joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79011673
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x7906e3f0], 0x7e0
jmp fcn.790bf218

Function at 0x79011bc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dh, cl
clc
mov dword [ecx + eax], 0
pushfd
btr cx, ax
rcr ch, 5
mov eax, 1
ror dx, 9
push dword [esp]
pushfd
imul ecx, eax, 6
xchg dh, ah
rdtsc
rcl al, cl
mov edx, 0x111
rcr ax, 0xb
lahf
mov eax, dword [ebp - 0x28]
mov word [esp + 4], 0x25b1
pushal
mov word [eax + ecx], dx
bswap ecx
clc
mov eax, 1
rcl ch, 3
imul ecx, eax, 0xa
btc ax, bx
rol dl, 2
rdtsc
ror dl, cl
mov edx, dword [ebp - 0x28]
call fcn.790f933d

Function at 0x79011cd9
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 4]
jbe fcn.79092e82
call fcn.790ef6a6

Function at 0x790157fe
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0xd0e87290
lea esp, [esp + 0x48]
jb 0x7901583e

Function at 0x790264f3
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 0x40]
call fcn.790d9e26
shl ch, 6
sets ch
add esp, 4
jb 0x791142a2
mov ecx, ebp
mov dword [ebp - 8], eax
pushfd
pushfd
pop ecx
lea ecx, [esi - 0x33d4b1be]
mov dword [esp], 4
jmp fcn.79094486
lea ecx, [eax*8 - 0x35081061]
bswap eax
movsx eax, dl
lea eax, [esi + 0x6f68309a]
mov eax, dword [0x7906e2d4]
bswap cx
pushal
mov dword [ebp - 8], eax
seta ch
mov dword [esp + 0x1c], 4
bswap ecx
not cl
lea ecx, [ebp - 0xc]
pushfd
lea esp, [esp + 0x20]
call fcn.7901a960
jmp 0x79141508
movzx ax, cl
jns 0x791070e6
rdtsc
mov eax, dword [0x7906e2d4]
push edi
call fcn.7916f633
movzx cx, cl
lea ecx, [ebp - 0x60]
pushfd
lea esp, [esp + 0x20]
call fcn.7901a960
pushal
pushfd
pushal
pushfd
lea esp, [esp + 0x48]
jmp fcn.79163f4b

Function at 0x79030c1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.7915bbf2
not ecx
mov ch, dh
lea ecx, [ebp - 0x40a503f8]
mov dword [ebp - 0x4c], eax
bswap cx
pushfd
pop ecx
bswap cx
lea ecx, [ebp - 0x44]
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.790adb05
jno 0x790be923
clc
test cl, bl
mov dword [ebp - 0x50], eax
stc
cmp dword [0x7906e1c6], 0x32
pushfd
pushfd
pushal
jmp fcn.79085c9a

Function at 0x79030d00
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x16304afc
lea esp, [esp + 0x4c]
jne 0x7916323e
pushal
pushal
sub eax, eax
pushfd
push dword [esp + 0x10]
pushfd
mov byte [esp], bh
lea esp, [esp + 0x4c]
jmp fcn.790f5afa
pushal
mov byte [esp], ah
push dword [esp]
lea esp, [esp + 0x24]
jmp fcn.79100eee
Function at 0x79075aba
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
call fcn.791349a2
push 0x67c9da5b
jmp fcn.79176e80

