joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790db62d
Capabilities:
Packed with generic packer

Disassembly:
clc
mov edx, dword [ebp - 0x408]
jmp 0x79091760
bswap ecx
mov dword [ebp - 0x414], edx
lahf
bswap ax
mov eax, 1
bt bx, 0xf
movsx cx, bl
rcr cl, cl
rcr dh, cl
imul ecx, eax, 0xc
shld ax, ax, cl
add esp, 0x24
je 0x790bc9e5
rcl dl, cl
mov edx, dword [ebp - 0x408]
shld ax, bx, cl
cmp esp, 0x73035b48
mov eax, dword [edx + ecx]
rcl cx, cl
mov dword [ebp - 0x418], eax
ror ax, 0xd
sub ah, ch
mov eax, dword [ebp - 0x408]
movzx cx, al
adc cl, ch
add eax, 0x10
cmc
rcr cx, cl
and ch, bl
mov dword [ebp - 0x408], eax

Function at 0x790db6cc
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [ebp - 0x29], 1
call fcn.79036a2c
mov dword [ebp - 0x48], 0x96
jmp 0x79120ae0
stc
cmp dword [0x790764b0], 0xdd1
mov byte [esp], 0x21
pushal
push dword [esp]
mov byte [esp + 4], 0x46
lea esp, [esp + 0x28]
jne 0x79036a39
bt esi, 2
mov byte [ebp - 0x29], 1
call fcn.791581fe
cmp dl, 0x3f
stc
stc
cmp dword [0x790764b0], 0xdd0
jmp 0x791669e3
call fcn.7907bc6f
mov byte [esp + 4], bh
mov byte [esp], ch
lea esp, [esp + 0x50]
jle 0x7913b670
je 0x790bbb6a
bt dx, 1
push 0x68cd5a77
jmp 0x790e2362

Function at 0x790dbd27
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
pushfd
mov byte [esp], ah
mov dword [esp], ecx
jmp 0x7911b661
not al
lahf
mov eax, dword [ebp - 0x48]
pushal
pushal
mov dword [esp + 0x40], eax
lea esp, [esp + 0x40]
je 0x79172e6d
pushfd
push 0x86226cce
pushal
lea esp, [esp + 0x28]
cvttss2si ecx, dword [ebp - 0x44]
jmp 0x790d5d89
movzx eax, byte [ebp + 0xc]
pop ecx
mov ch, dh
push eax
mov cx, 0x5ff
jmp 0x790ff934
movzx ecx, byte [ebp + 8]
call fcn.7910f579
pushfd
mov dword [esp], esi
lea esp, [esp + 4]
cvttss2si edx, dword [ebp - 0x40]
push 0xdf30fcf6
mov dword [esp], edx
pushfd
xchg cl, ah
movsx cx, bl
jmp 0x790dd4a3

