joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x10013b0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004153
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x10013ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004146
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1004155
xor eax, eax
pop esi
leave
ret 4

Function at 0x403437
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00404860
mov eax, dword [str.JanFebMarAprMayJunJulAugSepOctNovDec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov edx, dword [esi]
push eax
call dword [edx + 0x14]
test byte [ebp + 0x10], 0x80
mov ebx, eax
jne 0x403500
test ebx, ebx
je 0x403481
cmp ebx, 0xffffffff
je 0x403481
push 0
push ebx
lea ecx, [esi + 0x48]
call fcn.0040319a
push edi
push 0
push 0x27100
push ebx
call fcn.00405e4f
mov edi, 0x10000
push edi
lea eax, [ebp - 0x10004]
push 0
push eax
call fcn.00404570
push edi
lea eax, [ebp - 0x10004]
push eax
push ebx
call fcn.00405cdd
add esp, 0x24
xor eax, eax
pop edi
cmp byte [ebp + eax - 0x10004], 0x4d
jne 0x4034df
cmp byte [ebp + eax - 0x10003], 0x53
jne 0x4034df
cmp byte [ebp + eax - 0x10002], 0x43
jne 0x4034df
cmp byte [ebp + eax - 0x10001], 0x46
je 0x4034e9
inc eax
cmp eax, 0xfffa
jb 0x4034b7
jmp 0x403500
add eax, 0x27100
push 0
push eax
push ebx
mov dword [esi + 0x110c], eax
call fcn.00405e4f
add esp, 0xc
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004045ea
leave
ret 0xc
Function at 0xd4dc65
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x38], 0
jmp 0xd4de02
mov esi, dword [esp + 0x1c]
lea edi, [edi*4]
jmp 0xd4df2f
call fcn.00d4dcf0
call fcn.00d4df5c
push 0x4f592fc
mov ah, 0x5e
leave
pop ecx
cmp bl, cl
or ch, al
or esp, dword [edx + reloc.IMM32.dll_ImmGetDefaultIMEWnd]
or al, 0
add ch, dl
dec ebx
fstp xword [esi - 0x138271b3]
bound eax, qword [0x587932f4]
mov ebx, 0x980a0d92
push cs
imul ebx, dword [eax - reloc.IMM32.dll_ImmGetDefaultIMEWnd], 0x24648d54
add al, 0xe9
xor byte [edx], dl
add byte [eax], al
iretd
jmp 0xd4df95
push esp
lea esp, [esp + 4]
jmp 0xd4e57f
jmp 0xd4dd6e
jmp 0xd4dd0f
lea esp, [esp + 0x10]
jb 0xd4d345
jae 0xd4d2b7
clc
mov dh, byte [esp]
mov edx, dword [eax + ecx*4]
cmc
push esp
jmp 0xd4ddca
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
lea edx, [eax + ebx]
mov dh, ch
jmp 0xd4dd35
lea eax, [ebp + 0x5f]
rdtsc
jmp 0xd4dd53
lea esp, [esp + 0x15]
pop dword [esp]
lea esp, [esp + 3]
lea esp, [esp + 4]
jl 0xd4d326
jge 0xd4d3c2
stc
sub esp, 0x10
sub esp, 0
add edx, ebp
jmp 0xd4dde0
mov ax, word [esp + 2]
sub esp, 0x1a
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
mov eax, dword [esp + 0x3c]
jmp 0xd4dda0
lea esp, [esp + 0x10]
call fcn.00d1a5b4
call fcn.00d4ddab
sbb byte [edi], 0x8f
ljmp 0x81e6
pushal
mov byte [esp + 0xc], ch
lea esp, [esp + 0x20]
test ebx, ebx
pushal
jmp 0xd4dd85
lea edi, [esi*4]
mov edi, 0x52045b90
mov edi, dword [esp + 0x18]
jmp 0xd4d1b2
mov eax, dword [esp + 0x20]
