joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411d24
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.004154d0
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x411d3f
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x411d4c
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x411e28
movzx eax, word [esi]
test ax, ax
je 0x411e28
push ebp
mov ebp, dword [esp + 0x201c]
push edi
mov dword [esp + 0x10], ebx
mov edi, eax
add esi, 2
cmp di, 0x3d
jne 0x411d97
test ebp, ebp
je 0x411da3
test ebx, ebx
jne 0x411da3
test ecx, ecx
je 0x411d8e
mov byte [ecx], 1
mov ebx, dword [esp + 0x201c]
jmp 0x411dc7
cmp di, 0xd
je 0x411ddc
cmp di, 0xa
je 0x411ddf
mov eax, dword [esp + 0x201c]
mov word [eax], di
add eax, 2
mov edi, dword [esp + 0x202c]
mov dword [esp + 0x201c], eax
lea eax, [edi - 2]
cmp dword [esp + 0x10], eax
jge 0x411dd7
movzx eax, word [esi]
inc dword [esp + 0x10]
mov edi, eax
test ax, ax
jne 0x411d76
jmp 0x411ddf
mov byte [edx], 1
jmp 0x411de6
add esi, 2
mov edi, dword [esp + 0x202c]
mov eax, dword [esp + 0x201c]
xor ecx, ecx
mov word [eax], cx
test ebp, ebp
je 0x411e22
xor eax, eax
mov word [ebp], ax
test ebx, ebx
je 0x411e22
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.0040694c
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x411e2a
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18
Function at 0x414333
Capabilities:
Hide graphical window

Disassembly:
and dword [0x456d7c], 0
push 1
push dword [esp + 8]
mov byte [0x44f955], 1
mov byte [0x44f956], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401183
cmp dword [0x467228], 0
jne 0x414373
cmp byte [0x44f963], 0
je 0x41437c
cmp dword [0x44f95c], 0
jne 0x41438f
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x414463
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004154d0
cmp byte [0x458d88], 0
je 0x4144f2
cmp word [0x458d8a], 0
je 0x4144f2
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x458d8a
call fcn.00413024
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4144f1
push dword [ebp + 8]
call fcn.0041a043
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x4144f6
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.004154d0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00406679
mov esi, eax
test esi, esi
je 0x41454e
movzx ecx, word [esi]
push ecx
jmp 0x414539
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00406795
test al, al
jne 0x414532
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4
Function at 0x415f93
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415fd2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415fd2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415fd2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415fd2
cmp dword [ecx + 0x74], 0xe
jbe 0x415fd2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4283a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4283cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4283cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100250f0
Capabilities:
Check http status code

Disassembly:
mov ebx, ebp
jge 0x10093207
or dword [esp + 0x18], 0xae958a80
call fcn.100e2295

Function at 0x1002573c
Capabilities:
Check http status code

Disassembly:
push 0x518693e
push 0x3d9c9d9c
dec dl
push 0x2e8420ac
rol dl, 1
call fcn.10069e29
mov ebx, dword [ebx]
jmp 0x100a2682
mov dword [esp], 0xcc32dc11
adc ebp, 1
rol dword [esp], 0x15
or di, dx
call fcn.100b0210
sub eax, 0x9b8d4e5e
add byte [eax], al
add byte [eax], al
dec dl
or dword [esp], 0xa5b7e200
ror dl, 1
jmp 0x10025724
push 0x7a0e4887
push 0x4f812f8b
dec eax
lea esp, [esp + 0x10]
jmp fcn.100a49ac

Function at 0x10026866
Capabilities:
Check http status code

Disassembly:
mov edx, dword [esp + esi - 0x74288caa]
shl si, 6
push ebp
mov ebp, esi
call fcn.100dbabd

Function at 0x10026879
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + ecx + 0x53853518]
add dword [esp + 4], 0xeff2dadc
call fcn.100cd8cc

Function at 0x10026e4f
Capabilities:
Check http status code

Disassembly:
xor dword [esp + 0x20], 0x5100b4a8
neg dword [esp + 0x20]
jg 0x100be963
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x34]
ret

