joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7907d072
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl dh, cl
pushfd
mov dword [esp], 0x610a7e9a
imul ecx, eax, 0x2e
lea eax, [edi*2 - 0x2d10767b]
mov edx, dword [ebp - 0x20]
bswap ax
movzx eax, word [edx + ecx]
pop ecx
ror ch, cl
rcr cx, 1
mov dword [ebp - 0x7c], eax
cmc
ror ch, 5
movzx eax, cl
mov eax, 1
bt ebx, edi
ror cx, cl
rol cx, 0xe
imul ecx, eax, 0x30
ror ah, 3
add ecx, dword [ebp - 0x20]
bswap eax
lea eax, [ecx - 0x45ee6445]
call fcn.790ecd22
bts ax, cx
sets dl
cmc
mov edx, dword [ebp - 0x20]
pushfd
cmc
clc
movzx eax, word [edx + ecx]
btr cx, ax
movsx dx, al
mov dword [ebp - 0x70], eax
ror ecx, cl
rcl eax, cl
mov eax, 1
jmp 0x79095d90
rcl eax, cl
rol al, 1
movzx eax, word [edx + ecx]
lea ecx, [ebx + 0x2efed4c]
mov dword [ebp - 0x78], eax
rdtsc
lea esp, [esp + 0xc]
jnp 0x790c4856
cmc
mov eax, 1
pushal
lea esp, [esp + 0x20]
jb 0x7902e858
movsx cx, bl
movzx ecx, dl
imul ecx, eax, 0x2e
rol dh, cl
mov edx, dword [ebp - 0x20]
btc ax, bx
movzx eax, word [edx + ecx]
movzx cx, al
setae ch
mov dword [ebp - 0x7c], eax
movzx cx, dl
movzx cx, dl
mov eax, 1
movzx cx, al
ror cx, cl
movzx cx, bl
bswap ecx
imul ecx, eax, 0x30
bts ax, dx
cmp cl, bl
bsr eax, ebx
add ecx, dword [ebp - 0x20]
mov ax, ax
cwde
mov dword [ebp - 0x80], ecx
pushfd
pushal
xchg cx, ax
call fcn.7913033b
push edx
push dword [esp]
lea esp, [esp + 8]
movss dword [esp], xmm0
bswap ax
cmc
mov eax, 4
jmp 0x79131970
movzx ecx, cl
xchg cl, dl
rcr ch, 3
imul ecx, eax, 0x2a
lea esp, [esp + 0x44]
push eax
xchg dl, ah
pushfd
mov dh, bl
mov edx, dword [ebp - 0x20]
rcr eax, 0x13
rcl ax, 3
movzx eax, word [edx + ecx]
sete ch
rcr cl, 1
mov dword [ebp - 0x74], eax
rdtsc
lea eax, [esi - 0x4ffc675b]
movsx dx, al
clc
mov eax, 1
rcl cx, 3
rol edx, cl
setg ch
imul ecx, eax, 0x2c
ror ah, cl
pushfd
rol ah, cl
mov edx, dword [ebp - 0x20]
bts eax, 9
jmp 0x7907efac
lea esp, [esp + 4]
movss xmm0, dword [ebp + eax - 0x50]
push 0xcfd77b8f
push ecx
jmp 0x790309cd
push 0xd84b527c
cmc
shl eax, 0
pushfd
mov dword [esp + 4], ecx
jmp 0x79113bb4
Function at 0x7908417f
Capabilities:
Packed with generic packer

