joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79022b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x7906c390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
movzx eax, byte [0x7907475f]
test eax, eax
je 0x79022b4b
mov eax, 1
jmp 0x79022cf1
mov eax, dword [0x79073250]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.7903c840
add esp, 4
mov dword [ebp - 0xc], eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [0x79073248], eax
cmp dword [ebp - 0x10], 0
je 0x79022cef
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.7903e010
add esp, 0xc
mov dword [ebp - 0x14], fcn.79041ccb
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xe9
jne 0x79022bc5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 5]
mov dword [ebp - 0x14], eax
jmp 0x79022be4
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xeb
jne 0x79022be4
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx], 0x1b8
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax], 0x12c200
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x50
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x79022cef
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov edx, 0x79022c5d
mov dword [ebp - 0x70], edx
mov eax, 0x79022c9f
sub eax, edx
mov dword [ebp - 0x6c], eax
jmp 0x79022c9f
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.7903e010
add esp, 0xc
push 0x50
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x68]
call eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [0x7907475f], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.7903edc6
mov esp, ebp
pop ebp
ret

Function at 0x79027bc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror ax, 0xe
pushfd
movsx eax, word [edx + ecx]
rcl cl, cl
ror dh, 5
mov dword [ebp - 0x28], eax
movzx edx, dl
bt dx, 0xc
cdq
rdtsc
mov eax, 1
bts dx, di
clc
stc
imul ecx, eax, 0x15
not al
push dword [esp]
mov edx, dword [ebp - 4]
btc ax, bx
pop eax
mov eax, dword [edx + ecx]
not cx
ror dh, 6
bswap dx
mov dword [ebp - 0x2c], eax
jmp fcn.791050e0
Function at 0x7902ea49
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x40c], eax
mov byte [esp], 0xad
lea esp, [esp + 0x38]
jmp fcn.790cf44f

Function at 0x7903843d
Capabilities:
Execute anti-debugging instructions

Disassembly:
setno ah
movzx eax, word [edx + ecx]
jmp fcn.790d6095

Function at 0x790394a8
Capabilities:
Packed with generic packer

Disassembly:
pop eax
bswap ecx
mov dword [ebp - 8], ebp
bswap ax
mov eax, dword [ebp - 8]
movzx cx, al
mov ecx, 0xe75479bf
movzx cx, cl
mov ch, 0xaf
push eax
movsx cx, al
pushal
mov ecx, dword [ebp - 4]
push esp
mov dword [esp + 0x20], ecx
mov byte [esp + 0xc], bl
lea esp, [esp + 0x20]
call fcn.790ff345
rcr dh, cl
movsx dx, dl
jmp loc.790d7111

Function at 0x7903c6a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
stc
mov byte [esp], 0x37
sub al, al
mov byte [esp], bl
mov byte [esp], ah
pushfd
push 0x5ea6625d
lea esp, [esp + 0xc]
jmp fcn.79124703
Function at 0x7907a467
Capabilities:
Check http status code

Disassembly:
jmp 0x79126d6f
push dword [esp + 4]
call fcn.7908c832
pushal
pushfd
lea esp, [esp + 0x24]
je 0x790b6059
pushfd
bt di, cx
pushfd
bt ax, dx
cmp dword [ebp - 0x24], 0
jmp 0x790822b0
cmp ch, 0x9e
cmp eax, dword [ebp - 0x2c]
jmp 0x7909e1a1
test ch, 4
rcr eax, 0x12
jle 0x79131ed9
lea eax, [0x9049158c]
mov eax, dword [ebp - 0x1c]
bt ebx, ebx
push edi
call fcn.79011b56
lea esp, [esp + 8]
je 0x79126d9c
test bp, 0xc084
cmp dword [ebp - 0x28], 0x211
pushfd
push 0x4e84281a
pushfd
mov word [esp], 0x99b
lea esp, [esp + 0xc]
jne 0x790b42a8
clc
push 0xc6fbda2d
cmp dword [ebp - 0x30], 0
push dword [esp]
lea esp, [esp + 8]
jg 0x790b42a8
pushal
call fcn.7914105c
call fcn.7907d9d2
dec ah
mov eax, dword [ebp - 0x1c]
cmp bh, ah
clc
jmp 0x790ab0e9

