joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5c0f5a09
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4dfe206b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4018d8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401917
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401917
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401917
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401917
cmp dword [ecx + 0x74], 0xe
jbe 0x401917
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x4032f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x403351
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403351
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x403351
cmp dword [edx + ecx], 0x4550
jne 0x403351
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x40333c
mov edi, 0x8664
cmp ax, di
je 0x403351
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x403351
add ecx, 0xc
cmp esi, ecx
jae 0x403353
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x405ec0
Capabilities:
Encode data using xor

Disassembly:
dec ebx
jge 0x405f12
invalid
adc eax, dword [ebp - 0x36]
ja 0x405f39
push esp
popfd
aaa
das
iretd
adc bh, byte [edx + 0x3f]
test dword [edi - 0x1d], eax
pushal
cwde
clc
and al, 0x6b
xchg edx, eax
xchg edx, eax
invalid
Function at 0x79021df0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x79066330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
movzx eax, byte [0x7906e3a1]
test eax, eax
je 0x79021e1b
mov eax, 1
jmp 0x79021fc1
mov eax, dword [0x7906d1d8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.79035c80
add esp, 4
mov dword [ebp - 0xc], eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [0x7906d1d0], eax
cmp dword [ebp - 0x10], 0
je 0x79021fbf
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.79037770
add esp, 0xc
mov dword [ebp - 0x14], fcn.7903b42b
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xe9
jne 0x79021e95
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 5]
mov dword [ebp - 0x14], eax
jmp 0x79021eb4
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xeb
jne 0x79021eb4
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx], 0x1b8
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax], 0x12c200
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x50
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x79021fbf
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov edx, 0x79021f2d
mov dword [ebp - 0x70], edx
mov eax, 0x79021f6f
sub eax, edx
mov dword [ebp - 0x6c], eax
jmp 0x79021f6f
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.79037770
add esp, 0xc
push 0x50
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x68]
call eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [0x7906e3a1], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.79038526
mov esp, ebp
pop ebp
ret

Function at 0x7902e8e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edx
jl 0x7915acd8
pushfd
lea esp, [esp + 4]
call fcn.79025310
stc
movzx ecx, dl
adc cl, 0x5c
bsr cx, ax
add esp, 0x10
mov cx, di
mov eax, dword [eax]
pushal
push edx
bswap cx
bswap cx
mov dword [ebp - 0x60], eax
setne ch
movzx ax, al
lahf
movzx eax, dl
lea eax, [ebp - 0x5c]
not cx
mov dword [esp + 0x20], eax
push edi
mov word [esp], bx
lea ecx, [ebp - 0xb0]
call fcn.79173653
Function at 0x7902eec3
Capabilities:
Encrypt data using tea

