joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790a9958
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp + 0x30]
jne 0x7911eee5
lahf
mov byte [ebp - 0x1c], 0x4e
cwde
mov byte [ebp - 0x1b], 0x74
lahf
seto ah
lea eax, [edx - 0xa6deeef]
not al
mov byte [ebp - 0x1a], 0x51
pushfd
movzx ax, cl
pushal
mov byte [ebp - 0x19], 0x75
pop eax
setl al
movzx eax, cl
mov byte [ebp - 0x18], 0x65
pushfd
not al
movsx eax, bl
mov byte [ebp - 0x17], 0x72
mov ah, ch
mov byte [ebp - 0x16], 0x79
movsx ax, al
not al
push esp
not al
mov byte [ebp - 0x15], 0x56
not al
bswap ax
mov byte [ebp - 0x14], 0x69
lea eax, [ecx + 0x2564f6da]
pushfd
not al
pushfd
mov byte [ebp - 0x13], 0x72
pushfd
lea eax, [esi + 0x6c0c9970]
bswap ax
mov byte [ebp - 0x12], 0x74
setne al
mov byte [ebp - 0x11], 0x75
pop eax
setp al
mov byte [ebp - 0x10], 0x61
push dword [esp + 4]
mov byte [ebp - 0xf], 0x6c
not ah
sets ah
jmp 0x7911cdcf

Function at 0x790ad037
Capabilities:
Encode data using xor

Disassembly:
movzx eax, cl
cmc
mov edx, dword [ebp - 0x2c]
movsx eax, bl
pushal
bts eax, eax
jmp 0x790235e5
mov dword [ebp - 4], 0xffffffff
mov byte [esp + 4], bh
lea ecx, [ebp - 0x4c4]
lea esp, [esp + 0xc]
jae 0x790f4834
pushfd
pushfd
lea esp, [esp + 8]
call fcn.79004bc0
bts dx, 0xb
mov eax, dword [0x790702ec]
clc
push esi
mov ecx, dword [eax + 0x7c]
rcl dh, 4
sub ecx, dword [ebp - 0x14]
lea edx, [ebp + 0x1815e537]
bswap dx
call fcn.790a660c
movss xmm0, dword [ebp - 0x18]
call fcn.7912f5f3
pushal
jmp 0x7911e910
and al, 0x44
jmp 0x79079386
lea esp, [esp + 0x24]
call fcn.79004bc0
xadd ch, al
xor al, al
setb ah
mov eax, dword [0x790702ec]
bsf dx, dx
dec dl
mov ecx, dword [eax + 0x7c]
lea eax, [esi - 0x254de788]
pushal
rol edx, 0x11
cmc
sub ecx, dword [ebp - 0x14]
lea edx, [ecx*2 + 0x77329b1b]
rdtsc
mov edx, dword [0x790702ec]
movzx ax, al
push dword [esp]
call fcn.790b3552
jae 0x7911517e
mov eax, 0xdf179711
fild qword [ebx]
stosb byte es:[edi], al
and eax, 0x53398c42
cld
mov ecx, 0xcd437f04
xor ch, bh
dec esi
inc ebx
add byte [ebp + 0x1a6a8673], cl
and bl, byte [ebp - 0x39834b9b]
lcall 0xf79c, 0x4c3385d3
mov esi, 0x8e78a08e
aaa
aas
loop 0x791151fd
mov dl, 0xb1
pop edi
test dword [edi], esp
dec edi
sar dword [ebx], 1
mov byte [0x6401a6c1], al
mov edi, 0x24ac3c99
dec esp
cld
aas
mov byte [ebx], bh
test edx, eax
cmp bh, cl
or byte [eax + 0x20ccb2ee], al
or ebp, dword [ebx + 0x66]
add dword [edx - 0x473071e0], edx
cmp dh, byte [eax - 0x538e7f02]
xchg ecx, eax
push ebx
push ds
sub byte [edx + 0x69871957], ch
mov esi, 0x6753a08e
sub byte [eax - 0x22b18d29], bh
sub al, dh
invalid
pushfd
jmp 0x791151ac
Function at 0x790b1791
Capabilities:
Create thread

