joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79105ec8
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ecx
sub cl, 0x70
shld cx, ax, cl
bsf dx, ax
mov ecx, dword [0x7907636c]
shrd edx, edx, 9
and dl, 7
xor dl, 0x7f
shr dl, 5
mov dword [ecx + 0x5c], eax
sal ax, cl
dec cl
rol ax, 5
daa
mov eax, dword [ebp - 0x328]
cmc
xadd cl, dh
bswap edx
bswap cx
add eax, 0xe
shl dx, 0xf
jmp 0x7914b2f9
cmp dword [ebp - 0x2f4], 0
jmp 0x79153741
mov dword [ebp - 0x328], eax
dec ah
daa
cwde
mov eax, dword [ebp - 0x328]
test eax, ebx
cld
invalid
or dl, dh
mov ecx, dword [eax]
ror ax, cl
call fcn.7909634c
pushal
call fcn.7911b7a8
cmp dword [eax + 0x67], ebp
sbb bh, byte [edi + 4]
sub dword [esi], 0xb9e5e6a7
push gs
jbe 0x791307e5
pop ebx
pop esp
push 0x70
xor dword [esi - 0x24], ecx
jl 0x7913078f
jg 0x79130767
popal
popfd
lds edi, [ebp - 0x2155d630]
stosd dword es:[edi], eax
pop ebx
cld
adc ebp, dword [ebx + 2]
inc ebp
dec edi
jmp 0x7913076c
inc eax
dec edi
dec edx
int3
test ah, dh
jmp 0x7913075c
lea esp, [esp + 4]
je 0x79175165
rdtsc
mov eax, dword [ebp - 0x2f4]
sal ch, cl
and dh, ah
ror ecx, cl
sub eax, dword [ebp - 0x14]
stc
rcr cl, 1
btr cx, sp
mov dword [ebp - 0x2f4], eax
or edx, ebp
cdq
btr ax, 2
clc
mov eax, dword [ebp - 0x2f4]
bswap dx
add eax, 6
sal dl, 7
xadd ch, dh
adc cx, 0x12a7
sal cl, 3
mov dword [ebp - 0x328], eax
add al, ah
or dh, 0x87
mov eax, dword [ebp - 0x328]
btr edx, 2
mov ecx, dword [eax]
bt dx, si
sal dh, 4
mov edx, dword [ebp - 0x328]
stc
sbb ax, sp
lea eax, [ecx + edx + 4]
sar dl, 1
bt di, 3
bsr cx, cx
mov ecx, dword [0x7907636c]
shrd dx, sp, cl
shrd edx, edx, cl
sal dl, cl
mov dword [ecx + 0x44], eax
not cx
aaa
rcl cl, cl
btr ax, sp
mov eax, dword [ebp - 0x2f4]
shld cx, cx, 7
xchg cl, dl
mov ch, dl
add eax, 0x300
shrd cx, bx, 0xc
rol ch, 5
shr ch, 1
mov dword [ebp - 0x328], eax
add ecx, edx
ror ax, 1
mov eax, dword [ebp - 0x328]
push ebx
mov ecx, dword [eax]
pushal
bswap dx
das
mov edx, dword [ebp - 0x328]
sbb al, 0xfc
sub ah, bh
inc ax
lea eax, [ecx + edx + 4]
xchg edx, ecx
mov ecx, dword [0x7907636c]
inc dh
bswap dx
sal dl, 1
mov dword [ecx + 0x54], eax
push dword [esp]
aad 0x59
rdtsc
movsx dx, bl
mov eax, dword [ebp - 0x328]
shr dx, 4
sbb edx, ebx
sal edx, cl
add eax, 0x92
rol dl, 7
ror cx, cl
btc edx, ebx
mov dword [ebp - 0x328], eax
lea eax, [edx - 0x4fea47ac]
shl ah, 1
aad 0x26
mov eax, dword [ebp - 0x328]
sbb cl, 0x2b
shld cx, cx, 1
mov ecx, dword [eax]
bt bx, cx
mov edx, dword [ebp - 0x328]
cmc
lahf
lea eax, [ecx + edx + 4]
rcl dh, cl
shl edx, 0xe
mov ecx, dword [0x7907636c]
xor edx, esi
or edx, esi
push dword [esp + 0xc]
mov dword [ecx + 0x58], eax
and al, 0xb7
btr dx, 8
mov eax, dword [ebp - 0x328]
shrd dx, bx, 1
rcr cl, 3
pop edx
add eax, 0xe
pop edx
lea ecx, [esi - 0x1948597a]
mov dword [ebp - 0x328], eax
mov byte [esp + 8], ch
lea eax, [edx - 0x4f37e89e]
movsx dx, dl
mov eax, dword [ebp - 0x328]
xchg ch, dh
movsx dx, dl
pop ecx
mov ecx, dword [eax]
lea eax, [edx - 0xb7fae0c]
mov edx, dword [ebp - 0x328]
cwde
lea eax, [ecx + edx + 4]
pushal
push dword [esp]
push esi
lea esp, [esp + 0x48]
jmp 0x790b3537
mov ch, 0x3e
call fcn.790e4c36
Function at 0x79108dc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl cx, 7
imul ecx, eax, 0x21
movsx ax, dl
setnp al
rcl dh, cl
mov edx, dword [ebp - 4]
mov byte [esp], 0x8b
movzx eax, word [edx + ecx]
push eax
pushfd
mov dword [ebp - 0x40], eax
cwde
mov dx, word [esp + 4]
bt sp, cx
mov eax, 1
pushfd
btc cx, 6
imul ecx, eax, 0x25
cdq
not ah
rdtsc
lea edx, [ebp + 0x7bdce37c]
mov edx, dword [ebp - 4]
cwde
jmp 0x790f45fa

