joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790cab0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx cx, bl
pop ecx
mov dword [esp], 4
jmp 0x79105c5b
pushal
mov cx, 0x85ad
lea ecx, [ebp - 0x80]
pushfd
lea esp, [esp + 0x24]
call fcn.7901a960
cmp bl, ah
rdtsc
bsr dx, cx
rcl ah, 4
mov eax, dword [ebp - 0x74]
clc
pushfd
clc
pop edx
mov ecx, dword [eax + 8]
rdtsc
dec al
aaa
btc edx, ecx
sub ecx, 1
pushal
push ebp
pushfd
lahf
xchg dword [esp + 0x24], ecx
call fcn.7914653b

Function at 0x790cb9ad
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x44]
call fcn.7907eef8
cmc
jmp 0x7910aa2f

Function at 0x790cd756
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ch, 0x77
pushal
mov byte [ebp - 0x2e], 0x79
lea ecx, [esi + 0x22d98fbc]
lea ecx, [esi*4 - 0x2b4e1a6e]
mov byte [ebp - 0x2d], 0x49
movsx cx, dl
lea eax, [eax + 0x42913b10]
xchg cl, al
mov byte [ebp - 0x2c], 0x6e
lea eax, [eax + 0x4a84d05b]
not ch
pushal
lea eax, [ecx - 0x3573278f]
mov byte [ebp - 0x2b], 0x66
push dword [esp + 4]
cwde
push 0xe16497e1
movsx ax, bl
mov byte [ebp - 0x2a], 0x6f
cwde
mov byte [ebp - 0x29], 0x72
not ch
lea ecx, [ebp + 0x77b5999e]
mov ecx, edi
mov byte [ebp - 0x28], 0x6d
bswap cx
cwde
cwde
mov ah, 0xfb
mov byte [ebp - 0x27], 0x61
not cl
not ch
mov byte [ebp - 0x26], 0x74
pushfd
not ah
movzx cx, bl
bswap cx
mov byte [ebp - 0x25], 0x69
xchg cl, ah
not ax
not cx
mov byte [ebp - 0x24], 0x6f
mov byte [esp], dh
mov byte [esp], 0xa3
call fcn.790daafd

Function at 0x790d05c8
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x24], 0
call fcn.791093bf

Function at 0x790d2e58
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp - 0x40], 0
pushal
pushfd
lea esp, [esp + 0x28]
jl 0x790ab664
call fcn.790d597b

Function at 0x790d4e5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
pop ecx
lea eax, [ebp - 0x13c]
mov cl, byte [esp]
lea esp, [esp + 4]
jbe 0x7916fa28
push eax
lea ecx, [ebx*8 + 0x7a96aa67]
movzx cx, dl
call fcn.790754fe
mov edx, dword [ebp - 8]
sbb al, 0xb6
movzx eax, byte [edx + ecx]
movzx dx, bl
call fcn.7909778c
lea esp, [esp + 0x20]
call fcn.79036a50
call fcn.79158996
lea ecx, [edi + 0x70e87a3e]
push eax
call fcn.790b5a0a
lea ecx, [esi - 0x1f0bce8f]
jmp 0x790ef706

Function at 0x790d5e28
Capabilities:
Encrypt data using tea

Disassembly:
mov ecx, 0x7906e4d4
jmp 0x79092e66
push esp
xchg dword [esp + 0x34], ecx
not cl
jmp 0x790b703b
Function at 0x790da195
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dl, cl
push eax
rcl cl, 5
clc
mov ecx, dword [ebp - 8]
call fcn.7907ea8c
lea esp, [esp + 4]
jle 0x790817e6
not ah
inc ax
mov eax, dword [ebp - 8]
add dh, 0xe1
cmp bp, 0xa619
shr cx, 2
shl dx, cl
sub eax, dword [0x7906f540]
shld ecx, ebx, 0x1d
mov cx, ax
bts dx, 4
mov dword [ebp - 0x34], eax
xadd ah, ch
shrd cx, di, 0xc
not ecx
mov eax, dword [0x7906f548]
inc edx
sub eax, dword [ebp - 0x34]
bsr dx, ax
inc dx
sub eax, dword [ebp - 0x14]
jmp 0x79079bb1
lea esp, [esp + 4]
call fcn.790d10ed
btc ecx, 0x1c
pushal
sub cl, 0xbb
clc
add esp, 0x24
clc
not cx
movzx ecx, al
cmp cl, dh
pushal
test cl, ch
stc
test ecx, ecx
push ecx
lea esp, [esp + 0x24]
je 0x790fdaae
cwde
rol al, 1
xor al, 0x10
dec ax
mov eax, dword [ebp - 0x2c]
stc
pushfd
cmp eax, dword [ebp - 0x14]
jmp 0x790c4bc0