Function at 0x7907bf0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
test eax, eax
pushal
pushfd
lea esp, [esp + 0x28]
je fcn.790335b0
bswap cx
not cl
mov ch, 0xf7
call fcn.79085802

Function at 0x7907bf29
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jb 0x790ae479
call fcn.79003170
jmp 0x79118371
xchg ah, ch
not edx
mov dword [ebp - 4], 0
lahf
push edi
rdtsc
mov eax, dword [ebp - 0x18]
mov dword [esp], ebx
not edx
mov dword [esp], eax
push esp
call fcn.7910eb0d
call fcn.7908a236
push es
int1
xor byte [ebx - 0x3e], dl
rcl dword [ecx - 0x55], 0x9b
stosb byte es:[edi], al
insb byte es:[edi], dx
aam 0xa9
outsd dx, dword [esi]
or dword [ebx + 0x4e], esp
mov byte [0xeaa75861], al
dec esi
mov esp, 0x75657e8c
fnstcw word [ebx]
or ecx, dword [ecx]
and eax, 0x793943e7
wait
jae 0x790ae50e
fiadd dword [ecx + 0x3d]
sbb dword [ebx - 0x15fb778a], esp
mov dl, 0x96
jno 0x790ae4fb
fiadd word [ebp - 0x80]
push esi
test al, 0x16
mov ch, 0x8d
xchg edi, eax
scasd eax, dword es:[edi]
and byte [esi + edx*8], ch
leave
adc dword [0x476d028], ecx
sahf
pop es
mov esi, 0xae83b680
mov ah, 0x81
xchg esi, eax
invalid
jl 0x790ae552
mov ecx, 0x1f38df43
pop ecx
sub eax, 0x59fdbe57
jecxz 0x790ae511
imul ebx, dword [ebp - 9], 0x8b35276f
daa
xor eax, 0xb369d98b
fldcw word [ecx - 0x4d]
invalid
movzx ecx, al
mov byte [ebp - 0xf], 0x75
bswap eax
mov byte [ebp - 0xe], 0x6e
xchg cx, ax
xchg ch, al
pop eax
mov byte [ebp - 0xd], 0x74
jmp 0x79131d27
lds ebx, [eax - 0x3a]
inc ebp
je 0x790ae542
retf 0x837
pushfd
movzx si, dl
mov dword [ebp - 0x10], eax
pushfd
cdq
lea esp, [esp + 8]
popal
not ax
mov eax, dword [ebp - 0x10]
push edi
push dword [esp]
mov dword [esp], ebp
push edx
lea esp, [esp + 0xc]
jmp fcn.79121280
jmp 0x79099edf
movsx ax, bl
mov byte [ebp - 0xc], 0
call fcn.790965c9
mov byte [esp], bl
mov dword [esp], 0x86f7d1da
pushfd
pushal
call fcn.7912750b
jmp 0x790c6e33

Function at 0x79080073
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x50]
call fcn.79004dc0
jmp 0x790968d9
pushal
mov al, ah
pushfd
mov al, byte [ebp - 0xee]
push eax
pushfd
lea esp, [esp + 0x2c]
jmp 0x791498cc
Function at 0x79082cbb
Capabilities:
Access peb ldr_data

Disassembly:
xor ax, sp
movsx ax, cl
btr eax, esp
mov eax, dword [0x790733c8]
setne ch
bts ecx, 7
sub eax, dword [ebp - 0x14]
shrd edi, ebp, 0x14
mov dword [0x790733c8], eax
movsx cx, bl
movsx ax, cl
mov eax, dword [0x790733c8]
adc cx, dx
shr bl, 6
dec cx
inc ecx
mov ecx, dword [ebp - 0xc]
stc
mov dword fs:[0], ecx
dec bl
btr si, di
mov ecx, dword [esp + 4]
push 0x3a9bdc34
btc di, 0xa
shld cx, bx, 6
sbb edi, 0xbd89967
mov edi, dword [esp + 0xc]
dec bx
pushal
add ebx, 0xe9267444
xor si, di
mov esi, dword [esp + 0x30]
pop ebx
mov ebx, dword [esp + 0x30]
push 0xf5b80ade
shrd ecx, edi, 6
clc
call fcn.790f5558

