joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790b5f46
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 1
movsx cx, dl
imul ecx, eax, 0xe
not dh
lea edx, [esi - 0x54c0c01a]
setne dh
mov edx, dword [ebp - 4]
add ax, 0xb673
not al
movzx eax, word [edx + ecx]
call fcn.790bf530
ror dx, cl
imul ecx, eax, 0xc
rdtsc
movzx eax, bl
rdtsc
mov edx, dword [ebp - 4]
movzx ax, bl
cmc
rcl ah, cl
jmp 0x79149aba
pop edx
mov dword [ebp - 0x1c], eax
cmc
not dx
bt di, sp
jmp 0x7909e615
movzx eax, word [edx + ecx]
jmp 0x79124c86

Function at 0x790b6318
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.79014e50
mov ch, 0xb4
pushal
pop ecx
mov ecx, eax
mov byte [esp], al
jmp loc.79036eb5

Function at 0x790b6da8
Capabilities:
Encrypt data using xtea

Disassembly:
add eax, dword ds:[edx + ecx*4]
shl cl, cl
jmp 0x790edd7d
test esp, ecx
inc ch
mov ecx, dword ss:[ebp - 8]
rol dh, 1
bsr dx, bx
add ecx, eax
movzx dx, dl
and dl, 0x6c
bsf ax, dx
aas
mov dword ss:[ebp - 8], ecx
lahf
mov edx, dword ss:[ebp - 4]
or ah, dh
bts ax, di
xor cl, ch
sub edx, 0x61c88647
adc cl, 0xc8
mov dword ss:[ebp - 4], edx
bsf ax, sp
rol ax, cl
mov eax, dword ss:[ebp - 8]
rcl cx, 6
neg dl
pushfd
not cx
shl eax, 4
cmp dx, dx
shr ch, 1
shld ecx, esi, 0x11
rcr ch, cl
mov ecx, dword ss:[ebp - 8]
test bp, 0x142
bt dx, 0xe
shr ecx, 5
pushal
xor eax, ecx
push dword [esp + 8]
xor dl, cl
adc dh, 0x8e
mov edx, dword ss:[ebp - 8]
movzx ecx, cl
xor edx, dword ss:[ebp - 4]
bsr cx, bp
inc cx
bt dx, di
shld cx, bx, cl
add eax, edx
clc
bsf cx, di
btr cx, 0xd
mov ecx, dword ss:[ebp - 4]
sal dl, 1
add dl, cl
shr ecx, 0xb
inc dl
cmp al, 0xcf
shrd dx, si, 1
and ecx, 3
bsf dx, cx
and dx, cx
mov edx, dword ss:[ebp + 8]
mov dword [esp + 8], edx
add eax, dword ds:[edx + ecx*4]
shrd cx, ax, 3
shrd ecx, ecx, 0x11
mov ecx, dword ss:[ebp - 0x10]
mov byte [esp], ah
add ecx, eax
push ecx
push esp
jmp loc.7901926f

Function at 0x790ba0b6
Capabilities:
Packed with generic packer

Disassembly:
call fcn.7909c0b2
add eax, 1
pushal
cmc
mov dword [ebp - 0x10], eax
add esp, 0x44
cmc
cmp dword [ebp - 0x10], 1
je 0x790a56dd
push esi
pushal
lea esp, [esp + 0x24]
jae 0x790b88ce
test bl, 0x93
mov eax, dword [ebp - 0x10]
and ecx, ebx
call fcn.790be53d
jmp 0x790f077a
mov byte [esp], dh
pushfd
lea esp, [esp + 0x24]
jle 0x790d06ae
push 0xb54af1b0
lea esp, [esp + 4]
jmp fcn.790db404

