joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4091c8
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, 0x4b6
push edi
mov esi, ecx
call fcn.00407941
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
inc eax
inc eax
push edi
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.0040795e
push 1
inc edi
push edi
mov ecx, esi
call fcn.0040795e
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x4d0]
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
push edi
push dword [esi + 4]
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x407fa7
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.00408e97
mov ecx, esi
mov edi, eax
call fcn.00408314
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x40a8d0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
ret
Function at 0x40af30
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x80
push ebx
mov ebx, ecx
mov ecx, dword [ebx]
cmp ecx, 0x3f
jne 0x40afad
xor eax, eax
cmp dword [ebx + 4], eax
jbe 0x40af60
jmp 0x40af50
mov cl, byte [ebx + eax + 8]
mov byte [ebx + eax + 0x24], cl
add eax, 1
cmp eax, dword [ebx + 4]
jb 0x40af50
xor ecx, ecx
cmp dword [ebx + 0x1c], ecx
jbe 0x40af85
cmp eax, 0x20
jae 0x40b103
mov edx, dword [ebx + 0x20]
mov dl, byte [ecx + edx]
mov byte [eax + ebx + 0x24], dl
add ecx, 1
add eax, 1
cmp ecx, dword [ebx + 0x1c]
jb 0x40af67
cmp eax, 0x20
jae 0x40b103
mov ecx, 0x20
sub ecx, eax
push ecx
lea ebx, [eax + ebx + 0x24]
push 0
push ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
pop ebx
add esp, 0x80
ret
push esi
xor esi, esi
lea eax, [esi + 1]
xor edx, edx
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.00416360
cmp edx, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov byte [esp + 8], 0
mov byte [esp + 9], 0
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
jb 0x40b0f1
ja 0x40b04c
cmp eax, esi
jbe 0x40b0f1
push ebp
push edi
mov edi, edi
mov eax, dword [ebx + 4]
push eax
lea eax, [ebx + 8]
push eax
lea edx, [esp + 0x30]
push edx
call fcn.0040abf0
mov eax, dword [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0040abf0
mov esi, dword [esp + 0x60]
add esp, 0x18
mov ebp, 8
lea edi, [esp + 0x10]
and esi, 0x3f
mov cl, byte [edi]
mov byte [esp + esi + 0x50], cl
add esi, 1
add edi, 1
add dword [esp + 0x48], 1
adc dword [esp + 0x4c], 0
sub ebp, 1
cmp esi, 0x40
jne 0x40b0b0
lea edx, [esp + 0x28]
xor esi, esi
call fcn.0040ab30
test ebp, ebp
ja 0x40b087
xor eax, eax
add byte [esp + eax + 0x10], 1
jne 0x40b0c5
add eax, 1
cmp eax, 8
jl 0x40b0b6
add dword [esp + 0x18], 1
mov eax, dword [esp + 0x1c]
adc eax, 0
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
jb 0x40b050
ja 0x40b0ef
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x18], edx
jb 0x40b050
pop edi
pop ebp
add ebx, 0x24
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0040ac40
add esp, 8
pop esi
pop ebx
add esp, 0x80
ret

Function at 0x40f23e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f264
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f264
xor al, al
jmp 0x40f284
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00416320
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x415eb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41dc80], ecx
add edx, 1
cmp edx, 0x100
jb 0x415eb2
cmp edx, 0x800
jae 0x415f9b
mov edi, edi
mov eax, dword [edx*4 + 0x41d880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41dc80]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41dc7c], eax
jb 0x415f70
mov dword [0x41dc54], 0x416650
call fcn.004160e0
test eax, eax
jne 0x415fb8
mov dword [0x41dc54], 0x416570
ret
Function at 0x7900de48
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jmp 0x79038134
mov byte [esp + 4], 9
lea esp, [esp + 0x2c]
je 0x7912f9d9
cmp dl, 0x77
cmc
call fcn.791466fd