Disassembly:
push edx
mov byte [esp], 0x77
pushal
mov dword [0x79071668], 0x79025150
pushfd
mov byte [esp], 8
mov dword [esp + 4], 0x8526af21
mov dword [esp + 0x24], 0x79024fc0
call fcn.790e0780
push dword [esp]
mov dword [esp + 0x1c], 0x79024300
mov byte [esp], 0x31
pushal
mov byte [esp + 4], 0xfb
lea esp, [esp + 0x3c]
call fcn.7903d41b
bt bx, dx
pushfd
add esp, 0x10
jbe 0x7908c95b
pushal
push dword [esp + 8]
mov dword [0x79071668], 0x79025150
push esi
mov byte [esp], ah
jmp 0x79115641
mov byte [esp + 8], bl
mov dword [esp + 0x24], 0x79024fc0
push ecx
call fcn.79111b5e
rol ch, 1
pushfd
mov dword [esp], eax
movsx ax, bl
rcr ah, 7
push edx
movzx dx, al
mov ecx, 1
bswap edx
rol dh, 1
imul edx, ecx, 7
pop eax
pushal
lea eax, [ebp + edx - 0x404]
call int.7912e5d6

Function at 0x790b2d70
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bl
lea esp, [esp + 8]
je 0x79121904
ror ah, cl
sbb ax, cx
rcr ax, 9
shl ax, cl
mov eax, dword [ebp - 0x24]
cmc
push 0x24aef1bc
mov byte [esp], ch
cmp eax, dword [0x790705b8]
mov byte [esp], 0xaa
lea esp, [esp + 4]
je 0x79121904
bt edx, ecx
cmc
cmc
cmp dword [ebp - 0x24], 0x7576
push 0xf20e6039
pushal
pushal
lea esp, [esp + 0x44]
jmp loc.79016fab

Function at 0x790b3524
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
bt di, 1
cmp di, 0x2ed1
test ecx, ecx
pushfd
pushal
lea esp, [esp + 0x28]
je 0x790e7e02
cwde
movzx ax, dl
rdtsc
rdtsc
mov eax, dword [ebp + 8]
pushfd
mov byte [esp], al
call fcn.7912e087

Function at 0x790b887a
Capabilities:
Encrypt data using tea

Disassembly:
and ecx, 3
bsr edx, ecx
btr dx, 6
dec dh
bts dx, cx
mov edx, dword ss:[ebp + 8]
pushfd
jmp 0x790c3d97
add eax, dword ds:[edx + ecx*4]
add cl, al
pop ecx
shrd cx, ax, 0xa
bt edx, edi
mov ecx, dword ss:[ebp - 0x10]
cmp dh, ch
push 0x7b8c447
jmp 0x790fcd40
clc
add ecx, eax
jmp 0x7912ff6e
jmp loc.79035847

Function at 0x790bbaf6
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x28]
jne 0x790c5f5f
test dh, ch
pushfd
cmp dword [ebp - 0x10], 0x111
call fcn.790a1568
dec edi
fmul st(6)
xor esi, dword [ebx - 0x7d]
xor ch, byte [esi + edx*2 + 0x11]
cmp edx, dword [eax - 0x692eb119]
push ebp
pop esi
fstp dword [0x1dd76947]
invalid

Function at 0x790c1644
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
jne 0x790af2f0
cmc
cmp dh, al
cmp dword [ebp - 0x28], 0xffffffff
push 0x7f037ba5
pushfd
lea esp, [esp + 8]
je 0x79121904
jno 0x79117798
cmp dword [ebp - 0x24], 0x900e0000
pushal
pushfd
pushfd
jmp 0x79109dd7
lea esp, [esp + 0x28]
jae 0x79121904
das
rol ax, cl
rcr ax, cl
sar ah, cl
mov eax, dword [ebp - 0x24]
clc
jg 0x79115547
cmp eax, dword [0x790705bc]
pushal
lea esp, [esp + 0x20]
je 0x79121904
daa
and ah, 0x72
rol al, cl
rcl ah, 7
mov eax, dword [ebp - 0x24]
call fcn.79097d94
test bl, bh
test ah, ch
stc
cmp dword [ebp - 0x24], 0x900e0000
pushfd
jmp 0x7907d253
Function at 0x790c1eec
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x79124bfe
lea ecx, [ebp - 0x4c4]
push 0xd6a11985
push 0xb0a4cad8
pushal
pushfd
lea esp, [esp + 0x34]
call fcn.79004bc0
rdtsc
movzx ax, al
stc
mov eax, dword [0x790702ec]
or ecx, ebx
shrd cx, bp, 9
mov ecx, dword [eax + 0x7c]
jbe 0x79086096
bsf eax, esp
xadd eax, edx
xchg dh, al
sub ecx, dword [ebp - 0x14]
jnp 0x790ecd93
movzx edx, al
mov edx, dword [0x790702ec]
bswap ax
cwde
bswap ax
mov dword [edx + 0x7c], ecx
cwde
cwde
push 0xa
sets ah
not al
lahf
setl ah
push 0
lahf
jmp 0x790bb86e