Function at 0x79079cfd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0
push dword [esp]
lea esp, [esp + 0x40]
call fcn.790076e0
lea ecx, [edi*4 + 0x4c2d578b]
jmp 0x7914a5ac
pushfd
lea esp, [esp + 4]
je 0x7907c6cc
pushal
lea ecx, [ebp - 0xc]
call fcn.790c9188
jmp 0x7910aad3
test ecx, ecx
jmp 0x7915c200
lea esp, [esp + 0x20]
js 0x79098f03
lea eax, [edi + 0x5af1addf]
mov eax, dword ss:[ebp - 4]
jmp 0x79138657
push ebx
lea esp, [esp + 0x24]
leave
pushfd
push dword [esp + 4]
ret 0x18
pushal
jmp 0x79122ece
lea ecx, [ebp - 0x5f6f691b]
pushfd
mov dword [esp], eax
movsx ecx, bl
mov cx, bx
pushfd
lea ecx, [ebp - 0xc]
pushfd
lea esp, [esp + 8]
call fcn.7902a9f0
shld cx, ax, cl
movzx ecx, al
jmp 0x7909e9a7
jmp 0x7909d7c5

Function at 0x7907cf5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x28]
call fcn.7910fa51
call fcn.790d9e2b
movss xmm0, dword [ebp - 0xe8]
call fcn.790aab85

Function at 0x7907cf77
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esi*2 + 0x4c691e7e]
lea ecx, [ebp - 0x4e8]
jmp 0x790bb99c
mov dword [eax], 0
bswap ax
pushfd
pushfd
mov byte [0x7906e485], 1
movzx eax, dl
lahf
push dword [esp + 8]
jmp 0x7915248d
pushal
call fcn.7909821d
movsx ecx, dl
movsx ecx, dl
push 0x90adcc9d
lea eax, [ebp - 0x68]
movzx cx, cl
mov cx, 0x8e63
pop ecx
movsx ecx, bl
push eax
push 0xb280ac4b
mov ecx, 0x7906e428
pushal
push ecx
pushfd
lea esp, [esp + 0x2c]
call fcn.7901c130
pushal
jmp 0x7909cb3e
mov byte [0x7906e486], 1
push dword [esp + 8]
pop eax
lea eax, [ecx + 0x635a601d]
lea eax, [esi + 0x5ed5dd5]
mov byte [0x7906e484], 1
pop eax
mov byte [0x7906e433], 1
not ah
bswap eax
call fcn.79176faa
pushfd
movsx ax, cl
pop eax
bswap ax
lea eax, [ebp - 0x40]
push esi
pushfd
mov byte [esp], ch
push esi
lea esp, [esp + 0xc]
jmp int.790882c0

Function at 0x7907e7f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x42662c89
lea esp, [esp + 0x10]
call fcn.79016e00
lea ecx, [edx - 0x3d224928]
cmp ebp, esp
movzx ecx, al
clc
cmc
cmp al, dh
jmp 0x79108970

Function at 0x79088d7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
call fcn.79027d90
push edx
call fcn.7916747b
Function at 0x7908b7b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 1
movzx ecx, dl
stc
seta dh
ror dl, cl
imul ecx, eax, 0x26
bswap ax
cdq
lea edx, [ebp*4 + 0x51b69f68]
mov edx, dword [ebp - 0x18]
rol eax, cl
movzx eax, word [edx + ecx]
rcr dl, cl
mov dword [ebp - 0x4c], eax
not al
mov eax, 1
mov byte [esp + 4], 0x43
ror cl, 1
imul ecx, eax, 0x28
btr ax, 9
mov byte [esp], 0xdc
rdtsc
rol al, cl
mov edx, dword [ebp - 0x18]
lahf
bt edi, edi
movsx ax, cl
cmc
movzx eax, word [edx + ecx]
cmc
ror ch, 3
mov dword [ebp - 0x50], eax
rcr ax, 0xf
jmp 0x7916cfc0
mov eax, 1
cmc
ror dh, 5
bt di, dx
imul ecx, eax, 0x2a
bts dx, si
not dl
bts dx, 7
mov edx, dword [ebp - 0x18]
rcl al, cl
movzx eax, word [edx + ecx]
bswap edx
rcr ch, cl
stc
mov dword [ebp - 0x54], eax
pop eax
rdtsc
movzx dx, dl
rcl ah, cl
mov eax, 1
stc
call fcn.7916fff6