Function at 0x7910aa3a
Capabilities:
Packed with generic packer

Disassembly:
mov byte [ebp - 0xa9], 0
call fcn.790ec2a1
ja 0x790876e7
pop esp
or al, byte [esp + eax + 0x6403e852]
inc edi
jnp 0x790876ea
invalid
popal
cmp dl, byte [ebx + 0x65d65937]
pop ebx
aaa
pop ecx
salc
pop ebx
push ss
mov dword [ebp + 0x33ddebc2], ebx
xor ebp, dword [eax + 0x68]
das
dec edx
cvtps2pd xmm0, qword [edx]
invalid
mov dl, cl
mov dword [ebp - 0x504], eax
mov dh, 0x7f
movzx dx, cl
bswap dx
mov edx, dword [ebp - 0x504]
pushfd
lea esp, [esp + 4]
jmp 0x790de192
not ah
jmp 0x791105a1
bswap ax
pushfd
mov dword [ebp - 4], 8
lahf
mov eax, dword [ebp - 0x508]
pushal
mov dword [esp + 0x20], eax
pushfd
call fcn.790dbf99
mov byte [esp + 8], cl
mov byte [ebp - 0xaa], 0
jmp 0x7908765c
lea esp, [esp + 0x30]
call fcn.790042b0
jbe 0x79092e3c
pushal
mov dl, 0xd6
mov dword [ebp - 0x504], eax
pushfd
mov edx, dword [ebp - 0x504]
pushfd
push 0x3631accd
lea esp, [esp + 0x2c]
jmp 0x790de192
mov dword [esp + 0x30], ecx
mov cx, word [esp]
movzx cx, dl
bswap ecx
lea ecx, [ebp - 0x4a0]
jmp 0x791039b0
mov dword [ebp - 0x508], edx
jmp 0x791025d7

Function at 0x7910b87d
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.791748b0
lea esp, [esp + 0x28]
je 0x790e7813
jge 0x79090e77