Disassembly:
bt si, 3
pushfd
stc
add eax, dword ds:[edx + ecx*4]
or dl, ch
bsr dx, bp
sal dh, 4
sbb edx, eax
mov ecx, dword ss:[ebp - 8]
and dl, ah
movzx edx, al
sar edx, cl
lea edx, [ebx - 0x70868b95]
add ecx, eax
lahf
sub esp, 0xffffffb4
jle 0x790f1c66
mov dword ss:[ebp - 8], ecx
bswap dx
xadd edx, ecx
shr al, cl
setbe cl
mov edx, dword ss:[ebp - 4]
rcr cx, cl
rcr ax, cl
sub edx, 0x61c88647
aaa
shrd eax, esp, cl
mov dword ss:[ebp - 4], edx
bswap ax
rdtsc
das
mov eax, dword ss:[ebp - 8]
sal ch, 1
bsf dx, dx
bt bp, 1
shl eax, 4
bsr ecx, ecx
sub cl, 0x9c
rcr dl, cl
or cl, 0x4c
mov ecx, dword ss:[ebp - 8]
not dx
shr ecx, 5
ror dx, 8
or dh, 0xd4
rcl dx, 1
pushfd
xor eax, ecx
rcl dh, cl
btc edx, 0xa
setge dl
mov edx, dword ss:[ebp - 8]
shld ecx, ebp, 8
xor edx, dword ss:[ebp - 4]
cmp ah, 0x8b
btc cx, 0xd
add eax, edx
call fcn.79033e85
aas
mov dword ss:[ebp - 8], ecx
pushal
das
mov edx, dword ss:[ebp - 4]
xadd cl, ah
call fcn.79098734
call fcn.7912ec35
sar byte [edx + 0x730a2809], 1
xchg dword [eax], ebx
fisttp qword [esi]
pop ss
dec ebp
ficom dword [eax + 0x1a5cc3a5]
and ebx, dword [ecx - 0x57]
jle 0x790f1c84
jne 0x790f1c99
je 0x790f1cbe
rcr dword [esi + 0x3c], 0x95
mov eax, dword [0x4aee7e79]
shr byte [edx + 0x62], cl
mov dword [0x335cee35], eax
sbb eax, 0x3e21cadf
and al, 0x63
pop ss
wait
iretd
xor dword [ebx], edx
add eax, 0x2a241a3e
out 0xfb, al
outsb dx, byte [esi]
pop eax
das
add eax, 0xc58892a7
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
mov ch, al
fiadd word [edi + 0x3d]
or esp, dword [eax - 0x64]
xor al, 0x52
cdq
not dword [ebp - 0x536ad8a9]
push ss
xor eax, 0x1142281f
sahf
mov esi, 0xe0455f26
add byte [eax], al
or bh, byte [esi]
mov eax, dword [0x7583ab38]
aaa
jno 0x790f1ccc
add byte [bx + di - 0x9e], dh
sal esp, cl
mov bh, 0xe3
cmp al, 0x8b
retf

Function at 0x79030cc1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
lea esp, [esp + 0x14]
movss dword [esp], xmm0
pushal
mov byte [esp], 0xcc
pushal
lea esp, [esp + 0x40]
call fcn.79014360
pushal
bt ax, sp
add esp, 0x24
push ebx
jmp loc.79119eba
Function at 0x79078703
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd0e04115
ror ah, cl
mov byte [ebp - 0x108], 0x12
mov word [esp], dx
mov byte [ebp - 0x107], 0x8e
push 0xb6d67f9
cwde
mov byte [ebp - 0x106], 0x6c
aad 0x36
clc
aam 0xbc
neg ax
mov byte [ebp - 0x105], 0x87
cmc
jmp 0x790bd5f7
shr ah, 5
mov byte [ebp - 0x104], 6
bts ax, 0xd
ror al, cl
sete ah
mov byte [ebp - 0x103], 0x37
test di, bx
or eax, 0xa060d225
mov byte [ebp - 0x102], 0x12
bsr ax, bx
aad 0xf0
not ah
rcl ah, 1
mov byte [ebp - 0x101], 0xaa
setne ah
bts eax, edi
bsf eax, esi
not ah
mov byte [ebp - 0x100], 0xae
mov dword [esp + 4], ecx
inc al
mov byte [ebp - 0xff], 0xfe
aad 0xd6
sbb ax, 0x1cc5
mov byte [ebp - 0xfe], 0x9a
sub al, bh
cmc
btc ax, 0xe
sub ah, ah
mov byte [ebp - 0xfd], 0x3a
rcl al, 1
cwde
mov byte [ebp - 0xfc], 0x12
inc ax
xor ah, ah
rcr ah, 2
mov byte [ebp - 0xfb], 0x41
bt bp, cx
btc eax, 0x10
mov byte [ebp - 0xfa], 0xa9
shrd ax, cx, cl
lea eax, [ecx*8 - 0x725b6d0d]
cmp ah, 0xeb
push esi
mov byte [ebp - 0xf9], 0x3b
adc al, bl
bts ax, bx
shld ax, ax, 9
mov byte [ebp - 0xf8], 0xa5
rcr ah, cl
or ah, dl
and ax, bp
rcl al, 3
mov byte [ebp - 0xf7], 0x3d
das
aas
push dword [esp]
rol ax, cl
mov byte [ebp - 0xf6], 0x12
and ax, 0xb3e6
cmp bl, 0x7e
adc ax, 0x616
test bl, 0xae
mov byte [ebp - 0xf5], 0x22
bts eax, edi
mov byte [ebp - 0xf4], 0x91
daa
mov byte [ebp - 0xf3], 0x18
dec ah
lea eax, [0x144a21af]
neg ax
mov byte [ebp - 0xf2], 0x82
stc
adc ax, 0x803b
ror eax, cl
bsf eax, ecx
mov byte [ebp - 0xf1], 0x40
inc eax
shrd eax, ebp, cl
movsx eax, al
mov byte [ebp - 0xf0], 0x12
movsx eax, bl
bswap ax
sar al, 4
mov byte [ebp - 0xef], 0xcb
add ax, 0xbd4f
movzx ax, al
push dword [esp]
sub eax, 0x4c5da81
mov byte [ebp - 0xee], 0x49
lea eax, [esi*8 - 0x3ba0eed1]
mov byte [ebp - 0xed], 0xc6
rcr ah, cl
lahf
xor ax, dx
bswap ax
mov byte [ebp - 0xec], 0x50
movzx ax, dl
bts ax, 8
pop eax
mov eax, dword [0x7906e4cc]
mov byte [esp + 4], dl
pushal
jmp 0x7914a5e6
cmc
and eax, 0x80000001
call fcn.7909fbe3