Function at 0x7900ed2f
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x47c], 0
jmp loc.7913d024

Function at 0x79015315
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], bl
or esi, edx
bt esi, edi
mov edx, dword [ebp + 8]
stc
test dl, 0x68
cmp bh, cl
cmp bh, ah
xor esi, dword [edx]
bswap dx
movsx edx, bl
mov edx, dword [ebp + 0xc]
cmc
stc
mov dword [edx], esi
dec si
bswap si
mov si, word [edx + 2]
stc
jmp fcn.79128cd2

Function at 0x79015655
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 4]
mov ebx, esi
movzx bx, cl
movsx ebx, dl
not bl
mov ebx, dword [esp + 8]
call fcn.790e1be7

Function at 0x790157f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx cx, bl
mov dword [ebp - 8], edi
movzx ax, dl
rdtsc
cwde
rdtsc
mov eax, dword [ebp]
pop ecx
xchg dx, cx
mov dword [ebp - 0xc], eax
pushfd
pop eax
mov eax, dword [ebp - 0xc]
sete dh
push 0x932dea28
mov dword [esp], eax
setle ch
not ecx
jmp 0x790912a9

Function at 0x7902233b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwde
rdtsc
rcl ch, cl
mov eax, 1
btc cx, 0xa
rcl cl, 1
xchg ch, dl
pop ecx
imul ecx, eax, 0x29
pushfd
mov edx, dword [ebp - 4]
lahf
movzx eax, word [edx + ecx]
push dword [esp]
mov byte [esp + 4], 6
mov dword [ebp - 0x48], eax
pushal
lea esp, [esp + 0x28]
jmp loc.79143d4f

Function at 0x79022370
Capabilities:
Packed with generic packer

Disassembly:
mov byte [0x79070ce2], 1
mov byte [esp], cl
pushfd
push esp
lea esp, [esp + 0x38]
jmp fcn.790bc086

Function at 0x79029f0c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
jbe 0x79092b27
bswap cx
lea eax, [ecx*8 + 0x32580cc0]
xchg ah, ch
lahf
mov eax, dword [ebp - 0x20]
call fcn.7902f912

Function at 0x7902a13e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [eax + 4]
pushfd
call fcn.7909e368

Function at 0x79036739
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jb 0x7916ec95
push 0x419162d2
pushal
lea esp, [esp + 0x24]
call fcn.790b5312
call fcn.7907d48a

Function at 0x7903ad66
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
neg ax
push ebp
movsx cx, al
cmc
mov ebp, esp
xor cl, 0x25
shrd cx, si, cl
cmp cl, al
and cx, 0x7609
sub esp, 0x4c
movsx ax, cl
cwde
sub cx, 0x5f4e
aam 0xe5
mov eax, dword [0x7906f390]
bt ebx, 1
movzx ecx, dl
mov ch, 0x10
xor eax, ebp
push edx
setg ch
mov dword [ebp - 4], eax
mov cx, cx
movsx ecx, al
movsx cx, dl
mov cl, ah
mov dword [esp], ebx
not ch
pushfd
lea ecx, [eax - 0xabb5d33]
mov dword [esp], esi
movzx cx, dl
jne 0x790d94d1
lea ecx, [ecx - 0x44689b0b]
push edi
push 0xd7c305e7
jmp loc.7916a43a
Function at 0x7903c150
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 1
not cl
push dword [esp]
pushfd
imul ecx, eax, 0x24
movsx ax, cl
mov edx, dword [ebp - 0x14]
not ax
cmc
movzx eax, word [edx + ecx]
xchg dx, cx
not dl
clc
mov dword [ebp - 0x44], eax
xchg cl, al
bt edx, ebp
cmc
mov eax, 1
jmp 0x790ae745