jmp 0xd4d310
jne 0xd4d326
je 0xd4d27d
test eax, eax
push esp
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0xd4e337

Function at 0xd4ea13
Capabilities:
Encode data using xor

Disassembly:
add esi, edx
cmc
push esp
mov dword [esp], esi
cmp ebp, esi
jmp 0xd4ea37
mov eax, ebx
jmp 0xd4ea17
stc
cmc
jmp 0xd4e9f1
sub eax, edx
push edx
cmc
pushal
pop dword [esp + 0x10]
jmp 0xd4edcd
lea esp, [esp + 8]
jae 0xd4e425
cmc
mov eax, dword [esp]
jmp 0xd4e9fc
add eax, ebp
call fcn.00d4eb05
Function at 0x1116887
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
pop ecx
lea edi, [ecx + 0x4b]
mov dl, dh
xchg word [esp + 2], bp
mov dl, 0xb4
jmp 0x11168b1
lea edx, [edx*4]
mov edi, 0x1a21c176
mov byte [esp + 3], ch
jmp 0x1116890
bswap ecx
pop word [esp]
xchg si, bp
mov bx, dx
mov ebx, dword [esp + 2]
setl dh
jmp 0x1116840
lea edi, [ecx + edi]
xchg dword [esp + 6], ebp
jmp 0x1116869
mov al, ah
rdtsc
rdtsc
lea esp, [esp]
mov ecx, dword [esp + 3]
sub esp, 0x16
jmp 0x1116a7d
mov dx, 0xd359
mov bl, 0x80
xchg dword [esp], eax
xchg byte [esp], cl
xchg esi, ecx
and cl, bh
jmp 0x1116852
mov esi, ecx
pop esi
bswap esi
xchg edx, esi
mov dx, 0xd195
pop di
jmp 0x1116a06
mov word [esp + 5], dx
and si, 0x6392
btr edx, esp
mov bl, bh
push dword [esp + 7]
mov ebp, 0x24251c06
jmp 0x11168d9
add bx, 0x9c4e
mov eax, dword [esp + 0x13]
clc
pop word [esp + 2]
lea ecx, [edx*4]
setl dh
jmp 0x11168f8
not ch
rdtsc
cmc
btc ecx, edi
mov ah, byte [esp]
setge bh
jmp 0x111691b
xchg bx, bp
xchg edi, esi
cld
call fcn.01116994
pushal
push dword [esp + 0x11]
setns ah
call fcn.01116a44
invalid
push edx
mov cx, 0x64df
neg cx
rdtsc
cpuid
xchg bh, cl
jmp 0x11169cd
push edx
xchg byte [esp + 6], dl
mov byte [esp + 0x15], dh
mov esi, dword [esp + 0x19]
ror eax, 7
pop esi
jmp 0x1116946
Function at 0x11171bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea esp, [esp + 2]
lea esp, [esp]
mov bh, byte [esp]
mov bx, sp
call fcn.011171b5
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
dec esi
outsd dx, dword [esi]
je 0x11171e5
jns 0x11171c8
dec ebp
inc ebp
add ch, bh
int3
cpuid
push word [esp + 2]
not cx
ror ebx, 0x15
pop ecx
pop word [esp]
jmp 0x1117161
mov cx, 0x519f
mov edi, ebp
add esp, 1
mov eax, dword [esp + 1]
mov byte [esp + 1], bh
call 0x11171bb
inc edx
imul esi, dword [edx + eax*2 + 0x6c], 0xbd660074
mov bp, 0x1055
jmp 0x1117198
add esp, 1
jmp 0x1117211
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
insb byte es:[edi], dx
popal
mov bp, 0x1055
jmp 0x1117198
jae 0x111722f
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1117234
js 0x1117245
add byte [edi], cl
int 0x66
mov ebp, 0xd366cd0f
out 0x66, al
mov ebx, edx
xor di, 0x60cc
xchg ah, bl
jmp 0x1117184
mov cl, ch
rdtsc
push dword [esp + 3]
lea esi, reloc.IMM32.dll_ImmGetDefaultIMEWnd
mov ch, 0x47
adc eax, 0xa20f9fd1
cpuid
rdtsc
jmp 0x1117ad6
into
pop es
neg edx
xchg dword [esp], ebp
xchg word [esp + 2], bp