Function at 0x790da8ed
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
mov dword [esp + 0x1c], 0
pushfd
jmp 0x790f204b
mov dword [esp + 0x20], 0x72
mov byte [esp], 0xf0
mov dword [esp + 0x1c], 0
jmp 0x790aba2f
Function at 0x790dbc75
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror dl, cl
imul ecx, eax, 6
mov dx, ax
daa
das
rcr dh, cl
mov edx, dword [ebp - 4]
das
bswap ax
movzx eax, byte [edx + ecx]
cmc
pushal
mov dword [ebp - 0x18], eax
sets ah
xor eax, 0xc1a585d
push dword [esp + 8]
bsr eax, esi
mov eax, dword [ebp - 4]
jmp 0x790f448c
pushal
cmc
cmp dword [ebp - 0xc], 0
mov dword [esp], 0xb78d0997
lea esp, [esp + 0x20]
jle 0x7912a7fb
neg dx
movsx ecx, al
shld cx, bx, 2
mov eax, dword [ebp - 4]
clc
movzx ecx, word [eax]
stc
add edx, ebx
bsr ax, sp
adc ah, cl
mov dword [ebp - 0x10], ecx
stc
xadd ah, ch
bswap ax
mov eax, 1
btc edx, esi
btc cx, 1
bswap dx
shl eax, 1
pushal
btc cx, cx
pushfd
mov ecx, dword [ebp - 4]
ror dh, 4
mov edx, dword [ecx + eax]
xchg al, cl
mov ecx, 0x40957c1b
mov dword [ebp - 0x14], edx
rcr ah, cl
mov eax, 1
lea esp, [esp + 0x24]
jl 0x790aef86
setg ch
stc
imul ecx, eax, 6
cmc
mov edx, dword [ebp - 4]
or al, bl
cmp bp, si
stc
aaa
movzx eax, byte [edx + ecx]
stc
call fcn.79113b43
adc ebx, esp
test eax, 0x4f155468
push 0x5ca4dd99
or eax, 0xbbaa7adb
aad 0xc
add al, 0x55
stosd dword es:[edi], eax
or dword [ebp - 0x6bb8df4c], ebp
mov esp, 0xee9b601c
clc
mov dl, 0xf2
mov es, word [edx + 0x61]
popfd
add byte [edx], bl
out dx, al
scasb al, byte es:[edi]
mov dword [edx - 0x3daa1b71], 0x93e0cebd
xchg esi, eax
out 0xce, al
loopne 0x790b50d2
invalid
mov eax, 0x5caedee0
mul dword [ebx]
clc
dec edx
mov cl, 0x5d
invalid
rol cx, cl
neg dx
mov dword [ebp - 0x14], eax
mov dword [esp], ebp
ror ax, 0xb
inc edx
lahf
mov eax, dword [0x7906f548]
rol ch, cl
xadd dl, cl
bswap ecx
cmp ebx, ecx
sub eax, dword [ebp - 0x14]
clc
xadd edx, ecx
sub eax, 5
stc
pushfd
sets cl
mov dword [esp + 8], eax
call fcn.79160312
lahf
movzx eax, byte [edx + ecx]
bt dx, 0xd
mov dword [ebp - 0xc], eax
xor al, 0x3c
mov eax, dword [ebp - 4]
test al, ch
cmc
pushfd
add eax, 1
mov word [esp], 0x4a5a
cmp al, 0x72
mov word [esp], 0xbf8a
mov dword [ebp - 4], eax
lea esp, [esp + 0x28]
cmc
jmp 0x790b4fc2
add eax, 7
pushal
push 0x9156cfe7
clc
mov dword [ebp - 4], eax
inc al
bts ax, ax
clc
inc ax
mov eax, dword [ebp - 0xc]
push 0xc0245774
test bx, 0x61b7
test bl, ch
sub eax, 7
pushfd
mov dword [ebp - 0xc], eax
mov byte [esp + 0xc], cl
mov byte [esp], 0x5c
mov byte [esp], al
mov byte [esp + 8], 0x4e
lea esp, [esp + 0x50]
jmp 0x790dbcdb
rcl cx, 0xa
rcl al, 6
cwde
mov eax, 1
mov dl, 0x19
btc cx, 0xc
bt sp, bp
imul ecx, eax, 0
not dh
pushal
shr dx, 6
aas
mov edx, dword [ebp - 4]
bsf eax, ebx
movzx eax, byte [edx + ecx]
bt bx, 0xf
cmp ax, 0x5a4f
mov dword [ebp - 0x1c], eax
pushal
mov eax, dword [ebp - 4]
call fcn.79145658