Function at 0x790ba46f
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x24]
je 0x790e9692
test cx, 0xeb2c
clc
bt ax, 0xa
cmp dword [ebp - 0x10], 0xc8
call fcn.7912f51e
Function at 0x790bea79
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push edx
lea ecx, [ecx + 0x163d56f1]
mov dword [esp + 8], eax
bswap ecx
setp cl
mov ecx, dword [ebp + 0xc]
pushal
push dword [esp + 8]
mov dword [esp + 0x28], ecx
pushfd
mov byte [esp], dh
pushfd
mov word [esp + 4], 0x9708
lea esp, [esp + 0x30]
call fcn.7900d4e0
rcl di, 0xc
btr bx, 8
pushal
add esp, 0x28
movsx esi, dl
not di
push ecx
mov edi, dword [esp + 4]
movzx bx, al
mov esi, dword [esp + 8]
pop ebx
call fcn.79107ee1
leave
xor al, 0x34
push 0xffffffffffffffa0
js 0x790beaaa
mov bh, 0x1d
and al, 0x5f
aas
daa
in eax, dx
popal
wait
mov bh, byte [ecx]
je 0x790beb4a
clc
sbb dh, byte [edx]
rcl bh, 1
xor dl, al
xlatb
add ebx, dword [ebx]
int1
imul ebp, dword [ebx + 0x1bf961ab], 0x2fc6528e
pop ss
nop
ret 0xaf48
jp 0x790beae8

Function at 0x790c2822
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7911a8ad
lea esp, [esp + 0xc]
jne fcn.79141a3e
bswap di
mov eax, dword [ebp - 0x10]
xchg bx, di
jmp 0x79141a15
lea esi, [ebp - 0x6d39747a]
pushfd
mov dword [0x79074464], eax
pop eax
jg 0x7910b7bf
movsx ebx, dl
bswap bx
mov eax, dword [ebp - 4]
pushal
pushfd
mov dword [eax + 4], 0x7901f9b0
lea esp, [esp + 0x24]

Function at 0x790cf3d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x34]
call fcn.7900de50
cmc
adc eax, esi
shr ch, cl
add esp, 4
pushal
bt ax, bp
test dl, dh
mov byte [ebp - 0x405], 0
rcr ax, cl
aas
mov eax, 1
sub ch, 0x7b
bsf cx, dx
or cl, 0xae
lea ecx, [edi*2 - 0x5768479d]
shl eax, 4
rcr ch, cl
rol ch, 2
lea ecx, [ebp + eax - 0x404]
shrd ax, cx, 1
bts ax, 4
das
mov dword [ebp - 0x40c], ecx
dec ah
mov ch, bh
shrd cx, si, 0xb
adc ecx, 0xf16871d8
mov dword [ebp - 0x410], 0x19
sub esp, 0xffffffe0

Function at 0x790d06a5
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790e2879
lea esp, [esp + 0xc]
call fcn.79004dc0
push 0x7d1e5e19
mov byte [ebp - 0xed], 0
setb ch
lea ecx, [esp + 0x96429b2]
pushfd
push 0xa407f9f7
mov dword [ebp - 4], 0xffffffff
jmp 0x7907938c
pop ecx
movsx cx, dl
lea ecx, [ebp - 0x4c]
mov word [esp], 0xa92a
lea esp, [esp + 8]
call fcn.79004dc0
push edx
mov al, byte [ebp - 0xed]
mov byte [esp], al
pushal
push dword [esp]
pushfd
lea esp, [esp + 0x2c]
jmp 0x791498cc

Function at 0x790d65db
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x40c], eax
mov byte [esp + 4], 0x94
mov byte [esp], 0x21
push dword [esp]
push ebp
lea esp, [esp + 0x40]
jmp fcn.790cf44f
Function at 0x790d6ccf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], cl
pushfd
pushfd
lea esp, [esp + 0x50]
jne 0x7914084b
adc dh, 0xad
mov eax, dword [ebp - 0x48]
cmc
shr dh, 4
cdq
imul ecx, eax, 0x16
shld ax, dx, 6
aas
add ecx, dword [ebp - 0x1c]
btc dx, cx
mov dword [ebp - 0x38], ecx
movzx ax, al
rol dx, cl
cwde
rcl ax, 0xc
mov eax, 1
rcr ch, cl
not edx
rcl cx, cl
push edx
imul ecx, eax, 0x1e
clc
sal dl, cl
add ecx, dword [ebp - 0x1c]
bts ax, 0xe
mov dword [ebp - 0x3c], ecx
setbe ah
jmp 0x79120974
pop edx
rdtsc
mov edx, dword [ebp - 0x1c]
cwde
mov eax, dword [edx + ecx]
stc
pushfd
push ebx
bt eax, 0x19
mov dword [ebp - 0x44], eax
rcr al, cl
mov dword [ebp - 0x48], 0xc350
push 0x224898c5
cmc
imul eax, dword [ebp - 0x48], 0xa
stc
pushfd
mov dword [ebp - 0x4c], eax
daa
daa
pop eax
mov eax, dword [ebp - 0x24]
test ebx, edi
mov word [esp], 0x439a
cmp eax, dword [ebp - 8]
jmp 0x790d13b8
mov eax, 1
push dword [esp]
stc
imul ecx, eax, 0x26
xchg dx, ax
pushfd
add ecx, dword [ebp - 0x1c]
btr dx, 1
cmc
rdtsc
cdq
mov dword [ebp - 0x40], ecx
pushfd
ror eax, cl
mov eax, 1
lea edx, [eax + 0x69422e41]
imul ecx, eax, 0x2a
jmp 0x7910b3ed

