joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16443bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0x164d986
clc
mov ecx, dword [ebp - 0x44]
pushfd
bt bx, 6
cmp ebp, 0xf64dd6a3
xor edx, edx
ror dl, cl
ror dl, 4
push ebp
add dl, 8
mov dl, byte [ecx + 4]
push 0xec07d89d
mov byte [esp], 0x6b
clc
mov word [esp + 8], sp
cmp edx, 0x33
mov byte [esp], al
pushal
lea esp, [esp + 0x2c]
je 0x1646248
rol ah, cl
cwde
stc
mov eax, dword [ebp - 0x44]
cmp dl, 0x2b
jmp 0x1646b49
jmp 0x16481b2
xor ecx, ecx
cmc
neg cl
mov cl, byte [eax + 4]
call fcn.01644db7

Function at 0x1644956
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp esp, 0x3ba5bd0f
neg ecx
mov ecx, dword [eax + 0x30]
stc
pushfd
bt edx, 1
xor edx, edx
xor dh, bh
mov dx, word [ecx + 2]
bt ax, 1
stc
bt si, di
cmp edx, 0x45
mov word [esp + 4], sp
lea esp, [esp + 8]
jne 0x164ab71
dec eax
sub ax, ax
sbb ax, 0x989f
mov eax, dword [ebp - 0x104]
bt ax, ax
mov ecx, dword [eax + 0x30]
pushfd
pushal
push dword [esp + 4]
sub edx, edx
sbb dl, bh
sar dh, 6
bsf dx, dx
mov dx, word [ecx + 4]
stc
cmc
cmp edx, 0x72
push 0x459e3590
mov byte [esp + 4], 0x8d
lea esp, [esp + 0x2c]
je 0x1648620
pushal
daa
inc al
aaa
mov eax, dword [ebp - 0x104]
mov word [esp + 4], cx
stc
shld cx, sp, 0xc
mov ecx, dword [eax + 0x30]
mov byte [esp], 2
test dl, dh
pushfd
xor edx, edx
neg dl
mov dx, word [ecx + 4]
stc
call fcn.016453ec

Function at 0x1644acd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x44], eax
jmp 0x16455e6
jmp 0x164b973
pushfd
mov dword [esp + 0x44], 0x16472b2
call fcn.016420c3

Function at 0x1644afc
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp - 0x90], 0
jmp 0x164b1c3

Function at 0x1645222
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x433bbbf3
cmp dword [ebp - 0x70], 0
jmp 0x16455ba
xor edx, edx
rol dl, 1
shr dl, 4
mov dl, byte [ecx + 1]
call fcn.0164d181
pushfd
lea esp, [esp + 0x10]
je 0x1644261
movsx ax, bl
daa
test esi, esp
mov eax, dword [ebp - 0x44]
clc
push 0x34ecadcc
pushfd
xor ecx, ecx
rcr cl, cl
sbb cl, bl
cmp ah, 0xa5
mov cl, byte [eax + 0xa]
mov byte [esp + 4], 0x15
mov word [esp], bp
test ecx, ecx
push ecx
jmp 0x1646e5a
push esp
jmp 0x1648557
lea esp, [esp + 0xc]
jne 0x164d986
cmc
jmp 0x1644311

Function at 0x16453ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x52
mov byte [esp + 4], 0xdf
jmp 0x1649112

Function at 0x16455c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ax
mov eax, dword [ebp - 0x44]
push ecx
clc
xor ecx, ecx
rol cl, cl
cmc
setns cl
mov cl, byte [eax + 1]
cmp ax, 0x13ec
pushal
bt dx, 2
clc
cmp ecx, 0x53
call fcn.01642122

Function at 0x164569c
Capabilities:
Encode data using base64

Disassembly:
push 0x5623b75b
sub edx, edx
stc
bt dx, si
sbb dl, cl
mov dl, byte [ecx + 2]
mov byte [esp + 8], bh
cmp edx, 0x45
call fcn.01641935
Function at 0x1645789
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
mov byte [esp + 8], al
lea esp, [esp + 0x2c]
jne 0x164d986
sbb al, 0x2a
shr ah, 7
mov eax, dword [ebp - 0x44]
pushal
mov dword [esp], esi
xor ecx, ecx
sbb cl, ch
inc cl
mov cl, byte [eax + 3]
bt esi, 3
call fcn.0164ab9c

