joyce8/EMBER2024-capa huggingface dataset:
Function at 0x237bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 8
movzx dx, cl
jmp 0x24c1c
mov esi, eax
pushfd
not dx
xchg dl, cl
not dh
lea edx, [eax + 1]
setbe cl
lea esp, [esp + 4]
push ebx
mov cl, dl
jmp 0x2dab6
pushal
mov cl, byte [eax]
pushal
push dword [esp]
push dword [esp + 0xc]
inc eax
push 0x22f9cd27
bt ax, bp
cmc
clc
test cl, cl
jmp 0x3e984
call fcn.00033c3b

Function at 0x239c8
Capabilities:
Check for software breakpoints
Check http status code

Disassembly:
mov word [esp + 4], sp
lea esp, [esp + 0x20]
jl 0x25e42
push 0x2f812
call fcn.00019521
mov dword [esp + 8], 0x21850
pushfd
pushal
mov dword [esp + 0x28], esi
pushfd
mov dword [esp + 0x10], 0x1290429d
push dword [esp + 0x2c]
ret 0x30
pushal
call fcn.00039f4c

Function at 0x23ba0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], ax
pushal
jmp 0x27db9

Function at 0x23c94
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
mov word [esp + 4], 0x776e
add esp, 0x14
cmp dl, 0x8c
test eax, eax
pushfd
pushfd
jmp 0x2cf0a
lea esp, [esp + 8]
jne 0x3d426
shrd cx, di, 3
mov ecx, 0xc2
clc
pushfd
mov ax, word [ebp - 0x20]
push ecx
call fcn.000265e0

Function at 0x23cd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je fcn.0002db87
cmp dh, al
cmc
cmp esi, 4
push ebx
push esp
pushfd
lea esp, [esp + 0xc]
jne fcn.0002db87
pushfd
mov ecx, dword [ebx]
lea esp, [esp + 4]
ja 0x2aa55
pushfd
push edi
mov dword [esp + 4], 1
mov dword [esp], eax
push dword [esp]
pushfd
pushfd
mov dword [esp + 0xc], ecx
call fcn.00024a82

Function at 0x23e33
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], bh
lea esp, [esp + 8]
jbe 0x2bdf3
pushfd
pushfd
mov dword [esp + 4], ebx
pushal
pushfd
mov word [esp + 4], 0xeafe
pushfd
mov dword [esp + 0x28], esi
pushfd
jmp 0x26402
mov byte [esp + 8], 0x72
mov byte [esp], ch
mov dword [esp + 0x28], 0
pushfd
mov word [esp + 8], 0x91c3
call fcn.0003f319

Function at 0x23f31
Capabilities:
Check http status code

Disassembly:
pushfd
pushal
mov dword [esp + 0x20], esi
call fcn.0002942f
mov byte [esp + 0xc], 7
mov dword [esp + 0x24], ebx
push esp
lea esp, [esp + 0x28]
jne 0x21b05
push 0xc8b8d2f9
pushfd
mov dword [esp + 4], esi
push ebx
jmp 0x2aaf1
push eax
pushal
lea esp, [esp + 0x2c]
call fcn.00013800
pushal
test al, al
pushfd
push dword [esp]
lea esp, [esp + 0x28]
je 0x2bdf3
lea eax, [esp + 0x46ebbcfd]
sbb ax, di
sub ax, cx
mov eax, dword [0x1e348]
cmp dh, 0x97
cmc
cmc
test eax, eax
jmp 0x3f2bd
je 0x25ae6
call fcn.0002a7fd

Function at 0x24090
Capabilities:
Check http status code

Disassembly:
jmp 0x33547
push ebx
pushfd
lea esp, [esp + 0x30]
je 0x3d426
movsx dx, bl
call fcn.00035c98
pushal
test al, al
call fcn.0001124a
mov dword [esp + 0x3c], 0x14783
push dword [esp]
push 0x5df14187
mov dword [esp + 0x40], edi
mov byte [esp], dl
push 0x55dc75b6
push dword [esp + 0x44]
ret 0x48
aaa
shrd ax, dx, cl
inc ah
xor al, dh
mov dword [ebp - 4], 0xffffffff
xor ah, 0x57
mov eax, dword [ebp - 0x1c]
stc
test eax, eax
pushal
call fcn.00030539
Function at 0x241a3
Capabilities:
Check http status code