Function at 0x79043a48
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
test ebx, ebx
jne 0x79043a6b
call fcn.790484ea
mov dword [eax], 0x16
call fcn.7904b387
or eax, 0xffffffff
jmp 0x79043ad3
push edi
push 0x3bc
push 1
call fcn.79047cc3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x79043abd
call fcn.7904a37b
push dword [eax + 0x6c]
push edi
call fcn.7904a402
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
push edi
push 4
push edi
push 0x79043b53
push dword [ebp + 0xc]
mov dword [edi + 0x54], ebx
push esi
mov dword [edi + 0x58], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x79043ad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call fcn.790457f0
pop ecx
test esi, esi
je 0x79043acf
push esi
call fcn.790484c9
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x79043ab5
mov eax, esi
jmp 0x79043ad2
Function at 0x7907ca7f
Capabilities:
Packed with generic packer

Disassembly:
test al, 0x32
test cl, cl
clc
mov dword [ebp - 0x50], eax
cmp cl, ch
stc
mov dword [ebp - 4], 0
cmp bh, 0x21
mov byte [esp], bl
mov byte [esp], cl
cmp dword [ebp - 0x50], 0
pushfd
jmp 0x790d3b50

Function at 0x7907cc3b
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push eax
mov eax, 4
push 0x4124a814
shl eax, 0
push ecx
lea esp, [esp + 0x14]
movss xmm0, dword [ebp + eax - 0x20]
jmp loc.79030c99

Function at 0x7907d0f4
Capabilities:
Packed with generic packer

Disassembly:
push 0x407274c8
mov dword [esp + 0xc], eax
call fcn.7917734a

Function at 0x7907ee5c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
movss xmm0, dword [ebp - 0x38]
pushfd
pushfd
lea esp, [esp + 8]
movss dword [esp], xmm0
pushfd
jmp 0x790c2095

Function at 0x79080049
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jmp loc.79141bdd
lahf
lea esp, [esp + 8]
jo 0x790989e6
setns ah
lea eax, [ebp - 0x18]
lea ecx, [ebp*2 + 0x49ce34ef]
push eax
lea ecx, [edx*4 + 0x74ffd22d]
mov cl, 0xe5
pushal
sets ch
mov ecx, dword [0x79077448]
lea esp, [esp + 0x20]
jl 0x79013aee
push edi
push dword [esp]
pushfd
mov dword [esp + 8], ecx
call fcn.79094207
pushfd
mov dword [esp + 0x24], 0x10
pushal
mov dword [esp + 0x40], 0
push dword [esp + 0xc]
mov byte [esp], 4
pushfd
pushfd
lea esp, [esp + 0x4c]
jmp fcn.79103c29
pushal
pop ecx
xchg ah, ch
jmp 0x790fb1b7
lea eax, [ebp - 0x18]
movsx ecx, cl
push dword [esp + 4]
bswap cx
mov dword [esp + 0x1c], eax
bswap cx
bswap cx
call fcn.790aa207

Function at 0x7908193c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790ddaeb
mov byte [0x79070ce2], 1
pushfd
lea esp, [esp + 0x28]
jmp fcn.790bc086

Function at 0x79081f7b
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], ah
mov byte [ebp - 0xcc], 0
mov word [esp + 0x10], 0x3144
call fcn.791287be

Function at 0x79082a6d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
movzx ax, dl
mov eax, dword [0x79077930]
cmp ecx, 0xd58ae33c
mov dword [ebp - 4], eax
test al, al
rcr ax, cl
bt ax, 4
cmc
mov byte [ebp - 5], 0
lea esp, [esp + 8]

Function at 0x79084938
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror al, cl
mov dword [esp], esp
movzx eax, word [edx + ecx]
bswap edx
mov dword [ebp - 0x20], eax
cmc
mov eax, 1
pop edx
rcr cx, cl
imul ecx, eax, 0xf
lahf
lahf
clc
mov edx, dword [ebp - 4]
bt esi, esp
movzx eax, word [edx + ecx]
pushal
cmc
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x4d1ac4be]
mov eax, 1
stc
call fcn.7913b17b

