joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17e50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
push 0x50
push ebx
push 0x1e3e0
mov dword [ebp - 0x10], 0xc0000001
mov dword [0x1e374], ebx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push str.REGISTRYMACHINESYSTEMCurrentControlSetServicesTcpipParametersInterfaces
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 0x30]
push edx
push 0x20019
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x17ff4
mov edx, dword [ebp - 8]
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
push 2
push edx
call edi
mov eax, dword [ebp - 4]
add eax, 2
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
cmp esi, ebx
jne 0x17f03
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push esi
push 2
push eax
call edi
mov edi, eax
cmp edi, ebx
jge 0x17f32
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], ebx
jbe 0x17fdc
jmp 0x17f40
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push ebx
push eax
call edi
mov eax, dword [ebp - 4]
add eax, 2
push eax
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
test esi, esi
je 0x17fcd
mov ecx, dword [ebp - 4]
push ecx
push 0
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push 0
push ebx
push ecx
call edi
test eax, eax
jl 0x17fc4
mov edx, dword [ebp - 8]
push str.NameServer
lea edi, [esi + 0x10]
push edi
push edx
call fcn.00017bf0
test eax, eax
jge 0x17fbd
mov eax, dword [ebp - 8]
push 0x1c8a0
push edi
push eax
call fcn.00017bf0
test eax, eax
jl 0x17fc4
mov dword [ebp - 0x10], 0
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0xc]
inc ebx
cmp ebx, dword [ecx + 0x14]
jb 0x17f40
mov esi, ecx
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x194ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt ax, si
stc
add esi, ebx
bt ax, 9
lea esp, [esp + 4]
jae 0x44d96
cmc
cmp dx, word [edi + 6]
jg 0x2cc4c
jae 0x370e7
btr ax, bx
sbb al, dl
lea ebx, [edi + 0x108]
sub ax, bp
lea esp, [esp]
push dword [esp]
lea esp, [esp + 0x44]
jne 0x258f7
movsx dx, al
pushal
bswap edx
lea edx, [ebp - 0x38]
pushfd
mov dword [esp + 0x20], edx
pushal
pushfd
call fcn.00022244
pushal
lea esp, [esp + 0x20]
jae 0x370e7
shr ebx, cl
aaa
bsr eax, ebx
lea ebx, [edi + 0x108]
jmp 0x26598
pushal
cmp dx, word [edi + 6]
push 0xaf36ddcf
mov byte [esp + 0x18], dl
pushfd
lea esp, [esp + 0x28]
jae 0x370e7
dec bl
lahf
shrd bx, di, cl
call fcn.00030b93
jmp 0x21670

Function at 0x1afd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1b00c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1b00c
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x1b00b
lea esp, [esp]
movzx edx, byte [ecx]
xor edx, 0x9e
mov dl, byte [edx + 0x1ce30]
xor dl, 0x34
mov byte [eax], dl
inc eax
inc ecx
sub esi, 1
jne 0x1aff0
pop esi
pop ebp
ret 0xc

Function at 0x1b010
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1b03d
mov edx, dword [ebp + 0xc]
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1ca30]
dec ecx
inc edx
test ecx, ecx
jne 0x1b021
pop esi
pop ebp
ret 0xc

Function at 0x21315
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], esi
call fcn.00046cde

Function at 0x23e19
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], esp
jmp 0x308f8

Function at 0x23f4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jb 0x308ff

Function at 0x2480d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x100
pushal
lea edx, [ebp - 0x138]
push 0xd434987e
mov dword [esp + 0x20], 0
mov dword [esp], ebp
push edx
jmp 0x359f1
pushfd
mov dword [esp + 0x24], edx
pushal
mov byte [esp], 0x43
pushfd
pushfd
lea esp, [esp + 0x4c]
call sub.ntoskrnl.exe_memset
lahf
bsr eax, esi
rcl ah, 1
add esp, 0xc
call fcn.00019236

