joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc3723a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dx, 0x7eda
cmp edx, 0x32
jmp 0xc3b977
add edx, dword [ebp - 0x74]
bt bx, ax
mov dword [ebp - 0x80], edx
stc
jmp 0xc3c83a
cmc
test di, 0x15f8
sub edx, edx
call fcn.00c35b94
lea esp, [esp + 0x20]
jne 0xc329e2
mov ah, cl
inc al
stc
cwde
mov eax, dword [ebp - 0x44]
clc
xor ecx, ecx
add cl, 0x78
neg cl
mov cl, bh
sub cl, ch
mov cl, byte [eax + 6]
test bl, 0x36
cmp ecx, 0x2e
pushal
lea esp, [esp + 0x20]
je 0xc34fbf
call fcn.00c36bc8
cmp dword [ebp - 0x48], 0
push 0xbe5a78d8
call fcn.00c348df
xor ecx, ecx
sbb cl, bh
test ah, dl
rol cl, cl
neg cl
mov cl, byte [eax + 6]
cmp dx, 0x4f5b
pushal
cmp ecx, 0x2e
pushfd
lea esp, [esp + 0x24]
je 0xc34fbf
jae 0xc3df46
neg dx
dec dh
mov edx, dword [ebp - 0x44]
cmp dl, bl
pushfd
jmp 0xc3e23f
sub dh, al
or dl, 0x61
cmc
pushfd
mov edx, dword [ebp - 0x44]
bt bp, dx
sub eax, eax
sub al, 0xc
adc al, dh
cmp ah, ch
mov al, byte [edx + 6]
call fcn.00c3c42e
lea esp, [esp + 4]
je 0xc3c327
sar cl, 1
mov ecx, eax
mov ecx, dword [ebp - 0x44]
bt sp, 0xd
cmp ax, 0xa0a8
xor edx, edx
pushal
setnp dl
rcr dl, 5
mov dl, byte [ecx + 5]
bt ax, di
cmp al, dl
jmp 0xc341cb
xor eax, eax
dec al
adc al, bh
cmp bl, 0xe7
mov al, byte [edx + 6]
clc
cmp eax, 0x2e
mov byte [esp], 0x2a
pushal
mov word [esp + 8], 0xed9c
pushfd
lea esp, [esp + 0x28]
jne 0xc329e2
pushfd
rcl ch, 7
mov ecx, dword [ebp - 0x44]
jmp 0xc3a011

Function at 0xc372c3
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
bt cx, 0xd
clc
test edx, edx
pushal
mov word [esp], si
lea esp, [esp + 0x20]
jne 0xc339f1
pushal
mov word [esp], cx
push dword [esp + 8]
push 0xaa04863e
lea esp, [esp + 0x28]
jmp 0xc37350
sal al, cl
pop eax
sbb al, bl
mov edx, dword [ebp - 0xbc]
and ax, bx
movzx ax, cl
aad 0xcb
aad 0x5c
add edx, dword [ecx]
xor cx, bx
shr cx, cl
mov eax, dword [ebp - 0xa0]
or ecx, 0x44f86439
not cl
mov ecx, dword [ebp - 0xd8]
stc
pushal
bt si, 7
xor esi, esi
shr si, 0xe
mov si, word [ecx + eax*2]
cmc
and esi, 0xfff
pushal
stc
cmp al, 0xd8
pushfd
add edx, esi
cmp bl, ch
clc
cmp ah, ch
mov dword [ebp - 0x1c], edx
inc dl
bsf dx, cx
neg dh
mov edx, dword [ebp - 0x5c]
stc
and edx, 0xffff
sub esp, 0xffffffbc
jbe 0xc33db9
push eax
test edx, edx
pushal
jmp 0xc3de38
pushal
push 0x1addd35c
lea esp, [esp + 0x48]
jne 0xc339f1
pushfd
push ebx
pushal
lea esp, [esp + 0x28]
jmp 0xc37350

