joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe65fc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.pe1
lea edi, [esi - 0x903000]
push edi
jmp 0xe65fda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe65fe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe65fd0
mov eax, 1
add ebx, ebx
jne 0xe65ff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe66004
jne 0xe66023
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe66023
dec eax
add ebx, ebx
jne 0xe66010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xe65fe8
add ebx, ebx
jne 0xe6601f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xe66075
xor ecx, ecx
sub eax, 3
jb 0xe6603b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe660aa
sar eax, 1
mov ebp, eax
jmp 0xe66046
add ebx, ebx
jne 0xe66046
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe66014
inc ecx
add ebx, ebx
jne 0xe66054
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe66014
add ebx, ebx
jne 0xe66061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe66056
jne 0xe66072
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe66056
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe66094
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe66086
jmp 0xe65fd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe66094
add edi, ecx
jmp 0xe65fd6
pop esi
mov edi, esi
mov ecx, 0x4a80
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe660b2
cmp byte [edi], 0x2e
jne 0xe660b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe660b7
lea edi, [esi + 0xa63000]
mov eax, dword [edi]
or eax, eax
je 0xe6612f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaad0a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaad0f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe660e4
mov ecx, edi
jns 0xe66113
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaad0fc]
or eax, eax
je 0xe66129
mov dword [ebx], eax
add ebx, 4
jmp 0xe66101
call dword [esi + 0xaad0f8]
mov ebp, dword [esi + 0xaad100]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe66163
sub esp, 0xffffff80
jmp 0x42eb30
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040a7e3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040a7e3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040a7e3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040a7e3
mov dword [0x41203c], eax
call fcn.0040a7e3
test eax, eax
jge 0x402550
push 8
call fcn.0040a7e3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040a7e3
pop ecx
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040a7e3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040a7e3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040a7e3
jmp 0x402495

Function at 0x40a7e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40a7f2
pop dword [ebp - 0x28]
mov eax, 0xf68cbb87
sub eax, 0xf64c1395
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x36c2f
push 0
mov eax, 0x54d102f6
add eax, 0xab6fdde2
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x1eab5fc8
add ecx, 0xe154de6e
xor edi, edi
add edi, eax
mov ebx, 0x10b01421
sub ebx, 0x106ed85d
add ebx, dword [ebp - 0x28]
mov esi, 0x6bef1a51
sub esi, 0x5f545b15
sub dword [ebp - 4], 0x6cc299cb
mov edx, dword [ebx]
sub dword [ebp - 8], esi
xor edx, esi
add dword [ebp - 0xc], edi
mov dword [edi], edx
sub dword [ebp - 8], 0x36d6d7f1
add edi, 0x62af40ec
sub edi, 0x62af40e8
add ebx, 4
loop 0x40a853
add eax, 0x59f45189
sub eax, 0x59f365de
xor ebx, ebx
add ebx, eax
add eax, 0xf8e6c5c7
add eax, 0x7193a3e
mov ecx, 0xa8436ab5
add ecx, 0x57fc954b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x6081c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x6081da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6081e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6081d0
mov eax, 1
add ebx, ebx
jne 0x6081f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6081e8
jne 0x608204
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6081e8
xor ecx, ecx
sub eax, 3
jb 0x608218
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x60828a
mov ebp, eax
add ebx, ebx
jne 0x608223
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x608230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x608254
inc ecx
add ebx, ebx
jne 0x608240
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x608235
jne 0x608251
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x608235
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x608274
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x608265
jmp 0x6081d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x608274
add edi, ecx
jmp 0x6081d6
pop esi
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x6082d3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9cb0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x608291
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9cb8]
or eax, eax
je 0x6082cd
mov dword [ebx], eax
add ebx, 4
jmp 0x6082ae
call dword [esi + 0x9cb4]
mov ebp, dword [esi + 0x9cbc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x608307
sub esp, 0xffffff80
jmp 0x6013c8
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, reloc.gdi32.dll_GetRgnBox
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x161e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x161e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x161e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x161e06a
add dl, dl
jne 0x161e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x161e0dc
xor eax, eax
add dl, dl
jne 0x161e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x161e17d
add dl, dl
jne 0x161e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x161e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x161e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x161e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x161e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x161e075
mov eax, 1
add dl, dl
jne 0x161e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x161e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x161e0e1
sub eax, ebx
mov ebx, 1
jne 0x161e128
mov ecx, 1
add dl, dl
jne 0x161e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x161e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x161e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x161e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x161e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x161e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x161e136
cmp eax, 0x7d00
jae 0x161e16d
cmp eax, 0x500
jb 0x161e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x161e075
cmp eax, 0x7f
ja 0x161e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x161e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x161e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x161e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80d004]
jne 0x40100a
repz ret
jmp fcn.004011ef

