joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79131143
Capabilities:
Execute anti-debugging instructions

Disassembly:
call int.7909f6ff
jmp 0x79149025
lea ecx, [ebp - 0x38c]
jmp 0x790f90a6

Function at 0x79131f44
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
pushal
movzx dx, dl
mov edx, dword [ecx + 4]
pushfd
jmp 0x7915c7ef
bswap cx
mov ecx, dword [ebp - 8]
jmp 0x790903a6
mov word [esp], 0xf75e
mov dword [esp + 0x20], edx
pushal
lea esp, [esp + 0x40]
call fcn.79038090
not cx
add esp, 0xc
bswap ax
rdtsc
lea eax, [ebx + 0x56ed9ebb]
rdtsc
push 5
lahf
push eax
mov eax, dword [ebp - 0xc]
movzx edx, bl
call fcn.7908d2a5

Function at 0x79132024
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x40]
jg 0x79147746
cmc
cmp al, al
pushal
push 0x36339fce
cmp dword [ebp - 0x44], 0
jmp 0x7908d02f
lea esp, [esp + 0x24]
jbe 0x790ab664
pushal
push ebx
mov word [esp], 0x90eb
call fcn.79030768
jmp 0x790bf7f2
pushfd
mov esp, ebp
bswap bp
pop ebp
pushfd
mov byte [esp], 0x4e
push ebx
push dword [esp + 8]
ret 0xc
pushal
pushfd
pushfd
lea esp, [esp + 0x30]
jl 0x790ab664
pushal
pushal
jmp 0x7907ab71
lea esp, [esp + 0xc]
jl 0x7914f283
push 0x92015d64
mov byte [esp], dl
push dword [esp]
mov byte [esp], al
lea esp, [esp + 8]
jg 0x7916bd9d
bsr cx, sp
cmc
seto cl
mov ecx, dword [ebp - 0x4c]
cmc
bt si, 6
cmp ecx, dword [ebp - 0x44]
pushfd
lea esp, [esp + 4]
jbe 0x7914f283
rol ch, cl
inc ax
jmp 0x79136033
mov eax, dword [ebp - 0x4c]
shrd cx, bx, 9
bsr cx, di
btc cx, 1
btc cx, 1
mov dword [ebp - 0x44], eax
push 0x27981be6
stc
sal cx, 5
dec ecx
mov ecx, dword [ebp - 0x48]
test bx, 0x3446
test bl, 0xa
mov dword [ebp - 0x40], ecx
push eax
cmp dword [ebp - 0x40], 0
jmp 0x790e3b91

Function at 0x791330e8
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7916870f
cmp dword [ebp + 8], 2
pushfd
pushal
lea esp, [esp + 0x28]
jg 0x790decd0
jne 0x790a5d46
bswap eax
mov eax, dword [ebp - 0x3c]
push 0xe81925df
jmp 0x7912c111

Function at 0x79134420
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 4]
movss dword [ebp - 0x68], xmm0
pushfd
lea esp, [esp + 4]
jmp fcn.79092e82