Function at 0x790dd011
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr dx, 4
push 0xccd76a34
aaa
mov dword [esp + 4], 0xfffffffe
or al, 0xb6
rdtsc
mov dword [esp], 0x7906be38
sub eax, ecx
rdtsc
push 0x790447e0
btc dx, sp
rcl ah, cl
or dl, 0x6b
aam 0x84
mov eax, dword fs:[0]
sbb dh, bl
push eax
sbb ax, si
shr al, 3
add esp, 0xffffff8c
das
push 0xfdcb9ba9
test si, 0x2fe1
aam 0xe9
mov eax, dword [0x7906f390]
test cl, bl
test cl, 0x89
xor dword [ebp - 8], eax
movzx dx, bl
cmc
dec dx
xor eax, ebp
rol dl, cl
mov dword [ebp - 0x1c], eax
movsx dx, cl
rcr dh, cl
mov dword [esp], ebx
push 0xf557e090
mov dword [esp], esi
rol dh, 7
bts dx, di
push edi
btc dx, bp
push eax
ror eax, 9
movsx eax, bl
lea eax, [ebp - 0x10]
push 0x15423b61
call fcn.79127022
push dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
pop dword [esp + 0x40]
pushfd
push 0xe2891086
pushfd
push dword [esp + 0x4c]
ret 0x50
Function at 0x790dd5be
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr ax, 0xa
mov eax, dword [ebp - 8]
stc
add eax, dword [ebp - 0x18]
call fcn.790dddd5
mov esi, dword [esp + 4]
call fcn.791205e2
pushal
mov dword [esp], edx
push esi
lea esp, [esp + 0x24]
jne 0x7900e9c5
call fcn.79101bb8
mov ecx, dword [eax + 8]
not dx
mov byte [esp], dl
mov dword [esp], ecx
movzx edx, dl
push 0xcd07327e
mov dword [esp], 0x7906071c
bswap dx
movzx edx, cl
lea edx, [ebp - 0x320]
push 0xfaf022f4
jmp 0x7908d25e
mov dword [ebp - 4], eax
cwde
push ebx
xchg dh, ah
cdq
rdtsc
push esi
lahf
not edx
pushal
pushal
mov dword [esp + 0x3c], edi
setne ah
bswap eax
lahf
mov dword [ebp - 8], 0
lahf
rdtsc
bswap cx
mov dword [esp + 0x38], 0x1c
movsx dx, bl
movsx ecx, dl
rdtsc
lea eax, [ebp - 0x24]
not cl
seta dl
mov dword [esp + 0x34], eax
bswap dx
not dl
xchg ecx, edx
mov ecx, dword [ebp - 8]
bswap dx
mov dword [esp + 0x30], ecx
pop edx
movzx edx, al
pop edx
mov edx, dword [ebp + 8]
pushfd
mov byte [esp + 8], ah
push dword [esp + 0x10]
pushfd
mov dword [esp + 0x30], edx
push ebx
push ecx
pushfd
lea esp, [esp + 0x3c]
call fcn.7912cdbe
test al, dl
test bh, bh
cmp cl, bh
test eax, 0xf909bbd0
cmp eax, 0x1c
pushal
pushal
lea esp, [esp + 0x40]
jne 0x7913e6e0
cmp ah, cl
shr ah, 1
mov eax, dword [ebp - 0x10]
test esp, 0x50388703
test ah, 0xa1
and eax, 0x66
pushal
lea esp, [esp + 0x20]
je 0x79032255
push 0xb33420d5
movsx cx, al
movzx cx, bl
not cl
mov eax, dword [ebp - 0x20]
bswap cx
call fcn.790db4cf
lahf
das
lahf
push ebp
add cl, 0x86
dec cl
mov ebp, esp
bsr ax, sp
rcl ah, 3
rcr ah, 2
pushfd
sub esp, 0x6c
dec al
xor cl, 0x59
mov eax, dword [0x7906f390]
bsr cx, si
lea ecx, [esp - 0x12db710e]
cmp bp, bp
xchg dh, cl
xor eax, ebp
movsx cx, bl
jmp 0x79093e14
ror ah, cl
cmp di, bp
jl 0x790dd5be
push ebp
cmp bh, 0xd4
xadd bp, ax
inc eax
sbb dh, 0x87
mov ebp, esp
clc
sub esp, 0x70
ror dl, 1
add al, ah
btc ax, di
mov eax, dword [0x7906f390]
sbb ch, 0x60
stc
xor eax, ebp
setle dl
call fcn.7907b4b3
mov byte [ebp - 0xfd], 0
jmp 0x7916cc84
call fcn.790fc61f

