joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790b4fb1
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jmp 0x790eb330
mov byte [esp], 0x58
lea esp, [esp + 4]
je 0x790b5022
bswap ax
mov eax, dword [0x7906e4c4]
jge 0x790cedab
pushfd
pushal
mov byte [esp], cl
mov dword [esp + 0x20], eax
pushfd
mov dword [esp + 0x20], 0x7906f1a8
mov word [esp + 4], 0xaff4
mov dword [esp + 0x1c], 0x7906eda8
pushfd
pushfd
lea esp, [esp + 0x24]
call fcn.79037770
sal ah, cl
aas
add esp, 0xc
push 0xfa95753a
cwde
mov eax, dword [0x7906e4c4]
not cl
mov dword [0x7906e4c0], eax
lahf
xchg cl, al
sets ch
mov byte [0x7906e4bc], 1
lea esp, [esp + 4]
mov eax, 0x39507c9e
jmp 0x790cc4d1
jmp 0x7911bcf7
pushfd
mov dword [esp], eax
pushal
mov dword [esp + 0x1c], 0x7906f1a8
pushfd
mov dword [esp + 0x1c], 0x7906eda8
mov dword [esp + 4], 0x64eb3587
mov byte [esp + 4], dl
pushal
lea esp, [esp + 0x3c]
call fcn.79037770
aas
add esp, 0xc
jmp 0x790d9fdf
lea ecx, [eax + 0x7dafe212]
push eax
jmp 0x79026d2d
mov eax, dword [0x7906e518]
jmp 0x79077d7e

Function at 0x790b8211
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7910c79c
push dword [esp]
mov byte [esp], bh
mov dword [esp + 4], 0
jmp 0x7911e368
push edi
mov dword [esp + 4], 0x73
jmp 0x79106d8d

Function at 0x790ba0a0
Capabilities:
Check for software breakpoints

Disassembly:
push 0x402018be
lea esp, [esp + 0x10]
jne 0x790fe17b
pushal
lea esp, [esp + 0x20]
call fcn.7903a25a
rcl dl, cl
adc cl, 0x4d
cdq
push 0x5bde4cff
pop ecx
sub ch, dh
ror ch, cl
mov ecx, 0x50
call fcn.7910f1ad
push 0x2bbf6967
push edx
pushal
push dword [esp]
lea esp, [esp + 0x2c]
call fcn.7903a25a
add cx, 0xd71c
xor ch, bl
btc ecx, esp
cdq
movsx cx, cl
bsf ecx, edx
rol cl, cl
mov ecx, 0xf
stc
cmp ch, 0xcd
stc
pushfd
idiv ecx
call fcn.790f7ef8
add edx, 0xf
call fcn.7913371f
stc
test al, bh
pushal
test bp, bx
cmp dword [ebp + 0x10], 2
pushfd
jmp 0x79114ecb
push 0x621375fe
lea esp, [esp + 0x28]
jne 0x7916bd1b
push 0x44548d96
lea esp, [esp + 4]
jo 0x790ef3d1
call fcn.7903a25a
xchg cl, dl
shr edx, cl
cdq
ror ch, 4
ror cx, cl
shl ecx, cl
mov ecx, 0xf
pushal
idiv ecx
push dword [esp]
jmp 0x790fd3d2

Function at 0x790c54e8
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
call fcn.7902a0f0
and ecx, 0xed9f883f
btr cx, ax
movzx ecx, al
pushal
pushfd
pushfd
cmc
test ecx, ecx
jmp 0x790ec049
call fcn.79074285

Function at 0x790c708f
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
xor ebx, 0x85e1346e
call fcn.7913cd6d
Function at 0x790c709b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x64], edx
push dword [esp]
lea eax, [ebp - 0x64]
setno cl
movzx cx, al
bswap ecx
pushfd
mov dword [esp + 0x28], eax
setg cl
not cx
call fcn.7911eae3
push 0xe1c39a11
call fcn.7912de27
mov eax, dword [0x7906d1c6]
pushal
push dword [esp]
mov dword [ebp - 0x40], eax
call fcn.7912426f
lea ecx, [esi*8 + 0x78ce644a]
pop ecx
mov ecx, dword [ebp - 0x1a8]
mov word [esp], 0x3f67
lea esp, [esp + 0x38]
call fcn.790257b0
push ebx
mov dword [ebp - 0x1fc], eax
pushal
lea esp, [esp + 0x24]
jmp 0x7914e7b5
mov ecx, dword [ebp - 0x1fc]
cdq
lahf
xchg dx, ax
push 0xce37cbce
mov dword [ebp - 0x1ac], ecx
rdtsc
setl dh
movzx dx, bl
mov byte [ebp - 4], 2
pushal
mov edx, dword [ebp - 0x1ac]
jmp 0x7908febb
jmp 0x7909d2d5
cdq
setp ch
rdtsc
jmp 0x790b0f43