Function at 0x79093b47
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
je 0x790c0891
pushal
lea esp, [esp + 0x20]
jl 0x790a7350
mov al, 0xd1
not al
mov al, 1
pushal
push esi
pushal
lea esp, [esp + 0x44]
jmp 0x7908121f
mov al, dl
call fcn.79130059
bsr di, bx
pushfd
call fcn.79081219
pushfd
mov dword [esp], 0x4614d033
push 0xcbf82a42
lea esp, [esp + 4]
jmp loc.7900cec8

Function at 0x790946a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 0x160], 0x58
pushfd
jmp 0x791773d7

Function at 0x790954a5
Capabilities:
Parse pe header

Disassembly:
pushal
push edi
jmp 0x7908e2c5
cmp dword [ebp - 0x34], 0x111
pushal
call fcn.790c4d24
lea esp, [esp + 0x24]
je 0x790acf6a
push 0x699e7dab
jmp 0x7908b583
lea esp, [esp + 0x28]
xorpd xmm0, xmm0
pushfd
lea esp, [esp + 4]
movlpd qword [ebp - 0x44], xmm0
bts ax, 0xa
daa
sub al, 0x8a
movzx eax, byte [ebp - 0x25]
test cl, 0xcb
test eax, eax
jmp 0x790803e3

Function at 0x790974c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, eax
pushfd
push ecx
lea esp, [esp + 0x10]
call fcn.79016e00
movzx cx, cl
movzx ecx, al
test al, cl
cmc
test ecx, ecx
push 0x6ddb944d
push edx
push 0xc6978b58
lea esp, [esp + 0xc]
je 0x790e7fa4
cwde
pushal
pushal
movzx cx, al
mov eax, dword [ebp - 0x10]
setae cl
mov dword [ebp - 0x78], eax
movsx ecx, cl
movsx cx, cl
push 0xa37108c9
mov cl, 0x37
lea ecx, [ebp - 0x78]
push dword [esp]
jmp 0x791362ab
call fcn.790bc104

Function at 0x79098214
Capabilities:
Packed with generic packer

Disassembly:
stc
add esp, 0x40
jmp 0x79099479
push 0
pushal
pushfd
pushfd
mov dword [esp + 0x24], 0x21
push dword [esp]
call fcn.79092069

Function at 0x7909cc13
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
call fcn.7910fa51
shrd cx, di, 8
mov cl, 0x1e
push ebx
mov dword [ebp - 0x1c], eax
test bh, dl
sar ah, cl
mov eax, dword [ebp + 8]
clc
rol edx, 9
pushfd
btr dx, 0xc
mov dword [ebp - 0x20], eax
sub ah, dl
shrd ax, dx, cl
rdtsc
mov eax, dword [ebp - 0x20]
xchg edx, ecx
or cx, bp
movzx ecx, word [eax]
movsx dx, cl
lahf
sar edx, cl
cmp dl, ch
mov dword [ebp - 0x24], ecx
xchg ah, ch
jmp 0x791118f5

Function at 0x790a0317
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 4]
jne 0x790c540b
Function at 0x790a1642
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
call fcn.790392b0
rcr ah, cl
shr ax, 9
jmp 0x790e4189

Function at 0x790a1d1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x49
push dword [esp]
lea esp, [esp + 0x30]
je 0x7909d37e
cmc
cmc
bt sp, 0xb
cmp dword [ebp - 0x34], 0x211
call fcn.790e89b7

Function at 0x790a1d40
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx eax, word [ebp - 0x34]
pushal
mov byte [esp], 9
mov dword [esp + 0x1c], eax
pushfd
lea esp, [esp + 0x20]
call fcn.79083234
push 0xd6ca3abd
mov al, 0x4e
btc ax, cx
add esp, 8
mov ah, ch
lea eax, [ebp - 0x160ebea7]
lahf
mov eax, dword [ebp + 0x18]
jmp 0x79075ac2
xor ah, 0xa0
pushal
add esp, 0x28
movsx ax, dl
jmp 0x7909d99e