Function at 0x790dd635
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 4], 0xffffffff
mov cl, 0x5b
jmp 0x79115eff
push ebx
pushal
push ebx
test eax, eax
lea esp, [esp + 0x28]
jbe 0x791607d1
push 0x21e19ef4
pushal
lea esp, [esp + 0x24]
je 0x790cc745
mov al, dh
setae al
mov al, 1
push eax
mov byte [esp], 0xa5
lea esp, [esp + 4]
jmp fcn.790cc74d
cmp di, cx
neg di
xor al, al
mov byte [esp], cl
lea esp, [esp + 8]
call fcn.790119b0
call fcn.790a3f7d
mov byte [esp], 0xc4
mov byte [ebp - 0xc1], 0
call fcn.790ddd10
setbe ch
mov dword [ebp - 0x54], eax
jmp 0x7908879f
je 0x790cc745
pushal
jmp 0x7910afc8
push dword [esp]
pushal
mov al, 1
push dword [esp + 4]
lea esp, [esp + 0x48]
jmp fcn.790cc74d
lea esp, [esp + 4]
call fcn.790f21c2
rcr ah, 6
aas
mov byte [0x79076708], 1
sub ax, dx
movzx eax, byte [0x7907670c]
jae 0x790c20c7
stc
cmp bl, 0xe7
stc
test eax, eax
jmp 0x790f89f0
jmp 0x791209bf
pushal
mov ecx, dword [ebp - 0x54]
push ebx
mov dword [0x79078a1c], ecx
lea esp, [esp + 0x24]
push edi
jmp 0x79115468
pushfd
jmp fcn.7902fc2d
Function at 0x790e07cf
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x10]
jne 0x791209ce
pushfd
mov dword [esp], 0x38
jmp loc.790213ef

Function at 0x790e2ac5
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.7914161d
lea eax, [ebp - 0x18]
movsx cx, dl
movsx cx, al
mov dword [esp + 4], eax
pop ecx
pushfd
lea ecx, [ebp - 0x1c]
jmp 0x790eb088

Function at 0x790e31ed
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x791680aa
mov byte [ebp - 0x9d], 0
jmp 0x790d2c2c
mov byte [ebp - 0x9c], 0
mov byte [esp + 4], 0xdf
call fcn.791213f2

Function at 0x790e45cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ax
cdq
push ebp
aaa
bts ebp, 0x13
mov ebp, esp
shl al, 4
sub esp, 0x444
aas
mov eax, dword [0x7906f390]
bt edi, ebx
xor eax, ebp
bswap cx
bswap cx
movsx dx, cl
mov dword [ebp - 4], eax
call fcn.7914655b
xchg dx, ax
neg ch
jl 0x7908a3b2
btc cx, 1
push ebp
rcl ebp, 1
xadd bp, ax
aas
btc ebp, edi
mov ebp, esp
aaa
sub esp, 0x444
rdtsc
or edx, edi
mov eax, dword [0x7906f390]
movzx dx, al
xor eax, ebp
jmp 0x79112d9b
mov dword [ebp - 4], eax
movzx eax, bl
call fcn.79144519
lea ecx, [edi + 0x2ffa14c]
shl di, 1
shld bx, si, cl
mov dword [0x79077784], eax
push esp
shrd ecx, edx, cl
push ebx
bsf ebx, esp
mov edi, dword [esp + 8]
add ch, 0x9b
mov esi, dword [esp + 0xc]
sbb cl, 0x79
rol ch, 4
mov ebx, dword [esp + 0x10]
lea ecx, [eax*2 + 0x20424c60]
mov ecx, dword [ebp - 4]
clc
xor ecx, ebp
jmp 0x79093508

