joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7907bbcf
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790cf122
pushfd
pushfd
lea esp, [esp + 8]
call fcn.79117f21
call fcn.79097ee4
pop ecx
lea ecx, [ebp - 0x20]
lea esp, [esp + 0x34]
jnp 0x7909f151
pushal
push 0x5114688c
pushfd
lea esp, [esp + 0x28]
call fcn.79117f21
movzx eax, dl
call fcn.7911342c

Function at 0x7908101e
Capabilities:
Encode data using xor

Disassembly:
or byte [eax], al
cmc
cmc
sub eax, dword [ebp - 0x34]
pushal
cmp bh, bl
stc
mov dword [ebp - 0x38], eax
cmp ah, 0xe6
test cl, ch
test edi, 0xd59faa10
jmp 0x79114803
push 0x4507abb1
fstp dword [ebp - 0x8c]
call fcn.7912fc81
call fcn.7915ece2
shr dword [ebp + 0x4a], 0xdc
adc bh, byte [eax + 0x8efdc78]
inc ecx
sbb esi, dword [ecx + 0x2a6e475d]
pop ebx
sbb byte [ebx - 0x75], cl
add dword [edi - 0x21], esp
jb 0x79081000
cmp byte [ebx + 0x43dc92f4], 0x20
sahf
lodsb al, byte [esi]
fmul st(3), st(0)
imul esp, dword [edi - 0x5d], 0xffffff99
dec esp
lahf
movsd dword es:[edi], dword [esi]
aaa
jecxz 0x790810b0
salc
wait
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
out 0x3e, eax
xor eax, 0x2c479b8c
sbb edx, dword [eax + edi*2 + 0x23]
invalid
and esi, ebx
invalid
bound ebx, qword [edx + 0x49]
sbb cl, byte [eax + 0x1b5017e5]
int 0xac
ret
mov dh, 0xdd
xlatb
or al, 0xfd
dec esp
out dx, eax
adc al, 0x20
push esp
test ah, cl
jmp 0x790810d5
push 0xffffffffffffff91
sbb al, 0x99
xchg esi, eax
rcl dword [ebp - 0x1b]
push edx
adc eax, 0x162e4b89
and dword [edx], edx
fsubr st(2), st(0)
mov ecx, 0x3498aa92
xchg esp, eax
xor al, 0x94
xlatb
enter 0xfffffffffffffb81, 0x6d
inc edi
rcr byte [ecx + 0x6250ece], cl
sub byte [ebx - 0x50f62fd1], 0x19
push ebp
loopne 0x790810c9
stosd dword es:[edi], eax
das
ror byte [ecx], 1
scasd eax, dword es:[edi]
sbb dword [ebp - 0x20], edx
jmp 0x79081138
pop ecx
or byte [esp + edi*8 + 0x7c], 0x90
jge 0x7908107f
lds ebx, [esi]
push esp
nop
dec ebx
jg 0x79081071
js 0x7908109b
inc edi
xchg ebx, eax
stc
mov dh, 0x68
xchg esi, eax
loop 0x790810c6
wait
xor eax, 0x86fe6132
mov edi, 0x2ffd64d8
aam 0x4a
invalid
aad 0xa7
pushal
invalid
push 0x6b83fae4
jmp fcn.790f10ab
bswap ecx
not cx
setg ch
not ecx
mov dword [ebp - 4], 0xffffffff
not ch
lea ecx, [ebp - 0x1c]
jmp 0x79092cca
mov dword [ebp - 0x80], eax
jne 0x790c9719
push edi
mov cl, 0xdc
mov byte [esp], al
mov dword [ebp - 4], 0xffffffff
call fcn.790b3e50
cmp dword [ebp - 0x38], 0x12c
push edx
lea esp, [esp + 0x24]
jle 0x79124c28
lea eax, [eax + 0x42c332a4]
bswap cx
bswap cx
mov eax, dword [ebp - 0x24]
jmp 0x790eb615

Function at 0x79082c72
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
call fcn.79039f20
aas
setb ch
rdtsc
neg al
add esp, 0xc