Function at 0x790d6b0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0x79166cf6
stc
push 0xad6384e4
cmp dword [ebp - 0x88], 0x211
pushal
lea esp, [esp + 0x24]
je 0x79166cf6
cmc
cmp dword [ebp - 0x88], 0x1211
jmp 0x7912037e
pushfd
push dword [esp]
call fcn.79166cec

Function at 0x790dade8
Capabilities:
Create thread

Disassembly:
mov byte [esp], dl
lea esp, [esp + 0x30]
call fcn.7903a69b
pushal
cmc
test di, 0x2015
add esp, 0x2c
call fcn.79150c02

Function at 0x790dafd3
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x24]
call fcn.790d007a
pushal
test ax, 0x7808
stc
movzx eax, al
cmc
test eax, eax
jmp 0x790f9bfa

Function at 0x790db267
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dh, 1
mov eax, 1
cmc
pushfd
imul ecx, eax, 0x18
not al
btc ax, sp
push esp
mov edx, dword [ebp - 0x20]
pop eax
clc
movzx eax, word [edx + ecx]
lea edx, [esp - 0x7b1de244]
mov dword [ebp - 0x50], eax
rcr eax, 0x16
mov eax, 1
movsx cx, bl
lea ecx, [esi*4 + 0x17d6a910]
imul ecx, eax, 0x1a
pushal
mov dl, byte [esp]
bts edx, edx
movsx ax, dl
mov edx, dword [ebp - 0x20]
pop eax
movzx eax, word [edx + ecx]
cmc
xchg ch, dh
cmc
jmp fcn.79083dd8

Function at 0x790dba14
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], cl
mov byte [esp], 0xcc
mov dword [ecx + 0x14], eax
movzx cx, bl
movzx cx, al
mov ecx, dword [ebp - 0x1a8]
mov byte [esp], 0x3b
jmp 0x79122efb
jmp 0x790ceed7
lea esp, [esp + 0x5c]
call fcn.790257b0
pushal
mov dword [ebp - 0x1fc], eax
pushal
mov dword [esp], 0x374c5485
push dword [esp]
push 0x7f0ac06f
lea esp, [esp + 0x48]
jmp 0x7914e7b5

Function at 0x790dd078
Capabilities:
Packed with generic packer

Disassembly:
push 0xfd8c5d26
lea esp, [esp + 0x10]
call fcn.79034720
bt bx, 0xd
stc
push 0x7b574d95
cmp al, ah
movzx eax, al
call fcn.790f0dea
lea eax, [esi + 0x5a5e5101]
pushfd
push ebp
lea eax, [ebp*2 + 0x11056b27]
mov dword [ebp - 4], 0xffffffff
not ah
lea eax, [ebx*8 - 0x370c62e9]
setb al
mov eax, dword [ebp - 0x60]
pushfd
pushfd
lea esp, [esp + 0x10]
jmp 0x79072b29
Function at 0x790e1a64
Capabilities:
Packed with generic packer

Disassembly:
mov edi, dword [esp + 4]
push ecx
mov word [esp + 4], 0xf498
pushal
mov esi, dword [esp + 0x2c]
push 0x9a3b1cb
bswap ebx
pop ebx
movsx bx, cl
mov ebx, dword [esp + 0x30]
mov byte [esp + 4], dh
call fcn.790d1830