Function at 0x16457b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp cx, di
mov eax, dword [ebp - 0x64]
btc cx, cx
movsx cx, dl
mov ecx, dword [ebp - 0xbc]
clc
add ecx, dword [eax + edx*4]
dec ah
mov dword [ebp - 0x60], ecx
rdtsc
das
mov edx, dword [ebp - 0x60]
adc cl, 0xfe
adc cx, 0x51f3
btr ax, bx
clc
add edx, 2
pushfd
pop eax
not ch
movzx ax, bl
mov dword [ebp - 0x98], edx
lea eax, [esi + 0x305ca626]
call fcn.01645ff3
cmc
test eax, eax
pushal
jmp 0x164c149
mov byte [esp], al
pushfd
lea esp, [esp + 8]
je 0x164c7d7
test ah, dh
cmp dl, cl
bts edx, edi
xadd dx, ax
mov edx, dword [ebp - 8]
mov ch, 0xe1
jmp 0x16430bb
pushal
lea esp, [esp + 0x40]
je 0x16495c6
adc dl, al
bswap dx
mov dword [ebp - 0x90], eax
setns dh
aas
cmp cl, 0x79
lea eax, [ebp - 0xc]
stc
setns dh
shrd cx, sp, 2
shr ch, 3
push eax
adc dx, cx
dec dx
mov ecx, dword [ebp - 0x90]
call fcn.0164d821
mov byte [esp], 0x7a
push dword [ebp - 0xc8]
pop dword [esp + 0x1c]
mov byte [esp + 0xc], 0xe5
push 0xa67e0b16
push dword [esp + 0x20]
ret 0x24

Function at 0x1645de2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
je 0x1648c22
btr cx, 0xa
bsf cx, di
mov edx, dword [ebp - 8]
xchg al, cl
bt ebx, edi
das
shld ecx, edx, cl
mov eax, dword [ebp - 0x64]
shld cx, di, cl
stc
bsf ecx, esp
lea ecx, [ecx*8 + 0x761d0a05]
mov ecx, dword [eax + edx*4]
pushal
call fcn.0164ad23

Function at 0x16464b1
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmp cl, 0x1b
xor eax, eax
sbb al, ah
push ecx
cmp al, bh
test bl, ah
mov al, byte [edx + 3]
add esp, 0xc
cmc
call fcn.016450a7
mov dword [esp], edi
cmc
bt ax, 0xa
mov edx, dword [ebp - 0x44]
jmp 0x164da71
push esp
jmp 0x164148e

Function at 0x16465de
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
call fcn.016481df
lea esp, [esp + 0x18]
jne 0x164d986
or ch, bh
sal cx, 6
setae cl
mov ecx, dword [ebp - 0x44]
pushfd
clc
stc
sub edx, edx
cmc
rol dl, cl
test ah, 0x74
bt si, si
mov dl, byte [ecx + 4]
test ah, ah
bt si, bp
cmp edx, 0x33
pushal
jmp 0x1642d4f

Function at 0x1646a18
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push esp
lea esp, [esp + 8]
je 0x16448d1
lahf
xchg ch, al
mov eax, dword [ebp - 0x104]
btr cx, si
call fcn.01644956

Function at 0x1646ec8
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ecx, ecx
shl cl, 1
mov cl, byte [eax + 0xa]
push dword [esp]
pushal
jmp 0x164424e
Function at 0x1646ed8
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, dl
add ecx, dword [ebp - 0xf0]
bt esi, eax
stc
clc
push 0x5b8698e9
cmp dword [ebp - 0x108], ecx
push eax
push esi
lea esp, [esp + 0xc]
jb 0x1643497
rdtsc
mov edx, dword [ebp - 0x108]
setge al
not ah
call fcn.0164128b
pushfd
pushfd
lea esp, [esp + 0x50]
jb 0x1645f29
bsf cx, cx
mov ecx, dword [ebp - 0xf8]
jmp 0x1645f05

Function at 0x1647138
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x1641534
sbb bl, 0x94
or bl, bh
mov bl, byte [eax + 8]
clc
pushfd
call fcn.01642516
cmp al, ch
test eax, eax
pushal
mov byte [esp], ch
push esp
call fcn.01641106