Function at 0x7910c419
Capabilities:
Packed with generic packer

Disassembly:
push ebp
rol bp, cl
pushal
lea ebp, [esp + 0x2c]
cmc
pushfd
pushfd
sub esp, 0x10
bt ebx, 0x1f
bt ax, 6
test esp, ecx
push ebx
stc
cmc
jmp 0x790d65a1
Function at 0x7910e95c
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], eax
sete ch
not cx
push ecx
mov byte [esp], ch
lea ecx, [ebp - 0x3c]
jmp 0x7909c711
test esp, eax
cmp dword [ebp - 0x8c], 0
call fcn.7916e438
jmp loc.7900e833
jmp 0x790b4eb7
pushal
pushfd
lea esp, [esp + 0x44]
jg 0x7913066d
test bp, bx
clc
cmp dword [ebp - 0x90], 0
push 0xea721804
jmp 0x790cfcd8
xor al, dh
sal al, 6
neg ah
movzx eax, byte [ebp + 8]
call fcn.7912397d
pushal
pushal
lea esp, [esp + 0x40]
call fcn.7914ec95
test ah, 0x41
jmp 0x79173810
push dword [esp]
lea esp, [esp + 8]
call fcn.7911fe34
call fcn.790eddf7
bt edi, 0x18
mov dword [ebp - 0x90], eax
bt sp, 5
push dword [esp]
mov dword [ebp - 0x8c], edx
pushfd
pushfd
stc
cmp dword [ebp - 0x8c], 0
pushal
push 0x1aef59b8
pushfd
lea esp, [esp + 0x38]
jl 0x79008161
pushal
jmp 0x7909e0f3
lea esp, [esp + 4]
jbe 0x79008161
movsx ax, bl
rol al, cl
test dh, 0xf9
movzx eax, byte [ebp + 8]
cmc
stc
test eax, eax
jmp 0x79129b21
call fcn.790b4994
movsx cx, al
bswap cx
sets ch
lea ecx, [ebp - 0x3c]
pushfd
lea esp, [esp + 4]
call fcn.7914ec95
stc
push ebp
jmp 0x790c6564
jmp 0x7914a578
jmp loc.79032b57
aas
bsf ax, cx
jno 0x7914d814
inc eax
movzx eax, byte [ebp + 8]
cmp dx, sp
cmc
stc
test eax, eax
jmp 0x7910f3c8
pushal
lea esp, [esp + 0x20]
jne 0x791546b6
lea eax, [ecx + 0x212f0bb8]
not al
not ax
mov eax, dword [ebp - 0x38]
push 0xf7519063
mov byte [esp], 0x5b
mov byte [esp], 0x7d
push 0xfb88ac22
lea esp, [esp + 8]
jmp fcn.791390c9
jmp 0x7909e321
setne cl
mov eax, ebx
lea ecx, [edi - 0x2f9c3acd]
movsx ecx, bl
push 0
pushfd
not ch
movzx ecx, dl
mov byte [esp], dh
lea eax, [ebp - 0x20]
movsx ecx, cl
movzx ecx, al
jmp 0x7907b209
mov dword [ebp - 0x90], eax
cmc
mov dword [ebp - 0x8c], edx
cmp bp, dx
jmp 0x7908a0d8

Function at 0x79112339
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
movss dword [ebp + eax - 0x58], xmm0
mov ch, cl
setl cl
pushal
bswap ax
lea eax, [ebp - 0x58]
bswap cx
mov cx, 0xb638
call fcn.79152f36

Function at 0x791145ff
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 8], 0
jmp 0x790c7ef6

Function at 0x79115c9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp loc.7900d218
call fcn.790a71ae
mov byte [esp], 0x46
mov dword [esp], 0x311b5f01
lea esp, [esp + 0x88]
jb 0x790f0fc8
mov byte [ebp - 0x83], 0
push 0xc5c2674b
pushfd
jmp 0x790d7e53