Function at 0x7908487e
Capabilities:
Check http status code

Disassembly:
movsx cx, al
mov eax, dword [eax]
jmp 0x7915f6f5
pushal
mov cl, 0x13
pushfd
mov dword [esp + 0x24], eax
call fcn.790808df
Function at 0x7908bba4
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
setp cl
lea ecx, [esi - 0x5b72f72e]
lea ecx, [ebp - 0x5c]
mov byte [esp + 4], 0xdd
pushfd
pushal
jmp 0x79176a04
xchg ch, dh
jmp 0x7915c272
mov byte [esp], 0x7d
push esp
lea esp, [esp + 0xc]
jne 0x790df444
jmp loc.79037e45
jmp 0x790eb63f
cdq
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0x6c1c97ff]
mov ecx, dword [ebp - 0x24]
lea esp, [esp + 0x44]
call fcn.79026620
cmp ah, 0x77
rol ch, cl
shld ecx, ecx, 4
movzx ecx, al
pushfd
bt bp, ax
push 0xd0a43310
test ecx, ecx
jmp 0x7912c6e1

Function at 0x7908db88
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x48]
call fcn.79036e60
pushal
mov ecx, eax
mov word [esp + 4], 0xcca0
lea esp, [esp + 0x20]
call fcn.7901a340
bswap edi
setnp bl
xchg di, bx
pushal
mov edi, dword [esp + 0x20]
movsx ebx, al
not bl
pushfd
mov esi, dword [esp + 0x28]
bswap bx
lea ebx, [esi + 0x5058c3df]
not bh
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x2c]
call fcn.79152047
xor byte [eax], cl
lodsb al, byte [esi]
and al, 0xdb
mov ebx, 0x6caf3a97
add ebp, dword [edx]
lcall 0xdc37, 0x67881651
pop edx
cmp ebp, esi
outsd dx, dword [esi]
sar dword [ebx - 0x2b], 0xb2
je 0x7908dc13
mov eax, 0x1e4e0a6e
mov byte [0x4b3d1589], al
pop edi
jecxz 0x7908dbe7
fcmove st(0), st(3)
xlatb
sbb eax, 0xfe5d90ae
mov byte [0xe2adce16], al
cmp dword [ecx - 0x2d6e2d0f], esi
ret
mov al, byte [0xb79f318f]
rcr dword [edx + 0x571c2f34], 0x74
sbb byte [edx + 0x489cf9f9], cl
add al, 0x1d
add al, 0xf5
dec edi
jl 0x7908dbc6
wait
xchg ebp, eax
cwde
popal
fld dword cs:[ecx]
sub eax, 0xbd9aec49
and eax, 0xc7164b2b
invalid

