joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790db860
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov ecx, dword [eax + 0x40]
shld edx, esi, 1
add ecx, 0x33
rdtsc
lea edx, [esp - 0x4f1c2b04]
seto ah
not edx
mov dword [ebp - 0x250], ecx
pop eax
cwde
pop eax
xchg dl, ch
mov eax, dword [ebp - 0x250]
pushfd
push dword [esp + 8]
mov ecx, dword [eax + 1]
push 0xf9a097b0
cdq
mov dword [ebp - 0x254], ecx
rdtsc
mov eax, dword [ebp - 0x254]
jmp 0x79083836

Function at 0x790dbc46
Capabilities:
Packed with generic packer

Disassembly:
push eax
jmp 0x790eebd6
lea eax, [eax*2 + 0x1af45206]
rdtsc
mov dl, byte [esp]
mov dword [esp], 5
lea eax, [eax*4 + 0x1ccfe0f5]
mov eax, dword [0x7907044c]
movzx cx, bl
jmp 0x790cda6f
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x537e3abe]
not dx
jmp 0x79138e99

Function at 0x790e1490
Capabilities:
Encrypt data using tea

Disassembly:
daa
mov eax, dword [ebp - 0x14]
stc
add eax, 2
push dword [esp]
mov dword [ebp - 0x14], eax
pushal
lea esp, [esp + 0x28]
jmp 0x7914f343

Function at 0x790e1644
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
clc
cmp dword [ebp - 0x88], 0x21
pushal
call fcn.790c5293
push dword [esp]
pushfd
clc
cmp dword [ebp - 0x88], 0x111
pushfd
lea esp, [esp + 0x10]
je 0x790d55d7
cmc
stc
stc
cmc
cmp dword [ebp - 0x88], 0x211
pushal
pushfd
push 0x7ffc899b
lea esp, [esp + 0x28]
je 0x790d55d7
inc ax
movsx eax, al
mov eax, dword [ebp - 0x80]
push ecx
cmp ch, bh
mov byte [esp], dl
cmp al, cl
cmp eax, dword [ebp - 0x18]
pushfd
jmp 0x791587e9
pushal
lea esp, [esp + 0x28]
jne 0x790aa1b9
cmp ch, bh
push ebx
mov byte [ebp - 0x91], 1
cmp bh, bl
jmp 0x79077bc7

Function at 0x790e242d
Capabilities:
Packed with generic packer

Disassembly:
xchg ah, ch
mov byte [0x7906f40a], dl
bt esp, 0x12
jmp 0x79144669
bsr ecx, edi
inc ch
stc
mov byte [0x7906f409], al
btr ax, 0xe
mov eax, 1
add dl, cl
bsr cx, bx
bts cx, bx
shl eax, 2
rcl ch, 5
pop ecx
mov ecx, dword [ebp + 8]
seto dl
mov dl, byte [ecx + eax]
push dword [esp]
jmp 0x790be412
pop eax
mov eax, 1
stc
imul ecx, eax, 5
ror dl, 1
mov edx, dword [ebp + 8]
call fcn.79116a14

Function at 0x790e29ec
Capabilities:
Encrypt data using tea

Disassembly:
cmc
test ah, 0x44
pushal
mov dword [esp], edi
pushfd
lea esp, [esp + 0x28]
jnp 0x79081063
shrd ax, ax, cl
sbb ax, bp
mov eax, 4
stc
call fcn.790c93e1

Function at 0x790e490e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], eax
lea ecx, [edi*2 - 0xf3bf55a]
mov ecx, dword [ebp + 0x20]
mov byte [esp], 0x3e
call fcn.7903392d
Function at 0x790e6dde
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], edi
not al
rdtsc
mov dword [ebp - 8], ecx
movzx ax, bl
mov ah, 0x1c
not al
mov byte [ebp - 0x10], 0x63
bswap cx
mov byte [ebp - 0xf], 0x3a
not dx
lahf
mov byte [ebp - 0xe], 0x5c
rdtsc
lea esp, [esp + 0x1c]
jno 0x790f69e7
push ebx
not ah
mov byte [ebp - 0xd], 0x6d
lahf
bswap cx
lea ecx, [ebx*2 + 0x33f9b207]
mov byte [ebp - 0xc], 0x61
pushfd
mov byte [esp], al
xchg cx, ax
mov byte [ebp - 0xb], 0
movsx edx, cl
rdtsc
lea eax, [ebp - 0x10]
movzx dx, dl
lea edx, [ebx*2 - 0x78d8762b]
jmp 0x790f1480
mov dword [esp + 4], eax
movsx edx, cl
mov ecx, dword [ebp + 0xc]
pushfd
mov dword [esp + 4], ecx
call fcn.79031dc6