Function at 0x79085fe8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec al
adc ax, cx
mov byte [ebp - 0x130], 0xae
btc ax, 0xf
sar ax, 1
bt cx, ax
mov byte [ebp - 0x12f], 0x88
shld ax, ax, cl
sal ah, cl
mov byte [ebp - 0x12e], 0xa5
setge ah
mov byte [ebp - 0x12d], 0x22
clc
mov byte [ebp - 0x12c], 0x12
bt esi, 0xe
mov byte [ebp - 0x12b], 0x54
rcl ah, cl
sar ax, cl
mov byte [ebp - 0x12a], 0x19
inc ah
mov byte [ebp - 0x129], 0xc6
das
push 0x6b024f45
pop eax
aaa
mov byte [ebp - 0x128], 0x4e
cwde
sal al, 2
cwde
bsr ax, cx
mov byte [ebp - 0x127], 0x25
shld ax, bx, 1
shrd ax, si, 0xe
mov byte [ebp - 0x126], 0x12
shld ax, bx, cl
mov byte [ebp - 0x125], 0x62
and al, bh
aas
jmp 0x7909dbae
rcl eax, cl
mov byte [ebp - 0x124], 0x43
rol ax, 8
bswap ax
btr ax, 6
sub ax, bx
mov byte [ebp - 0x123], 0x12
rcr eax, cl
bswap ax
mov byte [ebp - 0x122], 0xc8
cmp bl, bh
sal al, cl
mov byte [ebp - 0x121], 0x28
bts eax, 0xf
daa
mov byte [ebp - 0x120], 0x12
sets al
aam 0x66
mov byte [ebp - 0x11f], 0xd1
aam 0x77
cmc
lea eax, [esp + 0x1dc1398c]
and al, 0x64
mov byte [ebp - 0x11e], 0x5f
aas
mov byte [ebp - 0x11d], 0x25
sub ah, ah
aas
bsf ax, bp
mov byte [ebp - 0x11c], 0x4f
cwde
cwde
mov byte [ebp - 0x11b], 0x2b
bsr eax, edx
mov byte [ebp - 0x11a], 0x12
shrd eax, esi, 8
stc
mov byte [ebp - 0x119], 0x6c
sub ah, 0x2f
sar ax, 4
bt si, bp
dec al
mov byte [ebp - 0x118], 0xcd
btr eax, 0xb
mov byte [ebp - 0x117], 0x31
movsx ax, bl
sbb eax, 0x67b4c400
adc eax, 0xf7ce48bd
mov byte [ebp - 0x116], 0x5b
rcl al, 6
bsr eax, ecx
mov byte [ebp - 0x115], 0x2e
btc eax, ebx
rcl ah, 5
mov byte [ebp - 0x114], 0x12
bts ax, bp
mov byte [ebp - 0x113], 0x9c
dec al
mov byte [ebp - 0x112], 0x44
inc ah
clc
not ah
mov byte [ebp - 0x111], 0x11
sub ax, bx
ror ax, 5
btc ax, 0xc
mov byte [ebp - 0x110], 0xba
bts ax, 2
movsx ax, bl
mov byte [ebp - 0x10f], 0x31
test ah, ah
ror ah, 7
mov byte [ebp - 0x10e], 0x12
sete al
or ah, 0xfe
mov byte [ebp - 0x10d], 0x89
cmp ch, dl
mov byte [ebp - 0x10c], 0xfc
mov ah, dh
sal eax, 0xf
mov byte [ebp - 0x10b], 0x97
cmc
mov byte [ebp - 0x10a], 0x3a
movzx ax, dl
test bl, dh
mov byte [ebp - 0x109], 0x34
inc al
cmc
mov byte [ebp - 0x108], 0x12
bts eax, esp
mov byte [ebp - 0x107], 0x8e
call fcn.791471d6
push esi
mov dword [0x7907350c], eax
call fcn.790d1701
Function at 0x79087e76
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0xc4], ecx
push 0x12948b91
jmp 0x790f051e
push eax
pushfd
lea esp, [esp + 0x14]
jge 0x790cb594
cvttss2si ecx, dword [ebp + eax - 0xb8]
cwde
rdtsc
jmp 0x7907ed93
call fcn.7914340e
mov edi, dword [eax - 0x729ab144]
invalid
movzx ax, cl
lea eax, [eax*2 - 0x7cffde5c]
movzx eax, byte [ebp - 0x15]
mov ecx, dword [esp]
pushal
movsx dx, bl
pushal
xchg dword [esp + 0x40], eax
jmp loc.7902dc5a