Function at 0xc37383
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0xc3f86b
clc
mov dl, 0x9a
mov edx, dword [ebp - 0x44]
clc
stc
xor eax, eax
cmp ah, dh
mov al, byte [edx + 3]
cmp al, 0x14
cmp eax, 0x52
call fcn.00c3c267
Function at 0xc3741f
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jne 0xc329e2
bt edx, 0xa
mov eax, dword [ebp - 0x44]
push eax
test esp, edi
clc
xor ecx, ecx
sub cl, bh
mov cl, byte [eax + 6]
clc
mov byte [esp], 0xcf
cmp ecx, 0x2e
push 0xc1291e68
lea esp, [esp + 8]
je 0xc34fbf
shr dx, 4
adc dx, 0x1e76
mov edx, dword [ebp - 0x44]
call fcn.00c3e455
lea esp, [esp + 0x10]
jne 0xc3555d
bsr ecx, eax
mov eax, dword [ebp - 0x104]
bswap cx
pushfd
sal cl, cl
mov ecx, dword [eax + 0x30]
test bh, cl
test dh, dl
xor edx, edx
cmc
btc dx, 3
btr dx, sp
bt sp, bp
mov dx, word [ecx + 0x10]
stc
pushfd
clc
mov word [esp], 0x8cc5
cmp edx, 0x2e
push 0x6889657d
call fcn.00c37994
bts dx, 1
mov dword [ebp - 0x108], ecx
neg dh
bsr dx, bx
mov edx, dword [ebp - 0x104]
clc
add edx, 0x3c
jl 0xc3b023
cmp dword [ebp - 0x108], edx
pushfd
push esp
lea esp, [esp + 8]
je 0xc3aec6
mov ah, cl
cmp dh, ch
mov eax, dword [ebp - 0x108]
call fcn.00c3cc02
bt bp, 3
test ah, 0xd
xor edx, edx
rcr dh, cl
mov dx, word [ecx + 6]
stc
cmp edx, 0x4c
pushal
pushfd
mov word [esp], sp
lea esp, [esp + 0x28]
jne 0xc324b4
xchg al, ch
xor cl, bl
shl ah, 3
mov eax, dword [ebp - 0x100]
setle ch
shld cx, bx, cl
bswap ecx
btr cx, 9
mov ecx, dword [eax + 0x30]
call fcn.00c35150
test cl, bl
mov dword [ebp - 0x110], eax
pushfd
mov byte [esp], 0x68
bt ax, 0xe
cmp dword [ebp - 0x114], 0
call fcn.00c360c6
xor edx, edx
cmc
sbb dl, bl
shl dl, cl
mov dl, byte [ecx + 5]
clc
clc
cmp edx, 0x32
push 0xb6e6858e
jmp 0xc3a9f6
shrd ax, sp, cl
mov eax, dword [ebp - 0x108]
stc
cmp eax, dword [ebp - 0xf8]
push esp
call fcn.00c3e628
jmp 0xc34e05
aam 0x8a
shrd cx, bp, 0xa
sub al, 0x73
mov ecx, dword [ebp - 0x108]
aam 0x5c
rcr dl, 6
das
sub ecx, 0x50
call fcn.00c3706f
lea esp, [esp + 0x24]
jne 0xc329e2
adc cl, 0xab
mov ecx, dword [ebp - 0x44]
jmp 0xc3c6e9
stc
test ch, 0xdc
bt bp, 5
cmp dword [ebp - 0x108], edx
push 0xd85bae85
lea esp, [esp + 4]
je 0xc3aec6
jmp 0xc3907d
bt bx, bx
clc
cmp ax, di
xor edx, edx
sub dl, 0x60
add dl, cl
bt dx, si
pushfd
mov dl, byte [ecx + 7]
test ch, 0xc0
bt edx, edi
stc
cmp edx, 0x64
push 0x3e3702c8
pushfd
lea esp, [esp + 0xc]
je 0xc33b06
adc ah, 0xe1
mov eax, dword [ebp - 0x44]
pushfd
call fcn.00c37ce0
jmp 0xc36fe2