Function at 0x790e6937
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
bswap dx
push ecx
push ebp
jmp 0x7914370f
call fcn.7910dfe5
mov ecx, 0x7906e3b8
jmp 0x7909904b
stc
add esp, 8
test bl, 0x63
movsx ecx, dl
lea ecx, [edx*4 - 0x58d5d3c7]
movzx ecx, al
cmp dl, bl
test ecx, ecx
push 0xac66f59f
lea esp, [esp + 4]
jne 0x79074fb1
rdtsc
rdtsc
mov eax, dword [ebp - 8]
movzx dx, dl
bswap cx
mov dword [ebp - 0x54], eax
movsx cx, cl
mov ecx, dword [ebp - 0x54]
pushfd
jmp 0x7908dd65
push ebp
mov byte [esp], 0x4f
lea edx, [ebp - 0x50]
setl cl
push dword [esp]
mov dword [esp + 8], edx
setg cl
movzx cx, al
jmp 0x790df959

Function at 0x790e71bc
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
comiss xmm0, xmm1
call fcn.790dd59d

Function at 0x790e71db
Capabilities:
Packed with generic packer

Disassembly:
call fcn.790d761b
movzx cx, dl
mov dword [ebp - 0x1a4], eax
call fcn.7913f527
jmp 0x790cf003

Function at 0x790f00e0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
bt si, 0xd
xor ecx, ebp
call fcn.79116059
pushfd
lea esp, [esp + 0x30]
call fcn.7903c84f
movzx ax, dl
clc
bt sp, 6
btr ax, bx
add esp, 0xc
movzx ax, cl
lea eax, [ecx*8 - 0x6a9cd901]
push 6
push 0x6f80ea41
lea esp, [esp + 4]
ja 0x79120387
push 0
seta al
lahf
lea eax, [ebp - 0x10]
pushfd
pushfd
mov byte [esp], al
pushfd
mov dword [esp + 8], eax
mov byte [esp], ah
pushfd
jmp 0x7913a89a
movsx ax, al
movzx ax, cl
cwde
push 0
cwde
pushfd
movzx ax, dl
sete al
lea eax, [ebp - 0x10]
jmp 0x7914ce76
call fcn.7914d2dd

Function at 0x790f2bf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], eax
jg 0x79146cd0
not ax
not dl
push ebx
setno ch
bswap ax
push edi
jmp 0x790df2f6
sub esp, 0x44c
rdtsc
btc cx, 2
xor ah, 0x3e
shrd eax, ebp, cl
mov eax, dword [0x79066330]
adc dx, 0x2251
and ch, dl
shl ch, 5
add dl, ch
xor eax, ebp
bswap dx
jmp 0x79077aa1
dec ax
push ebp
cdq
movsx bp, cl
btc bp, ax
rdtsc
mov ebp, esp
jmp 0x790f2bf2
not ah
push 0xab26a3d7
pop edx
rdtsc
push ebx
lahf
push esi
seta ah
mov dl, 0xf6
push edi
cdq
pushfd
mov eax, dword [0x7906e518]
lea ecx, [esi - 0x63a664da]
mov dword [esp], eax
jmp 0x7901cd1c

Function at 0x790f2cbe
Capabilities:
Packed with generic packer

Disassembly:
bswap cx
mov dword [esp + 4], eax
movsx cx, al
pushal
lea ecx, [ebp - 0x10]
jmp 0x790b1282

Function at 0x790f4aed
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [edx + ecx]
cmp ebx, ecx
cmp bl, dl
add dh, ch
mov dword [ebp - 0x28], eax
shr ah, 6
mov eax, 1
shld cx, ax, cl
ror cl, cl
shl eax, 2
call fcn.7909ac49
Function at 0x790f9bf5
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x7906d3f0], 0x7d7
push dword [esp + 4]
mov dword [esp], esp
mov byte [esp], al
lea esp, [esp + 0x28]
jne 0x7915c789
call fcn.79136f84
call fcn.790c3b95
lea esp, [esp + 0x20]
je 0x7915853d
pushfd
mov dword [ebp - 0x40], 0xc8
cmp bp, di
pushal
stc
jmp 0x790ad1e4

Function at 0x790fcb7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
mov dword [ebp - 0x68], eax
rol ax, 5
cdq
rdtsc
mov eax, 1
xchg cx, dx
imul ecx, eax, 0x26
jmp 0x79127582
setnp dl
movzx edx, bl
stc
mov dword [ebp - 0x64], eax
pushal
mov eax, 1
rcr ecx, 0x16
rcr dl, cl
imul ecx, eax, 0x24
pop edx
pushfd
push 0xeba309d5
mov edx, dword [ebp - 0x20]
bswap eax
bts eax, edi
rcr ah, 3
movzx eax, word [edx + ecx]
pushfd
jmp 0x790f4331