Disassembly:
stc
mov eax, dword [edx + ecx]
call fcn.791696d6
dec esi
rcl al, cl
je 0x790841cc
pop es
xor byte [edx + 0x54], cl
cmp al, 0xf2
jbe 0x79084159
or al, 0x8e
adc ch, byte [eax + 0x51907b1]
imul ebp, dword [edx + 0x2e], 0xfffffffd
rol edi, cl
sbb dword [0xd42ae93], edi
inc ebx
dec edi
xchg byte [ecx + 0x1b], bl
sar byte [eax + 0x42], cl
inc esi
test al, 3
xor eax, 0xed6ab5f3
sub al, 0x84
aam 0x46
or edx, eax
mov edx, 0xc209414e
std
push 0xffffffffffffffbf
retf
xchg ebx, eax
mov cl, 0x78
dec ebp
adc al, 0x67
cmp eax, dword [esi - 0x424bd7bc]
mov dl, 0xe6
leave
jo 0x790841e2
scasd eax, dword es:[edi]
bound ebp, qword [eax + 0x232db2c0]
ja 0x790841d8
mov dl, 0x2d
and esi, dword [edi - 0xf]
mov eax, 0xcc5cfec
pop ds
outsd dx, dword [esi]
jns 0x79084232
dec eax
add al, 0x87
cmp esp, edi
xchg esi, eax
xor eax, 0x8a213bbc
ja 0x790841a2
push edi
xor byte [edx + 0x1b], al
invalid
xchg byte [esp + ecx*2 + 0x1f924fe0], dh
jle 0x7908424e
mov ecx, edx
and eax, 0x43ad5f8a
call 0x2ffd83b3
jnp 0x7908428e
pop esp
in eax, dx
jbe 0x790842c8
pushal
enter 0xffffffffffffedfb, 0x31
mov bh, 0x1b
bound ebx, qword [esi]
test dword [ebx - 0x20], ecx
out 0x3b, al
cli
inc eax
in eax, dx
inc edx
xchg edi, esi
sub al, 0xee
adc bl, al
bound esp, qword [esi - 0x2e]
jge 0x7908425d
or eax, 0xba557a2
pushfd
int1
out dx, eax
mov cl, 0x61
loop 0x790842ca
sti
invalid
pop esi
add al, 0x7d
out 0x23, al
inc edi
sub eax, dword [esp + ebp - 0x6c6b4976]
bound esi, qword [ecx - 0x22]
add edi, dword [0x3a197cc3]
loopne 0x7908423b
push eax
retf
push edi
dec ecx
neg dword [eax - 0x30]
leave
add al, 0xf
adc esp, esi
or al, 0xef
add dword [ebx - 0x46f632fc], ebp
push es
pushal
xchg dh, dh
popal
test dword [ebx], 0x4d475608
bound esi, qword [esi - 0x22]
inc ebp
pushfd
sub eax, 0x1cc53782
adc byte [ebp - 0x3a], bh
sbb esp, ecx
or byte [ecx - 0xa], bl
cli
mov fs, word [edx + 0x75cfa9ca]
dec ebx
cmp eax, 0xbfe65db4
int 0xb3
mov edx, 0x64439d3e
push edx
cli
lodsd eax, dword [esi]
rol dword [esi], cl
retf

Function at 0x790897ce
Capabilities:
Encrypt data using tea

Disassembly:
test ah, 0x44
jmp 0x791325a8
push 0xd5faf96d
lea esp, [esp + 4]
ucomiss xmm0, dword [0x79059738]
pushfd
mov ah, bl
setl ah
lahf
pushfd
pushfd
lea esp, [esp + 0xc]
jmp fcn.790860ef
pushal
lea esp, [esp + 0x28]
jnp 0x79081063
shld eax, esi, 0x1d
mov eax, 4
pushal
bt ax, 0xa
cmp dx, 0x9d2e
mov word [esp + 8], bp
shl eax, 0
mov byte [esp + 0x10], al
lea esp, [esp + 0x20]
movss xmm0, dword [ebp + eax - 0x40]
jmp 0x7912c56c

Function at 0x790947e2
Capabilities:
Write file on windows

Disassembly:
jmp 0x79116a65
lea esp, [esp + 0x3c]
call fcn.7903d9b0
aam 0x2f
movzx ax, bl
shr ah, 3
add esp, 0x10
mov eax, edi
pushal
call fcn.790f3d76
mov ecx, dword [ebp + 8]
jo 0x79015788
pushal
mov word [esp + 0x10], si
lea esp, [esp + 0x20]
call fcn.79017b40
daa
mov eax, dword [ebp - 0x64]
cmp dh, 0x1b
shr ch, cl
inc ch
or eax, 1
movsx ecx, bl
bswap cx
bswap ecx
push esp
mov dword [ebp - 0x64], eax
not ch
mov dword [ebp - 4], 0xffffffff
pushal
call fcn.7910d40c
Function at 0x79095448
Capabilities:
Packed with generic packer