Function at 0x7913455f
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0xc]
call fcn.7901f940
pushal
mov byte [esp], dh
bt edi, 0x10
add esp, 0x3c
pushfd
pushfd
mov byte [esp], 0x34
mov dword [esp + 4], 0
pushal
pushal
mov dword [esp + 0x40], 0x74
mov dword [esp + 8], 0x5eb4867a
mov word [esp], 0x3692
mov dword [esp + 0x3c], 0
mov word [esp], sp
pushfd
call fcn.79143eb0
sal dword [edi - 0x61], cl
sbb edx, dword [ebx]
jne 0x79127694
dec ebp
sub dword [ebx], 0x21
or bh, dl
outsb dx, byte [esi]
push edx
cmp ah, byte [esi - 0x7975ed50]
clc
out dx, al
mov esi, es
mov esi, 0x10f6abb1
inc esi
invalid
test dword [esi - 0x7e], esi
add dword [eax], eax
pushfd
mov dword [esp + 8], 0
jmp 0x7913da6a
jmp 0x791275e1
Function at 0x791348c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0x89
bt bx, dx
imul ecx, eax, 0xa
call fcn.79117ea8
pushfd
pushfd
lea esp, [esp + 8]
jbe 0x790c2bab
lea esp, [esp + 8]
call fcn.7910fa51
cmp ebp, edx
shr ecx, 0x1f
bsr dx, bp
bts dx, 1
mov ecx, dword [ebp - 0x28]
bswap edx
pushal
mov word [ecx], ax
test esp, ebp
bsf dx, bx
mov eax, 1
bt ax, 0xf
btc cx, 6
sal dl, cl
shl eax, 1
pushal
mov ecx, dword [ebp - 0x28]
bts dx, di
mov dword [ecx + eax], 0
rdtsc
not ax
mov eax, 1
bswap cx
rcr dx, 0xb
mov ch, byte [esp + 4]
imul ecx, eax, 6
btr dx, cx
mov edx, 0x111
bswap ax
movzx eax, dl
btr ax, bp
bswap ax
mov eax, dword [ebp - 0x28]
push 0x91aeeaa3
mov word [eax + ecx], dx
push 0x5b951b9b
lea eax, [edi - 0x3691826d]
mov eax, 1
ror cl, cl
lea esp, [esp + 0x48]
je 0x7911b029
imul ecx, eax, 0xa
rol al, 5
cmc
mov edx, dword [ebp - 0x28]
stc
not ax
mov eax, dword [ebp - 0x64]
pushal
cmc
cmc
mov dword [edx + ecx], eax
mov ch, byte [esp + 4]
rdtsc
mov eax, 1
rcr dh, 4
lea edx, [eax + 0x2d62da6a]
imul ecx, eax, 0xe
neg dh
mov edx, 0xa
pushfd
mov eax, dword [ebp - 0x28]
test dh, 0xb4
jmp loc.79020762

Function at 0x79134e7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ecx], al
mov byte [esp + 4], 0x73
pushfd
pushfd
mov byte [esp + 4], bh
lea esp, [esp + 0x50]
jmp 0x790831d7

Function at 0x791369c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x3c4]
shl ecx, cl
btc cx, 7
mov ecx, dword [eax + 1]
aam 0x3d
mov edx, dword [ebp - 0x3c4]
pushal
xadd ax, si
lea eax, [edx + ecx + 5]
test bh, 0xd7
bswap di
add di, bp
mov ecx, dword [0x7906e2d4]
cmc
pushfd
bswap edi
mov dword [ecx + 0xc4], eax
bt si, dx
shrd esi, esp, cl
bsr cx, sp
mov ecx, dword [ebp - 0xc]
rol si, 2
pushfd
mov dword fs:[0], ecx
rcr bh, cl
movzx cx, bl
bts cx, 6
call fcn.790b3bcc
jmp 0x7909bc2d
cmp dword [ebp - 0x3c4], 0
push 0xd10e0b5b
pushal
lea esp, [esp + 0x28]
jle 0x791185ff
cdq
bsr ax, ax
mov eax, dword [ebp - 0x3c4]
rcl di, 0xb
sar cl, 4
sub eax, dword [ebp - 0x14]
cmp ebp, 0xf8572e8f
and ch, 7
mov dword [ebp - 0x3c4], eax
jmp 0x790ef712

Function at 0x79138159
Capabilities:
Packed with generic packer

Disassembly:
not ch
mov ecx, eax
jmp fcn.79030d70
push 0xc629eb89
lea esp, [esp + 4]
call fcn.79027d90
call fcn.790cd5fc
lea ecx, [ebp - 0xb0]
lea esp, [esp + 8]
jae 0x790e1f58
pushfd
mov byte [esp], 0x22
lea esp, [esp + 4]
call fcn.79027d90
jmp 0x7907f4cd