Function at 0x790dc6f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x79
jmp 0x790f909d
mov dword [esp + 0x24], edx
call fcn.790b30ee

Function at 0x790de22c
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.79107e61
mov bp, dx
lea ebp, [esp + 4]
ror eax, cl
rcr eax, cl
sub esp, 0x40
js 0x790b25c8
push ebx
push 0xf066911d
mov dword [esp], esi
call fcn.7902da01
Function at 0x790e25a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7914e9c7
rdtsc
mov eax, 1
jmp 0x79089111
mov dword [esp], edx
pushal
lea esp, [esp + 0x28]
movss xmm0, dword [ecx + eax]
pushfd
push 0x1fe4ebba
lea esp, [esp + 8]
movss dword [ebp - 0x2c], xmm0
push esi
not cx
jmp 0x790e8fea

Function at 0x790e5735
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x28]
call fcn.790392b0
rdtsc
bt dx, 9
add esp, 0xc
sal dx, 5
mov eax, 0x5f
bsf dx, cx
bswap dx
test bh, dl
sbb dx, ax
mov word [ebp - 0x84], ax
movzx ax, al
rol cx, cl
rdtsc
mov eax, 0x65
setbe dl
xor cl, 0x80
btr dx, 1
mov word [ebp - 0x82], ax
rcl ax, cl
cmc
shr ch, cl
mov eax, 0x76
rol dx, cl
clc
bsr dx, dx
bswap ecx
mov word [ebp - 0x80], ax
pushal
shrd cx, si, cl
jmp 0x79165c4b
rcr edx, cl
mov dword [esp + 0x18], 0
or ax, 0xd870
bsr ax, di
movsx ax, dl
ror dl, 6
mov dword [esp + 0x14], 0
cdq
aas
not eax
test bh, 0x80
mov eax, dword [ebp - 0x14]
movsx cx, cl
movsx dx, al
sub eax, 6
pushfd
mov dh, byte [esp]
ror ch, cl
rcl dh, cl
mov dword [esp + 0x14], eax
shr ch, 3
setge dl
shrd dx, cx, 0xe
jmp 0x79145477
mov ecx, dword [0x7906e2d4]
bts dx, si
add ecx, 0xc
pushfd
xchg dword [esp + 0x14], ecx
bswap dx
mov dword [esp + 0x10], 0
pushal
lea edx, [ebp - 0x84]
seto ch
lea ecx, [ecx - 0x72758b5d]
pop ecx
mov dword [esp + 0x28], edx
lea ecx, [ebp - 0x1162f74a]
movzx cx, dl
setp ch
mov dword [esp + 0x24], 0x79058650
movsx cx, al
call fcn.79089895
pushfd
call fcn.790eea35
and al, dl
mov eax, 0x66
lea ecx, [esi*8 + 0x4734d21f]
mov word [ebp - 0x7e], ax
cwde
mov eax, 0x61
lea edx, [ebp + 0x1da87202]
mov word [ebp - 0x7c], ax
pop edx
ror cl, cl
bt si, 6
xor eax, eax
mov byte [esp + 4], 0x62
rcl ch, 3
xchg dh, ch
mov word [ebp - 0x7a], ax
setno dh
or cl, 0x68
jmp 0x790f879a

Function at 0x790e60e7
Capabilities:
Parse pe header

Disassembly:
cmc
cmp dword [ebp - 0x34], 0x211
push edx
jmp 0x790a7d6a

Function at 0x790eac7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 4]
bt dx, dx
dec cl
btc bx, 0xd
movsx ecx, dl
mov ebx, dword [esp + 8]
bsf cx, bx
movzx cx, cl
rol cl, cl
inc ch
mov ecx, dword [ebp - 4]
cmc
clc
xor ecx, ebp
mov byte [esp], 0x25
lea esp, [esp + 0xc]
jns 0x7910a17f
call fcn.79038e46
pushal
call fcn.79172daf
jmp 0x7902fac5