Function at 0x790cc0b1
Capabilities:
Packed with generic packer

Disassembly:
cmp bh, al
clc
stc
cmp eax, 1
mov byte [esp], 0xd0
call fcn.7907ff19
push esi
mov dword [esp + 4], 0
mov ah, byte [esp]
pop eax
bswap ax
lea eax, [ebp - 0x20]
pushfd
push eax
mov dword [esp + 4], eax
mov byte [esp], dl
jmp loc.79022739
bt eax, esi
cmp dword [ebp - 0x10], 0
pushal
pushal
lea esp, [esp + 0x44]
je 0x79137946
stc
cmp dword [0x79070418], 0x43
jae 0x7911ca01
push ebx
mov byte [esp], 0x44
pushal
lea esp, [esp + 0x24]
jne 0x790b1edb
pushal
add al, 0x63
stc
movzx eax, byte [ebp - 5]
jmp 0x790a00cf
lea esp, [esp + 0x40]
jmp loc.79034d62
pushal
pushal
jmp 0x79127f44

Function at 0x790cd381
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
call fcn.7903b710
bsr cx, dx
rdtsc
or cl, 0x9f
add esp, 0xc
rdtsc
mov eax, 0x66
and dh, 0x19
lea ecx, [eax*4 + 0x7b2fe9a]
cmp ah, bh
mov word [ebp - 0x294], ax
cdq
daa
rdtsc
dec ax
mov eax, 0x63
shl ch, 2
mov word [ebp - 0x292], ax
add ah, 0x65
shrd cx, ax, cl
jmp 0x790f9754
lea edx, [ebp*2 - 0x26d43e3a]
mov eax, 0x6d
xchg cl, dh
mov word [ebp - 0x290], ax
cdq
add eax, 0xf3fe15b5
mov eax, 0x6f
bts edx, eax
mov word [ebp - 0x28e], ax
aam 0xda
mov eax, 0x6f
rcr cx, cl
xadd cl, dh
lea ecx, [eax*2 + 0x2579e286]
bts dx, 0xd
mov word [ebp - 0x28c], ax
setnp cl
shr cl, cl
cmc
shl cx, 0xd
xor eax, eax
sal cl, 4
mov word [ebp - 0x28a], ax
aas
push 0
rol ah, cl
sar cl, 1
rcl cl, cl
neg cl
push 0
rcl cl, cl
mov eax, dword [ebp - 0x14]
bt bx, si
sub eax, 0xa
and dx, 0xe219
cmp ah, 0x51
push eax
inc dl
mov ecx, dword [0x790702ec]
sar dx, cl
btc dx, cx
add ecx, 0x4c
push esi
not dl
mov dword [esp], ecx
Function at 0x790cea4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwde
mov eax, dword [0x790702ec]
lea edx, [edi*8 - 0x3d14bafa]
movzx dx, bl
mov ecx, dword [eax]
bswap edx
lea edx, [ecx + 0x72d30b0b]
not dl
mov edx, dword [ecx]
pop ecx
lea esp, [esp + 4]
jge 0x790e9fc4
push edx
push ebp
pushfd
push dword [esp]
lea ecx, [ebp - 0xcc]
mov byte [esp + 8], 0x45
pushal
lea esp, [esp + 0x2c]
call fcn.79015670
pushfd
mov ecx, eax
pushfd
lea esp, [esp + 8]
call fcn.7914303b
adc ch, 0x26
mov dh, 0xbb
shld ecx, eax, cl
mov dword [ebp - 0x1c], eax
add dh, bl
ror al, cl
mov eax, dword [ebp + 8]
setg cl
bswap dx
dec ch
mov dword [ebp - 0x20], eax
xor ah, 0xe5
mov eax, dword [ebp - 0x20]
test al, dh
bsf cx, bx
bswap ecx
movzx ecx, word [eax]
clc
dec edx
mov dword [ebp - 0x24], ecx
adc dh, bl
lahf
aaa
rcl ah, 6
mov eax, dword [ebp + 8]
sbb ch, ah
xor ecx, ebp
add eax, 6
push 0x8b719ccd
mov dword [ebp + 8], eax
rcr edx, 9
bswap ax
