joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29149
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 4], eax
push 0x7d0da717
push ebp
push ecx
push 0xf4fc597f
lea esp, [esp + 0x14]
call sub.ntoskrnl.exe_memset
cmp bl, 0xe2
push esp
clc
add esp, 0x10
pushal
cmp dword [ebx], 0
call fcn.0002bf0e
push ebx
test bh, ah
push edx
mov byte [esp + 4], 0x81
cmp dword [ebp - 8], 5
mov word [esp], 0x762f
mov byte [esp], cl
jmp 0x3642d
cmp dword [ebp - 4], 1
pushal
lea esp, [esp + 0x24]
jne 0x3a96f
shl al, cl
shrd ax, bx, cl
shld eax, eax, 0xf
or ax, cx
mov eax, dword [0x1e2f8]
stc
stc
push 0xf3052f1b
call fcn.00021996
mov ebx, dword [ebp - 4]
cmp edx, edi
cmp dl, dl
cmp ebx, 0x10
push 0x251ab514
jmp 0x40949
pushal
lea esp, [esp + 0x28]
jne 0x3a96f
push 0x9ad82584
bt sp, dx
pushfd
add esp, 8
ja 0x396fd
cmp dword [ebp - 4], 1
call fcn.0002b4e8
push 0xe917e247
stc
jmp 0x3127d

Function at 0x2918e
Capabilities:
Check http status code

Disassembly:
test eax, eax
push edx
pushfd
lea esp, [esp + 0x10]
jne 0x262b5
inc dh
mov edx, dword [ebp + 8]
pushal
test esp, esp
cmp bh, dl
cmp byte [edx + 0x28], al
call fcn.0002ce36

Function at 0x29221
Capabilities:
Check http status code

Disassembly:
call fcn.0003d7d5
lea esp, [esp + 0x28]
call fcn.0001ad60
push 0xf111f556
test dh, dl
cmp eax, dword [edi + 4]
pushal
pushfd
push ebx
lea esp, [esp + 0x2c]
jne 0x3cd8b
bswap ax
xor ah, cl
mov eax, dword [0x1e348]
pushfd
test si, 0x9959
test eax, eax
pushal
push ecx
call fcn.00018e4a
mov byte [esp + 8], 0xbe
jmp 0x23ef3

Function at 0x2923f
Capabilities:
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
stc
cmp esi, eax
jmp 0x2bfde
test ch, 5
clc
cmp word [ecx], ax
pushfd
push dword [esp + 8]
lea esp, [esp + 0x10]
jb 0x32a1c
call fcn.0003ac33
lea eax, [edx + eax + 0xc]
clc
cmc
jmp 0x280da
lea esp, [esp + 4]
jne 0x25dca
add ax, 0x74bf
mov eax, dword [ebx + 4]
movzx si, al
jmp 0x30a4a
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
clc
clc
push ebp
mov dword [esp], edi
xor edi, 0x2bfc9c2c
lea edi, [eax + ebx + 0xc]
bsr dx, cx
mov dx, 0xfcdc
add eax, ecx
lea ecx, [edi - 0x74c7b64e]
shld cx, sp, 2
mov edx, 0x400
sal ch, 5
rcr cl, cl
shld cx, cx, 1
lea ecx, [eax + ebx + 0xc]
clc
jmp loc.0001425a

Function at 0x29435
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 8], eax
call fcn.00030671

Function at 0x295c6
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x20], esi
push ebp
mov dword [esp + 4], ecx
jmp 0x343e7
pushal
lea esp, [esp + 0x40]
call fcn.00013720
clc
sar si, 2
clc
mov esi, eax
clc
pushfd
cmc
cmp al, ah
test esi, esi
pushal
push 0x31ed51f9
lea esp, [esp + 0x28]
je fcn.00026e50
bswap edi
movzx edi, al
mov edi, dword [ebp - 4]
pushal
push eax
pushfd
jmp 0x36607
mov word [esp], sp
jmp 0x27483
mov dword [esp + 0x24], edi
jmp 0x2f0c2

