joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7909500f
Capabilities:
Packed with generic packer

Disassembly:
cmp eax, dword [ebp - 0x10]
jmp loc.7902a949
mov eax, dword [ebp - 0xc]
test bx, bp
pushfd
test dh, ah
jmp 0x79081f73

Function at 0x7909559e
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
movss xmm0, dword [0x79060ac8]
jmp 0x7911235b
movss dword [ebp - 0x30], xmm0
pushal
mov word [esp + 0x10], 0x86c1
pushfd
mov dword [ebp - 0x34], 0
push edx
lea esp, [esp + 0x28]
jmp 0x79118e5c

Function at 0x79096b3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
cmp eax, dword [0x79077938]
pushfd
mov byte [esp], 0x42
lea esp, [esp + 0x30]
jge 0x790ddc45
pushal
cdq
rcr cl, 1
mov eax, 1
cmc
imul ecx, eax, 0
dec ax
sbb dx, bp
mov edx, dword [ebp - 0x408]
stc
bts ax, 0xf
rcl eax, cl
movzx eax, byte [edx + ecx]
sal dh, 6
not dh
mov dword [ebp - 0x40c], eax
das
bt cx, sp
not al
mov eax, 1
jmp 0x790e7bb6

Function at 0x7909a3b4
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790a5dd5
push 0x9d5e6f91
lea esp, [esp + 0x30]
call fcn.7902a390
bswap cx
mov dword [ebp - 0x1a4], eax
lea ecx, [0x66af5018]
lea eax, [ebp - 0x1a4]
lea ecx, [ebx + 0x52c22635]
pushfd
not ch
mov dword [esp], eax
movsx cx, bl
lea ecx, [ebp - 0x38]
jmp 0x790a71a1
call fcn.7901df90
bt eax, esp
call fcn.7908a970

Function at 0x7909bb0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.7908747f
pushfd
pop eax
mov edx, dword [ebp - 0x504]
lea esp, [esp + 0xc]
movzx ax, bl
mov al, 0x70
mov dword [ebp - 0x508], edx
cwde
not eax
movsx eax, dl
mov dword [ebp - 4], 0
jmp 0x7910309f
mov eax, dword [ebp - 0x508]
push 0x47a456d0
mov dword [esp], eax
pushal
mov dword [esp + 0x1c], 0x790606b0
mov byte [esp + 4], 0xca
pushal
lea esp, [esp + 0x3c]
call fcn.7901c5a0
jmp 0x7912349d
lea ecx, [ebp - 0x500]
pushfd
lea esp, [esp + 8]
call fcn.79004e90
pushal
ror cl, cl
mov eax, dword [0x7907636c]
pop ecx
mov ecx, dword [eax + 4]
cdq
lahf
sbb dh, 0x87
sub ecx, dword [ebp - 0x14]
jmp 0x79124263
and cx, 0xb9ad
sub cl, bh
inc cl
add esp, 8
not cl
mov ch, 0xe3
pushfd
not ch
mov dword [ebp - 4], 0xffffffff
jmp 0x7911a278
call fcn.790904a5

Function at 0x7909c057
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 4]
call fcn.7904347a
sal cx, cl
mov dword [ebp - 0x7c], eax
jmp 0x7912f541
mov word [esp + 4], sp
lea esp, [esp + 0x48]
jne 0x79170638
push 0x292904b9
pushfd
mov byte [esp], 0x6d
pushal
lea esp, [esp + 0x28]
jmp 0x79155524
not dl
inc al
sar ch, cl
mov eax, dword [ebp - 0x7c]
pushfd
stc
stc
rcr ecx, 0x14
mov ecx, dword [ebp - 0x70]
add dx, di
lea edx, [ecx + eax + 0x6b8]
add ax, 0x7947
and ah, 0xbf
mov dword [ebp - 0x80], edx
not ah
test ebp, 0xd1c06635
cmp ah, dl
lea eax, [edi*8 + 0x2792d83b]
mov dword [esp], 4
setb ah
mov eax, dword [ebp - 0x80]
pushfd
test ch, 0xb4
sub eax, dword [ebp - 0x7c]
pushal
jmp 0x790361a7
jmp 0x7907dcc1
Function at 0x7909e7ee
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x20], 0
pushal
jmp 0x790fba98
pushfd
mov byte [esp + 8], 0xee
add esp, 0x28
pushfd
mov dword [esp], 0
pushal
push 0xce98e4a
jmp 0x79175725
call fcn.79165d48
pushfd
mov dword [esp + 0x24], 0x76
pushfd
mov dword [esp + 0x24], 0
jmp 0x79082814