Function at 0x790e9146
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
je 0x790dacaa
jmp 0x79188452
jmp 0x7909d115

Function at 0x790eb2d6
Capabilities:
Encrypt data using tea

Disassembly:
xor edx, 0x12e8b45e
call fcn.790e52ce
mov edx, dword ss:[ebp - 4]
xchg ah, cl
bsf eax, edx
test ax, 0x92d5
bt sp, si
add edx, 0x61c88647
test cl, 0x5e
daa
add ah, bl
aam 0xd9
mov dword ss:[ebp - 4], edx
pushfd
bts ax, cx
shrd eax, esi, cl
pushfd
mov eax, dword ss:[ebp - 0x10]
clc
shld dx, dx, cl
test ch, ah
shl eax, 4
btc dx, cx
rcl cx, cl
mov ecx, dword ss:[ebp - 0x10]
pop edx
shr ecx, 5
shrd dx, cx, cl
sar dh, cl
xor eax, ecx
shr cl, 7
sal dx, cl
xor dx, 0xc7de
mov edx, dword ss:[ebp - 0x10]
test ah, bh
pop ecx
xor edx, dword ss:[ebp - 4]
push 0x536022c8
add eax, edx
dec dx
stc
sal dx, 2
mov ecx, dword ss:[ebp - 4]
movsx edx, cl
movzx dx, cl
sub dh, 0xf7
shrd dx, sp, 0xf
and ecx, 3
pushfd
mov edx, dword ss:[ebp + 8]
clc
add eax, dword ds:[edx + ecx*4]
mov ch, byte [esp]
or ch, ah
push esp
mov ecx, dword ss:[ebp - 8]
jmp 0x790fb6a8
pushal
cmp dword ss:[ebp - 4], 0
jmp 0x791126ba
sub ecx, eax
mov byte [esp + 0x18], 0x24
pushfd
mov dword ss:[ebp - 8], ecx
pushfd
push 0x7b3b3a29
push 0x2fcc7fea
lea esp, [esp + 0x44]
jmp 0x790f7e10
call fcn.7918b8ca

Function at 0x790ec0e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr dx, 2
or ch, dl
add esp, 0xc
sal edx, 3
mov edx, dword [eax]
ror cl, 7
shrd cx, bp, 0xc
push edx
push 0x9bc55be2
rcl cx, 0xf
dec cl
btr cx, dx
sub esp, 0x18
not cl
lea ecx, [eax*2 - 0x1fabeeef]
mov ecx, esp
pushal
mov byte [esp], 0x40
call fcn.79113573

Function at 0x790ec716
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x28]
jne 0x7914e8ff
pushal
mov word [esp + 4], 0x5bc3
jmp 0x7916b71e
call fcn.7907a3ed

Function at 0x790f051c
Capabilities:
Encrypt data using tea

Disassembly:
lea esp, [esp + 0xc]
je 0x7912d7ce
movzx ax, cl
jmp 0x79185954
bts ax, 7
mov eax, dword ss:[ebp - 0x10]
pushal
cmp cx, dx
push ecx
shl eax, 4
call fcn.790fe1d0
Function at 0x790f0628
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0x8f4
lea esp, [esp + 0x48]
je 0x791498fd
rdtsc
bswap edx
cdq
bswap ax
mov byte [ebp - 0x59], 1
rdtsc
push 0x4be05543
setge cl
rdtsc
mov eax, dword [0x7906f2d4]
setge dh
mov ecx, dword [eax]
setl dh
mov edx, dword [ecx]
movzx cx, dl
mov dword [esp], edx
pushfd
lea ecx, [ebp - 0xc8]
push ebx
lea esp, [esp + 8]
call fcn.79028ca0
pushfd
lea ecx, [eax*2 - 0x1d21d4a1]
not cl
mov dword [esp], 0xda1acf4f
mov ecx, eax
push dword [esp]
lea esp, [esp + 8]
call fcn.790f02b9
push esi
mov ecx, dword [ebp - 0x28]
pushal
adc dx, dx
dec dx
mov word [ecx], ax
or ax, 0x26
xchg edx, ecx
mov eax, 1
adc cx, ax
shl eax, 1
push 0xcc024e1a
movzx ecx, al
mov ecx, dword [ebp - 0x28]
jmp 0x7915ead9
cmc
rol dx, 7
mov byte [esp], bl
mov dword [ecx + eax], 0
movsx cx, bl
call fcn.79124470

