joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc3c0aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0xc329e2
push 0x2daaa816
add dh, 0xae
mov edx, dword [ebp - 0x44]
pushal
pushfd
call fcn.00c37a60

Function at 0xc3c0c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc3ed84
pushfd
push 0x4d2798ff
lea esp, [esp + 0x10]
je 0xc39275
clc
cmp bl, 0x4c
push ebx
jmp 0xc386a4
push dword [esp]
lea esp, [esp + 8]
jne 0xc3eab4
cmp ch, 0x9d
call fcn.00c37f4b

Function at 0xc3c132
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ax
mov eax, dword [edx]
pushal
call fcn.00c388b4
mov edx, dword [ebp - 0x108]
mov ax, 0x4ca6
jmp 0xc363f4

Function at 0xc3c15c
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x6c
pushfd
pushfd
pushfd
call fcn.00c3ad38

Function at 0xc3c2d7
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov byte [esp], cl
mov dword [esp + 8], ecx
lea esp, [esp + 0x2c]
jb 0xc3aec6
bswap dx
bswap edx
call fcn.00c3c132

Function at 0xc3c2f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00c3d8da
pushfd
movzx si, dl
mov esi, dword [ebp - 0x3c]
jmp 0xc370e7

Function at 0xc3c36e
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov byte [esp], 3
cmp edx, 0x4c
pushfd
lea esp, [esp + 0x2c]
jne 0xc329e2
btr eax, 0x1b
add ah, ch
rol ah, cl
lahf
mov eax, dword [ebp - 0x44]
pushal
pushal
clc
stc
xor ecx, ecx
push 0x32cab186
add cl, 5
mov cl, byte [eax + 9]
sub esp, 0xffffffbc
jne 0xc3f3f8
clc
cmp ecx, 0x6c
push 0x6cb21508
pushal
mov byte [esp], 0x21
push edx
lea esp, [esp + 0x28]
jmp 0xc3940c
cmp al, dh
pushfd
clc
cmp ecx, 0x6c
push dword [esp]
pushfd
pushal
push dword [esp]
lea esp, [esp + 0x30]
jmp 0xc3940c

Function at 0xc3c471
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push esp
lea esp, [esp + 0x30]
je 0xc32d3d
jmp 0xc37a4b

Function at 0xc3c55d
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp - 0x108], ecx
jmp 0xc4016f
pushal
pushfd
pushfd
lea esp, [esp + 0x34]
jb 0xc3aec6

Function at 0xc3c58c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xc33b06
bts ax, di
mov eax, dword [ebp - 0x44]
cmp bp, bx
jmp 0xc34652

Function at 0xc3c5d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, 0x6c
pushfd
push 0xb08ad7e6
push dword [esp + 4]
push dword [esp + 4]
lea esp, [esp + 0x38]
jmp 0xc3940c
sub edx, edx
and dl, 0xd8
and dl, ah
pushfd
and dl, al
mov dl, byte [ecx + 8]
cmp bh, 0x2a
cmp cl, al
bt edi, ebp
push 0x7abf9d5e
cmp edx, 0x4c
mov word [esp], 0x88d3
lea esp, [esp + 0xc]
jne 0xc329e2
xor ah, 0xf1
mov eax, dword [ebp - 0x44]
pushfd
clc
clc
pushfd
sub ecx, ecx
sar cl, cl
mov cl, byte [eax + 9]
mov byte [esp + 4], 0xa3
pushal
clc
jmp 0xc37587
stc
jmp 0xc39370
Function at 0xc3c643
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xor edx, edx
pushal
cmc
bswap dx
bsr dx, dx
mov dx, word [ecx + 2]
pushal
pushfd
cmp si, bp
cmp edx, 0x54
push 0xdc82042f
lea esp, [esp + 0x4c]
jne 0xc324b4
add cl, 0x26
aad 0x30
mov eax, dword [ebp - 0x100]
bsr cx, ax
cmc
mov ecx, dword [eax + 0x30]
test si, 0xe7ab
clc
xor edx, edx
pushal
sbb dl, bl
bswap dx
mov dx, word [ecx + 4]
push dword [esp + 0xc]
cmp edx, 0x64
push dword [esp + 0x10]
lea esp, [esp + 0x28]
je 0xc347cf
call fcn.00c33282
cmc
cmp edx, 0x65
call fcn.00c34c79

Function at 0xc3c6b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd ecx, edx
mov edx, dword [ebp - 0xac]
btc cx, 0xf
lea ecx, [ecx*2 + 0x5ea9c06b]
not cl
not cx
add edx, 0x10002464
cmc
not cx
sub cx, bx
shl cx, 1
xor eax, eax
not cl
inc cl
sbb cl, 7
rol cl, 2
mov dword [edx + 1], eax
cmp bl, ch
and dh, dl
shr dx, cl
rol dx, 6
mov ecx, dword [ebp - 0xbc]
bswap edx
btr dx, bp
sub ecx, 0x10000000
lea edx, [ebx*8 + 0x7f37fe72]
mov dword [ebp - 4], ecx
jmp 0xc3ac88
call fcn.00c3b46c
sbb cl, 0x6f
mov ecx, dword [eax + 0x30]
cmc
cmp ch, 0xec
sub edx, edx
pushal
lea esp, [esp + 0x20]
jmp 0xc37d21
mov byte [esp], ch
push esi
lea esp, [esp + 0xc]
je 0xc353fa
bswap ecx
not cl
movsx eax, cl
pushal
mov edx, dword [ebp - 0x7c]
call fcn.00c33ed4

Function at 0xc3c80a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0xc33483
test bl, 0x3c
call fcn.00c3313e
mov dword [ebp - 0xa0], 0
push eax
push 0x457046f9
mov byte [esp + 0x14], 0x12
lea esp, [esp + 0x50]
jmp 0xc35d36

Function at 0xc3c9ad
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xc3555d
aaa
call fcn.00c354bc

Function at 0xc3c9bd
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
stc
cmp eax, 0x32
pushfd
push esi
lea esp, [esp + 0x10]
je 0xc3c327
btr ecx, 0x1c
mov ecx, dword [ebp - 0x44]
pushfd
call fcn.00c375e0

Function at 0xc3c9da
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, eax
jmp 0xc37bb5
cmp bl, 0x6e
pushfd
pushal
mov byte [esp], 0xa8
lea esp, [esp + 0x2c]
je 0xc35cff
clc
call fcn.00c3a518
pushfd
lea esp, [esp + 0x48]
jne 0xc329e2
and dl, dl
mov edx, dword [ebp - 0x44]
pushal
jmp 0xc3726c

Function at 0xc3ca6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ch
push dword [ebp - 0xc8]
pop dword [esp + 0x3c]
mov dword [esp], 0x432dcbc7
push dword [esp + 0x3c]
ret 0x40
mov dword [esp + 0x20], 0xc3e5c0
push esi
call fcn.00c399e2
lea esp, [esp + 0x38]
jne 0xc3fca6
push eax
push edx
pushal
lea esp, [esp + 0x24]
jb 0xc3f53d
push 0xc3e5c0
call fcn.00c3fbc3
pushal
mov byte [esp + 0x10], 0xd5
push eax
jmp 0xc38dcb
pushal
mov dword [esp + 0x1c], eax
mov byte [esp + 4], 7
pushal
pushfd
mov byte [esp + 8], 0xf7
mov dword [esp + 0x3c], 0xc3ef37
mov word [esp + 8], ax
push 0x445bf669
jmp 0xc37091
Function at 0xc3cbc0
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
xchg ecx, edx
mov ecx, dword [ebp - 0xfc]
lea edx, [edx + 0x7e476cce]
movzx dx, cl
setl dh
call fcn.00c37f1f
rcl dh, 3
rcl dx, cl
mov dx, word [ecx + 0x12]
test dh, 0x87
test ecx, ebx
cmp bl, 0x79
test edx, edx
pushal
call fcn.00c3f1e4
lea esp, [esp + 0x30]
jne 0xc324b4
bsf cx, bp
bsr eax, edi
stc
rcl ah, cl
mov eax, dword [ebp - 0x100]
bsf cx, di
mov ecx, dword [eax + 0x30]
cmp dl, 0xfc
xor edx, edx
jmp 0xc38de5

Function at 0xc3cc2b
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x2c], 0xc35ac1
push dword [esp + 4]
pushfd
pushfd
call fcn.00c3dda5

Function at 0xc3cc86
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x33
mov byte [esp], bh
push esp
lea esp, [esp + 0xc]
jne 0xc3555d
test dh, 0xbf
shl al, 1
add ax, ax
rcr ah, cl
mov eax, dword [ebp - 0x104]
shr ch, cl
shld cx, ax, cl
mov ecx, dword [eax + 0x30]
cmc
xor edx, edx
sub dh, 0x23
mov dx, word [ecx + 0xe]
test cl, cl
pushal
cmc
push 0x5e415696
cmp edx, 0x32
pushal
push 0xbb03fcc6
mov byte [esp + 8], 0x81
jmp 0xc3d83f
lea esp, [esp + 0x48]
jne 0xc3555d
sal eax, cl
rcr ah, 5
bsr ecx, ecx
mov eax, dword [ebp - 0x104]
push 0xa45820b3
xor cl, dl
mov ecx, dword [eax + 0x30]
stc
test dh, 0x4a
sub edx, edx
shld dx, dx, 0xf
add dx, 0x892d
mov dx, word [ecx + 0x10]
stc
mov word [esp], 0x2755
bt bx, 3
cmp edx, 0x2e
call fcn.00c366fb

Function at 0xc3cd32
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], ecx
lea esp, [esp + 0x38]
jne 0xc324b4
sar eax, 0x13
mov eax, dword [ebp - 0x100]
pushfd
movsx cx, al
shr cl, cl
mov ecx, dword [eax + 0x30]
call fcn.00c35ede

Function at 0xc3ce8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [edi + 0x10]
clc
cmp cx, si
cmc
lea eax, [ecx*8 + 0x2ffba43e]
add ecx, edx
rcl al, cl
bswap dx
inc dl
pushfd
lea ecx, [ecx + esi*4]
dec dx
bt edx, 0x1b
mov dword [ebp - 0x7c], ecx
bt cx, bx
mov eax, dword [ecx]
movzx dx, al
cmp si, bp
inc edx
mov dword [ebp - 0xdc], eax
sub esp, 0xfffffff8

Function at 0xc3d0fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, byte [eax + 9]
stc
test bl, bl
pushal
pushal
call fcn.00c3ca44

Function at 0xc3d2bc
Capabilities:
Access peb ldr_data

Disassembly:
mov edx, dword [ebp - 0xac]
sar bx, 0xa
bt cx, 0xd
mov byte [esp], 8
add edx, 0x10002253
push dword [esp + 8]
bts ebx, ebp
add edx, 1
mov byte [esp + 0xc], dh
mov ebx, dword [ebp - 0xcc]
add ax, 0xcfc0
add ebx, dword [ebp - 0xbc]
das
btc di, 1
mov dword [edx], ebx
btr ax, sp
rol ah, 1
pop eax
xor byte [edx - 1], 0x80
shl cx, cl
stc
lahf
mov eax, dword [ebp - 0xac]
movzx bx, al
add eax, 0x10002395
pushal
setns bh
mov dword [ebp - 0xb0], eax
inc ah
cdq
push dword [esp + 0x44]
popfd
dec dx
xadd al, dl
movzx ax, cl
sub esp, 0xffffffb8
popal
sub ah, bl
mov eax, dword fs:[0x30]
clc
test ebp, 0xce37acfc
test ch, ah
cmp dx, 0x3bab
mov eax, dword [eax + 0xc]
clc
test eax, eax
call fcn.00c35fdf
Function at 0xc3d35b
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
add edx, 0x1000104a
rol ax, cl
pop ebx
btc bx, si
mov ebx, dword [edx]
rcl dh, 7
aas
add ebx, dword [ebp - 0xe4]
aaa
sar ax, 1
rol dl, cl
sbb eax, 0xfacca782
mov dword [ebp - 0xe0], ebx
rdtsc
and dh, ch
rdtsc
cmp bh, dh
mov eax, dword [ebx]
pushfd
or bx, 0xec31
mov dword [ebp - 0xd4], eax
rcl bx, 4
bsf ebx, esi
mov edx, dword [ebp - 0xac]
xor bl, 0xd5
rcl bh, 4
and bh, al
add edx, 0x10001036
stc
and bx, sp
mov dword [edx], eax
pushal
mov edx, dword [ebp - 0xac]
sub bl, 0x29
test bx, si
add edx, 0x10001042
bsf bx, sp
sar bh, cl
mov ebx, dword [edx]
rcr dl, cl
mov dword [ebp - 0xa8], ebx
sal edx, cl
cmp ax, 0x6f75
rcl dx, cl
add ebx, dword [ebp - 0xe4]
or edx, ebp
pushal
movsx dx, cl
sbb dl, bl
mov dword [ebp - 0x50], ebx
inc dl
mov edx, dword [ebp - 0xac]
neg bh
add edx, 0x1000104e
test dl, cl
movzx bx, al
shl bl, cl
lea ebx, [ebp + 0x7bfb7617]
mov ebx, dword [edx]
movzx dx, al
clc
rcr dh, 6
add ebx, dword [ebp - 0x50]
bswap dx
rcr dh, 2
mov dword [ebp - 0xa4], ebx
mov word [esp], 0x97fa
and bl, al
call fcn.00c32bd6

Function at 0xc3d545
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp eax, 0x2e
pushal
call fcn.00c34fb5
Function at 0xc3d889
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
cmc
cmp edx, 0x74
mov word [esp], 0x6b3
lea esp, [esp + 4]
je 0xc3bef8
dec ax
or cl, 0x32
mov cx, 0x9b77
mov eax, dword [ebp - 0x100]
inc cl
sub cx, dx
and cx, cx
mov ecx, dword [eax + 0x30]
test dl, bh
bt edi, 0x13
sub edx, edx
bsf dx, bp
mov dx, si
bsf dx, bx
movsx dx, bl
mov dx, word [ecx + 2]
pushal
cmp edx, 0x54
pushal
push dword [esp]
call fcn.00c32d8d
lea esp, [esp + 0x28]
je 0xc35cff
cmp dh, ch
push 0xe2acedc7
cmp bl, 0x4e
call fcn.00c3367a
lea esp, [esp + 0x2c]
jp 0xc3912a
pushfd
lea esp, [esp + 4]
jne 0xc324b4
xadd al, cl
mov eax, dword [ebp - 0x100]
neg cx
bts cx, 9
bt si, di
movzx ecx, dl
mov ecx, dword [eax + 0x30]
jg 0xc3dd86
sub edx, edx
shr dh, cl
bt eax, 1
mov dx, word [ecx + 2]
stc
jl 0xc35383
push 0xb223adfc
cmc
cmp edx, 0x74
call fcn.00c350d9
lea esp, [esp + 0x2c]
jl 0xc3a6ba
pushal
lea esp, [esp + 0x20]
je 0xc3cecb
rol bl, cl
seta bl
add eax, edx
neg bl
mov bl, byte [eax]
call fcn.00c3e2fd
jne 0xc324b4
movzx cx, dl
inc al
setp ah
cwde
mov eax, dword [ebp - 0x100]
and cx, 0x672
btc cx, cx
mov ecx, dword [eax + 0x30]
push esi
xor edx, edx
not dh
mov dx, word [ecx + 2]
call fcn.00c3ff8c
jmp 0xc3ca26
cmp bl, 0x6e
pushfd
pushfd
jmp 0xc373bf
jmp 0xc384f0
pushfd
mov word [esp], bp
jmp 0xc3bceb
push edi
mov byte [esp], 0xd5
mov byte [esp], 0xc7
lea esp, [esp + 4]
je 0xc3cecb
adc bl, ah
cmp dh, 0xfd
add eax, edx
sbb bl, 0xb5
mov bl, byte [eax]
test ebp, 0x68b61bd4
pushfd
call fcn.00c3c9da
lea esp, [esp + 4]
jnp 0xc3d540
je 0xc3cecb
bt ax, di
shl bl, 1
add eax, edx
not bl
dec bl
pushal
mov bl, byte [eax]
jmp 0xc38aa4
pushfd
stc
mov dword [ebp - 0x11c], eax
cmp bp, 0xbba2
stc
cmp eax, 0xea
jmp 0xc3e108
jmp 0xc3ad0d
mov byte [esp + 4], bl
pushal
pushfd
lea esp, [esp + 0x2c]
je 0xc3fe0c
pushal
btr cx, 9
mov eax, dword [ebp - 0x100]
shld ecx, ebp, 0xa
mov ecx, dword [eax + 0x30]
cmp cx, bp
xor edx, edx
pushfd
adc dl, dl
setns dh
movzx dx, al
mov dx, word [ecx]
cmc
pushfd
jmp 0xc3efd3
clc
stc
cmp dh, ch
push esi
sub edx, edx
dec dl
rcr dx, 9
mov dx, word [ecx + 2]
pushfd
pushfd
clc
cmp cl, bh
cmp edx, 0x74
pushfd
call fcn.00c32de7
push ebx
call fcn.00c33ad6
mov dword [ebp - 0xfc], edx
pushal
mov byte [esp], cl
push dword [esp + 0xc]
lea esp, [esp + 0x28]
jmp 0xc3ee0e
push eax
cmp edx, 0x4e
jmp 0xc37afb

Function at 0xc3d8da
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
call fcn.004ca480
pushal
rcl ch, cl
mov dword [ebp - 0xb8], eax
bts dx, ax
lea ecx, [esi - 0x33d1fd53]
rdtsc
mov edx, dword [ebp - 0x3c]
movzx cx, al
sub cl, 0xd9
mov ecx, dword [edx + 0x3c]
mov ax, 0x70c7
bsr eax, edx
add ecx, edx
movzx eax, al
or eax, esp
test al, 0x26
shr ah, 3
mov ecx, dword [ecx + 0x80]
das
add ecx, edx
call fcn.00c363e4
Function at 0xc3dae4
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0xc3a76d
lea esp, [esp + 0x38]
je 0xc3aec6
cmc
mov eax, dword [ebp - 0x108]
bt eax, esi
stc
cmp bx, cx
cmp eax, dword [ebp - 0xf8]
pushfd
pushfd
lea esp, [esp + 8]
jb 0xc4017c
pushfd
jmp 0xc3a028
add edx, 0x3c
pushfd
pushfd
cmc
stc
cmp dword [ebp - 0x108], edx
pushfd
jmp 0xc37fd9

Function at 0xc3daf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
lea esp, [esp + 0x28]
jne 0xc3eab4
push ebx
call fcn.00c38a02
jmp 0xc34728

Function at 0xc3ddcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
lea esp, [esp + 4]
jne 0xc3eab4
inc bl
clc
add bl, 0x83
mov bl, byte [eax + 5]
push eax
test ebx, 0x537cafae
pushfd
cmp bl, 0x2e
pushal
call fcn.00c3a279
call fcn.00c375d6
push dword [ebp - 0x10c]
pop dword [esp + 0x2c]
call fcn.00c378cf

Function at 0xc3de54
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd54aa7ad
lea esp, [esp + 0x34]
jne 0xc3555d
aas
bts ecx, 0x1c
cmc
dec cl
mov eax, dword [ebp - 0x104]
bswap ecx
mov ecx, dword [eax + 0x30]
test bl, 0x8a
stc
sub edx, edx
rcl dh, 4
shr dl, 2
bswap dx
mov dx, word [ecx + 0xc]
clc
cmp edx, 0x33
pushal
pushfd
lea esp, [esp + 0x24]
jne 0xc3555d
lea ecx, [ecx*8 + 0x1345824a]
mov eax, dword [ebp - 0x104]
bsr cx, sp
test bp, 0xfb7a
stc
mov ecx, dword [eax + 0x30]
push esp
xor edx, edx
bswap dx
mov dx, word [ecx + 0xe]
call fcn.00c37222
mov dword [ebp - 0x118], eax
btc edx, 0xe
not dl
rcr dx, 4
mov edx, dword [ebp - 0xac]
push esi
add edx, 0x1000230f
jmp 0xc3fe7c
pushal
push 0x16b9b4d1
mov dword [esp + 0x24], edx
jmp 0xc35717

Function at 0xc3e031
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bl
cmp edx, dword [ebp - 0x10]
jmp 0xc38609
jmp 0xc36912

Function at 0xc3e046
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0xc3eab4
inc bl
setg bl
mov bl, byte [eax + 4]
bt edx, 0xb
pushal
push dword [esp]
test bl, 0xcd
cmp bl, 0x6c
jmp 0xc3dd79
jmp 0xc3325d
lea esp, [esp + 0x44]
je fcn.00c36a1d
pushal
call fcn.00c3ef0f
mov word [esp + 8], 0xf036
pushal
jmp 0xc3a8a7
cmp bl, 0x4c
jmp 0xc34b4e

Function at 0xc3e04e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xc], 0xf6
jmp 0xc3bf3c

Function at 0xc3e0e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, ecx
adc cl, 0x27
mov cl, byte [eax + 9]
pushfd
cmp sp, 0x8578
call fcn.00c37377

Function at 0xc3e0f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x589b3897
mov byte [esp], 2
cmp bl, 0x44
jmp 0xc37de9
Function at 0xc3e136
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
add ebx, dword [ebp - 0x50]
sar dl, 4
movsx dx, cl
mov dword [ebp - 0x2c], ebx
lea edx, [esp - 0x44fd652e]
and dx, sp
btc dx, bx
pop edx
mov edx, dword [ebp - 0xac]
stc
push edi
cmp ch, 0x4e
add edx, 0x10001005
pushfd
call fcn.00c39140
mov edx, dword [ebp - 0xac]
shld bx, ax, cl
pushfd
add edx, 0x1000106a
sub esp, 0xfffffff8
jge 0xc33fe0
mov ebx, dword [edx]
push 0xbf54073d
sub esp, 0xfffffffc
jl 0xc3e21f
jmp 0xc395c5
lea ebx, [esi - 0x2a78a1ae]
cmc
rcr bl, 3
shrd bx, ax, 0xd
mov ebx, dword [edx]
bsr dx, di
not dx
bswap dx
movsx dx, cl
mov dword [ebp - 0x48], ebx
movzx edx, al
rcr bx, cl
rcl bl, 5
mov edx, dword [ebp - 0xac]
sal bl, 5
rcl ebx, 3
add edx, 0x10001066
btr bx, 6
or bl, 0xb9
mov ebx, dword [edx]
movsx dx, al
shr dl, 3
rcl dl, 6
shr dx, cl
mov dword [ebp - 0x74], ebx
or ebx, 0x21825886
mov edx, dword [ebp - 0xac]
shld ebx, edi, 0xa
bt si, 4
setl bh
cmp ax, 0xd294
add edx, 0x1000106e
shld bx, dx, 7
mov ebx, dword [edx]
btc edx, 7
mov dword [ebp - 0x10], ebx
pushal
bsf edx, ebp
xor dh, bh
mov edx, dword [ebp - 0xac]
push dword [esp + 4]
push dword [esp + 8]
sbb bh, ch
add edx, 0x10001072
rcr bh, cl
not bl
inc bl
mov ebx, dword [edx]
rcl dh, 7
or dx, 0xedc1
bt esi, ebx
mov dword [ebp - 0x18], ebx
or edx, esp
mov edx, dword [ebp - 0xac]
btr ebx, edi
add edx, 0x10001076
bsr ebx, eax
lea ebx, [edi + 0x67cd69d5]
bswap bx
setb bh
mov ebx, dword [edx]
jmp 0xc328a5
lea ebx, [0xfb2e39ff]
sbb bx, dx
mov ebx, dword [edx]
mov dx, bx
add ebx, dword [ebp - 0x50]
mov byte [esp + 4], dl
rol dh, cl
inc dx
rcr edx, 0x18
mov dword [ebp - 0x2c], ebx
bsf dx, dx
setns dh
mov edx, dword [ebp - 0xac]
push dword [esp + 4]
bt bx, 0xd
add edx, 0x10001005
pushfd
pushfd
xchg dword [esp + 0x30], edx
pop edx
pushfd
mov edx, dword [ebp - 0x34]
jmp 0xc36107
mov dword [esp + 0x2c], 0xc3a35a
call fcn.00c3a6c4
mov dword [ebp - 0x48], ebx
jmp 0xc3d624
btr bx, 3
cmc
add edx, 0x10001066
pushfd
mov ebx, dword [edx]
bswap dx
mov dword [ebp - 0x74], ebx
not dx
mov edx, dword [ebp - 0xac]
pushfd
stc
or bl, bh
pushfd
add edx, 0x1000106e
cmc
dec bl
bsr bx, bx
rol bl, 7
mov ebx, dword [edx]
xor dh, bl
mov dword [ebp - 0x10], ebx
cmc
bsr bx, di
sub bx, di
mov edx, dword [ebp - 0xac]
inc bx
and bl, 0x12
shrd bx, ax, cl
add edx, 0x10001072
shl bl, 7
pushfd
movsx bx, cl
mov ebx, dword [edx]
pop edx
clc
mov dword [ebp - 0x18], ebx
pushal
pop edx
rcr ebx, 1
mov edx, dword [ebp - 0xac]
bt di, si
btc ebx, 4
jmp 0xc3e61d
bsf ebx, eax
add edx, 0x10001062
dec bx
mov ebx, dword [edx]
cmc
mov dword [ebp - 0x54], ebx
cmc
mov edx, dword [ebp - 0xac]
rol bx, cl
stc
btc ebx, ebp
add edx, 0x10001066
test dh, dl
mov ebx, dword [edx]
neg dl
xor dh, cl
or edx, ecx
bts dx, 1
mov dword [ebp - 0x74], ebx
bt si, sp
xchg dx, bx
jmp 0xc33a88
ror dl, 5
bt bp, 0xb
mov dword [ebp - 0x48], ebx
or edx, 0x42524f79
shrd ebx, edi, 0x16
mov edx, dword [ebp - 0xac]
jmp 0xc3cac9
add edx, 0x10001076
jmp 0xc34f60
Function at 0xc3e1b0
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
call fcn.00c369cc
lea esp, [esp + 0x44]
je fcn.00c36a1d
clc
cmp bl, 0x4c
pushfd
call fcn.00c3267d
lea esp, [esp + 0x48]
jne 0xc3eab4
rol bl, 2
shr bl, cl
xor bl, bh
mov bl, byte [eax + 6]
pushfd
bt di, di
cmp bl, 0x64
jmp 0xc38ee2
push eax
jmp 0xc3d161

Function at 0xc3e3d9
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0xc368da
push 0x35f6d983
lea esp, [esp + 4]
jmp 0xc3d9d0
jmp 0xc3bd6d

Function at 0xc3e513
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp edx, 0x4c
pushfd
pushal
lea esp, [esp + 0x30]
jne 0xc3555d
shl ecx, cl
clc
shr cx, 4
sar cl, 5
mov eax, dword [ebp - 0x104]
xor cx, di
cmc
bswap cx
mov ecx, dword [eax + 0x30]
test bh, ch
xor edx, edx
mov eax, dword [ebp - 0x104]
and cl, bh
btr ecx, ebx
mov ecx, dword [eax + 0x30]
bt sp, si
bt si, bp
bt sp, bp
cmc
xor edx, edx
adc dx, bp
test ebp, 0xbc1b60bd
bsf dx, bx
or dl, 0x83
mov dx, word [ecx + 0x14]
clc
stc
pushal
test bl, bl
cmp edx, 0x6c
pushfd
mov dword [esp], 0xa8605c35
lea esp, [esp + 0x24]
je 0xc3f810
shl eax, 6
push 0xb8a1eaa5
dec ch
mov eax, dword [ebp - 0x104]
movsx cx, al
shrd cx, si, 0xc
mov ecx, dword [eax + 0x30]
push 0x2210dc8c
sub edx, edx
add dx, 0xc3f9
stc
jmp 0xc3a8fa
mov dx, word [ecx + 0x14]
jmp 0xc333af
pushfd
lea esp, [esp + 0xc]
jne 0xc3555d
btr ax, 0xf
jmp 0xc3445c

Function at 0xc3e6e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xac]
push dword [esp + 4]
clc
add edx, 0x1000230f
pushfd
push ebx
jmp 0xc4009e
mov dword [esp + 0x10], edx
jmp 0xc3c726

Function at 0xc3eb75
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp], ah
push 0x6ff9fe0c
lea esp, [esp + 8]
jne 0xc3555d
and dl, 0x4e
mov eax, dword [ebp - 0x104]
cmp ebp, esi
shld edx, esi, cl
sbb cx, dx
ror dx, cl
mov ecx, dword [eax + 0x3c]
pushfd
shld dx, di, cl
mov dword [ebp - 0x108], ecx
rcr dh, cl
sbb dl, cl
mov edx, dword [ebp - 0x104]
bt bx, si
bt bx, 0xb
cmc
add edx, 0x3c
jmp 0xc3b630
cmp dword [ebp - 0x108], edx
jmp 0xc3c635
jmp 0xc3e6c6
lea esp, [esp + 4]
je 0xc3aec6
lahf
sal ah, cl
sal ax, cl
shrd ax, sp, cl
mov eax, dword [ebp - 0x108]
pushal
call fcn.00c376c9
clc
call fcn.00c3838e
jmp 0xc38bc5

Function at 0xc3ec10
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jne 0xc3555d
bsr ax, sp
mov eax, dword [ebp - 0x104]
add ecx, edi
btc cx, 6
call fcn.00c39a32