Function at 0x164743f
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
call fcn.01644afc
lea esp, [esp + 0x28]
je 0x164a215
xadd ax, cx
test dx, 0xb9ca
mov ecx, 0x199ed930
cmp ebx, 0x488ad4ad
mov eax, dword [ebp - 0x104]
pushfd
mov ecx, dword [eax + 0x30]
jmp 0x1643916
stc
xor edx, edx
neg dl
movzx dx, al
btc dx, 0xc
sal dx, 8
mov dx, word [ecx + 0x12]
pushal
bt cx, 2
cmp edx, 0x44
pushfd
jmp 0x164b6d4
mov word [esp], si
push ebx
push esi
lea esp, [esp + 0xc]
je 0x164d986
jmp 0x164205c

Function at 0x16474eb
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
je 0x16428b6
pushal
clc
pushfd
cmp dword [ebp - 0x110], 0
jmp 0x164d611

Function at 0x1647c1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x2c]
je 0x164c718
push eax
stc
call fcn.0164cf31

Function at 0x1647fe0
Capabilities:
Authenticate hmac

Disassembly:
xor edx, edx
push ebp
movzx dx, al
movsx dx, al
jmp 0x16461fa

Function at 0x16480ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
test edx, edx
jmp 0x164ae08
pushfd
lea esp, [esp + 0xc]
je 0x1644261
bsr ax, sp
push eax
mov eax, dword [ebp - 0x44]
pushfd
cmp bh, ch
sub ecx, ecx
jmp 0x164c798
inc cl
mov cl, byte [eax + 0xa]
bt dx, 8
call fcn.016498fa

Function at 0x164841b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dh, cl
test dh, 0x1e
pushal
cmp edx, 0x4c
mov byte [esp], 0x75
pushal
lea esp, [esp + 0x44]
jne 0x164d986
sar ah, 1
clc
cmc
cmc
mov eax, dword [ebp - 0x44]
pushfd
bt cx, 8
pushfd
sub ecx, ecx
setge cl
test cl, al
clc
ror cl, 1
mov cl, byte [eax + 9]
cmc
cmp bp, di
cmp al, dl
cmp ecx, 0x6c
jmp 0x1642730

Function at 0x1648d88
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x44
pushal
lea esp, [esp + 0x28]
jne 0x1648777
bswap ax
aaa
mov eax, dword [ebp - 0x100]
dec cl
clc
mov ecx, dword [eax + 0x30]
pushfd
stc
sub edx, edx
clc
btr dx, 3
mov dx, word [ecx + 0xe]
pushfd
cmp edi, 0x2fbbb259
jmp 0x1644e4f

