joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3999e
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea edi, [0x45dc4c59]
mov esi, ebx
pop edi
mov edi, 0x1e4e0
mov byte [esp], bl
mov word [esp], si
push edi
rep movsd dword es:[edi], dword [esi]
call fcn.00023975
pushal
push esi
pushal
lea esp, [esp + 0x44]
jmp fcn.00025242

Function at 0x399d8
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0x4c5b
mov byte [esp], 0x76
lea esp, [esp + 0x20]
call fcn.00016d00
not ah
bswap ax
lahf
sete al
mov byte [ebp - 1], 1

Function at 0x39ddb
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
call fcn.00019467
lea esp, [esp + 0x28]
jne 0x21639
push edx
pushal
pushfd
mov dword [esp + 0x20], str.IoQueueWorkItem
push 0xbc9501b
mov byte [esp], 0x36
call fcn.00023af4

Function at 0x3a187
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
jne 0x3a96f
rol ah, cl
shrd ax, dx, 0xe
btr ax, 2
mov eax, dword [0x1e2f8]
test ch, ch
cmp eax, ebx
jmp 0x3d60b
pushfd
call fcn.00026ba8
push 0xba756230
jmp 0x37b81
pushfd
call fcn.000359d0

Function at 0x3a1c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp loc.00013f6f
stc
test edi, edi
pushal
lea esp, [esp + 0x28]
je fcn.0002db87
jmp 0x380bf

Function at 0x3a64a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 4], 0xbf51
pushfd
lea esp, [esp + 0xc]
jb 0x2b2b4
call fcn.00035917

Function at 0x3a6b5
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pushfd
pushal
mov dword [ebp - 0x20], eax
pushfd
mov dword [ebp - 4], esi
pushfd
lea esp, [esp + 0x30]
jmp 0x36042

Function at 0x3aa7c
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
call fcn.0003cfb6
mov word [esp + 0xc], ax
lea esp, [esp + 0x28]
je 0x2bdf3
bswap ax
shr ah, 1
lea eax, [ecx + 0x479d653e]
mov eax, dword [0x1e348]
stc
pushal
pushal
test eax, eax
pushfd
mov byte [esp], cl
lea esp, [esp + 0x44]
je 0x25ae6
call fcn.00034199
cwde
mov eax, dword [0x1e504]
pushal
pushal
jmp 0x335ef

Function at 0x3aaca
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
je 0x3ec40
call fcn.000390ea

Function at 0x3aafc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xd9ffe023
lea esp, [esp + 0xc]
je 0x4115c
pushal
pushal
call fcn.0002980c

Function at 0x3ae83
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
mov dword [esp + 4], 0x100
push dword [esp]
xchg dword [esp + 4], eax
pushal
pushfd
movsx eax, cl
lea eax, [ebp - 0x138]
push 0x1b968eb0
call fcn.00039f15

Function at 0x3aeba
Capabilities:
Check http status code

Disassembly:
call fcn.00028d7d
lea esp, [esp + 0x28]
jne 0x3d426
rol si, 4
and si, dx
sar esi, 0x19
mov esi, dword [ebp + 0x10]
bt edi, esi
test bl, al
cmp dword [esi + 0xc], 1
jmp 0x3321f
Function at 0x3b4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0xdb80
jmp 0x28709

Function at 0x3b620
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 8], ebx
pushal
call fcn.00019170

Function at 0x3b62a
Capabilities:
Check http status code

Disassembly:
aad 0xd8
shl eax, cl
mov eax, dword [0x1e510]
bt dx, dx
push ecx
test eax, eax
call fcn.000264ea
mov ah, bl
jmp 0x24087
mov eax, dword [ebp + 0xc]
push ebp
call fcn.00041f60
call fcn.0002f511
pushal
mov dword [esp + 0x20], eax
mov byte [esp], 1
lea esp, [esp + 0x20]
call fcn.00013b90
pushfd
test al, al
pushal
lea esp, [esp + 0x24]
je 0x3c94f
jmp 0x32210
stc
jmp 0x2406b

Function at 0x3b99b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx di, al
push 0x8914db7c
mov edi, eax
mov byte [esp], bh
mov dword [esp + 4], 0x2e
mov byte [esp], 0x6a
jmp 0x3a60a