Function at 0x7909170a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
movsx bp, dl
lea ebp, [ebx + 0x6931f0e0]
aaa
rdtsc
mov ebp, esp
pushal
test ch, bh
xchg ah, dl
sub al, al
sub esp, 0x42c
lahf
shr dh, cl
mov eax, dword [0x79068330]
btr edx, ebp
cmc
not dh
clc
xor eax, ebp
lea ecx, [esi*4 - 0x738959e6]
push 0xeeb9aea3
mov dword [ebp - 4], eax
rdtsc
call fcn.790f66d2
pushfd
push dword [esp]
jmp 0x79187490
lea esp, [esp + 8]
call fcn.7916fe50
test edi, ecx
pushal
pushfd
add esp, 0x28
jmp loc.7901570e
jmp 0x79169f5f
Function at 0x790961f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp dword [0x7906f330], 0
jmp 0x790fdae1
mov dword [esp + 0x18], eax
not ah
btr ax, bp
sub al, ah
stc
lea eax, [ebp - 0xc]
clc
cmp bh, bl
push 0xd25d3e4c
pushal
mov dword fs:[0], eax
bt di, bx
stc
test si, sp
lea esp, [esp + 0x3c]
jne 0x79077efd
cmp dword [0x7906f330], 0
pushal
call fcn.790ee03e
xchg dword [esp + 0x1c], eax
cwde
or ah, bh
sub esp, 0x74
setge ah
setae al
mov eax, dword [0x79068330]
cmc
pushal
xor eax, ebp
stc
mov byte [esp + 8], 0x3a
mov dword [ebp - 0x10], eax
cmc
mov dword [esp + 0x1c], ebx
pushfd
cmp ah, bh
mov dword [esp + 0x1c], esi
pushfd
mov dword [esp + 0x1c], edi
test cl, 0xb4
jmp 0x7907b3fc
push 0x5b2d0d17
jmp 0x791861a5
cwde
lea eax, [ebp - 0x24]
push 0xee81ede8
mov byte [esp], bl
jmp 0x790f50d4
movsx cx, bl
mov dword [esp], eax
mov cx, 0xacc3
mov ch, 0xbb
lea ecx, [ebp - 0x48]
jmp 0x79155078
pushfd
mov word [esp + 4], 0x251f
lea esp, [esp + 8]
jne 0x790b958d
aaa
xchg cl, ah
das
mov dword [ebp - 0x14], 0x3d1addff
lea eax, [eax*2 + 0x46dae8a3]
shr cl, 7
bsf ecx, edx
das
mov eax, 0x68
bsr cx, ax
mov word [ebp - 0x20], ax
cmp al, 0x7e
cmc
and al, dl
mov eax, 0x63
movsx ecx, cl
shrd cx, cx, cl
shl cl, 4
mov word [ebp - 0x1e], ax
shrd ax, dx, 0xb
adc cl, 0x43
adc ax, 0xd33b
mov eax, 0x68
neg ch
pushal
mov word [ebp - 0x1c], ax
lea ecx, [ebp*2 - 0x1279bbfa]
xor al, bh
mov eax, 0x61
dec ecx
sub cx, si
mov word [ebp - 0x1a], ax
shl cl, cl
rol cx, 0xe
dec cl
sub eax, eax
bsf cx, di
jmp 0x79134348
mov word [ebp - 0x18], ax
sub ax, dx
lea eax, [edi*8 - 0x24d692d]
shrd ax, dx, 2
mov dword [esp + 0x1c], 0
and al, dh
rcl cl, 1
bsf ax, bx
shl al, cl
mov dword [esp + 0x18], 0
shl al, 6
test dl, cl
mov eax, dword [ebp - 0x14]
sbb cl, al
add eax, 0x27
mov byte [esp + 8], 0xe9
lea ecx, [eax + 0x4871d6aa]
push esi
lea ecx, [ebx*4 + 0x4c27a646]
mov dword [esp + 0x18], eax
movsx cx, dl
mov dword [esp + 0x14], 0x7906f330
bswap cx
mov dword [esp + 0x10], 0
setno ch
lea ecx, [ebp - 0x20]
push 0xe5798ea6
jmp 0x79097d60
mov dword [esp + 0x14], ecx
bswap cx
movsx cx, cl
movsx ecx, dl
setbe ch
mov dword [esp + 0x10], 0x79059650
bswap ecx
lea ecx, [ebp - 0x48]
pushfd
lea esp, [esp + 0x14]
call fcn.79156fda
lahf
mov cx, 0x4196
jmp 0x790d61e1

Function at 0x7909edda
Capabilities:
Packed with generic packer

Disassembly:
and al, 0x38
mov byte [esp + 4], bl
and al, 4
mov dword [esp + 4], edx
mov dword [esp], esp
mov dword [esp], 0x7902e8a6
call fcn.790dea23
sub al, 0xb7
cmp dword [edi - 0x66beed7c], ebx
lahf
test byte [edx], dl
inc ecx
cdq
pop edx
sbb al, 0xf9
dec ebx
cmp edx, ecx
mov dl, 6
add eax, 0x93d452a1
add ebp, eax
mov esi, 0xf25e8632
mov al, dh
or dh, 0x9a
aad 0x41
dec edx
fcomp qword [edx]
outsb dx, byte [esi]
popal
lcall 0x86bc, 0xa357ccaa
mov bh, 0x67
sub edx, esp
inc edx
cwde
aam 0x68
push es
add eax, 0x531c5728
inc esp
js 0x7909ee32
dec eax
jg 0x7909ee38
xchg ebx, eax
and al, 0xd8
js 0x7909ee95
jo 0x7909edd2
loop 0x7909eddc
call 0x473f2275
loope 0x7909edf4
jge 0x7909edd5
jg 0x7909ee96
or byte gs:[0xcc2798e8], dl
sal edi, cl
adc dh, 0x31
cmpsd dword [esi], dword es:[edi]
invalid
pushfd
out 0x87, al
iretd
Function at 0x790a2f6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 4
rcl dh, 4
clc
btr dx, 1
imul ecx, eax, 0
movsx dx, al
pushal
not al
sets al
mov edx, dword [ebp - 0xc]
not ah
mov eax, dword [edx + ecx]
pushal
not cx
pushfd
mov dword [esp + 0x44], eax
movsx cx, dl
movzx ecx, dl
pop ecx
mov ecx, 0x7906f3d0
mov byte [esp], 0x7f
jmp 0x79154c6b