Disassembly:
pushal
test eax, eax
jmp fcn.791773f5
push dword [esp + 8]
mov dword [esp + 0xc], ecx
pushfd
pushal
lea esp, [esp + 0x30]
jp 0x790bf058
call fcn.790390a0
call fcn.790788e7
pushfd
mov byte [esp], 0xce
push 0x49263b88
mov dword [esp + 4], 0x809bce7d
mov word [esp], 0x9aa1
pushfd
mov dword [esp + 4], 0x334906a
push 0x344b304f
lea esp, [esp + 8]
jmp fcn.7900e6ba
push 0x6e5b698e
lea esp, [esp + 8]
call fcn.790390a0
clc
add esp, 0xc
push 0x985475f8
pushfd
pushfd
mov dword [0x79070550], 0x7906c2c0
push eax
mov word [esp], 0x729b
pushal
lea esp, [esp + 0x30]
call fcn.7914a878
pushal
mov dword [esp], edi
movzx eax, al
test dl, bl
pushfd
jmp 0x7908c1d6
push ebx
jmp 0x7909c9e2

Function at 0x79096418
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 8], cl
mov byte [esp + 0x14], 0xc6
lea esp, [esp + 0x38]
call fcn.79039e56
push 0x27508f45
mov word [esp], ax
mov esp, ebp
movzx bp, dl
call fcn.790774f4
pushfd
xchg dword [esp + 0x44], eax
movzx ax, al
pop eax
call fcn.79122aca
mov ecx, dword [ebp - 0xc]
jmp 0x79178c11
mov ebx, dword [esp + 0x34]
rol ecx, cl
mov ecx, dword [ebp - 0x10]
bt ecx, 3
cmc
cmc
mov byte [esp], 3
xor ecx, ebp
jmp 0x7908ef88
setnp bl
mov dword fs:[0], ecx
pushal
bt si, bp
bswap cx
mov ecx, dword [esp + 0x28]
clc
xadd bx, di
test ah, ch
ror bh, 2
mov edi, dword [esp + 0x2c]
and esi, 0x4c2447d
lea esi, [ecx + 0x29c8f635]
ror cx, 0xe
mov esi, dword [esp + 0x30]
btr bx, 6
btc bx, 8
jmp 0x790ca516

Function at 0x790975e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7913e82b
not cx
mov cl, 0xa4
pushfd
mov ecx, dword [ebp - 0x1a8]
lea esp, [esp + 4]
jg 0x7913cb31
pushal
push dword [esp]
mov dword [esp], ebx
lea esp, [esp + 0x24]
call fcn.79008190
not ch
bswap cx
setp cl
pushfd
mov dword [esp], 0
bswap cx
pushal
lea ecx, [ebp - 0x5c]
jmp 0x7911ab57
pushal
lea esp, [esp + 0x40]
call fcn.7901aeb0
cmp dh, 0x69
rcr dl, cl
push edx
rcl dl, 4
sub esp, 0x14
call fcn.7909c9ca
pushal
mov byte [esp], 0xcd
lea esp, [esp + 0x20]
call fcn.79008190
push esp
push 0x2bbb30d8
not cl
mov dword [esp + 4], 0
movzx cx, al
call fcn.7918b8aa
push ecx
jmp 0x7909e57a
pushal
push 0x457fcc57
lea esp, [esp + 0x2c]
je 0x7909b4cd
lea ecx, [esi*4 - 0x115ee852]
bswap ecx
push 0x1c
jmp 0x790cbdb7

Function at 0x79099939
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx cx, bl
mov ecx, dword [ebp - 8]
jmp 0x790b6fa0
mov dword [esp + 4], ecx
pushal
jmp 0x790ddf70
mov dword [esp], ecx
lea esp, [esp + 0x24]
call fcn.790c5273
stc
bt esi, 0x1a
cmc
add esp, 8
pushal
mov dword [esp], 0xb657f293
pushfd
lea esp, [esp + 0x24]
jmp 0x79098f9f
Function at 0x7909af5c
Capabilities:
Encrypt data using tea
Execute anti-debugging instructions