Function at 0x296ee
Capabilities:
Check http status code

Disassembly:
pushfd
lea esp, [esp + 0x18]
call fcn.00018830
clc
test al, al
pushal
lea esp, [esp + 0x20]
je 0x3d426
btr cx, cx
xchg cx, ax
lea eax, [0x3a098258]
rcr ax, 0xa
mov eax, dword [esi + 4]
pushfd
shrd ecx, ebp, 0x1a
rol ch, cl
movsx cx, bl
movzx ecx, word [eax]
clc
call fcn.0003fb55
Function at 0x29b01
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
push dword [esp]
cmp al, bh
test eax, eax
push ecx
pushal
jmp 0x36f0d
lea esp, [esp + 0x30]
je 0x4032d
jmp 0x3b387
jmp 0x21a58

Function at 0x29b32
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
jmp 0x2c591
lea edx, [ebp - 0x138]
jmp 0x29747
pushal
mov dword [esp + 0x1c], eax
call fcn.000226c9
pop edx
push 0x9834caab
mov dword [esp], 0x100
push 0xa5f2474d
bswap dx
jmp 0x41ddc
movsx ax, cl
movsx ax, al
push edx
mov ah, ah
lea eax, [ebp - 4]
pushfd
push 0x88f1d125
lea esp, [esp + 8]
jp 0x2a8a4
pushal
mov dword [esp + 0x1c], eax
push 0x8b30eda3
push dword [esp + 4]
mov dword [esp + 8], ebp
mov byte [esp], dh
lea esp, [esp + 0x24]
call fcn.00013720
bsr si, cx
mov esi, eax
bt cx, si
test esi, esi
pushfd
lea esp, [esp + 4]
je fcn.00026e50
mov dword [esp], 0x13
pushal
movsx cx, cl
pushfd
lea esp, [esp + 0x24]
jbe 0x3014c
lea ecx, [ebp - 0x138]
pushfd
mov dword [esp], ecx
jmp 0x308e7
jmp 0x2954a
mov byte [esp], 0x9e
lea esp, [esp + 4]
call fcn.0001ad20
movzx edx, dl
lahf
movsx ax, bl
movzx ax, al
push esi
cwde
push str._GameData.dat
bswap ax
jmp 0x2598c
pushfd
lea ecx, [ebp - 0x138]
call fcn.000397fc
lea esp, [esp + 0x40]
je 0x4115c
jmp 0x396e3
jmp 0x39076
push 0x1e050
jmp 0x24d50
call fcn.00023013
call fcn.0002e54c
pushal
btr ax, bp
aam 0x80
mov eax, dword [0x1e2b0]
cmp al, ch
clc
bt dx, ax
bt edi, 0xc
cmp eax, ebx
pushal
mov byte [esp + 0xc], dl
jmp 0x30351

Function at 0x29c43
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 4], 0xa
mov byte [esp], al
push ebx
pushal
mov dword [esp + 0x24], esi
mov byte [esp], 0x2e
pushal
pushfd
mov dword [esp + 0x44], 0x190b0
push dword [esp]
jmp 0x351a2
not ah
movzx bx, cl
bswap dx
not al
mov edx, 0x1e284
movsx di, dl
xchg dword [edx], ecx
movzx si, al
movzx esi, dl
bswap si
pop edi
movsx bx, cl
movsx si, cl
call fcn.0002b8f6
setne ch
setb ch
mov ecx, 1
lea edx, [esi*8 + 0x3c4be256]
jns 0x2bdc5
lea edx, [eax*2 - 0x42a0ecb3]
mov edx, 0x1e284
jmp 0x2c772
lea esp, [esp + 0x48]
call fcn.00014a70
jmp 0x2db32

Function at 0x29d9b
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pushfd
pushal
mov dword [esp + 0x24], ebx
jmp loc.0001f30f