Function at 0x790a6ff8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
lea esp, [esp + 4]
call fcn.7901a340
bt ebp, esi
cmp al, dl
pushal
movzx eax, al
clc
pushfd
test bh, 0xad
test eax, eax
jmp 0x790df751
mov word [esp], di
pushfd
jmp 0x791799d6
lea esp, [esp + 0x28]
je 0x791799ed
bswap ax
lahf
pushfd
mov byte [ebp - 0x59], 1
lea esp, [esp + 4]

Function at 0x790a8307
Capabilities:
Packed with generic packer

Disassembly:
movzx ecx, al
stc
test dl, 0x20
cmc
test ecx, ecx
pushfd
call fcn.7909d3ac
lea esp, [esp + 0x2c]
call fcn.79028de0
movzx cx, bl
push eax
bswap cx
pushfd
pop ecx
setne ch
lea ecx, [ebp - 0x5c]
push ebx
mov word [esp], si
lea esp, [esp + 4]
call fcn.79026620
bswap ecx
lea ecx, [ebp - 0x4d39148a]
jmp 0x7907bbbf

Function at 0x790ae8e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, dword [0x79070558]
pushfd
jmp fcn.7901a985

Function at 0x790b0a80
Capabilities:
Write file on windows

Disassembly:
bsf eax, esp
aad 5
shrd ax, bx, cl
push ebp
cmp al, 0x78
xadd bp, ax
sbb ax, 0x128
sal ax, cl
mov ebp, esp
rol ah, cl
aaa
cwde
sub esp, 0x60
lahf
pushfd
mov dword [esp], ebx
clc
ror ah, 1
cmc
push esi
aad 0x69
or al, cl
aad 0xe5
bswap ax
push edi
pushfd
lahf
bts ax, 3
pop eax
mov eax, dword [0x7906f2d4]
jmp 0x7910fa0c