Function at 0x79116065
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x34], 0x211
push dword [esp + 4]
mov byte [esp], al
lea esp, [esp + 0xc]
jne 0x790d883e
Function at 0x79118c8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp dword [eax + 0x18], 0
pushal
mov dword [esp], 0x6dcecb77
mov word [esp + 0x10], 0x24b1
lea esp, [esp + 0x40]
je 0x790dcf74
movzx cx, bl
push 4
lea ecx, [ebp - 0x6e45e748]
pushfd
lea ecx, [ebp - 0x84]
pushal
push dword [esp + 4]
lea esp, [esp + 0x28]
call fcn.7902ec70
btc dx, 4
rdtsc
sar ah, 1
shld ax, cx, cl
mov eax, dword [ebp - 0x74]
cmc
call fcn.790fd3c6
clc
mov dword [ebp - 0x14], ecx
jmp 0x79022784
pushfd
lea esp, [esp + 8]
jo 0x791119d9
cmp dword [eax + 0x18], 0
pushal
call fcn.790fdd9a

Function at 0x7911be32
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [ebp - 4], eax
mov word [esp + 4], 0x7c65
mov byte [esp], ch
mov word [esp], bp
lea esp, [esp + 0x54]
jmp 0x790ec592

Function at 0x7911d2a7
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x20], 0x10
pushal
pushfd
mov byte [esp + 8], cl
jmp 0x790d6647
pushfd
mov byte [esp], 0xd4
mov byte [ebp - 0x59], 1
pushfd
pushfd
pushfd
lea esp, [esp + 0x10]
jmp 0x79122ed4
cmp dx, 0x9c67
xor edx, eax
push 0x3a4a6cdf
lea esp, [esp + 4]
jne 0x791531c5
jle 0x79121ca5
push 0xf5693459
mov word [esp], 0x64da
pushal
mov dword [esp + 0x20], 0x10
mov byte [esp], cl
pushal
pushfd
jmp 0x790b130c
mov dword [esp + 0x40], 0x79158ca0
jmp 0x790d6844
push dword [sym.imp.USER32.dll_GetKeyState]
pop dword [esp + 0x3c]
push eax
mov byte [esp + 4], 0x36
push eax
push dword [esp + 0x44]
ret 0x48
lea esp, [esp + 0x10]
jge 0x79122ec7
push 0xcfd124e
mov word [esp], 0x7fe6
lea esp, [esp + 4]
jp 0x790a9895
pushfd
mov byte [ebp - 0x59], 1
push ebx
lea esp, [esp + 8]
jmp 0x79122ed4
jmp 0x790e1504
pushfd
pushal
jmp 0x790835aa
pushfd
sub ch, cl
sal dl, cl
aaa
mov byte [ebp - 0x59], 0
add esp, 4
rcr ah, 1
dec dl
aad 0x15
mov ecx, dword [ebp - 0x18]
test al, dh
daa
movzx edx, byte [ecx]
shrd ax, cx, cl
movzx eax, byte [ebp - 0x59]
cmc
bt sp, 6
jmp 0x790d2910

Function at 0x7911fe07
Capabilities:
Execute anti-debugging instructions

Disassembly:
setno dh
ror dl, cl
rdtsc
mov edx, dword [ebp - 4]
pushal
mov eax, dword [edx + ecx]
movsx dx, al
not dx
not cl
mov dword [ebp - 0x20], eax
jmp 0x791754aa
mov eax, 1
rcr cl, cl
xchg cx, dx
imul ecx, eax, 0xb
lea esp, [esp + 0x40]
jo 0x79102953
lahf
rol al, 6
push ebp
mov edx, dword [ebp - 4]
pushfd
rol ax, cl
mov eax, dword [edx + ecx]
ror ch, cl
jmp 0x7914fee4
not cl
mov dword [ebp - 0x20], eax
setb dh
setp al
mov eax, 1
movzx cx, bl
stc
rol dl, 6
imul ecx, eax, 0xf
jmp loc.7902376a
lea eax, [edi + 0x3dbe8c37]
mov eax, 1
not dx
seta dl
push dword [esp + 8]
imul ecx, eax, 0xf
call fcn.7910113d

Function at 0x79121cb1
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
call fcn.79041746
jmp 0x791453c7
mov esp, ebp
call fcn.7901e932