Function at 0x24e65
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x28bb2
mov word [esp], 0xd856
push edx
mov dword [esp + 8], 0x1e050
pushal
lea esp, [esp + 0x28]
call fcn.0001afd0
not dx
rdtsc
push esi
lahf
rdtsc
pushfd
lea eax, [edx + 0x6e322a8b]
mov dword [esp], str._Gpesys.dat
pushfd
not dx
cwde
lea edx, [ebp - 0x138]
jmp 0x2d63d
lea eax, [ecx*2 + 0x13c28ccf]
mov dword [esp], edx
bswap ax
lea eax, [ebp - 4]
pushal
call fcn.0003ba42
Function at 0x25169
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol eax, 3
and eax, edi
movzx ax, cl
mov eax, dword [ebx]
push ecx
test bh, 0xf9
mov byte [esp], 0x3c
cmc
test eax, eax
jmp fcn.00042a1a
pushal
mov byte [esp + 0xc], 0x61
lea esp, [esp + 0x20]
je 0x1955a
not dh
mov edx, dword [ebp - 8]
movzx si, bl
sal si, 3
pushal
lea esi, [eax + edx]
dec eax
test ax, 0x734e
bsf ax, dx
mov eax, dword [ebx]
bt ax, bx
test eax, eax
pushal
lea esp, [esp + 0x40]
je 0x25753
stc
cmp eax, dword [ebp + 0xc]
pushfd
call fcn.00042af4
jmp 0x2242c
lea esp, [esp + 0x28]
jae 0x370e7
btr eax, 0x1b
daa
lea ebx, [edi + 0x108]
pushfd
aad 0x2d
lea esp, [esp + 4]
add ax, ax
ror al, cl
rol ax, 2
test al, ch
mov eax, dword [ebx - 4]
cmc
test eax, eax
jmp 0x24831
test bh, al
cmp ebp, eax
mov eax, dword [ebx + 0x3c]
pushfd
shl si, cl
mov esi, dword [eax + ebx + 0x78]
cmp di, cx
lea eax, [eax + ebx + 0x18]
jmp 0x23c48

Function at 0x253ca
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x38]
je 0x38587
jmp 0x41d8b
not edi
call fcn.0003b665

Function at 0x25e98
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x28]
jbe 0x24671
bswap dx
push edi
xchg cl, dh
nop
movsx di, bl
inc dx
mov al, byte [esi]
bswap dx
xchg di, dx
xchg edi, edx
bswap dx
mov cl, byte [esi + 1]
not edx
push esp
dec di
mov word [esp], sp
inc esi
xchg dx, di
jmp 0x304f3
bswap dx
mov byte [ebp - 5], cl
mov dx, word [esp]
inc esi
rcl dx, 1
not dx
sar di, cl
sbb di, si
movzx ecx, cl
setp dh
shr dx, cl
sbb di, bp
mov edx, esi
pushal
add esi, ecx
push edi
movzx edi, bl
setnp cl
push esp
mov cl, byte [esi]
bswap edi
mov byte [ebp + 0xc], cl
pushfd
movzx di, bl
pushfd
inc di
inc esi
adc di, sp
pushfd
movzx ecx, cl
sal di, cl
ror di, cl
mov edi, esi
bt sp, bp
test dl, 0x7e
test al, dh
push dword [esp + 8]
add esi, ecx
sub cl, 0xc5
bts cx, 0xa
test ax, dx
movzx ecx, word [esi]
cmc
bt esp, 0x16
jmp 0x41012

Function at 0x260cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0x24a7f
mov edx, 0xe1a7dd7c
push 0x2ef4e5ed
mov dword [esp], 0x100
jmp 0x40af8
not dh
movsx dx, al
not dl
lea edx, [ebp - 0x150]
pushal
jmp 0x23ee2

Function at 0x260ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x31378
mov dword [esp], eax
push 0x11b4e1bf
lea esi, [edi + 0x10]
pushal
call fcn.00046e14