Function at 0x790bcb4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lahf
cmc
cmp bx, bp
bt dx, di
clc
test ah, 0x44
push 0x62fcf35e
jmp 0x7911f818
lea esp, [esp + 0xc]
jnp 0x7907b1fe
bsf ax, sp
mov eax, 4
test cl, dh
pushfd
shl eax, 1
jmp 0x7914391b
push 0x4d5233d1
pushal
pushfd
lea esp, [esp + 0x2c]
movss xmm0, dword [0x79059728]
push 0x16c3cc79
lea esp, [esp + 4]
movss dword [ebp + eax - 0x40], xmm0
pushfd
pushfd
lea esp, [esp + 8]
jo 0x79100d57
lea eax, [ebp - 0x40]
mov cl, 0xaa
push eax
pushfd
pop ecx
pushal
movzx ecx, cl
lea ecx, [ebp - 0x34]
call fcn.790f9c30
call fcn.7912fb5f
Function at 0x790bd183
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push edx
lea esp, [esp + 8]
je 0x790bbd27
stc
ror dh, cl
mov eax, 1
rcr cl, 4
rol dl, cl
setb cl
imul ecx, eax, 5
setb dh
lea edx, [ebp + ecx - 0x404]
push 0xe674a2e7
push 0xd0654d69
jmp 0x7917dda8
movzx dx, dl
mov dword [esp + 0x1c], eax
push dword [esp + 0xc]
lea ecx, [ebp - 0x404]
mov word [esp + 4], 0x24d1
jmp 0x790f9b36
lea esp, [esp + 0x1c]
call fcn.79038d00
shrd bx, ax, cl
rol cl, 7
btc di, di
lea ecx, [esp - 0x5f1dd7d5]
add esp, 0xc
or di, dx
jmp 0x791446c5
jmp 0x790fbec1
cmp eax, dword [ebp - 0x40]
push 0xcdff1969
pushfd
lea esp, [esp + 0x28]
jle 0x79021091
pushfd
push dword [esp]
lea esp, [esp + 8]
jmp fcn.79134e8d
pop edx
mov edx, 0x7d78a5bd
mov dword [esp + 0x18], ecx
not dl
not dx
lea edx, [esp - 0x60f3b7a0]
pop edx
mov edx, dword [0x79070550]
pushfd
mov byte [esp], 0xae
push ecx
mov dword [esp + 0x18], edx
pushfd
jmp 0x790bbd09
test ecx, ebp
test cl, dh
mov dword [ebp - 0x418], 0x16
sub esp, 0xffffffd0
jmp 0x7916db1b
add ah, ch
movzx eax, byte [ebp - 0x409]
bt ecx, ecx
cmp si, cx
cmc
test eax, eax
jb 0x7912c949
pushal
lea esp, [esp + 0x20]
je 0x790bbd27
jmp 0x79126e29
pushal
call fcn.790a2326
mov dword [esp + 0x20], edx
lea esp, [esp + 0x20]
jle 0x7912345e
pushal
lea esp, [esp + 0x20]
call fcn.790c9d2d
sar al, 1
dec dh
add esp, 4
rdtsc
pushal
mov eax, dword [0x79070558]
jmp 0x7909e841
pushfd
mov word [esp], dx
lea esp, [esp + 4]
call fcn.790c9d2d
cdq
stc
shld cx, bx, 0xb
add esp, 4
call fcn.790c232b
movsx eax, cl
mov eax, 1
bt sp, 7
push ebp
imul ecx, eax, 5
pushal
push edx
pop edx
lea edx, [ebp + ecx - 0x404]
jmp 0x7911f44f
jmp 0x7909cd5d
pop edi
setbe bh
dec si
sets bh
pop esi
dec cl
rcr ch, cl
shld cx, bx, cl
pop ebx
ror cx, cl
mov ecx, dword [ebp - 4]
bt ax, di
stc
push 0x26aacf8e
xor ecx, ebp
pushal
pushal
jmp 0x790db9d3
test dh, 0x56
cmp dword [ebp - 0x410], 0
pushfd
push 0x316a1fd1
pushfd
lea esp, [esp + 0xc]
jle 0x7910424f
das
mov eax, dword [ebp - 0x414]
rcl dh, 1
shl ecx, cl
bsr cx, ax
mov ecx, dword [eax]
bsr eax, edx
mov dword [ebp - 0x41c], ecx
rol dl, cl
mov eax, 1
movsx cx, bl
movsx cx, al
adc ch, 0xa
cmc
shl eax, 2
ror cl, 3
rcr ecx, 0xc
movzx cx, al
mov ecx, dword [ebp - 0x414]
bt di, 0xc
push edx
movzx edx, word [ecx + eax]
push dword [esp]
push 0x8f3e8385
rcr al, cl
mov dword [ebp - 0x420], edx
rdtsc
btr cx, 0xe
bt cx, dx
rcl dl, 7
mov eax, 1
setae dl
lea edx, [ebp + 0x375463c6]
btc dx, 2
imul ecx, eax, 6
btr ax, 0xa
clc
mov edx, dword [ebp - 0x414]
pop eax
lea eax, [ecx*8 - 0x6ce27460]
bswap ax
rcl ah, cl
mov eax, dword [edx + ecx]
mov byte [esp + 4], 0x4d
call fcn.790d9148
mov cx, word [esp]
lea ecx, [ebp - 0x1c]
jmp 0x79109181
mov dword [esp + 4], edx
mov byte [esp], 0x4f
call fcn.790990de
cmp al, 0x64
pushal
jmp 0x790c909e
Function at 0x790be0a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
push dword [esp + 4]
lea esp, [esp + 0x2c]
call fcn.79039f20
aaa
cwde
shl dl, cl
rdtsc
add esp, 0xc
seto ah
das
mov eax, dword [0x7906f2d4]
stc
not cx
shl cl, 2
mov ecx, dword [eax + 0x40]
aas
xchg edx, eax
mov dword [ebp - 0x24c], ecx
aad 0x8b
or ch, ah
rdtsc
cwde
mov eax, dword [0x7906f2d4]
movzx edx, dl
inc dh
or cl, ah
mov ecx, dword [eax + 0x40]
bt bx, si
movsx edx, cl
cmc
pushfd
sub ecx, dword [ebp - 0x14]
cmc
mov edx, dword [0x7906f2d4]
cmc
test ch, al
pushal
stc
mov dword [edx + 0x40], ecx
mov dword [esp], 0x9d12dfed