Function at 0x790a03d3
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
call fcn.79153376
jmp 0x79144459
clc
clc
jmp loc.79022a23

Function at 0x790a18b0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov byte [esp], 0x10
pushal
jmp 0x79127e7c

Function at 0x790a394d
Capabilities:
Packed with generic packer

Disassembly:
bt ebp, eax
push 0xe1937acc
add eax, 1
pushfd
call fcn.790b6763
add edi, 0x52bbb461
sub cx, cx
shl di, cl
bsr si, dx
pop edi
jmp 0x79029ee6
pushfd
pushfd
mov byte [esp], dh
lea esp, [esp + 8]
jne 0x79163aef
not al
cwde
lea eax, [esp - 0x211e12ee]
mov dword [ebp - 0x58], 0
movsx ax, dl
bswap ax
movsx ax, dl
cwde
mov eax, dword [ebp - 0xc]
pushal
lea esp, [esp + 0x20]
je 0x790edd9e
push 0xdf0237d3
pushal
mov dword [esp + 0x20], eax
pushfd
pushfd
lea esp, [esp + 0x28]
call fcn.791566af
pushal
cmc
add esp, 0x24
push esp
mov dword [ebp - 0x58], eax
aas
mov ax, 0x1cb6
and eax, 0x69099e8b
cwde
mov eax, dword [ebp - 0xc]
push dword [esp]
jmp 0x790a393c
cmp dword [ebp - 0x24], 0xbf6d
jmp 0x790eba01
call fcn.7908a84f
mov word [esp + 4], 0x9a9
lea esp, [esp + 0x24]
je 0x791415ab
cmc
jmp 0x790edb13

Function at 0x790a3b51
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushfd
mov dword [ebp - 0x34], 0
pushfd
mov byte [esp], 0x22
push ebp
lea esp, [esp + 0x18]
jmp 0x79118e5c
Function at 0x790a3ef7
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 4]
jmp 0x791036be
pushal
setg al
stc
setb ah
movzx eax, word [edx + ecx]
pushal
rcr ch, 5
mov dword [ebp - 0x24], eax
cdq
call fcn.790f8793
movzx eax, word [edx + ecx]
btc dx, 7
pushfd
push ecx
xchg cl, dh
mov dword [ebp - 0x40], eax
bts ax, 2
mov eax, 1
push 0x32e8c16f
bswap edx
cmc
stc
imul ecx, eax, 0x25
pushfd
rcr dh, 1
mov edx, dword [ebp - 4]
btc eax, 0x13
movzx eax, word [edx + ecx]
push dword [esp + 0xc]
mov word [esp], 0x894c
jmp 0x7914ecfb
lea esp, [esp + 0x24]
jnp 0x790e5c0c
movzx eax, word [edx + ecx]
clc
mov dword [ebp - 0x24], eax
bts ecx, ebp
bts eax, edx
push ecx
mov eax, 1
bswap dx
imul ecx, eax, 0x11
bts dx, dx
mov edx, dword [ebp - 4]
pop eax
pushfd
movzx eax, word [edx + ecx]
movzx edx, dl
bts dx, 3
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x392f9d1d]
btr dx, 7
movzx ax, cl
rdtsc
mov eax, 1
movsx dx, bl
not dx
imul ecx, eax, 0x13
ror dh, cl
mov edx, dword [ebp - 4]
btc ax, cx
movsx ax, dl
stc
movzx eax, word [edx + ecx]
rcl dl, cl
push dword [esp]
stc
ror dl, 7
mov dword [ebp - 0x2c], eax
mov cl, byte [esp]
bts dx, cx
movsx dx, bl
movzx dx, bl
mov eax, 1
pop edx
imul ecx, eax, 0x15
bswap ax
mov edx, dword [ebp - 4]
cmc
movzx eax, word [edx + ecx]
rcr cx, 3
btc dx, cx
not ch
clc
mov dword [ebp - 0x30], eax
ror ah, 4
btc cx, cx
mov eax, 1
bt si, 1
rcr dx, cl
btr dx, 0xf
imul ecx, eax, 0x17
ror ax, 3
rcr ax, 8
rol dh, 6
mov edx, dword [ebp - 4]
cwde
movzx eax, word [edx + ecx]
mov cl, 0x9c
push dword [esp]
mov dword [ebp - 0x34], eax
lahf
movsx cx, cl
cmc
stc
mov eax, 1
mov dh, ch
push ebp
xchg ecx, edx
imul ecx, eax, 0x19
cwde
mov edx, dword [ebp - 4]
rol al, cl
bswap ax
movzx eax, word [edx + ecx]
btc ecx, ebx
rcl edx, 0x1d
mov dword [ebp - 0x38], eax
lahf
mov eax, 1
clc
imul ecx, eax, 0x1d
cdq
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x271a267e]
not ah
cwde
movzx eax, word [edx + ecx]
push edx
mov dword [ebp - 0x3c], eax
cwde
mov eax, 1
pushfd
btr dx, di
imul ecx, eax, 0x21
not dh
push 0xc7b40c7c
push ebx
mov edx, dword [ebp - 4]
jmp 0x790f5e65
clc
mov dword [ebp - 0x44], eax
lea esp, [esp + 0x30]