Function at 0x164910d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.01643c43
mov byte [esp], 0xc2
lea esp, [esp + 0x28]
jne 0x164ab71
daa
sar ah, 3
mov eax, dword [ebp - 0x104]
bsf cx, cx
movzx cx, cl
test sp, sp
mov ecx, dword [eax + 0x30]
bt bp, 7
sub edx, edx
rcl dl, 7
and dl, 7
rcr dh, 6
mov dx, word [ecx + 6]
stc
stc
call fcn.0164d789
Function at 0x1649153
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], bh
lea esp, [esp + 0x24]
je 0x16495c6
pushal
lea esp, [esp + 0x20]
jmp 0x16469e5
push 0x869879c0
pushfd
pushal
mov dword [ebp - 0x90], 0
call fcn.0164ceaf
mov dx, word [ecx + 2]
mov dword [esp + 4], 0x6c13fd0
mov word [esp + 4], 0xf1cd
jmp 0x164ac59
sub eax, 5
pushal
pushfd
pushfd
mov dword [edx + 1], eax
call fcn.01644510
jmp 0x1643755
pushfd
cmc
cmp cx, bp
test eax, eax
pushal
jmp 0x16410cc
jmp 0x1641db7
clc
sub edx, edx
add dx, 0x548e
push 0xd2734ca7
stc
rcr dh, 1
mov dx, word [ecx + 2]
stc
pushfd
pushal
jmp 0x164dde3
lea esp, [esp + 0x54]
je 0x1648c22
aas
rcr ch, cl
sbb dh, ch
btr cx, si
mov edx, dword [ebp - 8]
movsx ax, bl
cmc
rcr al, 5
mov eax, dword [ebp - 0x64]
shld cx, di, cl
mov ecx, dword [eax + edx*4]
cmp bp, bx
cmp cl, ah
cmc
and ecx, 0x80000000
push 0x141a5062
clc
cmp ecx, 0x80000000
pushfd
lea esp, [esp + 8]
je 0x164c7d7
pushal
rdtsc
ror ax, 1
lea edx, [ebp*8 - 0x4f869a95]
mov edx, dword [ebp - 8]
bt sp, 0xa
sbb cx, 0x4fcc
shld ax, di, 0xe
mov eax, dword [ebp - 0x64]
sbb cl, 0x3a
clc
btc cx, 3
mov ecx, dword [ebp - 0xbc]
pushfd
mov byte [esp], 0x8f
clc
add ecx, dword [eax + edx*4]
test ebp, ebp
sal ax, cl
rcl edx, 0xe
btr ax, 0xb
mov dword [ebp - 0x60], ecx
lea edx, [eax - 0x1c779d20]
btc dx, 0xb
mov edx, dword [ebp - 0x60]
btr ax, 0xc
add edx, 2
call fcn.0164cc7b
not ah
cwde
add edx, 0x10001f19
ror eax, 0x12
cwde
mov byte [esp + 4], al
mov eax, dword [ebp - 0xb8]
mov byte [esp + 4], 0x59
sub eax, edx
push dword [esp + 8]
pushfd
lea esp, [esp + 0x38]
jmp 0x164a861
jmp 0x164366f
stc
cmp edx, 0x74
mov byte [esp + 4], 0x31
jmp 0x164afb2
pushal
lea esp, [esp + 0x28]
je 0x164d515
aam 0xc0
mov eax, dword [ebp - 0x100]
not cx
shr ch, 2
neg cx
mov ecx, dword [eax + 0x30]
jmp 0x1648b11
lea esp, [esp + 0x28]
jne 0x1648777
lahf
test sp, bp
mov eax, dword [ebp - 0x100]
bt cx, ax
mov ecx, dword [eax + 0x30]
call fcn.016426bb
cmp edx, 0x54
jmp 0x164c6de

Function at 0x1649443
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
pushal
lea esp, [esp + 0x34]
je 0x16486c1
aad 0x60
bswap ax
clc
mov eax, dword [ebp - 0x104]
or ecx, 0x148b9398
test ebx, ebp
clc
mov ch, cl
mov ecx, dword [eax + 0x30]
call fcn.01642ffe
bswap ax
movzx ax, bl
mov eax, dword [ebp - 0xdc]
push 0x772f72a8
pushfd
mov dword [ecx], eax
call fcn.0164997b

Function at 0x16495d5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push esp
mov dword [ebp - 0x130], eax
mov byte [esp], 0xc6
pushfd
mov byte [esp], ch
pushfd
lea esp, [esp + 0x38]
jmp 0x1641a3a

Function at 0x1649ceb
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get number of processors

Disassembly:
lea esp, [esp + 8]
je 0x164cd40
cmp bh, 0x8e
jmp 0x164c9a4
bt dx, 0xf
cmp bl, 0x4c
pushal
call fcn.01645d54
Function at 0x164a000
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
push 0x6caf8c9a
xor edx, edx
stc
xor dh, al
rcl dx, 4
stc
mov dx, word [ecx + 4]
test edx, ebx
cmp edx, 0x72
pushfd
lea esp, [esp + 0xc]
je 0x1648620
rcl ch, 5
aam 0xc1
mov eax, dword [ebp - 0x104]
btr ecx, edx
clc
ror ch, cl
shl ch, cl
mov ecx, dword [eax + 0x30]
bt esi, 1
cmp cl, cl
xor edx, edx
bsf dx, sp
neg dx
mov dx, word [ecx + 4]
clc
cmp si, 0x6305
pushfd
cmp edx, 0x52
pushfd
call fcn.0164193a
ror ch, cl
pop edx
stc
imul eax, eax, 0x14
test dh, 0xf1
mov ecx, dword [ebp - 0x40]
sub dl, 0xd2
mov edx, dword [ebp - 0xbc]
test bx, 0x7c56
push 0xf5df3487
stc
add edx, dword [ecx + eax + 0x10]
clc
setle al
mov dword [ebp - 0x8c], edx
push dword [esp]
sets ch
mov eax, dword [ebp - 0x38]
xchg ecx, edx
setle cl
imul eax, eax, 0x14
neg cx
bswap ecx
jmp 0x1647648
mov ecx, dword [eax + 0x30]
cmp ah, ah
jmp 0x1640f4a