Function at 0x790f2dbc
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov byte [esp + 4], 0x66
mov dword [esp + 4], eax
push 0xd82a00fe
pushfd
lea esp, [esp + 0xc]
call fcn.790f68cf
sar ah, 1
lahf
add esp, 4
lahf
cwde
pushal
pop eax
mov eax, dword [ebp + 0x10]
call fcn.7907aa6a

Function at 0x790f698e
Capabilities:
Encrypt data using tea

Disassembly:
lea esp, [esp + 8]
movss xmm0, dword [ebp - 0x54]
pushal
pushfd
push dword [esp + 8]
jmp 0x7913436c
lea esp, [esp + 0x28]
comiss xmm0, dword [0x79059a14]
call fcn.79016d02

Function at 0x791018ce
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
call fcn.79004b00
rcr cx, 7
mov dword [ebp - 4], 0
mov ch, cl
mov ecx, dword [ebp - 0x10]
cmc
clc
test si, 0xf828
call fcn.79038003
jmp 0x790e1dfc

Function at 0x79104f06
Capabilities:
Packed with generic packer

Disassembly:
mov edi, dword [esp + 0x24]
inc esi
add esi, edx
sub bh, 0xb3
bsf cx, bp
mov esi, dword [esp + 0x28]
rol cx, 0xa
bsr ebx, ebp
jmp 0x79033255

Function at 0x7910739a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
je 0x79170081
movzx cx, al
lea ecx, [ebp - 0x2929fa75]
setle cl
lea ecx, [ebp - 0x120]
jmp 0x7910b732
jmp 0x790e35cb
jmp 0x790e7257
call fcn.790d0d76
mov dword [esp + 8], 0
pushfd
push 0xba21da65
call fcn.7912c186
pushal
push 0xb35151b
lea esp, [esp + 0x24]
jg 0x791818ec
pushfd
lea esp, [esp + 4]
jmp 0x791559d4
pushal
call fcn.7911c6e1
mov dword [esp + 0xc], 0
jmp 0x7912cbf3

Function at 0x79108921
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
call fcn.7903d1bc
pushal
call fcn.79128db6

Function at 0x7910952b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [edx + 0xec], ecx
pushal
push dword [esp + 0x10]
not ah
mov eax, dword [0x7906f2d4]
mov byte [esp + 4], 0x51
lea esp, [esp + 0x30]
jmp 0x790b9a25

Function at 0x7910a836
Capabilities:
Encrypt data using tea

Disassembly:
movsx ecx, bl
lea ecx, [ebp - 0x18]
pushal
call fcn.790e5f49
Function at 0x7910d516
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x20]
movzx ax, dl
mov word [esp], 0x9345
lahf
movzx eax, word [edx + ecx]
ror dx, cl
mov dword [ebp - 0x68], eax
pop ecx
btr cx, 0xf
setae ah
mov eax, 1
rcl cx, 0xb
rcl cl, cl
mov dh, 0x1e
stc
imul ecx, eax, 0x26
movsx dx, bl
lahf
mov dword [esp + 8], 0x81751ae9
movzx dx, bl
mov edx, dword [ebp - 0x20]
setae ah
bt sp, 2
stc
jmp 0x79131a2e
movzx eax, word [edx + ecx]
rcl ch, cl
movsx cx, dl
mov dword [ebp - 0x6c], eax
ror ax, 4
stc
movsx eax, bl
bswap cx
mov eax, 1
bts edx, ecx
cmc
rcr dx, 7
jmp 0x79131b56
imul ecx, eax, 0x28
movsx ax, bl
movzx ax, cl
cwde
mov edx, dword [ebp - 0x20]
stc
rcl ah, 5
movzx eax, word [edx + ecx]
lea ecx, [eax - 0x37b8bc15]
cmc
mov dword [ebp - 0x70], eax
pop ecx
btc eax, edx
rol cx, cl
stc
mov eax, 1
not cx
movsx cx, al
rol ecx, cl
rcl ch, cl
imul ecx, eax, 0x2a
mov word [esp], 0x3b09
lea esp, [esp + 0x58]
jmp 0x79095d9f