Function at 0x790a337f
Capabilities:
Execute anti-debugging instructions

Disassembly:
test dh, 0x69
bts di, bp
bt di, 0xb
and bx, 0x7111
pop edi
inc si
shl cx, cl
cmp bx, dx
shr ecx, 0xb
pop esi
dec bx
push esi
test sp, 0x93b3
mov ebx, dword [esp + 4]
bsr cx, cx
sal ch, cl
shl cx, 0xd
shl ecx, cl
mov ecx, dword [ebp - 4]
clc
xor ecx, ebp
jmp 0x790b1a99
cmp dh, 0x48
bt ebp, ecx
push 0x97351302
cmp dword [ebp - 8], 4
call fcn.79166ed9
lea esp, [esp + 0x48]
call fcn.7902a9f0
bswap ecx
movzx ecx, al
cmc
jmp 0x79161c39
lea esp, [esp + 8]
call fcn.79038e46
pushfd
call fcn.7914153d
pushal
mov byte [ebp - 1], 1
lea esp, [esp + 0x20]
pushal
mov byte [esp + 8], ch
mov dword [ebp - 8], 0
push edi
pushfd
push ebx
mov byte [esp], 0xca
lea esp, [esp + 0x2c]
jmp 0x79088d6b
test ecx, ecx
pushal
lea esp, [esp + 0x20]
je 0x7907c6cc
movsx cx, al
mov ch, bh
bswap ecx
lea ecx, [ebp - 0xc]
pushfd
lea esp, [esp + 4]
call fcn.79025b70
push eax
mov word [esp], 0xcbfb
mov dword [ebp - 0x10], eax
call fcn.7908dfb6

Function at 0x790a3e1a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
call fcn.7913f7fb
cwde
cwde
movzx eax, byte [ebp - 0x25]
cmp bh, 0x11
stc
test eax, eax
jmp 0x79130fb4
pushal
lea esp, [esp + 0x20]
je 0x790894d3
cdq
mov eax, dword [ebp - 0x2c]
lea ecx, [ecx + 0x41718b8e]
xchg ch, dh
push eax
seta cl
mov ecx, dword [ebp - 8]
bswap edx
push 0xc7d27c50
not dl
mov byte [esp], 0x1e
mov dword [esp], ecx
movzx dx, dl
bswap dx
setp dh
mov edx, dword [ebp - 0x20]
call fcn.79117a34

Function at 0x790a7357
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x44], eax
setne al
pushfd
not al
setno al
lea eax, [ebp - 0x40]
mov word [esp], bp
lea esp, [esp + 0xc]
jmp int.790882c0

Function at 0x790a8973
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], si
pushal
lea esp, [esp + 0x28]
call fcn.790dabf6
pushal
lahf
movzx ax, cl
mov dword [ebp - 4], 0
bswap ax
cwde
bswap ax
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
call fcn.79016d83
Function at 0x790a951d
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x40]
movss xmm0, dword [0x79058690]
call fcn.790f9039
lea esp, [esp + 0x30]
jns 0x790c4225
pushal
lea esp, [esp + 0x20]
je 0x790b7b11
pushal
pushal
jmp 0x790ac30c
jmp 0x790981f9
lea esp, [esp + 0x20]
movss xmm0, dword [0x79058690]
pushal
jmp 0x7913338b
pushfd
mov byte [esp], dl
mov word [esp], bx
lea esp, [esp + 4]
je 0x790b7b11
pushal
jmp 0x79123a2c
jmp 0x790af3de

Function at 0x790ac118
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x1c]
call fcn.79038db4
pushfd
sbb cl, 0x21
btc ecx, 0xc
add esp, 8
push edi
pushal
mov ecx, dword [ebp - 8]
jmp 0x79101ebb
mov word [esp], 0xb5a4
mov dword [ecx + 4], eax
mov word [esp], 0x271
push 0x3d08eda9
mov dword [esp + 0x24], 5
pushal
push esi
push edx
lea esp, [esp + 0x4c]
call fcn.79038db4
stc
bts cx, bx
btr dx, 1
lea edx, [edi*8 + 0x72769730]
add esp, 4
jmp 0x790e01ff

