joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc3917d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0xc3eab4
not bl
mov bl, byte [eax + 9]
pushal
push 0x260ae489
pushfd
cmp esi, ecx
test bl, bl
call fcn.00c3e2b1
lea esp, [esp + 0xc]
jne 0xc3eab4
and bl, cl
mov bl, byte [eax + 7]
pushal
stc
cmp bl, 0x6c
jmp 0xc401d1
cmc
pushal
cmp bl, 0x4c
push 0x28505141
lea esp, [esp + 0x24]
jne 0xc3eab4
rcl bl, cl
mov bl, byte [eax + 8]
clc
bt di, bp
cmc
cmp bl, 0x6c
push ebx
pushfd
pushfd
lea esp, [esp + 0xc]
je 0xc39275
bt cx, 0xe
stc
cmp bl, 0x4c
push edx
mov byte [esp], 0x52
jmp 0xc33ab7
push 0xced202d4
lea esp, [esp + 0x24]
je 0xc33483
jmp 0xc3a41c

Function at 0xc3926a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 8]
jne 0xc3eab4

Function at 0xc39280
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0xc324b4
ror cl, cl
rcl cl, cl
sar ch, 5
mov eax, dword [ebp - 0x100]
rcl ch, cl
mov ecx, dword [eax + 0x30]
push ebp
test ebp, 0x1ca7da33
sub edx, edx
push dword [esp]
btc dx, ax
pushfd
mov dx, word [ecx + 0xe]
add esp, 0xc
jle 0xc3e2f0
stc
stc
cmp edx, 0x6c
jmp 0xc3fe4c

Function at 0xc393e4
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0xc329e2

Function at 0xc39439
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x6c
pushal
call fcn.00c35582
cmp dx, bp
cmp bl, 0x44
push edx
pushfd
lea esp, [esp + 0x2c]
jne 0xc3eab4
pushal
sub bl, ch
mov bl, byte [eax + 3]
bt si, sp
jmp 0xc32692

Function at 0xc3948d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0xc35c3e
pushal
mov byte [esp + 4], 0x7d
lea esp, [esp + 0x44]
je 0xc394b0
jbe 0xc35557
pushal
pushal
mov dword [ebp - 0x70], 1
lea esp, [esp + 0x40]
call fcn.00c3793f
pushal
pushfd
cmp dl, ch
pushal
cmp eax, 0x1000
jmp 0xc398d4

Function at 0xc39572
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 8], al
lea esp, [esp + 0x44]
je 0xc370fb
call fcn.00c379f2
mov ecx, dword [ebp - 0x40]
and dx, 0x36b1
pushfd
mov edx, dword [ebp - 0xbc]
clc
clc
test dh, 0x91
cmc
add edx, dword [ecx + eax + 0x10]
rcl cl, cl
ror ecx, cl
xchg ecx, eax
mov dword [ebp - 0x8c], edx
clc
not eax
mov eax, dword [ebp - 0x38]
jmp 0xc3fc1f
jmp 0xc383a5
stc
pushfd
movzx dx, cl
imul eax, eax, 0x14
sub cx, di
mov ecx, dword [ebp - 0x40]
dec edx
mov edx, dword [ebp - 0xbc]
pushfd
cmc
cmp si, 0x7f66
pushfd
add edx, dword [ecx + eax]
dec ax
mov dword [ebp - 0x64], edx
sub ax, 0x4c90
shrd eax, edx, 0xe
btc ax, 4
mov eax, dword [ebp - 0x44]
pushfd
sub ecx, ecx
rcl cl, cl
shr cl, 5
pushfd
mov cl, byte [eax]
test dh, al
push ebx
test bh, bl
push dword [esp + 4]
cmp ecx, 0x75
mov word [esp], dx
jmp 0xc3ee38
Function at 0xc39635
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x24]
jne 0xc3eab4
add bl, dh
setne bl
mov bl, byte [eax + 8]
stc
bt cx, 0xa
call fcn.00c329f3
cmp sp, bp
cmp eax, 0x6c
mov byte [esp + 4], dl
mov word [esp], bp
pushfd
lea esp, [esp + 0x28]
je 0xc393ee
bt cx, 0xe
mov ch, ch
btc cx, 5
cmp ah, bh
mov ecx, dword [ebp - 0x44]
lea esp, [esp + 0x34]
je 0xc33483
clc
cmp bl, 0x4c
pushfd
jmp 0xc3823b