Function at 0x7908a676
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x7e967fe3
push esi
mov dword [esp + 0x2c], ecx
call fcn.7909914d
movzx dx, dl
xchg ch, dh
xchg dword [esp], eax
movzx cx, dl
push 0
not dx
mov ecx, dword [ebp - 0xc]
mov dh, ch
rdtsc
movzx dx, bl
jmp 0x790cd4ef
push ecx
lea edx, [eax*8 + 0x175dca9]
not cx
movsx dx, cl
rdtsc
mov edx, dword [ebp - 0xc4]
not cx
pushfd
mov dword [esp], edx
cwde
push eax
push 0x577adb64
mov eax, dword [ebp - 0xc0]
lea ecx, [eax*8 + 0x58f0bfa]
mov dword [esp + 4], eax
xchg ch, dh
pushal
jmp 0x790e1274
mov ecx, dword [ebp - 0xbc]
push 0x94c95d90
jmp 0x7907dd88

Function at 0x7908bd9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
shld edx, ebx, 0x13
inc al
add ecx, dword [ebp - 0x1c]
jmp 0x790f8bf7
rcl ax, 3
ror dh, cl
mov dword [ebp - 0x34], ecx
cwde
not eax
mov eax, 1
bts dx, 0xd
rol cl, 1
bswap dx
rol edx, cl
imul ecx, eax, 0x16
stc
bsr ax, sp
and ax, 0xcf21
pop eax
add ecx, dword [ebp - 0x1c]
rcl ah, cl
cwde
mov byte [esp], 0xc9
movsx dx, bl
mov dword [ebp - 0x38], ecx
rcl eax, cl
mov eax, 1
movzx cx, bl
ror dl, 6
lea ecx, [eax - 0x230879fc]
setb dl
imul ecx, eax, 0x1e
rdtsc
xor dx, 0x7a9e
push eax
add ecx, dword [ebp - 0x1c]
clc
rdtsc
rcr dx, cl
cdq
mov dword [ebp - 0x3c], ecx
lea eax, [ecx - 0x31d8f105]
mov eax, 1
btr dx, 6
bswap ecx
btc dx, 0xb
imul ecx, eax, 0x26
shrd eax, eax, 0xb
xadd al, dh
add ecx, dword [ebp - 0x1c]
xchg edx, eax
clc
mov dword [ebp - 0x40], ecx
cdq
call fcn.79094ed3
int1
sub edx, esi
fst qword [eax - 0x6d]
fild qword [0x22b6ff0d]
cmc
mov esp, 0x218aab27
mov byte [eax - 0x51], dl
add dl, byte [esi]
les ebx, [esi + edi + 0x3b]
lodsb al, byte [esi]
lds ebx, [ebp + 0x75]
aad 0xec
in al, 0x4c
cmpsb byte [esi], byte es:[edi]
into
les esp, [ecx + 0x2d4f90ff]
sub edx, ecx
xor dh, byte [ebx + 0x1529f59b]
int3