Function at 0x790ac674
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ebp - 0x4f4]
push eax
lea esp, [esp + 0xc]
call fcn.79004c10
mov al, ch
btc ax, 9
dec ah
cwde
mov eax, dword [0x7906e2d4]
shr dh, 3
mov ecx, dword [eax + 0xc]
bsf dx, di
sub ecx, dword [ebp - 0x14]
call fcn.7911e89a

Function at 0x790ad2ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.79169932
aas
cwde
mov dword [ebp - 0x41c], ecx
rcl dx, cl
adc ax, bx
mov eax, 1
mov byte [esp], dh
test esi, 0xa4d8a6b0
shl eax, 2
ror cl, cl
push 0xcc94fc92
rol dh, 3
mov ecx, dword [ebp - 0x414]
cmc
ror dh, cl
movzx edx, word [ecx + eax]
call fcn.7911d600
mov byte [esp], 0xb9
cmp dword [ebp - 0xc], 0x1d
mov byte [esp], ch
jmp 0x79149c37
mov byte [esp], cl
lea esp, [esp + 4]
jne 0x790357d0
movsx ecx, dl
jmp 0x7908eec1

Function at 0x790aee9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
aad 0xb4
mov dword [esp], 0x79055ffb
aad 0x19
inc dh
adc dx, 0x3ef7
xadd ax, dx
mov eax, dword fs:[0]
lea edx, [ebx*8 + 0x6586cb03]
push eax
add ah, dl
add dh, 0x90
xadd ah, dh
btc ax, 0xa
sub esp, 0xe8
add ax, si
lahf
mov eax, dword [0x79067330]
btr dx, 3
or dh, 0xd2
add dl, ch
xor eax, ebp
movzx dx, dl
push 0x1f89f81a
mov dword [ebp - 0x10], eax
lea edx, [ecx*4 - 0x77886b00]
setg dl
mov dword [esp], ebx
movsx dx, cl
push esi
setns dh
bswap dx
bswap dx
push edi
lea edx, [ebp + 0x4c9f10cf]
pushfd
movzx dx, dl
movsx dx, al
mov dword [esp], eax
rdtsc
lea eax, [ebp - 0xc]
pushal
pop edx
bswap dx
mov dword fs:[0], eax
jmp loc.79035195
Function at 0x790b25cd
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
pushal
pushfd
lea esp, [esp + 0x24]
jbe fcn.79092e82
setl al
cwde
cwde
lahf
mov eax, dword [ebp - 0x6c]
jmp 0x79156e7f
push 0x30a29f3f
push 0x87c9a4b7
pushfd
push dword [esp + 0x30]
ret 0x34
pushal
pushal
mov esp, ebp
bswap bp
call fcn.790f1361
stc
push 0x525626c5
push esi
push edx
test bh, 0x7d
test al, bl
cmp dword [0x7906f53c], 0x4a
call fcn.79122ebf
xor byte [esp + ebx + 0x4f1650db], bl
push esi
je 0x790a52e9
mov cl, 0x17
mov ch, 0xe9
jo 0x790a5387
adc edi, eax
in eax, 0xb1
add dword [ebx - 0x4e], ebp
jp 0x790a5323
push ecx
outsd dx, dword [esi]
adc ebx, dword [edx - 0x5e]
ret
or eax, 0x1a52c8e4
pushal
mov byte [esi - 0x3f], bl
shr byte [esp + eax*2 - 0x31370dff], cl
ror esi, 1
xor eax, 0x14b7135a
retf
cmp dword [ebp - 0x6c], 0xbb8
pushfd
mov word [esp + 0xc], cx
lea esp, [esp + 0x30]
jae 0x790cc7ce
push edi
lea esp, [esp + 4]
jbe fcn.79092e82
pushfd
jmp 0x79178885
pushfd
call fcn.790d100f
jmp 0x790a5314
jmp 0x790a0335
call fcn.790e682f
mov byte [esp], 0x57
mov byte [esp + 8], dh
lea esp, [esp + 0x28]
jne 0x7909eb7f
pushfd
push dword [esp]
lea esp, [esp + 8]
jmp fcn.790fc43d
mov eax, dword [ebp - 0x6c]
lea esp, [esp + 4]
jae 0x790b9d78
mov dword [ebp - 0xc0], eax
jmp 0x790fb74b

