joyce8/EMBER2024-capa huggingface dataset:
Function at 0x306ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
call fcn.00013720
sub si, dx
sar esi, cl
push ecx
neg si
mov esi, eax
pushal
test esi, esi
call fcn.00035890

Function at 0x30768
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x14]
jne 0x2cf59
jmp 0x33a0c

Function at 0x307ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], edx
pushal
mov byte [esp + 4], 0xad
lea esp, [esp + 0x28]
jg 0x37dda
pushfd
lea esp, [esp + 4]
call fcn.00017030
jmp 0x307a7
jmp 0x3257c
call fcn.0001f520
bt ax, sp
test al, al
push 0x7c8705dd
pushfd
pushfd
jmp 0x2722b
push ecx
push edx
mov dword [ebp - 4], 0
mov byte [esp], bh
pushfd
push esp
lea esp, [esp + 0x10]
jmp fcn.0002db87
push esp
pushal
lea esp, [esp + 0x24]
call fcn.00017030
jmp 0x26d09

Function at 0x307d9
Capabilities:
Check http status code

Disassembly:
pushal
mov dword [esp + 0x40], 0
mov word [esp], bp
call fcn.00031978
mov dword [esp + 0x24], esi
mov byte [esp], dh
jmp 0x27d20

Function at 0x3089a
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
jne 0x3a14b
js 0x32deb
xor al, 0xdb
mov eax, dword [0x1e2c8]
pushal
push ebx
jmp 0x3a67a
neg al
mov eax, dword [0x1e2c8]
stc
cmp bh, 0xc2
test eax, eax
jmp 0x367d2
pushfd
pushal
jmp 0x18f69
call fcn.0002f38a

Function at 0x30b5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x35296
jmp 0x3fbdc
mov eax, dword [ebx + 0x16]
jmp 0x2bcfe

Function at 0x30ec5
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pop edi
inc esi
xor di, ax
cmc
bsf di, bp
movzx ecx, cl
bts edi, ecx
bsr di, dx
clc
bsr di, sp
mov edi, esi
clc
mov byte [esp], ch
cmc
add esi, ecx
adc cx, bp
movzx ecx, word [esi]
stc
add esi, 2
clc
cmp al, 5
push edi
lea esp, [esp + 0x40]
jne 0x399f8
lahf
pushfd
not ah
mov eax, dword [ebp + 0xc]
pushfd
call fcn.0003ae7a
mov byte [ebp + 0xc], cl
pop edi
jmp 0x2facf

Function at 0x30f2c
Capabilities:
Check http status code

Disassembly:
push 0xe67a203f
jmp 0x2bf83

Function at 0x311a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x4115c
pushfd
jmp 0x301c9
mov byte [esp], 0xc2
mov dword [esp], ebx
call fcn.00038aff
pushal
jmp 0x2dd9d

Function at 0x3136a
Capabilities:
Check http status code

Disassembly:
mov byte [esp], dl
jmp 0x37ad1
lea esp, [esp + 8]
jb 0x32a1c
daa
mov eax, dword [ebx + 0x34]
test al, cl
clc
call fcn.000383e4
pushfd
mov dword [esp + 0x1c], 0x295c1
call fcn.0003d251
mov word [esp], 0x35de
mov dword [esp + 0xc], 0x18cd0
pushfd
pushal
pushfd
lea esp, [esp + 0x34]
jmp 0x411f8

Function at 0x316c0
Capabilities:
Check for software breakpoints
Check http status code
Resolve function by parsing pe exports

Disassembly:
sub ecx, 4
cmp dl, 0x89
pushal
add eax, 4
pushal
clc
stc
cmp ecx, 4
mov byte [esp], bh
lea esp, [esp + 0x44]
jae 0x3738a
pushfd
pushal
push esi
lea esp, [esp + 0x28]
jmp fcn.0003bfed
Function at 0x31804
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pushal
pushal
mov dword [esp + 0x3c], 0x6c677065
mov byte [esp + 0xc], 0xf9
pushfd
call fcn.0002d662
pushal
lea esp, [esp + 0x28]
jl 0x2dc50
push 0x6c677065
push 0xd39c85fc
pushfd
pushfd
mov word [esp + 4], 0xbeea
mov dword [esp + 8], edi
pushal
mov word [esp], 0x80ab
push 0xf4699a86
push 0x98e62505
mov dword [esp + 0x2c], 0x33239
call fcn.0003f56d