Function at 0x790a441c
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [ebp - 4], eax
pushfd
lea esp, [esp + 0x40]
jmp 0x790ec592

Function at 0x790a5a08
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x79119cb2
call fcn.79160231
idiv ecx
mov byte [esp], 0x2c
stc
jmp 0x790c9909
Function at 0x790a8a0c
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push 0xad85c4c0
rcr ah, 7
sub esp, 0x64
sal ax, cl
adc cx, 0x50ed
stc
push ebx
cmp edx, esp
push esi
sub ch, al
push edi
btr cx, 0xc
cmp dl, 0x9e
aaa
mov eax, dword [0x79077930]
shrd cx, cx, 8
mov dword [ebp - 4], eax
movzx cx, cl
movzx eax, al
mov eax, dword [ebp - 4]
test bp, 0x91c4
bswap cx
jmp 0x790ebf9f
movzx ecx, word [eax]
bt ebx, 0x1a
not ah
sar al, cl
bts ax, si
mov dword [ebp - 8], ecx
push ecx
aad 0xbd
mov eax, dword [ebp - 4]
jmp 0x790ec570
pushal
add eax, 2
clc
pushal
cmc
push dword [esp + 0xc]
mov dword [ebp - 4], eax
movzx eax, al
bts ax, cx
or al, ch
mov dword [ebp - 0xc], 0xe
lea esp, [esp + 0x48]

Function at 0x790abdb9
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7914404e
push dword [esp]
push esi
lea esp, [esp + 0xc]
jl 0x7900fd77
pushfd
mov word [esp], 0x35d5
lea esp, [esp + 4]
jg 0x7909cc91
dec ecx
sar cl, cl
sub cl, ah
mov ecx, dword [ebp - 0x74]
pushal
cmc
clc
cmp ecx, dword [ebp - 0xc0]
mov byte [esp + 4], dl
call fcn.790f6fd9
Function at 0x790aceea
Capabilities:
Authenticate hmac