Function at 0x790fd3da
Capabilities:
Check for software breakpoints

Disassembly:
push 0x5c30352b
rdtsc
cdq
mov dword [ebp - 0x1fc], 0
lea esp, [esp + 4]
jmp 0x79159bbc
bt bp, 0xe
stc
add esp, 0xc
cmc
mov dword [ebp - 0xf0], eax
push ebp
push ebx
clc
test al, bh
mov byte [ebp - 4], 5
clc
pushal
test ch, 0x99
cmp dword [ebp - 0xf0], 0
mov dword [esp], 0x5571f4a8
push dword [esp + 4]
lea esp, [esp + 0x2c]
je 0x79075ad0
bswap cx
push 0x1c
jmp fcn.790df3b8
mov byte [ebp - 4], 4
pushal
cwde
call fcn.79128d3e
movsx ax, al
sets dh
mov ecx, dword [ebp - 0x1fc]
xchg ah, dh
mov dword [ebp - 0xf4], ecx
cdq
jmp 0x79134bcd

Function at 0x79104257
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts cx, si
bswap ax
sub esp, 0x470
stc
adc al, al
rcl ch, 2
sar edx, cl
mov eax, dword [0x79066330]
btr dx, cx
sal dx, cl
adc ecx, 0x3e6f3e3c
xor eax, ebp
setnp cl
jp 0x790a74a5
mov dword [ebp - 4], eax
rdtsc
jmp 0x790f61d4
setae ch
mov dword [ebp - 4], eax
not al
mov ah, 0x11
push ebx
push 0x431da3e3
mov dword [esp], esi
lahf
rdtsc
cdq
push edi
not ecx
mov eax, dword [0x7906e518]
lea edx, [ebx - 0x309bf893]
movsx cx, bl
push eax
pushal
sete cl
movsx cx, bl
xchg cx, dx
mov ecx, dword [0x7906e510]
pop edx
pushfd
jmp 0x790cf428
not eax
push ebp
cdq
movsx ecx, dl
mov ebp, esp
sbb ax, bp
jmp 0x790869c6

Function at 0x7910475e
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0xc], 0
push dword [esp + 4]
push 0x6df5dca0
mov dword [esp + 0xc], 0xb3d12595
mov dword [esp], 0x86fcdfa3
lea esp, [esp + 0x30]
jmp 0x790a5e7e

Function at 0x7910668c
Capabilities:
Encode data using xor

Disassembly:
call fcn.790fb287
cmpsd dword [esi], dword es:[edi]
sub al, 0xd3
add al, byte [ecx]
mov dl, 0x4d
dec eax
invalid
test eax, eax
jmp 0x79081978

Function at 0x7910d01d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], eax
pushfd
pushfd
jmp 0x791531a7
push dword [esp + 0x10]
jmp 0x790725ad

Function at 0x79113eaf
Capabilities:
Packed with generic packer

Disassembly:
push 0x3d39c947
call fcn.790d2dd3
Function at 0x79113eb9
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
call fcn.79021c50
pushfd
call fcn.7907dc99
call fcn.790c7629
pushfd
pushal
push 0xdd1170b1
push 0xa16513e9
lea esp, [esp + 0x2c]
call fcn.79016190
movzx cx, al
mov dword [ebp - 4], 0
setl ch
not cl
push 0x14
bswap ecx
pushal
lea ecx, [ebp - 0x4c]
call fcn.79081dbd
jmp 0x790eb545

Function at 0x7911a7ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], eax
jg 0x79146cd0
not ax
not dl
push ebx
setno ch
bswap ax
push edi
jmp 0x790df2f6
sub esp, 0x44c
rdtsc
btc cx, 2
xor ah, 0x3e
shrd eax, ebp, cl
mov eax, dword [0x79066330]
adc dx, 0x2251
and ch, dl
shl ch, 5
add dl, ch
xor eax, ebp
bswap dx
jmp 0x79077aa1
dec ax
push ebp
cdq
movsx bp, cl
btc bp, ax
rdtsc
mov ebp, esp
jmp 0x790f2bf2
not ah
push 0xab26a3d7
pop edx
rdtsc
push ebx
lahf
push esi
seta ah
mov dl, 0xf6
push edi
cdq
pushfd
mov eax, dword [0x7906e518]
lea ecx, [esi - 0x63a664da]
mov dword [esp], eax
jmp 0x7901cd1c