Function at 0xc374f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0xc3eab4
rol bl, 1
ror bl, cl
not bl
cmc
mov bl, byte [eax + 1]
bt bp, dx
jmp 0xc358df

Function at 0xc375d0
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0xc3efa2
clc
cmp dh, al
cmc
xor ecx, ecx
stc
mov cl, byte [eax + 0xa]
call fcn.00c356aa
lea esp, [esp + 4]
jne 0xc3eab4
dec bl
rcr bl, 1
sub bl, 0x31
call fcn.00c3a200
lea esp, [esp + 0x28]
je 0xc3eb24
btr ax, ax
inc al
mov eax, dword [ebp - 0x44]
jmp 0xc385a3

Function at 0xc375d6
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
stc
stc
cmp edx, 0x4c
call fcn.00c3c9ad
Function at 0xc375e0
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
xor edx, edx
ror dl, cl
pushfd
cmp dh, dh
mov dl, byte [ecx + 5]
clc
jmp 0xc40073
push esi
lea esp, [esp + 0x14]
jne 0xc329e2
stc
pushfd
cmp edx, 0x32
jmp 0xc3c31c

Function at 0xc37602
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
test eax, eax
push ebp
pushal
jmp 0xc377d1
lea esp, [esp + 0x2c]
je 0xc368da
pushal
mov byte [esp], 0xda
mov byte [esp], 0xc5
lea esp, [esp + 0x20]
jmp 0xc3d9d0

Function at 0xc37615
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x44
pushal
lea esp, [esp + 0x28]
jne 0xc3eab4
bt dx, 6
shr bl, cl
mov bl, byte [eax + 3]
pushal
cmp bl, 0x6c
call fcn.00c3b7df
cmp ecx, 0x44
jmp 0xc39874
push 0xa84c0311
mov dword [esp], edx
lea esp, [esp + 4]
jne 0xc329e2
push 0x94c71a81
test bl, bl
bts dx, di
shr dh, 7
mov edx, dword [ebp - 0x44]
test dl, 0x56
cmc
test ah, 0x34
cmc
xor eax, eax
adc al, 0x58
mov al, byte [edx + 8]
bt edi, eax
test edx, esp
stc
cmp al, 0xc2
cmp eax, 0x6c
pushal
pushal
call fcn.00c36c18
lea esp, [esp + 4]
je 0xc35cff
test bx, 0x3d05
cmp bl, 0x4e
pushfd
mov word [esp], dx
call fcn.00c36f67
jmp 0xc3d97f

Function at 0xc3774b
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push 4
lahf
push 0x7be024a6
mov eax, dword [ebp - 0x7c]
mov word [esp], sp
push 0x45a1295d
mov dword [esp + 4], eax
mov byte [esp], ch
mov dword [esp], 0xc3babd
jmp 0xc37b77
push 0xfc5926f0
lea esp, [esp + 0x14]
jne 0xc324b4
test ah, dl
shl al, 6
pushfd
mov eax, dword [ebp - 0x100]
clc
shl ch, 3
rol ch, cl
clc
mov ecx, dword [eax + 0x30]
pushal
cmc
test si, 0xe5bc
xor edx, edx
bswap dx
bswap dx
mov dx, word [ecx + 0xc]
mov byte [esp + 4], 0xb8
cmp edx, 0x64
pushal
mov word [esp + 4], 0xbaf4
call fcn.00c33d1a
cmp edx, 0x64
mov byte [esp + 4], bh
pushfd
push edx
lea esp, [esp + 0x30]
je 0xc3e8d7
das
mov eax, dword [ebp - 0x104]
test bx, 0x2596
mov ecx, dword [eax + 0x30]
cmc
xor edx, edx
add dl, 0x40
add dh, 0x98
mov dx, word [ecx + 0x12]
clc
stc
cmp edx, 0x44
jmp 0xc3dc78
pushal
pushal
push dword [ebp - 0xc8]
pop dword [esp + 0x3c]
mov byte [esp], 0xe2
push dword [esp + 0x3c]
ret 0x40
lea esp, [esp + 0xc]
je 0xc3f810
dec ah
mov ch, al
mov eax, dword [ebp - 0x104]
dec ecx
bts cx, 8
call fcn.00c39261
push edx
jmp 0xc34105
jne 0xc3555d
btc ax, 3
add eax, ebp
bswap cx
not al
mov eax, dword [ebp - 0x104]
setg cl
stc
shr ch, cl
mov ecx, dword [eax + 0x30]
push 0x37098694
mov byte [esp], cl
xor edx, edx
push dword [esp]
mov dx, word [ecx + 0x14]
cmc
pushfd
cmp edx, 0x6c
jmp 0xc37f26