Function at 0x79083b54
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp + 8]
mov word [ebp - 0x14c], ax
sar dl, cl
pop ecx
mov dword [esp + 0x1c], 0
rcr ax, 1
not al
mov dword [esp + 0x18], 0
sub ah, cl
bsr dx, dx
aad 0xf6
mov eax, dword [ebp - 0x14]
or dl, 0xfc
btc dx, dx
sub eax, 0x34
xor cl, dh
xchg ch, dl
mov dword [esp + 0x14], eax
bts ecx, 6
mov ecx, dword [0x7906d2d4]
adc dx, cx
neg dh
ror dh, 2
add ecx, 0x7c
not dx
pop edx
xchg dword [esp + 0xc], ecx
lea edx, [esi*8 + 0x6c4475b8]
movsx cx, cl
lea ecx, [esp + 0x642dd263]
mov dword [esp + 8], 0
movsx dx, cl
setno ch
lea edx, [ebp - 0x154]
movsx cx, dl
mov dword [esp + 4], edx
pushal
mov dword [esp + 0x20], 0x79057650
not cl
lea ecx, [ebp - 0x17c]
pushfd
push ecx
pushfd
push ebp
lea esp, [esp + 0x30]
call fcn.790e19c7
jmp 0x79134ad5
lea ecx, [ebp - 0x17c]
push esp
pushfd
xchg dword [esp + 4], ecx
movsx cx, al
pushal
lea ecx, [edx + 0x55ac50fd]
lea ecx, [ebp - 0x4c4]
jmp fcn.7902cc4c
setno cl
lea eax, [ebp - 0x158]
mov ch, 0x30
mov cx, 0x4988
pushfd
mov dword [esp], eax
not cx
jmp 0x790ce5bf
Function at 0x79085283
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [eax], ecx
pushal
push 0x91b14cc9
mov dword [esp + 4], 0xec982a7d
lea esp, [esp + 0x2c]
jmp fcn.7908a2a6

Function at 0x79085936
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x790da8d0
mov cl, 0x5f
call fcn.79171795

Function at 0x790869c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts cx, si
bswap ax
sub esp, 0x470
stc
adc al, al
rcl ch, 2
sar edx, cl
mov eax, dword [0x79066330]
btr dx, cx
sal dx, cl
adc ecx, 0x3e6f3e3c
xor eax, ebp
setnp cl
jp 0x790a74a5
mov dword [ebp - 4], eax
rdtsc
jmp 0x790f61d4
setae ch
mov dword [ebp - 4], eax
not al
mov ah, 0x11
push ebx
push 0x431da3e3
mov dword [esp], esi
lahf
rdtsc
cdq
push edi
not ecx
mov eax, dword [0x7906e518]
lea edx, [ebx - 0x309bf893]
movsx cx, bl
push eax
pushal
sete cl
movsx cx, bl
xchg cx, dx
mov ecx, dword [0x7906e510]
pop edx
pushfd
jmp 0x790cf428
not eax
push ebp
cdq
movsx ecx, dl
mov ebp, esp
sbb ax, bp
jmp 0x790869c6