Function at 0x790daa5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
pushfd
mov al, 1
lea esp, [esp + 4]
lea edi, [ecx*4 - 0x466ecfa3]
pop edi
lea ebx, [edx - 0x51e37324]
call fcn.790d930b
push 0x484df772
call fcn.79110674
pushal
lea esp, [esp + 0x24]
je 0x790b6e3c
jmp 0x7910b7fd

Function at 0x790dd9f2
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x44]
jne 0x790d5dcb
clc
call fcn.79103841
jmp 0x7908ab11

Function at 0x790e1881
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
aas
aas
mov edx, dword [ebp - 4]
movzx ax, bl
movzx eax, word [edx + ecx]
rcl dx, cl
neg dh
lea ecx, [0x29451bba]
mov dword [ebp - 0xc], eax
bts edx, 0xa
mov eax, 1
sar dh, 3
shl eax, 1
pushfd
push 0x204e26d1
rcr dl, 4
mov ecx, dword [ebp - 4]
Function at 0x790e2839
Capabilities:
Execute anti-debugging instructions

Disassembly:
setl ah
mov edx, dword [ebp - 0x2c]
cwde
jmp 0x791416bf
movzx ecx, word [eax]
daa
xchg ah, dl
or dl, 0xa6
movzx dx, cl
mov dword [ebp - 0x54], ecx
xadd cx, ax
mov eax, dword [ebp - 0x50]
and dl, al
or edx, esp
neg ch
movzx ecx, word [eax]
btc dx, bp
mov dword [ebp - 0x58], ecx
rol cx, cl
mov eax, 1
shr edx, cl
rol dx, cl
shl eax, 4
rcl ch, cl
ror ecx, 4
mov ecx, dword [ebp - 0x2c]
pushfd
cmc
rcr dl, 4
bswap edx
movzx edx, word [ecx + eax]
ror al, cl
btr cx, di
mov dword [ebp - 0x5c], edx
bts ax, sp
mov byte [esp], 0x1a
xchg ch, al
cwde
mov eax, 1
clc
stc
rcl ch, cl
movzx ecx, al
imul ecx, eax, 0x12
pushfd
mov word [esp], 0xe316
mov word [esp], 0x6b68
lea esp, [esp + 0x50]
jmp 0x790ba8e4
xchg dx, ax
ror dh, cl
mov edx, dword [ebp - 0x2c]
pushal
setne al
rol ax, cl
cwde
movzx eax, word [edx + ecx]
btc cx, 8
mov dword [ebp - 0x60], eax
movzx ecx, al
rcr ax, cl
mov eax, 1
rol dh, 1
stc
lea edx, [esi + 0x7eae4ef8]
cmc
imul ecx, eax, 0x14
mov byte [esp + 8], bl
pushal
setb dh
bts ax, 0xb
mov edx, dword [ebp - 0x2c]
sete ah
rcr ax, 4
btc ax, di
movzx eax, word [edx + ecx]
bswap cx
rcr dh, 3
mov dword [ebp - 0x64], eax
sete cl
not al
xchg ah, ch
movsx cx, cl
mov eax, 1
btc dx, si
imul ecx, eax, 0x16
pop edx
push dword [esp + 0xc]
mov dword [esp + 0xc], 0x8514e6b4
mov edx, dword [ebp - 0x2c]
lahf
movzx eax, word [edx + ecx]
bts cx, 3
rcr dl, 1
rcl dh, cl
ror dh, 6
mov dword [ebp - 0x68], eax
ror ah, cl
mov eax, 1
btc dx, 0xd
btc cx, si
not cx
rol ch, cl
imul ecx, eax, 0x18
ror dh, cl
mov edx, dword [ebp - 0x2c]
rol ax, 0xd
pop eax
pushfd
jmp 0x79140497
bt bx, ax
mov dword [ebp - 0x40], ecx
pushal
rol dh, 4