Disassembly:
test eax, eax
push ebp
lea esp, [esp + 0x24]
jne 0x7916ea51
sub dx, cx
lea eax, [esp - 0xf67df7c]
cwde
mov eax, dword [ebp - 0x10]
xchg edx, ecx
movsx dx, cl
inc dh
add eax, dword [ebp - 0x28]
call fcn.79141ff1
call fcn.790d5739
lea edx, [0x6510694e]
pop edx
mov dword [esp + 0x20], ecx
and al, 0x20
seta dh
lea edx, [ebp - 0x60]
call fcn.790c7a13
cmc
pop ss
je 0x79084d3a
mov word [0x6d7ab96e], gs
or dword [edx + 0x675c6031], edx
pop edx
inc edi
jmp 0x79084cef
mov ebx, 0xc4cd54b3
aam 0x3d
jle 0x79084d97
bound ebp, qword [edx]
retf
push ds
adc edx, dword [ebx]
div dh
sub ecx, ebx
bound ebx, qword [ebp + edi*4 + 0x33]
imul eax, dword [edi - 0x64b0a31b], 0x3a
and byte [eax], 0xd1
and dword [ebx], edx
aaa
fdiv dword [ebx]
inc esp
jne 0x79084dca
xchg ecx, eax
push ss
push esi
mov al, 0x8e
xor byte [esi + 0x37], 0xfe
cli
fsub st(6)
cmpsb byte [esi], byte es:[edi]
and dword [esi], ebp
invalid
mov bh, 0x15
mov eax, dword [0xe166249d]
push ss
push ss
aam 0x36
cld
adc ch, bh
mov word [esi], gs
je 0x79084e08
cmp byte [eax - 0x12], bl
mov bh, 0x14
and byte [esi - 0x446c6202], 0x96
fld dword [ecx - 0x4cad4069]
fld dword [eax - 0x2dd0635f]
int1
mov gs, word [ebx]
mov ebx, 0x4d28fe98
popal
test byte [edi], al
mov ebp, 0x3d2158dd
and ebp, eax
pop ds
sbb bl, dh
ja 0x79084e20
ja 0x79084e20
mov dword [ecx + 0x4abd9205], ecx
leave
lds eax, [eax + 0x6d]
xchg esi, eax
pushal
and eax, 0xff5934d4
or al, 0xb
sbb al, 0xc5
jne 0x79084e25
cmpsb byte [esi], byte es:[edi]
cli
xchg ebp, eax
ror dword [ebp + 0xf282464], 0x84
or eax, 0x66000444
movsx ecx, dl
pushal
lea ecx, [ebp - 8]
push 0x4bd27ac2
pushfd
push 0x9f5f3a68
mov byte [esp + 0x14], al
lea esp, [esp + 0x2c]
call fcn.790256e0
bswap ecx
call fcn.79111abc
pushfd
mov dword [esp], 0xd90ddb2b
jae 0x79131a42
pushfd
mov byte [esp], 0xae
mov dword [esp], 0x38dce383
pushal
lea esp, [esp + 0x20]
jmp fcn.79007cb1
mov byte [esp], bh
lea esp, [esp + 0xc]
call fcn.79041d02
clc
add esp, 0xc
pushal
cmp esp, edi
bt si, 3
jmp 0x79084cb5
call fcn.79032867
call 0x790223f2
jmp 0x7913d796
pushfd
pushfd
lea esp, [esp + 8]
call fcn.79135511
bt edx, ebx
jmp 0x7910ece0

Function at 0x790ad294
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [esp], eax
bswap ecx
jmp 0x791288dd
lea ecx, [ebp - 0x10]
pushfd
pushfd
push dword [esp]
pushal
xchg dword [esp + 0x28], ecx
jmp 0x79153ccf
Function at 0x790b0d41
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3
Packed with generic packer