Function at 0x790e45d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ax
cdq
push ebp
aaa
bts ebp, 0x13
mov ebp, esp
shl al, 4
sub esp, 0x444
aas
mov eax, dword [0x7906f390]
bt edi, ebx
xor eax, ebp
bswap cx
bswap cx
movsx dx, cl
mov dword [ebp - 4], eax
call fcn.7914655b
xchg dx, ax
neg ch
jl 0x7908a3b2
btc cx, 1
push ebp
rcl ebp, 1
xadd bp, ax
aas
btc ebp, edi
mov ebp, esp
aaa
sub esp, 0x444
rdtsc
or edx, edi
mov eax, dword [0x7906f390]
movzx dx, al
xor eax, ebp
jmp 0x79112d9b
mov dword [ebp - 4], eax
movzx eax, bl
call fcn.79144519
lea ecx, [edi + 0x2ffa14c]
shl di, 1
shld bx, si, cl
mov dword [0x79077784], eax
push esp
shrd ecx, edx, cl
push ebx
bsf ebx, esp
mov edi, dword [esp + 8]
add ch, 0x9b
mov esi, dword [esp + 0xc]
sbb cl, 0x79
rol ch, 4
mov ebx, dword [esp + 0x10]
lea ecx, [eax*2 + 0x20424c60]
mov ecx, dword [ebp - 4]
clc
xor ecx, ebp
jmp 0x79093508
Function at 0x790e8da4
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push 0xc2615eca
clc
mov dword [ebp - 0xc0], eax
inc ax
aad 0xa1
mov dword [ebp - 0xbc], edx
movsx ax, cl
and ah, dl
mov eax, dword [ebp - 0x70]
pushal
cmp eax, dword [ebp - 0xbc]
call fcn.7913c73c
shl al, cl
shld ax, cx, cl
mov dword [ebp - 0xbc], edx
aam 0xac
bt si, 8
aam 0xd1
mov eax, dword [ebp - 0x70]
pushfd
cmp al, 0x2b
cmp eax, dword [ebp - 0xbc]
pushfd
push dword [esp + 4]
lea esp, [esp + 0xc]
jl 0x7900fd77
pushfd
pushal
lea esp, [esp + 0x24]
jg 0x7909cc91
not ch
shrd ecx, edi, cl
mov ecx, dword [ebp - 0x74]
clc
cmp ecx, dword [ebp - 0xc0]
pushal
pushfd
lea esp, [esp + 0x24]
jbe 0x7900fd77
not ax
push edx
cwde
movzx ax, dl
mov eax, dword [ebp - 0x74]
push dword [esp]
push 0x23d98bb5
mov word [esp], di
push 0x92ffbabe
mov dword [0x790763c4], eax
pushal
push dword [esp]
push 0x2d46461a
lea esp, [esp + 0x38]
jmp 0x790b48cb
push 0x9a2a5705
jmp 0x79123d85
mov dword [ebp - 0x74], eax
rol ah, 3
pushal
mov dword [ebp - 0x70], edx
lahf
rdtsc
push 0xf0146fe5
cdq
mov eax, dword [0x790763c4]
movsx edx, cl
pushfd
pushfd
cdq
sub esp, 0xffffffcc
jae 0x7907e6fb
mov dword [ebp - 0xc0], eax
shrd eax, ecx, 0x17
bsf ax, sp
je 0x790b7763
das
mov dword [ebp - 0xbc], edx
mov ax, 0x9804
sal eax, 0x19
sbb ah, 0x89
add ah, 0xc1
mov eax, dword [ebp - 0x70]
test ch, 0x6f
cmp eax, dword [ebp - 0xbc]
call fcn.790abdb9

Function at 0x790ea263
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea ecx, [edi + 0x2f88b91d]
imul ecx, eax, 0
rcr ah, 6
mov edx, dword [ebp - 0x28]
not al
lahf
pop eax
clc
movzx eax, byte [edx + ecx]
setg ch
push edi
cmc
mov dword [ebp - 0x2c], eax
movzx ax, bl
pushfd
mov eax, 1
mov dword [esp + 0x10], esp
btr cx, ax
btc cx, 0xb
lea ecx, [ebp*4 - 0x62f529e]
imul ecx, eax, 0
bswap ax
sbb al, 0x92
shl ax, cl
or ax, 0xc659
add ecx, dword [ebp - 0x28]
and ah, ah
ror al, cl
mov dword [ebp - 0x30], ecx
btc cx, 0xc
add al, 0xe
mov eax, dword [ebp - 0x28]
sete ch
mov byte [esp + 8], ah
add eax, 1
mov cx, cx
bswap cx
pop ecx
mov dword [ebp - 0x28], eax
not cl
lea ecx, [ebp - 0x58a8091e]
mov dword [ebp - 0x34], 0
movzx cx, dl
call fcn.79092f86

Function at 0x790ea2fa
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov eax, dword [ebp - 0x3c]
call fcn.790ecfee
pushfd
lahf
mov eax, dword [ebp - 0x3c]
pushfd
call fcn.790edb1f
mov byte [esp + 0x10], 0x5a
lea esp, [esp + 0x28]
jne 0x79158470
jmp 0x790d0c59
jmp 0x790c27dc