ror al, 2
mov eax, dword [ebp - 0x3c]
cmc
not dx
mov byte [esp], ch
jmp 0x7912cab6
clc
imul ecx, eax, 0xe
rdtsc
ror ah, 6
add ecx, dword [ebp - 0x2c]
shld dx, sp, cl
mov dword [ebp - 0x50], ecx
mov dword [esp], edi
mov eax, dword [ebp - 0x4c]
or cl, 0x44
ror dl, cl
ror dx, 0xf
jmp 0x7909df21
movzx ecx, word [eax]
ror dl, 1
stc
mov dword [ebp - 0x44], ecx
pushfd
btc cx, 7
cdq
mov eax, 1
bts ecx, 0x1f
btc dx, 8
setp ch
movsx dx, bl
imul ecx, eax, 0xa
cdq
xchg al, dh
btr ax, si
mov edx, dword [ebp - 0x2c]
clc
stc
movzx eax, word [edx + ecx]
xchg ch, dh
mov dword [ebp - 0x48], eax
stc
mov eax, 1
clc
xchg edx, ecx
imul ecx, eax, 0xc
not ax
add ecx, dword [ebp - 0x2c]
xchg al, dl
lea eax, [ebx*8 - 0x78b9fa54]
mov dword [ebp - 0x4c], ecx
mov eax, dword [esp]
btc dx, 1
mov eax, 1
jmp 0x7912be82
movzx eax, word [edx + ecx]
bswap ecx
stc
mov dword [ebp - 0x6c], eax
movsx eax, al
clc
mov eax, 1
cmc
push dword [esp]
bt bx, 3
pushfd
imul ecx, eax, 0x1a
movzx ax, al
rdtsc
mov edx, dword [ebp - 0x2c]
setl al
movzx ax, al
pop eax
movzx eax, word [edx + ecx]
cmc
bswap dx
bts edx, esi
movzx cx, dl
mov dword [ebp - 0x70], eax
lea eax, [ebx + 0x61d7096a]
cwde
lahf
mov eax, 1
pop ecx
bts ecx, ebp
cmc
imul ecx, eax, 0x1c
rdtsc
rdtsc
jmp 0x790887ce
movzx eax, word [edx + ecx]
call fcn.791244a5
Function at 0x790e3405
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x790f424b
lea ecx, [ebp - 0x4c]
pushal
pushal
push esp
lea esp, [esp + 0x48]
call fcn.79005e80
push ebp
pushal
mov dword [esp + 0x20], eax
pushfd
mov byte [esp], dl
lea esp, [esp + 0x24]
call fcn.7903f230
test dl, 0xb
clc
bt ax, 1
test eax, 0x65a7621d
add esp, 0xc
pushfd
cmc
cmp dword [ebp - 0x50], 0
pushfd
pushfd
lea esp, [esp + 0xc]
jle 0x790d06ae
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jmp fcn.790db404

Function at 0x790e4f5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, dword [ebp - 0x414]
push edi
pushfd
rcr dh, 3
mov dword [ebp - 0x430], ecx
btr ecx, 0x19
lahf
pushfd
btc edx, 7
mov eax, 1
btr edx, esp
mov dx, word [esp]
imul ecx, eax, 0x1c
push edx
btr ax, 6
pop edx
bsf ax, ax
add ecx, dword [ebp - 0x414]
setnp ah
bswap dx
not dl
rdtsc
mov dword [ebp - 0x434], ecx
push edx
rdtsc
cdq
jmp 0x7912e490
mov eax, dword [ebp - 0x42c]
lea edx, [ebx - 0x3c04d8b2]
pushfd
mov word [esp], 0xf092
not dl
mov ecx, dword [eax]
push 0xc99457c2
mov dword [ebp - 0x43c], ecx
movsx dx, bl
lea ecx, [esp - 0x4b2aca40]
mov edx, dword [eax + 4]
call fcn.7914c4f5
invalid