Function at 0x2a179
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
js 0x3f8b2
lea eax, [eax + ecx - 1]
push 0x6d739db1
pushal
lea esp, [esp + 0x24]
jmp 0x275c7

Function at 0x2a3dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, byte [eax + 0x1f654]
push 0x339fe6d3
push dword [edx*4 + 0x3f02e]
pop dword [esp]
push eax
push 0x9a16dc29
push dword [esp + 8]
ret 0xc
pushal
lea esp, [esp + 0x3c]
ja 0x2db7d
lea edx, [ebp - 0x36cd5c1d]
jmp 0x244c1
sal esi, 0x17
mov dword [ebp - 4], 0xc000000d

Function at 0x2a7fd
Capabilities:
Check http status code

Disassembly:
pushal
push 0x4688ed58
pushfd
mov dword [esp + 0x28], 0
jmp 0x280d5
Function at 0x2ab98
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x3c], eax
call fcn.0003b87f

Function at 0x2aba1
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 8]
je 0x138c6
cmp cl, al
bswap ax
bsf ax, dx
cmp ecx, 0x4a747dc
mov eax, dword [0x1e33c]
clc
cmp bl, ch
test eax, eax
pushfd
pushfd
call fcn.0002b0b5

Function at 0x2acc6
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
je 0x25236
movzx ax, al
bsr ax, si
mov eax, dword [ebp - 4]
stc
pushal
push dword [esp + 4]
call fcn.00024311

Function at 0x2aed5
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push edx
mov dword [esp + 8], edx
pushfd
lea esp, [esp + 0xc]
jnp 0x39d2b
lea eax, [ebp - 0xc]

Function at 0x2af54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x3eec8dd3
lea esp, [esp + 8]
jb 0x2b2b4
jmp fcn.0001f42f

Function at 0x2af8a
Capabilities:
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0x65c57a39
cmp ebx, dword [eax]
mov byte [esp], 0x71
push 0x7cb8423b
lea esp, [esp + 0x50]
jne 0x24bca
jmp 0x2c455
lea ebx, [ebx]
shl ebx, 0x1d
pushfd
mov ebx, dword [edx + eax]
jmp 0x21ae6
test si, 0x6f2b
cmc
call fcn.000411d2

Function at 0x2af9c
Capabilities:
Check http status code

Disassembly:
mov word [esp], dx
cmp dword [0x1e4f0], eax
jmp 0x2de26
pushal
pushal
push dword [esp + 4]
lea esp, [esp + 0x48]
jne 0x2769d
aad 0x5b
mov eax, dword [0x1e2bc]
stc
test eax, eax
call fcn.000369a1

Function at 0x2b105
Capabilities:
Check http status code

Disassembly:
cmp cx, 0x46e5
sub esp, 0xfffffffc
js 0x2c608
sub eax, 1
pushal
mov byte [esp + 0xc], ah
lea esp, [esp + 0x20]
jne 0x3d426
bswap si
mov esi, dword [ebp + 0x10]
bt sp, sp
cmc
cmp dword [esi + 0xc], 1
pushal
push 0xaf5c0d2c
lea esp, [esp + 0x24]
jne 0x3d426
mov cx, 0xf18f
mov eax, dword [esi]
call fcn.00028f92

Function at 0x2b2f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x22d8a
cmc
cmp word [ebx + 0xc], 2
push 0x39528e9c
lea esp, [esp + 4]
jb 0x3de30
pushal
pushal
lea esp, [esp + 0x40]
jne 0x22d8a
jmp 0x3e115
mov eax, dword [ebx + 0x10]
jmp 0x34a73

Function at 0x2b378
Capabilities:
Check http status code

Disassembly:
pushfd
call fcn.0003965c
lea esp, [esp + 0x2c]
jne 0x22d8a
push 0xc77ad79b
cwde
movzx ax, al
lahf
mov eax, dword [ebx + 0x10]
pushfd
jmp 0x35410
mov dword [esp + 4], eax
pushfd
mov byte [esp + 4], bl
lea esp, [esp + 8]
jns 0x23468
call fcn.00016ae0
bt ax, bp
test eax, eax
jmp 0x22ee2