Function at 0xc377f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp dword [ebp - 0x11c], 0
mov byte [esp], al
pushfd
pushfd
lea esp, [esp + 0x14]
jne 0xc35a79
pushfd
pushal
jmp 0xc3d9c5
mov dword [ebp - 0xc], 0x2000
lea esp, [esp + 0x24]
Function at 0xc37852
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 8]
rdtsc
mov edx, dword [ebp - 0x64]
bswap ax
cwde
bswap eax
mov eax, dword [edx + ecx*4]
xchg cl, dh
push 0xecb96bb4
mov dword [ebp - 0x78], eax
bswap cx
mov byte [esp], 0xf9
mov ecx, dword [ebp - 0x78]
movsx dx, al
mov dword [esp + 0x30], ecx
movsx dx, bl
mov edx, dword [ebp - 0xb4]
call fcn.00c3bcd4

Function at 0xc3793f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
mov dword [ebp - 0x124], 0
push 0xda0049dc
push dword [esp + 4]
lea esp, [esp + 0x10]
jmp 0xc3a7e9

Function at 0xc37994
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
lea esp, [esp + 0x10]
jne 0xc3555d
shl cl, cl
mov eax, dword [ebp - 0x104]
sbb ch, 4
mov ecx, dword [eax + 0x30]
stc
jmp 0xc3d803

Function at 0xc379b6
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
sub edx, edx
bsr dx, ax
mov dx, word [ecx + 0xc]
stc
push 0xa5e3dee5
pushfd
cmp edx, 0x33
jmp 0xc38599

Function at 0xc379ff
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], cl
lea esp, [esp + 0x14]
je 0xc3e4ba
bswap ecx
btc dx, di
mov cl, al
mov eax, dword [ebp - 0xfc]
movsx cx, dl
mov dword [ebp - 0x104], eax
stc
rol cl, cl
mov ecx, dword [ebp - 0x104]
rol dx, cl
mov edx, dword [ecx + 0x34]
pushfd
cmp dh, bh
cmp al, bh
bt eax, eax
and edx, 4
push 0x7f2edbe8
test edx, edx
call fcn.00c3f954
test dl, 0xb8
pushal
bt ecx, ebx
cmp bl, 0x54
push 0x2849ef0a
pushal
call fcn.00c38ac2

Function at 0xc37a60
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts cx, ax
mov ecx, dword [ebp - 0x44]
bt si, si
pushfd
cmp bh, dl
mov word [esp], 0x4bfc
xor edx, edx
shr dl, 1
pushfd
push esp
cmp bl, 2
mov dl, byte [ecx + 5]
jmp 0xc356ee
cmc
stc
cmc
cmp edx, 0x32
jmp 0xc3ca3e
test dx, dx
sub eax, eax
ror al, 4
mov al, byte [edx + 5]
mov dword [esp + 0xc], edi
clc
cmp eax, 0x32
mov byte [esp + 4], ch
jmp 0xc3a1c2
push dword [esp + 4]
mov word [esp], ax
lea esp, [esp + 0x30]
je 0xc3c327
sbb ch, 0xec
clc
jmp 0xc3363a
push edi
call fcn.00c3d82c

Function at 0xc37ce0
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bx, 0xd6cd
xor ecx, ecx
cmp bl, bh
dec cl
cmc
call fcn.00c38103

Function at 0xc37da0
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
clc
cmp bh, ch
cmp edx, 0x64
jmp 0xc3f42a
call fcn.00c38d1b