Function at 0x790ee891
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
call fcn.79087dda
cmp dx, 0xdd00
mov ecx, dword [ebp - 0x94]
clc
jmp 0x79119c83

Function at 0x790ef157
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jne 0x790f6060
call fcn.790c3d3e
pushal
mov dword [esp + 4], 0x35adc225
mov dword [esp + 0x1c], 0xf10ddbde
push ebp
pushfd
pushal
push 0x2e7e16a3
mov dword [esp + 0x44], 0xcf2724a2
push 0x9e204b05
push ecx
pushfd
mov byte [esp + 8], ah
lea esp, [esp + 0x50]
jmp fcn.79006491
Function at 0x790efd4f
Capabilities:
Packed with generic packer

Disassembly:
call fcn.790d60b6
lea esp, [esp + 0x44]
ja 0x790d5583
push edi
mov dword [esp], eax
lea esp, [esp + 4]
call fcn.79087dda
pushal
rcl ch, 6
pushfd
mov ecx, dword [ebp - 0x94]
stc
clc
add ecx, dword [ebp - 0x78]
pushfd
test bp, 0x5def
bt di, 5
cmp eax, ecx
jmp 0x790f2490
lea esp, [esp + 0x14]
je 0x790a11da
shr ah, cl
aad 0x90
aas
mov eax, dword [ebp - 0x74]
btr dx, 8
ror cx, cl
mov cx, sp
sub eax, dword [0x7907639c]
pushal
mov ecx, dword [0x790763a0]
jmp 0x791206da
lea esp, [esp + 0x28]
jae 0x790a11da
pushfd
lea esp, [esp + 4]
jmp 0x79155524
mov dword [ebp - 0x94], edx
jmp 0x790eda08
pop edx
pushal
lea edx, [eax + ecx + 0x1f4]
pushfd
pushfd
jmp 0x790fa668

Function at 0x790f029c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 0x89], 0
lea esp, [esp + 0x5c]
jg 0x790b7fa8
mov byte [ebp - 0x88], 0
push 0xe0acb196
mov byte [ebp - 0x87], 0
push eax
pushfd
pushfd
mov byte [ebp - 0x86], 1
jmp loc.79021d4e

Function at 0x790f5037
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
pushal
lea esp, [esp + 0x2c]
call fcn.79026f70
mov eax, ebp
test bh, 0x59
add esp, 0xc
xor eax, 0xee72147
rol cx, cl
mov eax, dword [ebp - 4]
sbb dl, dh
setae dl
adc cx, 0x2343
dec dl
push eax
sbb cx, 0x8e33
mov ecx, dword [0x79077830]
pushal
add ecx, 0xf
pushal
jmp 0x7913de85
push 0x2db21f0
not cx
mov dword [ebp - 8], eax
rdtsc
pushfd
xchg cx, ax
mov dword [esp + 4], 0
push dword [esp]
rdtsc
mov al, 0x4d
mov eax, dword [ebp + 0x10]
movzx dx, al
mov dword [esp + 4], eax
bswap cx
call fcn.7908e566
push 0x85d46205
mov dword [esp + 4], ecx
pushfd
jmp 0x790c371f
mov byte [esp + 4], 0xa1
lea esp, [esp + 0x48]
call fcn.790416b4
dec ch
dec cx
sbb ecx, 0xe7ec0074
add esp, 4
xchg dx, cx
jmp 0x790db1cd
Function at 0x790f635b
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.790de6e9
setge cl
mov byte [ebp - 0xd], 0x6d
movzx edx, al
mov byte [ebp - 0xc], 0x61
movzx cx, al
not eax
rdtsc
mov byte [ebp - 0xb], 0
bswap ax
lea eax, [ebp + 0x18fa98f5]
movzx ax, al
cwde
lea eax, [ebp - 0x10]
movsx ecx, dl
setne cl
mov dword [esp + 4], eax
pop ecx
mov ecx, dword [ebp + 0xc]
pushal
bswap dx
sete dh
not dl
mov dword [esp + 0x1c], ecx
mov dl, al
mov byte [esp], ch
mov edx, dword [ebp + 8]
push dword [esp + 0x14]
call fcn.7911a096
lea esp, [esp + 0x40]
jge 0x7913d3f3
movsx eax, al
pushal
mov eax, 1
not ch
pushfd
clc
imul ecx, eax, 0
stc
adc dh, 0xdd
sar dl, cl
mov edx, dword [ebp - 8]
clc
movzx eax, byte [edx + ecx]
or si, dx
sub ch, bl
mov dword [ebp - 0x10], eax
sub cx, 0xfb75
mov eax, 1
shld cx, ax, cl
shl eax, 0
sar dl, cl
sal si, 4
sbb dx, 0x8da
mov ecx, dword [ebp - 8]
cmp ah, cl
xadd si, dx
clc
movzx edx, byte [ecx + eax]
xor ax, 0x673a
dec al
mov dword [ebp - 0x14], edx
dec eax
sar eax, cl
mov eax, 1
bswap cx
shl eax, 1
rcr si, cl
mov dl, byte [esp]
bt eax, 0x1b
setb ch
mov ecx, dword [ebp - 8]
jmp loc.790139d1
not ah
mov byte [ebp - 0x10], 0x63
rdtsc
mov byte [ebp - 0xf], 0x3a
pushfd
mov byte [ebp - 0xe], 0x5c
jmp 0x7909c16c
mov esi, dword [esp + 0x48]
mov bx, 0xc928
push 0x15871ab2
mov ebx, dword [esp + 0x50]
lea esp, [esp + 0x54]
jae 0x79093d04
push 0xf990dbce
pushfd
mov esp, ebp
call fcn.7910280c
pushfd
pushal
pushal
mov edi, dword [esp + 0x44]
jmp 0x7912cfee