Function at 0x79143b09
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp]
lea esp, [esp + 0x10]
jne 0x79157091
cmp edx, 0x82507e12
clc
push ebx
push 0x901a70e8
xor eax, eax
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.791211ec
bts edx, edi
cmc
mov al, 0xa7
mov eax, 1
bt di, dx
lea edx, [eax - 0x8931223]
imul ecx, eax, 0xc0
aam 0x74
shrd eax, ebx, 0x19
mov edx, dword [ebp - 8]
shl eax, cl
mov ah, bl
setg al
mov eax, dword [edx + ecx]
test bh, 0x94
jmp fcn.791647da

Function at 0x791458ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x790e2de2
lea ecx, [ebp - 0xb0]
jmp 0x790e7f97
Function at 0x79148aaf
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x4c]
jle 0x79107758
movsx eax, al
not cx
pushal
cwde
mov dword [esp + 0x1c], 0
lea eax, [edx + 0x2d823949]
lea eax, [ebp - 0x54]
pushal
mov dword [esp + 0x38], eax
push dword [esp + 8]
movsx cx, cl
pushfd
lea ecx, [ebp - 0xc]
push 0xaf6cf25
lea esp, [esp + 0x44]
call fcn.7912de50
cmc
setnp al
movsx eax, cl
call fcn.790e0cde
jmp 0x7908a93e
pushal
cmp dword [ebp - 0x40], 0
push dword [esp + 4]
jmp 0x7909c7d0

Function at 0x7914a696
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec si
bts si, sp
sub dx, bx
mov edx, dword [ecx + eax]
rol si, 4
stc
pushal
push ebx
mov dword [ebp - 0x18], edx
lea esi, [ecx - 0x478de675]
btc esi, edi
lea esi, [esi + 0x28ed727b]
cmc
mov esi, dword [ebp - 0x18]
test cl, 0xda
and esi, 0xfff
call fcn.79177141
cmc
shl eax, 0
mov byte [esp], 0xfa
jmp 0x791792f1
lea esp, [esp + 0x10]
jge 0x7908848a
rdtsc
mov eax, 1
stc
bts cx, ax
stc
cmc
imul ecx, eax, 0
rcl al, cl
movzx eax, dl
rcl dx, 6
mov edx, dword [ebp - 8]
xor esi, ecx
inc si
movzx eax, byte [edx + ecx]
rcr dh, 2
not cl
mov dword [ebp - 0x10], eax
inc ch
aad 0xbb
mov eax, 1
bsf cx, bp
shl eax, 0
xor si, ax
sub cx, bp
mov ecx, dword [ebp - 8]
rol dx, cl
movzx edx, byte [ecx + eax]
lahf
mov dword [ebp - 0x14], edx
rol si, cl
rdtsc
mov eax, 1
or si, 0xbd9
rcl si, 2
shl eax, 1
sub dh, 0x45
adc ch, 0xfd
add cx, si
mov ecx, dword [ebp - 8]
jmp 0x79084575

Function at 0x7914a7ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [0x7906e2d4]
push ebx
aaa
btr eax, edx
mov eax, dword [ecx + 0x2d]
bsf cx, di
mov dword [edx + 0x30], eax
ror ch, 4
bswap cx
mov eax, dword [0x7906e2d4]
setnp ch
test cl, cl
mov ecx, dword [eax + 0x40]
rcl dx, 8
aam 0x51
xchg edx, eax
mov edx, dword [0x7906e2d4]
jmp 0x790831eb

Function at 0x7914b5f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
pushfd
call fcn.79134e7e
lea esp, [esp + 8]
call fcn.7903ab7a
not cl
mov ecx, dword [ebp + 8]
test esi, 0x57518c48
pushal
cmp ch, 0xac
test dh, 2
add ecx, dword [ebp - 0xc]
lea esp, [esp + 0x20]
jo 0x7907f3c7
pushal
pushal
mov byte [ecx], al
pushfd
lea esp, [esp + 0x44]
jmp 0x790831d7