Function at 0xc37ddc
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ch, al
add edx, 0x100022cb
call fcn.00c3930d
lea esp, [esp + 4]
jne 0xc3eab4
test sp, sp
sal bl, 1
mov bl, byte [eax + 3]
push 0x2d0f4175
pushal
jmp 0xc3d05c
cmp bl, 0x6c
pushfd
call fcn.00c390f6

Function at 0xc37f1f
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
jmp 0xc3e10e
mov edx, dword [ecx]
jmp 0xc372be
Function at 0xc37fa8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], cl
lea esp, [esp + 0xc]
jb 0xc4017c
inc ecx
rcl cl, 1
inc ch
mov ecx, dword [ebp - 0xf8]
bt si, di
pushal
test dh, bl
test dh, dh
add ecx, dword [ebp - 0xf0]
push 0x44d31dff
jmp 0xc3d038

Function at 0xc38060
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00c3e9cf
pushfd
push dword [ebp - 0xd4]
pop dword [esp + 0x40]
push 0xea668e83
push dword [esp + 0x44]
ret 0x48
pushfd
jmp 0xc3f959
lea esp, [esp + 0xc]
je 0xc3a5c7
test ebx, 0xaa6f16d2
mov eax, dword [ebp - 0xfc]
bswap edx
sub dh, 0xf
movsx dx, bl
movsx dx, al
mov dword [ebp - 0x100], eax
rcl cl, 3
mov ecx, dword [ebp - 0x100]
movsx dx, bl
inc dl
mov edx, dword [ecx + 0x34]
jmp 0xc374b5

Function at 0xc38066
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xc], ch
cmp bl, 0x64
mov word [esp + 0x14], dx
lea esp, [esp + 0x28]
je 0xc369f9
pushfd
cmp bl, 0x44
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0xc3eab4
pushfd
dec bl
sub bl, ch
bt cx, dx
mov bl, byte [eax + 7]
call fcn.00c38a94

Function at 0xc380b7
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
add edx, 0x100022f6
mov byte [esp], al
pushal
push ecx
pushfd
mov dword [esp + 0x44], edx
push dword [esp + 4]
call fcn.00c34231
push ecx
jmp 0xc3809d
lea esp, [esp + 0x10]
je 0xc33483
cmc
cmp bl, 0x4c
pushfd
mov word [esp], 0x167d
call fcn.00c3d43f
stc
bts edx, 0x1d
mov dword [ebp - 0x114], eax
xor dh, 0x93
movzx dx, cl
movsx dx, al
mov edx, dword [ebp - 0xac]
cmp dl, dl
pushal
clc
jmp 0xc334bb

Function at 0xc382ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt sp, si
xor edx, edx
rol dl, cl
dec dl
adc dl, ch
mov dl, byte [ecx + 8]
mov byte [esp], ch
cmp edx, 0x4c
push dword [esp]
jmp 0xc398d9
mov byte [esp], dl
lea esp, [esp + 0x28]
jne 0xc329e2
lahf
call fcn.00c3ee88

Function at 0xc3834a
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xc3c327
cmc
pushal
mov ecx, dword [ebp - 0x44]
push ebx
jmp 0xc3743d

Function at 0xc383b8
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
shld ax, bx, 4
clc
xadd ah, ch
mov eax, dword [ebp - 0x104]
sub cl, ch
pushfd
bts cx, 4
xor cx, 0xab6d
mov ecx, dword [eax + 0x30]
mov byte [esp], 0x61
clc
clc
xor edx, edx
add dx, 0xa34
mov dx, word [ecx + 2]
pushal
call fcn.00c342eb
lea esp, [esp + 8]
je 0xc34195
xchg cl, ah
aam 0x9e
lea ecx, [ecx + 0xa475fc0]
shrd ax, ax, 4
mov eax, dword [ebp - 0x104]
sal ch, cl
mov ecx, dword [eax + 0x30]
jmp 0xc3d0c6
xor edx, edx
shr dh, cl
bt di, 8
mov dx, word [ecx]
test esi, 0x17bae4b4
pushfd
clc
pushal
cmp edx, 0x4b
push 0x82bf2f88
call fcn.00c3d831
pushfd
push dword [ebp - 0xd4]
pop dword [esp + 0x28]
mov byte [esp], 0x5a
push dword [esp + 0x28]
ret 0x2c
Function at 0xc383e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
jne 0xc3eab4
cmc
or bl, bh
mov bl, byte [eax + 4]
cmc
pushfd
pushfd
jmp 0xc38add
pushal
jmp 0xc3682b
cmp bl, 0x6c
call fcn.00c32939