Function at 0x100286e5
Capabilities:
Check http status code

Disassembly:
jns 0x100a25f6
jmp 0x100b6a67
jmp 0x100d984d

Function at 0x10029a68
Capabilities:
Check http status code

Disassembly:
jbe 0x100ab255
inc ecx
dec ch
jmp 0x100a167f
add dword [esp + 0xb], 0x19ab6506
sbb al, 0xbf
ror al, 1
and word [esp + 4], 0x501e
shr word [esp + 5], 0xae
neg al
not al
push 0xf6170803
xor bl, al
call fcn.1006e023
adc esi, 0
push 0xa5278481
xor al, bl
rol byte [esp + 3], 0xa7
rol al, 1
not al
push 0x8e89a5b7
inc dword [esp + 1]
sal word [esp + 4], 0x25
inc al
push 0x5b05643f
not al
push 0xf59f9d8d
sub al, 0x8b
not byte [esp + 7]
xor al, 0x29
ror al, 1
rol dword [esp + 0xc], 0x7b
jb 0x1008bd98

Function at 0x1002bbfe
Capabilities:
Check http status code

Disassembly:
mov edi, dword [esp + 0xc]
jae 0x1008af42
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x24]
ret
shl edx, 0xb2
jb 0x100aed12
inc ebp
invalid
shr dl, 0xcb
js 0x10097b48
add dword [esp], 0xfffd852e
call fcn.100c5671
Function at 0x1002c71b
Capabilities:
Check http status code

Disassembly:
call fcn.100d44f9
sar byte [esp + 8], 0xe1
dec eax
and eax, edi
push 0x9609861f
jmp 0x1007245e
push 0x22b6cf0f
dec eax
mov dword [ebx], eax
push 0xd00a5a9c
dec eax
lea esp, [esp + 0x28]
jmp fcn.100345d9

Function at 0x1002dd47
Capabilities:
Check http status code

Disassembly:
push ebx
mov ebx, dword [esp + ebp + 0x1179e62e]
mov dword [esp + 0x18], ecx
jl 0x1002c10d
shr dword [esp + ebp*4 + 0x45e79858], 0xe5
call fcn.100af35d

Function at 0x1002dd66
Capabilities:
Check http status code

Disassembly:
jg 0x100da123
test word [esp + 8], 0xd52b
not dword [esp + 8]
push ecx
nop
call fcn.100303e5
mov ecx, dword [ebp]
jmp 0x1006bcbc
mov edi, 0xe38546a8
push edi
mov di, word [ecx]
call fcn.100c06d2

Function at 0x1002e2f0
Capabilities:
Check http status code

Disassembly:
mov edi, eax
cld
mov dword [esp], 0x6030aa21
shl dword [esp], 0xc7
neg dword [esp]
rep movsb byte es:[edi], byte [esi]
push dword [esp + 4]
popfd
call fcn.1003a16a

Function at 0x1002f651
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x1c]
jae fcn.100eff85

Function at 0x10034b1b
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0xc], 0xffc6f6ce
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10095d28

Function at 0x10034c5d
Capabilities:
Check http status code

Disassembly:
push 0x5d1ba780
pushfd
shr dword [esp + 4], 0x71
push ecx
add word [esp + 8], 0xcb29
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], edx
push ecx
add dword [esp + ecx - 0xf9a2], 0x7809e
cmp ecx, dword [esp + ecx - 0xf9b6]
jle 0x100d1611
nop
mov edx, dword [esp + ecx - 0xf9aa]
setle byte [esp + ecx*8 - 0x7cdb0]
call 0x1006aa15

Function at 0x10034fb0
Capabilities:
Check http status code

Disassembly:
cmova ecx, dword [esp + ebx*8 - 0x377dc]
lea eax, [eax + ebx - 0x43d06755]
and ebx, dword [esp + ebx - 0x6ef0]
je 0x1004528f
jne 0x100d640d
jne 0x1005fa79
jbe 0x100a241e
dec esp
and al, 8
mov ch, 0xdd
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
xor ecx, dword [esp + ecx*2 + 0x40f0cc06]
jl 0x100651ba
pop es
dec esi
adc bl, byte [eax]
pushal
sbb byte [edi + ebp*8 - 0x49], bh
cmp ah, byte [esp + ebp*8 - 0x60]
dec ecx
pop ss
loopne 0x100a23ca
hlt