Disassembly:
push dword [esp + 4]
cmp dl, byte [ecx]
mov byte [esp], 0x1b
mov word [esp], sp
lea esp, [esp + 0xc]
jne 0x32bc6
sar dl, cl
shl dl, cl
shr dl, 3
cmc
mov dl, byte [eax + 1]
stc
pushfd
mov byte [esp], bl
push 0xce7abc40
cmp dl, byte [ecx + 1]
call fcn.000315a2
movzx dx, bl
bsr edx, eax
mov edx, dword [esi + 4]
rcr edi, cl
sal di, cl
shrd di, bx, 8
clc
mov eax, dword [0x1e300]
xchg edi, esi
rol esi, cl
mov dword [eax + 4], edx
rol dx, cl
movsx si, cl
mov edi, dword [0x1e2fc]
rol cl, cl
mov esi, dword [0x1e300]
bt bp, si
push 0x703af0a2
mov edx, edi
push 0xfd2f33f1
mov ecx, 8
shld ax, sp, 0xc
rol al, cl
mov eax, esi
clc
stc
setbe bl
sar ebx, cl
sub edx, esi
bsr bx, bp
shrd bx, bx, cl
btr bx, 0xa
mov ebx, dword [edx + eax]
jmp 0x2c618
cmp dh, ch
cmp ebx, dword [eax]
push dword [esp + 4]
mov byte [esp], dl
call fcn.00036e4c

Function at 0x2424a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
mov dword [esp + 0x2c], ebx
jmp fcn.00013b21

Function at 0x24311
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x40
jmp 0x2aadf
lea esp, [esp + 0x28]
jb 0x3bb73
pushal
cmp dword [ebx], eax
call fcn.00032127

Function at 0x246cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
test al, al
jmp 0x3eed8
mov dword [esp], 0xf2c6cd49
call fcn.00014372

Function at 0x2474e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x3d05d
bt esi, edi
call fcn.00031f74

Function at 0x24826
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x10], ch
lea esp, [esp + 0x28]
je 0x4115c
call fcn.00036d9e

Function at 0x24a5a
Capabilities:
Check http status code

Disassembly:
jmp 0x3e9d4
pushal
mov dword [esp + 0x20], 0x15200
mov byte [esp], bh
jmp 0x2fe69

Function at 0x24b52
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x30]
jns 0x324cd
pushal
mov dword [esp + 0x1c], ebx
push 0x113d1bc8
push dword [esp + 0x20]
ret 0x24

Function at 0x24c54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0002eda0
bt eax, 0xd
cmp dh, 0x6e
stc
pushfd
test al, al
push dword [esp]
jmp fcn.00011989

Function at 0x24d02
Capabilities:
Check http status code

Disassembly:
inc ebx
jmp 0x3c596
call fcn.0002b049

Function at 0x24d08
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
mov dword [esp + 0xc], edi
lea esp, [esp + 0x28]
jl 0x40870
sar ax, 8
sete ah
add ax, 0x96b5
add ecx, dword [0x1e2a4]
movzx ax, dl
lea eax, [edx - 0x10c5ce42]
mov dword [ebp - 4], ecx
jmp loc.00018f43

Function at 0x24ecc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp word [eax + 0x10], 0
pushfd
jmp 0x34f71
lea esp, [esp + 0xc]
je 0x35296
shrd cx, cx, cl
rcl cl, 5
shld cx, bx, cl
movzx eax, word [eax + 0x10]
movsx ecx, dl
bsr cx, bx
mov ecx, eax
bt di, di
test ebx, 0x916a960f
call fcn.0003d750
Function at 0x25161
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x333dc
pushfd
call fcn.00036014

Function at 0x25175
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 4]
call fcn.0001b170
clc
cmp eax, dword [ebp - 0x10]
pushfd
lea esp, [esp + 4]
jb 0x25236
pushal
call fcn.000424c1