Function at 0x7911e79c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x79113599
stc
cmc
mov dword [ebp - 0x14], ecx
jmp 0x79108cd6

Function at 0x79122c3c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
movss dword [esp], xmm1
call fcn.7912fc1d

Function at 0x791240e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x14], eax
movsx ecx, al
mov dword [esp + 0x3c], 8
bswap ecx
pop ecx
call fcn.790843ac
push ebp
or ebp, 0x73e6bc14
cmc
daa
mov ebp, esp
sal dl, cl
neg cl
aad 0x93
push 0xffffffffffffffff
rdtsc
push 0x79056a18
neg dh
push ebp
dec eax
mov eax, dword fs:[0]
bsf dx, sp
xchg dword [esp], eax
aad 0x48
cmc
sub esp, 0x68
rdtsc
mov eax, dword [0x79066330]
adc dl, dh
bsf edx, esi
dec cx
xor eax, ebp
btr dx, 0xc
bswap ecx
mov dword [ebp - 0x10], eax
btc cx, 8
push ebx
rol cl, 5
push esi
ror dh, 6
push edi
pushal
btc cx, 0xc
push ecx
pop edx
xchg dword [esp + 0x1c], eax
rcl ax, cl
lea eax, [ebp - 0xc]
push eax
mov dword fs:[0], eax
pop eax
bt esi, edx
clc
mov eax, dword [0x7906e510]
ror ecx, 1
bts ecx, esp
rol edx, 0x16
mov dword [ebp - 0x14], eax
pop edx
movzx cx, bl
ror al, 6
not al
mov eax, 1
pushal
btr dx, si
movsx cx, bl
rol cx, cl
imul ecx, eax, 0
shl dh, 1
aam 0xe5
aam 0xe6
pop edx
mov edx, dword [ebp - 0x14]
movsx ax, bl
movzx eax, byte [edx + ecx]
bsf dx, di
bts edx, ebx
test eax, esi
cmp cl, 0xff
mov dword [ebp - 0x18], eax
or ch, dl
stc
daa
pushfd
mov eax, dword [ebp - 0x14]
xor dx, 0xe692
sar dx, cl
clc
mov dx, sp
add eax, 1
push dword [esp + 0x14]
mov dword [ebp - 0x14], eax
btr eax, ebx
rcr ah, cl
movsx dx, al
cwde
mov eax, 1
bswap ecx
imul ecx, eax, 0
bts eax, ebp
bsr dx, si
aas
sar dl, cl
mov edx, dword [ebp - 0x14]
cmc
movzx eax, byte [edx + ecx]
shl cx, 9
mov dword [ebp - 0x1c], eax
btc eax, 0x19
xchg ch, al
mov eax, dword [ebp - 0x14]
rcl cx, 5
add eax, 1
not ch
pushfd
jmp 0x79119dce
sbb eax, esp
jmp 0x791240e6
Function at 0x79128b52
Capabilities:
Packed with generic packer

Disassembly:
pushal
call fcn.79163df7
pushfd
call fcn.7911fd5a
mov dword [esp + 4], eax
call fcn.7911e3c3
sub esp, 0x3ffc
pushfd
bt bx, ax
bt sp, 4
cmp ch, dl
add esp, 4
pushal
ror ax, 0xa
shr ah, 4
test cx, 0x8cae
bsf ax, sp
mov eax, dword [ebp + 4]
call fcn.79090cfd
pushal
lea esp, [esp + 0x24]
jnp 0x790a22fb
jne 0x7914250b
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.790bfb40
movzx eax, word [ebp + 8]
push esi
mov dword [esp], eax
jmp 0x790f4ae7
rol al, cl
mov eax, 1
btc dx, 5
bts ecx, 0x1f
imul ecx, eax, 0xc4
cmc
das
xor al, 0x60
pushfd
mov edx, dword [ebp - 0xc]
mov byte [esp], 0xc2
das
not ah
mov eax, dword [edx + ecx]
cmc
call fcn.790dd0cb
add esp, 4
jmp 0x7913e67d