Function at 0x10035169
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 8], 0xeff2871f
lea esp, [esp + 8]
call fcn.100a5081
push 0xb9871d2a
sar byte [esp + 5], 0xe2
mov dword [ebp - 4], eax
inc dword [esp + 3]
test ebx, ebx
call fcn.100c2d57
jmp 0x100b267c
mov word [ebp], cx
jmp 0x100cc4af
not cl
jmp 0x10084bb2
push 0xe2a7fd9f
lea esp, [esp + 0xc]
jmp fcn.100eff85

Function at 0x100352e0
Capabilities:
Check http status code

Disassembly:
seta bl
xor bx, word [esp + ebx + 0x60a42a1d]
sub si, si
xchg dword [esp + ebx + 0x60a4a917], ecx
mov ebx, dword [esp + ebx + 0x60a4a8ff]
ja 0x100b20b8
bswap esi
call fcn.1005fba8
push ebp
pushfd
mov ebp, 0xb18ad38f
push edx
push ebp
mov ebp, dword [esp + ebp + 0x4e752c7d]
mov dword [esp + 0xc], 0xeffc8162
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.100a5081
Function at 0x10035894
Capabilities:
Check http status code

Disassembly:
and ecx, 0xcf02070d
add dword [esp], 0xfff92851
mov ebx, 0xcd2200ab
shl edi, cl
or cx, di
shl ebx, cl
cmp ebx, 0xfea0f8b9
mov ebx, dword [esp + ecx - 0x3025609]
mov ebx, dword [ebx]
mov cx, 0x170c
mov dword [esp + ecx*8 - 0x1810b860], edi
jge 0x100588e9
neg ecx
lea ebx, [ebx - 0x5ce16f7c]
lea edi, [ecx*4 + 0x683244a0]
call fcn.100959cc

Function at 0x1003619d
Capabilities:
Check http status code

Disassembly:
mov bx, word [ebx]
dec eax
lea esp, [esp + 0x10]
jmp fcn.100a49ac

Function at 0x1003a563
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + eax*2 + 0x40c10192]
mov eax, dword [eax]
mov edi, 0xd5959db1
mov ebp, edi
jge 0x100f1aa1
ja fcn.100df7ed
lea eax, [eax + edi*2 + 0x74dc712a]
lea edi, [edi + edi - 0x3c860af6]
or edi, 0x1baacf3d
jl 0x1002870b
lea ebp, [ebp + edi*8 - 0x58e4555c]
lea ebp, [ebp + ebp*4 - 0x4ed0dc5a]
xchg dword [esp + 0x20], eax
mov edi, dword [esp + 4]
bswap ebp
add bp, bp
test bp, 0x5d30
call fcn.10070729

Function at 0x100555ed
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x10]
ja fcn.100eff85

Function at 0x100577f9
Capabilities:
Check http status code

Disassembly:
lea ecx, [ecx + ebp*2 + 0x64b78560]
setae byte [esp + ebp + 0xb28]
jb 0x1006d82d
cmovae ebp, dword [esp + ebp + 0xb28]
setae byte [esp + ebp*8 + 0x3ac45808]
xchg dword [esp + ebp + 0x7588b23], ecx
mov ebp, dword [esp + ebp + 0x7588b17]
xor word [esp + 0xc], 0x669e
jo 0x100af01e
sub byte [esp + 0xc], 0xa8
sub dword [esp + 0x10], 0xdc2f3b2c
sete byte [esp + 0xc]
or word [esp + 0xc], 0x1536
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x24]
ret
mov ecx, dword [esp + ecx - 0x65b5ecfd]
lea ecx, [ecx + 1]
mov dword [esp + 0x20], ecx
add dword [esp + 0x10], 0x555f
mov dword [esp + 4], 0x6eaf00be
mov ecx, dword [esp + 4]
push esi
sub dword [esp + ecx - 0x6eaf00b6], 0xc180e04
mov esi, 0x923a2b99
js fcn.100c3dd6
push ebp
mov ebp, ecx
mov ecx, dword [esp + esi + 0x6dc5d47f]
mov ecx, dword [ecx + esi + 0x6dc5d467]
add dword [esp + esi + 0x6dc5d487], 0xfff670fa
mov dword [esp + esi + 0x6dc5d47f], ebp
call fcn.100bc64f
mov dword [esp + 8], esi
not esi
lea edx, [edx + 1]
push edx
push ebx
add dword [esp + 8], 0xfff6c24f
call fcn.100c6e15
seto byte [esp + 0x10]
jo fcn.100287a0
add dword [esp], 0xeff5e691
shr word [esp + 0x10], 0x83
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x28]
ret
mov edx, dword [esp + edx - 0x4000be8]
cmp dword [esp + 0x10], 0x1fa76aa2
jl 0x100aa26a