Function at 0x790f1cdc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x7913c800
mov ax, di
pushal
movsx dx, cl
mov eax, 1
call fcn.79147d93
test al, 0x71
pushfd
stc
mov dword [ebp - 4], edx
mov byte [esp + 4], 0xd6
cmp dword [ebp - 4], 0
jmp 0x7908fc4e
push dword [esp]
lea esp, [esp + 0x2c]
jne 0x790cea01
bt ax, 0xa
jmp 0x79162281

Function at 0x790f4e59
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
call fcn.7912de50
not ecx
pushal
jmp 0x790acab5

Function at 0x790f70cf
Capabilities:
Parse pe header

Disassembly:
pushfd
lea esp, [esp + 8]
jne 0x790cde4c
call fcn.790801e6
cmp dword [eax], 0
mov byte [esp], dl
jmp 0x790dd141
Function at 0x790f7bdc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov al, byte [eax + 0xc]
jmp 0x790967f4
lea esp, [esp + 0x1c]
call fcn.79025ac0
mov ch, 0x6f
mov ecx, 1
btr edx, 3
imul edx, ecx, 3
push 0xdc99712
push edi
push ebx
mov ecx, dword [ebp - 0x114]
pushfd
jmp 0x790b787d

Function at 0x790f88df
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x790bf132
pushfd
pushal
lea esp, [esp + 0x24]
je 0x790e4013
lahf
or cl, bh
mov eax, dword [ebp - 4]
btc cx, bp
bsf ecx, ecx
rol ch, cl
ror ch, 1
mov ecx, dword [eax]
movzx ax, al
inc ah
aad 0x78
mov dword [ebp - 8], ecx
rcl ax, 6
mov eax, dword [ebp - 4]
call fcn.79103d1d
lahf
xor ah, 0xfd
rcr al, cl
push ebp
sbb ah, 0x26
movzx ebp, cl
shrd bp, bx, cl
or ebp, eax
mov ebp, esp
shr ah, 2
sub esp, 0x7c
bswap ax
push ebx
bt si, 0xa
cdq
cmc
push esi
bts ax, 0xb
push edi
cmc
push 0xf905257e
pushfd
mov eax, dword [0x7906f540]
setnp dl
mov dx, word [esp]
mov dword [ebp - 4], eax
push 0xf87908bf
rcr ah, 2
mov dword [ebp - 8], 0
stc
mov eax, 1
btr dx, 5
btr ecx, 1
pushfd
setle dh
imul ecx, eax, 0
rdtsc
mov edx, dword [ebp - 4]
shr al, cl
bsf ax, cx
movzx eax, byte [edx + ecx]
stc
sub esp, 0xfffffff0
jb 0x79149613
pushfd
stc
test eax, eax
pushfd
lea esp, [esp + 8]
jno 0x790a0312
push 0x77c1dfd9
lea esp, [esp + 4]
je 0x790e4013
rcr cl, 1
inc ax
sbb al, 0x8a
sbb ecx, esp
mov eax, dword [ebp - 4]
bsr cx, ax
jmp 0x790f9f42

Function at 0x790f90ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
jae 0x790a287b
push 0xfa
pushal
call fcn.7908300c
pushal
pushfd
push edx
jmp 0x7914ec8f
sets al
mov eax, 1
btr cx, 0xc
call fcn.7911f768
test ah, ah
pushfd
cmp eax, dword [ebp - 0x30]
jmp 0x7913b377
pushfd
lea esp, [esp + 8]
jbe 0x790e451f
jmp 0x79085c89

Function at 0x790fc365
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x790e639d
lea esp, [esp + 4]
movss xmm0, dword [ebp - 0x30]
jmp 0x7915f069
mov dword [esp], ecx
pushfd
lea esp, [esp + 8]
je 0x790b2b89
pushfd
jmp 0x790bc545