Function at 0x251d6
Capabilities:
Check http status code

Disassembly:
mov byte [esp], bh
lea esp, [esp + 0x2c]
je 0x397e4
ror dh, 7
inc di
xchg dx, di
mov ecx, dword [esi]
and di, di
lea ebx, [edx - 0x21e01e81]
shl ebx, 7
xadd bh, dh
mov dword [eax], ecx
rcr ah, 7
mov edx, dword [esi + 4]
dec ah
mov eax, dword [0x1e300]
push 0xbb7b8dc4
shld esi, ebx, 0xd
sar esi, cl
pushal
mov dword [eax + 4], edx
rcl di, cl
shld di, bx, cl
mov edi, dword [0x1e2fc]
xadd si, bx
jmp 0x2f6fe
rol ch, 1
mov esi, dword [0x1e300]
btr ax, cx
pushfd
mov edx, edi
daa
shrd ax, sp, 5
mov ecx, 8
daa
mov eax, esi
btr bx, si
inc bh
bts bx, di
pushfd
sub edx, esi
pop ebx
inc bh
shr bl, 4
and bh, dl
mov ebx, dword [edx + eax]
call fcn.00037c4e

Function at 0x25ab0
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
call sub.ntoskrnl.exe_memset
test dl, 0xf2
and dh, bh
movzx dx, dl
adc dl, 0x27
add esp, 0xc
bswap dx
push 0x53bb1ee1
bswap dx
movsx dx, bl
mov dword [esp], 0x11
not edx
pushal
jmp 0x21147

Function at 0x25c4e
Capabilities:
Check http status code

Disassembly:
mov dword [0x1e2b8], edx
mov byte [esp], dl
mov dword [ebp - 4], 0
call fcn.0001f042
setb dl
mov dword [0x1e2dc], ecx
setno al
jmp 0x3f527
push 0x162fd68b
mov dword [esp + 0x28], edi
cdq
bswap ax
lea edx, [ebp - 4]
call fcn.00028080

Function at 0x25da5
Capabilities:
Check http status code

Disassembly:
mov byte [esp], 0x2e
clc
clc
add ecx, 0x60
call fcn.00036030

Function at 0x2603c
Capabilities:
Check http status code

Disassembly:
bswap cx
movzx cx, al
lea edx, [eax*4 - 0x6554a8dc]
lea ecx, [ebp - 0x138]
not dh
mov dword [esp], ecx
pushfd
pushal
lea edx, [ebp - 4]
pushfd
mov byte [esp], bh
mov dword [esp + 0x24], edx
push 0xb225e8ab
lea esp, [esp + 0x28]
call fcn.00013720
clc
pushal
and si, 0x799b
mov esi, eax
bt sp, bx
test al, ah
push ecx
bt si, sp
test esi, esi
push 0x5c849291
call fcn.000327af
lea esp, [esp + 0x44]
je 0x397e4
not ebx
cmp dh, ch
test dx, 0x95fa
xadd ebx, edi
mov ecx, dword [esi]
xor bx, si
bsf di, ax
shl bh, cl
mov dword [eax], ecx
js 0x241d8
mov edx, dword [esi + 4]
xadd al, cl
mov eax, dword [0x1e300]
cmc
call fcn.0001477e
pushal
pushal
push eax
mov dword [esp + 0x40], 0
push 0x62240c6e
jmp 0x3c652
Function at 0x26129
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
je 0x35296
sar dx, cl
rcr dx, cl
movzx eax, word [eax + 0x10]
rcr dh, 2
bsf dx, si
call fcn.0002a908
mov eax, dword [ebx + 0x16]
lea esp, [esp + 4]
jnp 0x37898
pushal
mov dword [esp + 0x1c], eax
push dword [esp]
lea esp, [esp + 0x20]
call fcn.00016ae0
bt bp, si
pushfd
test eax, eax
jmp 0x2f0f7
lea esp, [esp + 0x24]
je 0x35296
shrd ecx, esp, 0xf
bsr cx, cx
bts cx, 2
mov ecx, dword [eax + 0xc]
push edi
pushal
mov dword [ebx + 0x16], ecx
pushfd
mov byte [esp], dl
cmc
mov word [esp + 4], sp
cmp word [eax + 0x10], 0
push dword [esp + 8]
push dword [esp]
jmp 0x2380d
pushal
jmp 0x2ae77
jmp 0x25c13

Function at 0x2629c
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x3226e
pushal
mov word [esp], dx
lea esp, [esp + 0x20]
je 0x30b07