Function at 0x4030bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040206e
and dword [ebp - 0x14], 0
cmp dword [0x80faac], 0
mov dword [ebp - 0x18], eax
jne 0x40316e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403216
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403216
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x80faac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x80fab0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x80fab4], eax
call edi
push eax
call esi
mov dword [0x80fabc], eax
test eax, eax
je 0x40316e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x80fab8], eax
mov eax, dword [0x80fab8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4031c7
cmp dword [0x80fabc], ecx
je 0x4031c7
push eax
call esi
push dword [0x80fabc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4031c7
test ebx, ebx
je 0x4031c7
call edi
test eax, eax
je 0x4031be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4031be
test byte [ebp - 8], 1
jne 0x4031c7
or dword [ebp + 0x10], 0x200000
jmp 0x4031fa
mov eax, dword [0x80fab0]
cmp eax, dword [ebp - 0x18]
je 0x4031fa
push eax
call esi
test eax, eax
je 0x4031fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4031fa
mov eax, dword [0x80fab4]
cmp eax, dword [ebp - 0x18]
je 0x4031fa
push eax
call esi
test eax, eax
je 0x4031fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80faac]
call esi
test eax, eax
je 0x403216
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403218
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x4054d0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [str.nvB]
sub esp, 0x10
push esi
mov esi, dword [0x854e70]
push edi
mov edi, dword [0x85514c]
push eax
call fcn.004053c0
add esp, 4
cmp dword [0x85514c], 0x2f
jne 0x405530
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Bihux_nivew_zuziduzaz_winojego_roli
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call fcn.00405410
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4057b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x85514c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x4057d2
push 0
push 0
call edi
mov eax, dword [0x85514c]
cmp esi, 0x845013
jne 0x4057e9
mov eax, dword [0x80e930]
add eax, 0xa231
mov dword [0x85514c], eax
cmp eax, 0x141
jne 0x405804
mov dword [0x80ffe8], 0xec58acac
mov dword [0x80ffec], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x4057c0
call fcn.00405540
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.00401537
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x4019de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, esi
add ebx, 0xc8
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, edi
shl eax, cl
cdq
idiv ebx
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x401a7c
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
jmp 0x401a17
add dword [ebp - 0xc], ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jl 0x401a11
mov ecx, dword [ebp - 8]
cmp eax, ecx
jne 0x401a30
mov eax, dword [ebp + 0xc]
add eax, esi
mov ebx, eax
sub ebx, dword [ebp - 0xc]
or ebx, ebx
je 0x401a8d
and dword [ebp - 0x14], 0
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
or edx, esi
add edx, eax
push edx
mov edx, dword [ebp - 0x18]
xor edx, esi
add edx, eax
push edx
call fcn.00401970
add esp, 0x20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x7e8
jl 0x401a38
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, esi
dec edx
and eax, edx
cmp dword [ebp - 4], eax
jle 0x401a07
pop edi
pop esi
pop ebx
leave
ret
Function at 0x606efd
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
dec al
jmp 0x71d8df
mov byte [esp + 0xc], 0x49
lea esp, [esp + 0x54]
ja 0x6fcd54
jmp 0x6fa91c
push 0xcefb89d3
mov dword [esp], 0xbd8cf7fc
push dword [esp]
lea esp, [esp + 8]
jb 0x61e19a
stc
test bl, 0x56
cmp byte [edi - 1], 0
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x71f8e5
clc
bt eax, ebp
dec di
mov edi, dword [edx + 0x24]
test dh, dh
bt bx, 1
add edi, eax
pushfd
movzx ecx, word [edi + ecx*2]
mov bh, 0xc
dec edi
xor di, sp
add di, sp
pushfd
shld di, cx, cl
mov edi, dword [edx + 0x1c]
test ebx, ecx
bt di, 7
pushal
add edi, eax
stc
pushfd
pushfd
mov edi, dword [edi + ecx*4]
push ebx
push 0x5dd37adc
test edi, edi
call fcn.0061dc4c
jge 0x6fa95e
int3
cmp si, bp
stc
bt cx, bx
cmp al, byte [edi]
movsx ax, cl
lea edi, [edi + 1]
pop eax
mov eax, dword [esp + 0x50]
jmp 0x607a61