Function at 0x790e570e
Capabilities:
Encrypt data using tea
Encrypt data using xtea

Disassembly:
test cl, bh
stc
add eax, dword ds:[edx + ecx*4]
rol cx, cl
lea ecx, [ecx + 0x53494ac4]
movzx cx, bl
btc cx, bp
mov ecx, dword ss:[ebp - 0x10]
cmp bl, dh
pushfd
add ecx, eax
push 0xc3635c48
mov word [esp + 4], 0x51be
mov dword ss:[ebp - 0x10], ecx
mov byte [esp], cl
lea esp, [esp + 0x48]
jmp fcn.7914109c

Function at 0x790e6f0b
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 8], ebx
jmp 0x79114c31
mov dword [ebp - 4], 0xffffffff
mov cx, word [esp]
lea ecx, [ebp + 8]
push 0x34e6ce9
jmp 0x7908d9f7
lea esp, [esp + 0xc]
call fcn.79004dc0
xadd bl, cl
mov ecx, dword [ebp - 0xc]
xadd di, bx
bts ebx, 0x10
movzx edi, cl
mov dword fs:[0], ecx
neg si
sbb di, bp
push esp
mov ecx, dword [esp + 4]
clc
inc edi
inc di
mov edi, dword [esp + 8]
lea ebx, [ebp*2 - 0x33120853]
mov esi, dword [esp + 0xc]
rol ch, 4
lea ecx, [esi*2 - 0x2f785627]
mov bl, 0x5a
add ch, 0x3f
mov ebx, dword [esp + 0x10]
add cl, 0x98
rol ch, 5
mov ecx, dword [ebp - 0x10]
pushfd
mov byte [esp + 8], dh
bt eax, ecx
xor ecx, ebp
call fcn.7913121a

Function at 0x790e7f8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x454], eax
xchg ch, dl
movzx eax, bl
mov eax, dword [ebp - 0x43c]
pushfd
not dl
mov dword [ebp - 0x4ac], eax
movsx eax, dl
pushfd
mov ecx, dword [ebp - 0x438]
rdtsc
bswap ax
mov dword [ebp - 0x4a8], ecx
rdtsc
mov edx, dword [ebp - 0x444]
jmp 0x79129125
mov dword [ebp - 0x49c], ecx
pushfd
call fcn.7903c7f0
cwde
setns ah
lea eax, [edi*8 - 0x6231d32a]
mov dword [ebp - 0x4a4], edx
lahf
pushfd
rdtsc
mov eax, dword [ebp - 0x440]
movzx dx, bl
setns dl
mov dword [ebp - 0x4a0], eax
movsx cx, cl
movzx edx, dl
lea ecx, [ebx*4 + 0x1b8f11ec]
mov ecx, dword [ebp - 0x44c]
pop edx
jmp 0x7910fc87
Function at 0x790ecffe
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, word [eax]
adc ax, 0x30c2
cwde
lahf
mov dword [ebp - 0x58], ecx
ror ax, cl
rdtsc
mov eax, 1
push 0xf53cfd37
test ch, 0x35
shl eax, 4
clc
rcr dx, 0xe
ror ch, cl
mov ecx, dword [ebp - 0x2c]
jmp 0x790ba8c6

Function at 0x790efe21
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, al
pushfd
push dword [esp + 4]
mov byte [esp], 0x90
cmc
test ecx, ecx
pushal
push dword [esp]
mov byte [esp + 0x10], dh
lea esp, [esp + 0x34]
je 0x791246f2
movsx ecx, bl
mov ch, dh
movsx cx, al
not ch
lea ecx, [ebp - 8]
push 0xdf62cda3
pushfd
lea esp, [esp + 8]
call fcn.790079f0
push edx
movzx eax, word [eax + 4]
mov byte [esp], 0x62
lea esp, [esp + 4]
jbe 0x7912243b
push esp
push dword [esp]
mov dword [esp + 4], eax
call fcn.7909933a
pushfd
mov dword [esp], eax
pushal
pushfd
mov byte [esp + 8], dh
lea esp, [esp + 0x24]
call fcn.7912ec1c
bt esi, 0x17
call fcn.791353fc
bsf edi, ebx
bsf cx, ax
shrd cx, bx, cl
pushal
mov al, 1
sub esp, 0xffffffe0