Function at 0x790864ce
Capabilities:
Access peb ldr_data

Disassembly:
mov esi, dword [esp + 0xc]
pushal
movzx bx, dl
call fcn.790d685c
Function at 0x79086d0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
call fcn.79046160
setnp ch
pushal
movzx cx, bl
mov ecx, dword [ebp - 0x3c]
pushfd
mov word [esp], 0xf2af
mov word [esp], 0x2a27
xchg dword [esp + 0x20], edx
jmp 0x790bf7c9
movsx dx, bl
pushfd
lea edx, [ecx*2 + 0x4859f06e]
xchg dword [esp + 0x20], eax
bswap eax
rdtsc
lahf
rdtsc
mov edx, dword [ecx + 4]
pop eax
mov dword [esp + 0x18], edx
lahf
lea eax, [ebp - 0x6a412e78]
pushal
mov eax, dword [ecx]
pushfd
pushfd
push esi
mov byte [esp + 0xc], 0x74
mov dword [esp + 0x40], eax
jmp 0x79141cd8
call fcn.7903005c
lea esp, [esp + 0x40]
jbe 0x791094d7
push esp
pushal
lea esp, [esp + 0x24]
call fcn.79046160
movsx cx, dl
bswap cx
pushal
not cx
mov ecx, dword [ebp - 0x40]
mov byte [esp + 4], 0x87
mov dword [ecx], eax
mov byte [esp + 4], 0
pushal
mov word [esp], bp
lea esp, [esp + 0x40]
jmp fcn.7914cec0

Function at 0x79087f53
Capabilities:
Get number of processors

Disassembly:
lea esp, [esp + 0x28]
call fcn.7902ddc0
movzx ecx, dl
bswap ecx
movsx cx, bl
mov dword [ebp - 4], 0xffffffff
movzx cx, al
not ecx
lea ecx, [edi*2 - 0x2517535d]
movzx cx, bl
lea ecx, [ebp + 8]
pushal
lea esp, [esp + 0x20]
call fcn.79004e70
bsf si, ax
xor si, 0x56e9
ror cx, cl
mov ecx, dword [ebp - 0xc]
cmc
mov dword fs:[0], ecx
stc
btc si, 1
pop ecx
bt eax, ecx
neg ebx
rol di, cl
pop edi
shr bl, 6
pushal
mov esi, dword [esp + 0x20]
bsf ecx, ebx
cmp dx, 0x3e15
stc
mov ebx, dword [esp + 0x24]
btr cx, 4
bsf cx, dx
cmp cl, 0x64
dec cl
mov ecx, dword [ebp - 0x10]
pushfd
stc
xor ecx, ebp
pushfd
lea esp, [esp + 0x30]
call fcn.79041746
call fcn.79105434

Function at 0x79089657
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ah, 0x70
mov dword [edx + 0xbc], ecx
neg ax
add al, ch
mov eax, 0x67
clc
setne dh
dec dl
mov word [ebp - 0x3cc], ax
movsx ax, dl
mov eax, 0x6c
clc
mov word [ebp - 0x3ca], ax
rcl edx, cl
sbb ch, 0xe7
mov eax, 0x66
bts cx, 0xf
neg dh
pushfd
mov word [ebp - 0x3c8], ax
bswap cx
sub cl, bl
btc cx, 5
sub eax, eax
add ch, al
mov word [ebp - 0x3c6], ax
sal al, 7
aaa
clc
mov dword [esp + 4], 0
lea edx, [edi*4 - 0x387d819f]
bts ax, ax
rdtsc
mov dword [esp], 0
rdtsc
mov eax, dword [ebp - 0x14]
shrd cx, ax, 6
add eax, 0x29
jmp 0x7911ae5d
not edx
pushal
pop ecx
mov dword [esp + 0x18], eax
lea edx, [ebx + 0x59badf92]
movsx dx, bl
lea ecx, [ebp - 0x3c4]
pop edx
call fcn.79119778
lea ecx, [ebp - 0xc]
pushal
jmp 0x79037be1
Function at 0x7908f571
Capabilities:
Packed with generic packer