Function at 0x60889e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushal
pushfd
mov dword [esp + 0x40], eax
sets al
mov al, dl
push eax
setb al
lodsb al, byte [esi]
clc
pushfd
clc
sub al, 0x4f
jmp 0x71f568
mov byte [esp], dh
push ebp
lea esp, [esp + 8]
jb 0x61e19a
clc
cmp byte [edi - 1], 0
pushfd
lea esp, [esp + 4]
jne 0x71f8e5
shr edi, cl
lea edi, [ebp*8 - 0x63903941]
bswap edi
sbb di, 0x4e22
mov edi, dword [edx + 0x24]
stc
stc
pushfd
add edi, eax
cmp ah, dl
bt bp, 1
stc
clc
movzx ecx, word [edi + ecx*2]
lea esp, [esp + 4]
or dl, 0x14
push esp
mov bl, 0xb8
pop ds
jl 0x71f577
jg 0x71f55a
adc bh, al
invalid
adc esp, dword [ecx - 0x8f9da4e]
retf 0x8476
call fcn.0070b27d
push ebp
or dword [edx], 0xffffff83
mov dl, 0x8b
fisttp qword [ebx]
cmp dword [ebx + 0x50], 0xffffffc3
mov edi, 0xa5a0b638
and ebx, dword [esi]
cdq
adc dword [ebx], ecx
pop es
jbe 0x71f529
push eax
ret
outsd dx, dword [esi]
mov ch, 0x24
invalid
jbe 0x606aad
pushfd
jmp 0x61d4be

Function at 0x60a560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jb 0x61e19a
clc
stc
push 0x85a35126
stc
cmp byte [edi - 1], 0
mov word [esp], 0x27f8
mov word [esp], bx
lea esp, [esp + 4]
jne 0x71f8e5
shl di, 2
neg di
mov edi, dword [edx + 0x24]
push ebp
add edi, eax
pushfd
movzx ecx, word [edi + ecx*2]
not edi
mov edi, dword [edx + 0x1c]
pushfd
clc
add edi, eax
push edi
clc
stc
push dword [esp]
mov edi, dword [edi + ecx*4]
cmp dl, bl
jmp 0x6fa915
clc
call fcn.0070ca38
cmc
jmp 0x71d7bb
pushal
lea esp, [esp + 0x20]
je 0x650ec1
clc
cmc
clc
test bx, 0xddf0
cmp ah, 0x2e
pushfd
pushfd
push dword [esp + 8]
ret 0xc
test edi, edi
jmp 0x72042e
or ah, ah
jmp 0x61e989
pushal
lea esp, [esp + 0x34]
je fcn.006062a2
test bh, cl
jmp 0x60ab27