Function at 0x790eff59
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx eax, byte [ebp - 0x15]
mov byte [esp], dh
push 0x4d8c619e
lea edx, [esp - 0x2059a19c]
lea ecx, [esp - 0x4d6fd2c4]
mov dword [esp + 0xc], eax
movsx cx, dl
lea eax, [edi*2 - 0x3744ca6a]
mov dword [esp + 8], 0

Function at 0x790f222b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol ecx, 0x1b
pushfd
pushfd
bts cx, 1
mov dword [ebp - 4], eax
cdq
pushfd
push eax
mov byte [esp + 8], dh
mov eax, 1
rcr ecx, 8
rcl cl, 6
imul ecx, eax, 0
aaa
mov edx, dword [ebp - 4]
cwde
stc
bsf ax, bx
movzx eax, byte [edx + ecx]
bt si, 5
pushfd
mov dword [ebp - 0xc], eax
aaa
sbb ah, bl
add ah, dh
mov eax, dword [ebp - 4]
stc
push ecx
jmp 0x790b1a2c
add eax, 1
pushfd
pushfd
mov dword [ebp - 4], eax
call fcn.79021ad4
or cl, ah
xor cl, 0xb1
mov dword [esp], ebx
aam 0xf8
das
rdtsc
push esi
shld ax, ax, 5
bswap cx
push edi
rcl ch, cl
rdtsc
cdq
mov eax, dword [0x790748fc]
setl cl
inc dh
shr ecx, 0xa
dec cx
mov dword [ebp - 4], eax
rcl cx, 4
mov dword [ebp - 8], 0x15238958
bts ecx, eax
bt ecx, 0xa
lea ecx, [ebp - 0x37844d74]
mov eax, dword [ebp - 4]
add cl, 0xf9
je 0x7907c89a
clc
add eax, 3
cmc
jg 0x79094c7c
setle dl
mov dword [ebp - 4], eax
bts cx, 2
pushal
mov eax, 1
lea ecx, [edx - 0x460a488e]
pushal
xchg cx, dx
imul ecx, eax, 0
das
lea eax, [ecx + 0x7088f4a7]
pushfd
mov edx, dword [ebp - 4]
cmc
stc
shrd ax, di, cl
shrd ax, dx, 0xc
movzx eax, byte [edx + ecx]
clc
mov dword [ebp - 0xc], eax
adc ah, 0x58
rol al, cl
mov eax, dword [ebp - 4]
clc
cmc
pushfd
add eax, 1
call fcn.790b5929

Function at 0x790f238a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lahf
aaa
aad 0xc7
push ebp
jmp loc.790165c5

Function at 0x790f2e25
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], 0x480
lea esp, [esp + 4]
jbe 0x7907ff18

Function at 0x790f39fa
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
jne 0x7909932d
pushal
pushal
mov eax, dword [ebp - 0x38]
pushfd
push edi
push edi
mov word [esp + 4], 0xf18e
lea esp, [esp + 0x4c]
jmp fcn.79116664
Function at 0x790f4cef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x48
mov dword [ebp - 4], eax
shl ch, cl
sub cx, ax
cwde
push ebx
ror ah, 6
aad 0xd9
shr dl, 2
push esi
movzx eax, bl
jmp 0x790bb661
push edi
bswap ax
mov eax, 1
or dl, 0x21
shl eax, 0
bts cx, 8
mov ecx, 4
ror dl, cl
imul edx, ecx, 0
movsx cx, dl
mov ecx, dword [ebp + 8]
clc
pushal
push 0xef3a1d4b
mov eax, dword [ecx + eax]
pushfd
btr cx, sp
not cx
cmc
mov dword [ebp + edx - 0x14], eax
setns dh
not edx
pop ecx
mov eax, 1
btc cx, si
not dh
imul ecx, eax, 5
cdq
rdtsc
bts dx, 0xb
bswap dx
mov edx, 4
push dword [esp]
imul eax, edx, 0
ror dx, 3
neg dl
rcl dh, 7
mov edx, dword [ebp + 8]
call fcn.790da88a
wait
push 0xfffffffffffffffa
sbb byte [esi + eax], al
and al, 0x5b
scasb al, byte es:[edi]
add cl, dh
fst qword [edi - 0x7540aa33]
and eax, ebp
retf
adc ah, 0x85
push ebp
lahf
shld dx, sp, 1
not bp
shld bp, ax, cl
mov ebp, esp
xadd eax, edx
pushfd
sub esp, 0x54
stc
or eax, edx
rdtsc
mov eax, dword [0x7906c390]
seta dl
xor eax, ebp
jmp 0x79096675