Function at 0x790f6fd9
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x44]
jbe 0x7900fd77
jmp 0x7909cc86
Function at 0x790fa7ec
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ecx
mov word [esp], 0x69bb
mov dword [esp], 0x90df001
push 0xc39e2499
push edi
pushfd
jmp 0x790d59b2
mov ecx, 0x790764e8
jmp 0x79155fd9
mov dword [esp + 8], 0xd930cae7
pushal
lea esp, [esp + 0x28]
jmp loc.79006f2f
mov dword [esp + 4], eax
pushal
mov byte [esp + 8], bl
pushal
call fcn.79129ec2
mov dword [ebp - 0x18], edx
rcr al, 5
mov eax, 1
movsx dx, al
imul ecx, eax, 0
pushfd
bts dx, bp
bt edi, 5
bswap edx
mov edx, dword [ebp - 0x18]
lahf
movzx eax, dl
movzx eax, byte [edx + ecx]
btc cx, sp
mov dword [ebp - 0x20], eax
bts cx, dx
jmp 0x79153ca0
jmp 0x7908f2e6
mov eax, 1
mov dword [esp], esp
lea ecx, [esi*4 + 0x60692e7d]
imul ecx, eax, 0
bsf eax, ecx
not ax
sal al, cl
add ecx, dword [ebp - 0x18]
aas
clc
mov dword [ebp - 0x24], ecx
cmc
aad 0xca
aam 0xa2
mov eax, dword [ebp - 0x18]
call fcn.79159952
lea esp, [esp + 0x28]
jg 0x7917b791
mov ecx, 0x790764e8
pushfd
push 0xcac958ea
lea esp, [esp + 8]
call fcn.7901a330
movzx ax, cl
pushal
movsx cx, cl
xchg cx, ax
lea eax, [ebp - 0x54]
seto cl
mov dword [esp + 0x1c], eax
movzx ecx, al
call fcn.791750a8
lea esp, [esp + 4]
call fcn.7902beb0
not cl
pushfd
mov dword [esp], eax
movzx ecx, cl
lea ecx, [ecx + 0xe8ec0f]
movzx cx, cl
push 0xcfacaa34
lea ecx, [ebp - 0x10]
pushfd
lea esp, [esp + 8]
call fcn.790294b0
test sp, 0xdfef
push 0x763887bc
bsr cx, di
movzx ecx, al
call fcn.791139a3
lea esp, [esp + 0x2c]
jae 0x790d249c
call fcn.790daa53
jae 0x79105bf7
pushfd
pushfd
mov word [esp], 0x6f4f
mov dword [esp + 4], 0x90df001
push ebp
push 0xf7d8f572
push edx
call fcn.790c56c6
not cl
movzx cx, dl
jmp fcn.791388ec
jb 0x7916652d
movsx ecx, cl
movzx cx, bl
mov ecx, 0x790764e8
push edx
lea esp, [esp + 4]
call fcn.7901a330
setb ch
lea eax, [ebp - 0x54]
mov cx, 0x4590
setb ch
pushfd
mov dword [esp], eax
push esp
jmp 0x790c25df
Function at 0x790faee5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop ecx
lahf
rdtsc
movzx eax, byte [ebp - 0x15]
pushal
pushal
xchg cl, dl
jmp 0x79138b81
pushal
jmp 0x7908f795
mov eax, 5
neg ch
sub eax, edx
ror dh, cl
sbb dx, 0xdcf9
setns dl
and dl, 0x5f
add eax, dword [ebp - 0xac]
lea ecx, [eax + 0x2ba75a1d]
mov dword [ebp - 0xac], eax
lea ecx, [ebp*2 - 0xb53e864]
lea esp, [esp + 0x28]
jb 0x790e1770
cwde
pushal
movzx eax, byte [ebp - 0x15]
setge dh
mov dword [esp + 0x1c], eax
movsx ax, cl
mov ch, byte [esp + 4]
mov dword [esp + 0x18], 0
lahf
xchg cl, ah
mov ecx, dword [ebp - 0xc]
cwde
mov dword [esp + 0x14], ecx
jmp 0x79174d84
xchg dword [esp + 0x3c], eax
lea esp, [esp + 0x3c]
jg 0x79156274
push 0
bswap edx
movsx cx, al
mov ecx, dword [ebp - 0xc]
sete dh
movsx dx, cl
xchg dh, al
push ecx
lahf
movzx ax, bl
setne dh
mov edx, dword [ebp - 0xb0]
not al
push edx
pushal
movsx dx, bl
mov eax, dword [ebp - 0xac]
pushfd
mov dword [esp + 0x20], eax
bswap cx
mov ecx, dword [ebp - 0xa8]
mov dh, bh
xchg dword [esp + 0x1c], ecx
movzx ax, cl
push dword [esp + 0xc]
lea edx, [eax*2 - 0x7685671e]
cdq
mov edx, dword [0x79076260]
push dword [esp + 4]
mov dword [esp + 0x20], edx
bswap ax
push 0x188316a1
cwde
mov eax, dword [ebp - 0xbc]
seto cl
mov dword [esp + 0x20], eax
pushal
push esi
mov ecx, dword [ebp - 0x14]
pushfd
pushfd
mov byte [esp + 4], 0xb5
mov dword [esp + 0x48], ecx
lea esp, [esp + 0x48]
jns 0x790f8178
push eax
lea esp, [esp + 4]
call fcn.7916b345
pushal
aas
dec ax
and al, bh
add esp, 0x44
daa
rcr ah, cl
dec eax
aam 0x91
mov eax, dword [ebp - 0x80]
cmc
stc
add eax, 1
jmp 0x79147b05
mov dword [ebp - 0x80], eax
pushal
mov byte [esp], ch
mov byte [esp + 0x14], 0xa
pushfd
lea esp, [esp + 0x24]
jmp fcn.79108479
xchg cx, dx
push 0
call fcn.79122903
pushfd
lea esp, [esp + 0x2c]
je 0x79032255
mov ch, dh
lahf
mov eax, dword [ebp - 0x20]
lea ecx, [edi - 0x5fbb4d18]
movsx cx, al
call fcn.790bd871