Function at 0x31a3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je fcn.0002db87
stc
cmp esi, 4
pushfd
lea esp, [esp + 4]
jne fcn.0002db87
pushfd
mov edx, dword [ebx]
call fcn.0003433b

Function at 0x31b4e
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
bt ax, dx
test ch, 0x56
bt bp, sp
mov dword [ebp - 0x24], eax
sub esp, 0xffffffd8

Function at 0x31b67
Capabilities:
Check http status code

Disassembly:
jmp 0x3efdf
jmp 0x25c7d
test esi, esi
lea esp, [esp + 4]
jge 0x25cd6
je fcn.00026e50
lea edi, [ebp + 0x2e0d4499]
mov edi, dword [ebp - 4]
jmp 0x29d69

Function at 0x31ba7
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x44]
jne 0x24bca
cmc
clc
cmp ch, 4
call fcn.000316c0

Function at 0x31f74
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
test edi, edi
pushfd
lea esp, [esp + 0xc]
je 0x2b3ed
setno ch
movzx cx, bl
push 2
pushal
pushfd
pushal
lea ecx, [ebp - 8]
call fcn.0002e162

Function at 0x3218b
Capabilities:
Check http status code

Disassembly:
jmp loc.000135c1
push dword [esp + 8]
lea esp, [esp + 0x10]
jg 0x21dcd
pushfd
mov dword [esp], esi
jmp 0x2fb69

Function at 0x324ad
Capabilities:
Check http status code

Disassembly:
pushfd
lea esp, [esp + 0xc]
jp 0x4216d
je 0x25236
not eax
stc
mov eax, dword [ebp - 4]
pushfd
cmp dx, di
pushfd
cmp cl, 0xbe
cmp eax, 0x40
mov byte [esp], dl
lea esp, [esp + 8]
jb 0x3bb73
test ax, 0xc887
pushal
call fcn.000144c2
call fcn.00033c85
ror bl, 6
mov ebx, eax
stc
jmp 0x3a3b2
pushfd
test ebx, ebx
jmp 0x22ea9
call fcn.0002638b

Function at 0x324b8
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp + 0xc]
mov byte [esp], bl
pushal
jmp 0x3ab8b
lea esp, [esp + 0x24]
jae 0x275b0
pushfd
xchg dword [esp], eax
rcl al, 2
mov eax, dword [ebx + 4]
pushfd
pushal
push dword [esp + 0xc]
add eax, dword [ebp + 8]
call fcn.0003b1d9

Function at 0x325c9
Capabilities:
Check http status code

Disassembly:
call fcn.0002ecc5
mov dword [esp + 0x44], 0x32225
push 0x8a6e54c6
jmp 0x219e9

Function at 0x32764
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x14]
jne 0x33248
mov edx, 0x3f94692b
pushal
lea edx, [ebp - 0x38]
pushfd
pushal
jmp 0x41c54
mov dword [esp + 0x40], edx
pushfd
mov dword [esp + 0x40], 0x41520
jmp 0x240ea
Function at 0x32796
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
mov word [esp], 0x8c7e
mov dword [esp + 0x18], ebx
pushfd
mov dword [esp + 0x18], 0x3777e
call fcn.0003c0d2

Function at 0x3289b
Capabilities:
Check http status code

Disassembly:
call fcn.00022c01
lea esp, [esp + 0xc]
je 0x3d426
pushfd
mov dword [esp], 0x2f
jmp 0x2f9b3

Function at 0x32b34
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x28], eax
call fcn.0003e6ce

Function at 0x32b5f
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x3d426
sar cx, 0xa
shld ax, cx, cl
inc al
mov eax, dword [esi + 4]
dec cx
sub cx, 0x780f
movzx ecx, word [eax]
test bx, 0x5c4d
test cx, cx
pushal
pushfd
lea esp, [esp + 0x24]
je 0x3d426
jmp 0x39518
cmp word [ebp - 0x20], 0x5e
call fcn.00040637

