joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110fa3fa
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx - 0x1d]
push edi
mov edi, ecx
cmp eax, 0xc4
ja case.0x110fa3ce.30
movzx eax, byte [eax + 0x110fa5b8]
jmp dword [eax*4 + 0x110fa59c]
xor ecx, ecx
cmp dword [0x111f1780], ecx
pop edi
sete cl
pop ebx
mov dword [0x111f1780], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x111f177c], 1
jmp case.0x110fa3ce.30
mov dword [0x111f177c], 0
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 1
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 0
xor ecx, ecx
cmp dword [0x111f1780], ecx
mov dword [0x111f1780], 0
setne cl
mov dword [ebp + 8], ecx
test bl, bl
jns 0x110fa43e
or ecx, 2
mov dword [ebp + 8], ecx
and ebx, 0x7f
lea eax, [ebx - 0x5b]
push esi
cmp eax, 0x17
ja case.0x110fa451.94
movzx edx, byte [eax + 0x110fa68c]
jmp dword [edx*4 + 0x110fa680]
mov esi, ebx
jmp 0x110fa495
cmp dword [ebp + 0x10], 0
je case.0x110fa451.94
xor eax, eax
cmp ebx, 0x71
sete al
or ebx, 0x80
and ecx, 0xfffffffd
mov dword [ebp + 8], ecx
lea esi, [eax*4 + 0x15]
jmp 0x110fa495
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
push ebx
call dword [sym.imp.uSEr32.dll_MapVirtualKeyA]
mov esi, eax
cmp ebx, 0x46
jne 0x110fa4b4
cmp esi, 0x91
jne 0x110fa52b
cmp dword [0x111f177c], 0
je 0x110fa52b
lea esi, [ebx - 0x43]
jmp 0x110fa52b
cmp ebx, 0x37
jne 0x110fa4ce
cmp esi, 0x6a
jne 0x110fa52b
test byte [ebp + 8], 1
je 0x110fa52b
lea esi, [ebx - 0xb]
xor ebx, ebx
mov dword [ebp + 8], ebx
jmp 0x110fa52b
cmp ebx, 0x54
jne 0x110fa4e4
cmp esi, 0x2c
jne 0x110fa52b
lea ebx, [esi - 0x2b]
mov dword [ebp + 8], 0
jmp 0x110fa52b
cmp ebx, 0x45
jne 0x110fa52b
cmp dword [0x111f177c], 0
jne 0x110fa4fb
cmp dword [0x111f1774], 0
je 0x110fa510
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x9d
mov ecx, edi
call eax
mov esi, 0x13
jmp 0x110fa515
cmp esi, 0x13
jne 0x110fa527
mov ecx, dword [ebp + 8]
shr ecx, 1
not ecx
and ecx, 1
mov dword [0x111f1774], ecx
jmp 0x110fa52b
or dword [ebp + 8], 1
push 2
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.uSEr32.dll_PeekMessageA]
push 0x90
call dword [sym.imp.uSEr32.dll_GetKeyState]
test al, 1
je 0x110fa57a
test byte [ebp + 8], 1
jne 0x110fa57a
push esi
push 0x111ea890
call fcn.11165010
add esp, 8
test eax, eax
je 0x110fa57a
sub eax, 0x111ea890
mov esi, eax
cmp esi, 9
ja 0x110fa575
add esi, 0x60
jmp 0x110fa57a
mov esi, 0x6e
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
push 0
push ecx
push ebx
push esi
mov ecx, edi
call edx
push ebx
mov ecx, edi
call fcn.110f8e60
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110fa406
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx - 0x1d]
push edi
mov edi, ecx
cmp eax, 0xc4
ja case.0x110fa3ce.30
movzx eax, byte [eax + 0x110fa5b8]
jmp dword [eax*4 + 0x110fa59c]
xor ecx, ecx
cmp dword [0x111f1780], ecx
pop edi
sete cl
pop ebx
mov dword [0x111f1780], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x111f177c], 1
jmp case.0x110fa3ce.30
mov dword [0x111f177c], 0
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 1
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 0
xor ecx, ecx
cmp dword [0x111f1780], ecx
mov dword [0x111f1780], 0
setne cl
mov dword [ebp + 8], ecx
test bl, bl
jns 0x110fa43e
or ecx, 2
mov dword [ebp + 8], ecx
and ebx, 0x7f
lea eax, [ebx - 0x5b]
push esi
cmp eax, 0x17