Function at 0x790fb824
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dl, byte [ecx + eax]
call fcn.7910ece5
cwde
mov eax, dword [ebp - 0x60]
push ebx
mov word [esp], dx
lea esp, [esp + 4]
jb 0x790acb29
pushfd
mov dword [esp], eax
pushfd
call fcn.790daa81
push ebx
mov esp, ebp
mov bp, 0xfec3
pop ebp
push 0x578afcbe
pushal
mov word [esp], dx
push 0xb996cb5c
push dword [esp + 0x28]
ret 0x34
pushal
mov eax, 4
adc cx, bx
shl eax, 0
pushfd
mov ecx, dword [ebp - 0xc]
not dl
mov dl, byte [esp]
push dword [esp]
jmp 0x7908b17c
mov edx, dword [ebp - 0xc]
pushfd
pushfd
bt dx, dx
cmp eax, dword [edx + ecx]
mov word [esp + 8], 0xe490
push 0xac34995a
lea esp, [esp + 0x10]
je 0x791073c7
lea ecx, [eax + 0x3f702145]
bts dx, ax
stc
bts ax, 4
mov eax, 4
rol dl, cl
movsx cx, cl
btr cx, 1
imul ecx, eax, 0
add al, 0xa8
adc al, dl
push edi
bsf dx, sp
mov edx, dword [ebp - 0xc]
shr al, 4
rcl al, 7
mov al, byte [edx + ecx]
neg dl
pushfd
rcr ch, cl
mov byte [0x790764ca], al
jmp 0x790ec27f