Function at 0x7914cc55
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x2c]
call fcn.7901a960
bswap ecx
lahf
movsx ecx, dl
mov ecx, 0x1bf23100
lea eax, [ebp - 0x44]
movzx cx, dl
movsx ecx, dl
movzx cx, al
pushfd
mov dword [esp], eax
pushfd
call fcn.79178c55
Function at 0x7914fbb8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0x14]
jmp 0x7902134b
pushal
mov dword [esp + 0x1c], ecx
setb cl
jmp 0x7910b17d
movzx cx, dl
lea ecx, [ebp - 0x28]
pushfd
jmp 0x79172b12
bswap ecx
jmp 0x790b61c9
push 0x31b7877b
call fcn.79011704
pushfd
mov dword [ebp - 4], 0
bswap eax
movsx cx, dl
lea eax, [ebp - 0x28]
pushfd
mov dword [esp + 4], eax
not ecx
pushfd
mov byte [esp], bh
movsx ecx, cl
lea ecx, [ebp - 0x18]
pushal
lea esp, [esp + 0x28]
jp 0x7907d408
push 0xa585ef41
pushfd
xchg dword [esp + 4], ecx
pop ecx
lea ecx, [edx*4 + 0x5ed1ad08]
bswap ecx
call fcn.790e0d6e
jno 0x79096f93
mov dword [ebp - 4], 0
pushal
movsx cx, bl
push ecx
movsx eax, al
lea eax, [ebp - 0x28]
pushal
movsx cx, dl
mov dword [esp + 0x40], eax
movzx cx, dl
lea ecx, [ebp - 0x18]
jmp 0x790a6833
jmp 0x790758cb
movzx cx, al
not ecx
lea ecx, [ebp - 0x28]
push dword [esp]
push dword [esp + 8]
pushfd
lea esp, [esp + 0x30]
call fcn.7901a960
mov ecx, 0x79df0937
bswap cx
jp 0x7907e62d
push 0x6565faa6
lea ecx, [ebp - 0x28]
pushal
mov word [esp + 8], 0x9cd6
pushal
lea esp, [esp + 0x44]
call fcn.7902a780
lahf
xchg ah, ch
sets cl
call fcn.79164640
pushal
call fcn.79031633
pushfd
mov byte [ebp - 0x19], 1
push esp
push 0x4cf60eb
mov dword [esp + 4], esi
lea esp, [esp + 0x18]
jmp 0x790e2148
pushal
lea esp, [esp + 0x24]
call fcn.7902a780
jmp 0x790d2b5b

Function at 0x791516c9
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ebp - 0x120]
call fcn.790f7bdc

Function at 0x79153e8f
Capabilities:
Encode data using base64

Disassembly:
mov byte [ebp - 0x187], 0xf5
mov dword [esp], esp
lea esp, [esp + 0x58]
jnp 0x79107bce
mov byte [ebp - 0x186], 0x11
pushal
mov byte [ebp - 0x185], 0xf5
push 0xbf1e988a
mov byte [esp + 0x10], 0x8e
mov byte [ebp - 0x184], 0x86
pushfd
call fcn.790e46f0
push 0xed951bac
pushfd
push 0x8f8495ab
pushfd
mov byte [ebp - 0x186], 0x11
call fcn.7913c57f
mov byte [ebp - 0x188], 0x88
jmp 0x7909a217

Function at 0x79157f25
Capabilities:
Packed with generic packer

Disassembly:
cmp al, ch
push 0x4e6c1fad
cmp eax, dword [0x7906f548]
push esi
mov word [esp + 4], cx
pushal
lea esp, [esp + 0x30]
jge 0x790a60d3
cwde
mov eax, 1
stc
clc
rcl edx, cl
imul ecx, eax, 0
bt ax, cx
mov ax, di
lea edx, [edi*8 + 0x11f19cbb]
pushfd
mov edx, dword [ebp - 4]
btc ax, 2
movzx eax, word [edx + ecx]
btc dx, 8
btr dx, di
mov dword [ebp - 0xc], eax
add ecx, 0xef71fc93
bsf ecx, edx
mov eax, 1
not cl
pushfd
shl eax, 1
movsx cx, bl
rcr dx, cl
bt bp, bx
mov ecx, dword [ebp - 4]
movsx dx, dl
mov edx, dword [ecx + eax]
bts cx, sp
movzx cx, cl
pushal
mov dword [ebp - 0x10], edx
rcl cx, cl
cdq
mov eax, 1
cmc
imul ecx, eax, 6
mov byte [esp], 0xd0
bt si, di
mov edx, dword [ebp - 4]
lea eax, [edx - 0x67d0467b]
lahf
bts ax, si
movzx eax, byte [edx + ecx]
pop ecx
movsx cx, bl
pushal
mov dword [ebp - 0x14], eax
call fcn.79014768