ja case.0x110fa451.94
movzx edx, byte [eax + 0x110fa68c]
jmp dword [edx*4 + 0x110fa680]
mov esi, ebx
jmp 0x110fa495
cmp dword [ebp + 0x10], 0
je case.0x110fa451.94
xor eax, eax
cmp ebx, 0x71
sete al
or ebx, 0x80
and ecx, 0xfffffffd
mov dword [ebp + 8], ecx
lea esi, [eax*4 + 0x15]
jmp 0x110fa495
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
push ebx
call dword [sym.imp.uSEr32.dll_MapVirtualKeyA]
mov esi, eax
cmp ebx, 0x46
jne 0x110fa4b4
cmp esi, 0x91
jne 0x110fa52b
cmp dword [0x111f177c], 0
je 0x110fa52b
lea esi, [ebx - 0x43]
jmp 0x110fa52b
cmp ebx, 0x37
jne 0x110fa4ce
cmp esi, 0x6a
jne 0x110fa52b
test byte [ebp + 8], 1
je 0x110fa52b
lea esi, [ebx - 0xb]
xor ebx, ebx
mov dword [ebp + 8], ebx
jmp 0x110fa52b
cmp ebx, 0x54
jne 0x110fa4e4
cmp esi, 0x2c
jne 0x110fa52b
lea ebx, [esi - 0x2b]
mov dword [ebp + 8], 0
jmp 0x110fa52b
cmp ebx, 0x45
jne 0x110fa52b
cmp dword [0x111f177c], 0
jne 0x110fa4fb
cmp dword [0x111f1774], 0
je 0x110fa510
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x9d
mov ecx, edi
call eax
mov esi, 0x13
jmp 0x110fa515
cmp esi, 0x13
jne 0x110fa527
mov ecx, dword [ebp + 8]
shr ecx, 1
not ecx
and ecx, 1
mov dword [0x111f1774], ecx
jmp 0x110fa52b
or dword [ebp + 8], 1
push 2
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.uSEr32.dll_PeekMessageA]
push 0x90
call dword [sym.imp.uSEr32.dll_GetKeyState]
test al, 1
je 0x110fa57a
test byte [ebp + 8], 1
jne 0x110fa57a
push esi
push 0x111ea890
call fcn.11165010
add esp, 8
test eax, eax
je 0x110fa57a
sub eax, 0x111ea890
mov esi, eax
cmp esi, 9
ja 0x110fa575
add esi, 0x60
jmp 0x110fa57a
mov esi, 0x6e
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
push 0
push ecx
push ebx
push esi
mov ecx, edi
call edx
push ebx
mov ecx, edi
call fcn.110f8e60
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110fa412
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx - 0x1d]
push edi
mov edi, ecx
cmp eax, 0xc4
ja case.0x110fa3ce.30
movzx eax, byte [eax + 0x110fa5b8]
jmp dword [eax*4 + 0x110fa59c]
xor ecx, ecx
cmp dword [0x111f1780], ecx
pop edi
sete cl
pop ebx
mov dword [0x111f1780], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x111f177c], 1
jmp case.0x110fa3ce.30
mov dword [0x111f177c], 0
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 1
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 0
xor ecx, ecx
cmp dword [0x111f1780], ecx
mov dword [0x111f1780], 0
setne cl
mov dword [ebp + 8], ecx
test bl, bl
jns 0x110fa43e
or ecx, 2
mov dword [ebp + 8], ecx
and ebx, 0x7f
lea eax, [ebx - 0x5b]
push esi
cmp eax, 0x17
ja case.0x110fa451.94
movzx edx, byte [eax + 0x110fa68c]
jmp dword [edx*4 + 0x110fa680]
mov esi, ebx
jmp 0x110fa495
cmp dword [ebp + 0x10], 0
je case.0x110fa451.94
xor eax, eax
cmp ebx, 0x71
sete al
or ebx, 0x80
and ecx, 0xfffffffd
mov dword [ebp + 8], ecx
lea esi, [eax*4 + 0x15]
jmp 0x110fa495
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
push ebx
call dword [sym.imp.uSEr32.dll_MapVirtualKeyA]
mov esi, eax
cmp ebx, 0x46
jne 0x110fa4b4
cmp esi, 0x91
jne 0x110fa52b
cmp dword [0x111f177c], 0
je 0x110fa52b
lea esi, [ebx - 0x43]
jmp 0x110fa52b
cmp ebx, 0x37
jne 0x110fa4ce
cmp esi, 0x6a
jne 0x110fa52b
test byte [ebp + 8], 1
je 0x110fa52b
lea esi, [ebx - 0xb]
xor ebx, ebx
mov dword [ebp + 8], ebx
jmp 0x110fa52b
cmp ebx, 0x54
jne 0x110fa4e4
cmp esi, 0x2c
jne 0x110fa52b
lea ebx, [esi - 0x2b]