Disassembly:
jmp 0x790cc056
mov eax, 1
cmp al, 0x1c
shl eax, 1
sub dh, 0xf2
mov ecx, dword [ebp - 4]
bswap edx
movzx edx, word [ecx + eax]
bsr cx, ax
bswap ax
mov dword [ebp - 0x14], edx
rcl ah, 1
mov eax, 1
shld cx, sp, cl
shl eax, 2
ror cl, 2
not dl
mov ecx, dword [ebp - 4]
lea edx, [eax*8 - 0x115f4fe5]
movzx edx, word [ecx + eax]
movsx ecx, dl
btr ecx, esp
lea ecx, [esi*2 + 0x5f0a6065]
bswap cx
mov dword [ebp - 0x18], edx
stc
lea eax, [esp - 0x5498c964]
movsx ax, bl
rcr ax, cl
mov eax, 1
pushfd
stc
lea esp, [esp + 8]
jbe 0x7913c455
rcr ch, 7
imul ecx, eax, 6
shr dl, 1
bt eax, eax
cdq
sub dx, 0x3ad1
mov edx, dword [ebp - 4]
pushal
movzx eax, word [edx + ecx]
and cl, 0x1e
rcl dl, 5
or edx, 0x700badb1
shld ecx, esp, cl
mov dword [ebp - 0x1c], eax
neg dh
btr dx, cx
movzx dx, cl
pushfd
mov eax, 1
pop edx
sub cx, 0x139
neg dl
shl eax, 3
btr cx, 0xb
rol ecx, cl
stc
mov dx, sp
mov ecx, dword [ebp - 4]
bts dx, 4
call fcn.790b90e3
adc eax, esi
mov eax, dword [ebp - 0x14]
bt bx, sp
call fcn.791520b6
das
mov eax, dword [ebp - 4]
bt ebp, 0xe
bt sp, 1
stc
js 0x7900d313
sub eax, dword [0x79077930]
call fcn.79100d3a
rcl dh, 3
movzx ecx, dl
ror ecx, 0xa
imul ecx, eax, 6
shrd edx, ebx, cl
mov edx, dword [ebp - 4]
sal al, 2
movzx eax, word [edx + ecx]
test esp, 0x2abbf1dd
xadd dx, cx
cmc
shr edx, cl
mov dword [ebp - 0x1c], eax
aad 0x4b
aas
and al, dh
rdtsc
mov eax, 1
stc
shl eax, 3
cmc
btc cx, 0xd
cmc
jmp 0x79148b4e
mov ecx, dword [ebp - 4]
pushal
ror dh, cl
bt bp, 8
rcl dx, 6
movzx edx, byte [ecx + eax]
rcl ah, cl
clc
mov dword [ebp - 0x20], edx
rcl dh, cl
btc cx, bx
lea ecx, [edx + 0x1c73ba33]
movzx dx, al
mov eax, 1
not dh
mov dh, 0x64
imul ecx, eax, 9
ror ah, 5
mov edx, dword [ebp - 4]
mov al, byte [esp + 0x14]
pushal
movzx eax, word [edx + ecx]
ror ecx, 5
btc dx, 0xa
rcr dx, cl
mov dword [ebp - 0x24], eax
pop ecx
cwde
movsx cx, dl
rdtsc
mov eax, 1
movsx cx, dl
setno ch
pushfd
push dword [esp + 8]
imul ecx, eax, 0xb
btc dx, 0xd
jmp 0x79163992
rdtsc
setnp dl
mov edx, dword [ebp - 4]
not ah
bt sp, di
push 0xa9c2a721
pushfd
movzx eax, word [edx + ecx]
stc
lea ecx, [ebp + 0x36728c47]
mov dl, byte [esp]
bt ax, dx
mov dword [ebp - 0x28], eax
rcl dl, 1
mov eax, 1
cmc
movsx dx, dl
imul ecx, eax, 0xd
clc
btc edx, 0xf
ror dh, cl
aaa
mov edx, dword [ebp - 4]
bsf ax, di
sbb ax, 0x3dd8
sal eax, cl
movzx eax, byte [edx + ecx]
cmp cx, sp
cmc
bt cx, 5
mov dword [ebp - 0x2c], eax
mov byte [esp], 0x2e
mov eax, dword [ebp - 4]
test ah, dh
add eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 4], eax
mov byte [esp + 8], 0x48
lea esp, [esp + 0x50]
jmp 0x790ec592

Function at 0x790b1ae5
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x79156aca
pushfd
lea esp, [esp + 8]
je 0x7907ea7d
mov cx, sp
push 0x1c
call fcn.790c0e71
Function at 0x790b32ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
aas
shl ah, 1
xadd dl, cl
clc
push ebp
btr cx, 0xf
cmp dx, si
mov ebp, esp
rdtsc
sub esp, 0x8c
pushal
not al
cwde
rdtsc
mov dword [esp + 0x1c], ebx
seta ah
bt edx, 1
cdq
mov dword [esp + 0x18], esi
xchg cl, dl
mov dword [esp + 0x14], edi
not ax
push ecx
btc ecx, ebx
aas
mov eax, dword [0x79077930]
add dh, 0x5d
mov dword [ebp - 4], eax
das
mov eax, dword [ebp - 4]
shl ch, 6
neg dh
movzx cx, cl
xadd cl, dh
add eax, 1
pushal
bt ecx, esp
rol ch, 1
setl cl
mov dword [ebp - 4], eax
cwde
xchg ecx, edx
mov eax, 1
xchg dl, ch
cmc
seto dh
btc dx, 5
imul ecx, eax, 0
pop eax
shl dx, 0xe
rcl ax, 6
mov edx, dword [ebp - 4]
or al, 0xa3
movzx ax, dl
movzx eax, byte [edx + ecx]
pushfd
stc
cmp bh, 8
pushfd
mov dword [ebp - 8], eax
bsf eax, esp
call fcn.790ea7e7