Function at 0x266d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x1e510]
mov byte [esp], 0xc6
mov word [esp], dx
push 0xc7fee3fd
lea esp, [esp + 8]
jmp 0x24a92

Function at 0x26f17
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x2df36
push dword [esp]
jmp 0x25121
mov eax, dword [0x1e2c8]
push edi
jmp 0x41e3c
lea esp, [esp + 0xc]
jne 0x2c975
jmp 0x2a954

Function at 0x2705d
Capabilities:
Encode data using base64

Disassembly:
jmp 0x2f408
push edx
pushfd
mov word [esp], bx
push esp
pushal
mov dword [esp + 0x24], 0x25703
pushal
mov word [esp + 0xc], 0xcd77
call fcn.00023e54
mov byte [esp], bh
mov dword [esp + 0x2c], edx
call fcn.00026c43
not dh
push str.REGISTRYMACHINESYSTEMCurrentControlSetServices_
mov dx, 0xba7
lea edx, [ebp - 8]
jmp 0x29de8
Function at 0x27e8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x48], edx
push 0xc404f8ec
lea esp, [esp + 0x4c]
call fcn.000139d0
bsf si, bp
shld si, bx, 0xf
mov esi, eax
clc
test bl, 0x8a
pushfd
test esi, esi
jmp 0x3537e
jmp 0x3aaf9
pushal
mov word [esp + 4], 0x22a0
lea esp, [esp + 0x24]
je 0x24a7f
mov bh, bl
mov ebx, dword [ebp - 4]
pushal
call fcn.0003be18

Function at 0x2a7ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x20]
jl 0x2b756
shr dh, cl
not al
sbb ax, bp
add ecx, dword [0x1e2a4]
rdtsc
movsx ax, cl
movzx dx, dl
mov dword [ebp - 4], ecx
movsx eax, al
jmp 0x353d8
push eax
call fcn.0002ffc0
pushal
jmp 0x36361
pushfd
mov dword [esp + 0x3c], esi
push edx
jmp 0x33375
pushal
pushfd
pushfd
mov byte [esp], 0x63
lea esp, [esp + 0x28]
jne 0x32476
clc
clc
cmc
cmc
sub eax, edx
call fcn.0002e1b3
mov dword [esp], edx
jmp 0x23084
push 0x1277dc8d
push dword [esp + 4]
mov dword [esp + 0xc], esi
mov byte [esp + 8], 0x24
jmp 0x32249
pushfd
mov dword [esp + 0xc], 0
pushal
mov dword [esp + 4], 0xc35e54bb
push eax
lea esp, [esp + 0x30]
call fcn.0001b010
pushal
mov edi, eax
pushal
mov dword [esp + 0x3c], 0x2e
jmp 0x25d97
call fcn.00022cf0
movzx ecx, byte [eax + 0x13c2c]
pushfd
call fcn.000463bf
mov dword [esp + 0x3c], 0x3cf9a
push 0x1b67d8aa
jmp 0x427d6
test cl, cl
mov word [esp], 0xea2b
pushfd
lea esp, [esp + 8]
js 0x28ffb
jne 0x32476
pushfd
stc
sub eax, edx
push dword [esp]
mov word [esp], 0x869
pushfd
mov dword [esp + 8], eax
mov byte [esp], 0xf3
jmp 0x30386
pushal
mov dword [0x1e2dc], ecx
setns al
rdtsc
mov dword [esp + 0x1c], edi
pushfd
lea edx, [ebp - 4]
jmp 0x3c297
lea esp, [esp + 0x24]
call fcn.00014fd0
btc cx, dx
mov ecx, dword [ebp - 4]
cmc
test ecx, ecx
jmp 0x38a5d
je 0x2b756
cmp al, 0x20
test ch, dl
pushal
test eax, eax
jmp 0x21328
mov dword [esp + 0x1c], edx
pushfd
pop eax
lea eax, [ebp - 0xc]
pushfd
mov dword [esp + 0x1c], eax
jmp 0x40654
call fcn.00031582
mov dword [esp], 0x67367e9f
inc eax
jmp 0x34a68
push ebx
call fcn.0003229e