Function at 0x791585b8
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp + 4], eax
pushfd
setg ch
lea esp, [esp + 8]
popal
pushfd
jmp loc.7901b4d4

Function at 0x7915c7da
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebp - 0x34], 0x211
push 0xdf67cc2e
jmp 0x79154120
jmp 0x790d3b9c
Function at 0x7915d85a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x23], 0x6e
movsx ax, bl
call fcn.7913b586
mov byte [ebp - 0x2d], 0x49
bswap ax
mov byte [ebp - 0x2c], 0x6e
lea eax, [esi*4 - 0x3f8dfefc]
push dword [esp]
pushfd
movsx ax, al
mov byte [ebp - 0x2b], 0x66
bswap ecx
bswap eax
mov byte [ebp - 0x2a], 0x6f
not ax
mov byte [esp], cl
mov byte [ebp - 0x29], 0x72
movsx cx, dl
pushal
mov byte [ebp - 0x28], 0x6d
pushfd
not cx
mov byte [ebp - 0x27], 0x61
pushfd
lahf
mov byte [ebp - 0x26], 0x74
pop ecx
pop eax
lahf
lea ecx, [0x312070cb]
mov byte [ebp - 0x25], 0x69
not ch
lahf
pop eax
mov byte [ebp - 0x24], 0x6f
jmp 0x79111e9e

Function at 0x7916258f
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790d7457
lea esp, [esp + 0x1c]
call fcn.79025ac0
push ecx
mov word [esp], 0x9e69
mov byte [esp], al
mov dword [esp], eax
push 0x318cc32e
mov dword [esp], 0xf9220272
lea esp, [esp + 4]
jb 0x79094d25
call fcn.79004050
shld ecx, ebp, 0x17
lea ecx, [ecx - 0xfbaf23d]
add esp, 8
pushfd
cmp al, ch
call fcn.7911c965

Function at 0x79162e26
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xbe
call fcn.790df213
mov dword [ebp - 0xbc], eax
pushal
push dword [esp + 4]
lea esp, [esp + 0x48]
jmp 0x790fc357

Function at 0x791647a1
Capabilities:
Packed with generic packer

Disassembly:
push ecx
mov dword [esp], ebp
pushfd
lea esp, [esp + 0xc]
call fcn.7903ab7a
movzx cx, bl
dec cx
test dl, bl
cmc
cdq
push 0x696904c2
pushal
and ch, bl
neg cx
mov ecx, 0xbb8
pushal
cmp dl, bh
cmc
idiv ecx
das
btr eax, 6
call fcn.790ff9a9

Function at 0x791655b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
push 0x7767e8c9
jmp 0x790e5722

Function at 0x7916606d
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 8]
je 0x791035b0
call fcn.7915c7da

Function at 0x7916a35d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7916a347
push dword [esp]
push dword [esp]
mov dword [esp + 0x48], 0x2e
mov byte [esp], bh
call fcn.790d59a9
pushal
mov dword [ebp - 0x44], eax
lea eax, [esp - 0x8f13829]
push dword [esp]
mov eax, dword [esp]
pop eax
lea eax, [ebp - 0x40]
push 0xa202124c
pushal
pushfd
lea esp, [esp + 0x48]
jmp int.790882c0