cmp dword [ebp - 0x24c], 0xffffffff
pushal
lea esp, [esp + 0x44]
je 0x790d68dc
daa
cmp ch, al
test dl, 0x2b
shrd ax, dx, cl
mov eax, dword [0x7906f2d4]
xadd cl, dl
xchg dl, cl
not ch
mov ecx, dword [eax + 0x40]
add dl, 0x5f
mov edx, dword [0x7906f2d4]
btr ax, 2
xor ax, 0x7c4f
mov eax, dword [ecx + 0x2d]
and ch, 0xe8
mov cx, 0x7540
pushal
mov dword [edx + 0x30], eax
ror ch, 6
xchg cl, ah
aaa
pushal
mov eax, dword [0x7906f2d4]
neg dl
adc cl, cl
shld cx, si, 4
bsf dx, di
mov ecx, dword [eax + 0x40]
shld ax, cx, 2
mov edx, dword [0x7906f2d4]
cwde
aas
aas
daa
mov eax, dword [ecx + 0x4a]
sbb ecx, 0x63a1a2aa
xor cx, 0xecc2
mov dword [edx + 0x2c], eax
rdtsc
inc dx
mov eax, dword [0x7906f2d4]
inc ch
pushfd
or cl, 0xa4
mov ecx, dword [eax + 0x40]
inc dh
sar ax, 6
sub dl, 0xe1
add ecx, 0x33
sub ah, 0xd0
bts ax, 1
mov dword [ebp - 0x250], ecx
cmp ah, 0x80
rcl dh, 3
rol ah, cl
mov eax, dword [ebp - 0x250]
neg edx
btc dx, bp
shr dx, cl
mov ecx, dword [eax + 1]
sub dl, 0x9c
add al, dh
push 0x6b826881
mov dword [ebp - 0x254], ecx
pushfd
bswap cx
rcl cl, 6
mov eax, dword [ebp - 0x254]
adc dh, 0xac
btr dx, ax
sbb cx, bp
movsx dx, bl
mov ecx, dword [ebp - 0x250]
push dword [esp]
dec dl
btr dx, 1
jmp 0x7907d3cb
inc ecx
shrd eax, esi, cl
aam 0x3d
mov eax, 0x66
sbb cx, 0x1d94
movsx cx, cl
mov word [ebp - 0x260], ax
cmp ch, 0x10
dec ah
sub ax, 0x31f2
mov eax, 0x63
clc
mov word [ebp - 0x25e], ax
xchg ch, ah
cmc
sbb ecx, edi
mov eax, 0x6d
btr ecx, ecx
mov word [ebp - 0x25c], ax
rcr ch, 1
mov eax, 0x6f
pushal
mov word [ebp - 0x25a], ax
sal cl, 1
cmc
pushfd
sub eax, eax
cmc
sub ecx, 0x1f38030b
stc
push dword [esp + 0xc]
mov word [ebp - 0x258], ax
das
test ch, 0xd9
shld ax, ax, cl
mov dword [esp + 0x24], 0
cwde
push dword [esp + 0x10]
sar al, cl
neg ax
mov dword [esp + 0x24], 0
lea esp, [esp + 0x24]
rcr ch, 1
dec cx
ror eax, 0x10
shld ax, bp, 5
push 7
cmp bx, bp
mov al, ch
aas
mov eax, dword [0x7906f2d4]
rcr cl, cl
add eax, 0x48
movzx cx, cl
jmp 0x7913a287
call fcn.79082c35
push 0x4ef00b21
mov dword [esp], eax
pushal
push 0x7dc5010
movzx cx, dl
setp ch
mov dword [esp + 0x20], 1
pushfd
lea ecx, [edi - 0x1871c75c]
lea ecx, [ebp - 0x260]
push dword [esp + 4]
call fcn.790d72d3
call fcn.79121202
mov dword [esp + 0x3c], ecx
pushfd
pushfd
lea esp, [esp + 0x44]
call fcn.790f77eb
sal al, 2
lea eax, [esp - 0x67d86f5c]
shrd ax, bp, 0xc
add esp, 8
lahf
push esp
cwde
mov eax, dword [0x7906f2d4]
mov byte [esp], ch
pushal
jmp 0x7912e481
Function at 0x790be78f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov eax, dword [0x7906f2d4]
bt bp, 8
rcr ch, 4
mov ecx, dword [eax + 0xf0]
sal ax, 1
or edx, 0xb50303d1
add ah, bh
add dl, cl
sub ecx, dword [ebp - 0x14]
sar dx, 0xb
xadd edx, eax
shl dx, cl
daa
mov edx, dword [0x7906f2d4]
sal ah, 6
ror al, 2
mov dword [edx + 0xf0], ecx
ror eax, cl
lea esp, [esp + 0x44]
js 0x790d2aa7
mov eax, 0x69
lea edx, [eax + 0x6a40e90e]
btr ecx, 0xe
inc cl
mov word [ebp - 0x398], ax
aam 0x45
bsr ax, ax
push 0xb569df2b
mov eax, 0x6e
dec edx
jmp 0x7917c447
neg dx
cmp ch, 0xca
mov eax, 0x69
shld ecx, esi, 0x16
xadd dl, ch
mov word [ebp - 0x398], ax
cmc
rcl dx, cl
sbb ah, 0x9c
aam 0xe0
mov eax, 0x6e
and cl, ch
mov word [ebp - 0x396], ax
pushfd
das
mov ah, byte [esp]
mov eax, 0x75
xor dl, 0x29
rcl ecx, cl
mov cx, word [esp]
mov word [ebp - 0x394], ax
aam 0xd4
adc cl, ch
sub ax, 0xe0c
mov eax, 0x61
stc
dec cx
lea ecx, [ebp - 0x651adb86]
mov word [ebp - 0x392], ax
rcr ecx, 0xf
xor eax, eax
clc
inc cl
pop ecx
xor cl, 0x46
mov word [ebp - 0x390], ax
movsx cx, bl
bsr ax, si
push 0
sub al, 0x71
clc
sub al, bl
push 0
aaa
jmp 0x79142597
mov word [ebp - 0x396], ax
sar dx, cl
bts cx, 0xe
mov dh, byte [esp]
cdq
mov eax, 0x75
dec cx
shrd dx, sp, cl
mov word [ebp - 0x394], ax
bsf cx, sp
movsx eax, bl
mov eax, 0x61
or ch, dh
shrd ecx, ecx, cl
movsx ecx, al
mov word [ebp - 0x392], ax
shr cl, cl
xor eax, eax
bsf cx, si
movzx dx, dl
sar dl, cl
mov word [ebp - 0x390], ax
shl ch, 7
rdtsc
mov dword [esp], 0
bsf eax, esp
shld ax, ax, cl
rol edx, 0xe
jmp 0x79181c38