Function at 0x2aced
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x100
seta dl
push 0xd0a17cad
movzx edx, bl
lea edx, [ebp - 0x150]
pushfd
call fcn.000408c6
lea esp, [esp + 0x30]
je 0x24a7f
clc
test ah, dh
cmp eax, dword [ebp - 0x1c]
pushal
mov byte [esp + 8], bl
mov word [esp], 0x1f8f
pushal
lea esp, [esp + 0x40]
je 0x24a7f
mov dl, dh
bswap dx
jmp 0x227da

Function at 0x2ad8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ecx
push 0xdf0f8da7
test cl, dh
pushfd
xor esi, esi
call fcn.00032d1d
add esi, edi
jmp 0x36909

Function at 0x2b373
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0x25256
call fcn.00027591
Function at 0x2c635
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aas
sub ah, bl
aad 0x5a
xor al, 0xee
mov eax, dword [ebx - 4]
cmp bl, dh
stc
test bx, 0x86ef
test eax, eax
jo 0x3ab34
pushal
push 0xb7f4c77e
push ebp
lea esp, [esp + 0x28]
je 0x1955a
bsf dx, bx
push 0x598bfe47
or si, si
mov edx, dword [ebp - 8]
sub si, di
or si, 0xea22
lea esp, [esp + 4]
jbe 0x315f3
btr si, di
lea esi, [eax + edx]
mov dword [ebp - 4], eax
cmc
cmp eax, edx
pushfd
jmp 0x370c9
push 0xb016e3ee
mov dword [esp + 4], 0x41a1df32
lea esp, [esp + 0x4c]
jb 0x19507
bsr si, cx
mov ebx, dword [ebp - 8]
push 0x5d70f1e2
pushfd
lea esp, [esp + 8]
je 0x1955a
stc
mov si, 0x512
mov edx, dword [ebp - 8]
movsx si, al
bts si, 8
btr si, bx
lea esi, [eax + edx]
bsf ax, ax
mov ax, di
mov eax, dword [ebx]
test di, 0x1db5
pushal
cmc
test eax, eax
push dword [esp + 0x10]
push 0x35bc7102
pushfd
call fcn.0003b0b2

Function at 0x2c9bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x2e550
setg dh
lea edx, [ebp - 4]
mov word [esp + 0x10], 0xf82d
jmp 0x3e4e1
push dword [esp + 4]
lea esp, [esp + 0x44]
jp 0x26e2f
push edx
call fcn.0002f22a

Function at 0x2d050
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
bswap cx
pushfd
mov ecx, dword [ebp - 0x10]
pushfd
not di
pushfd
mov dword fs:[0], ecx
mov esi, esi
mov edi, dword [esp + 0xc]
mov bl, byte [esp + 4]
pop esi
movzx bx, dl
mov esi, dword [esp + 0xc]
lea esp, [esp + 0x10]
jle 0x34408
mov ebx, ebp
pop ebx
call fcn.0002ae05

Function at 0x2fa0d
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
push edx
cmc
add eax, 0x493e0
add esp, 0x28
jge 0x38a58
cmp ch, 0x79
stc
stc
mov dword [ebp - 0x20], eax
aad 0xd1
btr ax, dx
das
mov eax, dword [0x1e51c]
pushfd
bt esi, 0xa
test eax, eax
mov word [esp], si
jmp 0x224dc
call fcn.00028d77

Function at 0x2fc82
Capabilities:
Execute anti-debugging instructions

Disassembly:
seto dh
lea edx, [ebp - 0xc]
jmp 0x4387b
mov dword [esp + 0x28], edx
push dword [esp]
mov word [esp + 4], 0x104e
push 0x6f11bde6
call fcn.00014874
bt dx, cx
add esi, 2
jmp loc.00011135
push ebx
pushfd
jmp 0x40ffa