Function at 0x3bc11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov dword [esp + 0x20], eax
pushfd
mov dword [esp + 0x20], 0x25928
call fcn.0002b84f
mov word [esp], bx
mov word [esp], 0x9fdf
mov dword [esp], ebx
push esi
jmp 0x324d2
lea esp, [esp + 0x2c]
je 0x18d41
push 0x849b9177
jmp 0x32997

Function at 0x3be0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol edx, cl
shld dx, dx, 7
movsx dx, al
add ecx, dword [0x1e2a4]
pushfd
movzx dx, al
push edi
mov dword [ebp - 4], ecx
mov dh, 0x52
movzx dx, dl
mov dx, di
call fcn.00027470
lea esp, [esp + 4]
jl 0x250ee
sub dl, 0x36
or dh, 0xce
jns 0x30f36
pushfd
add ecx, dword [0x1e2a4]
pop edx
jmp 0x3745b
mov dword [esp + 0x40], str.IoAllocateWorkItem
push dword [esp]
mov word [esp + 0x14], 0x72d
push ebp
pushfd
lea esp, [esp + 0x4c]
call fcn.00014d20
or cl, ch
bt di, dx
cmc
or ch, bh
mov ecx, dword [ebp - 4]
cmp dl, 0x35
test ecx, ecx
push esi
lea esp, [esp + 4]
je 0x250ee
bt si, 0xd
push 0xdbb8a907
test eax, eax
jmp 0x32e12

Function at 0x3c1a9
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
jne 0x2bdf3
pushal
mov dword [esp + 0x1c], 0x1e324
jmp loc.000111ee

Function at 0x3c2aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x34]
call fcn.00013310
neg al
mov eax, dword [0x1e2bc]
call fcn.00023c7d

Function at 0x3c2bf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.000319e6
pushfd
pushfd
pushfd
mov dword [esp + 0x34], 0
jmp 0x2ca41

Function at 0x3c343
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 4], 0
pushal
pushfd
mov dword [esp + 4], esp
lea esp, [esp + 0x2c]
jmp fcn.0002db87

Function at 0x3c359
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 4], dx
mov dword [esp + 4], 0
call fcn.0002d5c8
lea ecx, [ebp - 0x150]
jmp 0x41cfe
push dword [esp]
jmp 0x28ba2
Function at 0x3c437
Capabilities:
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x20]
call fcn.00013720
shld si, di, 3
mov esi, eax
pushfd
cmp ah, 0x8e
cmc
call fcn.0003d445
lea esp, [esp + 0x28]
jle 0x32667
call fcn.00013720
shr si, cl
bsr esi, esp
mov si, 0x19a1
bswap si
mov esi, eax
jmp 0x32a39

Function at 0x3c4c5
Capabilities:
Check for software breakpoints
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
mov byte [esp], ch
pushal
pushal
mov dword [esp + 0x40], 8
lea esp, [esp + 0x40]
jne 0x3505b
pushfd
mov dword [esp], esi
jmp fcn.00034d2f
pushfd
call fcn.0002e9f1
jmp 0x40e1f
push eax
mov byte [esp], 0x76
mov dword [esp], esi
pushal
pushfd
mov byte [esp + 4], 0x52
push edx
mov dword [esp + 0x24], edi
jmp 0x2debf
push 0xbcd843b5
pushfd
pushal
lea esp, [esp + 0x28]
jne 0x24bca
call fcn.0002266f
mov bx, 0x2fbf
add bh, 0x7d
xor bx, 0x5835
mov ebx, dword [edx + eax]
test edi, ebx
jmp 0x319bb
pushal
test cl, dh
add eax, 4
cmp ah, 0x5f
cmp ecx, 4
push dword [esp]
push 0x5ed91f4f
mov byte [esp], 0x8d
lea esp, [esp + 0x30]
jae 0x3738a
pushal
pushal
push 0x497ddf98
pushfd
lea esp, [esp + 0x48]
jmp fcn.0003bfed
cmp ch, 0xcd
cmp ebx, dword [eax]
pushal
lea esp, [esp + 0x20]
jne 0x3626e
pushal
mov byte [esp + 4], 0xb
lea esp, [esp + 0x20]
jne 0x24bca
bt bx, cx
bt ecx, 0x13
pushfd
pushal
sub ecx, 4
pushfd
push dword [esp]
pushfd
add eax, 4
cmc
cmp ch, al
cmc
cmp ecx, 4
push edi
push dword [esp + 4]
lea esp, [esp + 0x38]
jae 0x3738a
push eax
mov word [esp], cx
lea esp, [esp + 4]
jmp fcn.0003bfed