Function at 0x33410
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x24]
je 0x23f9c
push esi
pushal
mov dword [esp + 0x1c], 0
mov byte [esp + 8], bl
mov word [esp], 0x4beb
lea esp, [esp + 0x1c]
call fcn.0001ad60
test bl, ch
pushfd
cmp dword [0x1e50c], eax
jmp 0x3237a
pushal
jmp 0x2f913
pushal
mov dword [esp + 0x1c], 0
mov word [esp], bx
mov dword [esp + 0x18], eax
mov byte [esp], dl
mov word [esp + 4], bp
jmp 0x3c2e6
jmp 0x40100
lea esp, [esp + 4]
jne 0x3a14b
or ah, 0xba
dec eax
test esp, 0x4549c9ea
and ah, 2
mov eax, dword [0x1e2c8]
bt bx, ax
clc
bt cx, sp
test eax, eax
pushal
lea esp, [esp + 0x20]
je 0x3ec40
jmp 0x2985b
jmp 0x36315
lea esp, [esp + 8]
je fcn.00026e50
pushal
mov edi, dword [ebp - 4]
lea esp, [esp + 0x20]
jge 0x3221a
pushfd
pushfd
pushal
mov dword [esp + 0x24], edi
jmp 0x23044
call fcn.00027949

Function at 0x33763
Capabilities:
Check http status code

Disassembly:
pushfd
mov dword [0x1e2c0], edi
mov byte [esp + 0x10], bh
mov dword [0x1e2c4], ecx
mov word [esp], dx
pushal
pushfd
lea esp, [esp + 0x38]
jmp 0x38801
Function at 0x33888
Capabilities:
Check http status code

Disassembly:
push ecx
call fcn.0002529d
pushfd
lea esp, [esp + 0x48]
jne 0x2e926
pushal
pushal
mov byte [esp + 8], 0x77
pushfd
mov dword [esp + 0x40], edi
pushfd
push 0x37cb88e9
call fcn.00036a1e
rol esi, cl
mov esi, dword [eax + ebx + 0x78]
cmp sp, 0x34c1
cmp bx, 0x7f30
bt si, 0xd
lea eax, [eax + ebx + 0x18]
push edx
test esi, esi
mov byte [esp], ah
push 0xf32efc5e
mov byte [esp], ah
jmp 0x35433
pushfd
pushfd
lea esp, [esp + 0xc]
je fcn.0003f73d
push ecx
pushal
call fcn.00022c51
jmp 0x41346
lea esp, [esp + 8]
je 0x29103
shr ax, cl
dec al
shld ax, sp, 1
or al, bl
mov eax, dword [esi + ebx + 0x20]
cmp al, 5
pushal
cmp cx, bp
mov dword [esp + 4], 0xd541ac60
add eax, ebx
push dword [esp]
jmp 0x3d1cb
mov dword [esp + 0x20], eax
mov byte [esp + 4], 0x91
push 0x709439f4
mov dword [ebp + 8], eax
call fcn.0004227f
lea esp, [esp + 0x40]
je 0x293cf
pushal
mov byte [esp], dl
cmp bx, 0x2e5a
pushfd
test eax, eax
pushfd
mov word [esp + 8], 0x26d3
lea esp, [esp + 0x28]
jl 0x293cf
cmc
add ecx, dword [0x1e2a4]
push esi
mov dword [ebp - 4], ecx
pushal
mov byte [esp + 0xc], 0xbb
pushfd
push 0xb67ba850
lea esp, [esp + 0x2c]
jmp 0x293c5
call fcn.0002fc72
push 0x5c5a8931
mov byte [esp], 3
lea esp, [esp + 8]
je 0x3affc
cmc
xor cl, ch
not cl
call fcn.00023fb5
lea esp, [esp + 4]
jnp 0x40c37
pushal
pushal
mov dword [esp + 0x3c], 0x10
call fcn.0002c3e0
pushal
pushfd
call fcn.000260f4
push 0x8ffbfd0b
push 0x40a2514
jmp 0x41c66
mov dword [esp + 0x2c], 0
pushfd
lea esp, [esp + 0x30]
call fcn.0001ad60
sub cl, 0x4f
shrd ecx, edx, 0x1e
pushal
not cx
mov ecx, dword [0x1e514]
mov byte [esp], bh
clc
cmp ecx, eax
pushfd
pushal
jmp 0x2f452

Function at 0x33d64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
je 0x31abb
bsr edx, edx
shl dl, 6
adc dl, 0xc3
mov dword [eax + 0x78], ecx
shld cx, di, 7
movzx edx, dl
movzx cx, al
rcr ch, cl
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
dec cx
mov ecx, 0x1770
cmc
cmc
cmp word [edx], cx
jmp 0x2782f
jmp 0x2f3d1