Function at 0x2638b
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x25236
daa
bt si, 8
mov eax, dword [ebp - 4]
bt di, cx
cmp eax, 0x40
pushfd
push dword [esp]
lea esp, [esp + 8]
jb 0x3bb73
jmp 0x2e3ed
add eax, 0xfffffff8
mov ecx, ecx
seto ch
pushfd
movzx ecx, dl
mov dword [esp], eax
not ch
lea ecx, [ebx + 8]
push 0xda0c2e3f
mov dword [esp], ecx
call fcn.00035af5
mov dword [ebx + 0x4c], eax
pushfd
push eax
pushfd
lea esp, [esp + 0x38]
jb 0x326e9
call fcn.0002a5ba
clc
cmp dword [ebx], eax
pushal
push dword [esp + 8]
lea esp, [esp + 0x24]
jne 0x3bb73
rcr ecx, cl
rol cx, 1
jmp 0x2ce00
pushal
pushal
push esp
mov byte [esp + 8], 0x63
mov dword [ebp - 4], 0
push ebp
push ebp
mov byte [esp + 0xc], bl
lea esp, [esp + 0x4c]
jmp fcn.0002db87

Function at 0x2677c
Capabilities:
Execute anti-debugging instructions

Disassembly:
test cx, cx
pushfd
push 0x17d4388d
mov word [esp], 0xc845
mov byte [esp + 0xc], ah
lea esp, [esp + 0x38]
jne 0x367bd
cwde
lea eax, [ebx + 0xc]
bswap edx
mov edx, eax
pushal
mov byte [esp], 0x84
push 0xe03c5dab
pushfd
lea esp, [esp + 0x28]
jmp 0x2cd21

Function at 0x2695d
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x38480
pushal
bts cx, 7
mov cx, word [edi + 2]
mov byte [esp], ch
clc
add edi, 2
call fcn.00013fd1
push dword [esp]
pushal
lea esp, [esp + 0x34]
jne 0x2cf59
call fcn.0003ec9a
call fcn.0003d327

Function at 0x26a57
Capabilities:
Check http status code

Disassembly:
jmp 0x2c950
pushfd
mov dword [0x1e2d0], ecx
mov byte [esp], al
mov byte [esp], 0x42
mov byte [esp], cl
lea esp, [esp + 0x50]
jmp fcn.00026e50

Function at 0x26ba8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x3c974
pushal
cmp eax, ecx
jmp 0x3c964
lea esp, [esp + 0x20]
jae 0x3c974
bts ecx, 7
mov ecx, eax

Function at 0x26bba
Capabilities:
Check http status code

Disassembly:
je 0x23640
call fcn.00031d41
lea esp, [esp + 0x28]
jne 0x32a1c
cmc
bt ax, 0xe
test cl, 0xf5
test eax, eax
jmp 0x260df
Function at 0x26d42
Capabilities:
Check for software breakpoints
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov dword [0x1e348], esi
call fcn.00036920

Function at 0x26d4d
Capabilities:
Check for software breakpoints
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0xc]
jne 0x24bca
push 0xc4fb1416
sub ecx, 4
bt ecx, ebx
bt bp, cx
bt bp, cx
add eax, 4
sub esp, 0xfffffffc
jnp 0x3c38d
cmp ecx, 4
push edx
push esi
mov word [esp + 4], ax
push ebp
lea esp, [esp + 0xc]
jae 0x3738a
pushal
pushfd
push eax
pushfd
lea esp, [esp + 0x2c]
jmp fcn.0003bfed
jmp 0x3ebab
cmp ecx, 4
call fcn.0003c24c

Function at 0x26dc4
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ecx, ecx
mov word [esp], bp
pushfd
pushfd
pushal
lea esp, [esp + 0x30]
je 0x293cf
clc
test eax, eax
pushal
jmp 0x306d6
lea esp, [esp + 0x20]
jl 0x293cf
bts dx, si
and dh, bl
neg dx
rcl dl, 7
add ecx, dword [0x1e2a4]
not dx
rdtsc
bswap ax
mov dword [ebp - 4], ecx
rdtsc
pushfd
cwde
xchg dh, al
mov dword [0x1e2dc], ecx
bswap eax
call fcn.00023984
Function at 0x270e3
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
cmp esi, 0x15200
mov byte [esp + 4], 0x8f
push 0x1ddee607
push 0x63874989
push 0x3c54b31b
lea esp, [esp + 0x30]
je 0x33b62
call fcn.0002edf6