Disassembly:
inc esp
and al, 0x40
mov byte [esp + 4], cl
push dword [esp + 8]
call fcn.7907b6dc
lea esp, [esp + 4]
jge 0x790cade0
pushfd
call fcn.79114467
xchg ebp, eax
add bh, 0x6e
outsb dx, byte [esi]
pop es
add edx, ebx
test dword [esi + edx - 0x552a6408], edx
push ss
clc
wait
aad 0xaa
neg dh
sahf
lahf
cmp eax, 0x206b1b95
jno 0x7908f5c7
test eax, 0xa1efdfe9
mov ecx, 0x542d5fd3
xor al, 0x73
salc
pop edi
sub eax, 0xd6733454
call 0xe4295112
test byte [esi*2 - 0x323a2d17], bl
popfd
mov ch, 0xa0
mov al, byte [0x5088069b]
stosd dword es:[edi], eax
pop edi
stc
je 0x7908f5a2
repne lodsd eax, dword [esi]
dec ebp
pop edi
rcr dword [edx - 0x16], cl
sbb dword [ebp + eax*8 - 0xd], eax
add dh, byte [ebx + 0x33e8afc5]
fidivr dword [ebx + 0x4c]
ljmp 0xb302:0xf3c54419
lds ebp, [edi + 0x7bda33e8]
dec esp
sal byte [edi - 0x80], cl
xor byte [ebx], bl
salc
jnp 0x7908f561
aam 0xab
salc
jne 0x7908f5ce
in al, dx
loope 0x7908f58b
and dword [ebx + ecx], esi
lahf
xchg esi, eax
test dword [ecx*4 - 0x55d6be3a], eax
fdiv dword [edx + 0x41de19e3]
inc ecx
sar byte [ebp - 0x3b33d1d9], cl
les ebp, [esi]
scasd eax, dword es:[edi]
in al, dx
cmp byte fs:[ebx - 0x2a], bl
or ecx, dword [ebx]
std
mov eax, dword [0x2d666ba4]
inc esi
popal
and eax, 0x5126afa0
cmp dword [ebx + 5], ecx
adc bl, 0x78
xchg ecx, eax
sub dword [eax - 0x4f1a4925], ebp
sub esp, esi
mov ecx, 0x351b9732
les eax, [edi - 0x20054bfe]
ljmp 0x86e1
sbb cl, 0xf5
bts ax, bx
das
sar ch, 2
mov byte [ebp - 0x59], 0
inc ch
pushal
xchg edx, eax
mov ecx, dword [ebp - 0x18]
cmp bh, 0x8a
sub ah, cl
movzx edx, byte [ecx + 2]
aam 0x44
aad 0x64
das
movzx eax, byte [ebp - 0x59]
push ebx
pushfd
xor edx, eax
call fcn.79122440

Function at 0x79091745
Capabilities:
Packed with generic packer

Disassembly:
mov byte [ebp - 0xa6], 0
call fcn.790ef87b
pushal
lea esp, [esp + 0x28]
call fcn.79041746
call fcn.7903009f
stc
shrd ax, ax, cl
shrd ax, bx, 0xf
mov eax, dword [edx + ecx]
shr cl, 5
bswap ecx
shrd ecx, esp, 7
mov dword [ebp - 0x418], eax
movsx eax, bl
bsf ax, sp
bsf cx, bp
mov eax, dword [ebp - 0x408]
not cx
ror cx, cl
call fcn.790bf09a