Function at 0xc383e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl dx, cl
bsf dx, bp
mov edx, dword [ebp - 0x44]
mov byte [esp], 0xf3
stc
sub eax, eax
pushal
mov al, byte [edx + 6]
clc
test bl, 0x98
cmp bh, 0xb5
mov byte [esp], 0x29
cmp eax, 0x2e
jmp 0xc3aee3

Function at 0xc384dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xc3bef8
bts cx, 6
call fcn.00c3f4aa

Function at 0xc3852a
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get number of processors

Disassembly:
ror ah, 1
mov eax, dword fs:[0x30]
movzx cx, bl
bswap dx
movsx ecx, bl
adc dh, 0xde
mov eax, dword [eax + 0xc]
sar cl, 6
bsf cx, cx
or cx, sp
mov dword [ebp - 0xf4], eax
cdq
daa
mov dword [ebp - 0xf8], 0
lea eax, [esi - 0x5f052bcd]
sbb al, cl
dec eax
mov dword [ebp - 0xf0], 0
aam 0x75
not dh
pushal
mov eax, dword [ebp - 0xf4]
rol dx, cl
stc
shl cl, cl
neg cl
mov ecx, dword [eax + 0xc]
clc
shr dx, 0xc
mov dword [ebp - 0xfc], ecx
not dl
call fcn.00c3a5ac
mov byte [esp + 8], 0xd
jmp 0xc3d07a
lea esp, [esp + 0x30]
jne 0xc3555d
aaa
rcl cx, cl
das
mov eax, dword [ebp - 0x104]
pushal
sal ecx, 0x19
movzx cx, bl
bt edx, 2
mov ecx, dword [eax + 0x30]
bt esi, eax
push 0x3c0d0985
cmp ah, dl
sub edx, edx
shld dx, di, 1
mov dx, word [ecx + 0xe]
pushfd
cmc
call fcn.00c3ed7c

Function at 0xc385c8
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
clc
clc
cmp edx, 0x6e
mov byte [esp], al
mov byte [esp], 0xb6
pushfd
mov byte [esp + 4], 0x7a
lea esp, [esp + 8]
je 0xc3fe0c
setnp al
or ch, 0x9d
mov eax, dword [ebp - 0x100]
cmp bl, 0xae
mov ecx, dword [eax + 0x30]
jmp 0xc371c1
pushal
rcl ecx, cl
mov ecx, dword [eax + 0x30]
stc
cmc
jmp 0xc391a3
cmc
mov dword [ebp - 0xbc], eax
aas
stc
add edx, 0xd971c478
mov edx, dword [ebp - 0xac]
jmp 0xc3a4c0
sub edx, edx
push 0x8386d0bf
movsx dx, bl
xor dl, bl
mov dx, word [ecx]
bt edi, eax
cmp dx, 0x7ce1
cmp edx, 0x4e
push dword [esp]
jmp 0xc3f554
ror dl, 7
mov byte [esp], 0xb9
xor dh, dh
mov dx, word [ecx]
jmp 0xc33e87
xor edx, edx
push eax
xor dx, sp
mov dx, word [ecx + 2]
cmc
cmp edx, 0x74
push esi
call fcn.00c350e4
push esp
clc
stc
test eax, eax
push esi
call fcn.00c33de7
sar esi, cl
jmp 0xc36993
sar al, 7
mov bh, ah
lahf
add edx, 0x10002253
and bh, dl
aad 0x68
btc bx, 5
ror bl, 6
add edx, 1
clc
sal al, 5
mov ebx, dword [ebp - 0xcc]
not eax
sub ax, 0x82db
lahf
add ebx, dword [ebp - 0xbc]
sal edi, 0xe
mov dword [edx], ebx
aaa
call fcn.00c36ffb
cmp sp, di
mov dx, word [ecx + 0xe]
stc
cmp edx, 0x32
call fcn.00c38d20
xor eax, eax
xor al, cl
adc al, 0xb2
jmp 0xc38fa2
lea esp, [esp + 8]
jne 0xc324b4
cwde
aaa
setbe al
sub ch, bh
mov eax, dword [ebp - 0x100]
jmp 0xc363a3
Function at 0xc388f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
test edx, edx
pushfd
pushfd
mov word [esp], 0xf6e
lea esp, [esp + 0x3c]
je 0xc324b4
bts ax, dx
add cx, 0x50c1
bt sp, 2
mov eax, dword [ebp - 0x100]
bsf cx, bx
mov ecx, dword [eax + 0x30]
bt ebp, eax
stc
clc
stc
xor edx, edx
call fcn.00c385c8