Function at 0x3c51b
Capabilities:
Check http status code

Disassembly:
call fcn.00037aae
pushfd
lea esp, [esp + 8]
je 0x2bdf3
lea eax, [ebx*2 - 0x727ed9c1]
mov eax, dword [0x1e348]
call fcn.0003cbee
push 0xbf62758a
mov dword [esp], eax
jmp 0x2caaf

Function at 0x3c852
Capabilities:
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x3d6dd
bt bx, si
push ecx
mov dword [ebp - 0x1c], eax
clc
cmc
mov word [esp], 0x2212
call fcn.00023fa7
push 0x3ff4fc88
mov dword [esp], eax
jmp 0x2767e
lea esp, [esp + 0x48]
jb 0x32a1c
sub ax, ax
neg eax
aas
mov eax, dword [ebx + 0x34]
jmp 0x33dc0
push ebp
lea esp, [esp + 4]
call sub.ntoskrnl.exe_memset
bsr cx, sp
rcr ch, 2
bsr cx, bx
add esp, 0xc
movzx cx, bl
pushal
pop ecx
pushal
mov dword [esp + 0x38], 0x13
jmp 0x42523
not cl
push 0x2f509295
lea ecx, [ebp - 0x150]
jmp 0x26fa6

Function at 0x3c92a
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], dl
pushfd
mov dword [esp + 8], 0x5000
call fcn.0002c632

Function at 0x3c93c
Capabilities:
Check http status code

Disassembly:
cmc
bt bp, bx
pushal
add eax, 0x1b7740
pushfd
mov dword [ebp - 0xc], eax
lea esp, [esp + 0x28]

Function at 0x3cc34
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov dword [0x1e374], eax
stc
call fcn.0003214b
Function at 0x3ced0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], cl
mov dword [esp + 0x24], ecx
mov word [esp + 8], 0x8599
mov dword [esp + 0x20], 2
call fcn.0002b670

Function at 0x3cf7c
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x2c]
jbe 0x3d426
call fcn.0003fb06

Function at 0x3cffa
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp si, bp
add edi, 0x28
cmp cx, dx
sub edx, 1
call fcn.00039b83
pushal
cmc
mov byte [esp], bh
test eax, eax
pushfd
pushfd
push edx
mov byte [esp], bl
lea esp, [esp + 0x30]
je 0x3bffd
shl di, cl
movsx cx, cl
cmc
adc cl, bl
mov ecx, dword [esi]
dec di
mov edx, edx
mov dword [eax], ecx
lahf
bsf di, ax
shl dx, 0xf
mov edx, dword [esi + 4]
bsf di, sp
bt dx, si
mov eax, dword [0x1e308]
test dl, 0x88
bsf si, sp
mov dword [eax + 4], edx
rdtsc
movzx si, bl
rcr di, 0xa
mov edi, dword [0x1e304]
sar edx, 4
pushfd
add cl, 0x24
bswap si
mov esi, dword [0x1e308]
movzx cx, dl
bsf cx, bx
push edx
rdtsc
mov edx, edi
xadd ax, cx
mov ecx, 8
sal ah, 3
lahf
sub eax, 0xa8581e62
mov eax, esi
stc
pushal
call fcn.0003c5a6
mov byte [esp], 0xfa
pushfd
inc edi
call fcn.0003263a
pushfd
mov eax, dword [edi]
stc
test eax, eax
push 0x97b23bbd
lea esp, [esp + 0xc]
je 0x3c974
stc
call fcn.0002a981
jmp 0x3cf71