Function at 0x791222fa
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jmp 0x7912f9a0
lea esp, [esp + 8]
call fcn.79014650
call fcn.790372a4
Function at 0x7912348d
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
je 0x79115fe5
setge ch
pushfd
pushfd
lea ecx, [ebp - 0x7c]
push 0x20356452
mov byte [esp], 0xd6
pushal
call fcn.790c25d0
inc esi
fadd st(5)
xbegin 0x8a649c5a
movnti dword [ebp - 0x769f775], edi
mov ebp, 0xf896088b
mov bh, 0xc1
push ds
imul ebp, dword [esi], 0x9cf29f1a
std
lodsb al, byte [esi]
and dword [edi + ebp*8 + 0x44421ab7], ebx
pop esi
push edi
add byte [edi], ch
and al, 0xb8
mov dword [0xae88061e], eax
inc edx
fnstenv [ebp - 0x4f45b91e]
cli
and byte [eax - 0x2c7a52e9], al
in al, dx
xchg ebp, eax
clc
movsb byte es:[edi], byte [esi]
test eax, 0x588245a5
xchg ebx, eax
mov dh, 0x1b
aaa
popal
test eax, 0xb16e1199
loopne 0x790cb237
adc al, 0xaa
mov dword [0xfa529cf8], eax
cmp bl, byte [eax - 0x10]
xchg esi, eax
lea edi, [edx + 0xe]
pop ebp
iretd
jae 0x790cb1bd
mov cl, 0xd6
push 0xa8a01668
pushal
jmp 0x790cb190

Function at 0x79124268
Capabilities:
Execute anti-debugging instructions

Disassembly:
imul ecx, eax, 5
rcr edx, cl
rdtsc
pushfd
mov edx, dword [ebp - 0x40c]
cwde
rcr ah, 6
movzx eax, word [edx + ecx]
bswap cx
bswap cx
rcl ch, cl
xchg dh, cl
mov dword [ebp - 0x420], eax
rol dx, 0xe
xchg edx, eax
movsx dx, dl
jmp 0x79178d27
rol dl, 1
mov ecx, dword [ebp - 0x40c]
rcr dx, cl
movzx edx, word [ecx + eax]
pushfd
mov dword [ebp - 0x418], edx
rcl ah, 1
push dword [esp + 8]
ror dl, 2
mov eax, 1
cmc
clc
bts dx, cx
imul ecx, eax, 3
rol dh, cl
mov edx, dword [ebp - 0x40c]
ror al, 7
movsx ax, dl
movsx eax, al
rcl al, cl
movzx eax, word [edx + ecx]
stc
not dl
movzx cx, bl
btr dx, 0xa
mov dword [ebp - 0x41c], eax
cwde
setg ch
mov eax, 1
jmp 0x790d512c
bt eax, 0x1f
cmc
bt bp, cx
test eax, eax
pushal
mov dword [esp], edi
call fcn.7900dd8e
mov eax, 1
rcr ch, 3
imul ecx, eax, 7
xchg dh, ah
xchg al, dl
stc
mov edx, dword [ebp - 0x40c]
rcr al, cl
lea eax, [ebx - 0x74c1535e]
lahf
rol ax, cl
movzx eax, word [edx + ecx]
stc
ror ch, 6
pushfd
rcr ch, 1
mov dword [ebp - 0x424], eax
xchg cx, ax
ror cl, cl
cdq
clc
mov eax, 1
rcl ch, cl
pop edx
mov word [esp + 4], 0x937e
imul ecx, eax, 9
bts edx, ebx
rol ax, 1
mov edx, dword [ebp - 0x40c]
pop eax
movsx ax, al
mov ax, dx
bswap ax
movzx eax, word [edx + ecx]
rcr edx, 0x13
mov dword [ebp - 0x428], eax
bt si, 0xa
rcl ch, cl
rdtsc
mov eax, 1
cmc
btc cx, bp
movsx dx, bl
imul ecx, eax, 0xb
movzx dx, al
stc
cdq
cdq
mov edx, dword [ebp - 0x40c]
pop eax
movzx eax, word [edx + ecx]
push eax
lea ecx, [edi - 0x57d66e2b]
mov dword [ebp - 0x42c], eax
xchg cl, al
call fcn.79161067
dec al
shrd eax, edi, cl
movzx eax, byte [0x79076364]
jmp 0x7915d632