xchg dword [esp], esi
jmp 0x1117226
not dh
not dx
mov cx, word [esp]
ror ah, 1
lea eax, [esi*4]
push edx
jmp 0x11172b7
xchg byte [esp + 7], al
mov ebx, eax
lea esp, [esp + 9]
mov bh, byte [esp]
mov edi, 0xebb0abb4
sub cx, 0xb4b8
jmp 0x1117264
pop si
mov bx, 0xa97d
mov eax, 0x140933ca
mov dh, byte [esp + 7]
rdtsc
mov dx, sp
jmp 0x1117280
mov ebp, esi
mov cl, 0x22
not ch
mov byte [esp + 5], dh
xchg byte [esp + 2], bl
setg ch
jmp 0x11172ec
pop dword [esp + 8]
mov edi, eax
mov eax, 0xb99e9a78
xor dl, ch
stc
pop cx
jmp 0x11172a1
not ecx
mov bx, word [esp + 1]
mov dx, bx
push word [esp + 5]
mov edi, dword [esp + 4]
pop dword [esp]
jmp 0x1117538
pop bx
rdtsc
rol si, cl
sub esp, 0
xchg word [esp + 3], ax
xchg byte [esp], dl
jmp 0x11172da
mov bl, bh
setl ah
neg edx
call fcn.0111734a
push edi
push ebx
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 9], al
salc
inc eax
not esi
mov al, ah
mov cl, 0xb2
lea edi, [ebx*4]
rdtsc
jmp 0x1117321
pop bx
mov si, word [esp]
lea edi, [esi*4]
mov eax, 0x23630a9c
bsf di, ax
mov bp, 0x83f5
jmp 0x1117338
xchg word [esp], di
mov ax, word [esp]
rcr bh, 3
mov dh, byte [esp + 1]
mov esi, 0xd60541c8
mov edx, esi
jmp 0x1117362
pop di
lea esi, [esp + ebx]
mov bh, byte [esp + 2]
xchg ebx, edi
lea esp, [esp + 1]
and ecx, ecx
jmp 0x111741f
mov cx, bx
push dword [esp + 6]
push word [esp + 0xf]
sub bl, ah
rdtsc
mov ecx, ebp
jmp 0x111730d
ror ah, 1
xchg dword [esp + 2], esi
mov dx, 0xbff
mov ax, dx
cpuid
bswap ecx
jmp 0x1117572
xchg word [esp + 3], bx
lea esp, [esp + 0x15]
mov ebx, ebp
mov bl, 0x50
mov dl, dh
xchg dword [esp + 4], edi
jmp 0x11175b4
xchg word [esp + 0x14], bx
mov byte [esp + 0xb], ch
mov word [esp + 0x1c], dx
xchg ch, dl
push word [esp + 0xd]
not bh
jmp 0x1117778
pop edi
mov ecx, eax
cpuid
sub esp, 0x1e
mov byte [esp + 0x17], ah
mov dx, 0x55d
jmp 0x111782e
Function at 0x111725d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
pop ax
mov dx, 0x78fd
mov ah, byte [esp]
jmp 0x1117042
push word [esp + 4]
mov ax, word [esp + 7]
sub edx, eax
setae ch
mov dx, 0x4f99
pop dword [esp]
jmp 0x1116ffe
mov eax, 0x4e81ceec
ror ecx, 7
mov edi, dword [esp]
jmp 0x111708e
lea edi, [esi - 0xe5]
xchg esi, ecx
mov byte [esp + 1], bh
mov bl, bh
jmp 0x111702c
btr edx, esp
shr ah, 1
lea ebp, [ecx + 0x93]
add esp, 4
mov esi, dword [esp + 1]
btc ebp, edi
jmp 0x1117014
mov di, 0xe4bb
mov word [esp], dx
push word [esp + 1]
lea esp, [esp + 5]
push word [esp + 1]
jmp 0x11170e4
lea edx, [eax*4]
mov ax, 0x3ea9
lea esp, [esp]
mov byte [esp + 1], bh
push word [esp + 2]
cld
jmp 0x1117071
add esp, 0x32
xchg dword [esp + 1], ebp
mov ecx, 0x84236aea
push word [esp + 2]
add esp, 4
xchg byte [esp + 6], bl
jmp 0x111705a
and cl, bh
mov byte [esp], bh
inc cl
mov ecx, 0x16fa6b36
not bh
xchg byte [esp], dl
jmp 0x111712e
add esp, 3
mov di, sp
lea edi, reloc.IMM32.dll_ImmGetDefaultIMEWnd
mov bh, byte [esp]
xchg ebp, ebx
xchg byte [esp], al
