp + 8], cl
call dword [sym.imp.KeRneL32.DLl_GetDriveTypeA]
cmp eax, 4
jne 0x110271dd
mov al, 1
pop esi
pop ebp
ret
cmp byte [esi], 0x5c
jne 0x110271ee
cmp byte [esi + 1], 0x5c
jne 0x110271ee
cmp byte [esi + 2], 0x2e
jne 0x110271d8
xor al, al
pop esi
pop ebp
ret
Function at 0x11027d00
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x48]
push eax
xor esi, esi
push 0x28
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
call dword [sym.imp.KeRneL32.DLl_GetCurrentProcess]
push eax
call dword [sym.imp.aDvapi32.DLL_OpenProcessToken]
test eax, eax
je 0x11027dcc
mov edx, dword [ebp - 0x48]
push ebx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push esi
push esi
mov esi, dword [sym.imp.aDvapi32.DLL_GetTokenInformation]
push 3
push edx
call esi
mov ebx, dword [ebp - 0x4c]
push ebx
call fcn.11163a11
mov edi, eax
add esp, 4
test edi, edi
je 0x11027dbc
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x4c]
push eax
push ebx
push edi
push 3
push ecx
call esi
xor ebx, ebx
cmp dword [edi], ebx
jbe 0x11027db3
lea esi, [edi + 4]
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x44]
push eax
push esi
push 0
mov dword [ebp - 0x50], pe_nt_image_headers32
mov byte [ebp - 0x44], 0
call dword [sym.imp.aDvapi32.DLL_LookupPrivilegeNameA]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
push 0x1119a180
call fcn.11147060
inc ebx
add esp, 0x14
add esi, 0xc
cmp ebx, dword [edi]
jb 0x11027d73
push edi
call fcn.11163aa5
add esp, 4
mov eax, dword [ebp - 0x48]
pop edi
pop ebx
test eax, eax
je 0x11027dcc
push eax
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.11162bb7
mov esp, ebp
pop ebp
ret

Function at 0x11027de0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call fcn.111457a0
mov esi, dword [sym.imp.uSEr32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x20c]
push 0x1119a1bc
push eax
call esi
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.11143e00
add esp, 0x18
test eax, eax
jne 0x11027e3d
push eax
call fcn.111457a0
push eax
lea edx, [ebp - 0x20c]
push 0x1119a1ac
push edx
call esi
add esp, 0x10
call fcn.11145ef0
pop esi
test eax, eax
jne 0x11027e57
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x111ee308]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
test eax, eax
je 0x11027e47
cmp dword [0x111ee254], 0
jne 0x11027e47
push 1
push 0
push 0x1119a1a8
lea eax, [ebp - 0x20c]
push eax
push 0x11198240
push 0
call dword [sym.imp.ShELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x11027fc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117fb3b
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x111ee254], 0
je 0x110281a9
push 0
push 0
push 6
call fcn.11145c70
add esp, 0xc
test eax, eax
je 0x110281a9
call fcn.110b7df0
test eax, eax
je 0x110281a9
mov ecx, dword [0x111ee100]
push 0
push 0
push 0x1119a310
push 0x111a0f40
call fcn.1105e820
test eax, eax
jne 0x110281a9
lea ecx, [ebp - 0x21c]
call fcn.110ed130
push 0x20019
push 0x1119a2e4
push reloc.wsOcK32.dll_bind
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.110ed520
test eax, eax
je 0x11028197
mov ecx, dword [0x111ee100]
push 0
push 1
push 0x1119a2d0
push 0x111a0f40
call fcn.1105e820
test eax, eax
je 0x11028197
push 0x43
call dword [sym.imp.uSEr32.dll_GetSystemMetrics]
test eax, eax
jne 0x11028197
push eax
call fcn.111457a0
mov esi, dword [sym.imp.uSEr32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x218]
push 0x1119a1bc
push eax
call esi
lea ecx, [ebp - 0x218]
push 0
push ecx
call fcn.11143e00
add esp, 0x18
test eax, eax
jne 0x110280ea
push eax
call fcn.111457a0
push eax
lea edx, [ebp - 0x218]
push 0x1119a1ac
push edx
call esi
add esp, 0x10
lea eax, [ebp - 0x218]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x110280f1
mov ecx, dword [0x1119a2c8]
mov dx, word [0x1119a2cc]
mov dword [eax], ecx
mov cl, byte [0x1119a2ce]
mov word [eax + 4], dx
push 0x44
lea edx, [ebp - 0x270]
push 0
push edx
mov byte [eax + 6], cl
call fcn.11162be0
xor eax, eax
push 0x1119a2a8
mov dword [ebp - 0x270], 0x44
mov dword [ebp - 0x244], 1
mov word [ebp - 0x240], ax
call fcn.11147060
add esp, 0x10
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KeRneL32.DLl_CreateProcessA]
test eax, eax
je 0x11028197
mov ecx, dword [ebp - 0x22c]
mov esi, dword [sym.imp.KeRneL32.DLl_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x228]
push edx
call esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
call fcn.110edb10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x11028360
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [0x111ee254], ebx
je 0x11028402
call fcn.11028290
test al, al
je 0x11028402
mov ecx, dword [0x111ee30c]
mov byte [ebp - 0x44], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x120]
push esi
call edx
mov esi, eax
cmp esi, ebx
je 0x110283e9
push esi
call dword [sym.imp.aDvapi32.DLL_ImpersonateLoggedOnUser]
test eax, eax
je 0x110283e9