mov dword [ebp + 8], 0
jmp 0x110fa52b
cmp ebx, 0x45
jne 0x110fa52b
cmp dword [0x111f177c], 0
jne 0x110fa4fb
cmp dword [0x111f1774], 0
je 0x110fa510
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x9d
mov ecx, edi
call eax
mov esi, 0x13
jmp 0x110fa515
cmp esi, 0x13
jne 0x110fa527
mov ecx, dword [ebp + 8]
shr ecx, 1
not ecx
and ecx, 1
mov dword [0x111f1774], ecx
jmp 0x110fa52b
or dword [ebp + 8], 1
push 2
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.uSEr32.dll_PeekMessageA]
push 0x90
call dword [sym.imp.uSEr32.dll_GetKeyState]
test al, 1
je 0x110fa57a
test byte [ebp + 8], 1
jne 0x110fa57a
push esi
push 0x111ea890
call fcn.11165010
add esp, 8
test eax, eax
je 0x110fa57a
sub eax, 0x111ea890
mov esi, eax
cmp esi, 9
ja 0x110fa575
add esi, 0x60
jmp 0x110fa57a
mov esi, 0x6e
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
push 0
push ecx
push ebx
push esi
mov ecx, edi
call edx
push ebx
mov ecx, edi
call fcn.110f8e60
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110fae60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118a053
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x111ec774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov word [esi + 0x30], 1
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 0xdc
mov dword [ebp - 4], ebx
mov dword [esi], 0x111b3f44
call fcn.111101b0
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x110faeca
push ebx
push ebx
lea ecx, [edi + 0x1c]
call fcn.11110280
jmp 0x110faecc
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [edi], esi
mov dword [edi + 4], 0xffffffff
mov dword [edi + 0x2c], 1
mov eax, dword [0x111b3f34]
mov cl, byte [0x111b3f38]
mov dword [0x111f16a8], eax
mov byte [0x111f16ac], cl
call fcn.110f1600
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x110fd6d0
Capabilities:
Check for time delay via gettickcount
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118a18b
mov eax, dword fs:[0]
push eax
sub esp, 0x55c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x394], 0
mov ebx, dword [ebp + 8]
jne 0x110fd8a6
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov dword [ebp - 0x524], eax
push 0x111b4734
lea eax, [ebp - 0x520]
push eax
mov ecx, esi
call fcn.110f5590
cmp dword [0x111ee0e0], 0xd0003
mov dword [ebp - 4], 0
jle 0x110fd81b
mov edx, dword [ebp - 0x520]
mov eax, dword [edx]
lea ecx, [ebp - 0x520]
call eax
test al, al
jne 0x110fd774
push 0x252
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
cmp dword [ebp - 0x518], 0
je 0x110fd81b
mov edx, dword [ebp - 0x520]
mov eax, dword [edx]
lea ecx, [ebp - 0x520]
call eax
test al, al
jne 0x110fd7ac
push 0x250
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov ecx, dword [ebp - 0x514]
push ebx
push ecx
lea edx, [ebp - 0x510]
push 0x111b47d4
push edx
call dword [sym.imp.uSEr32.dll_wsprintfA]
push 0x44
lea eax, [ebp - 0x568]
push 0
push eax
call fcn.11162be0
mov eax, dword [ebp + 0xc]
add esp, 0x1c
lea edx, [ebp - 0x568]
push edx
push 1
push eax
xor ecx, ecx
push 0x4008000
push ecx
push ecx
push ecx
mov word [ebp - 0x538], cx
lea ecx, [ebp - 0x510]
push ecx
mov ecx, esi
mov dword [ebp - 0x568], 0x44
mov dword [ebp - 0x53c], 1
call fcn.110f9a70
jmp 0x110fd874
mov ecx, 0x13
mov esi, 0x111b4788
lea edi, [ebp - 0x110]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x110fd831