jmp 0x11170ca
mov ah, byte [esp + 4]
mov ax, word [esp + 7]
pop word [esp + 2]
mov dh, byte [esp + 6]
jmp 0x11171d2
push edx
mov edi, dword [esp]
mov cx, 0x78d
clc
push dword [esp + 4]
btc ebx, edi
jmp 0x11170fa
rcr bh, 3
mov byte [esp], bh
mov bl, bh
xchg di, dx
xchg ah, bl
mov ax, 0x49d5
jmp 0x1117112
mov word [esp], dx
pushal
rdtsc
cpuid
mov bx, dx
bsf bp, si
jmp 0x11170b0
bswap ebp
mov bp, 0xcd0f
shl si, cl
mov bx, dx
xchg bh, cl
jmp 0x111714c

Function at 0x111a911
Capabilities:
Execute anti-debugging instructions

Disassembly:
and cl, bh
setno bh
jmp 0x111a939
mov word [esp + 8], sp
rdtsc
xchg dword [esp + 2], ecx
rdtsc
mov di, 0xdf37
stc
jmp 0x111ae66
mov cl, 0x42
push word [esp + 0xa]
bsr di, bp
xchg byte [esp + 4], cl
mov al, 0xb6
xchg dword [esp + 7], eax
jmp 0x111ad31
Function at 0x111afdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], di
inc esi
lea edi, [ebp + 0x4f]
lea esp, [esp + 4]
jmp 0x111aea8
lea edx, [esi - 0xe5]
push esp
pop ecx
cpuid
mov ah, byte [esp + 1]
rdtsc
jmp 0x111ae80
lea esi, [ebp*4]
rcl bx, cl
push esp
xchg byte [esp], al
push dword [esp + 6]
jmp 0x111af1b
sub bp, 0x48f8
mov edx, dword [esp + 3]
pop bp
bswap edi
inc bx
inc cx
jmp 0x111ae96
bsr si, cx
mov dword [esp + 2], ecx
xchg byte [esp + 4], cl
xchg edx, eax
mov dx, 0xaa33
mov bp, word [esp + 1]
jmp 0x111aec5
mov si, word [esp + 7]
lea esi, [edi*4]
jmp 0x111af98
lea ecx, [ebp + 0xef]
mov dx, bx
xchg bp, ax
pop di
xchg edx, esi
mov dl, dh
jmp 0x111af03
btr ecx, edx
mov ah, byte [esp + 1]
xchg byte [esp], al
pushal
xchg word [esp + 7], si
add esp, 0x19
jmp 0x111aeea
pop word [esp + 8]
bsf si, ax
lea esp, [esp + 4]
jmp 0x111afb5
cpuid
lea esi, [ecx + 0xeb]
pop ax
rdtsc
not edx
jmp 0x111af4e
rol si, cl
not esi
inc al
sub esp, 0x12
bswap edi
mov eax, 0xf309e056
jmp 0x111af64
lea ebx, [ecx*4]
btc eax, ebx
mov bh, byte [esp + 5]
setnp ch
pop word [esp + 3]
mov word [esp + 3], dx
jmp 0x111af7b
pop word [esp + 8]
cpuid
mov cl, 0x2a
mov esi, ebp
xchg word [esp + 6], dx
push word [esp + 2]
jmp 0x111c29a
mov dword [esp + 4], ebp
pop dword [esp]
lea esp, [esp + 3]
bsf dx, si
jmp 0x111af39
mov edi, ebp
rdtsc
mov ebp, 0xe27995d0
xchg dword [esp + 0xb], esi
xchg word [esp + 7], si
Function at 0x111b168
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop cx
sub esp, 0x1e
xchg dh, al
neg bh
lea esp, [esp + 4]
pop esi
jmp 0x111b08d
pop cx
push word [esp + 6]
mov ah, byte [esp + 7]
pop dword [esp]
xchg dword [esp], ecx
xchg byte [esp + 2], dl
jmp 0x111afef
push word [esp + 1]
cpuid
push dword [esp + 2]
pop dword [esp + 4]
mov ax, word [esp + 8]
xor si, 0x1484
jmp 0x111b00f
mov dl, dh
lea edi, [esp + eax]
lea edx, [ecx + ebx]
rdtsc
mov ecx, esi
lea esi, [ebx + ebx]
jmp 0x111b143
xchg dword [esp + 0xf], ebp
add esp, 0x15
pop word [esp + 1]
cpuid
mov dx, word [esp + 2]
jmp 0x111b045
push dword [esp + 4]
xchg byte [esp + 0x12], bl
xchg dword [esp + 0x14], ebp