Disassembly:
pushal
mov word [ebp - 0x392], ax
pushfd
xor eax, eax
call fcn.79078354
xor esi, 0x62a28ab1
call fcn.7912d1af
sub ecx, dword [ebp - 0x14]
das
bt ebp, 7
shld dx, ax, cl
mov edx, dword [0x7906f2d4]
lea eax, [eax*2 + 0x3fece50d]
mov dword [edx + 0xf0], ecx
bsf ax, bp
movzx eax, cl
clc
sbb ax, bx
mov eax, 0x69
cmc
pushfd
mov word [esp], 0xb404
clc
mov word [ebp - 0x398], ax
clc
add al, al
mov eax, 0x6e
stc
cmp bl, cl
mov word [ebp - 0x396], ax
sal al, 6
inc ax
mov eax, 0x75
clc
mov word [ebp - 0x394], ax
rcl ah, 7
jmp 0x790c0365
mov ecx, dword [eax + 0xec]
sal al, 1
aad 0xe2
cwde
rdtsc
sub ecx, dword [ebp - 0x14]
aaa
mov edx, dword [0x7906f2d4]
shr ah, cl
cwde
bt esp, ecx
bts ax, 0xe
mov dword [edx + 0xec], ecx
cwde
pushal
test dx, di
mov eax, dword [0x7906f2d4]
shr edx, cl
xchg cl, dl
mov ecx, dword [eax + 0xf0]
pop edx
stc
jmp 0x79098453
xor eax, eax
jmp 0x7918a1b3
mov eax, 0x61
test ah, 0xf0
push 0x2ad281a7
jmp 0x790dfa6f
sub esp, 0xffffffd4
jge 0x79086425
mov word [ebp - 0x392], ax
cmc
pushal
jmp 0x790bdb0f
mov word [ebp - 0x390], ax
pushfd
mov byte [esp + 0xc], dl
mov word [esp], 0xde6c
lea esp, [esp + 0x28]
jmp 0x790b9ad3
pushfd
jmp 0x79163001

Function at 0x790a3a4b
Capabilities:
Encrypt data using tea

Disassembly:
jmp 0x7918596a
pushal
push 0xd120e22b
lea esp, [esp + 0x24]
movss xmm0, dword [ebp - 0x64]
push 0x3b49d223
call fcn.7908e457
push edx
pushal
mov dword [esp], 0xab8ee478
mov byte [esp], bl
lea esp, [esp + 0x24]
call fcn.7910508c
push edi
not di
lea edi, [ebp*8 + 0x3069c5c1]
movsx si, dl
mov byte [0x7906f230], 1
lea esp, [esp + 4]
movsx si, bl
pushal
mov word [esp], ax
call fcn.79161f1a
lea esp, [esp + 0x24]
movss xmm0, dword [ebp + ecx - 0x60]
pushfd
push 0xde4da513
pushfd
lea esp, [esp + 0xc]
movss dword [ebp - 0x6c], xmm0
sal ah, cl
mov eax, 4
cmp dh, ah
stc
shl eax, 0
pushal
push eax
pushal
push 0x4acd18d3
lea esp, [esp + 0x48]
movss xmm0, dword [ebp + eax - 0x60]
pushfd
push dword [esp]
push dword [esp]
lea esp, [esp + 0xc]
movss dword [ebp - 0x70], xmm0
jge 0x79161e95
movss xmm0, dword [ebp - 0x64]
lea esp, [esp + 4]
call fcn.790a61c8
lea ecx, [0xf40f140a]
not al
xchg cl, al
rol cl, cl
mov eax, 4
pushal
imul ecx, eax, 0
push dword [esp]
mov word [esp + 4], 0x4b9a
jmp 0x79180366
Function at 0x790a4210
Capabilities:
Encrypt data using tea