Function at 0x3d181
Capabilities:
Check http status code

Disassembly:
mov word [esp], 0x8bfd
lea esp, [esp + 0x28]
je 0x3affc
cmp edx, 0x25cce5fc
cmc
sub cl, 0x25
mov ecx, dword [ebx]
shrd ax, bp, 0xb
xor al, 0xd1
bt esp, 0x17
mov eax, dword [ecx + 4]
clc
test ch, 0x62
test eax, eax
pushal
lea esp, [esp + 0x20]
je 0x3affc
rol cl, cl
mov cl, byte [eax + 2]
call fcn.0002e17d

Function at 0x3d337
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt bp, 4
bt bp, si
stc
cmp word [eax + 0x10], 0
push ebp
jmp 0x2b9e0
call fcn.0003dce7
clc
mov dword [ebx + 0x10], edx
sub esp, 0xfffffffc
jae 0x21c19
cmp si, 0x2a7a
pushal
cmp word [eax + 0x10], 0
jmp 0x3f468

Function at 0x3d445
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x2979a
pushfd
mov dword [esp], 0x100
jmp 0x2ec56
pushfd
pushfd
mov dword [esp + 4], eax
sete ah
lea eax, [edi - 0x2ae06c4a]
lea eax, [ebx - 0x622ef844]
lea eax, [ebp - 0x138]
push ecx
mov dword [esp + 4], eax
push eax
pushal
jmp 0x36c15
jmp 0x41147
push dword [esp]
lea esp, [esp + 0x2c]
call sub.ntoskrnl.exe_memset
stc
sub ch, ah
add esp, 0xc
movzx cx, bl
mov ch, bl
mov ch, 0xe1
movsx cx, al
push 0x13
movzx cx, dl
lea ecx, [ebp - 0x138]
jmp 0x33148
push 0x1e050
call fcn.0003d01a
test esi, esi
jmp 0x25264
push ecx
jmp 0x38cf1

Function at 0x3d6d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.0002db87
Function at 0x3dc00
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 4]
jne 0x2d891
cmp dx, bx
pushfd
mov dl, byte [eax + 1]
stc
cmp dl, byte [ecx + 1]
push 0x2d377fed
call fcn.000258db
jmp 0x24e86
cmc
bswap si
mov eax, dword [edi + ebx + 0x54]
shld si, bp, 0xa
clc
call fcn.0002d6bd
pushfd
cmp dl, byte [ecx]
jmp 0x22693
lea esp, [esp + 0x38]
jae 0x378bf
sar dl, 2
shr dl, cl
sal dl, 5
rol dl, cl
mov dl, byte [eax]
jmp 0x2d772

Function at 0x3dce7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
lea esp, [esp + 0xc]
je 0x35296
stc
shr cl, 1
movzx eax, word [eax + 0x10]
sbb ch, 0x5e
mov ecx, eax
push 0x6fa6e398
and ecx, 0xff
call fcn.00029940

Function at 0x3dd10
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pushal
pushfd
mov dword [esp + 0x20], 0
jmp 0x2f832
lea esp, [esp + 0x20]
call sub.ntoskrnl.exe_memset
setne ah
mov eax, str.SystemRoot_system32drivers_
cmc
xadd dx, cx
neg ecx
mov edx, edi
pushfd
pop ecx
shld ecx, eax, cl
adc cx, 0xc14
add esp, 0xc
setle ch
shr cl, 1
sub edx, eax
shld cx, sp, 8
btc cx, di
btr cx, ax
rcl ch, 3
movzx ecx, word [eax]
jmp fcn.00013f1b
aad 0x15
bsr ax, ax
mov eax, dword [ebp - 4]
dec si
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0xe6212228
pushal
jmp 0x40ddb
pushfd
jmp 0x3cc80
pushfd
jmp fcn.00028f48
push eax
mov dword [esp + 0x20], edi
mov dword [esp], ebp
mov byte [esp + 0x10], 0x9f
jmp 0x23a5a
call fcn.00022643
push edx
call fcn.0002d17d
lea esp, [esp + 0xc]
je 0x27ce3
jmp 0x3f2a5
pushal
lea esp, [esp + 0x20]
jl 0x2dd23
push eax
mov dword [esp], 0x400
jmp 0x21814
pushal
test eax, eax
jmp 0x2c672

Function at 0x3dd39
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp fcn.00025242
call fcn.0002dec5
lea esp, [esp + 0x28]
je 0x25ae6
call fcn.000373a0
push edx
jmp 0x341a6
pushal
mov dword [esp + 0x20], 0x1e324
jmp 0x3dd25