rol si, cl
xchg edi, ecx
jmp 0x111b05b
not edi
xchg word [esp + 7], bx
push word [esp + 0x17]
mov word [esp + 9], dx
xchg edi, eax
mov al, ah
jmp 0x111b074
mov dword [esp + 4], eax
lea ebx, [edi*4]
not cx
sub esp, 0x1c
btc ebp, ebx
jmp 0x111b109
mov bl, bh
sub esp, 0xa
shr ch, 5
rdtsc
mov cl, ch
pop si
jmp 0x111b0a3
mov ch, byte [esp]
lea esp, [esp]
mov edi, 0xdc8e1e1c
mov ebx, dword [esp]
neg ecx
stc
jmp 0x111b0c1
bsr bp, cx
mov si, 0xa5c3
rdtsc
cpuid
jmp 0x111b18f
push word [esp + 0x1b]
xchg ebx, ebp
cpuid
bswap ebp
push esp
pop word [esp + 0xf]
jmp 0x111b0f3
mov eax, 0x6913ff0
cmc
bsf bp, ax
add esp, 0
lea esp, [esp]
add esp, 0
jmp 0x111b0e0
xchg ecx, eax
lea esp, [esp + 9]
mov ebx, dword [esp]
mov si, 0xbe4b
rdtsc
mov ebx, ebp
jmp 0x111b123
clc
add esp, 9
pop eax
mov eax, esi
btc ecx, ebx
jmp 0x111b02a
bswap ebp
cpuid
mov ah, byte [esp + 0x18]
xchg bh, cl
neg edi
bswap ebx
jmp 0x111b31e
mov di, word [esp + 0x1e]
bsr cx, bp
add esp, 0x10
mov edi, dword [esp + 9]
rcl di, cl
push dword [esp + 0x11]
jmp 0x111b177
mov byte [esp + 0xd], bh
push word [esp + 0x18]
push word [esp + 0xf]
add esp, 0x1a
pop di
btc esi, edi
call fcn.0111b2c9
btr edx, edx
xchg byte [esp + 0xf], bl
pop di
xchg bh, cl
mov bp, 0x7adf
xchg ah, bl
jmp 0x111b365
mov eax, esi
pop dword [esp + 0x32]
and edi, ecx
lea eax, [eax + 0x89]
xor ebp, esi
setne ah
jmp 0x111b3e0
mov al, ah
setae dh
sub bl, ah
xchg word [esp + 0x13], di
add esp, 0x27
mov bh, byte [esp + 4]
jmp 0x111b409
bswap edx
pop word [esp + 9]
cld
xchg byte [esp + 0x20], al
pop dword [esp + 0x18]
xchg esi, edi
jmp 0x111b3a1
neg ax
pop edx
rcl bp, cl
mov ax, dx
cld
mov dh, byte [esp + 7]
jmp 0x111b3bb
xchg ebx, eax
lea ebp, [edi*4]
setle dh
call fcn.0111b441
mov byte [ecx - 0x2f], 0xb0
inc ebx
test al, 0x80
btr ebp, esp
mov byte [esp + 5], dh
push word [esp + 3]
xchg byte [esp + 2], bl
mov dword [esp + 2], esi
xchg di, bp
jmp 0x111b3f1
Function at 0x111b24c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, ebp
mov ax, word [esp]
bsf di, si
lea esp, [esp]
jmp 0x111b254
xchg ecx, ebx
ror ch, 5
mov dl, dh
add esp, 1
xchg byte [esp], al
mov bx, 0x977b
jmp 0x111b1f6
xchg word [esp + 3], cx
lea esp, [esp + 3]
add esp, 1
mov edi, eax
rdtsc
xchg dx, cx
jmp 0x111b20c
rdtsc
mov dx, 0x96f
jmp 0x111b22e
mov bx, 0xd673
mov si, word [esp]
bsr ax, bp
mov bl, bh
push esp
jmp 0x111b29f
xchg ecx, eax
bsr bp, cx
btc eax, edi
xchg dx, bx
lea ebp, [esi + edi]
sub esp, 0x16
jmp 0x111b306
sub bx, 0x1ac8
not ecx
mov cx, word [esp]
lea edi, [edi*4]
mov si, bx
pop word [esp]
jmp 0x111b27e
mov word [esp + 0x16], di
lea esp, [esp + 0xb]
mov bx, 0x6589
pop dword [esp]
setle ch
call fcn.0111b2ce
mov esi, 0xdc862889
xchg ah, bl
mov byte [esp + 3], ah
lea esi, [edx + ebp]
cmc
pop dword [esp + 9]
push edx
jmp 0x111b2eb

Function at 0x111b2c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp + 4]
and ebx, ecx
push dword [esp + 5]
pop dword [esp]