Function at 0xc3984c
Capabilities:
Execute anti-debugging instructions

Disassembly:
setl ch
mov ch, cl
mov ecx, dword [ebp - 0x1c]
push dword [esp]
pushfd
jmp 0xc340f4

Function at 0xc398ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0xc3eab4
call fcn.00c33fa0
push esp
mov byte [esp + 4], dl
lea esp, [esp + 0x10]
je 0xc355f2
test dx, bp
stc
cmp bl, 0x4c
jmp 0xc37bd0

Function at 0xc39907
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [ebp - 0x11c], eax
push dword [esp]
cmp al, ah
bt sp, dx
cmp dh, 0x41
cmp dword [ebp - 0x11c], 0
call fcn.00c38c1c

Function at 0xc39b52
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc3d1dc
ror cl, cl
lea esp, [esp + 4]
jb 0xc33cad
mov dword [ebp - 0x28], edx
push esi
mov eax, dword [ebp - 0xa0]
ror ch, cl
mov dl, al
clc
mov word [esp], 0x7a13
imul eax, eax, 0x18
not ecx
push dword [esp]
mov ecx, dword [ebp - 0xe8]
pop edx
pushal
pop edx
mov edx, dword [ecx + eax + 0x10]
xchg cx, ax
mov dword [esp + 0x1c], edx
movzx ax, bl
movsx cx, cl
push 0x585ef524
movsx ax, cl
mov eax, dword [ebp - 0x94]
pushfd
mov dword [esp + 0x20], eax
lea ecx, [eax - 0x7a0d0542]
push 0x474bfa56
call fcn.00c35fc1
btc ax, 0xe
mov dword [ebp - 0x28], edx
xchg ecx, edx
push 0xe6a1718b
lahf
mov eax, dword [ebp - 0xa0]
pushal
pushal
bswap cx
imul eax, eax, 0x18
not cl
call fcn.00c38b28
jmp 0xc3f4fa
lea esp, [esp + 8]
jne 0xc3eab4
clc
cmc
or bl, 0xf0
mov bl, byte [eax + 8]
stc
cmp esp, ecx
cmp bl, 0x6c
pushfd
jmp fcn.00c3c24e

Function at 0xc3a1ea
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.00c3c482
pushfd
mov dword [esp + 0x10], ecx
jmp 0xc39470

Function at 0xc3a279
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xc3eab4
neg bl
bt bp, sp
mov bl, byte [eax + 6]
call fcn.00c32cbe

Function at 0xc3a518
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x4e
push 0x5589f9b1
lea esp, [esp + 8]
jne 0xc3eab4
sar bl, 6
add bl, ah
neg bl
push 0x39ca7610
mov bl, byte [eax + 1]
mov byte [esp], bl
cmc
cmp dl, 0x76
cmp bl, 0x74
mov word [esp], di
push dword [esp]
pushfd
lea esp, [esp + 0xc]
je 0xc32d3d
jmp 0xc38b49
jmp 0xc33d77

Function at 0xc3a69c
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ecx, cl
mov ecx, dword [ebp - 0xb4]
mov word [esp], si
mov byte [esp], ch
pushfd
push dword [esp + 4]
mov dword [esp + 8], ecx
call fcn.00c39027
Function at 0xc3a79d
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
call fcn.00c34741
test bl, bl
pushfd
lea esp, [esp + 0x10]
je 0xc34bae
clc
jno 0xc3a1b7
cmp dx, 0x908f
add ecx, 0x14
push 0xaa4b4c07
push eax
lea esp, [esp + 8]
jmp 0xc3f06f