Function at 0xc389e9
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push 0xf0992fbb
mov dword [ebp - 0x90], 0
mov byte [esp], 0x84
mov dword [esp], 4
call 0xc35a8c
neg dx
rol dx, 6
mov edx, dword [ebp - 0xac]
cmc
pushal
add edx, 0x10002361
push 0x52a9873c
mov dword [esp + 0x20], edx
pushfd
jmp 0xc3a261
lea esp, [esp + 8]
je 0xc368da
push ecx
lea esp, [esp + 4]
jmp 0xc3d9d0
push dword [ebp - 0x120]
pop dword [esp + 0x20]
pushfd
mov dword [esp + 0x20], 0xc360ad
call fcn.00c37f77
pushal
push ebp
lea esp, [esp + 0x24]
jge 0xc35204
mov dword [ebp - 0x90], 0
pushfd
call fcn.00c34550

Function at 0xc38a94
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp cl, 0x29
cmp bl, 0x6c
push 0x8559daac
call fcn.00c33f8b

Function at 0xc38ac2
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
call fcn.00c3b792
lea esp, [esp + 0x48]
jne 0xc3eab4
add bl, cl
push ecx
mov bl, byte [eax + 2]
mov word [esp], 0xa55d
jmp 0xc32677

Function at 0xc38ae5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0xc3eab4
sal bl, cl
not bl
ror bl, cl
mov bl, byte [eax + 5]
pushal
pushfd
cmp bl, 0x2e
pushal
push edx
push edx
lea esp, [esp + 0x4c]
jne 0xc3eab4
call fcn.00c38b54

Function at 0xc38b28
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0xe8]
setge dl
movzx dx, cl
movsx edx, bl
mov edx, dword [ecx + eax + 0x10]
setae ah
push ecx
mov dword [esp + 0x48], edx
call fcn.00c3e342
clc
clc
cmp bl, 0x54
pushfd
jmp 0xc385b2