Function at 0x2b663
Capabilities:
Check http status code

Disassembly:
mov eax, dword [ebp + 8]
not bl
mov ebx, dword [eax + 0x28]
jmp 0x41363

Function at 0x2b69a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 8], edi
call fcn.00030777
pushfd
mov dword [esp + 8], edx
jmp 0x24414
Function at 0x2b998
Capabilities:
Check http status code
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
jne 0x32a1c
pushal
test eax, eax
call fcn.0002362a

Function at 0x2bb05
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
cmc
pushfd
test eax, eax
pushfd
lea esp, [esp + 8]
jne 0x3d426
sets ch
or ah, 0xdf
setae cl
pushfd
mov ecx, 0xc2
neg al
mov ax, word [ebp - 0x20]
pushal
mov byte [esp], bh
stc
cmp ax, cx
lea esp, [esp + 0x24]
push edi
call fcn.0002b93f
mov dword [esp + 8], edx
push eax
push ebx
push dword [esp + 0xc]
jmp 0x2e721
call fcn.0002a2f5
pushfd
bt dx, 4
add esp, 0x10
jmp 0x27520
mov dword [esp + 0x10], 0
jmp 0x3568f

Function at 0x2bbe1
Capabilities:
Check http status code

Disassembly:
pushfd
stc
cmp dword [eax + 4], 0
pushal
jmp 0x31b87
lea esp, [esp + 0x28]
je 0x3d426
bswap dx
push 0x2f
mov dl, 0x5f
jmp 0x2851e

Function at 0x2bf2b
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
call fcn.0003d924
lea esp, [esp + 0x48]
je 0x25dc1
pushfd
pushal
mov dword [esp + 0x20], 0
pushfd
mov dword [esp + 4], 0x4c4bdb0f
mov dword [esp + 0x20], edi
call fcn.0001454e
pushfd
call fcn.00030615
jmp 0x3199c
test bh, 0xc8
bt cx, 1
cmp ebx, dword [eax]
lea esp, [esp + 0x28]
jo 0x2a811
jne 0x24bca
call fcn.0002d878

Function at 0x2c632
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
push 0x42cbbe90
push dword [esp + 4]
mov byte [esp], cl
push dword [esp + 0x44]
ret 0x48
jne 0x2d891
shr dl, cl
mov dl, byte [eax + 1]
test bp, 0x652
cmp dl, byte [ecx + 1]
push 0xddc5f3e1
lea esp, [esp + 4]
jne 0x2d891
clc
pushfd
call fcn.00040d7b
jmp 0x33b31
mov dword [esp + 8], esi
call fcn.000377c9
lea esp, [esp + 0x28]
call fcn.0001ad60
cmp cx, 0xbddd
pushfd
cmp dword [0x1e504], eax
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0x2bdf3
pushfd
mov dword [esp], 0x1e324
pushfd
pushfd
call fcn.0003b620
pushfd
mov word [esp], 0xbaa7
pushfd
mov dword [esp + 4], 0
pushfd
mov byte [esp], dl
mov dword [esp + 4], esi
mov dword [esp], 0x4cd2fe1a
call fcn.00040427
jmp 0x3f670
jmp 0x280b1
jmp 0x26bd4
pushal
mov byte [esp + 0xc], 0xca
pushal
mov dword [esp + 0x3c], 0x3826e
jmp 0x3a3ba
setg bl
pushfd
not bx
mov ebx, dword [ecx]
cmc
cmp ebx, dword [eax]
lea esp, [esp + 4]
pushfd
mov byte [esp + 4], 0x69
jmp 0x21961
mov dword [esp + 0x24], eax
mov byte [esp + 4], bl
pushal
pushfd
mov dword [esp + 0x44], 0x33b84
pushfd
call fcn.0002de8e
pushal
lea esp, [esp + 0x2c]
jae 0x378bf
add dl, 0x46
mov dl, byte [eax]
stc
cmp dl, byte [ecx]
jmp 0x269c3