Function at 0x7908bff2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 4
pushfd
jmp 0x790d105e
push eax
rdtsc
lahf
movzx cx, al
bswap cx
push 0
movzx ax, al
mov ecx, dword [ebp - 0xc]
setno dl
movsx ax, al
rdtsc
push ecx
mov dh, 0xe6
pushal
mov edx, dword [ebp - 0xc4]
movsx ax, cl
pushfd
push dword [esp]
mov dword [esp + 0x24], edx
rdtsc
setb al
jmp 0x790f5454
shl eax, 1
push ebx
mov dword [esp], 0x7172a7c4
pushal
lea esp, [esp + 0x2c]
cvttss2si ecx, dword [ebp + eax - 0xb8]
lahf
lahf
cdq
mov dword [ebp - 0xc4], ecx
movsx dx, al
movzx eax, byte [ebp - 0x15]
not edx
mov dl, bl
jmp 0x790af84a

Function at 0x7908c832
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x10]
je 0x790b6059
mov ah, 0xac
das
mov eax, dword [ebp - 8]
clc
jmp 0x790fa951
Function at 0x79091df7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 4]
pop eax
movzx eax, word [edx + ecx]
lea ecx, [ebp*2 + 0xc4efdc]
mov dword [ebp - 0x44], eax
ror ax, 6
movzx ax, al
rdtsc
btr dx, dx
mov eax, 1
movsx ecx, dl
pushal
cmc
not edx
imul ecx, eax, 0x29
pushfd
mov edx, dword [ebp - 4]
push 0xa7c99911
pushfd
push 0xb6185972
movzx eax, word [edx + ecx]
mov byte [esp], 0x98
lea esp, [esp + 0x38]
jns 0x790b7bab
pushfd
mov dword [ebp - 0x48], eax
mov dword [esp], ecx
pushal
push esi
pushfd
lea esp, [esp + 0x2c]
jmp 0x790f4ff0
cmc
rcr eax, cl
push dword [esp + 4]
movzx eax, word [edx + ecx]
bt edi, 0x1c
movzx cx, bl
clc
ror ecx, cl
mov dword [ebp - 0x40], eax
rdtsc
mov eax, 1
bts dx, ax
imul ecx, eax, 0x25
ror ax, cl
cmc
jmp 0x790905c2
pushal
jmp 0x7913cc69
rcl al, cl
ror eax, 9
shl al, 1
sar al, 5
mov eax, dword [ebp - 0x10]
test dh, 0x62
add eax, 1
call fcn.790ed548
pop ecx
call fcn.79034866
call fcn.79114061

Function at 0x790978b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov eax, 1
push esp
mov ecx, 0xb5ee523e
imul ecx, eax, 0
das
sar dl, 3
bswap dx
inc dh
mov edx, dword [ebp - 4]
sar di, 3
btc di, 1
bsf edi, edi
mov eax, dword [edx + ecx]
shrd di, di, cl
mov dword [ebp - 8], eax
rdtsc
mov eax, 1
dec di
shl eax, 2
bts edx, 0x15
shld si, si, 8
mov ecx, dword [ebp - 4]
sbb bh, bl
sar si, 1
xadd dh, bl
rcl di, 7
mov edx, dword [ecx + eax]
rol ch, 5
mov dword [ebp - 0xc], edx
bsr dx, dx
shrd cx, bp, 5
bswap ecx
mov eax, 1
sbb cl, ch
dec di
sar dx, cl
add esp, 8
jne 0x7911cf1c
shl eax, 3
btc dx, si
bts ecx, 0x12
rol ecx, 3
mov ecx, dword [ebp - 4]
mov dh, dl
stc
btc dx, 0xd
mov edx, esp
mov edx, dword [ecx + eax]
movsx bx, dl
mov dword [ebp - 0x10], edx
lahf
mov eax, 1
bts dx, cx
not dl
movsx di, dl
imul ecx, eax, 0xc
movzx dx, bl
mov edx, dword [ebp - 4]
pushal
mov eax, dword [edx + ecx]
push dword [esp]
mov dword [ebp - 0x14], eax
sete bl
jmp 0x7914dd2d
stc
inc di
sar di, 0xa
dec dl
shl eax, 3
cmc
clc
mov ecx, dword [ebp - 4]
xchg bl, dh
btc dx, 0xc
cmc
mov edx, dword [ecx + eax]
jmp 0x7913afe1
push esi
bswap di
mov edi, dword [esp + 0x28]
bswap bx
mov esi, dword [esp + 0x2c]
setge bl
setnp bh
call fcn.79104511
mov dword [esp + 0x20], 0x86f0d65d
mov dword [esp + 0xc], 0x96ee1da3
mov word [esp + 4], 0x190c
mov dword [esp + 0x1c], 0x751ec229
pushal
pushfd
lea esp, [esp + 0x40]
jmp fcn.79007a65