xchg byte [esp + 2], dl
push edx
jmp 0x111b26d
rdtsc
pop word [esp + 4]
mov ax, 0xf3a3
bswap ebp
rdtsc
xchg cx, ax
jmp 0x111b1ba
add esp, 9
mov word [esp], bx
add eax, ebp
setg bh
call fcn.0111b24c
jmp 0x111b1e2

Function at 0x111b6db
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push word [esp + 3]
lea edi, [ebp - 0x6f]
cld
add esp, 9
push word [esp + 7]
jmp 0x111b63d
rdtsc
and ebp, ecx
jmp 0x111b668

Function at 0x111b78c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 9], ecx
lea edx, [esi*4]
pop ebx
xchg byte [esp + 8], cl
jmp 0x111b761
mov cx, 0xbd8b
xchg byte [esp + 1], bl
mov ax, 0x499
clc
push esp
lea edi, [ecx*4]
jmp 0x111b716
mov word [esp + 4], bx
not ah
mov eax, 0xc2f20376
popal
pop dx
btr ecx, esp
jmp 0x111b730
mov esi, 0x5094a2e
pop word [esp + 9]
mov bx, 0x2ad7
push dword [esp + 4]
push dword [esp + 0xa]
mov dword [esp + 7], esi
jmp 0x111b83b
pushal
add bp, 0x65de
xchg bh, cl
jmp 0x111b74d
bswap edx
lea edx, [esi + 0x4d]
mov esi, dword [esp + 9]
xchg word [esp + 0xb], dx
popal
rdtsc
jmp 0x111b7d2
mov si, sp
mov bp, word [esp + 0xa]
stc
xchg edi, edx
mov word [esp + 0x10], bx
bswap ebx
jmp 0x111b796
cpuid
mov cl, 0xea
call fcn.0111b81c
sti
adc dword [ebx], 0x76
test dword [edx - 0x3d], ebp
inc esp
fidivr dword [ebp + 0x7071ac4c]
jae 0x111b855
inc cx
mov word [esp + 0x14], di
sub esp, 0xa
mov byte [esp + 0xc], ch
mov word [esp + 0x12], bx
pop dx
jmp 0x111b7be
cmc
mov ch, byte [esp + 0x13]
mov byte [esp + 0x16], ch
lea edi, [edx + edx]
xchg word [esp + 0xf], cx
not ax
jmp 0x111b7eb
pop word [esp + 1]
mov cl, ch
rdtsc
mov ebp, esi
mov cx, word [esp + 6]
mov word [esp + 0xa], dx
jmp 0x111b806
fisttp qword [ebp - 0x32f0d0cc]
Function at 0x111b8e0
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x1117141
call fcn.01117146
movzx ebx, word [eax + 0x3c]
jmp 0x111bb66
clc
jmp 0x111b8fb
lea esp, [esp + 4]
push edx
pop word [esp]
call 0x111b8e0
and byte [esi - 0x77], 0x64
and al, 2
jmp 0x111b94b
cld
mov word [esp], di
lea esp, [esp + 4]
popfd
jmp 0x111b8d1
push dword [esp]
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp], eax
pushal
pop word [esp + 0x13]
jmp 0x111bc01
mov byte [esp + 4], dh
push dword [esp + 2]
mov dword [esp + 1], ecx
pop dword [esp]
mov word [esp + 2], sp
jmp 0x111b932
push esp
pop word [esp]
mov word [esp], bx
push word [esp + 1]
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x111bb5d
push dword [esp + 0xa]
mov word [esp + 0xe], sp
mov dword [esp + 1], ecx
mov dword [esp + 0x11], ebp
mov dword [esp + 5], ecx
mov dword [esp + 0x1c], ecx
jmp 0x111b981
mov dword [esp + 0x1c], edx
call fcn.0111ba10
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x111bbd9
je 0x111b0d1
sub eax, 0x10000
jmp 0x111bb91
cmp word [eax], 0x5a4d
jmp 0x111bb73
je 0x1116304
jne 0x111bb79
dec esp
invalid
push edx
pushal
lea esp, [esp + 0x42]
pushal
pop dword [esp + 0xe]
mov byte [esp + 0x17], bh
jmp 0x111b9ac