Function at 0x2c77d
Capabilities:
Check http status code

Disassembly:
cmp dword [0x1e2a0], 0
jmp loc.000141b7
Function at 0x2c899
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
call fcn.0001ad20
not dh
movzx eax, bl
push esi
pushal
pushal
mov dword [esp + 0x3c], str._AppData.dat
bswap dx
rdtsc
rdtsc
lea edx, [ebp - 0x138]
not ax
setp al
mov dword [esp + 0x38], edx
cwde
movsx eax, dl
lea eax, [ebp - 4]
jmp 0x40d6d
mov byte [esp + 0x10], 0
mov dword [esp + 0x34], eax
jmp 0x21469

Function at 0x2cbab
Capabilities:
Check http status code

Disassembly:
jmp 0x363ae
pushfd
mov word [esp], 0xb5bb
lea esp, [esp + 0x28]
je 0x3c94f
jmp 0x2ca08

Function at 0x2cbe3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 4], 0
pushal
lea esp, [esp + 0x24]
jmp fcn.0002db87

Function at 0x2cd07
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
pushal
lea esp, [esp + 0x28]
je 0x26b1b
jmp 0x31ba2
call fcn.00040105

Function at 0x2d018
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
pushfd
pushal
mov dword [esp + 0x24], 0x22e050
pushfd
lea esp, [esp + 0x28]
call fcn.00013630
or cx, 0xe3ed
mov ecx, dword [0x1e34c]
jmp 0x25db3
clc
test ecx, ecx
push esi
jmp 0x42068
pushal
pushal
call fcn.00027604
call fcn.0002cb3b
push 0x88119e44
lea esp, [esp + 0x10]
je 0x36bbe
stc
pushal
call fcn.0003a46b
pushal
mov dword [esp + 0x3c], ecx
lea esp, [esp + 0x3c]
je 0x23ffc
pushfd
push dword [esp]
mov dword [esp + 4], 0x22e050
pushal
lea esp, [esp + 0x24]
call fcn.00013630
sbb ch, dl
test ebx, 0xf066d9b
mov ecx, dword [0x1e34c]
pushfd
call fcn.0002641f
movsx bx, dl
not bh
jmp 0x4005b
pushal
mov dword [esp + 0x1c], ecx
jmp 0x3e40d
pushal
lea esp, [esp + 0x40]
call fcn.00013630
pushal
call fcn.00032c5d
mov byte [esp + 4], 0x61
pushfd
mov dword [esp + 0x1c], 0x22e090
pushfd
jmp 0x3aeaa
push 0x3cd92940
lea esp, [esp + 0x24]
jbe 0x2beb8
pushfd
mov dword [esp], eax
jmp 0x3767d
pop ebx
lea edi, [esp + 0x76b83265]
pop edi
push 0x42e38a38
lea esp, [esp + 4]
jmp loc.00011ad2
mov byte [esp], 0x3d
lea esp, [esp + 4]
je 0x2beb8
sar eax, cl
mov eax, dword [0x1e350]
stc
cmp cx, 0xaaec
pushal
cmp eax, 0x10
jmp 0x3fa94

Function at 0x2d2ab
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
mov word [esp], sp
lea esp, [esp + 0xc]
je 0x25236
lea eax, [ebx*4 - 0xbe201fa]
mov eax, dword [ebp - 4]
call fcn.00029edb

Function at 0x2d5c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 8], ecx
mov byte [esp], 0xc8
lea esp, [esp + 8]
call sub.ntoskrnl.exe_memset
dec dh
add esp, 0xc
setge dl
lea edx, [ebp + 0x4f7f4c2b]
push 0xa70d7028
mov dword [esp], 0x11
setg dh
bswap dx
pushal
lea edx, [eax - 0x4c9e8df5]
lea edx, [ebp - 0x150]
lea esp, [esp + 0x20]