Function at 0x2710c
Capabilities:
Check http status code

Disassembly:
mov edx, dword [0x1e480]
mov byte [esp], cl
mov byte [esp], 0x28
pushfd
mov dword [esp + 0x24], eax
mov word [esp], bp
mov byte [esp], dh
push esp
call fcn.000406d8
lea esp, [esp + 4]
jne 0x33248

Function at 0x2723a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
jmp 0x32bfc

Function at 0x272ac
Capabilities:
Check http status code

Disassembly:
mov dword [esp + 0x1c], esi
pushal
mov dword [esp + 0x38], 0
call fcn.00027c22
push 0x443ee199
jmp 0x2e246
lea esp, [esp + 8]
je 0x39003
shld ax, ax, cl
lahf
and al, 0x77
aas
add esi, edx
shr al, 6
rcl ah, 7
rcr al, 7
sub al, cl
lea eax, [esi + ecx - 1]
pushfd
dec esi
sbb si, cx
sub edx, edx
push esp
movzx esi, cl
div ecx
bswap si
rcl si, cl
bts esi, ecx
bswap esi
mov esi, eax
pushal
cmc
call fcn.0002163e
push 0x469dc453
push ebp
mov dword [esp + 0x44], ebx
push 0x8154f99f
push dword [esp + 4]
mov dword [esp + 0x48], edi
mov byte [esp + 4], 0x6e
mov dword [esp + 0x44], 0x22e60
call fcn.000391eb
jmp 0x39bbb
bt eax, ebx
dec si
cmc
add eax, edx
shrd si, cx, 6
xor edx, edx
pushfd
lea eax, [eax + ecx - 1]
ror esi, cl
div ecx
stc
btr si, cx
mov esi, eax
pushfd
imul esi, ecx
pushal
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x31321
pushfd
lea esp, [esp + 0x2c]
call fcn.0001ad60
pushfd
cmp dword [ebx + 4], eax
mov byte [esp], dl
call fcn.0003e245

Function at 0x276cf
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
jmp 0x3eb04
mov dword [esp + 8], eax
call fcn.00038e1f
pushfd
jmp 0x225b9
pushfd
mov dword [0x1e2cc], edi
pushfd
mov dword [0x1e2d0], ecx
pushfd
lea esp, [esp + 0x38]
jmp fcn.00026e50
pushal
mov dword [0x1e2c8], esi
jmp 0x2d2e3
mov ecx, dword [0x1e50c]
pushfd
pushfd
jmp 0x3a83a
Function at 0x276ed
Capabilities:
Check http status code

Disassembly:
inc dl
rcr edx, cl
call fcn.0003f2db
lea esp, [esp + 0x24]
call sub.ntoskrnl.exe_memset
movsx esi, cl
jmp 0x3150f
lea esp, [esp + 0x30]
jne 0x32a1c
clc
test eax, eax
pushfd
lea esp, [esp + 4]
je 0x23640
not si
rol si, 8
push esp
movzx esi, word [eax + 2]
pushfd
rcr dh, 3
sal dl, 7
cmp dh, ah
mov edx, 0x3500
pushal
cmp si, dx
push ebp
mov byte [esp + 4], dl
jmp 0x2eee6
pushal
movzx di, bl
push 0xfe09ab0a
movsx di, cl
mov edi, dword [ebp - 4]
pushal
pushfd
pushfd
pushfd
mov dword [esp + 0x4c], edi
jmp fcn.00024b34
pushfd
lea esp, [esp + 0x30]
jne 0x3affc
lea eax, [esi*2 + 0x7bf49216]
jmp 0x39e2f
lahf
jmp 0x3b491
das
bswap eax
rol dh, cl
mov eax, dword [ebx + 0x34]
shr dl, cl
neg dl
jb 0x368e9
mov dword [ebp - 0x1c], eax
bswap dx
call fcn.0002a1c8
test esi, esi
pushal
pushfd
mov word [esp], 0xe34c
lea esp, [esp + 0x24]
jne 0x2979a
call fcn.00037ba5
mov word [esp], 0x13f0
pushal
mov dword [esp + 0x20], ebx
pushfd
mov word [esp + 8], 0x8b61
jmp 0x2441e
test ebp, ebp
call fcn.0003d592
inc dh
shrd dx, cx, cl
add dh, cl
mov dword [ebp - 0x1c], eax
btc edx, 0x11
rol dx, 7
rol dx, 7
movzx eax, word [eax + 8]
add dh, ch
btr dx, bx
mov edx, 0x3500
stc
jo 0x32d37
stc
cmp ax, dx
pushal
call fcn.00025bc5
pushfd
mov dword [esp], 0x200
setno ah
movsx ax, bl
push 0
push 0x895f69a4
lea eax, [edx - 0x6180af84]
lea eax, [ebp - 0x21c]
call fcn.00029149
jmp 0x3cd40
mov ecx, 0xc
not esi
pushfd
seta dh
jmp fcn.000142ad
mov dword [ebp - 4], 0xffffffff
pushal
pushal
push 0xc3b44c94
lea esp, [esp + 0x44]
jmp loc.000147a5