Function at 0x164a00a
Capabilities:
Execute anti-debugging instructions

Disassembly:
test al, al
cmp bl, 0x4e
pushal
mov word [esp + 0x10], 0x4dad
push dword [esp + 0xc]
lea esp, [esp + 0x24]
jne 0x1641534
test edi, 0xa2ff08bc
test eax, eax
mov byte [esp + 4], bh
mov byte [esp + 4], 0x73
pushfd
push 0xa779a291
lea esp, [esp + 0x10]
je 0x1645070
xor bl, al
rol bl, 1
add eax, edx
rcr bl, cl
mov bl, byte [eax]
push 0xedb65a4b
pushfd
mov byte [esp], al
pushfd
cmp bl, 0x6e
pushfd
lea esp, [esp + 0x10]
jp 0x164376c
je 0x1646e92
jmp 0x1646e77

Function at 0x164a558
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], 0x1644e81
call fcn.016499a3
jmp 0x16427a3
push ebp
mov dword [esp + 0x20], 0
jmp 0x1646978

Function at 0x164ad23
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1646c6a
push 0xebcb2a28
pushal
lea esp, [esp + 0x24]
je 0x164c7d7
rdtsc
mov edx, dword [ebp - 8]
stc
cmp bp, si
sub ecx, ebx
mov eax, dword [ebp - 0x64]
sal ecx, cl
pushal
mov ecx, dword [ebp - 0xbc]
jmp 0x1642625
and ecx, 0x80000000
jmp 0x1648a73
mov dword [esp + 0x1c], eax
jmp 0x1649bab
test di, 0x8f1c
cmp ecx, 0x80000000
mov word [esp + 0xc], 0x74c0
lea esp, [esp + 0x28]
jl 0x16462ac
pushal
mov byte [esp + 8], ah
lea esp, [esp + 0x20]
je 0x164c7d7
setb al
rcr ch, 5
sete ah
mov edx, dword [ebp - 8]
sar cx, cl
daa
bt esi, 0xf
mov eax, dword [ebp - 0x64]
shld cx, cx, 1
rol cl, cl
mov ecx, dword [ebp - 0xbc]
stc
clc
bt cx, ax
add ecx, dword [eax + edx*4]
shld dx, bp, cl
shld ax, ax, 0xc
mov dword [ebp - 0x60], ecx
xadd dx, ax
mov edx, dword [ebp - 0x60]
add al, cl
rcl eax, cl
xchg cx, ax
lea ecx, [edx - 0x158a93e6]
add edx, 2
movsx cx, bl
movzx ecx, al
mov dword [ebp - 0x98], edx
lahf
mov eax, dword [ebp - 0x98]
mov ch, 0x67
pushal
lea ecx, [ebp*2 + 0x173d0b7b]
jmp 0x164811b
pushfd
jmp 0x1646a61