Function at 0x790b47ae
Capabilities:
Packed with generic packer

Disassembly:
pushfd
clc
cmp bl, cl
test eax, eax
jmp 0x791268c4

Function at 0x790b5904
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [esp + 8], ecx
lea esp, [esp + 8]
je 0x79143bad
lea ecx, [ebp - 0x2f5357ab]
push 0xa67f3291
movsx cx, al
mov ecx, 0x790764e8
pushal
mov word [esp], dx
push dword [esp]
jmp 0x790fedd4
lea esp, [esp + 0x28]
call fcn.7901a330
mov cl, 0xe1
call fcn.7900d627
lea ecx, [ebp*2 + 0x6154f2ac]
bswap cx
jmp 0x790f73ae

Function at 0x790b5a59
Capabilities:
Packed with generic packer

Disassembly:
setp cl
push esi
setnp ch
bswap ecx
push edi
movzx cx, bl
mov ecx, 0x79076690
jno 0x790e1a3f
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
call fcn.79017690
pushfd
call fcn.7908feb2
bswap bx
not esi
call fcn.79031549
pop ecx
lea ecx, [esi + 0x2abe51f4]
jle 0x79030785
push esi
not cx
pushfd
push dword [esp]
mov dword [esp + 4], edi
pushal
mov ecx, 0x79076690
pushal
lea esp, [esp + 0x44]
call fcn.79017690
mov bl, bh
jg 0x790a98aa
push edi
mov edi, dword [esp + 4]
jmp 0x790bf78b
call 0x79123944

Function at 0x790b89b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x17], 0x65
push dword [esp]
mov byte [ebp - 0x16], 0x72
movzx ax, cl
mov byte [ebp - 0x15], 0x53
lahf
sets ah
mov byte [ebp - 0x14], 0x61
mov al, dl
movsx ax, bl
pushal
mov byte [ebp - 0x13], 0x66
lahf
lahf
mov byte [ebp - 0x12], 0x65
bswap eax
cwde
cwde
bswap ax
mov byte [ebp - 0x11], 0x2e
lahf
mov byte [ebp - 0x10], 0x64
movsx ax, al
push 0xab8b8cf5
lahf
bswap eax
mov byte [ebp - 0xf], 0x6c
lahf
not ax
movsx ax, bl
cwde
mov byte [ebp - 0xe], 0x6c
jmp 0x790d9eb4
mov byte [ebp - 0xd], 0
lea eax, [esp - 0x5d112bbb]
cwde
pushfd
lea eax, [ebp - 0x18]
mov byte [esp], ch
call fcn.7915bf49
pushal
mov dword [ebp - 0x480], eax
mov word [esp], 0xa26d
call fcn.7909cb32

Function at 0x790ba717
Capabilities:
Packed with generic packer

Disassembly:
pushfd
jmp 0x791594c7
mov byte [esp], 0x8d
lea esp, [esp + 0xc]
je 0x79008161
jmp 0x7910e961
Function at 0x790bb4d8
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x28]
jg 0x790c3b7a
jne 0x790a2270
jmp 0x790c1fe0
push 0x79060b30
movzx ax, dl
mov ah, ch
lea eax, [ebp - 0x41c]
pushfd
mov dword [esp], eax
push esp
pushfd
pushfd
lea esp, [esp + 0xc]
call fcn.79008370
cmc
bt esp, esp
test ch, al
call fcn.7916e699

Function at 0x790be942
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 4], 2
push 0xbd962d1a
lea esp, [esp + 0xc]
call fcn.79092537
clc
movzx eax, al
clc
clc
test eax, eax
pushal
call fcn.791571e0

Function at 0x790c25d0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
call fcn.790256e0
pushfd
call fcn.79133147

Function at 0x790c5d26
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 8]
jae 0x7916f5f7
pushal
mov byte [esp + 4], 0x3d
lea esp, [esp + 0x20]
jmp fcn.79081bc2