pushal
mov eax, dword [ebp + 8]
movzx dx, dl
xchg dh, cl
mov dword [ebp - 0x28], eax
not eax
pop ecx
clc
mov eax, 1
rcr dh, 1
bts cx, 9
imul ecx, eax, 0
movzx ax, bl
xchg dx, ax
clc
lea esp, [esp + 0x20]
je 0x7908430c
mov edx, dword [ebp - 0x28]
mov al, ch
movzx eax, byte [edx + ecx]
bswap cx
mov dword [ebp - 0x2c], eax
bt sp, dx
mov eax, 1
rcr ch, 1
btc ecx, 0xb
imul ecx, eax, 0
not ah
add ecx, dword [ebp - 0x28]
test al, 0x57
bt bx, 0xc
neg ah
mov dword [ebp - 0x30], ecx
test cl, dl
sal ch, cl
xor al, dl
push 0xb4758bc8
mov eax, dword [ebp - 0x28]
rcl ecx, cl
shr ch, cl
adc cx, 0x16e
rol cl, 2
add eax, 1
pushfd
mov dword [ebp - 0x28], eax
mov ecx, esi
jmp 0x790ea9cb
pushfd
lea esp, [esp + 0x34]
call fcn.79038820
push eax
lea ecx, [ebp - 0x3c]
jmp 0x7910cb62
push 0x7f2d3c7c
movzx ecx, cl
movzx ecx, al
mov byte [eax], 0
jmp 0x7908fe0e
movzx cx, dl
lea ecx, [ebx*4 + 0x7f45b5fa]
jmp 0x790fe47e
mov dword [ebp - 0x34], 0
push 0xd1d486fa
bswap cx
mov dword [esp + 8], 8
push dword [esp]
not ecx
pushal
setns ch
lea ecx, [ebp - 0x3c]
pushfd
jmp 0x79092807
jmp 0x7903792a
Function at 0x790d0a4f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx ax, dl
mov byte [ebp - 0x2b], 0x42
lahf
cwde
not ax
pushfd
mov byte [ebp - 0x2a], 0x20
push dword [esp + 4]
mov byte [ebp - 0x29], 0x30
pop ecx
setg cl
pushfd
mov byte [ebp - 0x28], 0x34
mov ax, bx
mov byte [ebp - 0x27], 0x20
push dword [esp + 8]
mov byte [ebp - 0x26], 0x32
bswap cx
pushal
pushfd
xchg cl, ah
mov byte [ebp - 0x25], 0x34
seta ah
pushfd
pushfd
lea eax, [esi - 0x637a8cc]
mov byte [ebp - 0x24], 0x20
lahf
cwde
push esp
mov byte [ebp - 0x23], 0x43
movsx cx, cl
lea ecx, [esi + 0x9ba8292]
pop eax
lea esp, [esp + 0x40]
jnp 0x790e0d3f
mov byte [ebp - 0x22], 0x33
movsx cx, dl
mov al, 0xbf
movzx cx, cl
mov byte [ebp - 0x21], 0
movsx ax, al
lahf
lea eax, [ebp - 0x2c]
mov ch, al
seto cl
call fcn.790928b2
pushal
cwde
mov byte [ebp - 0x22], 0x33
pushal
xchg ecx, eax
lahf
mov byte [ebp - 0x21], 0
jmp 0x7914b595
lea ecx, [eax + 0x11f3a543]
pushal
lea ecx, [ebp - 0x44]
mov byte [esp], bh
call fcn.790b5da4
movsx cx, bl
movzx cx, dl
movsx cx, bl
lea eax, [ebp - 0x2c]
movzx cx, cl
pop ecx
setns ch
movsx cx, bl
mov dword [esp + 0x38], eax
lea esp, [esp + 0x38]
jns 0x790e5547
movzx cx, dl
pushal
mov byte [esp], 0x48
lea ecx, [ebp - 0x44]
push ebx
pushfd
mov byte [esp + 4], dl
push 0xb7bbf986
lea esp, [esp + 0x2c]
call fcn.79002f70
rdtsc
bswap dx
movsx dx, al
mov dword [ebp - 4], 0
call fcn.79086f08
shr byte cs:[edx - 0xc], cl
push edx
out 0x46, al
fsubr dword [eax - 0xe]
mov dl, 0x4c
ret 0xe456