Disassembly:
mov byte [esp], bh
push esi
lea esp, [esp + 0x48]
jge 0x7915f15b
je 0x7912d7ce
aad 0x4d
daa
shr ch, 2
mov eax, dword ss:[ebp - 0x10]
movzx edx, al
and dx, si
inc cl
bts dx, bp
shl eax, 4
and ch, 0xf6
pushal
rol ch, 5
mov ecx, dword ss:[ebp - 0x10]
movzx edx, bl
movsx edx, dl
sbb dx, 0x8450
cmc
shr ecx, 5
xor dx, bp
or dx, 0x70c
xor eax, ecx
xchg dl, ch
xor dl, 8
mov edx, dword ss:[ebp - 0x10]
sbb ch, ch
sar ecx, 0x1b
xor edx, dword ss:[ebp - 4]
not ch
add eax, edx
dec dh
mov ecx, dword ss:[ebp - 4]
bts dx, 4
rcl dh, 1
inc dh
shr edx, 0xc
and ecx, 3
pushal
not dx
mov edx, dword ss:[ebp + 8]
clc
add eax, dword ds:[edx + ecx*4]
add esp, 0x40
jp 0x790c490b
bsr dx, cx
mov ecx, dword ss:[ebp - 8]
rcr dl, cl
and dh, al
neg dl
add dl, al
add ecx, eax
bt eax, esp
mov dword ss:[ebp - 8], ecx
xadd ecx, eax
lea edx, [ecx + 0x2ecdc33f]
shld dx, si, 0xb
rol ax, cl
mov edx, dword ss:[ebp - 4]
call fcn.79078925
call fcn.79133ca9

Function at 0x790a9a93
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jno 0x790b5898
add esp, 0xc
pushfd
mov dword [0x79070550], 0x7906c2c0
push dword [esp]
lea esp, [esp + 8]
call fcn.7914a878
push 0xaec859b1
cmp eax, edx
movzx eax, al
mov byte [esp], ah
pushal
test eax, eax
mov byte [esp], 0x91
mov byte [esp], bh
jmp 0x79156c7e
clc
add esp, 0xc
pushal
jmp fcn.790ffa99
push 0x7608d133
jmp 0x7917f18d
lea esp, [esp + 0x24]
jne 0x79102131
lahf
pushal
push ebx
cwde
lea esp, [esp + 0x24]
popal
pushfd
lea esp, [esp + 4]
jnp 0x791096d1
pushal
pushfd
lea esp, [esp + 0x24]
leave
push 0x61ea1251
pushal
pushfd
push dword [esp]
push dword [esp + 0x2c]
ret 0x3c
push dword [esp]
lea esp, [esp + 8]
leave
push 0x3b78adb2
mov word [esp], 0x3fc1
push esi
pushal
push dword [esp + 0x28]
ret 0x38

Function at 0x790aa1a9
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
bt di, 0xe
mov byte [ebp - 0x91], 1
lea esp, [esp + 0x24]

Function at 0x790ae64d
Capabilities:
Packed with generic packer

Disassembly:
push esi
pushfd
jmp 0x79186429
call fcn.79023c04
lea esp, [esp + 0xc]
je 0x7911311e
jmp 0x790eebd1

Function at 0x790affb5
Capabilities:
Encrypt data using tea

Disassembly:
lea esp, [esp + 4]
call fcn.7903bb8a
cmc
pushfd
stc
and eax, 0x80000fff
jmp 0x7915002b
pushfd
lea esp, [esp + 8]
jns 0x7911912d
pushal
dec eax
pushal
or eax, 0xfffff000
lea esp, [esp + 0x40]
jne 0x79162df9
pushal
pushfd
push dword [esp]
inc eax
add esp, 0x28
cmp ecx, ecx
add eax, 0x8000
push 0xa4b84357
pushal
mov word [esp], bx
mov dword [ebp - 0x10], eax
lea esp, [esp + 0x24]
jp 0x791860ce
pushfd
mov byte [esp], ch
lea esp, [esp + 4]
call fcn.79166629
test bl, 0x9f
pushal
stc
jmp 0x7912b581
jmp 0x79119107
pushfd
inc eax
clc
bt ax, di
add eax, 0x8000
mov byte [esp], 0x32
call fcn.79169ebb
push 0xd161ff3d
pushal
jmp 0x79154a26

Function at 0x790b0259
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.7916e47e
xor edx, 0x993e5a3e
bt si, ax
xor dword [esp + 8], 0x81
call fcn.790a7250
Function at 0x790b031a
Capabilities:
Encrypt data using tea
Execute anti-debugging instructions