Function at 0x790c8170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmc
cwde
mov eax, 1
jmp fcn.79184f8e
sub eax, dword [0x79070550]
pushfd
bt ax, 2
cmp eax, dword [0x79070558]
pushal
mov byte [esp + 4], bh
pushfd
lea esp, [esp + 0x2c]
jge 0x7911865b
jmp 0x7912f496
jne 0x7907a4d2
bts cx, 1
cwde
mov eax, 1
clc
imul ecx, eax, 0
bsf dx, di
mov edx, dword [ebp - 4]
shr eax, 8
bsr ax, sp
movzx eax, byte [edx + ecx]
xchg dh, cl
mov dword [ebp - 0x14], eax
bsf cx, bp
mov eax, 1
btc dx, bx
inc dh
shl eax, 0
stc
btc cx, ax
btr dx, 0xa
not dl
mov ecx, dword [ebp - 4]
bt cx, di
not dx
push ebp
bswap dx
movzx edx, word [ecx + eax]
movzx cx, cl
mov dword [ebp - 0x18], edx
push esp
bswap dx
btc dx, bx
btr eax, edi
mov eax, 1
xchg ch, dl
setno dl
ror dh, 7
pushal
imul ecx, eax, 3
bts ax, 0xa
mov edx, eax
bts ax, 0xd
mov edx, dword [ebp - 4]
adc al, bl
mov eax, dword [edx + ecx]
cmp ch, 0x48
cmp di, 0xd5a0
setg dh
xor eax, dword [ebp - 8]
bt cx, 8
bt si, bx
not cl
bt sp, bx
mov dword [ebp - 0x1c], eax
mov byte [esp], bh
bt si, 3
mov eax, 1
rol cx, 0xd
rol cl, cl
imul ecx, eax, 7
lea edx, [esp + 0x6bef1dae]
adc ax, 0x7863
call fcn.7916f6ac