Function at 0x7910e2f4
Capabilities:
Encrypt data using tea

Disassembly:
xchg dl, cl
mov eax, dword [ebp - 0x14]
xchg ch, dh
movsx cx, bl
setns dl
pushfd
mov dword [esp], eax
bswap cx
mov ecx, dword [ebp - 8]
call fcn.79125a3f
pushfd
mov dword [ebp - 8], eax
lea esp, [esp + 0x40]
jne 0x790ac443
not al
pushfd
mov eax, dword [ebp - 0x14]
push esp
mov dword [esp + 4], eax
pop edx
mov ecx, dword [ebp - 8]
movsx edx, dl
jmp fcn.79033a5e

Function at 0x79113510
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x28]
call fcn.7914a878
bt cx, bp
test cl, 0xbd
push 0x3853f7ef
cmp bh, 0x83
movzx eax, al
mov byte [esp], 0x7b
clc
test ah, 0xd
jmp 0x790d2f55
pushal
mov dword [0x79070550], 0x7906c2c0
mov word [esp + 4], 0xf2ec
call fcn.790ee953
jmp 0x7914fa7a
test eax, eax
push ebx
push dword [esp + 4]
lea esp, [esp + 0xc]
jne 0x79102131
cdq
bswap ax
pushfd
xchg dx, ax
lea esp, [esp + 4]
popal
push 0x47253b2b
call fcn.790aaa17
lea esp, [esp + 4]
jnp 0x790b3e35
pushfd
mov dword [0x79070550], 0x7906c2c0
pushal
jmp 0x790b322d
push 0x1a65616d
mov dword [ebp - 0x44], 0
pushfd
push 0x921da61
lea esp, [esp + 0xc]
jmp fcn.790deeec

Function at 0x79114a26
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], di
lea esp, [esp + 0x44]
call fcn.79013b20
bt sp, 0xc
pushal
cmp eax, 7
pushfd
pushfd
lea esp, [esp + 0x28]
je 0x790e14d4
pushfd
seta ch
seto ch
mov ecx, 0x7906f48c
pushal
jmp 0x7914d96f
cmp dword [0x7906f3f0], 0xdd0
call fcn.790a2fdf
pushfd
lea esp, [esp + 0x28]
call fcn.79013b20
bt ax, 6
pushfd
push edx
cmp eax, 8
pushal
lea esp, [esp + 0x28]
jne 0x79108d5b
clc
pushal
pushal
pushfd
mov byte [ebp - 0x19], 1
mov byte [esp + 4], al
clc
jmp 0x7914178d
Function at 0x79117650
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x50]
call fcn.7903bb8a
cmc
sbb dx, dx
shl edx, cl
rcl dl, 7
cdq
rcl ch, 7
not cl
ror cl, cl
sub cl, 0x5f
mov ecx, 0xbb8
pushal
clc
cmc
idiv ecx
pop eax
add edx, 0x1388
movzx eax, dl
xor ax, 0x4ea7
mov dword [ebp - 0x58], edx
bts ax, 0xc
rcr ah, 3
das
cwde
mov eax, dword [ebp - 0x54]
push 0x1a853ed1
mov dword [esp], 0x63ea7e32
cmp ecx, esi
mov dword [ebp - 0x5c], eax
call fcn.790bd766
mov dword [esp + 0x28], eax
push 0xc72c84fe
mov dword [esp + 0x28], 0x79059660
call fcn.790e6051

Function at 0x79117aa2
Capabilities:
Encode data using xor

Disassembly:
push 0x258
pushal
push 0x5d2a4662
mov dword [esp + 0x20], 0xcb
pushfd
jmp 0x79168555
mov dword [0x7906f500], eax
add bl, 0xb
btc di, 7
xchg bx, di
lea ecx, [ecx*2 + 0x5201fb4f]
mov edi, dword [esp + 4]
inc si
btc cx, bp
not ch
xadd cx, si
mov esi, dword [esp + 8]
stc
not cl
add cx, 0xfcac
sar bl, cl
mov ebx, dword [esp + 0xc]
bsf cx, cx
pushfd
sar cx, 3
mov ecx, dword [ebp - 4]
lea esp, [esp + 0x14]
jge 0x7914c1f4
xor ecx, ebp
call fcn.79097ec9
pushfd
mov dword [esp + 0x40], 0x24
push esp
mov dword [esp + 0x40], 0
pushfd
lea esp, [esp + 0x44]
jmp fcn.791774a0
fmul dword [esp + esi*2]
push ecx
mov al, byte [0x7906f4f6]
mov word [esp], 0x1ef0
call fcn.790884dd
lea esp, [esp + 8]
call fcn.7911a8da
jmp 0x790fe98b
cmp cx, cx
xor ecx, ebp
push ecx
push 0x27e84b86
call fcn.7907d8f9
call fcn.79181c18
jo 0x7914c1b6
adc ebx, ebp
invalid
pushal
pushfd
lea esp, [esp + 0x48]
call fcn.7910c05d
clc
stc
call fcn.790cec29