Function at 0x790b260a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp - 0xc4]
bswap cx
pushfd
call fcn.790fcc27
not cx
movzx cx, bl
bswap cx
lea ecx, [ebp - 0xc4]
pushfd
mov byte [esp + 4], bh
lea esp, [esp + 8]
call fcn.7902a780
mov ah, cl
lahf
pushfd
mov byte [ebp - 4], 2
cwde
jmp 0x790a1633

Function at 0x790b5988
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [0x7906f53c], 0xca
pushal
lea esp, [esp + 0x24]
jne 0x790d6e19
js 0x790f35ed
pushal
mov word [esp + 8], 0x5997
lea esp, [esp + 0x20]
call fcn.790fc490
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jmp loc.79012029
push eax
mov byte [esp], bh
lea esp, [esp + 4]
call fcn.79156cad
pushfd
mov byte [esp], bl
pushfd
lea esp, [esp + 8]
jmp loc.79012029

Function at 0x790b6419
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x24]
movss dword [ebp - 0x68], xmm0
mov word [esp + 8], ax
jmp 0x79092e79

Function at 0x790bd469
Capabilities:
Packed with generic packer

Disassembly:
call fcn.791507fb
mov dword [esp + 4], eax
call fcn.7909e6ee
pushal
call fcn.790e7fc8
pushal
push 0x9d095b0
mov dword [esp + 0x3c], 0
pushfd
push ebx
mov word [esp + 4], 0x3821
push esp
mov dword [esp + 0x44], 0
lea esp, [esp + 0x44]
jge 0x790a7b48
push 0x628c5046
push 0x8a4a69bf
mov dword [esp + 4], 0xe
call fcn.790fa44d
jmp loc.7901fb85
Function at 0x790bdaf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.7916fef9
lea esp, [esp + 4]
call fcn.79109f7d
btc di, 0xd
add esp, 0xc
bsf esi, esi
bsr ecx, eax
mov byte [0x79068c81], 1
sbb di, ax
shr cl, cl
mov byte [0x79068cfb], 1
sal bl, 1
ror edi, cl
bsf si, sp
pushal
mov byte [0x7906fd59], 1
cmp bh, 0x26
shld di, cx, 5
mov edi, dword [esp + 0x20]
xadd si, bx
mov esi, dword [esp + 0x24]
sub bh, bh
bt ecx, 8
bsr ecx, ecx
not ecx
mov ebx, dword [esp + 0x28]
neg ecx
mov ecx, dword [ebp - 4]
clc
cmc
pushfd
push esi
xor ecx, ebp
mov word [esp + 4], si
mov byte [esp + 8], 0x37
jmp 0x7907ab6c

Function at 0x790be0c9
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x34]
je 0x790acf98
call fcn.7909204e
jmp 0x790912fc