Function at 0x790c8c40
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.790c9e77
push esi
lea esp, [esp + 8]
call fcn.79164219
pushfd
push dword [esp]
movzx eax, al
pushfd
bt dx, di
bt bx, 1
cmp bh, 0x73
test eax, eax
lea esp, [esp + 0xc]
jno 0x79092d40
pushfd
pushfd
lea esp, [esp + 8]
je 0x79151fa5
call fcn.7907d89c
Function at 0x790c9053
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [0x79069cdc]
jmp 0x7917cb47
mov dword [esp + 0x28], ecx
jmp 0x79160daa
lea esp, [esp + 0x28]
call fcn.7913c69f
sar eax, cl
add esp, 0xc
xchg cl, ah
lea eax, [ecx + 0x1db48bac]
xchg si, dx
popal
pushfd
call fcn.791848f0
jmp 0x7913eb5d

Function at 0x790caf0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0xec]
sal dh, cl
jmp 0x790fdf0d
sbb ax, 0x288d
das
mov dword [edx + 0xf0], ecx
aam 0x8c
shl eax, cl
xor dh, 0xcb
aas
mov eax, 0x69
sbb edx, esp
mov edx, eax
mov word [ebp - 0x398], ax
add edx, esp
test eax, 0xfdc91e9b
mov eax, 0x6e
pushfd
inc dx
mov word [ebp - 0x396], ax
cwde
rdtsc
mov eax, 0x75
xadd cx, dx
neg ch
or ch, dl
mov word [ebp - 0x394], ax
bsf eax, ebx
aam 0xa6
bts eax, 8
mov eax, 0x61
sub cx, bx
rol dl, 6
pushfd
setg cl
mov word [ebp - 0x392], ax
sal dx, 2
ror dl, 4
rcl cl, cl
sub eax, eax
bswap dx
mov word [ebp - 0x390], ax
pop eax
mov dword [esp + 0x28], 0
mov byte [esp], 0x31
mov dword [esp + 0x24], 0
movzx ax, cl
mov eax, dword [ebp - 0x14]
clc
add eax, 7
pushal
jmp 0x7912a097
clc
rdtsc
sub ecx, dword [ebp - 0x14]
inc al
and dx, 0x750d
aam 0xdb
mov edx, dword [0x7906f2d4]
bt ebx, edx
lea eax, [ebx - 0x4f6889de]
daa
rol ax, cl
mov dword [edx + 0xec], ecx
rcl ah, 6
add cl, 0xd6
adc edx, 0x76dd4e51
mov eax, dword [0x7906f2d4]
pushal
shl cl, cl
mov ecx, dword [eax + 0xf0]
sar dh, cl
setle al
pushfd
lahf
sub ecx, dword [ebp - 0x14]
aaa
dec dh
aaa
mov edx, dword [0x7906f2d4]
btc ax, bx
jmp 0x790f0e19
stc
ror cx, cl
mov dword [esp + 0x40], eax
sbb dl, bl
pushfd
bsf edx, edi
mov ecx, dword [0x7906f2d4]
lea esp, [esp + 0x44]

Function at 0x790d364a
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], bh
call fcn.79166308
je 0x7910eaf9
not cx
mov eax, 1
cmc
call fcn.79085fc0
xadd cx, di
rol di, cl
pop edi

Function at 0x790d40e6
Capabilities:
Write file on windows

Disassembly:
lea esp, [esp + 0x28]
call fcn.7903e1fe
dec ah
stc
add esp, 0x10
movzx ax, dl
not al
push 0xcfbeca7d
mov eax, dword [ebp - 0x10c]
pushal
jmp 0x790bf849
jmp 0x790ccf98
mov dword [esp + 0x20], eax
mov word [esp], 0xa72c
pushal
call fcn.790c49e9
jmp 0x790bb80a
test sp, sp
sub eax, eax
push 0x1f36aae2
pushal
mov byte [esp], 0x88
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x79161e15
bswap di
bswap si
pop edi
not bh
pop esi
movsx bx, dl
movzx bx, cl
push 0x2048a76a
push 0x10b49504
mov ebx, dword [esp + 8]
call fcn.790dc331
mov dword [esp + 8], edx
pushal
jmp 0x790b7ee0
Function at 0x790d9148
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x428], eax
cwde
mov ecx, dword [edx + ecx + 4]
rdtsc
rcr ah, 2
lahf
rcr ah, cl
mov dword [ebp - 0x424], ecx
rcl ch, cl
mov eax, 1
push dword [esp + 4]
ror dl, cl
clc
imul ecx, eax, 0xe
bsf dx, bx
rdtsc
clc
mov edx, dword [ebp - 0x414]
sete al
btc ax, ax
inc ah
mov eax, dword [edx + ecx]
cmp ecx, ecx
jmp 0x790dabcc
mov dword [ebp - 0x430], eax
lea eax, [ebx*4 - 0x623fdd24]
bswap eax
shld ax, sp, 9
setne ah
mov ecx, dword [edx + ecx + 4]
cmp si, 0x5531
aam 0xcb
mov dword [ebp - 0x42c], ecx
rcr ax, 8
aaa
add al, dh
sal eax, cl
mov eax, dword [ebp - 0x410]
test bl, 0x98
sub eax, dword [ebp - 0x418]
push dword [esp]
pushfd
pushfd
mov dword [ebp - 0x410], eax
shl ax, cl
stc
aaa
mov eax, dword [ebp - 0x414]
cmc
pushal
mov byte [esp + 4], dh
pushfd
add eax, dword [ebp - 0x418]
call fcn.7910aeb8