Function at 0xc3a803
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push dword [esp]
lea esp, [esp + 0x10]
je 0xc3605c
btr ax, bp
aaa
bts eax, ecx
neg al
mov eax, dword [ebp - 0x44]
test sp, sp
cmp dl, 0xe5
test ah, dl
xor ecx, ecx
cmc
jmp 0xc37aed
jne 0xc329e2
bts edx, 0x18
push 0xc18b2c3a
mov edx, dword [ebp - 0x44]
jmp 0xc37340
pushfd
call fcn.00c37230
mov cl, byte [eax + 1]
cmp ax, bx
cmp ecx, 0x53
jmp 0xc36056
cmc
cmp edx, 0x73
mov word [esp + 4], 0xae61
jmp 0xc34269

Function at 0xc3a839
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x44]
test ch, bh
cmp bl, dh
pushal
pushfd
sub eax, eax
rol al, cl
neg al
ror al, 2
mov al, byte [edx + 3]
mov byte [esp + 4], dh
push eax
cmp esp, ecx
push dword [esp]
cmp eax, 0x52
call fcn.00c360ff
jmp 0xc32e4c
lea esp, [esp + 0xc]
je 0xc3f86b
bsr dx, ax
jmp 0xc3a34c

Function at 0xc3a8b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0xc]
je 0xc39275
cmp bl, 0x34
pushal
pushal
cmp bl, 0x4c
push 0x58acf979
push 0xd5170cbc
lea esp, [esp + 0x48]
jne 0xc3eab4
add bl, 0xe9
cmc
add bl, bh
pushal
mov bl, byte [eax + 9]
push edi
call fcn.00c3eb75

Function at 0xc3a95d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
jne 0xc329e2
mov ax, 0xf373
rcr ax, 1
aam 0x63
mov eax, dword [ebp - 0x44]
cmp dh, 0xc5
pushal
sub ecx, ecx
and cl, ah
mov cl, byte [eax + 6]
sub esp, 0xffffffe0
jo 0xc325e4
pushal
cmp ecx, 0x2e
pushal
pushfd
pushfd
pushfd
lea esp, [esp + 0x4c]
je 0xc34fbf
bts edx, esp
lea edx, [esi + 0x2984e26f]
mov edx, dword [ebp - 0x44]
pushal
stc
cmp ch, 0x38
mov byte [esp + 4], 0xd5
sub eax, eax
setg al
mov al, byte [edx + 6]
cmc
stc
call fcn.00c3a583
Function at 0xc3ab1f
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jmp 0xc3e793
cmp eax, 0x2e
mov dword [esp], ebx
mov byte [esp], bh
jmp 0xc3462e
sub edx, edx
adc dl, bl
sbb dl, 0xe8
clc
cmp dl, 0x81
mov dl, byte [ecx + 7]
test ah, al
cmp edx, 0x64
pushfd
pushal
lea esp, [esp + 0x24]
je 0xc33b06
sar ah, cl
mov ax, 0x2fdd
bsf ax, ax
not eax
mov eax, dword [ebp - 0x44]
push 0x2dc4df32
cmp bh, 0x4a
clc
mov word [esp], 0x4f94
xor ecx, ecx
shr cl, cl
mov cl, byte [eax + 7]
clc
cmc
cmp ecx, 0x44
pushfd
pushfd
pushfd
jmp 0xc3e9d4
jmp 0xc3609f
pushal
lea esp, [esp + 0x44]
jne 0xc3555d
push 0x67072a05
shld cx, bp, 1
mov eax, dword [ebp - 0x104]
neg cx
mov ecx, dword [eax + 0x30]
pushfd
mov word [esp], 0xc2e5
bt bx, bp
sub edx, edx
sub dh, ch
sar dl, 1
mov dx, word [ecx + 0xc]
stc
cmp edx, 0x33
push esp
call fcn.00c350de
lea esp, [esp + 0x2c]
jne 0xc329e2
clc
and cx, 0x2636
mov ecx, dword [ebp - 0x44]
test cl, ch
clc
cmc
jmp 0xc37170
lea esp, [esp + 0x10]
jne 0xc329e2
shrd dx, dx, 6
sbb dl, dl
btr dx, dx
sal dl, cl
mov edx, dword [ebp - 0x44]
bt ebx, ecx
pushal
pushal
xor eax, eax
rcr al, 1
shl al, 2
sbb al, 0x14
call fcn.00c3f188
jmp 0xc3fc76
lea esp, [esp + 4]
je 0xc3cefe
pushal
xchg cl, ah
mov eax, dword [ebp - 0x104]
clc
shr ch, 3
mov ecx, dword [eax + 0x30]
bt ebp, ebx
sub edx, edx
stc
mov dx, word [ecx + 0xa]
cmp bh, 0xf8
cmp edx, 0x4c
pushfd
jmp 0xc3afe3