Function at 0x164adbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
shld dx, sp, cl
rcl dh, cl
neg dx
btc dx, sp
mov dx, word [ecx + 0x10]
cmc
cmp edx, 0x6c
pushfd
lea esp, [esp + 4]
je 0x164746e
call fcn.0164ca76
or ecx, edx
setbe ah
pop eax
mov eax, dword [ebp - 0x100]
cmc
and cl, 0x56
stc
mov ecx, dword [eax + 0x30]
jmp 0x1644f92
Function at 0x164af40
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
call fcn.0164abab
mov eax, dword [ebp - 0x38]
bswap cx
rcl cl, cl
xchg dh, ch
imul eax, eax, 0x14
lea ecx, [edx - 0x63d5b084]
mov ecx, dword [ebp - 0x40]
setae dl
inc edx
mov edx, dword [ecx + eax + 0xc]
shrd ax, bp, 7
sal ch, 2
add edx, dword [ebp - 0xbc]
ror ah, cl
jo 0x164d994
rcr al, cl
mov dword [ebp - 0x44], edx
lahf
lea eax, [eax - 0x62b15597]
mov eax, dword [ebp - 0x38]
btc dx, ax
bts dx, 8
imul eax, eax, 0x14
lea edx, [ecx - 0x5e938118]
sub dh, 0x45
add edx, esi
mov ecx, dword [ebp - 0x40]
lea edx, [esi + 0x1e39e4fc]
mov edx, dword [ebp - 0xbc]
call fcn.016497fc
pushal
xor ecx, ecx
jmp 0x1645193
setnp cl
setge cl
cmc
mov dword [ebp - 0x12c], 0
btc ecx, 0x19
rdtsc
jmp 0x164ac83
lea esp, [esp + 4]
je 0x1644a36
jmp 0x164aecd
pushfd
rol al, 3
xchg cl, ah
mov dword [ebp - 0x44], edx
cmc
setae dh
lea ecx, [ecx*8 - 0x2c9b447a]
pop edx
mov eax, dword [ebp - 0x38]
btc dx, ax
xchg dh, cl
rol dx, 6
bswap dx
imul eax, eax, 0x14
bswap dx
shr dx, 1
sub cx, 0x5ef4
mov ecx, dword [ebp - 0x40]
pushal
movzx edx, cl
test ax, bx
rcl dx, 0xd
mov edx, dword [ebp - 0xbc]
pushfd
clc
bt cx, dx
add edx, dword [ecx + eax + 0x10]
movzx cx, dl
mov dword [ebp - 0x8c], edx
lahf
mov ah, 0x36
mov eax, dword [ebp - 0x38]
call fcn.0164ab0a

Function at 0x164b44e
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, 0x53
mov byte [esp + 4], ch
pushfd
push 0xe4439394
call fcn.0164c771
push dword [esp]
lea esp, [esp + 0x2c]
jne 0x164d986
shr ch, cl
shr cl, 1
bts cx, ax
mov ecx, dword [ebp - 0x44]
bt ax, 9
sub edx, edx
dec dl
mov dl, byte [ecx + 1]
pushfd
cmp bl, dh
pushfd
cmp edx, 0x73
pushal
push edx
lea esp, [esp + 0x2c]
je 0x164a9c7
rcl al, 5
add ax, 0xc648
mov eax, dword [ebp - 0x44]
pushal
stc
test dh, 2
sub ecx, ecx
shl cl, 5
mov cl, byte [eax + 1]
jmp 0x16471bf

Function at 0x164b566
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x1648620
cwde
cmc
shrd ax, sp, 9
or ch, dh
mov eax, dword [ebp - 0x104]
xor cx, dx
stc
mov ecx, dword [eax + 0x30]
push ebx
cmp ch, bl
xor edx, edx
or dh, 0xa5
ror dl, 6
neg dh
mov dx, word [ecx + 4]
mov byte [esp], 0x23
pushal
test ebx, ecx
cmp edx, 0x52
pushal
lea esp, [esp + 0x44]
jne 0x164ab71
sal ax, 0xb
aad 0xd9
mov eax, dword [ebp - 0x104]
btr cx, 0xe
pushal
mov ecx, dword [eax + 0x30]
jmp 0x16442dd

Function at 0x164b684
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
lea esp, [esp + 0x2c]
je 0x16486c1
bts eax, 0x1d
and al, 0xef
movzx ax, cl
mov eax, dword [ebp - 0x104]
call fcn.0164565d