Function at 0x790fc26e
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jne fcn.790fc28d
push esp
lea esp, [esp + 4]
js 0x79029f07
pushal
lea esp, [esp + 0x20]
call fcn.790ee171
Function at 0x790ff804
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], eax
lea ecx, [esi + 0xcd937f1]
lea ecx, [edi - 0x484c8cd7]
push dword [esp]
movsx cx, dl
mov ecx, 0x79076568
call fcn.7916befd

Function at 0x790ff825
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [edx + 0x12c]
call fcn.790c69c6
mov dword [ebp - 0x14], ecx
pushal
lea esp, [esp + 0x28]
pushal
rdtsc
pushfd
cdq
rdtsc
mov ecx, dword [ebp - 0x14]
pushfd
mov edx, dword [ecx]
movzx ax, bl
movzx ax, dl
pushal
jmp 0x790c7e0f

Function at 0x790ff87e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x48], eax
lea esp, [esp + 0x48]
js 0x7913bcb6
pushal
mov word [esp], 0xd7f6
lea esp, [esp + 0x20]
call fcn.79041bb0
jmp fcn.7901566d
pushfd
call fcn.7902253f

Function at 0x790ff93d
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x7915d4eb
pushfd
pushal
pushfd
mov byte [esp], 0x15
lea esp, [esp + 0x28]
jmp fcn.7913c21b

Function at 0x79101055
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
jne 0x791531c5
cwde
mov eax, dword [ebp - 0x18]
and cl, ah
call fcn.79147f4a
jmp 0x790e2ff6

Function at 0x79101232
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [esp + 4], 0x79060b30
lea eax, [eax + 0x2c694351]
pushal
lea eax, [ebp - 0x41c]
jmp 0x790f99d8

Function at 0x79102cda
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
cmp ecx, dword [ebp - 0x44]
pushal
lea esp, [esp + 0x28]
jbe 0x790128d4
neg cx
test cx, 0xc36a
mov eax, dword [ebp - 0x4c]
setnp cl
shrd cx, bx, 3
neg ch
pushal
mov dword [ebp - 0x44], eax
movsx cx, cl
mov ecx, dword [ebp - 0x48]
mov byte [esp], 0xfb
push dword [esp + 4]
mov dword [ebp - 0x40], ecx
push 0x1d1ae511
jmp 0x790c3423

Function at 0x791042b9
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x30]
call fcn.7902cae0
movsx cx, al
call fcn.79131f7b
pushfd
jmp 0x7910073a

Function at 0x79104542
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
pushal
cmp dword [ebp - 0x24], 0
pushfd
jmp 0x79167c76
lea esp, [esp + 0x2c]
je 0x7915d4eb
push edi
call fcn.79120ce1
mov dword [esp + 0x1c], eax
jmp loc.7901e884