Function at 0x2d6dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jl 0x40870
rol al, 7
add ecx, dword [0x1e2a4]
movzx ax, dl
setns al
sets ah
call fcn.0002b208
Function at 0x2de45
Capabilities:
Check http status code

Disassembly:
pushfd
mov dword [0x1e2d0], ecx
push ecx
lea esp, [esp + 0x20]
jmp fcn.00026e50
jmp 0x3c59b
mov dword [0x1e2cc], edi
jmp 0x2d4ef

Function at 0x2e029
Capabilities:
Check http status code

Disassembly:
pushfd
lea esp, [esp + 0x30]
je 0x25236
not ah
rcr ah, 5
movzx ax, cl
aad 0x47
mov eax, dword [ebp - 4]
test al, 0x58
pushal
cmp eax, 0x40
push dword [esp]
mov byte [esp + 4], 0x7b
mov byte [esp], 0x16
lea esp, [esp + 0x24]
jb 0x3bb73
clc
cmp dword [ebx], eax
call fcn.00037553

Function at 0x2e309
Capabilities:
Check http status code

Disassembly:
push dword [esp]
jmp 0x2eb55
pushfd
mov dword [esp + 8], ebx
jmp 0x3c80e
jmp 0x26bdd
mov dword [esp + 0x28], 0
jmp 0x332a6
push ebp
pushfd
mov dword [esp + 0xc], esi
pushal
jmp 0x3b8a2

Function at 0x2e4f9
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], eax
push 0xf0b192cf
mov byte [esp], 0x68
mov dword [esp], str.IoInitializeTimer
jmp 0x2e646
call fcn.00014d20
push ebp
bt bp, 3
mov ecx, dword [ebp - 4]
test bl, 0xc8
pushal
rcr edi, 9
shl di, 3
mov edi, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov byte [esp], dl
cmc
pushal
test ecx, ecx
call fcn.00038bd0

Function at 0x2e51c
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
test dh, bh
mov dword [ebp + 8], eax
bt dx, 8
mov byte [esp + 8], bl
cmp bx, ax
cmp eax, dword [ebx + 0xc]
mov word [esp + 8], ax
mov byte [esp + 8], 0xa3
lea esp, [esp + 0x30]
jb 0x3a8d9
not edi
pushfd
call fcn.00026ea7

Function at 0x2e6ca
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 4]
je 0x2b6b1
lea edi, [eax*8 + 0x3b197e7e]
movzx di, cl
bswap edi
not edi
mov edi, dword [ebp - 4]
pushfd
mov dword [esp], edi
push 0xa4338f01
push 0x5a4fc53
mov byte [esp + 4], 0x4b
mov dword [esp + 4], esi
call fcn.000368ad

Function at 0x2e788
Capabilities:
Check http status code

Disassembly:
not eax
bswap ax
mov dword [esp], edx
mov al, 0xb1
push ebp
movsx ax, al
lea eax, [ebp - 4]
pushfd
pushfd
mov dword [esp + 8], eax
jmp 0x34738
mov dword [esp + 0x40], 0x35895
mov byte [esp], 0x5f
call fcn.00038558
lea esp, [esp + 8]
call fcn.00013720
shl si, 0xb
dec si
xor si, 0x6822
sub si, 0xb571
mov esi, eax
clc
test esi, esi
pushfd
call fcn.00033410
call fcn.00026af4
pushal
mov word [esp + 4], 0xb5d6
mov dword [esp + 0x1c], ebx
mov dword [esp + 4], 0x88122c07
push esi
pushal
push 0x628cf93d
mov dword [esp + 0x40], eax
pushfd
jmp 0x33e5e

Function at 0x2e7b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ch, dl
sub ecx, 4
pushfd
stc
mov byte [esp], 0x26
test dh, 0xdd
add eax, 4
call fcn.000213f8
push 0x41ec88eb
jmp 0x21c3b
cmc
bt ax, 0xb
cmp ebx, dword [eax]
push 0xbdc0cbfb
lea esp, [esp + 0x14]
jne 0x410f5
jmp 0x2713e