Function at 0x790ff5d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], ebp
je 0x79175e67
add ax, 0xdf77
mov ebp, esp
pushfd
movzx cx, dl
setb ah
sub esp, 0x6c
aad 0xe0
bts ax, sp
mov eax, dword [0x79067330]
add dl, bh
xor eax, ebp
jmp 0x79149030
push ecx
mov dword [ebp - 4], eax
xchg dx, ax
rdtsc
lahf
mov dword [esp], ebx
jmp 0x790986bf

Function at 0x790ff9a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x3e8
cwde
mov eax, dword [ebp - 0x5c]
call fcn.7900ebc6

Function at 0x791013a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jl 0x790ab664
pushfd
lea esp, [esp + 4]
jg 0x79147746
clc
call fcn.790a90a5
Function at 0x79103578
Capabilities:
Check http status code

Disassembly:
test cl, bl
clc
add esp, 0xc
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.7915d1d8
clc
push 0x392c5a11
cmc
mov dword [0x7906f4c4], eax
bsf ax, dx
jns 0x790a1e0c
bsf eax, edx
mov eax, 4
clc
clc
jmp 0x790cee86
jbe 0x7915db53
pushfd
call fcn.79085124
cmpsb byte [esi], byte es:[edi]
jbe 0x790a1e02
std
xchg byte [esi], dl
dec edi
js 0x790a1d88
salc
aaa
cdq
and dword [ebx + 0x63], ebp
add dword [eax], esp
les ecx, [ebp - 0x7c0dfd85]
lea edx, [ebx + 0x67]
invalid
fisub word [eax + 0x60]
in eax, dx
push ebx
wait
mov esi, 0x25bfe5d2
mov bh, 0x30
nop
scasd eax, dword es:[edi]
mov word [edi], ss
xchg esi, eax
cdq
loope 0x790a1de2
xor esi, dword [edx - 0x30]
add eax, 0xf20e2a9f
dec edi
test byte [eax - 0xa742282], dl
nop
jle 0x790a1de2
mov esi, ebp
dec edi
adc edx, dword [ecx]
std
inc esi
mov eax, 0x572ef6f2
je 0x790a1da4
mov dword [ecx], ebx
and esp, dword [ebx + 0x66]
test eax, 0x2ebef5f9
cmp byte [esi - 0x11], ch
leave
push es
add eax, 0x698bd1c6
in al, dx
push 0xbe0cf9f
sbb bl, cl
push ecx
dec ebx
xor dl, byte [eax - 0x14]
xor eax, 0xd768ba6e
dec ebx
clc
cmp dword [ebx + 0x517a89c1], edi
loopne 0x790a1e4d
outsb dx, byte [esi]
push ebx
pop ss
in eax, dx
xor edx, eax
sbb dh, byte [edx]
mov ebp, 0x8e420
and ah, ah
or byte [eax], al
add byte [esp + eax*4], al
pop edi
inc esi
jl 0x790a1eab
imul ebx, dword [ebx + 4], 0x217f2b4f
in eax, 0x37
push esp
nop
fstp qword [edi - 0x74]
pop esi
pushal
dec esp
cwde
mov edx, 0xc4c8d2fe
ror byte [ecx - 0x27], 0x8d
push ds
clc
cld
into
ljmp 0x6c07
mov eax, 0xf2bdb668
sahf
movsb byte es:[edi], byte [esi]
cld
std
inc edx
invalid
mov byte [esp], 0x25
shl eax, 0
push dword [esp]
mov dword [esp + 4], ecx
mov byte [esp], 0xee
lea esp, [esp + 4]
movss xmm0, dword [ebp + eax - 0x40]
pushfd
lea esp, [esp + 4]
movss dword [esp], xmm0
pushal
btr dx, 4
mov ecx, 4
pushal
cmc
imul edx, ecx, 0
push 0xeb35557a
mov dword [esp + 0x40], ecx
pushfd
jmp 0x79121372
jmp 0x790a1db5
lea esp, [esp + 0x20]
call fcn.7903ab7a
sub dl, 0xf3
btc dx, 4
inc dx
pushfd
cdq
jmp loc.79031a5f
mov byte [esp], 0x13
lea esp, [esp + 0x24]
jp 0x790eaf58
jbe 0x7915db53
pushal
jmp 0x790f8e72
call fcn.790b80ac
setns bh
pushfd
not bh
fld dword [ebp - 4]
movzx di, al
xchg bx, di
bswap di
mov edi, dword [esp + 4]
not si
mov esi, dword [esp + 8]
movsx ebx, dl
mov ebx, dword [esp + 0xc]
call fcn.79124197