Function at 0x790922fd
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x790762d0]
push 0x668761c5
lea esp, [esp + 0x24]
jb 0x791247e0
pushal
mov dword [esp + 0x1c], eax
mov byte [esp + 0xc], 0xa6
mov dword [esp + 0x18], 0x790762d4
pushal
mov byte [esp + 8], ah
lea esp, [esp + 0x38]
call fcn.79040990
push 0x3d7a996e
neg ax
lea ecx, [edi - 0x75a19c7b]
daa
add esp, 0x10
lea eax, [edx*4 - 0x404e541e]
rcr ax, cl
clc
mov byte [ebp - 0xc], 0xb8
ror cl, cl
bswap ax
shl al, 7
mov byte [ebp - 0xb], 0
dec cx
sub cx, 0xb881
bt ax, 0xf
mov byte [ebp - 0xa], 0
adc cx, 0xbba
mov byte [ebp - 9], 0
bts ax, ax
bsf ecx, edi
xor ah, ah
bswap ax
mov byte [ebp - 8], 0
sar ax, cl
mov byte [ebp - 7], 0xff
bsf ax, si
jmp fcn.79019f40
push 0xeb24ac21
mov dword [esp], eax
call fcn.79125507
call fcn.790d05d8
Function at 0x790927fa
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
pushal
jb 0x7917af6e
pushal
push dword [esp + 8]
mov byte [esp + 0x10], 0xc1
lea esp, [esp + 0x24]
call fcn.790d8dca
jmp 0x790ccc47
pushfd
lea esp, [esp + 4]
popal
movsx ax, dl
lea eax, [eax*4 + 0x7cf898fe]
lea eax, [edi*8 + 0xcba6ef3]
push ebp
lahf
jmp 0x7916f609
push ecx
pushfd
lea eax, [edi + 0x7f0710f6]
movzx ax, bl
cwde
lea eax, ss:[ebp - 4]
lea esp, [esp + 4]
jge 0x7907b136
push eax
pushfd
push dword [esp]
push dword ss:[ebp + 0x14]
pop dword [esp + 4]
call fcn.79082b52
mov dword [esp + 0xc], 0x72
mov byte [esp], 0xd9
mov dword [esp + 8], 0
mov byte [esp + 4], 0xe8
mov word [esp], dx
pushfd
mov dword [esp], 0x51b5342f
mov dword [esp + 8], 0
pushfd
mov dword [esp + 8], 0
pushal
mov dword [esp + 0x24], 0x18
call fcn.7916b88f
mov ebp, esp
jmp 0x7910041e
call fcn.79133f4c