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov dword [ebp - 0x48], pe_nt_image_headers32
call dword [sym.imp.aDvapi32.DLL_GetUserNameA]
test eax, eax
je 0x110283dc
lea edx, [ebp - 0x44]
push 0x1119a380
push edx
call fcn.11081e70
add esp, 8
test eax, eax
sete bl
call dword [sym.imp.aDvapi32.DLL_RevertToSelf]
push esi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
call fcn.110b7df0
push eax
lea eax, [ebp - 0x44]
push eax
push esi
push 0x1119a350
call fcn.11147060
add esp, 0x10
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x11029520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11181208
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x111ec774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp eax, 0x12
ja case.0x1102955b.5
movzx eax, byte [eax + 0x11029704]
jmp dword [eax*4 + 0x110296f0]
mov ecx, dword [0x111ee134]
push 0xd0
push ecx
lea ecx, [ebp - 0x34]
xor bl, bl
call fcn.1106c0f0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.110684e0
test eax, eax
je 0x110295bb
jmp 0x11029590
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0xc]
push 0
push 0
push 0x1119a62c
push 0x111a0f40
call fcn.1105e820
test eax, eax
je 0x110295af
mov bl, 1
lea ecx, [ebp - 0x34]
call fcn.110684e0
test eax, eax
jne 0x11029590
movzx esi, bl
neg esi
sbb esi, esi
lea ecx, [ebp - 0x34]
and esi, 0x424d5143
mov dword [ebp - 4], 0xffffffff
call fcn.1106c150
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x111ee118]
mov ecx, dword [0x111ee114]
mov edx, dword [0x111ee110]
push eax
push ecx
push edx
push 0x1119a5f4
call fcn.11147060
xor edi, edi
add esp, 0x10
cmp dword [0x111ee118], edi
je 0x1102962a
push 0x1119a5e4
call fcn.11147060
add esp, 4
mov dword [0x111ee118], edi
cmp dword [0x111ee110], edi
jne case.0x1102955b.5
cmp dword [0x111ee114], edi
jne case.0x1102955b.5
cmp dword [0x111ee254], edi
jne case.0x1102955b.5
mov esi, dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov dword [0x111ee118], edi
call esi
or eax, 1
mov dword [0x111ee114], eax
call fcn.11029490
mov eax, dword [0x111ee1a8]
push edi
mov dword [0x111ee458], eax
call fcn.11027580
push edi
push edi
push edi
call fcn.11027200
add esp, 0x10
mov dword [0x111ee11c], edi
call esi
or eax, 1
mov dword [0x111ee110], eax
mov dword [0x111ee114], edi
jmp case.0x1102955b.5
cmp dword [ebp + 0xc], 0
je case.0x1102955b.2
mov ecx, dword [0x111ee100]
push 0
push 0
push 0x1119a5d0
push 0x111a0f50
call fcn.1105e820
test eax, eax
jne case.0x1102955b.5
cmp dword [0x111ee110], 0
je case.0x1102955b.5
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
or eax, 1
mov dword [0x111ee118], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11029790
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x111ee414], 0
jne 0x110297e9
mov ecx, dword [0x111ee100]
push 0
push 0
push 0x1119a63c
push 0x111a0f20
mov dword [0x111ee410], 0
call fcn.1105e820
test eax, eax
je 0x110297e9
cmp eax, 0x64
jge 0x110297ce
mov eax, 0x1f4
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x11027530
push 0
push 0
call dword [sym.imp.KeRneL32.DLl_CreateThread]
mov dword [0x111ee414], eax
mov esp, ebp
pop ebp
ret
Function at 0x110297f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x111ee468
push 0
push 0
push 0x11027690
push 0x1000
or esi, 0xffffffff
push 0
mov dword [0x111ee46c], esi
call dword [sym.imp.KeRneL32.DLl_CreateThread]
mov edi, dword [sym.imp.KeRneL32.DLl_Sleep]
mov dword [0x111ee464], eax
cmp dword [0x111ee46c], esi
jne 0x1102983c
lea esp, [esp]
push 0x32
call edi
cmp dword [0x111ee46c], esi
je 0x11029830
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x111ee46c], esi
mov eax, dword [0x111ee468]
push 0
push ebx
push 0x500
push eax
call dword [sym.imp.uSEr32.dll_PostThreadMessageA]
push 0x32
call edi
mov esi, dword [0x111ee46c]
cmp esi, 0xffffffff
je 0x11029846
pop ebx
test esi, esi
je 0x1102987f
cmp esi, 0x64
jge 0x1102987f
push 0
call fcn.11027580
add esp, 4
jmp 0x110298a7
mov ecx, dword [0x111ee1a0]
mov edx, dword [0x111ee1ac]
push ecx
mov ecx, dword [0x111ee134]
push edx
call fcn.11064260
mov dword [0x111ee1a8], 1
call fcn.11029790
test esi, esi
je 0x11029938
mov dword [0x111ee46c], esi
test esi, 0x8000
je 0x11029901
and esi, 0xffff7fff
or esi, 0x80000000
push esi
mov dword [0x111ee46c], esi
call fcn.11143a80
mov edx, dword [0x111ee46c]
push edx
mov esi, eax
mov eax, dword [0x111ee0f0]
mov ecx, dword [eax]
push 0
push 0x192b
push eax
mov eax, dword [ecx + 4]
call eax
push esi
call fcn.11162777
add esp, 0x18
pop edi
xor eax, eax
pop esi
pop ebp
ret
cmp esi, 0xffff
jne 0x11029910
mov esi, 0x42d
jmp 0x1102991e
cmp esi, 0x65
jl 0x11029918
sub esi, 0x5b
add esi, 0x42d
mov edx, dword [0x111ee470]
mov eax, dword [0x111ee0f0]
mov ecx, dword [eax]
push edx
push 0
push esi
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 0x10
mov eax, dword [0x111ee1a8]
pop edi
pop esi
pop ebp
ret