Function at 0x791035a6
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x10]
jne 0x790acf6a
Function at 0x79104500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
shr al, cl
mov byte [ebp - 0xdc], 0x55
daa
xor al, 0x98
btr ax, 9
mov byte [ebp - 0xdb], 0x95
shr al, 6
dec al
add al, ch
btc eax, ebx
mov byte [ebp - 0xda], 0x11
daa
mov byte [ebp - 0xd9], 0xea
shl ax, 5
neg al
bswap ax
aaa
mov byte [ebp - 0xd8], 0x88
ror ax, 8
rcr al, 3
mov byte [ebp - 0xd7], 0x6a
push dword [esp]
sal ah, 3
or ah, 0x6b
mov byte [ebp - 0xd6], 0x92
mov al, ah
lea eax, [edi*2 + 0x4721eb37]
aas
mov byte [ebp - 0xd5], 0x98
stc
shl ah, 3
mov byte [ebp - 0xd4], 0x11
movzx ax, dl
shld eax, ecx, cl
bts ax, 2
and ah, ah
mov byte [ebp - 0xd3], 0x26
ror eax, cl
test dl, dh
bt bp, sp
lea eax, [ebp*4 - 0xcadb6ee]
mov byte [ebp - 0xd2], 0x70
test cl, 0xd7
mov byte [ebp - 0xd1], 0xb6
movsx eax, dl
movsx ax, al
jmp 0x791774f4
shl ax, cl
mov byte [ebp - 0xd0], 0x72
not ah
rcr ax, cl
shl al, cl
pop eax
mov byte [ebp - 0xcf], 0x9b
and al, cl
aad 6
mov byte [ebp - 0xce], 0x11
or eax, 0xeac1114d
das
neg al
mov byte [ebp - 0xcd], 0x35
lahf
movsx ax, bl
aam 2
mov byte [ebp - 0xcc], 0xe4
adc ax, 0x1894
rol ah, cl
mov byte [ebp - 0xcb], 0xec
aaa
and ax, ax
sbb ah, bh
sets al
mov byte [ebp - 0xca], 0xcf
jmp loc.790203de

Function at 0x7910c2da
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x20], 0x6bc4a888
pushfd
push dword [esp + 8]
lea esp, [esp + 0x28]
jns 0x790bd472
push 0x9554edba
pushfd
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.7900e316
lea esp, [esp + 0x28]
jbe 0x7908e44e
lahf
mov byte [ebp - 0x39], 0
push eax
movzx eax, byte [ebp - 0x39]
pushfd
call fcn.791549fc
pushal
jmp 0x7908a98d

Function at 0x7910c8a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
fld dword [ebp - 4]
pop ebx
pop edi
movsx si, bl
jmp 0x7916f717
not bh
pop esi
mov bx, sp
setl bh
pushal
mov ebx, dword [esp + 0x20]
call fcn.790b340d

Function at 0x7910d5ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jbe 0x790ab664
call fcn.790d8a27

Function at 0x79114373
Capabilities:
Parse pe header

Disassembly:
dec al
mov eax, dword [0x7906d3bc]
test dh, 0x33
jmp 0x79111bf9
lea esp, [esp + 0x40]
jg 0x791726bf
pushfd
lea esp, [esp + 4]
jne 0x790c540b
aam 0x52
or eax, 0x8239423c
mov eax, dword [ebp - 8]
pushal
cmp eax, dword [0x7906d3b8]
pushfd
jmp 0x790d838d
shld eax, ebp, cl
sbb ax, bx
aam 0xb2
btr ax, sp
mov eax, dword [ebp - 8]
call fcn.790cf051
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
jne 0x7911e8fa
btc ax, 2
mov eax, dword [0x7906e2d4]
stc
push esi
mov byte [esp], bh
cmp dword [eax + 0xe8], 2
mov byte [esp], al
lea esp, [esp + 4]
je 0x7911e8fa
push esi
mov word [esp], bx
pushfd
push dword [esp]
lea esp, [esp + 0xc]
jmp fcn.790ad9fe
pushfd
cmp eax, dword [ebp - 8]
pushfd
lea esp, [esp + 8]
je 0x790c540b
bt cx, 3
clc
cmp ah, bh
test cx, bp
cmp dword [ebp - 0x14], 0
push ecx
lea esp, [esp + 4]
je 0x790a0321
cmc
stc
jae 0x791297ee
cmp dword [ebp - 0x14], 0xc8
call fcn.790a0317
mov word [esp], ax
lea esp, [esp + 8]
jmp 0x79080702
stc
pushal
pushal
cmp dword [ebp - 0x14], 0xc8
jmp 0x7908858f
Function at 0x791156b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp - 0x40]
push edx
lea esp, [esp + 8]
jmp int.790882c0