Function at 0x111bb28
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
call fcn.0111b007
mov eax, dword fs:[0x30]
jmp 0x111bb46
lea esp, [esp + 3]
mov dword [esp], ecx
pop word [esp]
lea esp, [esp + 3]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x111bae1
mov byte [esp + 3], bh
jmp 0x111bafa
mov eax, dword [eax + 0x1c]
jmp 0x111bba6
mov eax, dword [eax + 0xc]
jmp 0x111bb2e
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x111b002
Function at 0x1002f60
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1013775
call fcn.01013650
sub esp, 0x224
mov eax, dword [0x10171b0]
push esi
push edi
push 0xfa1
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
cmp eax, edi
je 0x1002fd7
cmp dword [esi], edi
jne 0x10030db
push 0x34
call fcn.01012145
pop ecx
mov dword [ebp - 0x22c], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x1002fb8
push 3
mov ecx, eax
call fcn.0100ecb8
jmp 0x1002fba
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi], eax
je 0x1002fd7
push eax
call fcn.0100ecdc
test eax, eax
jge 0x1002fde
push dword [esi]
call fcn.0100fdf9
mov dword [esi], edi
xor eax, eax
jmp 0x10030de
push 0x20019
call sym.mobsync.dll_RegGetHandlerTopLevelKey
cmp eax, edi
mov dword [ebp - 0x22c], eax
je 0x1003079
push ebx
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x228]
push ecx
push edi
mov dword [ebp - 0x230], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
jmp 0x1003064
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x100304a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call fcn.0100ed0a
test eax, eax
jne 0x100304a
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
push dword [esi]
call fcn.0100f9b8
inc dword [ebp - 0x230]
push ebx
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x1003014
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
pop ebx
lea eax, [ebp + 8]
push eax
push 3
push dword [esi]
call fcn.0100f97a
jmp 0x10030aa
push edi
push edi
push 0x100
push edi
push dword [ebp + 8]
push dword [esi]
call fcn.0100fa52
lea eax, [ebp + 8]
push eax
push 3
push dword [ebp + 8]
push dword [esi]
call fcn.0100efc9
test eax, eax
je 0x1003088
lea eax, [ebp + 8]
push eax
push 5
push dword [esi]
call fcn.0100f97a
jmp 0x10030d7
push dword [ebp + 8]
push dword [esi]
call fcn.0100fe1b
lea eax, [ebp + 8]
push eax
push 5
push dword [ebp + 8]
push dword [esi]
call fcn.0100efc9
test eax, eax
je 0x10030bd
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0101206b
leave
ret 8

Function at 0x100463b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1001624
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004690
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push 0x10000002
push 0x1001610
push esi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueA]
test eax, eax
jne 0x1004687
inc esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x7fff0001
add eax, 0x8000ffff
pop esi
leave
ret 8