Function at 0x7911a2fe
Capabilities:
Encrypt data using tea

Disassembly:
push 0xa0bb77d0
call fcn.7915102f
push 0xa9031eef
call fcn.79126035

Function at 0x7911a31f
Capabilities:
Encrypt data using tea

Disassembly:
push 0xa51c5433
mov dword [esp + 0x2c], ecx
pushfd
push 0x44b1b89a
mov word [esp + 8], cx
call fcn.790bf464
cmc
add eax, dword ds:[edx + ecx*4]
push esi
sbb dx, ax
cmc
mov ecx, dword ss:[ebp - 0x10]
adc dx, 0xbf51
sub ecx, eax
neg ax
rcl ah, cl
sbb ax, di
mov dword ss:[ebp - 0x10], ecx
pushfd
jmp 0x790eb2e1

Function at 0x7911c6e1
Capabilities:
Packed with generic packer

Disassembly:
push edx
lea esp, [esp + 0x28]
jmp 0x791559d4
not al
cwde
push 0
push ecx
pop eax
lea eax, [ebp - 0x174]
mov ch, ch
push eax
mov cl, dl
pushfd
lea ecx, [ebp - 0x11c]
push 0xbe93d829
pushal
lea esp, [esp + 0x28]
call fcn.79019d40

Function at 0x7911db22
Capabilities:
Create thread

Disassembly:
lea esp, [esp + 8]
jne 0x790a977c
pushfd
mov word [esp], ax
mov dword [esp], 0
pushal
mov dword [esp + 0x1c], 0
jmp 0x791694fd

Function at 0x7911e2c6
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
xor ecx, 0x738456b
call fcn.790e330b

Function at 0x7911f8d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x790e5134
pushfd
lea esp, [esp + 4]
jmp 0x79098f9f
jmp 0x79077443
Function at 0x79120eee
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jne 0x790dacbb
rcr di, cl
bts bx, 1
movzx di, bl
rol di, 9
mov byte [0x7906f475], 1
rcl bl, 5
pop edi
bt cx, 1
adc si, di
lea esi, [esi*4 - 0x5a6e5138]
pop esi
cmc
pop ebx
pushal
mov ecx, dword [ebp - 4]
jmp 0x790fc943
xor ecx, ebp
mov byte [esp], bl
pushfd
call fcn.791495e9
jmp 0x790935d5

Function at 0x7912516c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], eax
inc ax
bsf eax, esi
adc al, 0xaf
stc
mov dword [esp], ebx
bsf ax, cx
push esi
bt si, cx
push edi
jp 0x79098535
and al, bh
mov dword [ebp - 8], ecx
test bl, dl
mov eax, dword [0x7906f2d4]
shrd cx, bp, cl
jmp 0x7910a261
clc
rol eax, 7
mov dword [ebp - 8], ecx
sal ecx, cl
test di, cx
inc ah
mov eax, dword [0x7906f2d4]
neg ch
not ch
mov ecx, dword [eax + 0x24]
stc
mov dword [0x79070478], ecx
pushal
pushal
cmp ax, 0x23ab
movzx eax, byte [0x79068034]
push ecx
test eax, eax
call fcn.79095d3f
call fcn.79138f35
pushfd
mov dword [esp + 0x24], eax
lea ecx, [ecx + 0x253fc599]
call fcn.790b9eba
aas
dec al
push ebp
cmp cl, dh
rol al, 5
rol bp, cl
mov ebp, esp
dec ax
bsr ax, si
pushfd
sub esp, 0x54
aas
neg al
sar al, 1
mov eax, dword [0x79068330]
bt bx, sp
jo 0x79164064
bt edi, 7
xor eax, ebp
stc
pushfd
test cl, al
jmp 0x7907a12d

Function at 0x79127ede
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
cmp dword [ebp - 0x8c], 0
mov byte [esp], al
push dword [esp + 4]
mov byte [esp + 8], 0x53
lea esp, [esp + 0xc]
je 0x790d55ba
stc
push ebp
jmp 0x790ddfd9
pushfd
bt cx, 1
jmp 0x790e75a0