Function at 0x79117295
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 8]
movss xmm1, dword [ebp - 0x30]
call fcn.790f8516

Function at 0x79118f41
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
movss xmm0, dword [ebp + eax - 0x1c]
pushal
pushfd
jmp 0x7913622d
call fcn.79102552

Function at 0x79119911
Capabilities:
Packed with generic packer

Disassembly:
call fcn.7909054b
test al, 0xda
ficomp dword [ecx - 0x4cb0f0f6]
neg byte [ebp + ebx*8 + 0x549e56f7]
jmp 0x79119966
jg 0x791199d7
xor dword [eax - 0x5f], esi
arpl cx, sp
mov gs, edi
xchg esp, eax
das
or edi, edx
jb 0x7911999b
inc eax
scasb al, byte es:[edi]
mov dword [edx], eax
les eax, [esi + ebx*4]
invalid
xor ebx, eax
loop 0x791199fb
adc byte [edx - 0x2255b126], al
xchg edi, eax
jns 0x791199c0
dec ecx
mov edx, 0x6fdce7f3
mov ecx, 0x6a5fa7b1
invalid
wait
leave
in al, dx
shl dword [ecx], 0x6f
xchg ecx, eax
fsub st(3)
popal
into
ret 0xce0
in al, dx
xor dl, byte [edx + 0x6b515b01]
xchg ecx, eax
fcomp dword [esi]
sbb al, 0x66
inc cx
inc ecx
jnp 0x79119a40
pushfd
pop eax
pop eax
xor bl, byte [ebx - 0x130c853d]
jp 0x791199d8
in al, dx
jg 0x791199b9
or ebx, dword [ebp + 0x14004e73]
stosd dword es:[edi], eax
mov al, 0x8a
rol esp, cl
jp 0x79119a62
jno 0x79119a68
push ss
mov bl, 0xc7
push ebp
xchg esi, eax
add eax, 0x8e8c8f1a
jp 0x79119a71
stosd dword es:[edi], eax
call 0xfb5faf15
mov eax, esp
sub dh, dl
push ecx
mov al, 0xc6
or ah, al
lodsd eax, dword [esi]
fldenv [edi]
sub esi, dword [ebx + 6]
js 0x791199e3
add al, 0xf6
jp 0x791199ce
frstor dword [ebp + ebx*4 + 0x5b]
out 5, eax
xor edx, dword [edx]
push ds
aas
invalid
push es
invalid
mov ch, 0x47
leave
mov edx, 0x1bdc4022
fcomp qword [ebx]
adc edi, edi
pushal
mov ah, 0xdd
movsb byte es:[edi], byte [esi]
xor ch, cl
in eax, 0x34
inc ebp
int 0xe5
xor al, 0x45
xor bh, byte [ebx]
fld dword [eax + ecx*8]
insb byte es:[edi], dx
movsb byte es:[edi], byte [esi]
int3

Function at 0x7911ac61
Capabilities:
Parse pe header

Disassembly:
call 0x7916fb67
lea esp, [esp + 0x38]
jle 0x79111bf4
pushal
pushfd
mov dword [ebp - 0xc], eax
push eax
lea esp, [esp + 0x28]
jmp 0x790ee974

Function at 0x7911afb9
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x7916ad8b

Function at 0x7911bb7c
Capabilities:
Check http status code
Packed with generic packer
Parse pe header