Function at 0x7912a021
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x14], eax
movsx ecx, al
mov dword [esp + 0x3c], 8
bswap ecx
pop ecx
call fcn.790843ac
push ebp
or ebp, 0x73e6bc14
cmc
daa
mov ebp, esp
sal dl, cl
neg cl
aad 0x93
push 0xffffffffffffffff
rdtsc
push 0x79056a18
neg dh
push ebp
dec eax
mov eax, dword fs:[0]
bsf dx, sp
xchg dword [esp], eax
aad 0x48
cmc
sub esp, 0x68
rdtsc
mov eax, dword [0x79066330]
adc dl, dh
bsf edx, esi
dec cx
xor eax, ebp
btr dx, 0xc
bswap ecx
mov dword [ebp - 0x10], eax
btc cx, 8
push ebx
rol cl, 5
push esi
ror dh, 6
push edi
pushal
btc cx, 0xc
push ecx
pop edx
xchg dword [esp + 0x1c], eax
rcl ax, cl
lea eax, [ebp - 0xc]
push eax
mov dword fs:[0], eax
pop eax
bt esi, edx
clc
mov eax, dword [0x7906e510]
ror ecx, 1
bts ecx, esp
rol edx, 0x16
mov dword [ebp - 0x14], eax
pop edx
movzx cx, bl
ror al, 6
not al
mov eax, 1
pushal
btr dx, si
movsx cx, bl
rol cx, cl
imul ecx, eax, 0
shl dh, 1
aam 0xe5
aam 0xe6
pop edx
mov edx, dword [ebp - 0x14]
movsx ax, bl
movzx eax, byte [edx + ecx]
bsf dx, di
bts edx, ebx
test eax, esi
cmp cl, 0xff
mov dword [ebp - 0x18], eax
or ch, dl
stc
daa
pushfd
mov eax, dword [ebp - 0x14]
xor dx, 0xe692
sar dx, cl
clc
mov dx, sp
add eax, 1
push dword [esp + 0x14]
mov dword [ebp - 0x14], eax
btr eax, ebx
rcr ah, cl
movsx dx, al
cwde
mov eax, 1
bswap ecx
imul ecx, eax, 0
bts eax, ebp
bsr dx, si
aas
sar dl, cl
mov edx, dword [ebp - 0x14]
cmc
movzx eax, byte [edx + ecx]
shl cx, 9
mov dword [ebp - 0x1c], eax
btc eax, 0x19
xchg ch, al
mov eax, dword [ebp - 0x14]
rcl cx, 5
add eax, 1
not ch
pushfd
jmp 0x79119dce
sbb eax, esp
jmp 0x791240e6

Function at 0x7912bff7
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushal
bswap dx
mov dword [ebp - 4], eax
pushfd
pushfd
rdtsc
mov dword [esp + 0x28], ebx
pop ecx
movzx dx, dl
movsx eax, dl
mov dword [esp + 0x20], esi
pop eax
mov word [esp], 0xc48f
mov dword [esp + 0x18], edi
bswap ax
sete dh
movsx ax, dl
bswap cx
mov dword [ebp - 8], 0x2e
lahf
cwde
movsx cx, cl
mov eax, dword [0x7906d2d4]
lea ecx, [eax + 0x64372a1d]
movzx dx, bl
movzx cx, dl
mov ecx, dword [eax]
not dx
setp dl
mov edx, dword [ecx]
pop ecx
mov word [esp + 0xc], 0x19c3
mov dword [esp + 0x10], edx
push dword [esp + 8]
setae cl
lea ecx, [edi - 0x1911902f]
lea ecx, [ebp - 0xb0]
pushfd
call fcn.790b6b30
Function at 0x79135880
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x2c]
call fcn.790280c0
movzx ecx, al
lea eax, [ebp - 0x90]
not ecx
bswap cx
pushfd
mov dword [esp], eax
jmp 0x79135880
mov ch, dh
call fcn.791485c3
call fcn.790b3ac8
jmp 0x790ed3c6
bswap cx
movsx ecx, dl
lea ecx, [ebp - 0x1c]
pushfd
jmp 0x7915a4f1