Function at 0x790f5107
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x24]
call fcn.7903f230
cmc
test ah, 0xf0
test cl, 0x6d
clc
add esp, 0xc
stc
clc
cmc
cmp dword [ebp - 0x50], 0
pushal
mov byte [esp], cl
mov byte [esp + 8], ah
push dword [esp]
lea esp, [esp + 0x24]
jle 0x790d06ae
pushal
pushal
push eax
lea esp, [esp + 0x44]
jmp fcn.790db404

Function at 0x790f948f
Capabilities:
Encrypt data using tea
Encrypt data using xtea

Disassembly:
jmp 0x7912221f
call fcn.791472b2
mov edx, dword ss:[ebp + 0xc]
add ah, 0x67
mov eax, dword ds:[edx + 4]
test dh, 0x7b
stc
jmp 0x7912e966
test ah, 0x43
cmp bp, sp
mov dword ss:[ebp - 4], 0
clc
cmp dword ss:[ebp + 0x10], 0
jmp 0x7914106c
sub esp, 0xfffffff4
js 0x79027996
mov dword ss:[ebp - 0x10], eax
jmp 0x79122244
jle 0x790c989f
rol dl, 7
push 0x1b088680
clc
ror dh, 1
mov ecx, dword ss:[ebp + 0x10]
stc
movsx dx, al
pushal
imul ecx, ecx, 0x9e3779b9
inc dh
rcr dl, cl
bswap dx
mov dword ss:[ebp - 0xc], ecx
lea esp, [esp + 0x24]

Function at 0x7910c58f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ax
movzx eax, word [edx + ecx]
stc
call fcn.790a1d7d
rol ax, cl
bt ax, 9
btr edx, edx
mov eax, 1
lea ecx, [ebx*2 - 0x1eea4ce3]
clc
imul ecx, eax, 5
pushal
mov edx, dword [ebp - 8]
rcr ah, cl
btc ax, 2
cmc
movsx ax, cl
movzx eax, word [edx + ecx]
cmc
btc edx, 0x16
mov dword [ebp - 0x18], eax
ror dl, 5
not dl
pop edx
mov eax, 1
rol dl, cl
imul ecx, eax, 7
lea eax, [ebx - 0x4dcdc6b6]
cmc
pushfd
movzx ax, bl
mov edx, dword [ebp - 8]
setae al
jmp 0x790e282c

Function at 0x7910d5cd
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x10], 0x790ed87e
lea esp, [esp + 0x10]
jg 0x79130c07
push 0x880dab4d
pushal
push 0x188dfa41
push dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
pop dword [esp + 0x24]
push 0x3080e162
pushfd
pushfd
push dword [esp + 0x30]
ret 0x34
pushal
mov word [esp + 4], bx
call fcn.7907e5f9
Function at 0x7910f9b2
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jle 0x790d06ae
pushal
pushal
mov byte [esp], 0x84
push esi
lea esp, [esp + 0x44]
jmp fcn.790db404
stc
cmp dword [ebp - 0x50], 0
jmp 0x79101313

