joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc34d76
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
sub ax, 0x151f
bts ax, dx
mov eax, dword [ebp - 0x44]
pushfd
sub ecx, ecx
shl cl, 4
mov cl, byte [eax + 3]
bt bx, 6
clc
bt dx, 0xf
cmp ecx, 0x72
mov byte [esp], cl
pushfd
call fcn.00c3a839
ror dl, cl
test ah, 0x1a
mov dl, byte [ecx + 2]
test ecx, edx
cmp edx, 0x45
pushal
push dword [esp]
lea esp, [esp + 0x28]
jbe 0xc3c292
jne 0xc329e2
pushfd
add ah, bh
rol al, 4
bsr ax, dx
mov eax, dword [ebp - 0x44]
add esp, 4
jne 0xc33190
stc
call fcn.00c332d1
lea esp, [esp + 0x10]
je 0xc3e8d7
bsf ax, bx
xor ah, dh
mov ecx, ecx
ror cx, 6
mov eax, dword [ebp - 0x104]
cmc
mov ecx, dword [eax + 0x30]
pushal
push eax
sub edx, edx
btc dx, 2
setnp dh
rcr dh, 4
mov dx, word [ecx + 0x12]
push ebp
bt ax, di
jmp 0xc3ae7e
pushal
pushal
push 0x1afd39f0
lea esp, [esp + 0x44]
jne 0xc329e2
jmp 0xc33f60

Function at 0xc34fb5
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0xc329e2

Function at 0xc350de
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jne 0xc3555d
aaa
stc
daa
shld ax, bp, cl
mov eax, dword [ebp - 0x104]
shld ecx, ecx, cl
test cx, dx
test dx, 0xb813
btr ecx, 0x1c
mov ecx, dword [eax + 0x30]
pushal
call fcn.00c32821
shl bh, 3
shld bx, bx, 8
xadd bh, dh
mov dword [ebp - 0xbc], eax
neg dx
bt dx, 2
shr dl, cl
mov edx, dword [ebp - 0xac]
rol bl, cl
and bh, 0x14
sal bl, 2
cmc
add edx, 0x10002253
push 0x88753ed5
add edx, 1
movsx ebx, cl
pushal
sete bl
pushfd
mov ebx, dword [ebp - 0xcc]
mov dword [esp], eax
push 0xb16b1e25
pushfd
push 0xb450af50
lea esp, [esp + 0x34]
jmp 0xc39ad0
pushfd
jmp 0xc34853
cmp dh, bh
aas
pushfd
clc
add ebx, dword [ebp - 0xbc]
sub esp, 0xfffffffc
shld eax, ecx, cl
test cl, 0x50
add ah, 0x86
mov dword [edx], ebx
rcr al, cl
or ah, 0xb6
mov cx, 0xdf8b
bts ecx, esp
xor byte [edx - 1], 0x80
adc cx, 0x10aa
mov eax, dword [ebp - 0xac]
rol cx, cl
add eax, 0x10002395
bt cx, dx
test si, 0x75f2
mov dword [ebp - 0xb0], eax
cwde
rcr ax, 0xb
add cx, sp
test ah, bh
popfd
clc
test di, 0x4b78
inc ah
das
popal
sar ax, cl
inc eax
mov eax, dword fs:[0x30]
stc
test dl, al
push 0x4d686714
mov eax, dword [eax + 0xc]
pushal
test eax, eax
mov byte [esp + 0x14], 0x2e
call fcn.00c3f0a7

Function at 0xc350e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
je 0xc3bef8
clc
pushfd
not cl
inc eax
mov eax, dword [ebp - 0x100]
bts ecx, 0x15
mov ecx, dword [eax + 0x30]
call fcn.00c3f2b8