Function at 0x79092b3c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jg 0x7909cc91
mov cx, 0xd73
test dx, 0xc46b
mov ecx, dword [ebp - 0x74]
test cx, 0x4af
cmp ecx, dword [ebp - 0xc0]
call fcn.79128352
call fcn.7914b2ac
cwde
mov eax, dword [ebp - 0x74]
pushal
mov dword [0x790763c4], eax
pushal
push 0x8317378b
mov dword [esp], 0x985ab994
lea esp, [esp + 0x44]
jmp 0x790b48cb
Function at 0x790939e0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jl 0x790a3070
pushfd
push dword [esp]
push 0x76e7b6ae
mov dword [esp + 8], edx
jmp 0x7902a99a
xor ah, 0xd2
push 0xf4a14abb
cwde
xor eax, ecx
mov dword [esp], ebp
bts bp, sp
rcr ebp, cl
mov ebp, esp
rcl ah, cl
cdq
shl eax, cl
cmc
sub esp, 0x50
aas
mov eax, dword [0x7906f390]
bswap cx
shr dl, 6
rol edx, 5
test dl, 0xc0
xor eax, ebp
pushfd
xadd cl, dh
clc
mov dword [ebp - 4], eax
bsf dx, bp
sal al, 5
sets al
mov dword [esp], ebx
xadd ah, dl
rcl al, 4
add dx, cx
cwde
push esi
sbb dl, 0xe7
bswap ax
daa
push edi
cmc
mov eax, 1
add ch, 0x42
stc
bsr cx, di
shl eax, 0
push 0x934e4572
mov ecx, dword [ebp + 8]
not dx
stc
lea esp, [esp + 4]
jp 0x79110f0e
bswap edx
movsx edx, word [ecx + eax]
movsx ax, cl
clc
jmp 0x7910ea3d
lea esp, [esp + 0x10]
jo 0x790c5d71
pushal
lea esp, [esp + 0x20]
call fcn.79087dda
mov esi, ecx
not di
test ch, 0x9a
mov dword [0x790765b4], eax
movsx di, cl
cmc
lea ebx, [edx*4 + 0x557faf9]
rol bl, cl
pop edi
clc
pop esi
shr bl, 3
pushal
mov ebx, dword [esp + 0x20]
sub ch, 0x90
cmc
mov ecx, dword [ebp - 4]
pushfd
clc
xor ecx, ebp
call fcn.7914c606
pushfd
mov word [esp], di
lea esp, [esp + 4]
call fcn.79087dda
dec bl
cmp cl, al
mov dword [0x790765b4], eax
neg cl
movsx di, al
xchg cx, si
not di
pop edi
jmp 0x79119f19
pushfd
pushal
mov esp, ebp
movzx ebp, cl
pop ebp
pushal
pushal
mov dword [esp + 4], ebx
push dword [esp + 0x40]
ret 0x44
not ch
bswap dx
mov dword [0x790765ac], eax
call fcn.79178273
lea esp, [esp + 8]
jne 0x790f8b8b
pushal
lea esp, [esp + 0x20]
jmp fcn.7910a9ed
pop ebx
bt cx, bx
sbb ch, 0x3e
and cl, 0xd6
mov ecx, dword [ebp - 4]
stc
xor ecx, ebp
push ecx
mov byte [esp], 0x85
pushfd
pushal
lea esp, [esp + 0x28]
call fcn.79041746
push esp
jmp 0x790eb486
not ah
mov eax, dword [ebp - 0x10]
jp 0x790ed31d
mov dx, 0x9e87
mov dword [0x790765ac], eax
lea ecx, [ebx + 0x10527705]
mov dl, ah
mov dx, 0xbabc
push 0x1572b42d
mov ecx, dword [ebp - 0xc]
mov byte [esp], ah
setae dh
pushfd
mov dword [0x790765b0], ecx
bswap dx
mov edx, dword [ebp - 8]
push ebp
pushfd
jmp 0x79121fd9
lea esp, [esp + 8]
call fcn.79040990
xadd ax, dx
add esp, 0xc
jmp 0x790fb1d3
mov dword [ebp - 0x10], edx
cmc
push 4
ror ax, cl
mov eax, 1
mov dh, bl
cmc
imul ecx, eax, 3
and edx, 0xba8a3993
mov dh, 0x8b
add ecx, dword [ebp + 8]
push 0xbceb182d
bswap dx
lea esp, [esp + 4]
jge 0x7910f119
push ecx
movzx dx, cl
movzx dx, bl
lea edx, [eax + 0xc3951c0]
pushfd
lea edx, [ebp - 0xc]
pushal
lea esp, [esp + 0x24]
jle 0x79086fd1
push ecx
mov dword [esp], edx
push ebx
push dword [esp]
call fcn.79150e8e
pushfd
sete dh
push 0x2f9129fb
sete dh
mov dword [esp + 4], ecx
pushfd
movzx dx, dl
lea edx, [ebp - 0xc]
mov word [esp + 4], dx
mov dword [esp + 4], edx
push dword [esp]
jmp 0x7910a9b1
stc
stc
movsx edx, word [ecx + eax]
mov ch, 0xc3
cmc
mov dword [ebp - 0x10], edx
cdq
lea eax, [edi*2 + 0xdb7a299]
ror dh, 7
cwde
push 4
btr ecx, 0x1a
mov eax, 1
call fcn.790d240c
pop esi
btc bx, 0xc
jmp 0x790fabd0
mov dword [0x790765b4], edx
jmp 0x7909da1f