Function at 0x7944b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea ecx, [ecx]
xchg edi, eax
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
mov edx, edx
and eax, 1
lea ecx, [ecx]
xchg edi, edx
xchg dword [esp], edi
xchg edi, edx
lea esp, [esp + 4]
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
je 0x7941d0
jne 0x7941b4
jmp 0x7941ce
xchg ecx, ebp
lea eax, [ebp - 4]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x3c]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, dword [esi + 0x1c]
xchg dword [esp], eax
pushfd
mov edi, edi
call fcn.00794144
popfd
push edx
mov edx, dword [esp + 6]
pop edx
je 0x794108
jne 0x794108
jmp 0x794106
add byte [eax], al
popfd
pushfd
add ebp, 0x16
popfd
lea ebp, [ebp - 0x16]
je 0x7949fc
jne 0x7949fc
jmp 0x7949fa
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x53]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
pushfd
add ebp, 0x77
popfd
lea ebp, [ebp - 0x77]
and eax, 1
pushfd
add ebp, 0x1c
popfd
lea ebp, [ebp - 0x1c]
xchg esi, edx
xchg dword [esp], esi
xchg esi, edx
lea esp, [esp + 4]
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
je 0x794354
jne 0x794328
jmp 0x794352
add byte [eax], al
lea edx, [ebp - 4]
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x3b]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg ecx, edx
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, edx
mov edx, dword [esp]
push 2
pushfd
add ebp, 0x13
popfd
lea ebp, [ebp - 0x13]
lea esp, [esp - 4]
mov dword [esp], ebx
mov ebx, dword [eax + 0xc]
xchg dword [esp], ebx
xchg edx, ecx
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, ecx
mov ecx, dword [esp]
pushfd
pushfd
add ebp, 3
popfd
lea ebp, [ebp - 3]
call fcn.007942bf
popfd
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0xc]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
je 0x794264
jne 0x794264
jmp 0x794262
jg 0x794354
popfd
lea edi, [edi]
je 0x79481c
jne 0x79481c
jmp 0x79481a
pushfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x5d]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, eax
mov eax, dword [esp]
xchg edi, edx
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, edx
mov edx, dword [esp]
rdtsc
push edx
mov edx, dword [esp + 5]
pop edx
and eax, 1
push ecx
mov ecx, eax
pop ecx
xchg ecx, edx
xchg dword [esp], ecx
xchg ecx, edx
lea esp, [esp + 4]
xchg esi, eax
xchg dword [esp], esi
xchg esi, eax
lea esp, [esp + 4]
je 0x7944b4
jne 0x794488
jmp 0x7944b2
js 0x7943a2
lea eax, [ebp - 4]
pushfd
add ebp, 0x49
popfd
lea ebp, [ebp - 0x49]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, eax
mov eax, dword [esp]
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, dword [esi + 0xc]
xchg dword [esp], eax
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x71]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
call fcn.0079441e
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x24]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
je 0x7943dc
jne 0x7943dc
jmp 0x7943da
fild word [eax]
popfd
push ebp
mov ebp, esp
leave
je 0x794e10
jne 0x794e10
jmp 0x794e0e
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x52]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
pushfd
add ebp, 0x68
popfd
lea ebp, [ebp - 0x68]
and eax, 1
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x61]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg ecx, edx
xchg dword [esp], ecx
xchg ecx, edx
lea esp, [esp + 4]
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
je 0x794638
jne 0x79461c
jmp 0x794636
jmp 0xfcbed2e3
lea eax, [ebp - 4]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x7d]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
push 2
push ecx
mov ecx, dword [esp + 6]
pop ecx
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, dword [edi + 0x5e]
xchg dword [esp], edx
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, ecx
mov ecx, dword [esp]
pushfd
mov edx, edx
call fcn.007945a1
popfd
pushfd
add ebp, 5
popfd
lea ebp, [ebp - 5]
je 0x794550
jne 0x794550
jmp 0x79454e
cmpsb byte [esi], byte es:[edi]
loop 0x7945d6
popfd
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x6c]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0x794c08
jne 0x794c08
jmp 0x794c06
pushfd
push esi
mov esi, edi
pop esi
xchg ebx, eax
lea esp, [esp - 4]
mov dword [esp], ebx
mov ebx, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
pushfd
add ebp, 0x11
popfd
lea ebp, [ebp - 0x11]
and eax, 1
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x1a]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
xchg edx, eax
xchg dword [esp], eax
xchg edx, eax
lea esp, [esp + 4]
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
je 0x794798
jne 0x794780
jmp 0x794796
ret 0x9300
xchg ebx, eax
mov eax, dword [ecx + 0x3c]
push ebx
xchg ebx, eax
pop eax
xor edx, edx
push ebp
mov ebp, esp
leave
add ebx, ecx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x6b]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xor edi, edi