Function at 0x790be0fa
Capabilities:
Access peb ldr_data

Disassembly:
push edx
push ebx
mov dword [esp + 4], 0x57497407
pushal
mov dword [esp + 0x20], 0x1abb8a76
pushfd
pushal
pushfd
mov byte [esp + 4], 0xdb
lea esp, [esp + 0x48]
jmp fcn.7900dec7
test eax, eax
pushfd
mov byte [esp], ah
lea esp, [esp + 8]
je 0x790f513f
stc
mov dword [0x7906e33c], 0
bt cx, dx
cmp di, 0xa6c4
cmp dword [0x7906e500], 3
pushfd
lea esp, [esp + 4]
jl 0x7913594b
not ax
lea ecx, [ecx*2 - 0x53af4ea2]
call fcn.79086887
jmp 0x790850f4
lea esp, [esp + 0x54]
call fcn.7907ef0e
not si
sal al, 7
movsx ax, al
bswap eax
mov eax, dword [ebp + 8]
xor cx, di
rcr esi, 0x18
mov ecx, dword [ebp - 0xc]
pushfd
mov dword fs:[0], ecx
bt ebp, 0x16
cmc
mov ecx, dword [esp + 4]
clc
and esi, 0xc3e2ea2e
btr di, 2
mov edi, dword [esp + 8]
rcl si, 8
rcr esi, cl
or cl, al
shrd cx, bp, 0xf
mov esi, dword [esp + 0xc]
pushal
mov ebx, dword [esp + 0x30]
movsx cx, al
seto ch
mov ecx, dword [ebp - 0x10]
clc
cmp ch, 0x62
call fcn.79173524
jmp 0x790f1d2d
pushfd
lea esp, [esp + 4]
call fcn.7914ddfa
cmp cx, bp
push ecx
movzx eax, al
jmp 0x790a18b1
pushal
call fcn.790b7966
pushal
call fcn.7913dad2
hlt
call fcn.791097d5
pushfd
mov byte [esp], 0x2b
lea esp, [esp + 0x40]
call fcn.79004010
call fcn.7916b61f
movsx ax, cl
not cx
lahf
not eax
mov eax, dword [ebp - 0x2c]
push ebx
jmp 0x79105189

Function at 0x790befea
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp - 0x40]
mov byte [esp], dh
pushfd
mov byte [esp], dh
lea esp, [esp + 0x14]
jmp int.790882c0

Function at 0x790bf508
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
jae 0x7915965d
pushfd
pushfd
lea esp, [esp + 8]
call fcn.79004bf0
push 0xf1b60572
mov cl, byte [esp]
lea ecx, [ebx*2 - 0x6a12ecd1]
jmp 0x790994b7

Function at 0x790c02ee
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x30], 0xc8
call fcn.790995a5
cmc
mov byte [ebp - 0x25], al
pushfd
pushfd
bt ebx, esp
mov dword [ebp - 0x2c], 0xa
pushal
mov byte [esp], 0xbd
pushfd
jmp 0x79090b1c

Function at 0x790c034b
Capabilities:
Packed with generic packer

Disassembly:
pushfd
call fcn.790ca989
out dx, al
and cl, byte [ebx - 0xd]
mov al, byte [0xa5f34f14]
xchg edi, eax
mul dl
imul edi, dword [ebp - 0x2157f744], 0xfffffff6
xchg esp, eax
aad 0x1b
bound eax, qword [edx + 0x724e7c2a]
shl dword [ecx - 0x18], cl
adc byte [eax - 0x462799ea], ch
invalid
Function at 0x790c4acc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr esi, cl
stc
cdq
and si, bp
mov esi, eax
cmc
movsx cx, dl
mov edi, edx
rcl ecx, cl
add esi, dword [ebp - 0x44]
bswap ecx
pushfd
call fcn.790a8da9
mov byte [esp], 7
jmp 0x79123c72
jmp 0x790fef37
pushal
lea esp, [esp + 0x20]
call fcn.7903ab7a
sub ecx, ebx
shl cl, 4
cdq
jmp 0x791357df
pushal
push dword [esp]
lea esp, [esp + 0x48]
jbe 0x790ab664
jmp 0x790c5950
pushal
lea esp, [esp + 0x24]
jl 0x790ab664
pushfd
lea esp, [esp + 4]
jg 0x79147746
bt si, di
push edx
clc
cmp dword [ebp - 0x44], 0
pushal
jmp 0x7911a356
jb 0x790cc950
mov ecx, 0x1f4
sub si, sp
mov edi, 0x1df27e4d
movzx di, bl
idiv ecx
add cl, dl
push edx
adc ecx, eax
mov eax, edx
adc dl, 0x73
jmp 0x79074553