Disassembly:
clc
push eax
shrd dx, di, cl
mov eax, dword [0x7906f2d4]
pushal
lea esp, [esp + 0x30]
call fcn.7903a2c0
bts eax, 0x1e
jmp 0x790b99db
bswap cx
lahf
add esp, 0xc
aas
not dh
mov eax, dword [0x7906f2d4]
movzx cx, cl
push esi
mov ecx, dword [eax + 0xec]
aad 0x96
rcl dx, 0xf
sub ecx, dword [ebp - 0x14]
clc
daa
mov edx, dword [0x7906f2d4]
sar al, cl
lea eax, [edx - 0x67b2ce78]
clc
mov dword [edx + 0xec], ecx
add esp, 4
ja 0x79089fb1
daa
das
mov eax, dword [0x7906f2d4]

Function at 0x790b3ada
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xe362944b
mov ecx, dword [ebp - 0x98]
pushal
call fcn.790225c2
jmp 0x7912aadb
mov byte [ebp - 0x59], 1
push 0xed00be27
lea esp, [esp + 4]
jmp 0x790e7bb6
stc
rdtsc
mov byte [ebp - 0x59], 0
rdtsc
mov ecx, dword [ebp - 0x18]
btc dx, ax
pushal
movzx edx, byte [ecx]
add ah, bh
bsf ax, bx
sar ax, 3
movzx eax, byte [ebp - 0x59]
test dl, 0xb
clc
stc
call fcn.79031439
pushfd
push 0xf9a0d037
lea esp, [esp + 0x10]
jge 0x790e7baf
jmp 0x790db5a5
jmp 0x790b3ac9
push 0x7343931e
clc
bt ax, 7
cwde
push edx
bt dx, 0xf
test eax, eax
jmp 0x790fa22f

Function at 0x790b69f4
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov byte [ebp - 0x144], 0x12
jmp 0x79130901
call fcn.790f5025
pushal
pushfd
pop dword [esp + 0x1c]
mov byte [esp + 8], dh
xor esi, 0x2a7ab199
call fcn.79084fd6

Function at 0x790b734f
Capabilities:
Access peb ldr_data

Disassembly:
cwde
and al, 0x89
bswap ax
push ebp
bts ax, dx
btr bp, 8
mov ebp, esp
das
and eax, 0xdc5fb2e0
sub esp, 0x40
pushal
xor al, 0xc4
mov dword [esp + 0x1c], ebx
or al, bl
aad 0xb3
lea eax, [ebp*4 + 0x14d7954c]
mov dword [esp + 0x18], esi
movzx eax, al
shld ax, si, cl
mov dword [esp + 0x14], edi
setae al
dec ax
inc ah
lea eax, [ebp*2 + 0x4a15f81a]
movzx eax, byte [0x7906f431]
test ch, 0x1e
pushal
test eax, eax
jmp 0x7917ca20
pushfd
call fcn.790d9bca
lea esp, [esp + 0x34]
jne 0x790d7ad5
pushfd
mov byte [esp], 0x67
lea esp, [esp + 4]
jmp 0x790b0254

Function at 0x790b73ac
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
call fcn.7901cb10
add cx, si
mov ecx, dword [eax]
not eax
mov ah, dl
mov dword [ebp - 0x88], ecx
pushal
push 0x7aef211c
aad 0xcb
mov eax, dword [ebp - 0x88]
dec ch
adc cx, 0x7d37
add eax, 1
pop ecx
not cl
push dword [esp]
movzx cx, dl
mov dword [ebp - 0x8c], eax
pushal
mov dword [esp + 0x40], 4
movsx cx, dl
movzx cx, cl
lea ecx, [ebp - 0x90]
lea esp, [esp + 0x40]
jge 0x7917472a
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.79008190
movzx ax, al
pushfd
bswap ax
movsx ax, bl
lea eax, [ebp - 0x90]
jmp 0x790dd7c4
jmp 0x790b2ed2
pushal
push ecx
lea esp, [esp + 0x24]
call fcn.79008190
cwde
push 0x98d0a7df
pushal
movsx cx, bl
lea eax, [ebp - 0x90]
pushal
not cl
mov dword [esp + 0x40], eax
lea ecx, [ecx + 0x63bfb3bf]
lea ecx, [ebp + 0x39044a7d]
jmp 0x7913b495
Function at 0x790ba369
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
bt si, 9
clc
cmp dword [ebp - 0x90], 0x429
mov byte [esp], cl
lea esp, [esp + 4]
jne 0x790ba397
rcr al, cl
shrd ax, bx, cl
movzx ax, al
mov byte [ebp - 0x91], 1