Function at 0x79097fe9
Capabilities:
Packed with generic packer

Disassembly:
cmp eax, dword [ebp - 0x14]
pushal
push 0x658ba8fa
pushfd
push dword [esp + 4]
lea esp, [esp + 0x30]
je 0x7911665d
xadd ch, al
aas
lea eax, [ecx - 0x255908a6]
bsr cx, si
mov eax, dword [ebp - 0x10]
rcr cl, 6
push 0xf453e324
bswap ecx
mov ecx, dword [eax]
cmc
mov dword [ebp - 0x38], ecx
pushfd
cmc
jmp 0x790af026
jmp 0x79083814
bsf di, cx
mov eax, dword [ebp - 0x34]
Function at 0x7909a65d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ax, 0x87d6
setne ah
mov edx, dword [ebp - 8]
rcr eax, 0x12
pop eax
test bh, 0x36
sub ax, ax
mov eax, dword [edx + ecx]
stc
rcl dh, 2
xor eax, dword [ebp - 0x14]
jmp 0x7913dcc5
stc
xchg dx, cx
mov dword [ebp - 0x30], eax
rcl ch, cl
lahf
rol cx, cl
mov eax, 1
mov cx, word [esp + 4]
not dx
bts dx, bp
ror cx, cl
imul ecx, eax, 0x13
rdtsc
cdq
mov edx, dword [ebp - 8]
cwde
dec ax
rcl al, cl
mov eax, dword [edx + ecx]
bsf dx, dx
xor eax, dword [ebp - 0x14]
rcl ch, 6
bts edx, edx
btr cx, dx
mov dword [ebp - 0x34], eax
rol al, cl
rdtsc
rcr ah, 1
lea eax, [edi*2 + 0x16d9f5f2]
mov eax, 1
lea esp, [esp + 0x50]

Function at 0x790a2d33
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x40c], eax
pushfd
lea esp, [esp + 0x4c]
jmp fcn.790cf44f

Function at 0x790a3278
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror dword [edi], cl
int 0xe8
push eax
mov edi, edi
jmp dword [esi + 0xf]
invalid
invalid
lea esp, [esp + 8]
comiss xmm1, xmm0
call fcn.7907bef3
daa
in eax, 0x34
pop edi
mov esi, 0xc77f3cfd
dec ebp
loope 0x790a32d7
adc edi, ecx
and al, 0xbf
xchg ebx, eax
imul ecx, esp, 0xb58d6fef
push edi
ret
sahf
jbe 0x790a3270
nop
pop ss
dec ecx
mov byte [eax - 0x4de9fdee], bh
lcall 0xe4ac, 0xaad01147
xor eax, 0x49ee4a7a
lcall 0xd911, 0xa3b29496
mov byte [eax + 0x2a1c10a9], bl
retf
mov word [esp + 8], cx
stc
mov byte [ebp - 0x20], 0x65
clc
mov byte [ebp - 0x1f], 0x78
bt bp, ax
call fcn.790d6b47
pushfd
lea esp, [esp + 0x24]
addss xmm0, dword [0x7905d728]
pushfd
lea esp, [esp + 4]
movss xmm1, dword [ebp + ecx - 0x88]
push 0x65b91993
push esi
jmp 0x790a329c

Function at 0x790a328f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xc
push 0x8f7d3cc2
jmp 0x79021d6f