Function at 0x79110674
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.790f3663
lea esp, [esp + 0x2c]
jle 0x790fc410
ror ax, cl
mov eax, dword [0x790733c8]
btc ecx, 0x18
sub di, di
sub eax, dword [ebp - 0x14]
xchg si, bx
mov dword [0x790733c8], eax
ror al, cl
aaa
add al, ch
shld ax, sp, 8
mov eax, dword [0x790733c8]
cmc
stc
add cx, 0x422d
rcr ecx, 5
mov ecx, dword [ebp - 0xc]
and di, 0xc573
mov dword fs:[0], ecx
pushal
or bh, cl
mov ecx, dword [esp + 0x20]
bt esp, esp
xor edi, ebx
bswap cx
mov edi, dword [esp + 0x24]
cmc
bt sp, dx
inc si
bt ebx, 0x11
mov esi, dword [esp + 0x28]
bswap ebx
bts bx, cx
ror cx, 0xb
mov ebx, dword [esp + 0x2c]
shrd cx, cx, cl
shr cl, cl
rcr cx, cl
dec cl
mov ecx, dword [ebp - 0x10]
cmc
cmc
test bh, cl
xor ecx, ebp
jmp 0x790f574e

Function at 0x79118415
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
jne 0x790cad36
cmp bp, bx
pushal
clc
cmc
xor eax, eax
pushal
lea esp, [esp + 0x40]
jmp fcn.79116664
cmp dword [ebp - 0xc], 0
pushal
jmp 0x790df6c9

Function at 0x79118cb9
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
jne 0x790c0c17
bt di, cx
clc
sub eax, eax
pushal
lea esp, [esp + 0x20]
jmp fcn.79116664
clc
not ax
setp dh
clc
mov eax, 1
rcl dl, 1
imul ecx, eax, 0xc4
pushfd
setp al
cmp bh, 0x57
movzx ax, al
mov edx, dword [ebp - 0xc]
call fcn.79149963
cwde
pushfd
mov eax, 1
sets ch
clc
ror ch, 4
lea edx, [esi + 0x2e96db31]
imul ecx, eax, 0xc0
not dh
mov edx, dword [ebp - 0xc]
daa
mov eax, dword [edx + ecx]
test cl, 0x90
mov dword [ebp - 0x10], eax
cmp bh, cl
cmp dword [ebp - 0x10], 0
push esp
pushal
jmp 0x790b7293
jne 0x790cad36
bt dx, cx
sub eax, eax
push edi
lea esp, [esp + 4]
jmp fcn.79116664
lea esp, [esp + 8]
jnp 0x79126229
rol cx, 0xc
imul ecx, eax, 0xb4
bts ax, bx
mov edx, dword [ebp - 8]
shrd ax, si, 0xf
mov eax, dword [edx + ecx]
bt ecx, 0xb
mov dword [ebp - 0xc], eax
test esp, 0x2a7d0718
stc
cmp dword [ebp - 0xc], 0
jmp 0x790cb476
cmc
imul ecx, eax, 0xb4
bsr ax, di
movsx dx, bl
rdtsc
cmc
mov edx, dword [ebp - 8]
btc ax, bp
movsx ax, cl
neg ah
bts ax, bx
mov eax, dword [edx + ecx]
push 0x4c5bd891
mov dword [ebp - 0xc], eax
call fcn.79118415

Function at 0x7911a066
Capabilities:
Execute anti-debugging instructions

Disassembly:
cdq
jmp 0x790aee1b
cdq
mov eax, 1
clc
imul ecx, eax, 0xb
pop eax
lea edx, [ebx - 0x40e49a04]
ror eax, 0x1e
mov edx, dword [ebp - 0x40c]
lahf
lahf
rcl al, 3
movzx eax, word [edx + ecx]
mov dh, byte [esp + 8]
bswap cx
mov dword [ebp - 0x42c], eax
btr ax, ax
cmc
pushfd
mov eax, 1
stc
bt sp, sp
imul ecx, eax, 0xd
rol dx, cl
mov edx, dword [ebp - 0x40c]
lahf
btc ax, di
movzx eax, word [edx + ecx]
rol edx, cl
mov dword [ebp - 0x430], eax
stc
jmp 0x790f39f4

Function at 0x7911f53d
Capabilities:
Execute anti-debugging instructions

Disassembly:
imul ecx, eax, 0x2c
cwde
bswap dx
clc
rcr eax, cl
mov edx, dword [ebp - 4]
cmc
bswap ax
jmp 0x790e8584