joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790decbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x791799ed
bswap ax
mov byte [ebp - 0x59], 1
rdtsc
movsx cx, al
lahf
mov eax, dword [0x7906f2d4]
push eax
setne dl
call fcn.790a264e

Function at 0x790df52e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0x7913a8e6
cmp bx, 0xd0b7
sub eax, eax
pushal
lea esp, [esp + 0x20]
jmp fcn.7914b8f6

Function at 0x790eed20
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7914add5
push ebx
mov dword [esp + 8], 0
jmp 0x79131948
pushal
mov dword [esp + 0x24], 0x56
mov byte [esp + 4], 0xde
pushal
mov dword [esp + 0x40], 0
jmp 0x790c2068
mov byte [esp + 4], ch
mov dword [esp], esi
mov dword [esp + 0x3c], 0
pushfd
jmp 0x7907b7c9

Function at 0x790eed62
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol ch, cl
rol dx, cl
rol cx, cl
imul ecx, eax, 0xd8
rcl al, cl
movzx edx, dl
rol dh, 2
mov edx, dword [ebp - 0x34]
btr ax, 0xa
mov eax, dword [edx + ecx]
push edx
rcl dh, 7
mov dword [ebp - 0x38], eax
push dword [esp + 4]
pop ecx
movzx dx, cl
ror ecx, cl
mov eax, 1
bswap dx
pushal
imul ecx, eax, 0
rdtsc
ror ah, cl
btr ax, 9
pushfd
mov edx, dword [ebp - 0x38]
lahf
jmp 0x790f5bc4
lahf
mov eax, dword [edx + ecx]
xchg ecx, edx
movzx cx, dl
rcr dh, cl
mov dword [ebp - 0x3c], eax
rcr ecx, 7
lea ecx, [ebx*8 - 0x6de0b01f]
btr cx, 0xf
lahf
mov eax, 1
setle dh
clc
bts cx, 8
rcl dx, 3
imul ecx, eax, 0x38
or dl, bh
and edx, 0x56dca1fb
add al, ah
add ecx, dword [ebp - 0x3c]
movzx edx, cl
lahf
bswap dx
mov dword [ebp - 0x40], ecx
bts ax, cx
bts ax, 0xb
rdtsc
mov eax, 1
clc
rcr dh, cl
pop edx
rcl edx, cl
imul ecx, eax, 0x48
jmp 0x79165b57

Function at 0x790fdb77
Capabilities:
Create thread

Disassembly:
lea esp, [esp + 8]
call fcn.7903bc2b
pushal
pushfd
pushal
clc
add esp, 0x50
call fcn.7908d886
push 0x7f281a13
mov dword [esp + 8], 0
mov word [esp + 4], 0xe2e7
push 0xd19e35f
jmp 0x7916ae5c
mov dword [esp + 8], 0
mov byte [esp], 0xd5
mov dword [esp + 4], 0x790225f0
pushfd
jmp 0x790ae638

Function at 0x7910274a
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x44], ecx
movzx ecx, al
push dword [ebp + 0xc]
pop dword [esp + 0x40]
jmp 0x79108ddf
Function at 0x79103eaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror al, cl
pushfd
mov edx, dword [ebp - 0x14]
jmp fcn.79128647
mov edx, dword [ebp - 0x14]
movsx ax, cl
sete ah
movzx eax, word [edx + ecx]
lea ecx, [ecx - 0xc98b974]
mov dword [ebp - 0x44], eax
bswap ax
bts ecx, edx
xchg al, ch
mov eax, 1
clc
bswap dx
imul ecx, eax, 0x26
ror ax, 9
stc
jmp 0x7917e81b
lahf
movzx eax, word [edx + ecx]
movsx cx, cl
ror cl, cl
pushfd
pop edx
mov dword [ebp - 0x48], eax
pushal
stc
rdtsc
mov eax, 1
xchg dh, cl
mov cl, 0x2d
rcl cx, cl
ror dl, 3
imul ecx, eax, 0x28
btr dx, 5
mov edx, dword [ebp - 0x14]
bt dx, 4
btc ax, sp
bt si, sp
movzx eax, word [edx + ecx]
rcl ch, 1
ror dl, cl
stc
rol ch, 4
mov dword [ebp - 0x4c], eax
bt dx, 8
pop eax
mov eax, 1
not edx
stc
movsx dx, bl
imul ecx, eax, 0x2a
jmp 0x79167539
lea esp, [esp + 0x60]
jge 0x7902100b
mov edx, dword [ebp - 0x14]
jo 0x7911fa7a
pushfd
not al
movzx eax, word [edx + ecx]
btr ecx, 0x19
bswap dx
mov dword [ebp - 0x48], eax
btc ax, cx
call fcn.7911bcb2

Function at 0x79104f75
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0
pushal
mov byte [esp + 8], 0x7d
pushfd
pushfd
mov dword [esp + 0x24], 0x74
mov byte [esp], 0xa9
pushfd
push dword [esp + 0x10]
jmp 0x79101a0d
push 0xa35494da
mov dword [esp + 0x20], 0xb6ae487e
call fcn.790c92f0
xor edi, 0x4883fe53
clc
call fcn.7914cd68
push 0xaf267413
jmp 0x790f4d09
call fcn.7918354e
push dword [esp]
mov byte [esp], 0x73
jmp 0x79100d3f
mov dword [esp + 4], 0x21
mov dword [esp], eax
mov dword [esp], 0
push ebx
call fcn.7913e259
bswap cx
movzx cx, cl
lea eax, [ebp - 0x40]
bswap ecx
call fcn.7911bd07
mov dword [esp + 0x28], 0
push 0x811d3fcd
lea esp, [esp + 0x2c]
jg 0x790bd833
push 0
call fcn.7915906a
jmp 0x790bd287
mov dword [esp + 0x4c], 0
push dword [esp]
lea esp, [esp + 0x50]
call fcn.7901ff80
push edi
add esp, 0x20
jmp 0x7917bca9
pushfd
jmp 0x790915dd

Function at 0x79105fbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [edx + 0x50], ecx
pushfd
cwde
mov dword [esp + 0x20], 0xc
pushal
mov al, 0x28
not eax
mov dword [esp + 0x3c], 0
setge ah
movsx ax, dl
lea eax, [ebp - 0x2c8]
mov byte [esp + 4], 0x66
jmp 0x7911e182
pushfd
mov dword [esp + 0x3c], eax
jmp 0x790b336b

Function at 0x791088dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov eax, dword [ebp + 4]
push dword [esp + 0x10]
mov dword [0x7906e3b4], eax
mov byte [esp + 4], ah
mov dword [0x7906e3b8], esi
call fcn.7914cbf2
Function at 0x7910f525
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp loc.79015b65
add esp, 0xc
cmp esi, 0x1f28075a
push ebx
pushal
pushfd
cmp dword [ebp - 0x2f4], 0
jmp 0x790c55c6
pushal
mov byte [esp + 4], cl
push 0x91767a9e
push 0x2312af64
lea esp, [esp + 0x28]
call fcn.79039f20
test dl, bh
add esp, 0xc
pushal
test cl, dh
pushal
cmp dword [ebp - 0x2f4], 0
pushfd
pushfd
push 0x59bd3db7
lea esp, [esp + 0x4c]
je 0x791844e0
movsx eax, bl
mov eax, dword [ebp - 0x2f4]
bt ax, dx
sar dl, cl
sub eax, dword [ebp - 0x14]
rol cl, cl
sal dx, cl
mov dword [ebp - 0x2f4], eax
rdtsc
bswap dx
mov eax, dword [ebp - 0x2f4]
adc cx, 0x8d77
cmc
rol ch, 7
shrd ecx, ecx, cl
add eax, 6
push esp
test al, 0x9d
shr dh, 2
xadd cl, dl
mov dword [ebp - 0x328], eax
rdtsc
shr dx, cl
mov eax, dword [ebp - 0x328]
clc
and cx, 0x4c71
shrd cx, ax, 4
seta dl
mov ecx, dword [eax]
aaa
shrd dx, cx, 3
call fcn.790f42de
lea esp, [esp + 0x40]
jns 0x790ded89
pushal
lea esp, [esp + 0x20]
call fcn.79039f20
bt di, di
clc
jmp 0x790d919f
jmp 0x7915f660
lea eax, [ebp - 0x2fc]
pushal
jmp 0x790ede5a
mov byte [esp + 8], 0xcd
mov dword [esp + 0x3c], eax
push dword [esp]
jmp 0x790e6473

Function at 0x79116d48
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0xc]
ucomiss xmm0, dword [0x79059728]
push 0x78bb12cb
pushal
lahf
pushal
test ah, 0x44
pushfd
lea esp, [esp + 0x48]
jnp 0x7908c7f5
push ebx
lea esp, [esp + 4]
movss xmm0, dword [ebp - 0x2c]
push 0x7d7fe8ab
mov byte [esp], 0x86
lea esp, [esp + 4]
ucomiss xmm0, dword [0x79059728]
push 0xc9ed191e
call fcn.7912386c

Function at 0x7911ff4a
Capabilities:
Write file on windows

Disassembly:
call fcn.790e77a3
invalid
push 0xd4e6dc18
mov byte [esp], dl
lea esp, [esp + 4]
call fcn.79005ca0
pushal
pushfd
mov byte [esp], dh
call fcn.79106334
lea ecx, [esi - 0x7fc1ab6c]
jmp 0x790edcdc
pushfd
lea esp, [esp + 4]
jne 0x790ea4b2
pushfd
cmc
push dword [esp]
mov byte [esp], 0x4a
xor eax, eax
mov byte [esp], 0xb0
lea esp, [esp + 8]
jmp 0x79161e15
cwde
mov eax, dword [0x7906f2d4]
test ch, ch
mov ecx, dword [eax]
movzx dx, cl
clc
sub edx, 0xe2716e1c
mov edx, dword [ecx]
cmp bl, 0x7d
cmp bx, si
mov dword [ebp - 4], edx
cmp si, 0x3e43
cmp ax, bp
cmp dword [ebp - 4], 0
pushal
call fcn.79123f65
lea ecx, [ebp - 0x84]
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.79004c40
pushal
pop ecx
lea ecx, [edx + 0x2c3461c9]
mov dword [esp + 0x18], eax
pushfd
mov cl, byte [esp + 0xc]
lea ecx, [ebp - 0x70]
mov word [esp], di
lea esp, [esp + 0x1c]
call fcn.79034470
ror ch, 3
mov cx, cx
and ecx, ebx
or cl, 0xb4
mov ecx, dword [ebp - 0x74]
cmp si, 0xa764
jmp 0x7910f9ff
cmp bl, al
stc
add ecx, 4
pushfd
pushal
call fcn.790ec05f
cmc
cmp dword [eax], 0
jmp 0x7909a108
xchg dx, cx
lea edx, [ebp - 0x164]
movsx cx, al
mov byte [esp + 8], bl
mov dword [esp + 0x18], edx
lea esp, [esp + 0x18]
jl 0x79030781
lea ecx, [ebp - 0xd8]
jmp 0x79082617
Function at 0x79120378
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x24]
je 0x79015c63
pushal
stc
pushfd
cmp dword [ebp - 0x10], 0
pushal
pushfd
call fcn.7912ca36
clc
xor edi, 0xd951f6a9
call fcn.791887d2
stc
clc
movzx eax, al
call fcn.7915050b
pushal
cmp eax, dword [ebp - 0x2c]
jmp 0x790dc2d5

Function at 0x79121fdf
Capabilities:
Write file on windows

Disassembly:
pushfd
mov word [esp + 4], ax
lea esp, [esp + 8]
movss xmm0, dword [ebp + ecx - 0x28]
pushal
push 0xd5e9d770
jmp 0x7911ff45

Function at 0x79123f65
Capabilities:
Write file on windows

Disassembly:
cwde
movsx eax, al
mov eax, 1
rcr cx, 0xe
imul ecx, eax, 0xb4
bts edx, ebp
mov edx, dword [ebp - 4]
rcl al, 6
cmp bp, di
setb ah
cmc
mov eax, dword [edx + ecx]
stc
push edi
bt eax, esi
mov dword [ebp - 8], eax
pushfd
cmp dh, 0xb1
mov byte [esp + 4], 0x6c
cmp dword [ebp - 8], 0
push edx
lea esp, [esp + 0xc]
jne 0x7912fa89
cmp ah, 0x46
pushal
xor eax, eax
push ecx
pushfd
lea esp, [esp + 0x28]
jmp 0x79161e15
mov byte [esp + 4], cl
lea esp, [esp + 0x24]
jne 0x7902f8ee
bt cx, 4
cmp cl, 0x69
pushal
sub eax, eax
push dword [esp]
mov byte [esp + 8], 0x42
lea esp, [esp + 0x24]
jmp 0x79161e15
cdq
cdq
cwde
mov eax, 1
bswap edx
xchg dh, ch
call fcn.79033278

Function at 0x791280c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ch, dh
clc
mov dword [ebp - 8], eax
clc
mov word [esp], 0xe984
cmp dword [ebp - 8], 0
pushal
push dword [esp]
mov dword [esp + 4], ecx
jmp 0x79139a87
bt bp, di
bt edx, ecx
xchg cx, dx
bt sp, di
mov eax, 1
pushal
movsx cx, al
movzx edx, dl
imul ecx, eax, 0xb4
adc al, 0xd9
mov edx, dword [ebp - 4]
sub ax, bx
das
mov eax, dword [edx + ecx]
cmc
jmp 0x7908eeb4
cmp ax, 0x3457
mov dword [ebp - 4], edx
jmp 0x7913a1a3
cmp dword [ebp - 4], 0
pushal
push edi
mov byte [esp], 0xc0
lea esp, [esp + 0x28]
jge 0x79106102
jne 0x7910fc6d
cmc
xor eax, eax
push esp
pushal
mov byte [esp], cl
lea esp, [esp + 0x24]
jmp fcn.791451cc

Function at 0x7912a259
Capabilities:
Access peb ldr_data

Disassembly:
push 0xd057422a
pushfd
lea esp, [esp + 0x50]
call fcn.79039ab6
pushal
mov esp, ebp
not bp
not ebp
pop ebp
pushfd
pushfd
mov byte [esp + 4], 0xb5
push dword [esp + 4]
push dword [esp + 0xc]
ret 0x10
clc
pushfd
shld ecx, ecx, 5
mov ecx, dword [ebp - 0xc]
sbb di, bp
mov dword fs:[0], ecx
inc ch
neg cx
xchg si, di
test dh, 0xf4
mov ecx, dword [esp + 0xc]
pushal
sal di, 4
mov edi, dword [esp + 0x30]
movsx esi, al
sub si, di
mov esi, dword [esp + 0x34]
bts bx, si
xor ch, 0xd6
bsr bx, bx
mov ebx, dword [esp + 0x38]
rcl ch, 3
mov ecx, dword [ebp - 0x10]
pushfd
push esi
clc
xor ecx, ebp
push ebp
jmp 0x7908855f

Function at 0x7912ca36
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x4c]
je 0x79015c63
cmc
aad 0xc9
clc
rcr ah, 5
mov eax, 0x1211
stc
test eax, eax
pushfd
lea esp, [esp + 4]
je 0x79015c25
call fcn.790c2ae0
Function at 0x7912dcc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [edi*8 + 0x633cdc3]
pushfd
mov byte [ebp - 0x16], 0x79
movzx ax, dl
mov byte [ebp - 0x15], 0x56
pushal
push 0x66642d95
lahf
mov byte [ebp - 0x14], 0x69
lahf
setno al
mov byte [ebp - 0x13], 0x72
bswap ax
movzx eax, dl
lea eax, [ebx + 0x49b9eb67]
pop eax
mov byte [ebp - 0x12], 0x74
movzx ax, dl
mov ah, byte [esp + 0xc]
cwde
mov byte [ebp - 0x11], 0x75
movsx ax, al
mov byte [ebp - 0x10], 0x61
pop eax
bswap ax
mov byte [ebp - 0xf], 0x6c
mov ax, 0xc71
mov byte [ebp - 0xe], 0x4d
not ax
movsx ax, bl
pushal
cwde
mov byte [ebp - 0xd], 0x65
push dword [esp + 4]
cwde
setbe al
setp al
mov byte [ebp - 0xc], 0x6d
setno ah
cwde
mov byte [esp + 0x10], 0xe0
mov byte [ebp - 0xb], 0x6f
mov eax, esp
setnp al
mov byte [ebp - 0xa], 0x72
lahf
setp ah
lahf
not al
mov byte [ebp - 9], 0x79
movzx ax, dl
mov byte [ebp - 8], 0
bswap ax
mov ah, byte [esp + 4]
lea eax, [ebp - 0x1c]
mov byte [esp + 8], cl
mov dword [esp + 0x44], eax
mov word [esp + 4], cx
mov dword [esp + 0x40], 0x7905967c
push dword [esp]
pushfd
mov dword [esp + 0x44], 0x79146356
jmp 0x79162847

Function at 0x7913197b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [0x7906f434], al
rdtsc
adc dh, 0x70
setge ch
rdtsc
mov eax, 1
rcr cl, cl
btc cx, 9
shrd cx, ax, cl
cmp al, dh
shl eax, 4
mov byte [esp], 0xd8
mov ecx, dword [ebp + 8]
movzx dx, cl
movsx edx, bl
movsx dx, al
movzx edx, byte [ecx + eax]
call fcn.79088e48

Function at 0x7913706e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.7917cb11
lea ecx, [edx + 0x44d4068b]
imul ecx, eax, 0x118c
rdtsc
mov edx, dword [ebp + 0xc]
shl al, cl
jmp 0x7914c71f
mov eax, dword [edx + ecx]
pushal
pushal
mov byte [esp + 4], dl
mov dword [ebp - 0x3c], eax
pushfd
test bl, cl
cmp dword [ebp - 0x3c], 0
jmp 0x790fb8ae

Function at 0x7913936c
Capabilities:
Write file on windows

Disassembly:
lea esp, [esp + 4]
jne 0x7914804b
movsx ax, cl
lea eax, [edi + 0x5a68d709]
mov eax, dword [ebp - 0x14]
pushal
pushal
push eax
push 0xc6bd1275
lea esp, [esp + 0x48]
jmp 0x79161e15
pushal
pushal
pushfd
call fcn.79131fb1

Function at 0x7913d80e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xcd3f419e
lea esp, [esp + 0x2c]
call fcn.7903b7ea
mov dl, 0x64
sal dl, 3
sar dh, 7
cdq
dec cl
xor ch, bh
mov ecx, 0xa
stc
push esi
pushfd
idiv ecx
sub esp, 0xfffffff8
ja 0x79178de1
clc
and cl, ah
lea ecx, [ecx + 0x35ab3ea7]
mov eax, 5
not ecx
bswap cx
or cl, 0x84
sub eax, edx
cmc
btr edx, ebx
bswap cx
add eax, dword [ebp - 0xa8]
jmp loc.7902fb82
mov byte [esp], 0xdc
mov dword [ebp - 0xa4], eax
jmp 0x790dfac4
Function at 0x7913f2a5
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp], bl
push eax
mov word [esp], dx
lea esp, [esp + 8]
call fcn.7902c460
jmp 0x7916edb5
movzx dx, al
not edx
mov edx, dword [ebp + 8]
pushfd
call fcn.79156c64
movzx ecx, bl
movzx ecx, al
pushal
mov dword [ebp - 0x14], eax
lahf
cwde
movzx ax, dl
pushfd
mov eax, dword [ebp - 8]
pop ecx
setb ch
movzx cx, bl
mov byte [esp + 8], 0x70
mov dword [ebp - 0xc], eax
pushfd
push dword [esp]
setnp al
bswap eax
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [ebp - 0x10], eax
bswap ecx
lea eax, [edi*2 + 0x3e56f7b2]
bswap ax
sets cl
lea eax, [ebp - 0x14]
setbe ch
pushfd
mov dword [esp + 0x28], eax
push eax
not cl
lea ecx, [edx*4 + 0x73a1bdeb]
mov ecx, 0x79071668
pushfd
lea esp, [esp + 0x30]
jp 0x790a9159
push edx
push dword [esp]
lea esp, [esp + 8]
call fcn.7902c460
lea ecx, [edx - 0x7fc86946]
lea edx, [ecx*4 + 0x60f89d25]
push 0
movzx edx, cl
mov eax, dword [ebp + 0x10]
movsx ecx, cl
call fcn.7914ceac
not al
lea ecx, [edi - 0x5129c5b7]
push 0
not al
mov eax, dword [ebp + 0x10]
push 0x205e87f6
push dword [esp]
mov byte [esp + 4], 0xc3
mov dword [esp + 4], eax
movsx cx, bl
pushfd
not cx
mov ecx, dword [ebp + 0xc]
movzx dx, al
setb dh
mov dword [esp + 4], ecx
pop edx
jmp 0x790eb630

Function at 0x791504d7
Capabilities:
Write file on windows

Disassembly:
call fcn.79106c76
mov dword [esp + 4], 0xb6bf6d0e
mov word [esp], sp
jmp 0x790d40e1

Function at 0x79153ac9
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl dx, cl
lea edx, [ebp - 0x462586a3]
jge 0x7917d555
xadd dx, ax
push ebp
xadd eax, edx
cdq
shl bp, cl
mov ebp, esp
lea edx, [0x63165c88]
xchg al, dl
stc
dec al
sub esp, 0xd8
rdtsc
mov eax, dword [0x79068330]
shl dh, 3
setb dl
cmp bl, 0xf6
xor eax, ebp
call fcn.79145a0b

Function at 0x7915534b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
push 0xeecf8b36
mov dword [esp + 0x38], 0x7912dc91
mov byte [esp + 4], bl
pushfd
call fcn.7916d584
push ebp
mov dword [esp + 0x30], edi
jmp 0x79100d26

Function at 0x791563a5
Capabilities:
Encode data using xor

Disassembly:
xor edi, 0x4530411b
cmc
xor ecx, 0xc4faadb2
clc
pushfd
xor dword [esp + 0x30], 0x840
call fcn.7902ec50
shl byte [esi - 0xa], 0xaa
cmp ebp, ebp
xchg ebx, eax
cmp eax, 0xff274ce2
jno 0x791563ae
mov dl, 0xad
cli
invalid
enter 0x315e, 0xfffffffffffffff5
retf 0x2744

Function at 0x7915851a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0xc]
call fcn.79039f20
sal al, cl
add esp, 0xc
shld ax, sp, cl
clc
mov eax, 0x5f
not dh
mov word [ebp - 0x154], ax
rdtsc
rcr ax, 5
rdtsc
sal cx, 0xf
mov eax, 0x67
stc
call fcn.790ce145

Function at 0x7915d484
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.7913a1df
push ecx
sbb al, dh
btc ax, dx
movzx eax, byte [0x79069cca]
clc
cmp dh, ah
push eax
jmp 0x79113f42
test eax, eax
pushfd
call fcn.790ba73e
pushal
lea esp, [esp + 0x28]
jne 0x7916a8ef
pushal
pushfd
jmp 0x7915c40c
clc
call fcn.790c889f
cmp ax, 0x8bca
test dx, 0x71e2
push edx
bt ax, 9
cmp dword [0x7907054c], 0x2b
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0x791607a4
jmp 0x790b377a
Function at 0x7916625b
Capabilities:
Write file on windows

Disassembly:
xor eax, eax
pushal
push dword [esp + 0x10]
lea esp, [esp + 0x48]
jmp 0x79161e15
clc
pushal
jmp 0x7908daf2

Function at 0x7916706b
Capabilities:
Packed with generic packer

Disassembly:
jne 0x79162eb4
pushal
lea esp, [esp + 0x20]
movss xmm0, dword [ebp - 0x2c]
push 0xca7ebd08
push dword [esp]
mov byte [esp], 0x21
lea esp, [esp + 8]
addss xmm0, dword [0x7905973c]
call fcn.7914c3ad
lea esp, [esp + 0x44]
movss xmm0, dword [ebp + eax - 0x18]
pushfd
pushal
pushal
lea esp, [esp + 0x44]
movss dword [ebp - 0x34], xmm0
test al, bl
cmp cl, ch
test esp, ebp
cmp dword [ebp + 8], 0
jmp 0x790f1e2a
jmp 0x7914f3fa

Function at 0x7916febf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], bl
lea esp, [esp + 8]
call fcn.790376c0
call fcn.791835c2

Function at 0x7916fed1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x7906f2d4]
pop ecx
jmp 0x790a5582
lea esp, [esp + 0x48]
je 0x791799ed
mov cl, ah
pushfd
mov byte [ebp - 0x59], 1
jmp 0x7915d8ee

Function at 0x791703c1
Capabilities:
Encode data using xor

Disassembly:
cmp ah, 0x83
cmp cl, ch
add eax, 1
push 0xed8c0a0d
jmp 0x79122f83
push esi
mov dword [esp], eax
pushal
pushfd
pushfd
mov byte [esp], 0xec
lea esp, [esp + 0x28]
call fcn.79039f20
not eax
add esp, 0xc
sal ax, cl
inc ah
daa
ror ax, 7
mov dword [0x79070430], 0
seta ah
movsx ax, bl
neg eax
sbb al, 0x97
mov dword [0x79070434], 0
das
aas
mov byte [0x7907042d], 0
movsx ax, dl
cmp cl, ch
aad 0x70
dec ax
mov eax, dword [ebp - 0x1c]
jmp 0x7914aad4
lea esp, [esp + 8]
call fcn.79039f20
rcr ax, cl
clc
add esp, 0xc
movzx ax, dl
clc
or ah, 0x6a
mov dword [0x79070430], 0
aad 0xae
mov dword [0x79070434], 0
shrd eax, edx, 0xe
jmp 0x790c4831
lea esp, [esp + 4]
js 0x7914bd94
push 0xc7b44973
mov dword [esp], eax
pushfd
push ecx
jmp 0x79151868

Function at 0x79170959
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x7906f2d4]
lea edx, [esp + 0x1cb57197]
mov ecx, dword [eax + 8]
pushal
dec bx
mov dword [0x7906f31c], ecx
lea edx, [ebx*8 + 0x552b33ff]
movzx eax, bl
lea esp, [esp + 0x20]
popal
dec dx
not al
push ebp
pushfd
lea ebp, [esp + 4]
sets ah
push 0x7096d416
mov dl, 0x91
bswap ax
mov dword [esp + 4], ecx
lea esp, [esp + 4]
jbe 0x791250ca
push ebx
dec bl
push esi
mov al, 0x3a
seta bh
push edi
cdq
bswap di
pushfd
pop eax
mov ebx, ecx
bswap edx
jmp 0x79154267
call fcn.7918026f
pushal
push 0x712e4536
mov eax, dword ds:[0x2f0d308]
xchg si, di
pushfd
push dword [esp + 4]
setge dh
inc eax
shr edx, 0xd
xadd dx, cx
bt sp, 6
jmp loc.790232b5
lea esp, [esp + 8]
pushal
dec dl
jmp 0x790ccbd8
Function at 0x79172985
Capabilities:
Encode data using xor

Disassembly:
call fcn.790a47ee
mov dword [esp + 4], ecx
pushal
lea esp, [esp + 0x24]
movss xmm0, dword [ebp + edx - 0x20]
pushfd
push esi
pushal
lea esp, [esp + 0x28]
movss dword [esp], xmm0
push 0xf7611713
jmp 0x7915fc86
movss xmm0, dword [ebp - 0x48]
push esp
lea esp, [esp + 4]
movss dword [ebp - 0x30], xmm0
movsx eax, al
mov eax, dword [ebp - 0x38]
call fcn.7916b8a9
push ds
pop ebx
inc eax
out 0x91, al
adc eax, 0xbcf20dc3
ja 0x79147b0a
loope 0x79147b44
cmp al, 0xe2
xchg ebp, eax
xor dword [ebx + 0x237dd315], edi
mov ch, 0xc5
or esp, ecx
movsb byte es:[edi], byte [esi]
aam 0x36
mov edx, 0xa7fecf30
std
call 0xa84fa011
ljmp 0xfb2a
sbb dword [edx + 0x12], 0x9ccfa4b7
sub byte [0xa3657952], bh
cwde
mov bl, 0xac
scasd eax, dword es:[edi]
mov esp, 0xb8bb9897
xchg ebx, eax
push ebp
or byte [edi], bl
cmp al, 0x2f
and al, 0x1b
jae 0x79147ad2
mov esp, 0xf0fb7305
fbld tbyte [esi + 0xf]
bswap cx
lea ecx, [ebp - 0x120]
call fcn.790fcc72
pushfd
add esp, 0x10
cmp cl, ch
stc
cmp ecx, 0xdef104df
cmp dword [0x7906f330], 0
call fcn.7917af9b
pushal
lea esp, [esp + 0x24]
call fcn.790feaa7
bt sp, ax
test dx, bp
add esp, 0x10
cmc
fstp dword [ebp - 0x48]
cmc
pushfd
cmp dword [ebp - 0x34], 0
pushfd
push 0x9416ee48
lea esp, [esp + 0xc]
je 0x79081228
pushfd
pushal
lea esp, [esp + 0x24]
jno 0x790b39d3
movss xmm0, dword [ebp - 0x30]
pushal
mov byte [esp], 0xa3
lea esp, [esp + 0x20]
comiss xmm0, dword [ebp - 0x48]
pushal
pushal
mov word [esp], bp
lea esp, [esp + 0x40]
jbe 0x79082fce
jmp 0x79147ab5
lea esp, [esp + 4]
movss dword [esp], xmm0
bswap cx
rcr dh, 3
push edx
pushfd
mov ecx, 4
stc
stc
btr dx, 0xd
imul edx, ecx, 0
jmp 0x7913e0ca

Function at 0x791742bb
Capabilities:
Encode data using add xor sub operations

Disassembly:
push dword [esp + 4]
mov byte [esp + 8], cl
mov dword [esp + 0x38], 0
pushfd
jmp 0x79180905
call fcn.7907ccb4
pushfd
mov dword [esp + 0x3c], 0x1f
jmp 0x79179a4e

Function at 0x791765a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 0x10], 0x63
pop edx
mov byte [ebp - 0xf], 0x3a
jmp loc.7902ee85
aaa
cmp dx, 0x1005
lahf
push ebp
sar ebp, cl
mov ebp, esp
dec dl
sub esp, 0x50
daa
cmc
rdtsc
and dx, bx
mov eax, dword [0x79068330]
test bl, ah
pushfd
xor eax, ebp
push eax
pushal
mov dword [ebp - 4], eax
cdq
seta dl
lahf
setae ah
mov dword [esp + 0x24], ebx
lea edx, [edx - 0x6d3b755b]
pushal
lahf
mov dword [esp + 0x40], esi
cdq
cwde
movsx eax, cl
mov dword [esp + 0x3c], edi
lahf
lea edx, [ebx + 0x736035ca]
mov dword [ebp - 8], ecx
cdq
rdtsc
push 0x718fd10b
jmp 0x79119ff4

Function at 0x79177669
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xb1
mov dword [esp + 4], 0
jmp 0x790f4d0e

Function at 0x79179e07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x13b], 0x2f
daa
sub ax, di
mov byte [ebp - 0x13a], 0x59
and ax, dx
cmc
shrd eax, ebp, 0xf
mov byte [ebp - 0x139], 0x1c
bts ax, bp
sar ax, cl
stc
mov byte [ebp - 0x138], 0x12
rcr ax, 3
shld ax, bp, cl
mov byte [ebp - 0x137], 0x44
bswap ax
mov byte [ebp - 0x136], 0x82
xor al, 0x9b
mov byte [ebp - 0x135], 0xf7
lea esp, [esp + 0x14]
Function at 0x7917fd1d
Capabilities:
Packed with generic packer

Disassembly:
call fcn.79117e30
push dword [0x79069cdc]
pushfd
mov word [esp], si
push dword [esp]
push dword [esp + 8]
ret 0xc
lea esp, [esp + 0x20]
js 0x790bcdf6
leave
jmp 0x7912f35f
setnp dh
mov dword [ebp + 4], eax
bswap eax
lea eax, [edx - 0x80bcc7b]
movzx ax, bl
pushfd
lea esp, [esp + 0x30]
popal
pushal
jmp 0x79132a91

Function at 0x79182f2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x7910fc6d
push edx
test bl, 0xdd
pushfd
cmc
sub eax, eax
push 0xaa5e7fb6
mov dword [esp], 0x2679ad8b
pushal
lea esp, [esp + 0x2c]
jmp fcn.791451cc

Function at 0x791836b8
Capabilities:
Create thread

Disassembly:
lea esp, [esp + 0x44]
call fcn.7903bc2b
clc
add esp, 0xc
push ebx
push ecx
mov dword [0x790703d0], 0x79023440
pushal
mov dword [esp + 0x24], 0x790232b0
pushal
call fcn.79087a11
pushal
push dword [esp + 4]
mov dword [esp + 0x44], 0x790225f0
jmp 0x790a6c76