lea edi, [ebp - 0x110]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x110fd841
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x110]
mov ecx, eax
push edx
and ecx, 3
push reloc.wsOcK32.dll_bind
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.aDvapi32.DLL_RegDeleteKeyA]
test eax, eax
jne 0x110fd874
call fcn.110f3380
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
sub eax, dword [ebp - 0x524]
cmp eax, 0x64
jb 0x110fd894
push eax
push ebx
push 0x111b4760
call fcn.11147060
add esp, 0xc
lea ecx, [ebp - 0x520]
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 8
Function at 0x110fdbb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118a20b
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push edi
push 0x111b4958
mov esi, ecx
call fcn.11147060
mov eax, dword [esi + 0x24]
add esp, 8
cmp dword [eax + 0x394], 0
jne 0x110fddd1
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x110fdc06
sub eax, edx
je 0x110fddd1
mov ebx, dword [sym.imp.KeRneL32.DLl_GetTickCount]
call ebx
mov dword [ebp - 0x414], eax
push 0x111b48a8
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.110f5590
cmp dword [0x111ee0e0], 0xd0003
mov dword [ebp - 4], 0
jle 0x110fdd21
mov edx, dword [ebp - 0x434]
mov eax, dword [edx]
lea ecx, [ebp - 0x434]
call eax
test al, al
jne 0x110fdc78
push 0x252
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
cmp dword [ebp - 0x42c], 0
je 0x110fdd21
push edi
lea ecx, [ebp - 0x434]
call fcn.1101d360
push eax
lea ecx, [ebp - 0x410]
push 0x111b4938
push ecx
call dword [sym.imp.uSEr32.dll_wsprintfA]
push 0x44
lea edx, [ebp - 0x478]
push 0
push edx
call fcn.11162be0
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
xor eax, eax
cmp dword [0x111ee0e0], 0x160003
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x478]
push eax
push 1
push ecx
push 0x4008000
push 0
push 0
mov dword [ebp - 0x478], 0x44
mov dword [ebp - 0x44c], 1
mov ecx, esi
push 0
jl 0x110fdd10
mov edx, dword [esi]
mov edx, dword [edx + 0xec]
lea eax, [ebp - 0x410]
push eax
call edx
jmp 0x110fdda3
lea edx, [ebp - 0x410]
push edx
call fcn.110f9a70
jmp 0x110fdda3
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x418]
push ecx
push edi
mov dword [ebp - 0x41c], 0xf000c
call sub.WinSpOOl.dRv_OpenPrinterA
test eax, eax
je 0x110fdd89
mov edx, dword [ebp - 0x418]
push edx
call sub.WinSpOOl.dRv_DeletePrinter
test eax, eax
jne 0x110fdd7b
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push 0x111b4918
call fcn.11147060
add esp, 8
mov eax, dword [ebp - 0x418]
push eax
call sub.WinSpOOl.dRv_ClosePrinter
jmp 0x110fdda3
cmp byte [ebp + 0xc], 0
jne 0x110fdda3
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push 0x111b48fc
call fcn.11147060
add esp, 8
call ebx
sub eax, dword [ebp - 0x414]
cmp eax, 0x64
jb 0x110fddbf
push eax
push edi
push 0x111b48dc
call fcn.11147060
add esp, 0xc
lea ecx, [ebp - 0x434]
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x111038a0
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 0x111a60e4
mov dword [ebp - 4], 0xffffff9d
call dword [sym.imp.KeRneL32.DLl_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x11103a08
push esi
push 0x111b43c0
push ebx
call dword [sym.imp.KeRneL32.DLl_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x111038ed
push ebx
mov dword [ebp - 4], 0xffffff9e
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x1c], 0
mov eax, 0x111b58b0