Function at 0x791247f2
Capabilities:
Packed with generic packer

Disassembly:
inc di
pop edi
add si, 0x92a2
sar bl, cl
setae bl
pushal
mov esi, dword [esp + 0x20]
rol bl, 4
bts bx, 4
mov ebx, dword [esp + 0x24]
sub cl, 0xa3
inc cx
bts cx, 7
sbb cl, 0x8b
mov ecx, dword [ebp - 4]
push dword [esp + 4]
cmp ebp, esi
pushfd
push edi
xor ecx, ebp
call fcn.79024b00
xchg ecx, eax
lea esp, [esp + 4]
popal
bswap ax
pushfd
mov eax, dword [ebp - 0x10]
mov byte [esp], dh
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x7911bba0
Function at 0x79126274
Capabilities:
Packed with generic packer

Disassembly:
mov edi, dword [esp + 0x24]
call fcn.790ef13e
pushfd
cmc
test eax, eax
push esp
mov byte [esp], 0x81
mov byte [esp], dl
call fcn.7909d3bd
rdtsc
pushal
lea eax, [ebp + 0xe1f330f]
movzx bx, dl
lea esp, [esp + 0x20]
popal
pushfd
pushal
xchg edi, esi
jmp 0x79095647
mov word [esp + 8], dx
push dword [esp + 0x14]
lea esp, [esp + 0x2c]
call fcn.7903e850
jmp 0x790a3e4c

Function at 0x7912688d
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x20]
movss xmm0, dword [ebp - 0x2c]
call fcn.790bc2de
lea esp, [esp + 8]
movss xmm0, dword [ebp - 0x2c]
call fcn.7908bbae
lea esp, [esp + 8]
je 0x790b68a0
pushfd
pushfd
jmp 0x790fc328
push dword [esp]
lea esp, [esp + 0x28]
call fcn.79040990
sal di, cl
rcl si, 0xc
shl si, cl
add esp, 0xc
pushal
mov edi, dword [esp + 0x20]
seto bh
mov esi, dword [esp + 0x24]
mov byte [esp + 8], dh
pop ebx
mov bx, di
mov ebx, dword [esp + 0x24]
pushfd
call fcn.790e248f
jmp 0x7910f5e5

Function at 0x79127108
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7915e3c2
push edx
jmp 0x790b32c2
lea esp, [esp + 0x24]
je 0x7911fccb
rcr ah, cl
mov eax, 1
cmc
imul ecx, eax, 7
movsx edx, cl
jmp 0x7909933c
lea edx, [ebp + ecx - 0x404]
jmp 0x7909d923

Function at 0x79128885
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jns 0x79170c22
call fcn.79029190
lea ecx, [eax*4 - 0xaf37f6d]
push ecx
call fcn.790d70ff