Function at 0x61d342
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + 0x20]
pushfd
lea esp, [esp + 0x28]
ja 0x6fcd54
jmp 0x64fd7f
call fcn.0060a560
Function at 0x61da1e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x72ec68ac
mov byte [esp + 8], 0xf
mov dword [esp], eax
lea esp, [esp + 0x50]
je fcn.006062a2
pushfd
stc
clc
jmp 0x61fd89
lea esp, [esp + 0xc]
jb 0x61e19a
pushal
bt dx, bx
pushal
cmp byte [edi - 1], 0
push dword [esp + 4]
lea esp, [esp + 0x44]
jne 0x71f8e5
adc di, ax
sub edi, ebp
mov edi, dword [edx + 0x24]
pushal
pushfd
cmc
add edi, eax
pushal
movzx ecx, word [edi + ecx*2]
pushfd
mov edi, dword [edx + 0x1c]
stc
push eax
bt bp, 2
add edi, eax
test bl, dl
mov edi, dword [edi + ecx*4]
cmc
cmc
bt ax, ax
test edi, edi
jmp 0x607105
add eax, edi
cmp bl, bl
stc
jmp 0x7066a4
mov word [esp], bx
cmp eax, edx
mov byte [esp], 0x53
push esi
lea esp, [esp + 8]
jb fcn.006062a9
test bl, 0xa9
call fcn.0070567e

Function at 0x64fdec
Capabilities:
Encode data using xor

Disassembly:
in al, 0x38
out 0x80, eax
cli
xor al, 0x55
push dword [esp]
mov dword [esp + 0x2c], ebx
call fcn.0070a6c4
loopne 0x64fe16
xchg bl, bh
mov edi, 0x153b0749
push es
fst qword [edx - 0x33]
inc esp
les edi, [edi]
cmp edi, dword [ecx]
xor eax, 0x11a6262e
add dword [ecx + 0xd], 0x3fa1380f
cmpsb byte [esi], byte es:[edi]
jnp 0x64fe33
jge 0x64fddc
xchg ebp, eax
mov edi, 0x44019c0c
shl byte [esi - 0x31], 1
cmp eax, ecx
test al, 0x1a
xadd cl, dl
adc byte [edx], 6
sbb cl, byte [edi]
rcl cl, 0x80
adc al, byte [esi]
call 0x7b1f20de
cmp dl, byte [esi]
jp 0x64fe6f
push ss
xchg esp, eax
pop esp
xor byte [ecx - 0x5d27b692], 0x81
jecxz 0x64fe28
or bl, ch
mov eax, 0xdd144cd6
sbb al, 0x86
in eax, 0x53
xchg dword [0xccd77ce6], ecx
nop
push ebp
xor eax, 0xc8ec26f2
inc eax
dec eax
out dx, al
shr dword [esi], 0x18
out 0x40, eax
rol dword [ecx - 0x15], 0xba
in eax, 0x74
xchg byte [edi - 0x3793c5d8], ch
movsb byte es:[edi], byte [esi]
leave
and sp, bp
invalid