Function at 0x7912a5a1
Capabilities:
Encrypt data using tea

Disassembly:
pushal
lea esp, [esp + 0x24]
ucomiss xmm0, dword [0x79059738]
jmp loc.79019fda

Function at 0x7912c73f
Capabilities:
Encrypt data using tea

Disassembly:
call fcn.790fcd25
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x790e21b2
push ecx
jmp 0x790783a4
jmp 0x790c0f9d

Function at 0x7912f905
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
je 0x790b055c
pushfd
push edi
mov byte [esp], 0xe2
lea esp, [esp + 8]
jmp fcn.79138de3

Function at 0x7912f937
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push eax
push ebx
pop edx
neg dh
bsr dx, si
lea ecx, [ebp - 0xc]
lea edx, [ebp + 0x6bb8036f]
dec dh
push ecx
pushal
and dx, 0x7865
sar cl, 1
lea edx, [ebp - 0x54]
neg ecx
shr ch, 1
adc cx, si
add cl, ah
mov dword [esp + 0x1c], edx
bsr cx, bx
mov ecx, dword [ebp - 8]
pushal
add ecx, 0xbc
mov byte [esp], 0x61
pushfd
lea esp, [esp + 0x40]
call fcn.79030120
jmp 0x79186773
push ecx
lea esp, [esp + 0x10]
call fcn.79017ab0
jmp 0x79107e35
Function at 0x79136564
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x3c], 0
jmp 0x7913655f
call fcn.7910c1d9
bswap cx
xchg cx, dx
movsx eax, al
push 0
rdtsc
rdtsc
lea eax, [edi*2 + 0xb937bde]
push 5
bswap dx
mov eax, dword [ebp - 4]
seta dl
lea ecx, [eax - 0x5dd5dd57]
movzx dx, al
mov dx, 0x4a8f
mov ecx, dword [eax + 4]
lea edx, [ebp*2 + 0x5f6f1acd]
movzx edx, al
lea edx, [ecx*2 - 0x7099faed]
push ecx
mov dl, 0x3c
mov edx, dword [0x7907044c]
pushfd
mov byte [esp], bl
jmp 0x79182ab3
mov dword [esp], edx
pushal
mov byte [esp], 0x5a
mov dword [esp + 0x1c], 0x790da8c0
mov byte [esp + 0x10], 0x98
push dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
pop dword [esp + 0x18]
push ebx
pushfd
pushal
push dword [esp + 0x40]
ret 0x44

Function at 0x7913a69b
Capabilities:
Encrypt data using tea

Disassembly:
dec cx
ror ch, cl
shl eax, 2
dec cx
movsx cx, cl
bsr cx, si
adc ch, 0x87
mov ecx, dword [ebp - 0x10]
cmc
cmc
push 0x4ba08eb6
cmp dword [ecx + eax], 0
push dword [esp]
pushfd
lea esp, [esp + 0x10]
jne 0x790c5d17
test bl, 0xe9
das
inc eax
and ax, 0xdacf
mov eax, 1
shrd cx, sp, 3
shl eax, 3
cmc
sal ecx, cl
mov ecx, dword [ebp - 0x10]
stc
movzx edx, word [ecx + eax]
pushal
cmp edx, 0x816
jmp 0x7918d84b
lea esp, [esp + 0x20]
jne 0x790c5d17
or ah, 0x20
clc
movzx eax, byte [0x7907031c]
pushfd
bt bp, 0xc
call fcn.7903671e

Function at 0x7913f5b1
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push 0xc3a8cf0e
mov eax, dword [ebp + 0x10]
movzx ecx, bl
movsx cx, dl
jmp 0x790d5f18
mov dword [esp + 4], ecx
pushfd
lea esp, [esp + 8]
call fcn.7902fa83
pushal
stc
clc
add esp, 0x28
pushal
pushfd
pushfd
mov word [esp], sp
lea esp, [esp + 0x28]
jmp fcn.79078afc
push edi
cmp dword [ebp - 8], 1
jmp 0x790a09eb
movsx cx, al
mov dword [esp], eax
push 0x1c75ed23
setns cl
mov ecx, dword [ebp + 0xc]
push dword [esp]
jmp 0x7915ebdd
cmc
clc
pushal
cmp dword [ebp - 8], 0
pushfd
lea esp, [esp + 0x24]
jne 0x790ac3bb
cmc
cmc
pushfd
jmp 0x7917b20f
jmp 0x7915f118
call fcn.79177e33
cmp dword [ebp - 0xc], 0x183
mov byte [esp], bh
push 0x7ebe72af
lea esp, [esp + 8]
jne 0x79108930
push 0x8900d93a
mov eax, dword [ebp + 0x10]
not cx
pushal
call fcn.7918160e
call fcn.79141069
jmp 0x79096c13
pushal
lea esp, [esp + 0x44]
jne 0x790ac3bb
setnp ah
jmp 0x7908e4ad
cmp dword [ebp - 0xc], 0xd
pushal
jmp 0x79116df2