Function at 0x7913648a
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
cwde
cmc
pushfd
bt esi, eax
test eax, eax
jmp 0x790d1165
mov word [esp], bp
call fcn.7911b664
cmc
jmp 0x790750a8
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0x10]
jge 0x79145b6f
call fcn.791594a3
lea esp, [esp + 0x58]
jg 0x7914ec63
pushal
pushal
lea esp, [esp + 0x40]
jl 0x790dbfc2
pushal
cmp dword [ebp - 0x48], 0
pushfd
jmp 0x790b47c5
lea edx, [edx + 0x4d43c19b]
shl dx, 6
xchg ch, ah
rcr dh, cl
mov byte [ebp - 0x59], 0

Function at 0x79142bea
Capabilities:
Packed with generic packer

Disassembly:
fstp dword [ebp - 0x8c]
call fcn.7907e012
pushal
add esp, 0x28
pushal
pushal
jmp 0x790b47ba

Function at 0x79145257
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x24]
jne 0x790fe701
jmp 0x790726d1

Function at 0x79145caa
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr cl, cl
mov dword [ebp - 0x70], eax
bts cx, bp
mov eax, 1
lea ecx, [edx + 0x7fa7dfe0]
seta cl
push dword [esp]
imul ecx, eax, 0x2a
lea edx, [ecx - 0x7b7fd239]
rol al, cl
rdtsc
mov edx, dword [ebp - 0x20]
push eax
movzx ax, al
pushfd
pop eax
movzx eax, word [edx + ecx]
btr cx, 0xd
rol ch, 1
bts edx, esi
mov dword [ebp - 0x74], eax
push dword [esp]
rcl al, cl
mov eax, 1
pushfd
bswap dx
not ch
imul ecx, eax, 0x2c
bswap ax
mov dword [esp], 0xde1744b8
mov edx, dword [ebp - 0x20]
btc ax, sp
stc
movzx eax, word [edx + ecx]
jmp loc.79020e91
lea esp, [esp + 0x4c]
jb 0x791637e6
movzx ax, al
mov eax, 1
pushal
imul ecx, eax, 0x26
call fcn.790abb09
rcr ch, cl
pushfd
mov eax, 1
rol dl, 4
rcl dx, 6
btr dx, bp
jmp 0x7916fe9e
imul ecx, eax, 0x26
movzx dx, al
mov edx, dword [ebp - 0x20]
bts ax, dx
movzx eax, word [edx + ecx]
stc
bts dx, 0xd
stc
mov dword [ebp - 0x6c], eax
not ecx
ror ax, cl
cmc
not ecx
mov eax, 1
movsx cx, al
rcr cx, cl
imul ecx, eax, 0x28
bt ebx, 0x1e
rdtsc
rol al, 2
mov edx, dword [ebp - 0x20]
pushal
bswap ax
cwde
bts eax, esi
movzx eax, word [edx + ecx]
jmp 0x79080c96

Function at 0x79148860
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0x12
shl eax, 0
mov byte [esp], dh
lea esp, [esp + 0xc]
movss xmm0, dword [ebp + eax - 0x28]
pushfd
push dword [esp]
jmp 0x791358c8

Function at 0x7914d577
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [esp + 8], dl
lea esp, [esp + 0xc]
jg 0x790f8c22
jmp loc.79030179
cmp dword [ebp - 0xb0], 0
jmp 0x790c4f71

Function at 0x7914e7a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x1fc], 0
lea esp, [esp + 8]