Function at 0x308f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00033370
mov dword [ebp - 0x20], eax
lea esp, [esp + 0xc]
rcl ah, 4
mov eax, dword [0x1e51c]
stc
cmc
cmc
pushfd
test eax, eax
jmp 0x2cded

Function at 0x31334
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
call fcn.00014d20
lea esi, [esp - 0x6458de87]
or si, di
clc
mov esi, dword [0x1e37c]
push ebp
test esi, esi
pushal
mov dword [esp + 4], 0x9ac8de91
pushfd
mov byte [esp + 0xc], ah
lea esp, [esp + 0x28]
je 0x34b1b
cmc
mov dl, 0x4b
aaa
mov edx, 0xa
lahf
call fcn.00045026

Function at 0x31a52
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edx + eax + 0xc]
test bp, ax
pushfd
clc
cmc
cmp esi, eax
push 0x16f859a
jmp 0x39982
test dl, al
add edx, ecx
jmp 0x30419
Function at 0x31d9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmp al, 5
pushfd
jmp 0x3330c
push dword [esp]
movzx di, cl
inc esi
dec di
movzx ecx, cl
bsf edi, edx
mov edi, esi
pushal
add esi, ecx
mov cl, ch
mov byte [esp], bl
movsx cx, al
movzx ecx, word [esi]
push dword [esp + 4]
pushfd
cmp edx, eax
cmp dl, bl
add esi, 2
jmp 0x275ca
lea esp, [esp + 0x50]
jne 0x46ea3
mov ah, ah
pushfd
mov eax, dword [ebp + 0xc]
pushfd
mov dword [esp + 4], eax
pushal
mov byte [esp + 4], 0x68
mov dword [esp + 0x20], ecx
pushal
setne cl
setb ch
pop ecx
mov ecx, dword [ebp - 5]
mov dword [esp], 0xa3339ca9
mov dword [esp + 0x38], edi
call fcn.0003a101
mov edx, esi
lea edi, [edx + 0x4e86696a]
add esi, ecx
push esp
dec cl
mov cl, byte [esi]
dec di
movsx di, al
mov dword [esp], 0xa5491064
mov byte [ebp + 0xc], cl
jmp 0x2e62e
jmp 0x302fa

Function at 0x3210f
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
push 0x11
push esp
lea eax, [ebp - 0x150]
pushfd
mov dword [esp + 4], eax
pushal
jmp 0x38329
mov word [esp + 0x14], 0x24f2
pushal
lea esp, [esp + 0x40]
call sub.ntoskrnl.exe_memset
bsr ax, di
add esp, 0xc
jmp 0x2d2a0
push ecx
mov dword [esp + 0x24], 0x1e018
jmp 0x375ba