Function at 0x3e01c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x39ecd
call fcn.00023285

Function at 0x3e146
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
stc
jmp 0x35a40
cmp dword [esi + 0xc], 1
pushal
lea esp, [esp + 0x24]
jne 0x3d426
lea ecx, [ecx + 0x3b0bf3cd]
not ecx
pushfd
mov cl, bh
mov eax, dword [esi]
call fcn.00032cfa
lea esp, [esp + 8]
jne 0x3d426
pushfd
mov esi, dword [ebp + 0x10]
cmp al, 0xed
jmp 0x24326
Function at 0x3e2f2
Capabilities:
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x2d145
lea esp, [esp + 4]
call fcn.0001ad20
lea edx, [ebx + 0x1cb05d23]
push esi
bswap ax
cdq
pushfd
mov dword [esp], str._Gpesys.dat
rdtsc
pushal
cdq
lea edx, [ebp - 0x138]
setbe al
pushfd
lahf
mov dword [esp + 0x20], edx
movzx eax, al
pushfd
bswap ax
jmp 0x3f9b6
pop ecx
setno cl
push 0x13
lea ecx, [eax - 0x18b97ebd]
lea ecx, [ebp - 0x138]
pushal
mov dword [esp + 0x1c], ecx
lea esp, [esp + 0x1c]
ja 0x3c5e0
push ecx
mov dword [esp], 0x1e050
jmp 0x3f441
pushfd
jmp 0x21cf5
push 0x844135c5
pushfd
push dword [esp + 4]
pushfd
mov dword [esp + 0xc], 0x1e050
mov byte [esp + 8], al
pushal
lea esp, [esp + 0x2c]
call fcn.0001ad20
rdtsc
bswap dx
rdtsc
lahf
push esi
movsx dx, bl
push str._Gpesys.dat
bswap dx
call fcn.000135e0
add esp, 0xc
push 0xe63e13bf
jmp 0x2dfd0
lahf
not al
lea eax, [ebp - 0x138]
pushal
mov byte [esp + 0xc], ch
mov dword [esp + 0x2c], eax
lea esp, [esp + 0x2c]
jbe 0x1489b
pushal
lea esp, [esp + 0x20]
call sub.ntoskrnl.exe_memset
stc
jmp 0x3cf23
jo 0x3741d
push eax
pushfd
lea esp, [esp + 8]
call fcn.0001ad20
pushfd
pop eax
call fcn.00037593
lea eax, [ebp - 4]
call fcn.0002c1fb

Function at 0x3eb11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 8], 0x1e050
pushal
pushfd
mov byte [esp + 0x10], 0x9b
lea esp, [esp + 0x2c]
call fcn.0001ad20
xchg dx, ax
push esi
xchg ah, dh
push 0xbc04d7df
mov dword [esp], str._AppData.dat
lahf
rdtsc
not ah
cwde
lea edx, [ebp - 0x138]
movzx eax, bl
push edx
bswap ax
lea eax, [ebp - 4]
call fcn.0003eb3a
jmp 0x33e19

Function at 0x3eb16
Capabilities:
Check http status code

Disassembly:
add ecx, 4
test al, cl
cmp edx, 4
mov byte [esp], ah
push 0xd7600e25
lea esp, [esp + 0x48]
jae 0x4132f
test dx, di
mov dl, byte [eax]
call fcn.0002ba6d
add bh, cl
mov ebx, dword [ecx]
clc
test di, si
test ah, 0x3e
bt ax, 6
cmp ebx, dword [eax]
call fcn.00022e7a

Function at 0x3eee4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0002be4c
xchg dword [esp + 0x20], eax
movsx eax, cl
lea eax, [ebp - 0x138]
jmp 0x2f1e9
cmc
test eax, eax
pushal
lea esp, [esp + 0x24]
je 0x3c974
pushal
push ecx
pushal
cmp eax, ecx
push esi
call fcn.00039772
pushal
call fcn.00042172
lea esp, [esp + 4]
jne 0x27c3c
pushal
mov dword [esp + 0x1c], 0x100
jmp 0x40f5d
pushfd
pushfd
jmp 0x3c6ba