jne 0x111038fd
mov eax, 0x111b5898
mov ecx, dword [0x111ee100]
push edi
push 0
push 0xffffffffffffffff
push eax
push 0x111a0f40
call fcn.1105e820
test eax, eax
jg 0x1110395b
jns 0x11103931
mov edi, dword [sym.imp.uSEr32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jns 0x11103931
push 0x10
call edi
test ax, ax
js 0x1110395b
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call esi
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x1c], 0
mov eax, 0x111b5890
jne 0x1110396b
mov eax, 0x111b5884
push eax
call fcn.110b7ef0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 8]
push ecx
push 0
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x20]
push edx
push 0x110f4f80
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push 0x1000
push 0
mov dword [ebp - 4], 0xffffff9f
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KeRneL32.DLl_CreateThread]
mov esi, eax
push 0x3a98
push esi
call dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
test eax, eax
je 0x111039ed
push 0x111b585c
call fcn.11147060
mov eax, dword [0x111ee308]
push 0
push 0xc0003396
push 1
push eax
call fcn.110ffd70
add esp, 0x14
jmp 0x111039f8
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KeRneL32.DLl_GetExitCodeThread]
push esi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
push ebx
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x111060b0
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KeRneL32.DLl_GetTickCount]
push edi
call esi
push 0x111f160c
mov ebx, eax
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
call esi
mov edi, eax
sub eax, ebx
cmp eax, 0x64
jb 0x111060e5
push eax
push 0x111b26d4
call fcn.11147060
add esp, 8
mov ecx, dword [0x111f174c]
mov eax, dword [ecx]
cmp eax, ecx
je 0x1110615c
mov ebx, dword [eax + 0x10]
test ebx, ebx
je 0x1110615c
cmp dword [ebx + 0x30], 0
je 0x1110615c
call esi
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
mov eax, esi
sub eax, edi
cmp eax, 0x64
jb 0x11106124
push eax
push 0x111b26fc
call fcn.11147060
add esp, 8
lea esi, [ebx + 0x38]
push esi
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
push 0
lea eax, [ebp - 4]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KeRneL32.DLl_WriteFile]
cmp dword [ebp - 4], edi
push esi
sete bl
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call esi
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
mov eax, esi
sub eax, edi
cmp eax, 0x64
jb 0x11106182
push eax
push 0x111b26fc
call fcn.11147060
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11106190
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x111ee258], 0
jne 0x111061a6
cmp dword [0x111ee254], 0
je 0x1110626e
push ebx
push esi
push edi
mov edi, dword [sym.imp.KeRneL32.DLl_GetTickCount]
call edi
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
call edi
mov ebx, eax
sub eax, esi
cmp eax, 0x64
jb 0x111061d7
push eax
push 0x111b26d4
call fcn.11147060
add esp, 8
mov eax, dword [0x111f174c]
mov ecx, dword [eax]
mov edx, 1
cmp ecx, eax
je 0x1110623f
jmp 0x111061f0
mov eax, dword [ecx + 0x10]
mov dword [eax + 4], edx
cmp byte [ecx + 0x15], 0
jne 0x11106237
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], 0
jne 0x1110621c
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x11106237
nop
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x11106210
jmp 0x11106237