Disassembly:
pushfd
test ax, 0x251f
cmp dword [ebp - 0x48], 0
push ebp
pushfd
pushfd
lea esp, [esp + 0x14]
je 0x7908ad3a
seta ah
call fcn.791692fb
Function at 0x7911bb9a
Capabilities:
Check http status code
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x1c], 0x38
pushal
mov dword [esp + 0x38], 0
pushfd
pushfd
pushfd
lea esp, [esp + 0x44]
call fcn.7901f940
clc
call fcn.790a85f6
pushfd
pushal
jmp 0x790d3925
mov dword [esp + 0x20], 0
jmp 0x790c4d01
xchg byte [edx - 0x5e9097d0], bl
aam 0xe2
push es
jns 0x79107164
bswap ecx
call fcn.790c893f
pushfd
mov dword [esp + 0x20], 0x38
push esp
push 0x34880cb2
push 0x6403f2c1
call fcn.79096e33
outsd dx, dword [esi]
add dword [eax + 0x18], esi
xor edx, dword [eax]
dec edi
xchg ebx, eax
fldenv [edi]
push es
push ss
aaa
mov ch, 0x13
scasd eax, dword es:[edi]
or eax, 0xbe9ff9a9
outsb dx, byte [esi]
dec dword [ecx]
push eax
enter 0x7789, 0xffffffffffffffd6
mov dword [edi - 0x2a], esi
jb 0x7910715b
fstp qword [esp + ebp*2 - 0x1bad9d24]
bound edx, qword [edx - 0x1c]
pop edx
lodsb al, byte [esi]
jo 0x791070f3
adc eax, dword [edx + eax*2 - 0x52]
mov al, 0x4e
adc al, 0xa
mov byte [edx - 0x38], bh
mov ebp, 0xc96000c5
invalid
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0x1a940246
mov word [esp + 8], 0x31cc
lea esp, [esp + 0x1c]
jge 0x790d2a52
pushal
mov dword [esp + 0x1c], 0
pushfd
mov byte [esp + 4], 0x9f
jmp 0x79107128

Function at 0x7911d89a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
push dword [ebp - 0xc]
pop dword [esp + 0x4c]
mov dword [esp], eax
push dword [ebp - 8]
pop dword [esp + 0x48]
pushfd
pushfd
push dword [ebp - 0x10]
pop dword [esp + 0x4c]
push 0xbe15eaf2
jmp 0x791158e5
call fcn.790f07d8
ror ch, cl
neg dh
push ebp
aam 8
daa
mov bp, 0x3e24
mov ebp, esp
daa
shl cl, 6
inc cl
sub esp, 0x50
not ch
shld ax, cx, cl
mov eax, dword [0x79067330]
setp ch
sar dl, 2
mov dh, 0x93
push 0xd2b757b0
xor eax, ebp
sub dx, 0xe9e6
sbb dl, 0x7b
shld cx, cx, cl
xadd ecx, edx
mov dword [ebp - 4], eax
shrd dx, dx, 6
rdtsc
mov dword [esp], ebx
shr dx, cl
push esi
bsr cx, di
push edi
ror dl, cl
mov eax, dword [ebp + 8]
bsr dx, sp
bts cx, ax
rcl ch, 6
bswap dx
movzx ecx, word [eax]
bts ax, 0xb
pushfd
mov dword [ebp - 8], ecx
cwde
rdtsc
lahf
bswap eax
mov eax, 1
add ch, 0xd7
bts dx, 3
shl eax, 1
rol ch, cl
pushal
mov ecx, dword [ebp + 8]
movzx dx, cl
jmp 0x791261f3
mov edx, dword [ecx + eax]
lahf
mov dword [ebp - 0xc], edx
bswap ecx
mov byte [esp + 4], bl
pushal
mov eax, 1
pushfd
pop ecx
imul ecx, eax, 6
push dword [esp]
cmc
pushfd
add ecx, dword [ebp + 8]
mov byte [esp + 0x10], ah
mov byte [esp + 4], 8
mov dword [ebp - 0x10], ecx
jmp 0x7908d19b

Function at 0x79120888
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], cx
mov esp, ebp
call fcn.7901cb3c

Function at 0x79121577
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0xc]
sete bl
push 0xb46ac163
mov si, word [esp + 4]
mov esi, dword [esp + 0x14]
pushfd
movsx ebx, cl
lea ebx, [eax*4 - 0x7d32435a]
mov ebx, dword [esp + 0x1c]
push edx
pushfd
lea esp, [esp + 0x28]
je 0x790e571d
pushal
mov esp, ebp
jmp 0x7917943a
movzx bp, cl
pop ebp
push 0x4c5c9de2
pushal
push 0xba6db112
push dword [esp + 0x28]
ret 0x2c