Function at 0x79088ce7
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
call fcn.7914e2c9
push 0x61ff5c4b
mov dword [esp], 0
movzx ax, bl
bswap cx
call fcn.79116d5a
bt dx, 6
add esp, 0xc
pushfd
fstp dword [ebp - 0x4c]
pushal
pushal
lea esp, [esp + 0x44]
movss xmm0, dword [ebp - 0x48]
push eax
jmp 0x790a6d60
lea esp, [esp + 4]
call fcn.79027e10
lea ecx, [edi - 0x4b738d92]
pushal
pop ecx
lea ecx, [ebp - 0xc]
push dword [esp]
mov byte [esp + 4], 0x64
call fcn.790bd23e
lea esp, [esp + 0x34]
je 0x7907ded4
pushal
push 0x7204683d
lea esp, [esp + 0x24]
jmp fcn.790db40a
pushal
pushfd
lea esp, [esp + 0x28]
addss xmm0, dword [ebp - 0x4c]
call fcn.79020fb7
not eax
setg dh
mov dword [0x7906c3d0], 0xffffffff
rdtsc
mov dword [0x7906c3d4], 0xffffffff
bswap ax
lahf
rdtsc
rdtsc
mov eax, dword [0x7906d2d4]
not dl
jmp 0x7910593e
mov ecx, dword [eax]
push esp
not dx
bswap dx
mov edx, dword [ecx]
movsx ecx, al
bswap cx
mov byte [esp], 0x67
mov dword [ebp - 8], edx
setae ch
not ch
mov dword [esp], 4
pushfd
lea ecx, [ebp - 0xc]
pushal
mov byte [esp], 0x91
mov word [esp], bp
push esi
lea esp, [esp + 0x28]
call fcn.790280c0
mov cl, 0x70
mov eax, dword [0x7906c3b8]
lea ecx, [ebx*2 - 0x75c59c5a]
push eax
push eax
lea ecx, [ebp - 0xc]
jmp 0x790a1099

Function at 0x7908f7db
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [esp + 8], 0xcf
mov dword [esp], 0x9976af68
lea esp, [esp + 0x30]
jle 0x790ae442
pushal
setno ch
lea ecx, [ebx*8 + 0x4c247170]
lea ecx, [ebp - 0x60]
call fcn.7913c0fb

Function at 0x7908ffc7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [eax + 8]
jmp 0x790fe950
jmp 0x79134323
jmp 0x7910bcde
mov byte [esp], 0xb
mov dword [ecx + 8], edx
bswap dx
mov edx, dword [eax + 0xc]
mov byte [esp], bl
lea esp, [esp + 0x54]
jl 0x790d7402
pushal
mov dword [ecx + 0xc], edx
pushfd
not dx
call fcn.790e6f0b
Function at 0x79095761
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], eax
movsx cx, al
jmp 0x7915ca46
movsx cx, dl
lea ecx, [ebp - 0x10]
pushal
mov byte [esp + 4], dl
lea esp, [esp + 0x24]
call fcn.79027e10
cdq
mov eax, 1
xchg cl, dh
imul ecx, eax, 0xc0
test dh, cl
mov dl, 0xd2
mov edx, dword [ebp - 0xc]
sar ax, 1
mov eax, dword [edx + ecx]
stc
push 0x809d15c
stc
push dword [esp]
mov dword [ebp - 0x14], eax
cmp al, ch
cmp dword [ebp - 0x14], 0
pushal
lea esp, [esp + 0x28]
jne 0x7914250b
push ebp
lea esp, [esp + 4]
jmp fcn.790bfb40