Function at 0x79142980
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
call fcn.790a3f5e
bsr cx, bx
add esp, 4
push edi
not dl
rcr ah, cl
clc
mov eax, 1
btr dx, 0xe
rcr dx, cl
imul ecx, eax, 7
rcr ah, cl
shl ah, 7
movzx edx, word [ebp + ecx - 0x404]
movzx ax, al
bts ax, 0xb
add edx, 0xd
xchg ah, cl
pushfd
mov dword [ebp - 0x40c], edx
setno ch
pushal
not ax
mov eax, dword [0x7907055c]
setae ch
bswap dx
mov ecx, dword [ebp - 0x40c]
call fcn.790e6bfe
mov dword [esp + 4], edx
jmp 0x790b057c
jmp 0x790e361e
Function at 0x7914590c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jne 0x79102131
rdtsc
popal
pushal
lea esp, [esp + 0x20]
leave
pushal
pushal
push dword [esp + 0x40]
ret 0x50
mov byte [esp], ch
jmp 0x7907c50f
push edi
mov dword [0x79070550], 0x7906c2c0
push 0xbdbe2d46
lea esp, [esp + 0x14]
call fcn.7914a878
test dx, 0xa118
push 0x4e6bf6af
bt bp, 4
push ecx
movzx eax, al
test di, cx
test eax, eax
jmp 0x79107f0d

Function at 0x7914cab3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x30]
jne 0x79102131
push esp
bswap ax
lea esp, [esp + 4]
popal
push 0x9ede68bf
call fcn.7911bcd5

Function at 0x7914e1cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ax, al
inc eax
add eax, ebp
mov eax, dword [ebp - 4]
jmp loc.79034412

Function at 0x79150081
Capabilities:
Encrypt data using tea

Disassembly:
mov dword [esp + 4], 0
mov byte [esp], 0x7f
pushal
mov word [esp + 8], 0xd464
lea esp, [esp + 0x24]
call fcn.790206f0
cmp cl, 0xfe
add esp, 0x1c
jmp 0x7910b431
mov dword [esp + 4], 0x25
mov word [esp], si
push dword [esp]
jmp 0x790e6b6f

Function at 0x79152862
Capabilities:
Packed with generic packer

Disassembly:
call fcn.790aab24
xchg di, si
rol di, 3
shld bx, si, 5
add esp, 0x20
call fcn.790758ba
mov word [esp], dx
mov dword [ebp - 4], ecx
call fcn.7918cb87
xchg cx, ax
movzx eax, cl
jmp 0x791705fe
movzx eax, byte [ebp + 0xc]
bswap cx
movzx cx, al
not cl
pushfd
mov dword [esp], eax
setnp ch
push 0x4ca3f3d3
movzx cx, cl
movzx ecx, byte [ebp + 8]
mov byte [esp], bh
mov dword [esp], ecx
jmp 0x790963ff

Function at 0x79153e7c
Capabilities:
Encrypt data using tea
Packed with generic packer

Disassembly:
push 0x5e32ad7e
stc
cmp dword [ebp - 0x48], 0
push 0x35685e1c
pushal
call fcn.79144e6a

Function at 0x79155a1a
Capabilities:
Packed with generic packer

Disassembly:
bt edx, 0xd
push 0x2140d0a1
test dl, 0x5a
cmc
xor ecx, ebp
push 0xcfa2ee4c
pushfd
jmp 0x79085912
pushfd
pushal
mov esp, ebp
call fcn.7908f122
pushfd
mov dword [esp], esi
lea esp, [esp + 4]
call fcn.79039e56
jmp 0x790dbd90
jmp 0x7910b9cf
test edi, 0xdafc3e78
sub esp, 0xffffffe8
jo 0x790ad8b6
xor ecx, ebp
jo 0x7914ab9b
call fcn.79039e56
call fcn.790c6e30

Function at 0x7915a18a
Capabilities:
Packed with generic packer

Disassembly:
or ecx, ebx
setae al
sbb al, 0x96
mov eax, dword [ebp + 8]
ror cl, 4
mov ecx, dword [eax + 4]
cmp ax, dx
mov dword [ebp - 8], ecx
call fcn.790abaa2
call fcn.790d36dd
lea esp, [esp + 0x28]
je 0x790b055c
pushfd
push ebp
pushal
lea esp, [esp + 0x28]
jmp fcn.79138de3
Function at 0x7915d604
Capabilities:
Contain obfuscated stackstrings

Disassembly:
bswap ax
mov byte [ebp - 0x112], 0x44
shrd ax, si, cl
bts ax, ax
mov byte [ebp - 0x111], 0x11
setle ah
shrd ax, di, 9
mov byte [ebp - 0x110], 0xba
sub al, al
lahf
clc
sar al, cl
mov byte [ebp - 0x10f], 0x31
cmc
mov byte [ebp - 0x10e], 0x12
bt ebx, ebp
jmp 0x7912968a
stc
shrd ax, sp, cl
das
mov byte [ebp - 0x118], 0xcd
jmp 0x791772b1
mov byte [ebp - 0x10d], 0x89
push esp
shl ax, 2
rol eax, 0x18
mov byte [ebp - 0x10c], 0xfc
sar al, 4
mov byte [ebp - 0x10b], 0x97
ror ah, cl
or eax, 0x848a717b
mov byte [ebp - 0x10a], 0x3a
aas
cmp al, al
mov byte [ebp - 0x109], 0x34
or al, ah
mov byte [ebp - 0x108], 0x12
shr eax, cl
mov byte [ebp - 0x107], 0x8e
aad 0xaa
shr ax, cl
mov byte [ebp - 0x106], 0x6c
or ah, dl
daa
mov byte [ebp - 0x105], 0x87
aam 0xf9
mov byte [ebp - 0x104], 6
bt eax, esi
sar ah, cl
mov byte [ebp - 0x103], 0x37
das
pushal
mov byte [ebp - 0x102], 0x12
sal ax, 7
xor al, ch
mov byte [ebp - 0x101], 0xaa
btc ax, si
mov byte [ebp - 0x100], 0xae
cmc
cmp cl, 0xfb
shrd eax, ebp, 8
mov byte [ebp - 0xff], 0xfe
dec al
pop eax
shr al, 7
pushfd
mov byte [ebp - 0xfe], 0x9a
bsr ax, di
or eax, ebx
sar al, cl
mov byte [ebp - 0xfd], 0x3a
rcr ah, 2
neg ah
sbb ax, 0x164d
mov byte [ebp - 0xfc], 0x12
btr ax, 7
btc ax, ax
movsx ax, cl
not al
mov byte [ebp - 0xfb], 0x41
or eax, 0x40df1021
shr al, cl
sal al, cl
mov byte [ebp - 0xfa], 0xa9
pushal
movsx ax, cl
stc
mov byte [ebp - 0xf9], 0x3b
lahf
rcr ah, cl
btc eax, 7
mov byte [ebp - 0xf8], 0xa5
add ah, 0x2c
mov byte [ebp - 0xf7], 0x3d
sbb ah, 0x8f
bts ax, si
inc al
sar ax, 6
mov byte [ebp - 0xf6], 0x12
dec al
shrd ax, cx, cl
sets al
inc ax
mov byte [ebp - 0xf5], 0x22
aad 0xed
mov byte [ebp - 0xf4], 0x91
aaa
pushfd
call fcn.79189868
clc
mov byte [ebp - 0x115], 0x2e
setge al
mov byte [ebp - 0x114], 0x12
sub al, cl
lahf
mov byte [ebp - 0x113], 0x9c
shl eax, cl
je 0x790a4ee1
aad 0xf8
pushal
mov byte [ebp - 0x112], 0x44
movsx ax, bl
das
btc ax, 0xf
daa
mov byte [ebp - 0x111], 0x11
lea eax, [edx - 0x751c9b7]
mov byte [ebp - 0x110], 0xba
sub ah, 0x8a
test bh, dl
call fcn.7916914f
mov byte [ebp - 0x119], 0x6c
mov byte [esp], 0x14
lea esp, [esp + 0x74]
jmp 0x790d7410
shld eax, ebx, cl
mov byte [ebp - 0x117], 0x31
btc ax, 9
ror ax, cl
cmc
mov byte [ebp - 0x116], 0x5b
not al
jmp 0x79134995