Function at 0x279c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov dword [esp + 0x28], str.CSDProductId
push esp
mov word [esp], 0x4f04
push 0x5356052b
mov dword [esp + 0x2c], str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
jmp 0x3edd8
pushfd
call fcn.0003c2aa
Function at 0x27b83
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x38]
jne 0x399f8
bswap ax
mov eax, dword [ebp + 0xc]
pushfd
mov dword [esp], eax
call fcn.0002be5a
mov dword [ebp - 4], esi
push esi
mov byte [esp], 0xb8
pushfd
lea esp, [esp + 0x2c]
jmp 0x36042
push dword [esp]
mov dword [esp + 4], 0
call fcn.00036c85
jmp 0x21664
lea esp, [esp + 0x54]
call fcn.00013800
push 0xdd3401f6
pushfd
mov word [esp], di
stc
test al, al
mov word [esp], 0x2761
lea esp, [esp + 8]
je 0x2bdf3
bt di, bp
lahf
mov eax, dword [0x1e348]
jmp 0x4247c
pushfd
lea esp, [esp + 0x14]
call fcn.00016a40
call fcn.0003a30f
movsx si, al
lea esi, [esi + 0x7761734f]
movzx si, al
pushal
mov esi, dword [esp + 0x20]
pushal
lea esp, [esp + 0x44]
jmp 0x36bbe
jmp 0x361f6
add cl, al
or cl, 0xf0
mov cl, byte [eax + 2]
cmc
push 0x9c689ad4
jmp 0x24449
push ebp
pushal
lea esp, [esp + 0x24]
je 0x25ae6
call fcn.000211e6
jmp 0x2aa60
bt ax, 9
test eax, eax
pushfd
pushal
push 0xc48f1bd7
mov byte [esp + 4], 0x4f
lea esp, [esp + 0x28]
je fcn.0003f73d
sal cl, 4
jmp 0x2f6e5
jb 0x3a8d9
xchg dx, di
pop edi
call fcn.0002b06b
test cx, ax
cmc
test eax, eax
jne 0x3567e
pushal
mov byte [esp + 4], cl
push esp
lea esp, [esp + 0x24]
je 0x25ae6
push esp
jmp 0x22c1c
movsx eax, cl
pushfd
dec ax
mov eax, dword [ebp + 8]
lea esp, [esp + 4]
jns 0x3a72e
pushfd
inc eax
stc
stc
bt si, 1
mov dword [ebp + 8], eax
stc
cmp cl, 0x8d
pushfd
cmp eax, dword [ebx + 0xc]
lea esp, [esp + 8]
ja 0x2d934
pushal
mov byte [esp + 4], dh
mov word [esp + 4], 0x8497
lea esp, [esp + 0x20]
jb 0x3a8d9
pushal
setae dl
xchg dx, di
mov edi, dword [esp + 0x20]
lea esp, [esp + 0x24]
setnp dl
seta dl
not dh
not dl
mov edx, dword [ebx + 8]
push 0x7a97fd7b
mov byte [esp], dh
mov dword [0x1e32c], edx
mov byte [esp], 0x6b
mov word [esp], 0xc263
lea esp, [esp + 4]
jmp 0x3f609
call fcn.0002aa4c
not eax
lea ebx, [eax*4 + 0x4550dd50]
movsx ax, dl
call fcn.0002b663
pushal
pushfd
jmp fcn.0002db73
jmp 0x38b08