Function at 0x10057b37
Capabilities:
Check http status code

Disassembly:
jmp 0x100b34fb
sal word [esp + 4], 0xe8
xor al, 0x81
push 0xcc39992a
shr dword [esp + 8], 0x6a
sar word [esp + 4], 0xa1
not al
ja 0x10070461
mov dword [esp], 0x878bca30
xor al, bl
inc dword [esp + 4]
jnp 0x100cf2da
ror al, 1
dec al
neg word [esp + 1]
jg 0x100ac436
dec dword [esp + 0x28]
inc esp
xor cl, cl
push 0x25827912
dec eax
sub ebx, 2
jmp fcn.10075c6a

Function at 0x10058dd8
Capabilities:
Check http status code

Disassembly:
cmp cx, 0xad89
call fcn.10086532
Function at 0x1005c673
Capabilities:
Check http status code

Disassembly:
push edi
inc ecx
neg bh
sar di, 0xd
dec eax
mov dword [esp + edi*2 - 0x1ffe8], 0x529774a2
inc ebp
xor cl, bh
dec eax
lea edi, [edi*8 + 0x6bb6f2b0]
dec eax
mov dword [esp + edi - 0x6bbef288], edi
call fcn.10063589

Function at 0x1005c706
Capabilities:
Check http status code

Disassembly:
mov eax, 0xd60843a8
sal ax, 0x23
mov eax, dword [ebp + ebx*4]
call fcn.1005c706
push edi
call fcn.100c0fc6
mov dword [esp], 0xd209d80f
jmp 0x100274ce
add ecx, edx
mov dword [ebp], ecx
jmp 0x10097e90
mov dword [esp], 0xa32c2a98
mov dword [esp], eax
jns 0x1006ece5
jns 0x100831a6
push 0x860bb8b8
dec ebx
lea esp, [esp + 4]
jne 0x10026e0b
mov eax, 0xba9d2716
lea eax, [eax + eax + 0x3486d997]
mov eax, dword [ebp]
push 0x70bcdc85
call fcn.1005fb70
jmp 0x100596a0

Function at 0x1005ca1c
Capabilities:
Check http status code

Disassembly:
add edi, edx
mov ecx, edx
push edi
push edi
jae 0x10082fcb
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp]
call fcn.1008fbda
xor eax, 0xd7f71cb9
cld
stosd dword es:[edi], eax
cdq
adc al, byte [edi + 0x615e249]
in al, 0xce
pop edi
imul ebp, ebx, 6
stosb byte es:[edi], al
sahf
test eax, 0x9467357d
fidiv word [edi]
mov esp, 0x27124e63
aad 0xc9
std
hlt
cmp word [esp + 0xc], 0xff23
ja 0x100ccbac
add byte [esp + 0x20], 0x92
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x2c]
ret

Function at 0x1005e0e8
Capabilities:
Check http status code

Disassembly:
and ecx, ecx
add word [esp + ecx*2 + 0x20], 0xc232
mov ecx, dword [esp + ecx*2 + 0x10]
ja 0x1002dd38