Function at 0x32bf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bh, 0x8c
test esi, esi
pushfd
lea esp, [esp + 8]
je 0x24a7f
pushfd
pop ebx
mov ebx, dword [ebp - 4]
call fcn.0003f24e
mov dword [esp], esp
lea esp, [esp + 0x20]
je 0x442ba
pushfd
mov dword [esp], ebx
jmp 0x2b29a
Function at 0x35b66
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
call fcn.000451f9
jmp 0x346e2
push esp
mov dword [ebp - 4], ecx
pop eax
bswap ax
mov dword [0x1e2d8], ecx
setns cl
cwde
mov byte [esp], 0xee
lea eax, [ebp - 4]
not cl
not ch
movsx ecx, cl
movzx cx, dl
mov dword [esp], eax
movsx cx, bl
lea ecx, [ebp - 0xc]
call fcn.0003aff3
bswap cx
mov ecx, dword [0x1e4f0]
pushfd
lea esp, [esp + 4]
jo 0x413b9
pushal
mov dword [0x1e2bc], esi
push dword [esp]
push eax
lea esp, [esp + 0x28]
jmp fcn.00030f6d
cwde
push 0xd813b145
call fcn.0003c0c5
test eax, eax
pushal
lea esp, [esp + 0x20]
jl 0x3c0cf
sbb al, 0xc4
sbb al, bh
push 0x32c77674
shrd ax, si, 2
add ecx, dword [0x1e2a4]
jmp 0x21904
sub ax, si
aad 0xf7
bt si, 0xd
and ax, 0x5f3c
mov eax, dword [0x1e510]
pushfd
clc
test ecx, 0xa47a262a
test eax, eax
pushfd
lea esp, [esp + 8]
js 0x11852
jge 0x2b030
je 0x396f7
push 0x49ea2aa2
cmc
pushfd
test dh, 0xac
cmp eax, dword [ebp - 8]
mov word [esp], sp
pushal
lea esp, [esp + 0x28]
je 0x434db
setne al
push 0x100
setae al
cwde
lea eax, [ebp - 0x150]
jmp 0x329fe
pushal
pushal
lea esp, [esp + 0x40]
je 0x3c0cf
stc
jmp 0x24768
je 0x396f7
cmc
cmc
bt cx, cx
cmp eax, dword [ebp - 8]
call fcn.00038106
jmp 0x2aa8f
push 0
pushal
mov dword [esp + 0x3c], 0x22e090
mov word [esp + 8], 0xd19c
lea esp, [esp + 0x3c]
call fcn.000138e0
pushal
pushal
mov byte [esi + 0x28], 0
push 0xb57be381
push ebx
lea esp, [esp + 0x48]
call fcn.0001b420
stc
add eax, 0x493e0
pushal
mov dword [ebp - 0x20], eax
das
mov eax, dword [0x1e51c]
cmc
test eax, eax
push 0xb2d2911a
jmp 0x3b63d
call fcn.000359c0
je 0x3c0cf
cmc
clc
cmp ebp, edi
clc
test eax, eax
pushal
pushal
lea esp, [esp + 0x40]
jl 0x3c0cf
rol al, cl
push ebx
pushal
add ecx, dword [0x1e2a4]
bswap ax
lahf
mov dword [ebp - 4], ecx
jmp 0x2395d
lea esp, [esp + 0x24]
je 0x24a7f
push ebx
clc
cmp eax, dword [ebp - 0x1c]
push dword [esp]
pushal
lea esp, [esp + 0x28]
je 0x24a7f
call fcn.00041d0e
cmc
jmp 0x3ed0d
setne ah
pushfd
bswap ecx
xchg al, cl
lea eax, [ebp - 4]
push 0x9c2cfe84
movzx cx, al
mov dword [esp + 4], eax
call fcn.0002fd6c
test ecx, ecx
jb 0x26dc4
jmp 0x3a09c
jg 0x118ea
pushfd
pushal
pushal
mov dword [0x1e2bc], esi
mov byte [esp], 4
pushfd
lea esp, [esp + 0x48]
jmp fcn.00030f6d
clc
cmc
call fcn.0004496d

Function at 0x369a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
pushal
lea esp, [esp + 0x24]
je 0x2e0a0
shl dx, 0xc
lea edx, [edi - 0x2d9d608e]
mov dword [eax + 0x78], ecx
bsr edx, esi
mov cx, 0xa9f0
bsr cx, ax
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
shrd cx, cx, cl
shr ecx, 0xc
mov ecx, 0x1770
pushfd
mov byte [esp], 0x34
cmp word [edx], cx
jmp 0x35a14
neg cl
ror dl, 2
rol dl, 2
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
or ch, dh
shrd cx, sp, cl
ror cx, 0xe
call fcn.000262bf
pushal
push 0x1c50d579
lea esp, [esp + 0x28]
jb 0x24b53
bsr ax, ax
lea eax, [edi - 0x30cd396e]
lahf
mov eax, dword [0x1e3d0]
call fcn.0002f6e6
cmc
call fcn.000253aa
mov dword [esp + 0x24], edi
pop edx
push 0x4ac1aafc
not dl
lea esp, [esp + 0x24]
sets cl
lea edx, [ebp - 4]
lea ecx, [edx*2 - 0x597741fe]
call fcn.000255e9
jmp 0x25a03
Function at 0x372d8
Capabilities:
Check http status code