Function at 0x27c22
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x3c]
call fcn.0001ad60
pushfd
jmp 0x3dd57
pushal
jmp 0x3d9bd
cmp dword [0x1e50c], eax
jmp 0x3925f
Function at 0x2846e
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
clc
cmp eax, dword [ebp - 0x28]
call fcn.00037f15
movsx dx, dl
add esp, 0xc
setl dh
movzx dx, al
push 0x11
movsx dx, dl
jmp 0x2d1da
lea esp, [esp + 4]
jb 0x31b5f
jmp 0x3045e
stc
cmp dword [0x1e4e8], 0
pushfd
lea esp, [esp + 8]
je 0x2ae34
pushal
lea esp, [esp + 0x20]
call fcn.0001b170
jmp 0x40e78
lea edx, [ebp - 0x150]
push 0x4830f156
mov dword [esp], edx
pushfd
pushfd
mov byte [esp], ch
mov byte [esp + 4], dl
mov dword [esp + 4], 0x1e064
mov dword [esp], edi
call fcn.00031fab
push 0
call fcn.0003c88d
cmp eax, edx
pushfd
jmp 0x298be
pushal
mov dword [esp + 0x1c], 0
call fcn.0002ab2b
clc
jl 0x18f90
bt bp, di
cmp eax, dword [ebp - 0x28]
pushfd
pushfd
lea esp, [esp + 8]
jl 0x328d3
pushal
lea esp, [esp + 0x20]
jb 0x2ae34
not ecx
pushal
not cx
mov dword [esp + 0x1c], 0x100
push dword [esp]
lea ecx, [ebp - 0x150]
lea esp, [esp + 0x20]
ja 0x3d5a6
push 0
pushal
pushal
pushfd
mov dword [esp + 0x40], ecx
push dword [esp + 4]
mov dword [esp], ebx
push dword [esp + 4]
lea esp, [esp + 0x48]
call sub.ntoskrnl.exe_memset
jmp 0x24795

Function at 0x284b0
Capabilities:
Check http status code

Disassembly:
mov dword [0x1e2d0], ecx
pushfd
pushfd
push ebx
push dword [esp + 4]
lea esp, [esp + 0x44]
jmp fcn.00026e50

Function at 0x285b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
push dword [esp]
mov dword [esp + 4], 0x1e050
pushal
push dword [esp]
jmp fcn.00038cfb
mov edi, 0x1e4e0
push dword [esp]
rep movsd dword es:[edi], dword [esi]
jmp 0x33f50
mov word [esp], si
pushfd
mov dword [esp + 8], ecx
lea esp, [esp + 8]
jle 0x24343
push 0x1e050
pushal
pushal
jmp 0x2d63f
jmp 0x3fefc
lea esp, [esp + 8]
call fcn.0001b170
cmp ah, 0xd7
shld di, bp, cl
add eax, dword [0x1e4ec]
bswap di
mov dword [ebp - 0x10], eax
lea edi, [edx + 0x49eccd3f]
push 0x1c9ca94c
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x4231b
cdq
push esi
mov ax, bx
push esp
rdtsc
mov dword [esp], str._GameData.dat
setae al
pushfd
bswap eax
lea edx, [ebp - 0x138]
bswap ax
call fcn.00033a98
jmp 0x2527b
lea esp, [esp + 0x40]
call fcn.0001ad20
jmp 0x3b7fd
mov dword [esp], 0
push 0x2675988e
pushfd
pushal
mov dword [esp + 0x24], ebx
call fcn.00040acd
jmp loc.000139f0

Function at 0x28936
Capabilities:
Check http status code

Disassembly:
add ecx, 4
jmp 0x3a3a6
cmp al, dl
cmp edx, 4
pushal
push edx
jmp fcn.0001961e

Function at 0x28bb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x2ac8e
test bl, ch
cmc
mov dword [ebx + 0x10], edx
jmp fcn.00018d98