Function at 0x790d3a22
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
mov word [ebp - 0x2f8], ax
and dh, 0x84
sub eax, eax
pushal
jmp 0x79110f25
pushfd
mov dword [esp + 0x34], eax
pushfd
jmp 0x79102f46
movsx dx, cl
not ah
mov ch, 0xc1
add esp, 0xc
xchg ch, al
aaa
rdtsc
mov eax, 0x66
test ah, cl
mov word [ebp - 0x2fc], ax
cdq
mov eax, 0x63
rcr dx, 7
mov word [ebp - 0x2fa], ax
adc ah, 0x8d
mov cl, 0x5e
movsx ax, dl
das
mov eax, 0x6d
not cx
jmp 0x790b2ed2
mov eax, 0x66
add dx, 0xab6
or dl, cl
adc ch, bl
mov word [ebp - 0x2fc], ax
aad 0xa4
bsr cx, sp
bswap ax
mov eax, 0x63
xchg dh, cl
xadd dx, cx
shl ch, 4
mov word [ebp - 0x2fa], ax
inc dl
das
stc
adc dl, 0x33
mov eax, 0x6d
movsx cx, bl
inc dx
adc dx, 0x55c1
mov word [ebp - 0x2f8], ax
bswap cx
sbb dx, si
inc dl
sub eax, eax
xchg cx, dx
xchg dx, cx
call fcn.7909e706
lea esp, [esp + 0x38]
call fcn.7903b710
movzx ax, bl
bsr ax, dx
js 0x790edf74
cdq
add esp, 0xc
rol dx, 0xe
bsf dx, cx
rol dl, cl
jmp 0x79102093

Function at 0x790e40cc
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x790e2f8e
cmc
bt dx, bx
bt bp, 2
cmp dword [ebp + 8], 0xd37d
pushfd
lea esp, [esp + 4]
je 0x790e2f8e
call fcn.79149d35
Function at 0x790e4f57
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
pushfd
mov byte [esp], 0x71
lea esp, [esp + 4]
call fcn.7903b710
btr eax, 0xc
movzx eax, cl
add esp, 0xc
lea eax, [ecx*2 - 0x5ca25224]
pushfd
push ebp
mov dword [esp + 4], 0xc
call fcn.79138824
mov dword [ebp - 4], 0xffffffff
push 0xa3cbd415
lea ecx, [ebp + 0x523c6606]
not ch
movzx cx, al
lea ecx, [ebp - 0x500]
push 0x8816d0ce
pushal
pushfd
lea esp, [esp + 0x34]
call fcn.79004bc0
sal ah, 1
movsx dx, dl
xchg ah, ch
mov eax, dword [0x790702ec]
bsr dx, cx
push esp
btr dx, bp
mov ecx, dword [eax + 4]
bts dx, si
aad 0x12
ror dh, cl
rdtsc
sub ecx, dword [ebp - 0x14]
rdtsc
cdq
lea esp, [esp + 4]
jp 0x7914db6f
movsx dx, cl
mov edx, dword [0x790702ec]
pushfd
mov dword [edx + 4], ecx
bswap ax
movsx ax, dl
setne ah
lea eax, [ebp - 0x7f7dca21]
mov dword [esp], 0xc
mov al, cl
setp al
push 0
bswap ax
lea eax, [edi - 0x7535be41]
lea eax, [ebp - 0x20]
jmp 0x7909cd11
lea eax, [ebx + 0x12b191e7]
pushal
rdtsc
call fcn.79030655

Function at 0x790e8852
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], dh
jmp 0x790f747e
lea esp, [esp + 0x28]
je 0x790e2f8e
test al, 0xd1
test ah, 5
cmp dword [ebp + 8], 0x2b78
pushfd
pushal
lea esp, [esp + 0x24]
jne fcn.790e2f9b
inc edi
neg si
mov byte [0x7907049d], 1
test dh, bh
shrd ebx, eax, cl
shld di, si, 3
pop edi
movzx bx, al
pushal
mov esi, dword [esp + 0x20]
shrd ecx, esi, 8
rcl cx, 3
bsr cx, sp
mov ebx, dword [esp + 0x24]
bsr ecx, ecx
shld cx, ax, cl
rcr cx, 4
sub ch, dh
mov ecx, dword [ebp - 4]
mov byte [esp + 0xc], bh
push 0x89f3c3a1
xor ecx, ebp
call fcn.7909cf39
jmp 0x79036274

Function at 0x790ef063
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], eax
movzx cx, cl
not cx
bswap cx
lea ecx, [ebp - 0x120]
pushfd
mov word [esp], dx
pushal
jmp 0x790bfbe1