lea ebx, [ebx]
movzx eax, word [ebx + 0x14]
mov edi, edi
add eax, 0x18
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x71]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
add eax, ebx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x42]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [ebp + 8], edi
mov edi, eax
push dword [ebp + 8]
xchg dword [ebp + 8], edi
pop edi
cmp dx, word [ebx + 6]
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x36]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
jae 0x79481c
lea esi, [eax + 8]
lea esi, [esi]
lea ebx, [ebx]
pushfd
add ebp, 0x23
popfd
lea ebp, [ebp - 0x23]
jmp 0x7949fc
popfd
mov edi, edi
je 0x7946d4
jne 0x7946d4
jmp 0x7946d2
add byte [eax], al
popfd
lea edx, [edx]
je 0x794acc
jne 0x794acc
jmp 0x794aca
add byte [eax], al
lea edx, [ebp - 4]
push ebp
mov ebp, esp
leave
xchg edi, edx
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, edx
mov edx, dword [esp]
push 2
push eax
mov eax, dword [esp + 3]
pop eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, dword [eax + 0xc]
xchg dword [esp], ecx
xchg edi, ecx
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, ecx
mov ecx, dword [esp]
pushfd
pushfd
add ebp, 0x2e
popfd
lea ebp, [ebp - 0x2e]
call fcn.00794862
add byte [eax], al
lea eax, [ebp - 4]
push ebp
mov ebp, esp
leave
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, dword [esi + 0x1c]
xchg dword [esp], ecx
pushfd
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x46]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
call fcn.00794a3a
add byte [eax], al
xchg ebx, eax
mov eax, dword [ecx + 0x3c]
push ebx
xchg ebx, eax
pop eax
xor edx, edx
pushfd
add ebp, 0x70
popfd
lea ebp, [ebp - 0x70]
add ebx, ecx
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x5d]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xor edi, edi
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0xc]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
movzx eax, word [ebx + 0x14]
push ecx
mov ecx, eax
pop ecx
add eax, 0x18
mov edi, edi
add eax, ebx
push ebp
mov ebp, esp
leave
xchg dword [ebp + 8], ebx
mov ebx, eax
push dword [ebp + 8]
xchg dword [ebp + 8], ebx
pop ebx
cmp dx, word [ebx + 6]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x2d]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
jae 0x7941ec
lea esi, [eax + 8]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 1]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
lea ebx, [ebx]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x40]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jmp 0x7940b4
div dword [0x8bfc458d]
fist dword [ecx - 0x3db9b73]
lea eax, [ebp - 4]
mov ebx, ebx
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
push 2
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0xb]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], esi
mov esi, dword [edi + 0x5e]
xchg dword [esp], esi
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, ecx
mov ecx, dword [esp]
pushfd
mov esi, esi
call fcn.00794c55
add byte [eax], al
lea eax, [ebp - 4]
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x48]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, dword [esi + 0xc]
xchg dword [esp], eax
pushfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x11]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
call fcn.00794e61
add al, 0x24
lea esp, [esp + 4]
cmp dword [edi], 8
mov ecx, ecx
jle 0x794664
xor eax, eax
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x46]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xor ebx, ebx
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 9]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
cmp ax, word [edi + 6]
mov ecx, ecx
jae 0x7944cc
lea esi, [edi + 0x62]
pushfd
add ebp, 0x54
popfd
lea ebp, [ebp - 0x54]
jmp 0x79436c
call fcn.007965ec
ja 0x795771
inc ecx
lds eax, [ebp + 0xe]
xchg edx, eax
push 0x4d
pushal
sbb edi, eax
jge 0x79568b
xor dh, ch
loop 0x79573b
lodsb al, byte [esi]
sub dh, byte [ebx]
in eax, dx
xchg edi, eax
mov byte [0xcaa1c079], al
mov al, 0xff
mov dl, byte [0xa5eb5be9]
call fcn.00796680
scasb al, byte es:[edi]
dec eax
inc edi
xchg esp, eax
pop edi
imul esp, dword [ebp - 0x58], 0x3aad87e8
scasb al, byte es:[edi]
arpl sp, cx
mov eax, esi
lea eax, [ecx - 0x748920b8]
inc edx
notrack call fcn.00796734
jnp 0x79571e
add al, 0x68
and ebx, dword [edx]
dec ebx
pop edx
push 0x5a4b1a23
sub dword [ebp - 0x6b], esi
invalid
invalid
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x71]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xfffff8fe
xchg dword [esp], eax
lea edi, [edi]
xchg dword [esp + 4], eax
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0xd]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], eax
push ecx
mov ecx, dword [esp + 0xc]
pop ecx
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x2a]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jmp 0x7956ec