Function at 0x6fb1e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test bl, 0x51
test dx, 0x247f
test eax, eax
pushfd
jmp 0x607f4a
bsf ax, si
push ebp
cmp di, di
aad 0xba
mov ebp, esp
add ax, di
jmp 0x707b22
sub esp, 0x10
aaa
push esi
clc
push edi
btr ax, ax
bt ebp, 0x1b
movsx eax, al
push ebx
add al, ch
cmc
not al
aam 0x52
push edx
sar ax, 0xe
inc ah
bsr ax, si
not ah
mov eax, dword [ebp + 8]
jmp 0x606eed
Function at 0x7008af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0x416a
jmp 0x70d781
call fcn.00607de8
mov bl, 6
sub byte [edi + ebp + 8], 0xdb
cli
mov eax, dword [0x52cbab46]
dec edi
enter 0x3ac1, 0xffffffffffffffb2
mov al, 0x9e
movsd dword es:[edi], dword [esi]
nop
test ecx, edi
mov edx, 0x22a5c988
add dword [ecx - 0x5c1e3ce5], ecx
push esi
loop 0x61eb9d
mov ebp, 0xa7508a6c
adc eax, 0x1cef2ecd
outsb dx, byte [esi]
sbb al, 0x6e
cmp ah, byte [edx - 0x6c]
or dword [ecx - 0x6b3beec7], esi
push edi
xor byte [ebp - 0x4d75b30f], ch
in al, 0x34
aam 0x75
cmp edx, dword [edx*8 + 0x34633f49]
pop ebp
and esp, dword ds:[ebx + eax*8 - 0x16]
push esi
daa
je 0x61eba9
dec edx
jns 0x61ec43
jmp 0xfa8f86fc
sbb eax, 0x2404c63c
adc byte [ebp + ecx*4 - 0x17f7db9c], bl
salc
fimul word [0x34ff9c00]
and al, 0x60
mov byte [esp], bl
mov al, 0x51
mov byte [esp], 0xb2
lodsb al, byte [esi]
mov byte [esp], al
push ebx
mov byte [esp], 0xe0
cmp bp, bx
sub al, 0x4f
mov byte [esp], 0xdb
test ch, ah
neg al
stc
add al, 0x96
bt bp, cx
cmc
xor al, 0x38
mov byte [esp], 0x87
dec al
clc
cmp al, byte [edi]
cwde
not al
movzx ax, dl
setbe al
lea edi, [edi + 1]
lahf
mov eax, dword [esp + 0x30]
push dword [esp]
lea esp, [esp + 0x38]
ja 0x6fcd54
push edi
push eax
lea esp, [esp + 8]
jl 0x61eb75
pushfd
lea esp, [esp + 4]
jb 0x61e19a
clc
bt bp, bx
pushal
cmp byte [edi - 1], 0
jmp 0x606aa2
lea esp, [esp + 0x20]
jne 0x71f8e5
rcl di, 9
movsx di, al
dec di
rcr edi, cl
mov edi, dword [edx + 0x24]
jp 0x70d7bf
pushfd
clc
stc
add edi, eax
cmp dh, dh
stc
movzx ecx, word [edi + ecx*2]
mov dword [esp], 0x75442d3f
cmc
mov di, 0xebd3
or di, ax
mov edi, dword [edx + 0x1c]
bt ebx, edi
call fcn.00620fed
enter 0xffffffffffff940d, 0xffffffffffffff81
inc esp
sti
sub eax, 0x66f57544
mov edi, 0x966ebd3
invalid
int1
dec eax
or eax, 0xfb448194
scasd eax, dword es:[edi]
push edi
out dx, al
lds edi, [eax]
xor ch, byte ss:[edx]
movsb byte es:[edi], byte [esi]
sbb eax, 0x8010179a
ja 0x70d845
jne 0x70d7ab
push esi
jno 0x70d810
lea eax, [edx]
push esp
jg 0x70d799
xchg esp, eax
inc ebx
jbe 0x70d79d
or edx, dword [eax + 0x332c6603]
leave
and al, 0xd3
imul ecx, edi, 0x79679849
mov ah, 0x37
add bh, byte [esi]
xchg esi, eax
dec ecx
pop ss
pop ebx
insb byte es:[edi], dx
or cl, 0xaa
sub edx, dword [edi - 0x1e]
and edx, dword [eax - 0x60]
cli
retf 0x5158
arpl word [edx], di
xchg esp, eax
push 0xc96fbdb7
jmp fcn.0070d873
pop ebx
and ebx, esi
les ebx, [eax - 7]
outsb dx, byte [esi]
push edi
xchg esi, eax
bound esp, qword [ebx - 0x41950e86]
hlt

Function at 0x7067b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, eax
lea ecx, [edi + 0x2d37283f]
mov ecx, 0x104
push dword [esp]
bt edx, 9
bt bx, 2
bt di, 0xc
sub al, al
pushal
stc
test bp, ax
call fcn.0070a4ca