Function at 0x79098734
Capabilities:
Encrypt data using tea
Encrypt data using xtea

Disassembly:
sub edx, 0x61c88647
btr cx, dx
pop eax
bsr cx, si
sar ah, 2
mov dword ss:[ebp - 4], edx
xor eax, esi
cmp dh, dh
movsx ax, al
mov eax, dword ss:[ebp - 8]
stc
not dl
push dword [esp]
lea edx, [edi - 0x6588674e]
shl eax, 4
pushfd
mov ecx, dword ss:[ebp - 8]
shl edx, 4
dec dh
pop edx
bswap dx
shr ecx, 5
ror edx, cl
mov dh, 0xd5
xor eax, ecx
pop edx
neg dl
or cl, 0x8a
push 0x65543524
mov edx, dword ss:[ebp - 8]
rcl cl, 3
xor edx, dword ss:[ebp - 4]
pushal
sub cx, bx
xor ch, 0xdd
add eax, edx
rcl cx, 5
bswap dx
mov ecx, dword ss:[ebp - 4]
movzx edx, bl
clc
rcr dl, cl
shr ecx, 0xb
shrd dx, dx, cl
and ecx, 3
bsf dx, cx
sar dx, 0xe
mov edx, dword ss:[ebp + 8]
test ch, ah
push edx
add eax, dword ds:[edx + ecx*4]
bts cx, bp
add cl, bl
mov ecx, dword ss:[ebp - 0x10]
push 0x7999a227
jmp 0x7915894d

Function at 0x7909e28c
Capabilities:
Packed with generic packer

Disassembly:
mov dword [0x7906d334], esi
mov word [esp], 0x5193
mov dword [0x7906d338], edi
jmp 0x791504f3
stc
cmc
stc
call fcn.79118851
call fcn.791343f8
mov dword [0x7906d33c], eax
pushfd
pushfd
lea esp, [esp + 0xc]
call fcn.7911ef76
pushal
adc cl, al
and bh, 0x1c
shl ax, 0xf
add esp, 0x20
popal
cwde
rol al, cl
cmc
mov eax, dword [0x7906d33c]
stc
cmc
push 0x803a7e2c
lea esp, [esp + 4]
je 0x790f37ee
add esp, 0x3c
je 0x790a1600
pushfd
cmp al, 1
pushfd
push 0xfe9af3f7
pushal
push dword [0x7906d340]
pop dword [esp + 0x28]
push dword [esp]
push dword [esp + 0x2c]
ret 0x30

Function at 0x790a4244
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushal
pushfd
mov byte [ebp - 0x59], 1
push dword [esp + 0x10]
pushfd
lea esp, [esp + 0x30]
jmp 0x79145b81
xchg ch, ah
mov ecx, dword [ebp - 0x18]
ror ax, 1
aam 0x3e
rdtsc
movzx edx, byte [ecx]
neg eax
rol ah, cl
movzx eax, byte [ebp - 0x59]
push esp
stc
xor edx, eax
pushal
mov byte [esp], 0xa5
jmp 0x79161482

Function at 0x790a5e29
Capabilities:
Packed with generic packer

Disassembly:
xor edx, 0xbb741cb3
stc
xor ecx, 0xe50d7356
cmp cl, dl
xor eax, 0xbcffcbdd
bt sp, 8
xor ebx, 0xdb15f84
bt eax, esi
cmp ah, dl
xor edi, 0xf65cac0f
push 0x87262f18
call fcn.790f29d0
Function at 0x790a7b96
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc edx, 0xe
push ebp
inc ax
bsf ebp, ebp
bswap ax
push eax
lea ebp, [esp + 4]
movzx ax, dl
dec dh
shrd ax, di, cl
sub esp, 0x440
lahf
mov eax, dword [0x79066330]
shld dx, cx, 3
movsx edx, al
xor eax, ebp
setae ch
mov dword [ebp - 4], eax
rdtsc
rdtsc
push ebx
pushfd
mov ah, 0x95
movzx cx, al
lahf
mov dword [esp], esi
not al
xchg al, ch
mov al, bh
push edi
cwde
xchg edx, eax
cdq
mov eax, dword [0x7906e518]
setne cl
pushfd
mov dword [esp], eax
pushal
lea ecx, [ebx*8 - 0x670f3ca5]
bswap cx
mov ecx, dword [0x7906e510]
jmp 0x7916d5ab
not dh
lea esp, [esp + 0x20]
jne 0x79110df2
push ecx
setge dl
lea edx, [ebp - 0x404]
jmp 0x790caa9f

Function at 0x790a943a
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push 0x7777916f
lea esp, [esp + 0x2c]
je 0x790b5022
not ah
pushal
bswap ax
mov eax, dword [0x7906e4c4]
push 0x9d283b1d
push dword [esp]
mov byte [esp], al
mov dword [esp + 0x24], eax
call fcn.79082168
setle ah
mov dword [ebp - 0x68], 0x321
movzx ax, al
lea eax, [ebp - 0x68]
movsx ecx, bl
push eax
setne ch
bswap cx
not cl
mov cx, 0x57ab
mov ecx, 0x7906d428
pushfd
pushfd
lea esp, [esp + 8]
call fcn.7901c2a0
jmp loc.7902e2c1

Function at 0x790ab209
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, ch
pushal
mov word [ebp - 0x2f8], ax
neg dh
cmp edi, 0x6f7c407b
bsr cx, dx
xor eax, eax
movsx cx, bl
mov word [ebp - 0x2f6], ax
cdq
movsx cx, bl
cwde
lahf
mov dword [esp + 0x40], 0
setl al
movzx eax, dl
mov dword [esp + 0x3c], 0
rdtsc
mov eax, dword [ebp - 0x14]
call fcn.79090294
mov dword [esp + 0x2c], eax
push 0xe6eac628
lea esp, [esp + 0x30]
call fcn.79038990
ror cl, 1
dec dx
add esp, 0xc
test bl, 0x3c
pushfd
cmp dh, ch
test bh, dh
mov eax, 0x66
pop edx
mov word [ebp - 0x2fc], ax
sub dl, dl
rdtsc
or dl, 0x2f
pushfd
mov eax, 0x63
inc dl
shrd cx, si, 7
xadd ecx, edx
mov word [ebp - 0x2fa], ax
pushal
das
movsx eax, al
mov eax, 0x6d
jmp 0x79097b94
jmp 0x791123ce
lea esp, [esp + 0x24]
call fcn.79004c20
xchg ecx, edx
mov eax, dword [0x7906d2d4]
bts cx, 5
and cl, ah
bsr cx, cx
mov ecx, dword [eax + 0x50]
rdtsc
setnp al
sub ecx, dword [ebp - 0x14]
pushal
mov byte [esp], 0x79
movsx eax, al
cdq
mov edx, dword [0x7906d2d4]
lahf
movzx ax, al
movsx ax, bl
pushal
mov dword [edx + 0x50], ecx
lahf
pop eax
mov dword [esp + 0x38], 0xc
pop eax
mov dword [esp + 0x30], 0
bswap ax
movsx ax, al
movzx ax, cl
movzx eax, cl
lea eax, [ebp - 0x2c8]
jmp 0x7909821e

Function at 0x790aba9c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
call fcn.7901c2a0
bsf cx, si
push ebp
mov ecx, dword [eax]
das
stc
bsr ax, bp
ror al, cl
mov dword [ebp - 0x88], ecx
lahf
ror ecx, 3
sbb ax, 0xf09d
rcl cl, 7
mov eax, dword [ebp - 0x88]
pushfd
cmc
cmp bx, bx
ror cl, 4
add eax, 1
pushal
mov word [esp], bx
movsx cx, bl
mov dword [ebp - 0x8c], eax
jmp 0x791699cb
pop ecx
mov dword [esp + 0x20], 4
mov word [esp + 4], 0x9eb4
mov byte [esp], dl
jmp 0x79134e38