Function at 0x1005e1a3
Capabilities:
Check http status code

Disassembly:
xor dword [esp + 0xc], edi
jno 0x1002db41

Function at 0x1005e46b
Capabilities:
Encode data using xor

Disassembly:
jle 0x100e2872
mov ecx, dword [ebp]
mov eax, 0x16b1cf9a
neg al
mov eax, dword [ebp + eax*2 - 0x2d639ec8]
call fcn.10034d10
and dword [esi], edx
add eax, 0x4918e204
std
push ebx
arpl word [edi + 0x5c], bx
mov byte [edi + 0x5b], bh
sbb eax, 0xa07411a5
insd dword es:[edi], dx
inc ecx
das
inc ebx
rcr byte [edx], cl
adc dword [edi - 0x711b1321], ebx
fucompi st(4)
in al, 0x8e
mov gs, word [edi + ecx*4 + 0x25]
jne 0x1005e50a
daa
xor al, 0x46
lahf
xchg dh, ch
pop edx
xchg esp, eax
sub al, 0x59
cmp bl, byte [ebp + 0x47]
jne 0x1005e4a5
sub al, 0x16
invalid
dec eax
fild dword [eax]
add al, ch
call fcn.100d3eb1
test dword [esp + 0x3c], 0xcfa6bca9
invalid
invalid
call fcn.100cc67c
Function at 0x1005e6ff
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov ebx, 0xa01c2234
cmp bl, 0x8f
mov dword [esp + 0xc], esi
js 0x10084810
stosb byte es:[edi], al
push es
js 0x1005e790
cmp cl, byte [edx + ebx - 0x17]
xchg ecx, eax
add al, 0x72
xacquire xchg byte [ebp + 0x35], ch
ret 0xb8a4
or al, 0xf3
xchg edi, eax
mov al, byte [0x59191e22]
out dx, al
dec eax
invalid
adc eax, 0xae340179
or al, byte [esi + 0x43]
mov bl, 0xa3
inc edi
mov dword [0x40e76ffa], eax
push es
loope 0x1005e755
and ch, byte [eax]
and byte [esi + 0x10057f97], bh
mov al, 0x42
adc byte [eax - 0x6e9098be], dh
inc edx
outsd dx, dword [si]
xchg ecx, eax
push ebx
fdivr dword [ecx + esi*8 - 0x41cc2c57]
test al, 0xe6
cmp eax, 0x86fc0f49
mov ah, 0x81
fst dword [ebx + 0x6c32a3cd]
xchg edi, eax
imul ebp, dword [ebp - 0x3c], 0xc821f9b3
xor ch, byte [edi + edx*4 + 0x69]
insd dword es:[edi], dx
les esi, [ebx - 0x6937de07]
and eax, ecx
xchg esi, eax
ja 0x1005e7e9
mov dword [edi - 0x55], edx
stosb byte es:[edi], al
je 0x1005e776
loop 0x1005e7d2
mov ah, byte [ebx - 0x5f6ffa81]
add dword [ebx], ebx
push edi
or esi, eax
lodsb al, byte [esi]
jbe 0x1005e792
retf
jg 0x1005e7d9
adc byte [eax], cl
add ebp, 0xedd817cd
pop ss
fsubr st(5)
in eax, 0x9f
int1
invalid
jg 0x1005e824
nop
nop
invalid
jg 0x1005e818
adc byte [ebp + 0x6f], ch
test al, 0x4f
inc esi
jbe 0x1005e87f
sub eax, 0xa85e71dc
jle 0x1005e7ab
mov al, byte [0x816214a3]
rcl byte [edx], cl
cdq
stosd dword es:[edi], eax
adc al, 0x62
adc edx, 0xab3e9912
inc esi
stosd dword es:[edi], eax
jle 0x1005e811
jno 0x1005e7b3
adc dword [0xf4405451], edx
jnp 0x1005e8ae
or al, 0x60
sbb byte [ecx], al
and dh, dh
fnsave dword ds:[ebx + eax*4 - 0x47]
pop es
inc ebx
push ebx
invalid
or bh, cl
mov dword [edx + 0x1a], esi
sbb eax, 0x10f70daf
jp 0x1005e8da
xor al, 0
xchg esp, eax
pushfd
push ebx
sbb eax, 0x187ddba
pop edi
fdivr qword [ecx + ebx*2 + 0x7d7f2139]
daa
shl byte [ecx + ebx + 0x7493df57], 0x18
das
lodsd eax, dword [esi]
leave
sub byte [eax + 0x78], ch
xchg esp, eax
salc
add al, 0x3e
aam 0x24
sub al, 0x9a
nop
cwde
add eax, 0x2ceffa16
fdivp st(3)
lahf
fidiv dword [edx + 0x20]
idiv byte [esi]
jmp 0x1005e860
daa
pop edx
aas
push ss
cli
outsd dx, dword [esi]
cmp al, 0x87
jnp 0x1005e8bd
out 0x56, al
sub al, 0xf5
push ss
cli
out dx, eax
adc ecx, dword [edi + 0x1b218bc1]
mov cl, 0xf
mov edx, 0xe8ceb4b2
mov dh, 0x57
adc dword [ebx - 0x2b0f7180], edi
sahf
dec eax
mov al, byte [esi - 0x44]
xor byte [0xc997833d], dh
xor eax, 0xc997833d
dec ebx
fld dword [0xc8728a10]
pop esp
sub byte [edx - 0x2a], ch
add eax, 0x93bd1710
pop ss
inc eax
js 0x1005e8b6
je 0x1005e907
push eax
out dx, al
cmpsb byte [esi], byte es:[edi]
insb byte es:[edi], dx
invalid
jmp 0x8b1ff911