Function at 0x790be7ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts cx, 1
shrd cx, si, 5
mov ecx, dword [ebp - 4]
cmc
cmc
test bl, bh
clc
xor ecx, ebp
mov dword [esp], esp
mov byte [esp + 4], 0x76
push dword [esp + 4]
push 0x4e6cc827
lea esp, [esp + 0x38]
call fcn.79039e56
call fcn.7915c3aa

Function at 0x790bf527
Capabilities:
Encrypt data using tea

Disassembly:
cmp si, 0x403e
jmp 0x7912c737
movzx eax, al
jmp 0x7907defb
mov dword [0x79070550], 0x7906c2c0
jmp 0x7913afdb
lea esp, [esp + 8]
call fcn.7914a878
pushfd
jmp 0x790b8555

Function at 0x790c0efb
Capabilities:
Encrypt data using tea

Disassembly:
not ah
lahf
pushfd
mov word [esp], 0xa680
push esp
lea esp, [esp + 0x2c]
jmp fcn.790860ef

Function at 0x790c0fd3
Capabilities:
Packed with generic packer

Disassembly:
mov esp, ebp
jbe 0x79145b0f
push ebx
lea ebp, [ecx + 0x416c8d00]
mov ebp, dword [esp + 4]
mov byte [esp + 4], ch
mov word [esp], dx
mov dword [esp], eax
push dword [esp + 8]
ret 0xc
stc
bt ax, 1
cmp dword [ebp + 8], 0x2b78
mov byte [esp], ch
lea esp, [esp + 4]
jne 0x790dacbb
sbb si, dx
btc si, si
push eax
mov byte [0x7906f475], 1
test ch, 0xc9
push edx
test ax, 0x7853
mov edi, dword [esp + 8]
inc bh
bswap ebx
shl bl, 3
add bh, 4
mov esi, dword [esp + 0xc]
push dword [esp]
or ebx, 0x909ab923
seto ch
rcr cl, 3
mov ebx, dword [esp + 0x14]
pushal
xor ch, dh
pushfd
push 0xf3ea47fb
mov ecx, dword [ebp - 4]
clc
pushfd
cmc
xor ecx, ebp
jmp 0x79180033
push 0x615ded61
mov ebp, dword [esp + 4]
push 0xc72c2db3
pushfd
pushfd
push 0x88b5887
push dword [esp + 0x18]
ret 0x1c
pushfd
mov byte [esp + 8], 0xfd
mov dword [esp + 0x10], esi
lea esp, [esp + 0x48]
call fcn.79039e56
push ecx
jmp 0x790a84e8

Function at 0x790c14b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jmp 0x79089694

Function at 0x790c3d68
Capabilities:
Encrypt data using tea

Disassembly:
call fcn.7916ef99
call fcn.7911e30b
pushal
lea esp, [esp + 0x44]
jb 0x7912a4bc
pushfd
lea esp, [esp + 4]
call fcn.7909ab66
jno 0x790281b5
pushfd
push 0xc2457a90
mov dword [ebp - 0x54], eax
pushal
push ebp
jmp 0x79099308
pushfd
mov byte [esp], 0x68
lea esp, [esp + 4]
call fcn.7909ab66
pushal
pushfd
mov dword [ebp - 0x54], eax
pushal
push 0x84ec7071
pushfd
call fcn.79117650

Function at 0x790c5273
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
aaa
daa
not cl
push ebp
and bp, 0xd968
lea ecx, [esi*2 - 0x1b6ca6a5]
test bp, bp
setbe cl
mov ebp, esp
das
cmc
call fcn.791259de

Function at 0x790c5293
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
jne 0x790ba397
call fcn.79163e09
Function at 0x790c9da0
Capabilities:
Packed with generic packer