Function at 0x7916ad0a
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x28]
call fcn.790392b0
push ebp
add esp, 0x10
call fcn.791369c4
pushal
pushfd
push dword [esp]
lea esp, [esp + 0x30]
call fcn.7910fa51
btc cx, 0xf
sal dx, 5
shr cl, 1
mov dword [ebp - 0x1c], eax
pushfd
inc dx
cmp dl, cl
cmp dh, 0x4c
mov eax, dword [ebp + 8]
shr dl, 4
bts dx, 1
mov dword [ebp - 0x20], eax
bts ax, 8
xadd ah, dh
lea edx, [ecx*2 - 0x566d1fa4]
pushal
mov eax, dword [ebp - 0x20]
shr dl, cl
not cl
lea ecx, [eax*4 - 0x79aee211]
ror dl, 6
movzx ecx, word [eax]
xchg dx, ax
xchg al, dh
aas
btc edx, esp
mov dword [ebp - 0x24], ecx
setle cl
clc
shr al, 2
mov eax, dword [ebp + 8]
rcr dx, 2
bts edx, edx
clc
add eax, 6
push 0x1d408f82
call fcn.790a4246
jmp 0x791080be
Function at 0x7916b4a9
Capabilities:
Parse pe header

Disassembly:
movzx ecx, dl
lea ecx, [ebp - 0x94]
mov byte [esp + 8], 0x17
mov dword [esp], eax
lea esp, [esp + 0x40]
call fcn.79004c10
lahf
push 0xa
pushfd
pop eax
call fcn.791651ed
bsr ax, bp
xor ax, 0xc3ab
push ebp
sub esp, 0x54
sal eax, cl
dec ax
bswap ax
daa
mov eax, dword [0x79067330]
push 0x368172b1
cmp ch, 0x60
pushal
xor eax, ebp
call fcn.79108552
mov dword [esp + 0x30], eax
mov byte [esp], ah
mov dword [esp + 0x2c], 0x79058650
push eax
lea esp, [esp + 0x30]
call fcn.7901a720
sar ecx, cl
neg cl
setg cl
add esp, 8
setb ch
pushal
pushal
mov dword [ebp - 4], 0xffffffff
jmp 0x790f15ec
cmp sp, cx
test eax, eax
pushal
pushfd
pushfd
lea esp, [esp + 0x28]
je 0x790bc0d5
pushal
shrd ax, dx, cl
bswap eax
pushfd
movzx eax, byte [0x7906e433]
cmp bh, 0xe0
test eax, eax
pushal
call fcn.790fa6ca
mov eax, dword [ebp - 0xc]
pop ecx
movzx cx, al
push eax
pushfd
movsx cx, bl
bswap cx
lea ecx, [ebp - 0x50]
call fcn.791265d3
lea eax, [eax*2 + 0x429c3132]
add al, ah
xchg dword [esp], ebp
ror al, cl
btc ax, bx
not bp
mov ebp, esp
jns 0x791341e9
not eax
pushfd
bsf ax, dx
sub esp, 0x54
aas
cwde
mov eax, dword [0x79067330]
test cl, 0xed
bt bx, 6
xor eax, ebp
pushal
clc
mov dword [ebp - 4], eax
lahf
mov dword [esp + 0x1c], ebx
pop eax
mov dword [esp + 0x14], esi
sal al, cl
mov dword [esp + 0x10], edi
rcr eax, cl
movzx eax, byte [0x7906e430]
sub esp, 0xfffffff0
js 0x79163c71
cmc
bt di, bx
test eax, eax
call fcn.7917286e
cmp dword [ebp - 0x14], 0
push dword [esp + 4]
mov word [esp], 0x8c71
push 0xd6801543
lea esp, [esp + 0x14]
je 0x790acf98
bt bp, ax
pushfd
pushfd
cmp dword [ebp - 0x14], 0xc8
push esp
pushal
lea esp, [esp + 0x2c]
jne 0x7907594e
pushfd
pushal
pushal
cmp dword [0x7906e1b0], 0
jmp 0x79094787