Function at 0x1005eac9
Capabilities:
Check http status code

Disassembly:
mov dword [esp + edi*2], esi
push edi
pushfd
pop edi
mov dword [esp], edi
mov esi, 0xeabe70b8
jmp 0x100d9afe

Function at 0x100608d5
Capabilities:
Check http status code

Disassembly:
and dword [esp + 0x10], 0x5ed37
jl 0x10039303
add dword [esp], 0x6d702
mov eax, 0xaf07188c
call fcn.100e6a33
Function at 0x100618a9
Capabilities:
Check http status code

Disassembly:
not dword [esp + 0x10]
setle byte [esp + 0x38]
call fcn.1003a13f

Function at 0x100631e2
Capabilities:
Check http status code

Disassembly:
sub dx, dx
add dword [esp], 0xfffc02f4
neg cl

Function at 0x100634ec
Capabilities:
Check http status code

Disassembly:
push ecx
mov ecx, 0xd3bd4c0e
pushfd
and cl, 4
mov dword [esp + 0xc], 0xeff17e5b
mov ecx, dword [esp + ecx*2 + 0x588567fc]
add dword [esp + 8], 0xeff30c28
call fcn.100c64c2
jl 0x100b58dd
jb fcn.100ed416
push ebx
mov ebx, 0x37260203
add dword [esp + 4], 0x3f81d
mov ecx, ebx
cmp cx, bx
seto bl
push edx
push ecx
add bx, word [esp + ebx*2 - 0x6e4c03fe]
mov edx, ebx
call fcn.100a147e
sub ebx, 0xb002ee91
neg ebx
call fcn.100c5b8a
mov edx, 0xb324a00d
shl edx, 0x4b
movzx edx, byte [esi + edx*2 - 0x4a00d000]
call fcn.1008fbdf
inc ecx
mov edi, 0x3b03383c
inc ecx
inc bh
dec ecx
inc edi
inc edi
movzx edx, byte [eax + edi*2 - 0x7606707c]
inc bp
or edi, edi
dec edi
lea eax, [eax + edi - 0x3b03383d]
inc ebp
xor dl, cl
inc cx
inc edi
dec ecx
neg edi
inc ecx
adc dl, 0x27
inc ebp
and edi, edi
inc ecx
push edi
inc ecx
neg dl
inc ecx
inc dl
dec dword [esp]
dec eax
dec dword [esp]
inc ecx
pop edi
inc ecx
xor dl, 0x3f
inc bp
btr edi, edi
inc ecx
not bh
dec ecx
shl edi, 0xb3
inc ecx
sbb dl, 0x10
inc ebp
or bh, bh
inc ecx
sar bh, 0x67
inc ebp
xor cl, dl
dec ecx
and edi, 0x472b3585
dec ecx
inc edi
inc ecx
shl edi, 8
dec esp
adc edx, esp
inc cx
sal edi, 0xed
dec edi
xor edi, dword [edx + edi*4]
push 0x6b035d06
shr byte [esp + 1], 0x41
sal dword [esp + 2], 0xf3
dec eax
sbb ebx, 7
push 0x12241c81
jmp 0x100da49b
or dl, 0x1d
shr ebx, 0xe2
call fcn.1009141d
aad 0xc6
and al, 0x31
pop edi
hlt
setg cl
neg ecx
push ebx
mov ebx, 0x312a849d
add dword [esp + 0x18], 0x646f6
mov eax, 0xeb11db26
push edx
bswap ebx
and eax, 0x6b054398
jbe 0x1009c8ca
jo 0x10067437
mov edx, 0xb2014aa1
mov bx, dx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + ecx - 0x59c6ed00]
call fcn.10084d0e
movsd dword es:[edi], dword [esi]
pop edi
push cs
xor al, 0x78
int 0x50
push ebx
xchg dword [ebp + 0x6c], esi
pop edx
jp 0x100b58f0
inc edx
invalid
dec esp
mov dword [ebx], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.100a49ac