Function at 0x2e9b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
je 0x35296
call fcn.00037cc1
Function at 0x2eb5f
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x40870
test sp, si
test eax, eax
jle 0x3cc21
pushal
mov dword [esp], ecx
lea esp, [esp + 0x20]
jl 0x40870
call fcn.00022481

Function at 0x2ee5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x1e2bc], esi
pushfd
mov dword [0x1e2c0], edi
call fcn.00023673
lea esp, [esp + 8]
jb 0x3cd8b
pushfd
pushal
pushfd
xchg dword [esp + 0x24], eax
pop eax
call fcn.0003c326
stc
test al, al
push 0xf7b8ec37
call fcn.0002bf5c
pushal
mov ch, byte [esp + 0x10]
push eax
mov ecx, dword [0x1e4f0]
jmp 0x25073

Function at 0x2f02a
Capabilities:
Check http status code

Disassembly:
pushal
mov word [esp], 0x606f
mov dword [esp + 0x20], ecx
call fcn.000305c8

Function at 0x2f03a
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0xc]
jb 0x25236
call fcn.00032fcf

Function at 0x2f11c
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x14]
call fcn.00014d20
bsf ecx, esi
test cl, ah
sub di, bx
mov ecx, dword [ebp - 4]
bts edi, 0x1a
movsx di, dl
shrd di, cx, cl
mov edi, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
clc
cmp dl, 0x20
bt bp, 7
test ecx, ecx
call fcn.0003c71d

Function at 0x2f258
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x34]
call sub.ntoskrnl.exe_memset
and ah, bl
movsx ax, bl
add esp, 0xc
lea eax, [ebp*8 - 0x4290374e]
not al
push 0x11
jmp 0x41691

Function at 0x2f6b8
Capabilities:
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x3f459
lea esp, [esp + 0x38]
jne 0x32a1c
call fcn.00030bc1
lea esp, [esp + 0x20]
je 0x35296
movsx cx, al
ror cl, cl
shrd cx, bx, cl
bswap cx
movzx eax, word [eax + 0x10]
bsf cx, cx
btr cx, bx
mov ecx, eax
push 0xf1b08ba5
test ah, 0x5d
cmp bl, ah
and ecx, 0xff
stc
pushfd
shl ecx, 8
test bx, 0x43fa
bt si, sp
bt ax, 0xc
shr eax, 8
mov byte [esp], ch
stc
or ecx, eax
call fcn.0003c688

Function at 0x2f6be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
jne 0x3affc
sub ch, bh
rcr cx, cl
sub ch, al
and cx, sp
lea ecx, [ebp - 0x21c]
pushal
push esi
mov word [esp], 0x430b
jmp 0x37995
mov dword [esp + 0x20], ecx
call fcn.00034dfa

Function at 0x2f9bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x44]
jb 0x3cade
movzx si, bl
not si
push 0xdfaab818
mov ebx, dword [ebp - 8]
sub esp, 0xfffffffc

Function at 0x2fb16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov word [esp], 0x16b4
mov dword [ebp - 8], eax
push ebp
pushal
jmp 0x2b87c
pushfd
mov dword [ebp - 4], 0xc0000004
mov byte [esp], 0xe0
lea esp, [esp + 0x2c]
jmp fcn.0002db87
mov dword [esp + 0x50], ecx
jmp 0x30977
call fcn.00014754
pushal
lea esp, [esp + 0x20]
je 0x2b2b4
stc
stc
call fcn.0003e0d3
Function at 0x2fcad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 4], 0xffffffff
push dword [esp]
push dword [esp]
lea esp, [esp + 0x30]
jmp loc.000147a5
shr eax, 8
bt eax, edi
push ecx
or edx, eax
mov byte [esp + 8], 0x48
mov byte [esp], 0x25
mov word [ebx + 0x14], dx
jmp 0x375d9
push dword [esp + 0xc]
lea esp, [esp + 0x14]
je 0x35296
btc dx, cx
movzx eax, word [eax + 0x10]
shl dx, 1
cmp bl, ch
bt bx, 9
sete dh
mov edx, eax
push eax
bt bx, bp
and edx, 0xff
pushal
test esp, 0xe0ff4714
mov byte [esp], 0x38
cmp dh, 0x90
shl edx, 8
jmp 0x2f894
jmp 0x2760d