Function at 0x7916f72a
Capabilities:
Execute anti-debugging instructions

Disassembly:
test edi, ecx
cmc
cmp ecx, dword [ebp - 0x44]
push eax
jmp 0x79105130

Function at 0x7916fec2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 4]
bswap cx
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0x2e84f0ef]
lea ecx, [ebp - 0x47c]
pushfd
pushal
lea esp, [esp + 0x2c]
call fcn.79004c10
push 0x6d83097e
call fcn.7907d993

Function at 0x791768ff
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 4], 0x66
mov dword [esp], ecx
call fcn.790954a5
pushfd
lea esp, [esp + 0xc]
call fcn.7913d60f
push eax
add esp, 8
ja 0x790afbd2
pushfd
mov byte [esp], bh
pushal
mov byte [ebp - 0x39], al
jmp 0x790f5362

Function at 0x79176edf
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, 0x8dfff3ad
and al, 0x34
call fcn.79079d68
call fcn.790d603f
jle 0x79176e81
pop ss
mov edi, 0xd94f0935
sbb al, 0x5e
daa
invalid
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x403da0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406394
test esi, esi
jne 0x403dd6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040651c
jmp 0x403df4
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403c84
mov edi, eax
test esi, esi
je 0x403df4
cmp dword [ebx], 0
je 0x403df4
dec esi
jmp 0x403ddd
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x406044
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42503c], 0
je 0x4060ab
cmp word [0x425328], 0xd7b2
jne 0x40606d
cmp dword [0x425330], 0
jbe 0x40606d
mov eax, 0x425324
call dword [0x425340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4060d8
call fcn.004068d8
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x423022], 0
jne 0x4060c7
push 0
push 0x4239c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406268
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x423024], 0
je 0x406293
mov edx, edi
mov eax, esi
call dword [0x423024]
mov ebx, eax
jmp 0x4062a4
mov eax, 8
call fcn.00403a2c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x42503d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406230
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x4062d9
mov edx, 8
mov eax, ebx
call fcn.00403a48
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40964c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00406994
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4096b9
test ah, 4
je 0x4096b2
test bl, bl
jne 0x409677
mov al, 1
jmp 0x4096e0
test al, 0x10
je 0x40967f
xor eax, eax
jmp 0x4096e0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x4096a3
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x4096e0
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x4096e0
test al, 0x10
sete al
jmp 0x4096e0
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x4096da
cmp ebx, 3
je 0x4096da
cmp ebx, 0x7b
je 0x4096da
mov eax, esi
call fcn.0040960c
test al, al
jne 0x4096de
xor eax, eax
jmp 0x4096e0
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.00406994
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x40a2f5
test esi, 0x400
jne 0x40a27c
test esi, 0x10
setne bl
jmp 0x40a314
cmp byte [ebp - 1], 0
je 0x40a2b7
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
mov eax, edi
call fcn.00406994
push eax
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x40a314
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, 0x10
setne bl
jmp 0x40a314
test esi, 0x10
je 0x40a2c3
mov bl, 1
jmp 0x40a314
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
mov eax, edi
call fcn.00406994
push eax
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x40a2f1
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x40a314
mov bl, 1
jmp 0x40a314
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x40a30e
cmp eax, 3
je 0x40a30e
cmp eax, 0x7b
je 0x40a30e
cmp eax, 0x35
jne 0x40a312
xor ebx, ebx
jmp 0x40a314
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40a614
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [esi + 4]
call fcn.00406394
push 0xa
mov eax, ebx
call fcn.00406994
push eax
push edi
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x40a6ec
push ebx
push edi
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a6ec
cmp dword [ebp - 4], 0xffffffff
je 0x40a6ec
xor eax, eax
push ebp
push 0x40a6e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40a6c7
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
cmp ebx, 2
jb 0x40a6b9
mov edx, ebx
shr edx, 1
lea eax, [esi + 4]
call fcn.00406abc
lea eax, [esi + 4]
call fcn.00406844
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.00403b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a6ce
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret