joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc32e16
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x54
pushfd
mov byte [esp + 4], 0xd0
pushal
lea esp, [esp + 0x28]
jne 0xc3eab4
adc bl, 0xb4
or bl, dh
sal bl, 5
cmp ch, 0x31
mov bl, byte [eax + 2]
bt sp, cx
test si, 0xffc4
clc
test ah, al
cmp bl, 0x64
call fcn.00c38e2d

Function at 0xc32e73
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0xc3a51d
das
call fcn.00c347fc
mov edx, dword [ebp - 0xac]
movzx si, cl
lea esi, [edx - 0x28285d4]
bt si, ax
add edx, 0x1000103e
btr si, 6
movzx si, cl
btr si, bx
mov dword [edx], eax
not al
btc si, ax
aam 0xba
mov eax, dword [ebp - 0xac]
neg esi
add eax, 0x10001012
not esi
mov esi, dword [ebp - 0x3c]
pushfd
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.004ca480
sub si, di
and dl, 0xb7
sar dx, cl
mov dword [ebp - 0x14], eax
sub dh, 0xa7
pushal
mov edx, dword [ebp - 0xac]
bsf si, di
stc
pushal
add edx, 0x1000103a
adc si, 0xaf95
mov dword [edx], eax
dec si
daa
mov eax, dword [ebp - 0xac]
not esi
add eax, 0x1000101e
lea esp, [esp + 0x40]
je 0xc3792d
not si
mov esi, dword [ebp - 0x3c]
pushfd
lea esp, [esp + 4]
call fcn.004ca480
pushal
push 0xc92d927e
jmp 0xc3adef
call fcn.00c3a66a
lea esp, [esp + 0x24]
jg 0xc33adb
mov dword [ebp - 0x58], eax
pushal
pushfd
pushfd
mov dword [esp + 0x24], 0x40
pushfd
mov byte [esp], 0x70
push 0xa9f21d27
mov dword [esp + 0x28], 0x3000
pushfd
call fcn.00c386a9

Function at 0xc33119
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0xc393ee
test di, 0x122
shld ecx, eax, 0x1d
shld cx, ax, cl
lea ecx, [ecx - 0x1a0b1888]
mov ecx, dword [ebp - 0x44]
jmp 0xc391ce
test edx, esp
sub edx, edx
shr dl, cl
call fcn.00c3b874

Function at 0xc3313e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp ax, 0xec96
cmp bl, 0x4c
mov byte [esp], ah
jmp 0xc3d201

Function at 0xc33161
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor edx, edx
cmc
clc
mov dx, word [ecx + 0xa]
test cl, 0x7f
stc
bt cx, bx
cmp edx, 0x6c
mov word [esp], 0xbf65
jmp 0xc3ea01

Function at 0xc33201
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0xc347de
adc cl, cl
pushal
mov eax, dword [ebp - 0x100]
cmp edx, esp
setns cl
pop ecx
mov ecx, dword [eax + 0x30]
pushal
cmc
xor edx, edx
or dx, 0x6a1
mov dx, word [ecx + 0xe]
stc
test bh, al
clc
cmp edx, 0x4c
call fcn.00c3f518

Function at 0xc33282
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ch
sar cl, 4
mov eax, dword [ebp - 0x100]
pushfd
shr ecx, 0x1a
setge ch
neg ch
mov ecx, dword [eax + 0x30]
pushal
bt ax, bp
clc
xor edx, edx
xor dh, ah
btr dx, 1
rcl dl, 1
mov dx, word [ecx + 4]
pushfd
cmp edx, 0x44
call fcn.00c3469e

Function at 0xc332b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
bsr dx, ax
mov dx, word [ecx + 0x10]
test dl, 0x30
cmp edx, 0x2e
pushfd
push dword [esp + 8]
call fcn.00c3b1b3
Function at 0xc332d1
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
jmp 0xc3a554
sub ecx, ecx
pushal
bt ax, 9
ror cl, 5
mov cl, byte [eax + 3]
clc
pushfd
cmp ecx, 0x72
lea esp, [esp + 0x28]
jb 0xc35fe5
pushal
jmp 0xc3c630
cmp bl, bh
xor eax, eax
jmp 0xc3f844
jmp 0xc3d8c5
lea esp, [esp + 0x20]
je 0xc3f86b
movzx edx, al
mov edx, dword [ebp - 0x44]
jmp 0xc3b9f9

Function at 0xc332fc
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [edx + 1], eax
lea eax, [ebx + 0x2e2a91d7]
mov edx, dword [ebp - 0xac]
pop eax
add edx, 0x10001f04
bswap ax
lea eax, [0x47de1774]
btc eax, ecx
test cl, dh
mov eax, dword [ebp - 0x9c]
cmc
mov dword [edx + 1], eax
neg ax
mov eax, dword [ebp - 0xc]
bt ebx, edi
cmc
mov byte [esp], 0x5c
mov dword [edx + 6], eax
daa
mov edx, dword [ebp - 0xac]
pushfd
add edx, 0x10001f1a
push eax
rol ah, cl
mov eax, dword [ebp - 0xb8]
test ch, ch
sub eax, edx
bt bx, dx
push 0xa5ee9aaa
sub eax, 5
push 0x9e9748ae
call fcn.00c35817

Function at 0xc3342b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00c3b816
push edx
cmc
xor edx, edx
bsf dx, dx
bt bp, 9
mov dx, word [ecx + 0xc]
sub esp, 0xfffffffc
pushfd
cmc
jmp 0xc3bc9a
pushfd
lea esp, [esp + 0x28]
je 0xc3d55d
cmc
lahf
shrd cx, cx, 0xd
aam 0xda
mov eax, dword [ebp - 0x104]
mov cl, 0xb3
mov ecx, dword [eax + 0x30]
bt si, 0xe
pushfd
sub edx, edx
or dl, bl
mov dx, word [ecx + 6]
jmp 0xc3d54e
pushfd
call fcn.00c39280
clc
cmp edx, 0x44
lea esp, [esp + 4]
jno 0xc388a9
pushal
mov byte [esp + 4], 0xb5
lea esp, [esp + 0x20]
jne 0xc324b4
pushal
clc
mov eax, dword [ebp - 0x100]
pushfd
shl ecx, cl
setbe cl
mov ecx, dword [eax + 0x30]
cmc
call fcn.00c3a040
jmp 0xc33851
cmc
cmp edx, 0x4e
pushal
lea esp, [esp + 0x24]
jne 0xc3555d
btr ax, di
sbb al, 0xb8
shl eax, cl
inc ch
mov eax, dword [ebp - 0x104]
movzx cx, dl
rol ecx, 0x11
mov ecx, dword [eax + 0x30]
push eax
clc
xor edx, edx
test bp, bx
sbb dx, bp
mov dx, word [ecx + 8]
jmp 0xc3c6a9

Function at 0xc3344b
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
pushal
sub edx, edx
rcl dx, 0xb
shld dx, bp, 6
mov dx, word [ecx + 6]
pushfd
pushfd
cmp ebx, edx
cmp edx, 0x4c
mov word [esp], sp
push dword [esp]
mov word [esp + 0xc], 0xbcd
call fcn.00c3365f

Function at 0xc33478
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
jne 0xc3eab4
bt di, bx
mov bl, byte [eax + 8]
call fcn.00c3df3e
mov byte [esp], 0xf7
test ah, 0x3c
cmp dword [ebp - 0x118], 0
jmp 0xc3f7be
pushal
call 0xc326d3

Function at 0xc33550
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
bsf ax, cx
mov eax, dword [ebp - 0x104]
stc
mov ecx, dword [eax + 0x30]
push edx
clc
sub edx, edx
mov byte [esp + 4], 0x53
rol dx, cl
mov dx, word [ecx + 2]
stc
cmp edx, 0x45
jmp 0xc38e74
Function at 0xc335ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap cx
jmp 0xc3399c
mov ecx, dword [ebp - 0x1c]
mov word [esp], ax
mov dword [ecx], eax
pushal
pushfd
lea esp, [esp + 0x44]
jmp 0xc37350

Function at 0xc3365f
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0xc324b4

Function at 0xc3367a
Capabilities:
Execute anti-debugging instructions

Disassembly:
invalid
mov word [esp + 4], cx
lea esp, [esp + 8]
jne 0xc3eab4
sar bl, 1
mov bl, byte [eax + 1]
cmc
clc
cmp ch, dh
pushfd
cmp bl, 0x74
call fcn.00c34380
bt ebx, ebp
call fcn.00c37a81
or ah, byte [ecx]
mov ebx, 0x476b67ed
dec esi
jecxz 0xc33678
invalid

Function at 0xc337c2
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push dword [esp]
mov edx, dword [ebp - 0x104]
mov word [esp], 0x977e
jmp 0xc365c8

Function at 0xc3381b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x9a5757de
lea esp, [esp + 4]
call fcn.004ca480
jmp 0xc36b66
pop ecx
shld cx, ax, cl
cwde
mov ecx, dword [edx + 0x3c]
xor al, 0x97
push eax
push esp
add ecx, edx
call fcn.00c3fcf4
mov dword [ebp - 0x20], eax
daa
aad 0x99
mov eax, dword [ebp - 0xac]
shrd si, ax, 0xf
dec si
shld si, dx, 1
add eax, 0x100022ba
not si
bswap si
jns 0xc3bd95
mov esi, dword [ebp - 0x3c]
jmp 0xc392c4
call fcn.004ca480
pushal
shl cx, 2
and ecx, ecx
sub cl, ah
mov dword [ebp - 0xb8], eax
movzx dx, dl
dec ah
sub dl, 0x40
clc
mov edx, dword [ebp - 0x3c]
jmp 0xc35837

Function at 0xc339e4
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov dword [ecx], eax
pushfd
push dword [esp]
push ebx
lea esp, [esp + 0xc]
jmp 0xc37350
mov dword [esp + 0x3c], 0xc3b556
call fcn.00c38ab3
inc ah
mov ax, 0x6e7a
stc
js 0xc35c68
mov eax, dword [ebp - 0x5c]
test dx, 0x9516
bt esi, ecx
clc
jmp 0xc3f410
bts eax, edx
lea eax, [esi - 0x2f622724]
mov eax, dword [ebp - 0x5c]
pushfd
and eax, 0xffff
lea esp, [esp + 4]
jns 0xc394b5
bt ebp, 0x1c
stc
pushfd
cmp eax, 0x1000
pushal
lea esp, [esp + 0x24]
js 0xc3b678
pushal
lea esp, [esp + 0x20]
jne 0xc33089
or cx, sp
aaa
bsf ax, sp
mov ecx, dword [ebp - 4]
bsf dx, bx
aad 0x85
add eax, ebp
cmp ah, 0x48
and ecx, 0xffff0000
cmc
shrd eax, edx, 0x19
sub dl, bl
mov edx, dword [ebp - 0x1c]
aad 0xbe
aas
mov eax, dword [edx]
clc
pushal
clc
lea esp, [esp + 0x20]
jge 0xc3c63a
add eax, ecx
movsx cx, cl
bswap ecx
jmp 0xc3ccd6
pushal
call fcn.00c3f4bc
cmp al, dh
add eax, ecx
call fcn.00c3984c
mov ecx, dword [ebp - 0x1c]
jmp 0xc32d06
and eax, 0xffff
pushal
cmp eax, 0x1000
call fcn.00c3687a
jmp 0xc3821b

Function at 0xc33a0f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [edx]
mov dl, byte [esp]
call fcn.00c329fb

Function at 0xc33a19
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edx
shl dl, 1
stc
mov dx, word [ecx + 0x14]
cmp cl, bl
call fcn.00c3f15a
Function at 0xc33ae0
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
cmp dl, 0x5f
mov dword [esp + 0x14], 0xb1554c42
cmp ecx, 0x44
pushfd
mov word [esp], 0x8649
push 0xdd8795db
push esi
lea esp, [esp + 0x50]
jne 0xc329e2

Function at 0xc33b64
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x48
call fcn.00c3f49d
pushfd
mov word [esp], 0xb524
call fcn.00c32dc1

Function at 0xc33cda
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xe
test bh, 0x9f
pushal
sub edx, edx
mov dl, byte [esp]
rcr dl, cl
mov dl, byte [ecx + 0xa]
jmp 0xc331f7

Function at 0xc33cf1
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xc33089
test edx, esp
mov ecx, dword [ebp - 4]
mov al, 0x5d
rcr al, cl
btr ax, dx
and ecx, 0xffff0000
rol eax, cl
shld ax, si, 6
call fcn.00c37128

Function at 0xc33d1a
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0xc3bcb8
neg ax
bsr eax, esp
xadd ah, ch
btr cx, 0xd
mov eax, dword [ebp - 0x100]
neg ecx
btc ecx, 0x13
cmc
mov ecx, dword [eax + 0x30]
jmp 0xc33430

Function at 0xc33ed4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
pop eax
pop eax
mov dword [esp + 0x34], 4
bswap ax
lahf
setb al
pop eax
mov eax, dword [ebp - 0x7c]
pushfd
mov word [esp], si
call fcn.00c3ca6f
pop eax
not ax
movzx cx, dl
mov eax, dword [ebp - 0xc0]
setb ch
mov dword [edx], eax
push 0x8ee258ed
xchg cl, ah
pop eax
movzx edx, bl
lea ecx, [ebp - 0xc4]
mov dl, 0xb2
setl dl
cwde
mov dword [esp + 0x1c], ecx
rdtsc
lea esp, [esp + 0x1c]
jp 0xc3a75b
xchg dx, ax
rdtsc
mov edx, dword [ebp - 0xc4]
bswap eax
pushfd
mov dword [esp], edx
jp 0xc33830
lea eax, [ecx + 0x2fd9f474]
lea eax, [ebp - 0x528e3625]
mov al, 0xf6
push 4
pushfd
mov eax, dword [ebp - 0x7c]
pushfd
push ebp
push dword [esp]
mov dword [esp + 0xc], eax
push dword [esp + 4]
pushal
mov byte [esp + 8], 0x1a
pushfd
mov dword [esp + 0x30], 0xc353fa
mov byte [esp + 4], cl
push dword [esp]
call fcn.00c3fd78

Function at 0xc33fd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jne 0xc3eab4
call fcn.00c36d91

Function at 0xc34167
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xac]
pushfd
add edx, 0x10002361
push 0x5d339d3a
call fcn.00c3e333

Function at 0xc3418b
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
jne 0xc3555d
Function at 0xc342eb
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
clc
cmp edx, 0x65
pushfd
lea esp, [esp + 0x2c]
je 0xc38e7f
stc
rol ah, 6
call fcn.00c33550
shrd eax, ebx, cl
movzx ax, bl
lea ecx, [ecx - 0xf3d8be5]
mov eax, dword [ebp - 0x104]
adc ch, 0x64
setge ch
mov ecx, dword [eax + 0x30]
push 0x4775cf5f
clc
push dword [esp]
pushal
xor edx, edx
btr dx, cx
stc
mov dx, word [ecx + 4]
pushfd
stc
test al, bl
cmp edx, 0x72
pushfd
push ebp
lea esp, [esp + 0x34]
je 0xc3d131
das
movzx cx, al
mov eax, dword [ebp - 0x104]
add cl, 0xab
bts cx, 1
setbe cl
mov ecx, dword [eax + 0x30]
cmc
jmp 0xc3d10b
pushfd
stc
sub edx, edx
sal dl, cl
cmp ebx, 0xc91b2d44
btr dx, bp
inc dl
mov dx, word [ecx + 4]
pushal
clc
cmp edx, 0x52
push edx
lea esp, [esp + 0x28]
jne 0xc3555d
daa
daa
mov eax, dword [ebp - 0x104]
cmp ah, dh
neg ch
neg ch
mov ecx, dword [eax + 0x30]
stc
sub edx, edx
stc
rcl dh, cl
movzx dx, bl
mov dx, word [ecx + 6]
clc
push eax
bt cx, sp
cmp dl, dh
cmp edx, 0x6e
pushal
jmp 0xc3bccf

Function at 0xc34303
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl dh, 7
mov dx, word [ecx + 0x14]
call fcn.00c36577

Function at 0xc3431f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00c325b3
push ecx
push ebx
lea esp, [esp + 8]
jne 0xc324b4
xadd ch, al
mov eax, dword [ebp - 0x100]
sal ch, 4
mov ecx, dword [eax + 0x30]
test ah, dl
clc
sub edx, edx
ror dx, 0xe
mov dx, word [ecx + 4]
cmc
cmp edx, 0x64
pushfd
push dword [esp]
push esi
pushfd
lea esp, [esp + 0x10]
je 0xc347cf
das
mov eax, 0x794c6967
daa
rcl cl, 3
mov eax, dword [ebp - 0x100]
neg ch
bsf cx, ax
bswap ecx
mov ecx, dword [eax + 0x30]
call fcn.00c3fb7a

Function at 0xc343ec
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push 0x628ffb6f
cmp eax, 0x32
lea esp, [esp + 0x28]
jo 0xc37f56
pushfd
mov byte [esp], bh
lea esp, [esp + 4]
je 0xc3c327
btc cx, 4
neg cl
shl cx, 3
shld cx, bp, 1
mov ecx, dword [ebp - 0x44]
bt ax, dx
bt bp, 8
xor edx, edx
not dl
mov dl, byte [ecx + 5]
pushfd
pushal
pushfd
cmp edx, 0x32
mov word [esp + 4], sp
call fcn.00c35fda
call fcn.00c368d4
push esp
lea esp, [esp + 0x14]
je 0xc3b725
shrd dx, ax, cl
mov edx, dword [ebp - 0xac]
pushfd
pushal
call fcn.00c325df

Function at 0xc34544
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, byte [ecx + 8]
bt ax, cx
call fcn.00c3fb1e

Function at 0xc34550
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 4
pushal
mov dword [esp + 0x20], 0x3000
call fcn.00c3d6dd
jmp 0xc34151
Function at 0xc3469e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0xc324b4
setno al
sar cl, 5
jns 0xc39105
sal al, cl
mov eax, dword [ebp - 0x100]
rol ch, 3
mov ecx, dword [eax + 0x30]
push 0xd693e225
xor edx, edx
pushfd
setnp dl
cmc
mov dx, word [ecx + 6]
mov byte [esp], ch
cmp bl, 0x4a
stc
cmp edx, 0x6c
push 0x53b2bc8b
lea esp, [esp + 0xc]
je 0xc33669
ror cx, 0xb
daa
mov eax, dword [ebp - 0x100]
lea ecx, [esi - 0x1cb96cea]
rcr cl, cl
mov ecx, dword [eax + 0x30]
pushal
sub edx, edx
jmp 0xc3705d
push 0xf244002a
jmp 0xc32834

Function at 0xc346a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [ecx + 0x14]
cmc
cmp dh, 0x7e
push dword [esp]
push ebx
cmp edx, 0x6c
pushfd
lea esp, [esp + 0x1c]
je 0xc3f810
bswap cx
movzx ax, bl
mov eax, dword [ebp - 0x104]
cmc
cmp dl, dl
cmp bl, ah
mov ecx, dword [eax + 0x30]
push 0x6e26732c
sub edx, edx
movzx dx, al
shr dx, cl
call fcn.00c34303

Function at 0xc34741
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
add ecx, 0x14
pushfd
pushfd
pushfd
lea esp, [esp + 0x10]
jmp 0xc3f06f

Function at 0xc347bf
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x44
pushal
pushfd
pushfd
lea esp, [esp + 0x30]
jne 0xc324b4

Function at 0xc347fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc dx, dx
mov edx, dword [ebp - 8]
sbb ax, 0x7053
or cl, 0x7c
aad 0x7f
mov eax, dword [ebp - 0x64]
sar cx, cl
bt bp, dx
pushal
mov ecx, dword [eax + edx*4]
clc
jmp 0xc34c51
test cl, 0x36
push 0xbfa8a330
and ecx, 0x80000000
lea esp, [esp + 0x28]
jbe 0xc35156
bt cx, 0xf
cmp ecx, 0x80000000
call fcn.00c3a224
stc
cmp ecx, 0x80000000
pushfd
push dword [esp]
mov byte [esp], bl
lea esp, [esp + 8]
je 0xc3ff41
cdq
rol ah, 5
bsf dx, bp
call fcn.00c37dbc
rdtsc
aas
sbb dh, 0xdd
mov edx, dword [ebp - 8]
and cl, dl
sub al, 0x32
mov eax, dword [ebp - 0x64]
movsx ecx, cl
bsf cx, bp
shld cx, cx, 7
mov ecx, dword [eax + edx*4]
lahf
sub ecx, 0x80000000
call fcn.00c3fac9

Function at 0xc3483a
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0xc33b06
mov ax, 0x540c
lahf
inc al
mov eax, dword [ebp - 0x44]
call fcn.00c39a61

Function at 0xc34a6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x2e
mov dword [esp], 0x2550a558
pushfd
lea esp, [esp + 8]
jne 0xc3eab4
shr bl, 7
not bl
shr bl, cl
and bl, al
mov bl, byte [eax + 6]
jmp 0xc3724a
cmp dx, cx
cmp cl, 0xc0
cmp bl, 0x64
pushfd
pushfd
mov byte [esp + 4], cl
lea esp, [esp + 8]
je 0xc369f9
stc
cmp bl, 0x44
call fcn.00c3daf7
Function at 0xc34a93
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
jmp 0xc3dc2a
stc
cmc
cmp edx, 0x74
jmp 0xc339d3
mov word [esp], 0x19c2
push 0xf9ddd21c
lea esp, [esp + 8]
je 0xc3fe0c
rcr cx, cl
mov eax, dword [ebp - 0x100]
movsx cx, al
bt ecx, 0x14
shl cl, cl
sub ch, 0x9f
mov ecx, dword [eax + 0x30]
pushfd
cmc
jmp 0xc3bd0f
xor edx, edx
rcl dx, cl
pushfd
and dl, dl
mov dx, word [ecx]
pushal
test cl, bl
pushfd
push 0xcc4a1afb
cmp edx, 0x4e
pushfd
mov byte [esp], dl
push dword [esp]
mov byte [esp], 0xb7
lea esp, [esp + 0x38]
jne 0xc324b4
sbb al, 0xb5
daa
mov eax, dword [ebp - 0x100]
sub cx, si
rcl cx, 4
mov cx, 0x7999
lea ecx, [ebp - 0x119e102f]
mov ecx, dword [eax + 0x30]
push 0x6c849c00
xor edx, edx
rcl dx, cl
rcl dl, cl
mov dx, word [ecx + 2]
jmp 0xc33d6d
mov byte [esp], 0xf4
push dword [esp]
lea esp, [esp + 8]
je 0xc3bef8
bswap ax
mov eax, dword [ebp - 0x100]
bts cx, 0xc
pushfd
cmp dh, 0x52
not cl
mov ecx, dword [eax + 0x30]
cmp dl, 0xd0
test ecx, 0xbb4b7b23
bt bx, 3
clc
sub edx, edx
btr dx, 1
mov dx, word [ecx + 2]
mov byte [esp], 0xfb
cmp edx, 0x54
call fcn.00c32bb4

Function at 0xc34b1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xc4
lea esp, [esp + 0x44]
jne 0xc3555d
aad 0x39
mov eax, dword [ebp - 0x104]
rcr cx, 1
sbb cl, al
btc cx, di
mov ecx, dword [eax + 0x30]
push ebp
pushfd
mov dword [esp], esp
pushfd
sub edx, edx
sbb dh, ch
cmp bl, cl
call fcn.00c346a8

Function at 0xc34bf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xc3555d
shld cx, dx, 7
mov eax, dword [ebp - 0x104]
btc cx, bx
mov ecx, dword [eax + 0x30]
clc
call fcn.00c3c04e
push esi
mov dword [ebp - 0xc], 0x2000
call fcn.00c3ce65
Function at 0xc34c79
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x44]
jne 0xc3555d
adc cl, 0xc5
mov eax, dword [ebp - 0x104]
call fcn.00c331e8
jmp 0xc329b0
push dword [esp + 4]
pushal
push ebp
lea esp, [esp + 0x30]
je 0xc3dd1f
adc ah, bl
mov eax, dword [ebp - 0x104]
cmp dh, ch
jb 0xc3835f
mov ecx, dword [eax + 0x30]
pushfd
clc
jmp 0xc3dcf0
push edx
call fcn.00c32a83
rcr ch, cl
btr ecx, 0x11
mov ecx, dword [eax + 0x30]
cmc
xor edx, edx
shld dx, si, 5
mov dx, word [ecx + 0xc]
cmp dx, 0x3035
clc
cmp edx, 0x33
pushal
push eax
lea esp, [esp + 0x24]
jne 0xc3555d
bt esp, esi
setbe cl
sub ah, 0x8c
mov eax, dword [ebp - 0x104]
bts cx, ax
shld cx, bp, 2
pushfd
sub cl, al
mov ecx, dword [eax + 0x30]
clc
call fcn.00c326cc
pushal
xor edx, edx
bsr dx, bp
shl dl, 5
mov dx, word [ecx + 0xa]
pushal
stc
bt di, si
cmp edx, 0x4c
jmp 0xc340d6
shr ecx, 0x1c
rcr cl, cl
sal cx, cl
mov ecx, dword [eax + 0x30]
cmp bx, 0xae84
xor edx, edx
bt bp, 5
cmp dl, 0x32
btr dx, 9
mov dx, word [ecx + 8]
pushfd
pushfd
pushal
cmc
cmp edx, 0x45
call fcn.00c36ab0
sub edx, edx
shrd dx, di, 3
mov dx, word [ecx + 0xa]
pushal
cmp edx, 0x4c
mov dword [esp], ebp
pushfd
pushfd
lea esp, [esp + 0x48]
jne 0xc3555d
sar al, cl
mov eax, dword [ebp - 0x104]
movzx cx, cl
mov ecx, dword [eax + 0x30]
jmp 0xc3b451
pushal
pushal
pushfd
lea esp, [esp + 0x44]
je 0xc3cefe
cmp ah, dl
movzx ecx, bl
mov eax, dword [ebp - 0x104]
shld cx, ax, cl
mov ecx, dword [eax + 0x30]
push 0x20ff3af2
jmp 0xc3fe8b
clc
pushfd
sub edx, edx
mov dl, byte [esp]
mov dx, word [ecx + 0xc]
call fcn.00c3cc86
pushfd
push ebp
xor edx, edx
push 0x3088333a
mov byte [esp], 0x20
mov dx, word [ecx + 0xa]
mov word [esp], di
cmp edx, 0x6c
pushal
lea esp, [esp + 0x2c]
jge 0xc3ecdb
pushal
lea esp, [esp + 0x20]
jno 0xc3af50
je 0xc3cefe
bsr cx, cx
bsf cx, di
clc
mov eax, dword [ebp - 0x104]
not cx
mov ecx, dword [eax + 0x30]
cmp cl, al
pushal
sub edx, edx
shr dl, 4
rcr dh, 6
mov dx, word [ecx + 0xa]
mov byte [esp], bh
stc
cmp edx, 0x4c
mov byte [esp], bh
jmp 0xc3cef3
pushfd
lea esp, [esp + 0x24]
jne 0xc3555d
shr ch, cl
test dh, 0x7a
mov eax, dword [ebp - 0x104]
stc
jmp 0xc35dc0
clc
sub edx, edx
rcr dh, cl
bt bp, bx
sbb dh, 0x97
mov dx, word [ecx + 8]
bt ebx, edi
clc
bt eax, ecx
cmp edx, 0x45
lea esp, [esp + 4]
jge 0xc3561d
push esp
lea esp, [esp + 4]
jne 0xc3555d
aaa
bsf eax, ebx
mov eax, dword [ebp - 0x104]
bsf cx, sp
movzx cx, bl
or cl, cl
mov ecx, dword [eax + 0x30]
jmp 0xc3c4b1
jmp 0xc3efba
pushfd
lea esp, [esp + 4]
je 0xc3cefe
jbe 0xc3e4ff
mov eax, dword [ebp - 0x104]
jo 0xc3a73b
mov ecx, dword [eax + 0x30]
jmp 0xc36f4b
pushal
aas
mov eax, dword [ebp - 0x104]
add cx, dx
setb cl
adc cl, 0xeb
mov ecx, dword [eax + 0x30]
jmp 0xc39a6a
call fcn.00c36a36