Function at 0x3ef2d
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x44]
jne 0x32bc6
pushfd
cmc
stc
clc
sub edx, 4
call fcn.00039e1f

Function at 0x3f1ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xaaca9be3
test eax, eax
mov byte [esp + 0x18], 0x24
mov byte [esp], 0xfc
call fcn.00018e76
test eax, eax
jmp 0x3f1d0
mov byte [esp + 4], 0x3d
push ebp
push 0x5e972ee7
lea esp, [esp + 0x10]
je 0x2271a
cmc
cmp bh, 0x42
call fcn.0002d271
push ecx
cmp edx, 0xed7d630
mov dword [0x1e308], eax
pushal
test dh, 0x42
jmp 0x338a0
Function at 0x3f6bf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jbe 0x3cb2c
pushfd
mov dword [esp], 0
pushfd
mov dword [esp], 0x38adc
push 0x6c8fa8ee
push esi
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
pop dword [esp + 4]
pushfd
pushal
pushfd
pushfd
push dword [esp + 0x30]
ret 0x34
call fcn.00022e4d
mov dword [esp + 0x1c], 8
mov word [esp + 4], 0x2d4c
push ecx
lea esp, [esp + 0x20]
jnp 0x13ce3
push 0
jmp loc.00019705
pushfd
lea esp, [esp + 8]
je 0x2b3ed
movsx ecx, al
jmp 0x38f55
pushal
mov dword [esp + 0x34], ecx
jmp 0x26fb9
pushal
mov dword [esp + 0x1c], 2
pop ecx
not ch
lea ecx, [ebp - 8]
mov dword [esp], 0x2e8d164
jmp 0x317fa
jmp 0x2aac0

Function at 0x3f758
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x4115c
push 0x2004aab9
pushfd
mov dword [esp + 4], ebx
pushal
jmp 0x396ba
mov dword [esp + 0x20], eax
push 0x524ad997
mov dword [esp + 0x20], 0x35a0a
mov byte [esp + 0x18], cl
pushal
call fcn.00033867
cmp eax, ebx
jmp 0x2bacd

Function at 0x3fb27
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], esi
pushfd
lea esp, [esp + 8]
call fcn.00013800
pushal
call fcn.00021434

Function at 0x3fb3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
pushal
cmc
test edi, edi
pushal
jmp 0x4034a
lea esp, [esp + 0x34]
jns 0x33e74
push esi
lea esp, [esp + 4]
je 0x3d05d
jmp 0x25085
pushfd
lea esp, [esp + 0x44]
je 0x2b3ed
push ebp
bswap cx
mov dword [esp], 2
not cl
lea ecx, [ebp - 8]
pushal
pushfd
push 0x35a2ef74
mov dword [esp + 0x24], ecx
call fcn.0003212c

Function at 0x3fb55
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x2c]
je 0x3d426
push 0xa24135ed
stc
stc
cmp word [ebp - 0x20], 0x5e
pushfd
mov byte [esp + 4], dl
pushal
call fcn.0003cf7c
jmp 0x2cdd7
je 0x397e4
pushfd
mov byte [esp], bh
mov dword [esp], 0x9023701b
mov dword [esp], 8
push ebx
call fcn.0003d7ef
test cx, cx
pushal
pushfd
jmp 0x26e19

Function at 0x3fedb
Capabilities:
Check http status code

Disassembly:
mov word [esp], ax
mov byte [esp + 4], bh
pushal
mov dword [0x1e2cc], edi
pushfd
mov dword [0x1e2d0], ecx
pushfd
push edx
lea esp, [esp + 0x34]
jmp fcn.00026e50

Function at 0x40042
Capabilities:
Check http status code

Disassembly:
mov dword [esp], 0x5d98e3bb
lea esp, [esp + 0x30]
call fcn.00016970
jmp 0x336c1
not cx
movzx cx, bl
push str._tj.php
jmp 0x39166
jmp 0x31ec2

Function at 0x402f1
Capabilities:
Check http status code

Disassembly:
jmp loc.00011159
lea esp, [esp + 0xc]
call fcn.00013720
rol bl, 5
sub bx, 0xe97b
movzx ebx, dl
mov ebx, eax
cmc
test ebx, ebx
jmp 0x3beed