Function at 0xc38b54
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl bl, 3
ror bl, cl
clc
mov bl, byte [eax + 6]
push eax
cmp bl, 0x64
mov byte [esp], 0x41
mov byte [esp + 4], bh
lea esp, [esp + 8]
je 0xc369f9
cmc
cmp bh, 0x7e
cmp bl, 0x44
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0xc3eab4
mov bl, ch
shl bl, cl
shr bl, 2
or bl, 0xaf
mov bl, byte [eax + 7]
cmc
cmp bl, 0x6c
call fcn.00c3e8b7
Function at 0xc38c1c
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0xc], 0x2000
push edi
mov dword [esp], 0x164d80a
mov dword [ebp - 0x90], 0
call fcn.00c37932
push 0x6e67c6f1
push ebp
lea esp, [esp + 0x2c]
jne 0xc329e2
cmc
sbb cl, 0xb3
mov ecx, dword [ebp - 0x44]
stc
stc
cmc
sub edx, edx
sbb dl, 0x62
jmp 0xc40215
push dword [esp]
jmp 0xc3af8a
lea esp, [esp + 0x14]
jne 0xc35a79
pushal
jmp 0xc3cac3
pushfd
jmp 0xc3693e
clc
mov al, byte [edx + 8]
pushfd
jmp 0xc38259
mov dl, byte [ecx + 7]
push 0xc3abdbe6
cmp edx, 0x64
mov byte [esp], ah
push dword [esp]
pushal
lea esp, [esp + 0x28]
je 0xc33b06
bsf ax, cx
aam 0x3e
or ah, 0x18
rcl al, 3
mov eax, dword [ebp - 0x44]
push edi
stc
test ax, si
test ch, 0x23
xor ecx, ecx
adc cl, bl
adc cl, bh
mov cl, byte [eax + 7]
stc
cmp bl, 0x12
stc
stc
cmp ecx, 0x44
pushfd
lea esp, [esp + 8]
jne 0xc329e2
sub dx, 0x6be8
mov edx, dword [ebp - 0x44]
pushal
clc
sub eax, eax
cmp bx, 0xa1fc
jmp 0xc3ff82

Function at 0xc38dff
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0xc3eab4
inc bl
sbb bl, 0x45
ror bl, cl
pushfd
mov bl, byte [eax + 7]
cmc
stc
cmp ah, 0xbe
cmp bl, 0x6c
push dword [esp]
pushfd
call fcn.00c335b5

Function at 0xc38e2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xd3
lea esp, [esp + 4]
je 0xc338b1
cmp dl, 0xa7
call fcn.00c3e0f6
mov byte [esp], 0xa3
lea esp, [esp + 4]
je 0xc3ce3c
aaa
mov eax, dword [ebp - 0x44]
test dh, dl
sub ecx, ecx
sbb cl, 0x2d
or cl, bl
rcr cl, cl
rcl cl, cl
mov cl, byte [eax + 4]
test dl, ch
pushal
stc
cmp bp, dx
cmp ecx, 0x33
call fcn.00c3f5dc
push esp
lea esp, [esp + 0xc]
jne 0xc3555d

Function at 0xc38f00
Capabilities:
Execute anti-debugging instructions

Disassembly:
das
add ax, 0xeb88
mov eax, dword [ebp - 0x104]
bt sp, 0xb
bsf cx, bx
mov ecx, dword [eax + 0x30]
clc
mov byte [esp], 0x74
xor edx, edx
test ch, 0x81
adc dh, 0xa2
pushfd
clc
mov dx, word [ecx + 0x12]
pushal
cmp edx, 0x44
mov byte [esp], ch
pushfd
pushfd
lea esp, [esp + 0x30]
jne 0xc3555d
ror al, cl
dec ch
aas
mov eax, dword [ebp - 0x104]
pushal
mov ecx, dword [eax + 0x30]
call fcn.00c33a19
pushal
mov dword [esp + 0x1c], 0xc36757
call fcn.00c3ae1f

Function at 0xc38f5f
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x44
jmp 0xc3e8cd
lea esp, [esp + 0x2c]
jne 0xc3555d

Function at 0xc38fed
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0xc3e8d7
btc ax, 3
adc cl, 0x91
adc ch, 0xf2
bsr cx, ax
mov eax, dword [ebp - 0x104]
ror ecx, 0x19
shr cx, 0xf
sbb ch, ah
rol cx, 5
mov ecx, dword [eax + 0x30]
cmp edx, 0x26bb7d9a
call fcn.00c37e95

Function at 0xc390f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0xc355f2
call fcn.00c3e02c
mov ax, sp
rcl cl, cl
bswap cx
mov eax, dword [ebp - 0x100]
bswap cx
adc cl, 0x32
rcl cl, 2
mov ecx, dword [eax + 0x30]
cmc
test cx, si
xor edx, edx
jmp 0xc3a001
mov dx, word [ecx + 6]
bt bx, di
cmp edx, 0x6c
call fcn.00c3fe90