Function at 0x790c76a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7910ef4e
mov byte [esp], cl
lea esp, [esp + 0x24]
jne 0x79023ab6
push 0x7fe01e9c
pushfd
lea esp, [esp + 8]
call fcn.79127356
aad 0x58
inc ah
movzx eax, byte [0x79070d26]
push 0x68d32db9
test dh, 0xba
pushal
stc
test eax, eax
jmp 0x791677be
lea esp, [esp + 0x24]
je 0x79023efa
call fcn.7915a979

Function at 0x790c917c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x24]
call fcn.79041bb0
clc
btr cx, di
add esp, 0xc
ja 0x790fce2d
push 0x3e8
movzx cx, bl
mov cl, 0xb3
mov ecx, dword [ebp - 8]
call fcn.790b2105

Function at 0x790c990e
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jbe fcn.790c20ba
pushal
pushfd
mov dword [esp + 0x20], 2
call fcn.79173c9a

Function at 0x790ca582
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x7911607d
cmp cl, al
call fcn.791143f6

Function at 0x790ce38d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx*2 + 0x5611b61c]
jmp 0x7912887b
pushal
lea ecx, [ebp - 8]
pushfd
call fcn.7914ffca

Function at 0x790cf93e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], ax
mov dword [ebp - 8], 0
pushfd
pushfd
lea esp, [esp + 0x10]
jmp fcn.7903bafb

Function at 0x790d00af
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
mov word [esp], 0xb1a8
lea esp, [esp + 0x28]
call fcn.790bdc25
push ebx
stc
add esp, 0xc
pushfd
push dword [esp]
mov word [esp + 4], bx
fstp dword [ebp - 0x30]
push 0x287bbc73
pushfd
pushfd
lea esp, [esp + 0x14]
jmp fcn.790c20ba

Function at 0x790d0504
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0xbc], edx
clc
btr ax, ax
cmc
push 0x4801b2d8
mov eax, dword [ebp - 0x70]
cmp ch, 0xb
cmc
cmc
cmp eax, dword [ebp - 0xbc]
mov byte [esp + 4], 0x96
pushfd
push 0x9fd03cc7
push dword [esp]
lea esp, [esp + 0x34]
jg 0x790b48cb
push 0x329f0198
push eax
pushfd
pushal
lea esp, [esp + 0x2c]
jl 0x790b48b8
rol cl, cl
mov ecx, dword [ebp - 0x74]
jmp 0x790b48a4
Function at 0x790d05d8
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
je 0x7909e44d
lahf
call fcn.790d0c73

Function at 0x790d0c6e
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jmp 0x79136070
cmp ch, dh
cmp dword [0x790764b0], 0x7e0
pushal
pushal
mov word [esp], 0x9af
mov byte [esp + 8], dh
lea esp, [esp + 0x44]
jne 0x7917c698
clc
call fcn.79147a9e
bts cx, si
rcr ch, 6
mov eax, 1
bts cx, 5
bt eax, 0x10
ror ch, cl
imul ecx, eax, 0
call fcn.7910bf34

Function at 0x790d2c01
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push dword [esp + 4]
lea esp, [esp + 0xc]
call fcn.79087dda
stc
clc
pushal
clc
sub eax, dword [0x79077888]
test bl, 0xe7
bt sp, 6
cmp eax, 0x1f4
push eax
call fcn.790d9551