Function at 0x341be
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
call fcn.00014d20
bt cx, 0xf
mov ecx, dword [ebp - 4]
cmc
pushfd
bt ax, si
mov dword [esp], ebp
test ecx, ecx
mov byte [esp], 0x30
pushfd
push ecx
lea esp, [esp + 0xc]
je 0x250ee
bt sp, cx
test eax, eax
push 0x6962b190
lea esp, [esp + 4]
jl 0x250ee
neg edx
shr edx, 7
adc dh, 0x24
inc dh
add ecx, dword [0x1e2a4]
movzx dx, dl
pushfd
call fcn.000381e7

Function at 0x34542
Capabilities:
Check http status code

Disassembly:
mov dword [esp], edi
mov dword [esp + 4], edx
call fcn.00033b4f

Function at 0x3466f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, eax
bt bx, 7
clc
test cx, ax
test edi, edi
mov byte [esp], cl
jmp 0x3a2d8

Function at 0x34c6d
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0x73
cmp ebx, dword [eax]
push edx
lea esp, [esp + 8]
jmp fcn.000378cf
Function at 0x357a2
Capabilities:
Check http status code

Disassembly:
lea eax, [ebp - 0x138]
mov byte [esp + 8], 0x87
mov dword [esp + 0x3c], eax
pushfd
call fcn.00030527
inc eax
clc
clc
stc
test cl, cl
pushal
call fcn.00023413
pushal
mov dword [esp + 0x20], 0x100
pushal
pushfd
mov dword [esp + 0x40], eax
cwde
jmp 0x24d3b

Function at 0x35890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x39708
push esi
lea esp, [esp + 0x2c]
je 0x39ecd

Function at 0x35a2c
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push edi
pushal
push dword [esp + 4]
lea esp, [esp + 0x2c]
call fcn.0001b170
call fcn.00031be4

Function at 0x35bd2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx ax, dl
mov eax, dword [0x1e504]
pushfd
mov dword [0x1e348], esi
call fcn.00025727
test bh, dh
pushfd
jmp loc.0001f4d8

Function at 0x35e6d
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
call fcn.00013720
shrd esi, ebp, 0xb
sbb si, dx
adc si, sp
mov esi, eax
clc
clc
test esi, esi
pushal
lea esp, [esp + 0x20]
je fcn.00026e50
call fcn.00022791
mov dword [esp + 0x24], ebx
mov word [esp], ax
push edx
push edi
call fcn.00018e59
Function at 0x35fd7
Capabilities:
Check http status code

Disassembly:
pushfd
lea esp, [esp + 0xc]
jne 0x3d426
seta ch
mov eax, dword [esi]
push ecx
pushfd
pushal
mov dword [esp + 0x24], eax
lea ecx, [ebx*4 + 0x605f44e1]
jmp 0x37622
call fcn.00038abc
test esi, esi
call fcn.0002f01a

Function at 0x36030
Capabilities:
Check http status code

Disassembly:
mov byte [esp + 4], 0xa2
pushfd
pushfd
mov dword [esp + 0xc], ecx
push esp
pushal
jmp 0x3cc3f
mov dword [esp], 0x4b931395
lea esp, [esp + 0x30]
call fcn.000171d0
pushal
mov byte [esp], 0x32
lea esp, [esp + 0x20]
jmp 0x3d426

Function at 0x36205
Capabilities:
Check http status code

Disassembly:
pushfd
mov dword [0x1e2c4], ecx
push dword [esp + 4]
push dword [esp]
mov dword [esp + 0xc], eax
lea esp, [esp + 0x40]
jmp 0x38801

Function at 0x36454
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], ecx
push 0x4fced1a6
lea esp, [esp + 0xc]
jne 0x3d426
or ah, cl
mov ecx, 0xc2
rol ah, cl
sal ax, 0xf
mov ax, word [ebp - 0x20]
pushal
cmp ax, cx
mov byte [esp], ch
lea esp, [esp + 0x20]
jb 0x34449
setno dh
setp dl
pushal
mov dword [esp + 0x1c], 0x6e726567
bswap dx
movzx dx, al
not dl
mov edx, dword [ebp - 0x1c]
mov byte [esp + 4], ah
push 0x8b438cb9
mov dword [esp + 0x1c], edx
pushal
mov byte [esp], 0xa0
mov byte [esp + 4], 0x56
mov dword [esp + 0x38], 0x4228c
mov word [esp], si
mov dword [esp], ecx
push dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop dword [esp + 0x34]
push esi
push dword [esp]
push edx
pushfd
push dword [esp + 0x44]
ret 0x48

Function at 0x36987
Capabilities:
Check http status code

Disassembly:
mov dword [0x1e2d0], ecx
pushfd
lea esp, [esp + 0x2c]
jmp fcn.00026e50