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], 0
jne 0x11106235
cmp ecx, dword [eax + 8]
jne 0x11106235
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x11106225
mov ecx, eax
cmp ecx, dword [0x111f174c]
jne 0x111061f0
mov byte [0x111ee26e], dl
call edi
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
mov eax, esi
pop edi
sub eax, ebx
pop esi
pop ebx
cmp eax, 0x64
jb 0x1110626e
push eax
push 0x111b26fc
call fcn.11147060
add esp, 8
ret
Function at 0x11106270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118a728
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x111ec774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x14]
mov ebx, dword [eax + 0x18]
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov esi, eax
push 0x111f160c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x111f160c
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov dword [ebp - 0x14], eax
sub eax, esi
cmp eax, 0x64
jb 0x111062dc
push eax
push 0x111b26d4
call fcn.11147060
add esp, 8
mov ecx, dword [0x111f174c]
mov esi, dword [ecx]
mov dword [ebp - 4], 0
cmp esi, ecx
je 0x1110635b
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x60]
test eax, eax
je 0x11106315
mov ecx, dword [0x111ee134]
push 0
push 0
push 0xffffffffffffffff
push ebx
push edi
push eax
push 0
call fcn.11068770
mov ecx, dword [0x111f174c]
cmp byte [esi + 0x15], 0
jne 0x11106357
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x1110633c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x11106357
mov edi, edi
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x11106330
jmp 0x11106357
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x11106355
cmp esi, dword [eax + 8]
jne 0x11106355
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x11106345
mov esi, eax
cmp esi, ecx
jne 0x111062ef
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
mov eax, esi
sub eax, dword [ebp - 0x14]
cmp eax, 0x64
jb 0x11106386
push eax
push 0x111b26fc
call fcn.11147060
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x11106640
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KeRneL32.DLl_GetTickCount]
push esi
push edi
mov dword [ebp - 4], 0
call ebx
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
call ebx
mov edi, eax
sub eax, esi
mov dword [ebp - 0xc], edi
cmp eax, 0x64
jb 0x11106681
push eax
push 0x111b26d4
call fcn.11147060
add esp, 8
mov eax, dword [0x111f174c]
mov esi, dword [eax]
cmp esi, eax
je 0x111066f2
lea esp, [esp]
mov edi, dword [esi + 0x10]
mov ecx, edi
call fcn.110f62e0
test eax, eax
je 0x111066a7
cmp dword [edi + 0x60], 0
je 0x111066a7
inc dword [ebp - 4]
cmp byte [esi + 0x15], 0
jne 0x111066e7
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x111066cc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x111066e7
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x111066c0
jmp 0x111066e7
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x111066e5
cmp esi, dword [eax + 8]
jne 0x111066e5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x111066d5
mov esi, eax
cmp esi, dword [0x111f174c]
jne 0x11106690
mov edi, dword [ebp - 0xc]
call ebx
push 0x111f160c
mov esi, eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
mov eax, esi
sub eax, edi
pop edi
pop esi
pop ebx
cmp eax, 0x64
jb 0x1110671b
push eax
push 0x111b26fc
call fcn.11147060
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret