joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79135118
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0x40]
or ah, 0x9b
bswap ax
clc
mov edx, dword [0x7907636c]
push dword [esp]
rcr ah, cl
mov eax, dword [ecx + 0x4a]
pushfd
mov dword [edx + 0x2c], eax
and dh, 0x16
sbb cl, 0x6b
and dl, bh
btr cx, sp
mov eax, dword [0x7907636c]
shrd dx, si, 9
btc cx, 4
mov ecx, dword [eax + 0x40]
mov ax, dx
neg ax
rdtsc
rdtsc
add ecx, 0x33
aad 0x9d
mov dword [ebp - 0x250], ecx
pushal
mov eax, dword [ebp - 0x250]
add cl, 0x80
cmp cx, ax
and ch, 0x30
mov ecx, dword [eax + 1]
bswap edx
bsr dx, bx
lea esp, [esp + 0x2c]
jle 0x7910c799
movzx dx, dl
mov dword [ebp - 0x254], ecx
ror dh, cl
cmc
not cx
mov eax, dword [ebp - 0x254]
inc ch
inc dh
xadd dh, ch
mov ecx, dword [ebp - 0x250]
test ebx, esi
shrd dx, di, 8
rcl dx, 5
or dx, 0x121e
lea edx, [ecx + eax + 5]
btr eax, 0x1b
clc
mov eax, dword [0x7907636c]
pushfd
mov dword [eax + 0x38], edx
push dword [esp]
aad 0xe4
sub ax, dx
mov eax, 0x66
test dl, bh
cmp bx, si
test ah, al
stc
mov word [ebp - 0x260], ax
bts ax, cx
bsr eax, ebp
mov byte [esp], 0x15
mov eax, 0x63
test bp, bp
test ah, 0x1b
mov word [ebp - 0x25e], ax
dec al
btr ax, bx
mov eax, 0x6d
jmp 0x791420af
and al, 0x2b
test bh, ah
mov eax, 0x66
call fcn.790130e6
movzx ax, al
mov dword [ebp - 0x254], ecx
pushfd
mov eax, dword [ebp - 0x254]
pushal
xor edx, esp
not cl
mov ecx, dword [ebp - 0x250]
or dl, 0xbd
lea edx, [ebp - 0x648c38b]
lea edx, [ecx + eax + 5]
cmc
inc ah
bts ax, ax
test edx, edi
mov eax, dword [0x7907636c]
test si, 0xcef4
bt bp, ax
bt edi, ecx
mov dword [eax + 0x38], edx
xor ah, 0x2c
jmp 0x790e0f12
sal al, 3
shld ax, dx, 7
inc ax
mov eax, dword [ecx + 0x2d]
push eax
mov dword [edx + 0x30], eax
shr dx, 9
pop eax
sal edx, cl
mov eax, dword [0x7907636c]
shrd cx, sp, 2
jmp 0x790bc0b8

Function at 0x79135bae
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x1c], 0xece1f381
push dword [esp + 4]
pushfd
pushal
mov word [esp + 4], sp
lea esp, [esp + 0x44]
jmp fcn.79005505
call fcn.7914dc20
ja 0x7911a9dd
pushfd
mov word [esp], si
pushal
mov dword [esp + 0x20], 0x4f0dd3fc
jmp 0x7907e1df
mov byte [esp], 0x67
lea esp, [esp + 4]
jbe fcn.790c20ba
jmp 0x790ec64d
mov word [esp + 4], sp
mov dword [esp + 4], 0x4eb5e76
mov word [esp], bp
lea esp, [esp + 4]
jmp loc.79005678
push 2
pushal
push 0x96040373
mov dword [esp + 0x20], ecx
pushal
push 0xbdd8c146
mov byte [esp], cl
lea esp, [esp + 0x44]
movss xmm0, dword [ebp - 0x38]
pushal
pushfd
lea esp, [esp + 0x24]
movss dword [esp], xmm0
ja 0x7909f89f
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0xc]
call fcn.790bdc25
not cl
btr eax, 8
jmp 0x7916e909
jmp 0x79119ee3
call fcn.79164a20
ja 0x7914f5c4
push 0x910dd7dc
pushfd
pushfd
jmp 0x790da1da
pushfd
mov dword [esp + 4], 0xece1f381
pushfd
push edx
lea esp, [esp + 0xc]
jmp fcn.79005505
pushfd
mov dword [esp], 0x4f0dd3fc
pushfd
jmp 0x79109c89
lea esp, [esp + 8]
call fcn.79014de0
pushfd
pushal
add esp, 0x28
push 0xb7b9c7d4
fstp dword [ebp - 0x90]
pushfd
pushfd
lea esp, [esp + 0xc]
movss xmm0, dword [ebp - 0x90]
je 0x7910c0f1
push 0x29c904a8
pushfd
lea esp, [esp + 8]
comiss xmm0, dword [0x79060750]
push 0x9d968658
jmp 0x790b9c18
Function at 0x79137750
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x790bc2b3
jmp 0x79169d87
sets dl
not cl
not al
mov eax, 1
bts ecx, 0xd
ror dh, 6
imul ecx, eax, 7
setge dh
lea edx, [ebp + ecx - 0x404]
pushfd
push ebx
pushal
mov dword [esp + 0x24], edx
jmp 0x7909486b

Function at 0x7913810b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
call fcn.79041bb0
xadd ax, dx
add esp, 0xc
mov eax, ebx
shr cx, cl
mov eax, 0x66
rcr dl, 1
mov word [ebp - 0x294], ax
xchg al, ch
pushfd
neg dh
daa
mov eax, 0x63
shrd ecx, esp, 3
bts dx, ax
mov word [ebp - 0x292], ax
das
rdtsc
rdtsc
mov eax, 0x6d
bsf edx, esp
sar dh, 5
mov word [ebp - 0x290], ax
shl ax, 3
mov eax, 0x6f
lea ecx, [ebx*2 + 0x193784a6]
mov word [ebp - 0x28e], ax
movzx cx, bl
rcr ax, cl
mov eax, 0x6f
btc dx, 0xa
btr ecx, ebx
mov word [ebp - 0x28c], ax
xor dh, ah
and cx, 0x7ce
btr dx, 7
mov cx, 0xdbfb
sub eax, eax
rcr cx, 0xd
pushal
mov word [ebp - 0x28a], ax
cwde
das
movsx dx, dl
mov dword [esp + 0x20], 0
cmp bl, 0xd3
mov dword [esp + 0x1c], 0
sub ax, di
clc
not ecx
clc
mov eax, dword [ebp - 0x14]
pop edx
push 0xbf780295
sub eax, 7
pushfd
neg dx
mov dword [esp + 0x1c], eax
adc cx, si
sar dx, cl
rcr cl, 3
mov ecx, dword [0x7907636c]
rol dx, 0xb
add ecx, 0x4c
call fcn.790fa582

Function at 0x79138442
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jl 0x790128d4
push eax
lea esp, [esp + 4]
jg 0x790128a5
rol cl, 2
test ebx, edi
mov ecx, dword [ebp - 0x4c]
test ah, 0x55
pushfd
mov byte [esp], ch
call fcn.79102cda

Function at 0x7913a7eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
bts dx, 1
mov dword [ebp - 0x14], eax
setl dh
push eax
rcl cx, 4
mov eax, 1
setne dh
ror ch, cl
jmp 0x790d7af4
js 0x79015e0e
lea ecx, [ebx*2 - 0x3be59f57]
btc dx, si
mov dword [ebp - 0x14], eax
movsx dx, cl
call fcn.7913d9a0
pushal
imul ecx, eax, 6
not dx
movzx ax, al
mov edx, dword [ebp - 4]
ror al, 4
btr ax, si
movzx eax, cl
movzx eax, byte [edx + ecx]
stc
lea esp, [esp + 0x2c]
ja 0x79019a5c
movsx dx, al
mov dword [ebp - 0x14], eax
cdq
movsx ax, dl
btc cx, dx
mov eax, 1
push edi
stc
btr cx, cx
pop edx
imul ecx, eax, 7
movzx dx, al
rdtsc
pushal
mov edx, dword [ebp - 4]
clc
movzx eax, word [edx + ecx]
btr ecx, edx
rcl ch, cl
ror cx, cl
mov dword [ebp - 0x18], eax
push 0x481ff43a
sete al
mov eax, 1
pushfd
push dword [esp]
rcr ch, 6
jmp 0x79179d4c

Function at 0x7913fda7
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 0x30]
call fcn.79004f00
shrd cx, si, 0xa
mov ecx, 1
cmp edx, esp
rcr dh, cl
btr dx, 1
test dh, dh
shl ecx, 0
pushfd
push dword [esp]
mov edx, dword [ebp - 0x114]
mov byte [esp + 4], dh
mov al, byte [eax + 4]
pushfd
jmp loc.79030566

Function at 0x79141061
Capabilities:
Packed with generic packer

Disassembly:
mov al, 1
mov byte [esp + 4], 0x75
push 0xf6fba867
pushfd
lea esp, [esp + 0x14]
jmp fcn.790cc74d
Function at 0x791421da
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x79161ba0
pushal
cmp al, 0x89
xor al, al
pushfd
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp fcn.790e4ee6
jmp 0x790a778a
push edx
lea esp, [esp + 4]
jmp fcn.790bc086

Function at 0x791481d4
Capabilities:
Packed with generic packer

Disassembly:
test bl, bh
cmp dword [ebp - 0x28], 0
mov byte [esp], bl
lea esp, [esp + 8]
je 0x79125b16
movsx ecx, al
push 0x7f042e6d
not ch
mov byte [esp], 0x97
mov dword [esp], 4
not ecx
bswap cx
jmp 0x79080368

Function at 0x791486c9
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 0x20], eax
mov dword [esp + 4], 0xddbd0a10
pushfd
lea esp, [esp + 0x24]
call fcn.790f0ab0
cmc
pushal
clc
add esp, 0x24
pushal
jmp 0x79151f38
mov byte [esp], 0xbe
mov dword [esp], eax
push eax
lea esp, [esp + 4]
call fcn.79135511
test ch, 0x4d
pushal
add esp, 0x24
pushal
pushal
mov byte [esp + 8], ah
push dword [esp]
lea esp, [esp + 0x44]
cvttss2si eax, dword [ebp - 0x4c]
push 0x7a0c294
jmp 0x79145712
lea esp, [esp + 0x20]
cvttss2si eax, dword [ebp - 0x48]
pushfd
mov dword [esp], eax
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.790f0ab0
neg al
mov ah, dl
daa
sbb ah, ah
add esp, 4
pushal
movzx ax, bl
movzx eax, word [ebp - 0x30]
push 0x22d0b612
mov byte [esp], cl
call fcn.79165685

Function at 0x7914911f
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov dword [eax], ecx
pushal
mov byte [esp + 8], bh
lea esp, [esp + 0x30]
jmp fcn.79036786

Function at 0x7914c141
Capabilities:
Encode data using xor

Disassembly:
add esp, 8
and ah, dh
clc
sub al, bl
btr ax, 3
mov eax, dword [ebp + 8]
bt si, 9
pushfd
test sp, di
add eax, dword [ebp + 0xc]
pushal
jmp 0x7915f31c
mov dword [esp + 0x20], eax
mov byte [esp + 4], 0xd9
lea esp, [esp + 0x20]
jo 0x79033cd0
pushfd
pushfd
lea esp, [esp + 8]
call fcn.79135511
stc
jmp 0x79095af3

Function at 0x7914ce2f
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov word [esp + 4], 0xda26
lea esp, [esp + 8]
call fcn.7914ec95
pushfd
jmp 0x79110511

Function at 0x79151870
Capabilities:
Packed with generic packer

Disassembly:
call fcn.79167d56
push 0x92cf55d1
call fcn.7911b252
lea esp, [esp + 0x38]
call fcn.79040990
stc
movzx cx, bl
sar di, cl
cmc
add esp, 0xc
bts di, 0xa
movsx si, bl
bts si, 8
shr cl, cl
pop edi
pushfd
sar ch, cl
xadd si, cx
mov esi, dword [esp + 4]
bts cx, bx
cmp si, dx
add bl, bh
mov ebx, dword [esp + 8]
pop ecx
cmc
or cl, 0xbf
mov ecx, dword [ebp - 4]
stc
xor ecx, ebp
push 0x6afea7c
lea esp, [esp + 0xc]
ja 0x791205c5
call fcn.79041746
push ebx
mov byte [esp], 0x15
mov esp, ebp
mov ebp, 0x849a6306
movsx ebp, cl
call fcn.7908e978

Function at 0x7915605e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x364], eax
call fcn.7909f249
pushal
mov dword [esp + 0x28], 0
pushfd
push 0x2ddc3e6b
lea esp, [esp + 0x30]
jmp fcn.79103c29
Function at 0x7915893f
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushal
call fcn.790aaf64
jp 0x791588ec
pop edx
xor al, 0x48
adc cl, dh
jp 0x791589be
xchg esi, eax
loopne 0x791588d5
sbb ebp, dword [edx + 0x2b]
stosb byte es:[edi], al
cld
fst dword [edi + 0x2f084094]
mov al, 0xde
sal bh, 0xca
xlatb
mov al, 0xc9
sal bl, 1
ror eax, cl
enter 0xffffffffffff90c5, 0xffffffffffffffb2
cmp ebp, dword [ecx + 0x27]
test eax, 0x67a32d39
or al, 0xc5
pop ds
retf 0xddb6
stosd dword es:[edi], eax
les edi, [ebp + ebx*2 + 0x7ad0acda]
test bh, cl
into
invalid

Function at 0x79159c00
Capabilities:
Packed with generic packer

Disassembly:
add edx, 0xf
pushfd
pushal
call fcn.790d2f4c

Function at 0x7915b4b7
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x7915d4eb
pushfd
lea esp, [esp + 4]
jmp fcn.7913c21b
pushal
mov byte [esp], bl
lea esp, [esp + 0x3c]
call fcn.79008370
pushal
add esp, 0x28
pushal
cmc
push 0x52de1546
test eax, eax
jmp 0x790a6f56
mov byte [esp], 0xbd
mov dword [esp + 0x1c], eax
jmp 0x791130a3

Function at 0x7915b4e0
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [ebp - 0x3c], 0
call fcn.7916ab8a

Function at 0x7915c234
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], si
test eax, eax
pushfd
jmp 0x79011a9f

Function at 0x7915ddbb
Capabilities:
Packed with generic packer

Disassembly:
pushal
bt si, ax
shl edx, 1
lea esp, [esp + 0x24]
jne 0x79087115
push ecx
mov byte [esp], cl
pushfd
lea esp, [esp + 8]
movss dword [ebp + edx - 0x3c], xmm0
jmp 0x790b373e

Function at 0x7915e77d
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0x60
lea esp, [esp + 4]
jbe fcn.790c20ba
jmp 0x79161b7a

Function at 0x7915eea4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
xchg al, cl
push esi
not dx
setno al
push edi
xchg dx, ax
mov dword [ebp - 4], 0x2e
cwde
mov eax, dword [0x7907636c]
mov cx, sp
mov ecx, dword [eax]
jmp 0x7916eed4
sete ah
and dx, bp
sub esp, 0xa4
xchg ah, dh
push edx
jmp 0x790fa6cc
cwde
push esi
mov eax, edi
mov dl, cl
cwde
push edi
rdtsc
pushfd
mov dword [ebp - 4], 0x2e
rdtsc
call fcn.790df50f
jmp 0x790a473d
lea ebp, [esp + 4]
add esp, 4
jle 0x790b0d21
and al, 0x39
dec ch
sub esp, 0xa4
movsx cx, cl
lea eax, [ebx - 0x36907796]
lea ecx, [ebx + 0x7707908f]
push ebx
jns 0x790d9b86
push esi
not al
movsx ax, al
push edi
setne dh
mov dword [ebp - 4], 0x2e
call fcn.79086b96

Function at 0x7915f660
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push edx
lea esp, [esp + 0x2c]
call fcn.79041bb0
das
neg ax
shr ax, 1
add esp, 0xc
bswap ax
mov eax, 0x5f
pushfd
push eax
mov word [esp + 4], di
pushal
mov word [ebp - 0xe8], ax
movsx ax, cl
jmp 0x790939d2
Function at 0x7915ffe5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
call fcn.79041746
jmp 0x7913dc7b
jmp 0x790f304d
pushfd
call fcn.791558e2
mov byte [esp], bl
mov word [esp], 0xdbb1
lea esp, [esp + 8]
call fcn.79014190
call fcn.7914486e
mov dword [esp + 0x48], eax
push 0x3821cd52
pushfd
lea esp, [esp + 0x50]
call fcn.79041bb0
rdtsc
clc
cwde
add esp, 0xc
rdtsc
aaa
mov eax, 0x66
shrd dx, cx, 6
mov word [ebp - 0x294], ax
not dl
mov eax, 0x63
bsf cx, cx
sar dh, cl
mov word [ebp - 0x292], ax
sub edx, 0xb4b7d738
aam 0xa0
sar dl, 4
aas
mov eax, 0x6d
dec ecx
btr ecx, 3
shld dx, dx, 0xe
mov word [ebp - 0x290], ax
lea ecx, [eax*4 - 0xb8ac92e]
add dh, ah
ror dl, 6
lea eax, [ebx - 0x2b1502f7]
mov eax, 0x6f
xadd ecx, edx
cmc
cmc
mov word [ebp - 0x28e], ax
aas
das
cwde
bsf ax, bx
mov eax, 0x6f
shl dl, cl
mov ch, cl
shrd ecx, ebp, cl
mov word [ebp - 0x28c], ax
neg dh
shld dx, cx, 1
shld dx, bx, cl
rol cl, 3
xor eax, eax
movsx ecx, bl
bt edi, esp
pushfd
clc
mov word [ebp - 0x28a], ax
bsf ax, di
movzx dx, al
rdtsc
aad 0xbf
mov dword [esp], 0
not ecx
push 0
dec dx
lea eax, [edx*8 + 0x5d150d9]
shl dh, 7
aam 0x76
mov eax, dword [ebp - 0x14]
btr cx, dx
sub eax, 7
bsf dx, ax
xadd ch, dh
push eax
or cl, bh
add dx, dx
inc edx
and dh, 0xa3
mov ecx, dword [0x7907636c]
add dl, ah
shrd dx, di, cl
movsx edx, al
add ecx, 0x4c
lea edx, [eax + 0x1a55dde5]
push ecx
movzx cx, al
push ebx
not dx
pushal
mov dword [esp + 0x20], 0
call fcn.7901c484
push edi
jmp 0x791303be

Function at 0x79161067
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg cl, dl
mov eax, 1
btc ecx, esp
imul ecx, eax, 0xd
lea esp, [esp + 0x3c]

Function at 0x791614a6
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [esp], ah
pushfd
call fcn.790d0c4b
lea esp, [esp + 0x20]
je 0x790b93c2
push 0x7912facb
call fcn.790a8a6d

Function at 0x79167592
Capabilities:
Packed with generic packer

Disassembly:
call fcn.790f9010
lea esp, [esp + 8]
call fcn.790d8dca
movsx ax, cl
mov al, cl
popal
call fcn.7914266f
not ebx
pushfd
mov esi, dword [esp + 0x2c]
pop ebx
mov bx, ax
pop ebx
mov ebx, dword [esp + 0x28]
jmp 0x7911ee5f

Function at 0x79169688
Capabilities:
Encode data using xor

Disassembly:
lahf
mov dword [esp], 0
lea ecx, [ebp + 0x6d1a05ab]
push 0
jmp 0x79178dec
mov dword [esp], ebp
mov dword [esp + 4], 1
jmp 0x790e048a
Function at 0x7916a5bd
Capabilities:
Encode data using xor

Disassembly:
push edi
mov word [ebp - 0xa8], ax
daa
or al, 0xe5
shld eax, ebp, 8
mov eax, 0x65af
call fcn.790b4664
jno 0x7916a60f
xchg ebp, eax
adc dword [ebp + 0x10], edi
ja 0x7916a5ee
insd dword es:[edi], dx
and dh, byte [ebx + 0x1d]
jne 0x7916a5ef
xchg dword [0x2a830971], edx
mov eax, dword [0x9e1e9f20]
sahf
dec ecx
jno 0x7916a5c6
iretd
rol dword [0xbfc0c1ce], 0xc2
mov ebp, 0xac9fe3ea
inc eax
mov cl, 0x6b
pushfd
jb 0x7916a663
mov ch, 0x4f
jl 0x7916a63a
ret 0x3000
jg 0x7916a647
push ebp
sal byte [esi - 0x65e3dfe4], cl
aad 0x75
jne 0x7916a646
or ebp, dword [esi - 0x12]
outsb dx, byte [esi]
out dx, al
daa
lcall 0x49fd, 0x99035c26
packuswb mm7, mm3
sti
sti
out 2, al
pop ebx
push 0x722b95bb
mov ch, 0x96
xor dword [edi - 0x11], edx
lodsd eax, dword [esi]
ja 0x7916a639
xchg dword [ebp + 0x35], edi
push edx
fld xword [esi]
js 0x7916a62e
ret 0x858e
test eax, edx
sbb eax, ebp
imul ebp, ebx, 0x31
scasb al, byte es:[edi]
inc ebx
or al, ch
call 0x790e6bf4

Function at 0x7916b65b
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push dword [esp + 0xc]
movzx bx, bl
movzx bx, dl
mov ebx, dword [esp + 0x14]
mov byte [esp + 4], bh
push ebx
call fcn.7902ac55
mov esi, dword [esp + 0xc]
jmp 0x7914b2df

Function at 0x7916c7d2
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
je 0x790c27f3
aaa
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x71ca3cff]
btr cx, 9
stc
rol cl, cl
lea ecx, [eax*8 + 0x7906f194]
rcr ax, 0xe
bsf eax, esi
mov dword [ebp - 0xc], ecx
bt dx, cx
bts ecx, 0x1c
setns cl
cmc
mov eax, 4
xchg dh, cl
lea ecx, [edi*2 + 0x6be7e6ad]
bts cx, 0xf
shl eax, 0
btc dx, dx
movsx cx, dl
push eax
movsx dx, al
mov ecx, dword [ebp - 0xc]
bts edx, 6
pushal
mov edx, dword [ecx + eax]
xchg ecx, eax
btr cx, di
btr ax, di
mov dword [esp + 0x20], edx
not ch
pushal
mov eax, 4
call fcn.7911a6bd

Function at 0x7916dce1
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x8e
adc ecx, 0x616c89d4
cwde
mov eax, 0x5f
mov cx, 0x78f8
btc cx, sp
btc cx, dx
xor cx, 0xa432
mov word [ebp - 0x120], ax
sbb ch, bh
mov eax, 0x63
cmp dx, 0x48bc
dec cl
sar ch, 4
add ch, 0xc2
mov word [ebp - 0x11e], ax
cwde
mov eax, 0x61
add ch, 0x63
cmp ah, 1
mov word [ebp - 0x11c], ax
rcr al, cl
adc eax, 0x7fac133a
xor ecx, ebx
mov eax, 0x62
shr ch, cl
shr cl, cl
mov word [ebp - 0x11a], ax
stc
test al, 0x80
movsx cx, bl
mov eax, 0x64
jmp 0x790ee1d9
push ecx
pushal
pushal
lea esp, [esp + 0x44]
call fcn.79041bb0
or ch, 0xaf
add esp, 0xc
cwde
xor ch, 0x54
mov eax, 0x5f
call fcn.79157dbf
pushal
mov dword [esp + 0x20], eax
push dword [esp]
pushfd
lea esp, [esp + 0x28]
jae 0x79149e19
call fcn.79041bb0
dec cx
add esp, 0xc
jmp 0x79084be7
Function at 0x79170abb
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
clc
mov dword [ebp - 0x44], eax
bswap ax
mov dword [ebp - 0x48], 0xc350
rol eax, cl
imul eax, dword [ebp - 0x48], 0xa
stc
bt edx, ecx
pushfd
bt si, ax
mov dword [ebp - 0x4c], eax
add esp, 0x3c
mov dword [ebp - 0x40], ecx
rcr cx, 0xa
rdtsc
movsx edx, bl
rdtsc
mov eax, 1
clc
imul ecx, eax, 0x2a
rol dl, 1
mov edx, dword [ebp - 0x1c]
cwde
mov eax, dword [edx + ecx]
bt sp, ax
jmp 0x790a7715

Function at 0x79170c07
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
call fcn.79029190
mov cx, bp
push 0xdb8a6977
call fcn.79036707
push dword [esp + 0x10]
call fcn.790a8883
pushfd
lea esp, [esp + 8]
subss xmm0, dword [0x79060804]
call fcn.790f5215
jmp 0x790e182f

Function at 0x791710ba
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.790c0d1c
lea eax, [ebp - 0x5c]
jmp 0x790c001e
bswap cx
jmp loc.7900ed24
jmp 0x7908570f