Function at 0x7914f9fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x1fc], eax
pushfd
push 0xa8d6987c
lea esp, [esp + 8]
jmp 0x7914e7b5
lea esp, [esp + 0x44]
call fcn.790257b0
jmp 0x7909a4b7
Function at 0x79156fde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x7916a717
not ah
mov byte [ebp - 0x154], 6
sets ah
cmc
mov byte [ebp - 0x153], 0x86
shld ax, bx, cl
rcl ax, cl
shr ah, cl
setbe ah
mov byte [ebp - 0x152], 0x1e
lea eax, [edi + 0x363d4534]
mov byte [ebp - 0x151], 0x10
lahf
shld ax, dx, 5
mov byte [ebp - 0x150], 0x12
pushfd
and ax, dx
movsx ax, dl
mov byte [ebp - 0x14f], 0x48
inc ah
mov byte [ebp - 0x14e], 0x15
test bp, dx
test dl, 0x47
add ax, 0x1abf
mov byte [ebp - 0x14d], 0xf4
btr ax, cx
mov byte [ebp - 0x14c], 0x62
or ah, 0x70
mov byte [ebp - 0x14b], 0x13
test bh, dl
mov byte [ebp - 0x14a], 0x12
movzx ax, dl
mov byte [ebp - 0x149], 0x17
sub eax, 0xcb0e1419
daa
mov byte [ebp - 0x148], 0x74
inc al
shr ah, 1
mov byte [ebp - 0x147], 0x77
aam 0x5e
mov byte [ebp - 0x146], 0x45
btc ax, 2
mov byte [ebp - 0x145], 0x16
rcr al, 1
mov byte [ebp - 0x144], 0x12
shr ax, cl
cmc
pop eax
mov byte [ebp - 0x143], 0x98
stc
shrd eax, ecx, 0x11
push 0xbb186445
or eax, ebx
mov byte [ebp - 0x142], 0xc0
sal ah, 1
sar ax, cl
bswap ax
mov byte [ebp - 0x141], 7
bsr ax, bp
shrd eax, esi, cl
clc
sbb eax, esp
mov byte [ebp - 0x140], 0xf5
btr ax, 1
btr ax, 2
mov byte [ebp - 0x13f], 0x19
rcl ax, cl
cmc
mov byte [ebp - 0x13e], 0x12
shld ax, cx, cl
mov byte [ebp - 0x13d], 0xfa
push 0x360a2844
btr eax, 0x1d
mov word [esp], bx
mov byte [ebp - 0x13c], 0x34
bsf ax, sp
btc ax, dx
cmp ecx, eax
mov byte [ebp - 0x13b], 0x2f
rcr al, cl
aas
daa
mov byte [ebp - 0x13a], 0x59
bsr ax, si
bsr ax, sp
sar al, cl
adc eax, 0xe2d03ef7
mov byte [ebp - 0x139], 0x1c
bt di, di
ror ax, 2
bsf ax, bp
mov byte [ebp - 0x138], 0x12
shld eax, eax, 0xc
xor eax, 0xa82f02e
movsx ax, cl
xor eax, 0xc33a954c
mov byte [ebp - 0x137], 0x44
bt ax, dx
mov byte [ebp - 0x136], 0x82
das
xor ax, bp
bts ax, ax
aad 0x1d
mov byte [ebp - 0x135], 0xf7
aaa
mov byte [ebp - 0x134], 0xb0
rcr ah, 6
mov byte [ebp - 0x133], 0x1f
cmp dh, 0xa3
mov byte [ebp - 0x132], 0x12
sub esp, 0xffffffb0
js 0x790e4594
btr ax, 6
pushfd
movsx ax, al
mov byte [ebp - 0x131], 0xc9
shrd ax, sp, cl
movsx ax, al
bts eax, 5
mov al, al
mov byte [ebp - 0x130], 0xae
call fcn.79089d24
mov byte [ebp - 0x131], 0xc9
call fcn.790f911e

Function at 0x791594a3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [ebp - 0x59], 1
mov byte [esp], cl
lea esp, [esp + 8]
jmp 0x79145b81

Function at 0x7915ad3e
Capabilities:
Packed with generic packer

Disassembly:
pushfd
not ch
lea ecx, [ebp - 0x1e4]
call fcn.79074865
jmp 0x7916737b
pushfd
lea ecx, [ebp - 0x1e4]
mov byte [esp], 0x89
lea esp, [esp + 0x20]
call fcn.790e19c7
lea eax, [eax + 0x27279df7]
lea eax, [ebp - 0x1c0]
push 0xb0a51ce2
pushal
push dword [esp + 8]
pushfd
lea esp, [esp + 0x2c]
jmp 0x791170ab
mov byte [esp], 0x39
mov dword [esp + 0x20], ecx
lea ecx, [ecx + 0x6f713c27]
mov byte [esp + 0x10], bh
mov dword [esp + 0x1c], 0x79057650
movsx cx, al
jmp 0x79143cab
movsx cx, cl
push eax
jge 0x79095753
push eax
not cx
lea ecx, [ebp - 0x1e4]
push 0x794df0d6
call fcn.79176a8b