Function at 0x790f1214
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr cx, cl
mov dword [ebp - 0x1c], eax
lahf
mov eax, 1
btc cx, bx
clc
jmp fcn.79037c46

Function at 0x790fa719
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
bswap cx
bswap ax
lea eax, [ebp - 0x10]
movsx cx, al
sets ch
sete ch
push eax
setp cl
jmp 0x791160e3
mov ecx, 0x790705d0
jmp 0x7911ace0
jg 0x791255a3
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.79019cf0
cmc
test bh, 0xa
mov dword [eax], 1
cmp dx, bp
cmp cl, ch
pushfd
push 0x4d63183e
cmp dword [ebp + 8], 0x985a
jmp loc.79031423

Function at 0x790fc163
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790cb998
push dword [0x7906ac98]
pop dword [esp + 0x1c]
pushfd
pushfd
pushal
pushfd
push dword [esp + 0x48]
ret 0x4c
lea esp, [esp + 0x28]
call fcn.7902ce43
cmp cl, dl
rcr eax, 0x17
sbb dh, 0xfa
add esp, 0xc
movzx ax, dl
popal
pushal
lea esp, [esp + 0x20]
leave
pushal
jmp 0x790be717

Function at 0x790fc1b0
Capabilities:
Encrypt data using tea

Disassembly:
pushfd
call fcn.790b1ff2
lea esp, [esp + 8]
jns 0x7902cb71
pushfd
lea esp, [esp + 4]
jle 0x7912ff8e
rol ecx, cl
btc cx, 0xc
mov ecx, dword ss:[ebp + 0x10]
btc edx, ecx
bts edx, edx
btr edx, eax
imul ecx, ecx, 0x9e3779b9
movzx dx, bl
push esi
mov dword ss:[ebp - 0xc], ecx
lea esp, [esp + 4]
Function at 0x79103634
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x20]
jne 0x79139efc
push 0x87ffe8a
lea esp, [esp + 4]
call fcn.790c5372
pushal
pushal
lea esp, [esp + 0x40]
jmp fcn.79085630
test eax, eax
call fcn.7911b7cd
push ecx
jmp 0x79125867
lea esp, [esp + 0xc]
jnp 0x79145cd0
jne 0x79151c85
call fcn.7911563b
test al, 0x52
stc
stc
jmp fcn.790fb168
pushal
push dword [esp + 4]
lea esp, [esp + 0x24]
jne 0x79151c85
pushfd
mov byte [esp], 0x17
mov byte [esp], ah
lea esp, [esp + 4]
call fcn.7912ce12
cmp dl, dl
movzx eax, al
pushfd
mov byte [esp], 0xe2
jmp 0x790e735f
stc
clc
cmp dword [0x790717f8], 0x28
push edx
mov byte [esp], al
lea esp, [esp + 4]
je 0x790b0729
push 0xb1a4b010
lea esp, [esp + 4]
jne 0x79139efc
jmp 0x790e955a

Function at 0x791059ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x827e1b2a
pushal
push esi
lea esp, [esp + 0x30]
je 0x79121904
setno al
mov eax, dword [ebp - 0x24]
bt di, 0xc
call fcn.7910b544
push dword [esp]
cmp eax, dword [0x790705bc]
jmp 0x790d7411

Function at 0x79106bba
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x10]
jne fcn.790e2f9b
dec esi
shrd cx, di, cl
mov byte [0x7907049d], 1
adc si, bx
sbb di, 0x4bac
push 0xb896b5dd
mov edi, dword [esp + 4]
xadd si, bx
pop ebx
sar esi, cl
xor bx, 0x8b77
mov esi, dword [esp + 4]
call fcn.79146f41

Function at 0x791079f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
movzx cx, bl
not eax
pushal
movzx eax, byte [ebp - 0x11]
xchg cx, dx
jmp 0x790d064f
call fcn.790ebf31
not ecx
lea edx, [ecx + 0x10cd6700]
mov dword [esp + 0x1c], eax
lea ecx, [ebx - 0x7cf2114a]
mov dword [esp + 0x18], 0
rdtsc
jmp 0x790b4544
mov dword [ebp - 0xa8], eax
mov dword [esp], 0x52d54ff
lea esp, [esp + 0xc]
js 0x79086e05
lea eax, [esp + 0x32cae762]
rdtsc
movzx eax, byte [ebp - 0x11]
not cx
push eax
jmp loc.790342c8