Function at 0x2fe97
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
call fcn.0003f3b7
mov dword [esp + 0x1c], edi
push ecx
jmp 0x308e2
mov dword [esp + 0x2c], eax
pushfd
lea esp, [esp + 0x30]
call fcn.00013720
pushal
mov esi, eax
cmc
test di, bp
test esi, esi
push esi
lea esp, [esp + 0x24]
je fcn.00026e50
movzx edi, cl
mov edi, dword [ebp - 4]
jmp 0x2b44b
pushal
jmp 0x37eb6
cwde
setno al
lea eax, [ebp - 4]
pushal
push dword [esp]
push dword [esp]
jmp 0x2abcb
jmp 0x37231
mov dword [esp + 0x1c], esi
push 0x33117020
pushal
mov dword [esp + 0x3c], 0
push dword [esp + 4]
pushfd
jmp 0x25be5
jmp 0x29f4e

Function at 0x30158
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 4], 0x7003505e
lea esp, [esp + 0x2c]
je 0x40870
jmp 0x272c8
pushfd
push 0x930aa26
stc
test eax, eax
push dword [esp]
lea esp, [esp + 0xc]
jb 0x2d6ff
push esi
lea esp, [esp + 4]
jl 0x40870
bts ax, sp
and al, 0x58
daa
add ecx, dword [0x1e2a4]
cwde
lea eax, [ebp + 0x4ed51c67]
mov eax, esp
pushal
mov dword [ebp - 4], ecx
jmp 0x27e8a
jmp 0x3c4f8
mov dword [0x1e2d8], ecx
lahf
push dword [esp]
push ecx
push 0x7c6d08f2
lea eax, [ebp - 4]
pushfd
movsx cx, al
lea ecx, [ecx + 0x3c8a4b]
mov dword [esp + 0x2c], eax
movzx cx, al
lea ecx, [ebp - 0xc]
push dword [esp + 4]
mov byte [esp], 0x82
mov dword [esp + 0x2c], ecx
mov word [esp], 0x48cd
mov dword [esp + 0x28], str.IoFreeWorkItem
push 0xe615cfc1
lea esp, [esp + 0x2c]
call fcn.00014d20
pushfd
movsx cx, bl
bt di, bp
mov ecx, dword [ebp - 4]
cmc
call fcn.00026dc4
lea esp, [esp + 0x30]
call fcn.00014d20
xchg cx, di
shld cx, cx, cl
push eax
mov ecx, dword [ebp - 4]
movsx di, al
mov edi, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp bh, al
test ecx, ecx
mov byte [esp], bl
push esi
pushal
call fcn.00026a8e
pushfd
lea esp, [esp + 0x30]
call fcn.0001b170
clc
add eax, 0x493e0
pushal
jmp 0x27565
call fcn.00038265
call fcn.00026694
call fcn.00024d08
push ecx
jmp 0x28308
stc
test ecx, ecx
jmp 0x21c01
bt di, cx
mov dword [ebp - 0x20], eax
inc al
aas
test dx, 0x4220
mov eax, dword [0x1e51c]
push ebp
jmp 0x119ed

Function at 0x3019c
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x3c]
jne 0x399f8
jmp 0x24080

Function at 0x30671
Capabilities:
Check http status code

Disassembly:
cmp bp, 0x352f
cmc
test esi, esi
jmp 0x37220
push dword [esp + 4]
lea esp, [esp + 0x10]
call fcn.00013720
mov si, ax
mov esi, eax
bt sp, ax
jmp 0x298fe