Function at 0x791748b0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov byte [esp], 0x32
push 0x62b4ea0c
jmp 0x7917aa61
lea esp, [esp + 8]
jge 0x79090e77
pushal
pushfd
mov byte [esp + 4], 0x2d
lea esp, [esp + 0x24]
jmp 0x7911d22e

Function at 0x79174cd9
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
ror ah, cl
sal ax, cl
mov eax, dword [ebp - 0x38]
pushfd
pushal
cmp eax, dword [ebp - 8]
pushal
lea esp, [esp + 0x44]
jne 0x790a751f
pushal
lea esp, [esp + 0x20]
jmp fcn.79168946
pushfd
clc
mov dword [ebp - 0x38], ecx
call fcn.790cbec7
movsx cx, al
bswap cx
mov dword [ebp - 0x24], eax
push edx
setne cl
jmp 0x790b9f4b
setl ch
call fcn.7913fea8
jmp 0x790a5b71
lea ecx, [ebp - 0x20]
call fcn.790fa205
mov byte [esp], dh
lea esp, [esp + 0x20]
je 0x7912f9d9
test dl, dl
cmp dword [ebp - 0x38], 0x1000000
pushal
mov byte [esp + 0xc], 0x5d
mov byte [esp + 0xc], bh
pushal
lea esp, [esp + 0x40]
jge 0x7909dc3f
push ebx
pushal
push 0xb004c03d
call fcn.79090c32
sal al, 1
pushfd
rcr eax, 3
mov eax, dword [ebp - 0x34]
lea esp, [esp + 4]
mov byte [ebp - 0x10b], 0
pushfd
call fcn.790ab95d
pushfd
lea esp, [esp + 0x48]
je 0x791390bc
sal al, 4
mov eax, dword [ebp - 0x10]
pushfd
xor cl, bh
pushal
mov ecx, dword [eax]
cmp ah, dl
pushfd
add esp, 0x28
jns 0x790a5004
clc
mov dword [ebp - 0x38], ecx
clc
cmp bp, 0x75e6
cmc
clc
cmp dword [ebp - 0x38], 0
pushal
jmp 0x7912f9ae

Function at 0x79176cfd
Capabilities:
Packed with generic packer

Disassembly:
mov byte [ebp - 0x8a], 0
push dword [esp + 0xc]
call fcn.7914b833
call fcn.790f5b68
jmp 0x79118cc5

Function at 0x7917908e
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x10], eax
movsx ax, dl
cwde
mov dh, 0xa6
pop ebx
popal
push ebx
mov al, 0x15
pushfd
bswap ax
mov eax, dword [ebp - 0x10]
push dword [esp]
lea esp, [esp + 0xc]
jmp 0x7911bba0
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x22e60080
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x157665e8
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100d8590
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100d877d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8e000]
push edi
or ebp, 0xffffffff
jmp 0x100d85ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100d85c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100d85b0
mov eax, 1
add ebx, ebx
jne 0x100d85d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100d85e4
jne 0x100d8603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100d8603
dec eax
add ebx, ebx
jne 0x100d85f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100d85c8
add ebx, ebx
jne 0x100d85ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100d8655
xor ecx, ecx
sub eax, 3
jb 0x100d861b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100d868a
sar eax, 1
mov ebp, eax
jmp 0x100d8626
add ebx, ebx
jne 0x100d8626
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100d85f4
inc ecx
add ebx, ebx
jne 0x100d8634
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100d85f4
add ebx, ebx
jne 0x100d8641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100d8636
jne 0x100d8652
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100d8636
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100d8674
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100d8666
jmp 0x100d85b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100d8674
add edi, ecx
jmp 0x100d85b6
pop esi
mov edi, esi
mov ecx, 0x2b83
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100d8692
cmp byte [edi], 0x1e
jne 0x100d8692
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100d8697
lea edi, [esi + 0xd1000]
mov eax, dword [edi]
or eax, eax
je 0x100d870f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd9f14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xda018]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100d86c4
mov ecx, edi
jns 0x100d86f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xda01c]
or eax, eax
je 0x100d8709
mov dword [ebx], eax
add ebx, 4
jmp 0x100d86e1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100d8740
cmp al, 0xef
ja 0x100d8733
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100d8715
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100d8722
mov ebp, dword [esi + 0xda020]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100d8774
sub esp, 0xffffff80
jmp 0x1005c897