Function at 0x791296d8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x7907636c]
cmc
mov ecx, dword [eax + 0xec]
bsf edx, edi
sub ecx, dword [ebp - 0x14]
pushal
aam 0x1a
mov edx, dword [0x7907636c]
lahf
add eax, edi
mov dword [edx + 0xec], ecx
bsr dx, bx
sal ch, cl
mov eax, dword [0x7907636c]
push ecx
pushfd
xadd edx, ecx
mov ecx, dword [eax + 0xf0]
cmc
das
sub ecx, dword [ebp - 0x14]
cdq
aad 0x4c
daa
dec dh
mov edx, dword [0x7907636c]
push 0x88b9da2c
mov dword [edx + 0xf0], ecx
das
shl cx, cl
neg ch
mov eax, 0x69
test dx, cx
rol cx, 2
mov word [ebp - 0x398], ax
pushfd
push dword [esp]
mov eax, 0x6e
xor cl, dh
mov word [ebp - 0x396], ax
and al, 0x2a
mov eax, 0x75
lea ecx, [ebp*8 - 0x7eead470]
lea ecx, [edi - 0x184ee318]
shl cx, 4
mov word [ebp - 0x394], ax
rcl ax, 9
pop ecx
bswap ax
adc ch, 0x29
mov eax, 0x61
pushfd
adc cx, dx
add cl, ah
mov word [ebp - 0x392], ax
shr cl, 5
test ah, dh
sub cl, dh
sub cl, ch
sub eax, eax
rcl cx, 3
mov byte [esp + 0xc], 0xcf
mov word [ebp - 0x390], ax
stc
mov dword [esp + 0x30], 0
xor ecx, 0x5568f5f2
mov dword [esp + 0x2c], 0
rol ch, 4
mov eax, dword [ebp - 0x14]
pushfd
add eax, 7
mov cl, dl
setle cl
movsx cx, dl
mov dword [esp + 0x2c], eax
not ch
movsx cx, cl
mov ecx, dword [0x7907636c]
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0x38]
jmp 0x79094a72
mov dword [esp + 4], eax
pushfd
lea esp, [esp + 8]
call fcn.79041bb0
bsr eax, esp
adc al, ch
bt cx, ax
bswap ecx
add esp, 0xc
clc
bsf dx, cx
seto al
jmp 0x79088868
Function at 0x7912b16e
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x791746ec
lea esp, [esp + 0xc]
jne 0x790fe40b
push ebx
pushfd
jmp 0x7916649e
pushfd
lea esp, [esp + 0xc]
call fcn.790eda41
pushal
pushal
mov dword [esp + 4], 0xd2ef8fef
mov byte [esp + 4], bl
lea esp, [esp + 0x40]
jmp fcn.790bc086

Function at 0x7912d995
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
pushfd
mov dword [ebp - 4], eax
mov byte [esp + 4], al
push dword [esp]
pushfd
lea esp, [esp + 0x3c]
jmp 0x790ec592

Function at 0x7912df74
Capabilities:
Packed with generic packer

Disassembly:
mov al, byte [eax + 0x10]
pushfd
jmp 0x790dd3bb
movsx ax, cl
setg cl
mov byte [ebp - 0x1b], 0x6c
pushal
movsx cx, bl
xchg cx, ax
pushal
mov byte [ebp - 0x1a], 0
mov al, bh
lea eax, [ebp - 0x18]
not cl
push 0x6d6ee521
setnp cl
push dword [esp + 0x10]
mov dword [esp + 0x48], eax
movsx ecx, bl
call fcn.790e88b9
lea esp, [esp + 8]
jbe fcn.790c20ba
call fcn.790082bf
pushal
pushfd
lea ecx, [ebp - 0x120]
mov byte [esp + 0x14], al
lea esp, [esp + 0x48]
call fcn.79004f00
lea ecx, [ecx + 0x3653db19]
dec cl
stc
mov ecx, 1
ror dh, cl
cmp al, 0xf7
shl ecx, 2
movzx dx, bl
mov edx, dword [ebp - 0x114]
push eax
jmp 0x7909baf5

Function at 0x7912efec
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp + 0x10], eax
lea esp, [esp + 0x44]
js 0x791047de
pushal
lea esp, [esp + 0x20]
jns 0x7912f654
push 0x83d08ddf
mov byte [esp], ch
pushal
lea esp, [esp + 0x24]
jmp fcn.7916cdca
call fcn.790260dc
and ecx, edi
rcr ecx, cl
xor eax, ebp
mov cx, sp
call fcn.7913e478
ror ah, cl
ror dh, cl
popal
ror al, 1
shld ax, bp, cl
mov eax, dword [ebp + 0x10]
pushal
test dh, 0x87
sub eax, dword [ebp + 0x14]
pushfd
pushal
jmp 0x790a6eca