Disassembly:
clc
pushfd
cmp ah, 0xcb
sub edx, 4
cmc
push 0xffe4cc1f
add eax, 4
clc
bt edx, ecx
add ecx, 4
stc
cmp edx, 4
call fcn.00021b2c
lea esp, [esp + 0xc]
jne 0x471f4
bt bx, bx
je 0x21fc8
pushal
mov byte [esp], 0x5d
sub edx, 4
push ebx
call fcn.00025c6c

Function at 0x3836d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jb 0x19636
lea edi, [ebx + 0x7d5dfa34]
setns dh
pop edi
test dl, dl
cmp eax, dword [ebx + 0xc]
jmp 0x3e089
jmp 0x2e76b

Function at 0x39125
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x44]
je 0x24a7f
push 0x63075d1f
mov ebx, dword [ebp - 4]
jmp 0x41ab0
jmp 0x325f2
push dword [esp]
call fcn.000223f8

Function at 0x3948b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 8], di
lea esp, [esp + 0x2c]
jp 0x3695e
pushal
mov dword [esp + 0x1c], 0x1e018
jmp loc.00018c71

Function at 0x3a130
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
lea esp, [esp + 8]
je 0x2e0a0
stc
cmc
cmp dword [eax + 0x78], ecx
jmp 0x369cb
jmp 0x259dd
mov byte [esp], 0x47
mov word [esp], 0xbede
test ecx, ecx
pushfd
lea esp, [esp + 8]
je 0x2e0a0
add ax, bp
mov eax, dword [esi + 8]
bt sp, cx
cmc
test eax, eax
push 0xa5854b78
jmp 0x2ecc3

Function at 0x3aff3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
pushfd
push edx
mov dword [esp + 4], str.IoFreeWorkItem
jmp 0x2308a

Function at 0x3b124
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x2e0a0
pushfd
jmp 0x4467f
mov dword [esp + 4], edi
lea esp, [esp + 0xc]
je 0x2e0a0
shr dx, 8
rol dx, cl
btr dx, si
add dh, bl
mov dword [eax + 0x78], ecx
xadd dx, cx
btc ecx, 0x10
shrd dx, dx, 0xa
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
rcl cl, cl
mov ecx, 0x1770
pushfd
mov byte [esp], ah
pushfd
cmc
cmp word [edx], cx
jmp 0x410f7
test eax, eax
lea esp, [esp + 0xc]
je 0x4415f
pushal
lea esp, [esp + 0x20]
jns 0x41c1c
jmp 0x29540
lea esp, [esp + 8]
jb 0x24b53
shr al, 1
clc
shr ax, cl
pushfd
mov eax, dword [0x1e3d0]
cmc
test eax, eax
mov byte [esp], dh
pushal
jmp 0x41e37
pushfd
push dword [esp]
lea esp, [esp + 8]
je 0x2e0a0
cmc
push eax
mov word [esp], 0x4ca8
cmp dword [eax + 0x78], ecx
push eax
push ecx
jmp 0x381ff

Function at 0x3b524
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp loc.0001974d
lea esp, [esp + 0xc]
je fcn.00037b07
pushal
push 0xb6470e97
pushal
pushfd
cmp word [ebp - 0x20], 0x5e
push dword [esp]
mov word [esp], bx
jmp 0x3152a

Function at 0x3b665
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [ebp - 4]
pushal
jmp 0x40f35
mov dword [esp + 0x20], edi
call fcn.0003cff9

Function at 0x3bd7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
mov dword [esp + 0xc], 0x2e
jmp 0x3334a

Function at 0x3dd01
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb077a267
push 0xb765c8e9
mov byte [esp], 0x9d
mov dword [esp + 0x28], esi
call fcn.0003c3fa