Function at 0x79108405
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0xb8]
and dh, al
xadd edx, eax
das
test ah, 0x65
sub ecx, dword [ebp - 0x14]
bswap ax
pushfd
not dh
cdq
mov edx, dword [0x790702ec]
lahf
lea eax, [esp + 0x4a65fe8a]
movzx ax, bl
mov dword [edx + 0xb8], ecx
lahf
push dword [esp + 4]
mov dword [esp + 8], 0xa
movsx eax, bl
pop eax
mov dword [esp], 0
push esp
bswap eax
cwde
push dword [esp]
lea eax, [ebp - 0x1f0]
push ecx
mov dword [esp + 8], eax
push 0xc93922ef
lea esp, [esp + 0xc]
jmp 0x790a5307
Function at 0x7910d661
Capabilities:
Execute anti-debugging instructions

Disassembly:
ja 0x7909bbf9
jb 0x7912345b
pushal
lea esp, [esp + 0x20]
call fcn.7903b710
jmp 0x7909ef9a
pushal
lea esp, [esp + 0x20]
call fcn.7903b710
rcl al, 1
add esp, 0xc
not dx
xchg dl, al
cmp ah, bh
rdtsc
mov eax, dword [0x790702ec]
push edi
adc ecx, esi
push 0xdd29acae
mov ecx, dword [eax + 0x40]
aam 0x3b
jmp 0x7912cddf
bts cx, si
bswap ax
cmp bh, dl
add esp, 0xc
mov ax, 0xeec1
setp dl
lahf
cdq
mov eax, dword [0x790702ec]
test ch, 0x12
bt si, dx
mov ecx, dword [eax + 0x40]
aaa
mov dword [ebp - 0x24c], ecx
pushal
mov eax, dword [0x790702ec]
shr cl, cl
stc
mov ecx, dword [eax + 0x40]
btc edx, 6
pop edx
neg dh
push 0xe7642ff1
sub ecx, dword [ebp - 0x14]
jmp 0x790e1ddc
mov edx, dword [0x790702ec]
cmc
jmp 0x7911be0b
lea ecx, [ebp - 0x494]
pushal
jmp 0x7914722c
push dword [esp]
pushal
mov dword [edx + 0x40], ecx
clc
test dh, 0x62
cmp dword [ebp - 0x24c], 0xffffffff
jmp 0x7914bc07
pushfd
lea esp, [esp + 0x28]
call fcn.79004bc0
lahf
cwde
push 8
setg al
push 0
cwde
lahf
movsx ax, dl
lea eax, [ebp - 0x220]
pushfd
mov word [esp], si
mov dword [esp], eax
jmp 0x7909b959