Function at 0x40340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x4c], edx
push esi
call fcn.0002fb16
Function at 0x40472
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esp
push 0x13e67ca
mov byte [esp], 0x30
pushal
inc ebx
clc
add esi, 0x10
pushfd
call fcn.00032273
jmp 0x38ca2
pushfd
lea esp, [esp + 0x38]
ja 0x18c3a
not cx
not cl
movzx ecx, byte [eax + 0x1397c]
jmp 0x4043a
call fcn.0003203a
ror di, cl
clc
add eax, dword [0x1e4ec]
push esp
mov edi, dword [esp]
pushfd
pop edi
mov dword [ebp - 0x10], eax
lea edi, [edi - 0x3c0199ca]
bswap di
movzx edi, dl
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pushfd
mov dword [esp + 4], 0
call fcn.0002b14f
push ecx
pushal
mov dword [ebp - 4], 0
pushfd
mov byte [esp + 4], 0x32
push ecx
pushfd
lea esp, [esp + 0x30]
jmp fcn.0002db87

Function at 0x40637
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushal
bt dx, 0xe
cmp dword [eax + 4], 0
mov byte [esp], bh
lea esp, [esp + 0x20]
je 0x3d426
movsx dx, al
not dx
push 0x3711150b
mov dword [esp], 0x2f
pushal
pop edx
movzx edx, al
pushal
mov dword [esp + 0x38], str.REGISTRYMACHINESYSTEMControlSet001Services
setl dh
pop edx
mov edx, dword [ebp - 0x1c]
call fcn.0002cd82
mov byte [esp], 0x2d
lea esp, [esp + 4]
jbe 0x3d426
test esi, 0x4b151d57
pushal
cmp cx, 0x16
push ecx
push dword [esp + 8]
push 0x88d30101
mov byte [esp], 0xa4
lea esp, [esp + 0x2c]
jne 0x3d426
test di, ax
jmp 0x30a8e

Function at 0x407c9
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea ecx, [eax + 0x10]
mov word [esp], 0x3cac
cmp esi, ecx
pushal
mov byte [esp + 4], dh
pushal
push 0x23312b1e
lea esp, [esp + 0x48]
jne 0x3f609
pushal
pushfd
movsx si, bl
lea esi, [edi*2 - 0x67bfa317]
mov dword [esp + 0x20], eax
jmp 0x23751

Function at 0x40934
Capabilities:
Check http status code

Disassembly:
call fcn.0002dd1e
jmp 0x2bbab
push ebp
mov word [esp + 4], 0x52a1
lea esp, [esp + 0x18]
jne 0x411b7
cmp bp, 0xf3d5
stc
bt si, 0xc
call fcn.00022fa9
lea esp, [esp + 0xc]
jne 0x3d426
push ebx
pushal
cmp dword [eax + 4], 0
call fcn.00024090
lea esp, [esp + 4]
jbe 0x3a882
pushfd
pushfd
mov dword [esp + 4], ebx
jmp 0x28596

Function at 0x4095e
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
call fcn.00041d3e
lea esp, [esp + 4]
jne 0x2bdf3
jle 0x3af46
push 0x1e324
jmp loc.00019623

Function at 0x40a16
Capabilities:
Check http status code
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 8], cx
push 0xcb975421
lea esp, [esp + 0x10]
jb 0x32a1c
btr ax, bp
or al, 0xda
setbe ah
rcr ax, 5
mov eax, dword [ebx + 0x34]
jmp 0x33bfe
clc
mov dword [ebp - 0x1c], eax
bt bx, ax
cmc
cmp word [eax], 2
pushfd
push dword [esp]
call fcn.0002b998
mov byte [esp], bh
cmp word [ecx], ax
pushfd
jmp 0x304e9

Function at 0x40aef
Capabilities:
Check http status code

Disassembly:
pushal
test esi, esi
pushfd
lea esp, [esp + 0x28]
je 0x3034c
call fcn.0004249c

Function at 0x40c69
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 8]
je 0x2bdf3
xor ax, 0x85d4
inc ah
sal eax, 0x1b
aad 0x58
mov eax, dword [0x1e348]
cmc
pushfd
cmc
test ax, ax
test eax, eax
jmp 0x37e0e