Function at 0x790aecab
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwde
bswap edx
ror ecx, 2
mov eax, 1
btr edx, esi
imul ecx, eax, 7
bts ax, di
mov edx, dword [ebp - 0x40c]
pushal
btr ax, 0xa
movzx eax, word [edx + ecx]
call fcn.7913e79b
bt cx, sp
cdq
mov edx, dword [ebp - 0x40c]
not ax
movzx eax, word [edx + ecx]
bt si, cx
setae dh
btc dx, bp
mov dword [ebp - 0x420], eax
lea esp, [esp + 0x4c]
lahf
clc
js 0x79086dae
cwde
mov eax, 1
bswap dx
lea edx, [esp - 0x7ce7fe5b]
imul ecx, eax, 7
pushfd
mov edx, dword [ebp - 0x40c]
lea eax, [ebx - 0x22f48d71]
btr ax, 2
push 0x126272b4
movzx eax, word [edx + ecx]
btc dx, 1
lea edx, [esp + 0x6b429ee2]
mov dword [ebp - 0x424], eax
bswap ax
rdtsc
setg ah
mov eax, 1
lea esp, [esp + 8]
Function at 0x790af3d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts cx, si
mov eax, 1
btc cx, di
mov word [esp], si
btc dx, 1
bts dx, bx
imul ecx, eax, 0xc
inc dl
not ah
btr ax, cx
add ecx, dword [ebp - 0x414]
clc
push 0x6f796be7
rdtsc
lea edx, [eax + 0x5afdcefb]
mov dword [ebp - 0x42c], ecx
movzx dx, cl
rcr ah, cl
lea edx, [esp + 0x79177940]
mov eax, esi
mov eax, 1
mov dh, ch
imul ecx, eax, 0x14
movzx dx, dl
shld dx, dx, 0xc
lea eax, [edx*2 - 0x644549a4]
add ecx, dword [ebp - 0x414]
xchg dh, ah
xchg dh, ah
setl ah
rdtsc
mov dword [ebp - 0x430], ecx
bt sp, 0xe
cwde
mov eax, 1
ror cx, cl
imul ecx, eax, 0x1c
cmp bl, 0x10
add ecx, dword [ebp - 0x414]
clc
mov dword [ebp - 0x434], ecx
movzx cx, bl
mov eax, dword [ebp - 0x42c]
rcl ch, 1
mov ecx, dword [eax]
bts dx, 5
bswap dx
rcl dl, cl
push 0xfc6df13e
mov dword [ebp - 0x43c], ecx
call fcn.790830af
mov eax, dword [ecx + eax + 4]
btc ecx, 9
push edx
rcr dh, 3
clc
mov dword [ebp - 0x424], eax
jmp 0x790a8c80