Function at 0xc3abe8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
rcr al, cl
ror al, cl
shr al, 2
mov al, byte [edx + 6]
call fcn.00c3fad9

Function at 0xc3ad38
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
je 0xc355f2
push eax
cmp al, 0xf9
cmp bl, 0x4c
mov dword [esp], eax
pushal
mov word [esp + 8], 0xb4ec
lea esp, [esp + 0x24]
jne 0xc3eab4
rcl bl, cl
sbb bl, bl
adc bl, 0x74
adc bl, cl
mov bl, byte [eax + 4]
clc
test ah, 0xd2
stc
clc
cmp bl, 0x6c
pushfd
mov byte [esp], ah
call fcn.00c3fbe6

Function at 0xc3ae83
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x2c
mov dword [esp], ebp
lea esp, [esp + 4]
je 0xc3f47f
xadd al, cl
sal cl, 5
mov eax, dword [ebp - 0x124]
shld ecx, edi, cl
btr cx, 0xb
btc cx, cx
pushal
mov ecx, dword [ebp - 0x9c]
jmp 0xc3b55d
lea esp, [esp + 0x28]
jae 0xc368da
bswap ecx
and al, 0xa3
mov eax, dword [ebp - 0x124]
dec cx
mov ecx, dword [ebp - 0x9c]
push esi
xor edx, edx
sbb dh, 0xb1
mov dx, word [ecx + eax*2]
bt esi, ebx
cmp ebx, 0x43318e9d
clc
jmp 0xc32af9
pushal
sub edx, edx
btr dx, ax
bt cx, 0xf
mov dx, word [ecx + eax*2]
bt cx, 7
clc
cmp al, dh
pushfd
cmp edx, 0x20
call fcn.00c3f475
push 0x7f88b7c7
cwde
pushal
mov eax, dword [ebp - 0x124]
lea ecx, [ebx - 0x328e3e49]
mov ecx, dword [ebp - 0x9c]
call fcn.00c3d234

Function at 0xc3af79
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb6bdac83
push dword [ebp - 0xc]
pop dword [esp + 0x30]
jmp 0xc36198
Function at 0xc3b063
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xc34fbf
bswap edx
sar dx, cl
mov edx, dword [ebp - 0x44]
stc
clc
call fcn.00c3abe8
pushal
mov dword [ecx], eax
mov byte [esp + 4], 0xf5
lea esp, [esp + 0x2c]
jmp 0xc37350
lea esp, [esp + 0x30]
jne 0xc329e2
btc ax, bx
bsr ax, dx
dec ah
mov eax, dword [ebp - 0x44]
cmc
stc
cmc
xor ecx, ecx
shr cl, 1
sub cl, dl
cmc
rcr cl, cl
mov cl, byte [eax + 6]
bt sp, bx
bt cx, bp
push esp
mov byte [esp], 0x1b
cmp ecx, 0x2e
push 0x45115ef9
jmp 0xc340db

Function at 0xc3b1b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
neg dh
inc dh
push 0
jmp 0xc35223
call fcn.00c34b1a
push 0x55fef854
pushfd
mov dword [eax + edx*4], ecx
push ebp
push edx
lea esp, [esp + 0x20]
jmp 0xc3252b
pushfd
call fcn.00c3e33d
bt eax, ecx
cmp bp, cx
test eax, eax
pushfd
lea esp, [esp + 4]
je 0xc368da
clc
rol dl, cl
movsx cx, bl
mov dword [ebp - 0x90], eax
movzx edx, dl
sal ax, cl
xchg dh, ch
sal cx, cl
lea eax, [ebp - 0xc]
not dl
or cl, bh
bts cx, 9
sbb cl, 0xbc
push eax
push 0x8293abe6
stc
xadd dl, cl
mov ecx, dword [ebp - 0x90]
bt di, bp
bsf dx, bx
rol dx, cl
jmp 0xc3c5ed
jmp 0xc3ca90
mov dword [esp], ecx
shr dx, 4
bts dx, 6
jmp 0xc33ccd
lea esp, [esp + 0x14]
jne 0xc3555d
stc
rol ah, cl
bsf cx, dx
mov eax, dword [ebp - 0x104]
stc
rcl ecx, 0x1c
mov ecx, dword [eax + 0x30]
stc
sub edx, edx
not dx
btc dx, 0xc
clc
mov dx, word [ecx + 0x12]
jmp 0xc3d182
pushfd
clc
cmp edx, 0x64
lea esp, [esp + 4]
jo 0xc37d3d
push ebp
mov byte [esp], 0xb0
push dword [esp]
lea esp, [esp + 8]
je 0xc3e8d7
xadd ch, al
pushal
mov eax, dword [ebp - 0x104]
inc ch
shl cx, cl
test dl, 0x63
shr cl, cl
mov ecx, dword [eax + 0x30]
cmp edi, 0x83f93022
cmc
cmc
xor edx, edx
xor dh, 0x6e
sar dh, cl
mov dx, word [ecx + 0x12]
bt si, 0xe
stc
cmp edx, 0x44
pushal
jmp 0xc34246

Function at 0xc3b461
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0xc3eab4
not bl
pushfd
mov bl, byte [eax + 4]
test esi, edi
pushfd
bt si, ax
test cl, 0xb4
cmp bl, 0x6c
push dword [esp + 4]
pushfd
lea esp, [esp + 0x10]
je fcn.00c36a1d
cmp bp, 0xe2ce
cmp bl, 0x4c
push ecx
jmp 0xc373ba
call fcn.00c38ae5
pushfd
jmp 0xc33950

Function at 0xc3b5b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x1c]
das
not eax
mov eax, dword [edx]
stc
push 0xbf7efdf9
cmc
add eax, ecx
bswap cx
mov ecx, dword [ebp - 0x1c]
pushfd
pushfd
jmp 0xc3e93a
mov dword [ecx], eax
mov byte [esp + 8], 0xeb
lea esp, [esp + 0x10]
jmp 0xc37350

Function at 0xc3b5d4
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmp eax, 0x2e
pushal
pushfd
lea esp, [esp + 0x34]
jne 0xc329e2
cmc
movsx cx, cl
mov ecx, dword [ebp - 0x44]
pushal
pushfd
mov byte [esp + 4], 0xb6
sub edx, edx
sub dl, ch
cmp bp, bp
mov dl, byte [ecx + 7]
pushfd
stc
stc
cmp edx, 0x64
call fcn.00c39708
push 0x2e56f6ed
mov byte [esp], 0x3b
lea esp, [esp + 0x24]
je 0xc338b1
cmp dh, 0x19
test cx, 0xb51
bt bx, 9
stc
cmp bl, 0x44
call fcn.00c3fedc
Function at 0xc3b816
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x2c]
je 0xc39275
bt esi, esp
cmp bl, 0x4c
call fcn.00c3926a

Function at 0xc3b874
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
sar dl, cl
mov dl, byte [ecx + 8]
mov byte [esp], bh
pushal
clc
cmp edx, 0x4c
pushfd
lea esp, [esp + 0x28]
jne 0xc329e2
lahf
mov al, al
mov eax, dword [ebp - 0x44]
cmc
push edi
xor ecx, ecx
stc
mov cl, 0xa0
sar cl, cl
mov cl, byte [eax + 9]
pushal
cmp ecx, 0x6c
pushal
pushfd
mov byte [esp], 9
push 0x3146ac0c
lea esp, [esp + 0x4c]
je 0xc345e3
and dl, 0x62
bt si, di
movzx dx, dl
mov edx, dword [ebp - 0x44]
test ch, 0x44
sub eax, eax
shr al, 2
mov al, byte [edx + 9]
clc
call fcn.00c3fd1b

Function at 0xc3b9b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
sub ecx, ecx
rcl cl, cl
sar cl, cl
shl cl, cl
mov cl, byte [eax + 7]
cmp ax, si
pushal
bt edi, edi
cmp ecx, 0x44
pushal
lea esp, [esp + 0x40]
jne 0xc329e2
shr dl, 1
bswap edx
sub edx, 0x9c91d3a0
mov edx, dword [ebp - 0x44]
pushfd
cmp bh, 0x50
bt dx, si
mov word [esp], cx
sub eax, eax
adc al, 0x75
neg al
rcl al, cl
neg al
mov al, byte [edx + 8]
stc
cmp edx, 0xb4df1647
stc
cmp eax, 0x6c
pushal
jmp 0xc3c2b2
pushfd
lea esp, [esp + 0xc]
je 0xc33b06
pushfd
bts ax, 2
neg ah
mov eax, dword [ebp - 0x44]
sub esp, 0xfffffffc
jbe 0xc34293
cmp dl, dl
sub ecx, ecx
and cl, ch
rol cl, cl
adc cl, bl
mov cl, byte [eax + 7]
stc
jmp 0xc37636
push eax
jmp 0xc38944
mov dl, byte [ecx + 7]
cmc
cmp edx, 0x64
jmp 0xc3ad97
pushal
mov byte [esp], 0x4b
lea esp, [esp + 0x44]
je 0xc393ee
bswap ecx
push ebp
pop ecx
mov ecx, dword [ebp - 0x44]
stc
call fcn.00c3c5d1

Function at 0xc3bdc0
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x40]
je 0xc34d97
clc
bt esp, esp
mov ecx, dword [ebp - 0x44]
clc
stc
cmc
stc
sub edx, edx
shr dl, cl
call fcn.00c34d76
jmp 0xc33bf6

Function at 0xc3bdc5
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pop ecx
mov ecx, dword [eax + 0x18]
movzx eax, al
not dl
lea edx, [0x8af549a6]
pop edx
mov dword [ebp - 0xf8], ecx
lahf
mov edx, dword [ebp - 0x100]
movzx ax, al
mov eax, dword [edx + 0x20]
push 0x3f6ab62b
mov dword [ebp - 0xf0], eax
pushal
push dword [esp + 4]
lea esp, [esp + 0x28]
jmp 0xc3a5c7

Function at 0xc3bea7
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jmp 0xc34324
pushal
mov byte [esp], ch
pushfd
lea esp, [esp + 0x28]
je 0xc3bef8
lea ecx, [edi - 0x2d584817]
setae al
test bl, 0x59
shld cx, bx, cl
mov eax, dword [ebp - 0x100]
dec ecx
shl ch, 5
mov ecx, dword [eax + 0x30]
cmc
xor edx, edx
and dh, bh
ror dx, cl
mov dx, word [ecx + 2]
stc
bt bp, di
test cx, 0xa585
cmp edx, 0x54
ja 0xc3a9f1
jne 0xc324b4
Function at 0xc3bf20
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
je 0xc3cbca
bts ax, 4
aam 0x5f
mov eax, dword [ebp - 0x100]
shr cx, 0xe
movsx cx, al
seto cl
mov ecx, dword [eax + 0x30]
call fcn.00c32dd0
pushal
mov byte [esp + 0xc], 0x67
cmp edx, 0x6c
push ebx
push edx
mov word [esp], 0x7cae
jmp 0xc37a94

Function at 0xc3bf36
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx eax, cl
cwde
movzx ax, al
lea eax, [ecx*4 - 0x324802b]
mov eax, dword [edx]
call fcn.00c37273
pushal
call fcn.00c356de
push edi
lea esp, [esp + 0x30]
jb 0xc4017c
sub cx, bp
mov ecx, dword [ebp - 0xf8]
cmp ecx, 0xa5541ddd
clc
pushal
add ecx, dword [ebp - 0xf0]
jmp 0xc3e8a8
stc
push edx
cmc
cmp dword [ebp - 0x108], ecx
pushfd
call fcn.00c3c2d7
setb ah
mov edx, dword [ebp - 0x108]
pushal
lea esp, [esp + 0x20]
jle 0xc375ba
pushfd
sete ah
mov eax, dword [edx]
pushal
mov dword [ebp - 0x108], eax
push 0xd5eae1a3
push dword [esp + 8]
mov byte [esp], dl
lea esp, [esp + 0x2c]
jmp 0xc35b8f

Function at 0xc3bfd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push esp
mov dword [esp + 0x44], ecx
push 0xdd79e882
jmp 0xc38709

Function at 0xc3bff5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, 0x14
push 0x849ad4f3
pushal
push dword [esp + 4]
lea esp, [esp + 0x28]
jmp 0xc3f06f
jmp 0xc3eea3
cwde
sub esi, esi
not ax
cmc
movsx di, dl
mov edi, ecx
bswap ebx
mov ecx, dword [ecx]
btr bx, 0xd
lea ebx, [ebx*8 + 0x7f0668b3]
sub bx, 0xc65c
stc
mov eax, ecx
xor bl, 0x1e
add eax, edx
btr bx, si
stc
bsr bx, di
sbb bx, 0xf794
mov eax, dword [eax]
bt sp, bp
mov ebx, eax
pushfd
test ebx, ebx
call fcn.00c3ff6c
push 0x29ba28b8
mov dword [esp], 0xc3d5c3
jmp 0xc37f9e
lea esp, [esp + 0x20]
je 0xc3cecb
push edi
call fcn.00c32598
push 0x33451dda
jmp 0xc3ef0a
mov byte [esp], ah
push esi
lea esp, [esp + 0x24]
je 0xc347cf
dec cl
shr cx, cl
rol ah, cl
mov eax, dword [ebp - 0x100]
shrd cx, ax, cl
mov ecx, dword [eax + 0x30]
test al, cl
call fcn.00c358e4
mov byte [esp + 8], al
cmp edx, 0x32
call fcn.00c3749e
aad 0xa7
lahf
mov eax, dword [ebp - 0x100]
test eax, 0x772a2912
mov ecx, dword [eax + 0x30]
test ax, 0xbd4f
sub edx, edx
test dl, 0xe8
shl dx, 0xe
pushal
mov dx, word [ecx + 4]
jmp 0xc3f23d
push 0xb18b5a01
mov byte [esp], 0x22
mov byte [esp + 8], dl
lea esp, [esp + 0x2c]
je 0xc3bef8
cmc
rol ah, 6
das
movsx cx, dl
mov eax, dword [ebp - 0x100]
adc cx, 0x4789
mov ecx, dword [eax + 0x30]
jmp 0xc3ea8e
neg edx
xor dx, 0x263f
pushal
sub dh, ah
mov edx, dword [ebp - 0xac]
cmp bh, 0xc3
push ebp
call fcn.00c37ddc
call fcn.00c3c643
mov bl, byte [eax + 9]
mov byte [esp], 0x7c
bt si, si
test cx, ax
test bl, bl
mov byte [esp], 0x15
pushfd
pushfd
pushfd
lea esp, [esp + 0x10]
je 0xc34bae
cmp si, cx
cmp al, 0xb
jmp 0xc3f533
or ax, 0xee80
not ah
mov eax, dword [ebp - 0x100]
ror ch, 2
mov ecx, dword [eax + 0x30]
cmc
cmp al, 0xfe
bt sp, bp
call fcn.00c36b01
jmp 0xc3631c
call fcn.00c3b2e5
mov ah, bl
mov eax, eax
ror ah, cl
not ah
mov eax, dword [ecx + 0xc]
cmp si, cx
cmp al, 0x8d
test eax, eax
pushal
jmp 0xc36bf2
cmp edx, 0x64
jmp 0xc395d3
jmp 0xc32cde
Function at 0xc3c028
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
sub eax, 5
call fcn.00c332fc

Function at 0xc3c04e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc33406
sub edx, edx
cmp ah, 0x7c
stc
push 0x6958b0a9
mov dx, word [ecx + 0x12]
pushal
cmp ebp, 0xeb612133
cmc
cmp edx, 0x64
pushfd
jmp 0xc3a9ec

Function at 0xc3c073
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dh, 0x66
pushal
cmp bp, ax
test edx, edx
push dword [esp]
pushal
pushfd
jmp 0xc3ea06
push edi
movsx ax, cl
mov eax, dword [ebp - 0x100]
shld ecx, edi, 0x1d
shrd cx, ax, cl
mov ecx, dword [eax + 0x30]
push dword [esp]
call fcn.00c3b57e
bt ax, 1
cmp dword [ebp - 0xfc], edx
push esi
pushal
mov word [esp], di
lea esp, [esp + 0x24]
je 0xc3a5c7
movsx ax, bl
neg dl
mov eax, dword [ebp - 0xfc]
bsr dx, sp
xadd ch, dh
bt si, si
and ch, dl
mov dword [ebp - 0x100], eax
xadd dx, cx
mov ecx, dword [ebp - 0x100]
sal dl, cl
xor dl, ch
mov edx, dword [ecx + 0x34]
pushfd
mov byte [esp], 0xb1
pushfd
and edx, 4
pushfd
cmp dl, 0x46
add esp, 0xc
jno 0xc3314e
pushfd
test edx, edx
mov dword [esp], edi
push eax
lea esp, [esp + 8]
je 0xc37f8b
call fcn.00c356b2
mov byte [esp + 4], 0x59
push 0x289b190d
mov byte [esp + 0xc], bl
mov dword [esp + 0x30], 0
call fcn.00c3f8e4
sub edx, edx
bsf dx, sp
pushfd
inc dh
shld dx, cx, 9
mov dx, word [ecx]
mov dword [esp + 4], edi
test dl, 0x71
cmp bh, cl
mov dword [esp + 4], 0xedc98f04
cmp edx, 0x6e
mov byte [esp + 4], bl
lea esp, [esp + 8]
je 0xc3fe0c
lea ecx, [eax*2 - 0x2bb99836]
mov eax, dword [ebp - 0x100]
dec ch
mov ecx, dword [eax + 0x30]
call fcn.00c35e0e
pushal
pushal
pushfd
call fcn.00c3cc3e
aam 0x69
movzx dx, al
clc
mov eax, dword [ebp - 0xf4]
xor dl, 0x97
mov ecx, dword [eax + 0xc]
bsr dx, si
movzx edx, al
cmc
rcr dx, cl
mov dword [ebp - 0xfc], ecx
pushfd
call fcn.00c3587e
lea esp, [esp + 8]
je 0xc393ee
bsr ecx, edx
inc ecx
bts cx, 0xc
test ah, 0x77
mov ecx, dword [ebp - 0x44]
push edi
sub edx, edx
mov byte [esp], cl
call fcn.00c34544
cmp ecx, 0x44
pushal
pushfd
push edi
lea esp, [esp + 0x30]
jne 0xc329e2
sub edx, 0xd4726354
bswap dx
mov edx, dword [ebp - 0x44]
call fcn.00c382b0
sub dh, dl
mov dword [ebp - 0xfc], ecx
xor dl, ah
rol dh, 1
test bh, 0xdf
ror dx, 2
mov edx, dword [ebp - 0xf4]
bt ebp, edx
mov dword [esp], 0xce937353
push edx
add edx, 0xc
pushfd
pushfd
push dword [esp + 8]
pushal
lea esp, [esp + 0x34]
jmp 0xc36121
lea esp, [esp + 0x48]
je 0xc324b4
xadd ch, al
mov eax, dword [ebp - 0x100]
rcl cx, 8
rcl cx, 0xa
mov ecx, dword [eax + 0x30]
push 0xa9393e00
test ch, bl
mov byte [esp], 0x8b
jmp 0xc36ca0
cmc
call fcn.00c376f9
bsr eax, esp
not cl
mov eax, dword [ebp - 0x100]
movzx cx, al
setl ch
movsx cx, cl
mov ecx, dword [eax + 0x30]
bt edi, 2
xor edx, edx
sar dx, 0xc
bsf dx, bx
btc dx, ax
mov dx, word [ecx + 2]
clc
bt ebp, 0x13
bt bp, di
cmp edx, 0x74
call fcn.00c3bea7
je 0xc347de
cwde
add cx, si
mov eax, dword [ebp - 0x100]
inc cl
sar ch, 1
mov ecx, dword [eax + 0x30]
push edx
cmp dx, 0x785e
pushfd
xor edx, edx
sal dh, 7
push dword [esp + 4]
mov dx, word [ecx + 0xe]
jmp 0xc3fdd8