Disassembly:
cwde
movzx bp, bl
mov ebp, esp
not ax
jmp 0x79179fd7
lea esp, [esp + 0x3c]
popal
push 0xbada2b4e
xchg dword [esp], ebp
not dx
not ebp
xchg bp, dx
ja 0x79016b2c
mov ebp, esp
movzx dx, dl
push ecx
movzx ax, dl
push ebx
pushfd
cwde
mov dword [esp], esi
lahf
dec dh
movzx ax, al
dec bh
push edi
movsx bx, cl
movsx ax, al
cdq
mov ebx, ecx
pushal
pushfd
not al
mov eax, dword ds:[0x2f0d308]
movzx dx, al
inc eax
shrd edi, esp, cl
mov edx, eax
add si, 0x464f
cmc
shld cx, cx, cl
shr edx, 8
pushfd
btc cx, sp
push dword [esp]
movzx ecx, dl
jmp 0x7910abff
setl dl
mov dword [0x7906f31c], ecx
pop eax
pushal
jmp 0x790c6a8a
stc
call fcn.79130eb4

Function at 0x790cfe5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x30], edx
rdtsc
mov cl, 0x8e
rdtsc
not al
mov eax, 1
bts ecx, esp
btc ecx, 0x11
pushfd
imul ecx, eax, 0x21
rdtsc
btr edx, 0x12
lea edx, [ebp*8 + 0x3427e4a]
mov edx, dword [ebp - 8]
bt si, dx
shr ax, cl
movzx ax, al
movzx eax, byte [edx + ecx]
sar ecx, cl
sub eax, dword [ebp - 0x30]
ror ch, 2
stc
mov ecx, 1
stc
movsx dx, dl
imul edx, ecx, 0x21
setae cl
bswap cx
movzx cx, cl
bswap cx
mov ecx, dword [ebp - 8]
jmp 0x791828b9

Function at 0x790d3ba3
Capabilities:
Encrypt data using tea

Disassembly:
jmp fcn.7902817e
call fcn.7910d694
stc
mov eax, 1
rcr edx, cl
setns dh
not dl
stc
imul ecx, eax, 0
test bl, al
push ebx
stc
pushfd
mov edx, dword [ebp - 0x10]
clc
pushfd
stc
cmp dword [edx + ecx], 0
call fcn.79030cf5
lea ecx, [ebp - 0x3c0]
push 0xa1313d6
push 0xea05006e
pushal
mov dword [esp + 8], ebx
lea esp, [esp + 0x30]
call fcn.7912ff54
lea eax, [0x81d71ef9]
xchg ch, al
lea eax, [ebp - 0x39c]
not ch
jmp 0x79111376
mov byte [esp + 4], bl
mov word [esp], 0x176b
lea esp, [esp + 0x28]
jne 0x790c5d17
daa
rcr al, cl
sub ah, bh
movzx eax, byte [0x7907031c]
cmp ah, 0x3a
test dh, cl
pushfd
test eax, eax
jmp 0x7909cfaf
call fcn.7909905e
ucomiss xmm0, dword [0x79059738]
pushfd
lahf
stc
cmc
pushal
test bp, 0x9ffa
test ah, 0x44
push dword [esp + 0x10]
push edx
mov dword [esp + 4], ebp
lea esp, [esp + 0x2c]
jnp 0x79081063
bts eax, 7
mov eax, 4
cmp di, bx
pushfd
cmp al, bl
stc
shl eax, 1
call fcn.7910d32d

Function at 0x790d55b0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
je 0x790d55d7

Function at 0x790d778a
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
cmp dword [ebp - 0x88], 0x21
jmp 0x791699a9
pushal
lea esp, [esp + 0x2c]
jne 0x790ba397
cmc
clc
bt cx, 7
pushal
cmp dword [ebp - 0x90], 0x429
push ebx
lea esp, [esp + 0x24]
jne 0x790ba397
mov ax, bx
movzx ax, bl
rcl ah, 2
mov byte [ebp - 0x91], 1
dec ax
lahf
movzx eax, byte [ebp - 0x91]
clc
stc
clc
pushfd
test eax, eax
call fcn.791804d1
pushal
pushfd
call fcn.790d182e