Function at 0x10063589
Capabilities:
Check http status code

Disassembly:
dec esi
lea edi, [esp + edi + 0x20]
shr edi, 0x30
inc ecx
mov edi, dword [edi + edi*2 - 0xd77c]
ror dword [esp + 9], 0x41
dec eax
sbb ebx, 4
call fcn.10091610
Function at 0x10063eb8
Capabilities:
Check http status code

Disassembly:
inc ecx
and dl, 0xf0
inc ecx
push ecx
inc ecx
movzx ebp, cx
dec ecx
mov esp, edx
inc ecx
mov ecx, 0x87187638
dec ebp
mov ecx, eax
inc ecx
mov ebx, 0x1b100936
dec esp
lea edx, [0xeffcba3d]
dec ebx
lea ebp, [ebx + ebx*4 + 0x80b8690]
dec ebp
sub ecx, edx
inc sp
or ebx, ebp
dec eax
lea ebp, [0x7f167]
dec edx
mov dword [esp + ebx*2 + 0x431bfd2e], ebp
dec esi
mov dword [esp + edx - 0x7aaa33a3], ecx
dec edx
not dword [esp + edx - 0x7aaa33a3]
dec edx
mov dword [esp + edx - 0x7aaa331b], ecx
dec ecx
btr ebx, 0x1c
inc ecx
push ecx
dec edx
add dword [esp + ebx*2 + 0x631bfcb1], 0x8a8d8722
dec edx
lea ebx, [esp + ebx*2 + 0x631bfcbe]
dec esi
lea edx, [ebx + edx - 0x7aaa358b]
jnp 0x100345a0

Function at 0x100678a9
Capabilities:
Check http status code

Disassembly:
setbe bl
cmp dx, 0xcf2b
push ebp
mov ebp, dword [esp + edx + 7]
mov edx, dword [esp + edx + 0x13]
mov edx, dword [edx]
je 0x1007ed4a
mov dword [esp + ebx + 0x13], ebp
cmovg ebp, ebx
or bl, 0xe
add ebp, dword [esp + ebp + 0x13]
add dword [esp + 4], 0xfffab9ac
lea edx, [edx + ebx*2 - 0x42d315fa]
sub dword [esp + 0x14], ebp
or dword [esp + ebx*8 - 0x64], 0xa23f42b6
jbe 0x10069323
or bp, 0x4db9
jbe 0x100339e3
xchg dword [esp + 0x18], edx
mov ebx, dword [esp + 0x10]
cmp dword [esp + 0x14], 0x6b115699
not word [esp + 0x14]
call fcn.1005ac34

Function at 0x1006aabd
Capabilities:
Check http status code

Disassembly:
pushfd
mov ecx, 0x24a4c125
not cl
cmp ecx, 0x68821a31
call fcn.10037640
jmp 0x100ae714
mov bx, word [ebx]
jmp fcn.100a49ac

Function at 0x1006b39d
Capabilities:
Check http status code

Disassembly:
mov ebx, dword [ebx]
push 0x16af5b35
call fcn.100e49b3
push edx
pushfd
mov edx, 0xd4311610
and dx, dx
not dx
neg dl
mov edx, dword [esp + edx + 0x2bce16f3]
mov dword [esp + 4], 0xffcd07bd
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10095d28

Function at 0x1006b3d5
Capabilities:
Check http status code

Disassembly:
test ebp, 0x8113e98b
call fcn.100ad511
mov dword [ebp + 4], eax
jmp 0x100a519b
jmp fcn.100eff85