Function at 0x790d3036
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x34]
call fcn.79018450
movzx cx, cl
setg cl
jmp 0x790e44b8
mov byte [ebp - 4], 0
push ecx
push esp
bswap cx
lea ecx, [ebp - 0xb8]
mov byte [esp + 4], 0x20
call fcn.790f38e3
Function at 0x790d39db
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
dec cl
movzx cx, bl
adc edi, dword [ebp - 0x40]
setb ch
push 0xebd484c6
mov ch, byte [esp]
lea ecx, [ebp - 0x1c]
pushfd
pushal
lea esp, [esp + 0x28]
call fcn.790119b0
push eax
jmp 0x7908b13f
call fcn.79103e0c
lea eax, [ebp + 8]
bsf cx, ax
sbb cx, 0x578b
pushfd
xor ch, al
mov dword [esp + 0x20], eax
pushal
cmc
xor ch, 0x10
mov ecx, dword [ebp - 4]
call fcn.790dc51f
push ebx
pushfd
lea esp, [esp + 8]
call fcn.790119b0
pushal
mov byte [esp + 4], ah
pushal
mov dword [eax + 0x20], esi
call fcn.790a9b65
mov word [esp], 0x3a04
mov byte [ebp - 0xd3], 0
push esp
push 0x3cdba4b4
push esp
mov byte [esp + 0x14], bl
mov byte [ebp - 0xd2], 0
call fcn.790d9241
mov dword [esp], esp
lea esp, [esp + 4]
jl 0x7914be96
pushal
stc
pushfd
jmp 0x790d586c
cmp dword [ebp - 0xd0], 0
pushal
push eax
lea esp, [esp + 0x48]
ja 0x790d01e1
pushfd
mov byte [esp], 0x20
push ecx
push ebp
mov dword [esp + 8], 1
pushal
pushfd
lea esp, [esp + 0x2c]
call fcn.7912f198
add cl, bh
add esp, 4
sbb cl, 0x6f
shrd cx, si, 5
btc cx, ax
mov dword [ebp - 8], eax
cmp cx, 0x641d
xadd al, ch
lea eax, [esi*8 - 0x580b861d]
mov eax, dword [0x7907636c]
cmc
stc
movzx ecx, byte [eax + 0x64]
stc
push 0x31ed61a7
test ax, ax
test ecx, ecx
pushfd
mov dword [esp + 4], 0x3f9a9dab
lea esp, [esp + 8]
je 0x790d690d
jmp 0x790e492a
cmp dword [0x790765bc], 0
call fcn.790bf648
jmp 0x790ec35b
push ebx
pushal
lea esp, [esp + 0x24]
jg 0x791274c5
pushfd
cmp dword [ebp - 0x44], 0
pushfd
pushfd
lea esp, [esp + 0xc]
jbe 0x790e5634
push 0x154ceb7e
lea esp, [esp + 4]
call fcn.7904347a
cmp ah, bh
cdq
sbb si, 0x1ada
setae cl
setne cl
xor cl, 0x22
mov ecx, 0x1f4
cmp bp, bp
btc di, ax
rcl di, cl
idiv ecx
das
sar si, cl
bsf esi, ebp
ror si, cl
mov eax, edx
shr edi, 9
rcr si, 5
cdq
je 0x7913648b
sal esi, 0x1c
btr cx, 1
shld si, bp, cl
mov esi, eax
push 0x42d85ac6
stc
lea edi, [0x899abbb7]
push 0x651f3cb9
mov edi, edx
and ch, ah
btr cx, 6
cmc
sar cl, 2
add esi, dword [ebp - 0x44]
inc cl
lea esp, [esp + 8]
jno 0x790862cb
mov cl, dh
adc edi, dword [ebp - 0x40]
jmp 0x7912de40
mov cl, 0x4e
movsx cx, bl
lea ecx, [ebp - 0x1c]
jmp 0x790a7b05
adc di, 0xbe77
mov esi, eax
pushal
mov edi, edx
rol ch, 4
sub ecx, 0x8c4d12e9
add esi, dword [ebp - 0x44]
movzx cx, bl
call fcn.790a54e2
pushfd
call fcn.79110803
add esp, 0x28
push esp
lea esp, [esp + 4]
jmp 0x7910a8d6

Function at 0x790d4d81
Capabilities:
Packed with generic packer

Disassembly:
clc
cmc
mov dword [ebp - 0x90], eax
push 0x6482f715
jmp 0x79178862
lea esp, [esp + 0x28]
je 0x79008161
movzx cx, bl
lea ecx, [ebp - 0x3c]
jns 0x7909e331
push ebp
lea esp, [esp + 4]
call fcn.7914ec95
jmp 0x790ccc35
call fcn.790fa64b
cmp dh, ch
test eax, edi
mov dword [ebp - 0x8c], edx
pushal
cmp dword [ebp - 0x8c], 0
pushfd
lea esp, [esp + 0x28]
jl 0x79008161
push 0x38d41b14
pushal
pushal
lea esp, [esp + 0x44]
jg 0x7913066d
test dl, dl
jmp 0x79150795

Function at 0x790d65bc
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], eax
not cl
call fcn.7910f332