Function at 0x369a1
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 4]
je 0x4032d
pushal
pushal
push dword [esp]
mov dword [esp + 0x40], 0
jmp 0x3c1c1
push dword [esp + 0x14]
pushfd
mov dword [esp + 0x44], eax
jmp 0x40745
pushfd
mov dword [esp + 0x44], 0x2a92b
call fcn.00030369

Function at 0x36a8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, esi
pushfd
push dword [esp + 4]
jmp 0x38162

Function at 0x36b9d
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 0x24], 0x400
pushal
pushfd
mov dword [esp + 0x44], 1
pushfd
pushfd
pushfd
mov byte [esp], 0x41
mov dword [esp + 0x4c], 0x29f58
pushfd
mov byte [esp + 4], 0xbc
call fcn.00022cda
jmp 0x2ac99

Function at 0x36ec3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
je 0x39ecd
push edx
mov edi, dword [ebp - 4]
call fcn.00035ba9

Function at 0x36ed6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x24], 0
pushal
push 0xb7b8bf49
jmp 0x334eb

Function at 0x370c1
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
pushfd
lea ebx, [ebx]
test ax, 0x9b50
mov ebx, dword [edx + eax]
push esp
jmp loc.00013c17
pushal
sub edx, esi
jmp 0x30e3b

Function at 0x370c9
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x2979a
call fcn.0003ae83
Function at 0x37203
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push edx
call fcn.00037cfe
pushfd
mov dword [esp + 0x28], edi
jmp 0x25e32
lea ecx, [ebx + 8]
push dword [esp]
mov dword [esp + 4], ecx
mov dword [esp], 0xa3e1f4ff
mov dword [esp], 0
call fcn.0002e3d5
je 0x38801
pushal
mov edi, dword [ebp - 4]
pushfd
push esp
jmp 0x32599

Function at 0x376a0
Capabilities:
Check http status code

Disassembly:
test eax, eax
mov byte [esp], 0x5b
lea esp, [esp + 4]
je 0x3d05d
pushal
mov dword [esp + 0x1c], 0
call fcn.0003e15b

Function at 0x37886
Capabilities:
Check http status code

Disassembly:
call fcn.0003fdcf
push dword [esp + 8]
mov dword [esp + 0x2c], str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
pushfd
jmp 0x2bb2c

Function at 0x3799e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sar cx, 2
mov ecx, eax
pushfd
cmp ch, 0x9b
and ecx, 0xff
call fcn.0002a835
push dword [esp]
lea esp, [esp + 0x10]
je 0x35296
dec cl
movzx eax, word [eax + 0x10]
sal ch, cl
jmp 0x34cfb

Function at 0x37cde
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x28], eax
call fcn.00034185
push str.REGISTRYMACHINESYSTEMCurrentControlSetServices_
mov dh, ch
not dl
mov dx, 0xa88b
not dl
lea edx, [ebp - 8]
call fcn.00041a02

Function at 0x37cfe
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x2c], esi
jmp 0x3c36c
mov dword [esp + 0x28], 0
jmp 0x226ce

Function at 0x37e57
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x38]
jb 0x13eb6

Function at 0x381e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setns dl
mov dword [ebp - 4], ecx
setbe dl
pop edx
lea edx, [eax*8 - 0x45edfb6]
setne dh
mov dword [0x1e2d4], ecx
jmp 0x3af7c
not dx
jmp 0x3344b

Function at 0x38341
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pushfd
mov word [esp], 0x1b4b
mov dword [esp + 8], edx
push dword [esp]
lea esp, [esp + 0xc]
call fcn.00013720
bsr esi, ebp
rcr si, cl
mov esi, 0x8859b12b
shr si, cl
mov esi, eax
pushal
cmp cl, 0x13
test esi, esi
mov word [esp + 0x14], 0xeb03
lea esp, [esp + 0x20]
je fcn.00041f77
shr bl, cl
mov ebx, dword [ebp - 4]
clc
cmp ebx, 0x10
jns 0x23958
jbe 0x2bdf3
jmp 0x288c0

Function at 0x383e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov dword [ebp - 0x1c], eax
jmp 0x30909

Function at 0x383ed
Capabilities:
Check http status code

Disassembly:
pushal
mov dword [esp], ecx
lea esp, [esp + 0x28]
jne 0x3a96f
lea eax, [0x4bcc4844]
mov eax, dword [0x1e2f8]
test al, 0xd
cmp eax, ebx
pushfd
lea esp, [esp + 4]
je 0x3a96f
call fcn.00013a43