Function at 0x164b981
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
clc
test ecx, ecx
call fcn.0164b4cb
clc
add cl, 0x6b
mov cl, byte [eax + 0xa]
cmp eax, edi
jmp 0x16425de
pushfd
test edx, edx
pushal
push 0x10e1ad5c
pushfd
lea esp, [esp + 0x38]
je 0x1644261
setbe ah
rcl ah, cl
mov eax, dword [ebp - 0x44]
cmp al, 0x4e
pushal
bt esp, 0xc
sub ecx, ecx
jmp 0x16465af
Function at 0x164bbd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp ecx, 0x6c
jmp 0x164af7d
jmp 0x164c697
mov byte [esp], 0xe4
lea esp, [esp + 4]
je 0x1649512
shrd dx, bx, cl
mov edx, dword [ebp - 0x44]
pushal
cmc
cmp bp, 0x1310
push ebx
xor eax, eax
rol al, 1
sub al, cl
mov al, byte [edx + 9]
mov byte [esp], ch
call fcn.0164d9fb
sub edx, edx
xor dh, 0x81
test ah, dl
bts dx, 0xf
mov dx, word [ecx + 2]
pushfd
cmp edx, 0x45
call fcn.016448c6
lea esp, [esp + 0x30]
jns 0x164dcec
je 0x1648777
sar ax, 2
sar al, cl
mov eax, dword [ebp - 0x100]
rcl ecx, cl
test al, 0x13
bswap cx
and cl, ch
mov ecx, dword [eax + 0x30]
push 0xb13a59fe
sub edx, edx
btr dx, ax
clc
mov dx, word [ecx]
bt ax, 0xe
pushal
pushal
cmc
cmp edx, 0x6e
pushfd
pushfd
pushfd
lea esp, [esp + 0x50]
je 0x16415cf
bswap cx
or ah, bl
xchg al, cl
mov eax, dword [ebp - 0x100]
sbb cl, 0x32
btc ecx, eax
sbb ch, 0xb0
mov ecx, dword [eax + 0x30]
call fcn.0164cb86
xor ecx, ecx
sar cl, cl
mov cl, byte [eax + 9]
add esp, 0x24
jne 0x16495f3
cmp ecx, 0x6c
push ebx
jmp 0x164b303
push dword [esp]
lea esp, [esp + 0x24]
je 0x1649512
btr edx, 0x11
bt sp, ax
mov edx, dword [ebp - 0x44]
cmc
cmc
call fcn.0164a624
call fcn.01649503

Function at 0x164c6fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
sal bl, cl
mov bl, byte [eax + 9]
pushal
pushal
stc
clc
test bl, bl
pushfd
mov byte [esp + 0xc], 0x12
push dword [esp]
lea esp, [esp + 0x48]
je 0x164caef
lea esp, [esp + 4]
je 0x1641515
bt si, ax
cmp bl, 0xf2
push 0x892d825b
mov dword [esp], eax
cmp bl, 0x4c
call fcn.01641505
lea esp, [esp + 4]
jne 0x1641534
not bl
and bl, 0xd8
pushfd
dec bl
mov bl, byte [eax + 9]
mov dword [esp], 0x7b1e8c66
clc
test bl, bl
push dword [esp]
pushal
pushfd
mov word [esp + 8], ax
inc esp
and al, 8
lea esp, [esp + 0x2c]
je 0x164caef
stc
pushfd
clc
cmc
add ecx, 0x14
pushal
lea esp, [esp + 0x24]
jmp 0x16478ef
call fcn.0164c216
call fcn.016410c2
cmp bl, 0x6c
mov byte [esp], ah
lea esp, [esp + 4]
je 0x164cd40
cmp bp, bx
pushal
push dword [esp]
cmc
cmp bl, 0x4c
mov byte [esp], 0x34
jmp 0x16461b2
pushfd
pushfd
jmp 0x164c072
pushfd
lea esp, [esp + 0xc]
jne 0x1641534
shr bl, 5
mov bl, byte [eax + 7]
pushfd
jmp 0x164799d
lea esp, [esp + 0xc]
jno 0x164a095
pushfd
push 0x76e152e2
lea esp, [esp + 8]
jne 0x1641534
test ah, ch
xchg bx, ax
sub ebx, esi
cmc
sub esi, esi
movzx eax, cl
setp bh
bsf ax, ax
aaa
mov edi, ecx
das
mov ecx, dword [ecx]
sal ah, cl
rol ah, 1
sar ah, 3
sbb al, dl
mov eax, ecx
sub bx, ax
add eax, edx
neg bl
mov eax, dword [eax]
shr ebx, 0x1d
adc bx, 0xce19
cmc
mov ebx, eax
cmc
cmc
test ebx, ebx
jmp 0x1646a3a
sal bl, 4
xor bl, ah
mov bl, byte [eax + 8]
push 0x9f79e967
bt eax, 4
cmp bl, 0x6c
jmp 0x16439d4
Function at 0x164c8ab
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jmp 0x1647f08
mov ecx, dword [eax + 0x30]
stc
cmp dl, 0xc7
sub edx, edx
bswap dx
shrd dx, sp, 2
mov dl, byte [esp]
bsr dx, ax
mov dx, word [ecx + 0xe]
mov byte [esp], 0xbe
clc
cmp dl, dh
cmp si, 0xfd9b
cmp edx, 0x6c
push 0xf12a1f93
lea esp, [esp + 8]
jnp 0x16417d0
push 0x8b21a067
lea esp, [esp + 4]
je 0x164560d
setnp ch
rcr cx, 0xf
mov eax, dword [ebp - 0x100]
sar ch, 5
dec cl
cmc
mov ecx, dword [eax + 0x30]
pushfd
clc
xor edx, edx
btr dx, 9
shl dl, 3
mov dx, word [ecx + 0xe]
pushal
clc
cmp edx, 0x4c
call fcn.0164664f

Function at 0x164c992
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jne 0x1641534
sub bl, 0xde
jmp 0x16461f5

Function at 0x164ce98
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
pushal
lea esp, [esp + 0x34]
je 0x164d147
cmc
cmp bl, 0x44
jmp 0x1643533

Function at 0x164ceb4
Capabilities:
Encode data using base64

Disassembly:
stc
xor ax, 0xe251
mov dword [ebp - 0x64], edx
or eax, ebp
mov eax, dword [ebp - 0x44]
test ch, ah
sub ecx, ecx
cmc
stc
mov cl, byte [eax]
pushal
cmc
cmp ecx, 0x75
jmp 0x1642bf5
jmp 0x1643547
add edx, dword [ecx + eax]
lea esp, [esp + 0x14]
jge 0x16416bc
das
stc
mov dword [ebp - 0x64], edx
adc al, al
mov eax, dword [ebp - 0x44]
pushfd
clc
xor ecx, ecx
rcl cl, 7
mov cl, byte [eax]
bt esi, 0xf
cmp ecx, 0x75
lea esp, [esp + 4]
jl 0x164bd4b
call fcn.0164157d

Function at 0x164d20b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmp ecx, 0x72
mov byte [esp], 0xe6
mov word [esp], 0xdeaa
push ebp
pushal
lea esp, [esp + 0x28]
je 0x16450c0
test edx, 0x28192e46
clc
shr dx, cl
call fcn.0164c12a
call fcn.01644f66

Function at 0x164d818
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
sub ecx, ecx
cmc
call fcn.016446c0

Function at 0x164d9fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1649508
cmp eax, 0x4c
pushfd
jmp 0x1649e4a

Function at 0x164da21
Capabilities:
Authenticate hmac

Disassembly:
sub edx, edx
dec dx
ror dh, cl
shl dh, cl
xor dx, 0x2f75
mov dx, word [ecx + 0xe]
cmc
cmp edx, 0x6c
pushal
push dword [esp + 8]
lea esp, [esp + 0x48]
je 0x164560d
ror cl, cl
aas
sub al, dh
mov eax, dword [ebp - 0x100]
add cx, ax
sal cx, 4
mov ecx, dword [eax + 0x30]
cmp dx, 0xf4c8
test cx, 0x8f20
stc
sub edx, edx
bts dx, di
mov dx, word [ecx + 0xe]
test eax, 0x3a326a80
cmp edx, 0x4c
call fcn.01648b85
lea esp, [esp + 0x30]
jne 0x1648777
sub ax, si
mov eax, dword [ebp - 0x100]
shr ch, 2
inc cx
mov ecx, dword [eax + 0x30]
pushal
push dword [esp]
jmp 0x1642a57

Function at 0x164dcd4
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp - 0x44]
pushfd
pushfd
pushfd
xor ecx, ecx
or cl, dl
mov cl, byte [eax]
bt sp, si
cmp ecx, 0x75
jmp 0x164c98d
Function at 0x164dd47
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmc
pushal
sub esp, 0xffffffdc
ja 0x16461d9
cmp ecx, 0x53
jmp 0x164a9b7
pushal
test di, si
pushal
cmp ecx, 0x53
pushfd
push 0x874cb1ee
call fcn.01648bf8
pushfd
mov dword [esp], edx
call fcn.016489b7
call fcn.01644a69
mov dx, word [ecx + 0x10]
mov word [esp], dx
pushfd
push dword [esp]
lea esp, [esp + 0x38]
jmp 0x1649fc3
xor ecx, ecx
rcr cl, cl
mov cl, byte [eax + 1]
jmp 0x164563f
push 0xfd4fd846
pushal
lea esp, [esp + 0x24]
jne 0x164d986
jmp 0x1647a0b