Function at 0x7912f008
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
lea esp, [esp + 0x30]
jbe 0x7913dbe3
pushal
call fcn.7907fd6d
Function at 0x79131420
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jmp loc.79016ed1
pushfd
lea esp, [esp + 4]
call fcn.7909b6fb
movzx cx, cl
btr cx, cx
btc cx, cx
bt sp, cx
movzx ecx, al
pushfd
test ch, 0x3c
call fcn.79024d3d
jmp 0x79100796
jb 0x79088d13
cmp dword [ebp - 0x40], 0
pushal
pushfd
mov dword [esp], 0x2e27d51e
mov word [esp + 8], dx
lea esp, [esp + 0x24]
jne 0x791542df
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.7913c21b
pushfd
cmp dword [ebp - 0x14], 0
pushfd
lea esp, [esp + 8]
je 0x790d9c4e
cmp esi, 0x40d9e9fc
call fcn.790d9c3c
pushal
mov byte [ebp - 0xb4], 0x74
mov word [esp + 4], 0x63dd
lea esp, [esp + 0x20]
jp 0x7913001b
mov byte [ebp - 0xb3], 0x85
push 0x1b5703a3
push dword [esp]
pushal
mov byte [ebp - 0xb2], 0x1b
mov byte [esp + 4], 0x75
pushfd
mov byte [esp + 4], 0xe5
mov byte [ebp - 0xb1], 0xaa
pushfd
call fcn.79097df0
pushal
call fcn.79108eb3
call fcn.790da66e
lea esp, [esp + 4]
jne 0x790d883e
bt cx, 1
shld ax, ax, cl
and eax, eax
movzx eax, byte [0x79076510]
pushfd
cmp al, ch
mov word [esp], 0x5557
test eax, eax
push ecx
pushfd
lea esp, [esp + 0xc]
jne 0x790d883e
jmp loc.7900f24f
setne cl
movzx ecx, bl
setb cl
push eax
mov ch, 0xa6
mov ecx, 0x79076370
jmp 0x790d6a7e
not cx
mov eax, dword [0x79075448]
movzx ecx, cl
push eax
lea esp, [esp + 4]
jae 0x791437e2
push eax
setns ch
movsx ecx, al
movzx cx, bl
not ch
mov ecx, 0x79076370
call fcn.7912b5d7
mov byte [esp + 0x14], 0x7f
lea esp, [esp + 0x60]
jge 0x7910350b
mov byte [ebp - 0xb4], 0x74
call fcn.791344ca

Function at 0x791316c9
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp - 0x74]
push 0x44d6b1e9
mov dword [0x790763c4], eax
pushal
push edi
pushfd
mov word [esp + 4], 0x9868
lea esp, [esp + 0x2c]
jmp 0x790b48cb
push 0x2e2c83b0
lea esp, [esp + 4]
jbe 0x7900fd77
jmp 0x790cd110
lea esp, [esp + 0x24]
jg 0x7909cc91
movzx cx, cl
clc
sub ch, 0xdd
inc cx
mov ecx, dword [ebp - 0x74]
bt ebp, 8
cmp ecx, dword [ebp - 0xc0]
jmp 0x790eed12

Function at 0x79131846
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x44], ecx
shl ah, 5
das
and ax, 0x7cab
mov eax, dword [ebp - 0x40]
sbb ch, bl
rcl ch, 3
sub cl, 0x79
mov ecx, dword [eax + 4]
pushfd
mov dword [ebp - 0x48], ecx
clc
push esp
cmp dx, 0x2173
cmc
cmp dword [ebp - 0x48], 0x14c4051
push edx
call fcn.7916be71
jmp 0x7913fcb3

Function at 0x7913307c
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
not eax
movsx ax, al
jmp 0x790b0e12
cmp dword [ebp - 0x14], 0x1000000
mov dword [esp], esp
lea esp, [esp + 4]
jge 0x79090e77
pushal
lea esp, [esp + 0x20]
jmp 0x7911d22e

Function at 0x7913398c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0x79097a64
bsr ax, ax
mov eax, dword [ebp - 0x18]
stc
cmp bl, dh
cmp ch, 0xce
cmp eax, dword [0x79077460]
jmp fcn.79014c47