Function at 0x790b1968
Capabilities:
Execute anti-debugging instructions

Disassembly:
imul ecx, eax, 0xd
pop edx
mov edx, dword [ebp - 4]
stc
movsx eax, word [edx + ecx]
setl dh
mov dword [ebp - 0x1c], eax
rdtsc
bswap ax
rdtsc
rdtsc
mov eax, 1
stc
btc dx, 1
rcr dh, 2
imul ecx, eax, 0xf
push dword [esp]
rcr dh, 7
not eax
mov edx, dword [ebp - 4]
clc
lahf
movsx eax, word [edx + ecx]
mov dx, word [esp]
pushfd
mov dword [ebp - 0x20], eax
pushal
rcr dl, 1
bswap cx
movsx dx, cl
mov eax, 1
jmp 0x790cd78f
Function at 0x790b34c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.79109c5e
outsd dx, dword [esi]
loopne 0x7909d1f0
retf 0x743d
aaa
adc eax, 0x5d4fcb4d
sub byte [0x5103adbf], ah
lodsb al, byte [esi]
dec eax
leave
out dx, eax
outsd dx, dword [esi]
or byte [ebx + 0x5bca50f8], 0x77
invalid
sets ch
pushfd
lea ecx, [ebp*8 + 0x70533105]
pushal
mov ecx, dword [eax]
pushfd
pushfd
mov dword [esp], ebx
lea esp, [esp + 0x2c]
jmp 0x790e128e
imul ecx, eax, 0
adc edx, edx
inc dl
shrd edx, ebp, 0x1b
cmc
mov edx, dword [ebp - 0x414]
aaa
aaa
and eax, 0x57f400ef
push 0xfc7bf067
movzx eax, byte [edx + ecx]
lea esp, [esp + 0x10]
jb 0x790d1706
sub cx, bx
neg cl
mov dword [ebp - 0x41c], eax
rdtsc
movsx dx, bl
mov eax, dword [ebp - 0x414]
xor cl, 0xcc
add eax, 1
bts cx, bx
bts cx, bx
cmc
mov dword [ebp - 0x414], eax
das
sar ch, cl
cwde
setle ah
mov eax, dword [ebp - 0x414]
shld cx, bp, 1
shrd cx, bx, cl
mov ecx, dword [eax]
rcr dx, 3
bts dx, 6
mov dword [ebp - 0x420], ecx
btc ax, 0xd
daa
rcl ch, cl
mov eax, 1
rol ch, 4
setle dh
call fcn.79012c28
movzx cx, dl
pushal
mov dword [ebp - 0x80], eax
pushfd
jmp 0x7909d1a0
bts eax, eax
mov dword [ebp - 0x430], ecx
bts eax, 0x1e
mov dx, 0x36f4
bswap dx
mov eax, 1
ror cl, cl
imul ecx, eax, 0x1c
inc dh
add ecx, dword [ebp - 0x414]
movzx dx, bl
cwde
mov dword [ebp - 0x434], ecx
rdtsc
lahf
mov eax, dword [ebp - 0x42c]
movsx dx, cl
pushfd
mov ecx, dword [eax]
setae dh
pushfd
mov dx, cx
mov dword [ebp - 0x43c], ecx
movsx ecx, bl
pushfd
push dword [esp + 4]
movzx cx, bl
mov edx, dword [eax + 4]
jmp 0x790e1533
cmc
clc
mov eax, 1
not dh
not ch
bt esp, esi
stc
imul ecx, eax, 0x14
rdtsc
bt dx, dx
mov byte [esp], 0x4e
ror eax, cl
add ecx, dword [ebp - 0x414]
jmp 0x790c151f
lea edx, [edx - 0x2d295007]
mov dword [ebp - 0x41c], eax
cmp bl, 0xfa
mov eax, dword [ebp - 0x414]
rol edx, cl
rcl dx, 1
add eax, 1
dec edx
inc ch
bswap edx
mov dword [ebp - 0x414], eax
inc ax
setnp ch
shr dh, 5
sete ch
mov eax, dword [ebp - 0x414]
rcl dh, cl
mov ecx, dword [eax]
xadd ah, dl
lahf
bt ax, 6
sar al, cl
mov dword [ebp - 0x420], ecx
aam 0xd8
inc al
stc
mov eax, 1
xchg cx, dx
test bl, bl
shl eax, 2
lea ecx, [edi + 0x683cde55]
rol dx, cl
mov ecx, dword [ebp - 0x414]
movsx dx, cl
lea edx, [ebx + 0x6414b553]
mov edx, dword [ecx + eax]
push esi
pushfd
jmp 0x790e5145
btc edx, esp
mov dword [ebp - 0x444], ecx
rol edx, 0xd
call fcn.790eb5b6
lea eax, [esi + 0x3c9eff8d]
pushfd
cwde
mov dword [ebp - 0x438], edx
lahf
pushfd
mov eax, dword [ebp - 0x430]
setns ch
lea esp, [esp + 0x3c]
js 0x790a49f8
movsx cx, dl
bswap ecx
mov ecx, dword [eax]
push 0xbea37db3
lea esp, [esp + 4]
jmp 0x790e128e
mov word [esp], 0x593b
mov dword [ebp - 0x428], edx
not dl
mov edx, dword [esp + 4]
mov eax, dword [ecx + eax + 4]
rcr ecx, 0x1e
stc
mov dword [ebp - 0x424], eax
setae ch
mov eax, 1
bt bp, cx
setb dl
cmc
movzx dx, bl
imul ecx, eax, 0xc
or al, ah
das
pop eax
add ecx, dword [ebp - 0x414]
movsx dx, al
bts dx, bp
pushal
rcr al, cl
mov dword [ebp - 0x42c], ecx
jmp 0x790caf6c