Function at 0x38459
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
lea esp, [esp + 0x34]
jbe fcn.0002db87
pushfd
mov dword [esp], esi
call fcn.00032e0d

Function at 0x384b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x11
not dl
mov dl, 0x8b
lea edx, [ebp - 0x150]
jmp 0x3a3c5
call fcn.0003ee7f
Function at 0x38625
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
push 0x9eab934d
jmp 0x35113
push ebp
pushal
pushfd
mov dword [esp + 0x24], 0
push dword [esp + 4]
mov dword [esp + 0x24], eax
push edx
pushfd
pushfd
pushfd
mov dword [esp + 0x30], 0x276d8
push edi
jmp 0x42056
mov dword [esp], eax
jmp fcn.00038f24
call fcn.00018d50
lea esp, [esp + 4]
je 0x3ec40
push 0x1ddfbcc3
mov byte [esp], 0x61
lea esp, [esp + 4]
js 0x2eebc
push 0
jmp 0x2dc65
mov byte [esp], dh
mov dword [esp + 0x30], ebx
push eax
mov byte [esp + 0xc], 0xc1
push dword [esp + 0x34]
ret 0x38
pushfd
call fcn.0003d99c
jmp 0x3c77a

Function at 0x38957
Capabilities:
Check http status code

Disassembly:
jmp 0x37bfc
pushal
lea esp, [esp + 0x20]
je 0x39ecd
pushal
mov word [esp], 0x2239
mov edi, dword [ebp - 4]
mov byte [esp], ch
pushfd
push dword [esp]
pushfd
mov dword [esp + 0x28], edi
mov byte [esp + 0x24], 7
pushfd
jmp 0x28f19
pushfd
jmp 0x3cd9f
lea esp, [esp + 0x3c]
call fcn.00013720
add si, 0xdeaa
mov esi, eax
cmc
stc
test esi, esi
jmp 0x35699

Function at 0x38bd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0x7e6f
pushfd
mov word [esp], 0xbb65
lea esp, [esp + 0x4c]
je 0x34fb4
push eax
test eax, eax
pushal
push dword [esp]
call fcn.00025584

Function at 0x38bf4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
test eax, eax
pushfd
push dword [esp]
mov byte [esp], 0x93
lea esp, [esp + 0x30]
je 0x3c974
stc
bt bx, dx
pushal
bt cx, 0xb
cmp eax, ecx
pushal
mov byte [esp], al
mov byte [esp + 0xc], 0x7d
lea esp, [esp + 0x40]
jae 0x3c974
bts cx, ax
xor cl, bh
lea ecx, [esi*8 + 0x5d62cde1]
mov ecx, eax
cmc
pushal
add edi, 0x28
mov byte [esp + 8], 0x80
cmc
sub edx, 1
call fcn.0003576d
lea esp, [esp + 0x48]
jbe 0x39b95
pushfd
add edi, 0x10c
clc
movsx edx, bl
mov edx, eax
test ecx, 0x61972fb7
inc eax
shrd ax, dx, cl
mov eax, dword [edi]
jmp 0x21c57

Function at 0x38de7
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0xc], eax
mov byte [esp + 4], 3
push eax
jmp 0x378da
push ecx
jmp 0x2bb31

Function at 0x39140
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
test al, al
pushal
lea esp, [esp + 0x24]
je 0x34fb4
sete al
movzx ax, dl
mov al, cl
call fcn.000216eb

Function at 0x3915b
Capabilities:
Check http status code

Disassembly:
mov dword [esp], ebx
pushfd
pushfd
pushfd
call fcn.00039d3d
not cx
not cx
mov cx, 0x17b1
lea ecx, [ebp - 0x150]
jmp 0x347fb

Function at 0x39772
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
jae 0x3c974
sal ecx, 6
sar ch, cl
push edx
dec cx
mov ecx, eax
jmp 0x23c27

Function at 0x39836
Capabilities:
Check http status code

Disassembly:
and edi, 0xa3538670
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0x100
pushfd
call fcn.0003c63b
cmp eax, dword [ebp - 0x10]
pushfd
mov byte [esp], 0x26
pushfd
pushfd
lea esp, [esp + 0x10]
jb 0x25236
jmp 0x3f7e2
pushal
lea esp, [esp + 0x20]
call fcn.0001b170
clc
bt sp, 2
add eax, 0x1388
jmp 0x29fc9