Function at 0x7910e87e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x13eb5919
mov word [esp], bp
lea esp, [esp + 0xc]
je 0x79121904
and eax, 0x6b5ccd9e
test sp, sp
mov eax, dword [ebp - 0x24]
bt edi, ebp
cmp eax, dword [0x790705b8]
pushal
jmp 0x79114378
mov dword [esp + 0x20], 0
mov dword [esp + 4], ecx
jmp 0x79113aaa
test al, 0x1d
mov byte [0x7906aca3], 0
cmp cl, al
test dh, 0x49
test al, 0xb7
clc
mov byte [0x7906acab], 0
pushal
cmp dword [0x790717f8], 0x38
push dword [esp + 0x10]
call fcn.7909a480
lahf
xchg cl, dh
mov eax, dword [0x79071804]
push eax
push 0xe3a72088
xchg cl, dh
mov byte [esp], ch
mov dword [esp + 4], eax
call fcn.7911c0fc
jmp 0x790a3681
mov esp, ebp
lea ebp, [ecx - 0x7f636914]
movzx bp, bl
movzx ebp, dl
call fcn.790ceb3f
push esp
call fcn.79111b55
cmc
jmp 0x790cb133
jmp 0x790d5ac0
lea esp, [esp + 0x3c]
movss dword [esp], xmm0
push esp
push 0x77190973
pushal
mov byte [esp], ah
lea esp, [esp + 0x28]
call fcn.79039970
movzx ebx, cl
add si, ax
sub bh, bl
add esp, 4
bswap bx
movzx di, al
pushfd
mov edi, dword [esp + 4]
pushfd
mov esi, dword [esp + 0xc]
mov bh, byte [esp + 8]
seto bh
lea ebx, [esi - 0x6aa06791]
mov ebx, dword [esp + 0x10]
jmp 0x79100ad5
cmp eax, dword [0x7906904c]
jmp 0x790a02fa
mov dword [esp + 0x1c], 0x28
pushal
pushfd
mov dword [esp + 0x3c], 1
push dword [esp + 4]
mov byte [esp + 8], dh
pushfd
mov byte [esp], ch
mov dword [esp + 0x40], 0
push dword [esp + 4]
mov word [esp + 0x10], 0x804c
mov dword [esp + 0x40], 0
push ebx
mov dword [esp + 0x40], 3
pushfd
mov word [esp], 0x64d4
mov dword [esp + 0x40], 0
jmp 0x79136df8
lea esp, [esp + 0x20]
je 0x79121904
cmc
test ax, 0x673f
clc
test dh, 0x2f
cmp dword [ebp - 0x24], 0x7576
push esp
lea esp, [esp + 4]
je 0x79121904
stc
cmp dword [ebp - 0x24], 0xbf6d
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x790f0130
bswap eax
lea eax, [eax*4 - 0x5d29d5f7]
mov dword [ebp - 0x58], 0
bswap ax
mov eax, dword [ebp - 0xc]
push 0xc18b52b6
call fcn.7913758a
pushal
jmp 0x7910a359
pushfd
mov dword [ebp - 0x58], 0
call fcn.7912b20a
Function at 0x791150e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl ah, 3
add ecx, dword [ebp - 0x2c]
pushfd
mov dword [ebp - 0x4c], ecx
push dword [esp + 4]
movsx ax, cl
mov eax, 1
cmc
imul ecx, eax, 0xe
cmp bp, di
xadd eax, edx
add ecx, dword [ebp - 0x2c]
das
and ah, 0xac
mov dword [ebp - 0x50], ecx
dec eax
mov eax, dword [ebp - 0x4c]
ror dh, cl
stc
ror cx, 0xd
movzx ecx, word [eax]
sar ax, 1
mov dword [ebp - 0x54], ecx
clc
rdtsc
mov eax, dword [ebp - 0x50]
shl dx, 2
shld edx, esp, cl
movzx ecx, word [eax]
btc edx, esi
bsr dx, bx
sal dl, cl
rdtsc
mov dword [ebp - 0x58], ecx
das
movzx dx, dl
mov eax, 1
push 0xf6cc78ed
btc ecx, 0x16
shl eax, 4
rcr cl, cl
mov ecx, dword [ebp - 0x2c]
ror dh, cl
movzx edx, word [ecx + eax]
lahf
bswap ecx
lea eax, [esi + 0x3f14c63d]
mov dword [ebp - 0x5c], edx
btr cx, bp
mov eax, 1
bts ecx, 0x11
imul ecx, eax, 0x12
pushfd
lea esp, [esp + 0x44]

Function at 0x7911b922
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [ebp + 8], 0xd37d
mov byte [esp], 0x62
push esi
mov word [esp + 8], 0x767e
lea esp, [esp + 0xc]
je 0x790e2f8e
cmc
cmp dword [ebp + 8], 0x2b78
call fcn.790bc8c8
pushfd
lea esp, [esp + 0xc]
call fcn.79019cf0
pushal
mov word [esp], sp
mov dword [eax], 1
test bx, cx
mov byte [esp + 8], dl
push dword [esp + 8]
cmp dword [ebp + 8], 0x985a
pushal
push 0x9509ed56
lea esp, [esp + 0x48]
je 0x790e2f8e
pushfd
clc
pushfd
jmp 0x7908c2e0

Function at 0x7911d599
Capabilities:
Packed with generic packer
Write file on windows

Disassembly:
lea esp, [esp + 0x44]
call fcn.7903ee00
aam 0x61
shl ax, cl
push 0x8ff21bea
add esp, 0x14
bswap ax
pushfd
not ax
pop eax
mov eax, dword [ebp - 0x10c]
push ebx
mov byte [esp], 0x93
mov word [esp], 0x55bc
mov dword [esp], eax
jmp 0x79111929
pushal
jmp 0x790e557c

Function at 0x7911f63f
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [ecx + 8]
xchg di, bx
call fcn.791353b3

Function at 0x7911f64a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x3c]
call fcn.7903b2a6
pushal
pushal
mov esp, ebp
call fcn.790bcf22
jmp 0x790cc7a3
pushfd
xor ecx, ebp
mov byte [esp + 8], cl
pushal
jmp 0x790d4b3e