Function at 0x790c4d24
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x28]
je 0x791035b0
clc
push 0x84d16792
cmp cl, 0x9d
clc
cmp dword [ebp - 0x34], 0x211
call fcn.790cd4a9

Function at 0x790c4e9a
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x14]
je 0x790acf6a
cmc
cmp dl, 0x11
cmp dword [ebp - 0x34], 0x111
pushfd
lea esp, [esp + 4]
je 0x791035b0
call fcn.790e60e7

Function at 0x790c7fa8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7916f786
pop ecx
pushal
mov dword [ebp - 0x1c], eax
push ebp
stc
lahf
rdtsc
mov eax, 1
btr dx, 2
movsx cx, dl
mov cl, byte [esp + 8]
imul ecx, eax, 0
lahf
mov edx, dword [ebp - 0x1c]
bt sp, 0xd
aad 0xca
pushfd
movzx eax, word [edx + ecx]
clc
bsf ecx, edi
pushfd
shr dl, 7
mov dword [ebp - 0x20], eax
add dl, ch
rdtsc
pushfd
aad 0x42
mov eax, 1
btr cx, sp
shl eax, 1
clc
mov ecx, dword [ebp - 0x1c]
adc dx, bp
bt bx, 3
bsf dx, di
movzx edx, word [ecx + eax]
pop ecx
stc
ror ah, cl
cwde
mov dword [ebp - 0x24], edx
aaa
dec ch
mov eax, 1
pushfd
shl eax, 3
ror cl, 5
add eax, dword [ebp - 0x1c]
ror cl, 4
rcr cl, 2
mov dword [ebp - 0x28], eax
mov dword [esp], 0x87d81bb7
lea eax, [0x7cfe2af0]
movsx cx, al
mov eax, 1
stc
btc cx, ax
movsx ecx, al
imul ecx, eax, 0xc
xor ah, dh
jmp 0x7912fb7c
add ecx, dword [ebp - 0x1c]
lea eax, [edi - 0x1780c6bf]
mov dword [ebp - 0x2c], ecx
clc
not cx
setg ah
rcl ax, 2
mov eax, 1
movzx cx, bl
movzx cx, dl
imul ecx, eax, 0x14
bsr eax, edx
lahf
mov byte [esp], ah
xor eax, 0xe17fd870
add ecx, dword [ebp - 0x1c]
not al
ror al, cl
btc eax, eax
mov dword [ebp - 0x30], ecx
btc cx, bx
mov al, dh
btr ecx, eax
cwde
mov eax, 1
ror cx, 3
rcr ecx, cl
rol cl, cl
movsx cx, dl
imul ecx, eax, 0x1c
shrd eax, ebp, 0xa
aam 0xff
cmc
add ecx, dword [ebp - 0x1c]
rcl ax, 4
btr eax, edx
mov dword [ebp - 0x34], ecx
bswap cx
xchg cx, ax
mov eax, 1
rcr cl, 6
pop ecx
imul ecx, eax, 0x24
shld ax, cx, cl
neg eax
add ecx, dword [ebp - 0x1c]
and eax, esi
and al, cl
sar al, 3
dec ah
mov dword [ebp - 0x38], ecx
setle al
sub ax, ax
mov dword [ebp - 0x3c], 0x186a0
mov byte [esp + 8], 0x68
mov eax, dword [ebp - 0x20]
clc
test al, dl
clc
cmp eax, dword [ebp - 8]
push 0xa1a093a5
mov byte [esp + 8], 4
jmp 0x790b2919