Function at 0xc35294
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
cmp edx, 0x6c
lea esp, [esp + 0x28]
push edi
push esp
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0xc33669
and al, al
mov eax, dword [ebp - 0x100]
dec ch
test cx, ax
mov ecx, dword [eax + 0x30]
call fcn.00c3344b
Function at 0xc352c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0xc3c327
bt si, si
lea ecx, [esi - 0x354e773d]
sal ch, 3
mov ecx, dword [ebp - 0x44]
clc
clc
xor edx, edx
pushfd
or dl, 0xc
mov dl, byte [ecx + 5]
pushal
call fcn.00c35fb8
mov word [esp], bp
mov dword [esp + 0x38], 0xc3dd60
pushfd
push dword [ebp - 0xd4]
pop dword [esp + 0x38]
pushfd
pushfd
push dword [esp + 8]
push dword [esp + 0x44]
ret 0x48

Function at 0xc353db
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0x30]
pushal
pushfd
pushfd
xor edx, edx
not dl
inc dl
rol dl, 1
mov dx, word [ecx + 0x14]
push 0x7ae43886
test dl, ah
cmp edx, 0x4c
push dword [esp]
jmp 0xc38f67
mov byte [esp], 0x38
lea esp, [esp + 0x2c]
je 0xc3f810
shr ch, cl
pushfd
cmp dh, ch
das
mov eax, dword [ebp - 0x104]
jmp 0xc3269b
xor edx, edx
pushal
mov byte [esp], 0x27
push 0x829b1152
lea esp, [esp + 0x30]
jmp 0xc37d21
lea esp, [esp + 0x34]
jne 0xc3555d
push ecx
mov eax, dword [ebp - 0x104]
or cl, 0x7e
cmc
and ch, 0x59
mov ecx, dword [eax + 0x30]
test dh, al
pushfd
pushfd
jmp 0xc35542

Function at 0xc3545f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jp 0xc3a229
pushfd
push 0xf99df50e
mov dword [esp + 4], 0x4c91a6
add esp, 4
stc
pop eax
btr bx, 0xe
shr bl, cl
sub eax, 0x100010ab
lea ebx, [eax + 0x7512a1d0]
rcl bx, cl
mov ebx, eax
rcr al, 4
add ebx, 0x10001036
cwde
cmp dword [ebx], 0
cwde
lea eax, [esp - 0x635020b]
jmp 0xc3fbb9
bsf ax, ax
rcr al, cl
push 0x4c91a6
bsr eax, eax
pop eax
sal bl, cl
not bh
sub eax, 0x100010ab
adc bx, ax
mov ebx, eax
add ah, bh
cmp dh, al
xor ax, 0x181f
shl al, 6
add ebx, 0x10001036
call fcn.00c3273f

Function at 0xc35587
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp + 8], eax
movzx ax, bl
lahf
movzx ax, cl
movsx ax, cl
mov eax, dword [ebp - 0xbc]
mov byte [esp + 8], ah
mov dword [ebp + 0xc], eax
bswap ax
mov eax, dword [ebp - 0x80]
call fcn.00c36217

Function at 0xc355af
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0xc3555d
sal ecx, cl
stc
mov eax, dword [ebp - 0x104]
and ch, ch
sar cl, cl
push esi
mov ecx, dword [eax + 0x30]
call fcn.00c3f999

Function at 0xc35609
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp eax, 0x4c
pushal
pushfd
mov byte [esp], 0x6b
push 0x5531c363
lea esp, [esp + 0x30]
jne 0xc329e2
jmp 0xc3d926
xor eax, eax
inc al
clc
mov al, byte [edx + 9]
test al, 0xe4
cmp al, 0x67
push 0xd4c3d1e9
jmp 0xc345cb
push eax
lea esp, [esp + 8]
je 0xc345e3
bsf dx, di
not dh
shrd edx, esp, cl
mov edx, dword [ebp - 0x44]
pushfd
jmp 0xc3a1a1

Function at 0xc3563c
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
stc
jmp 0xc38395
lea esp, [esp + 0x2c]
jne 0xc329e2
bsf ecx, ebp
or cl, dh
mov ecx, dword [ebp - 0x44]
pushal
stc
mov byte [esp], cl
sub edx, edx
sal dl, cl
mov dl, byte [ecx + 7]
clc
jmp 0xc33815
cmp edx, 0x64
mov word [esp + 4], 0x6150
pushfd
call fcn.00c3483a
Function at 0xc35675
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
pushfd
stc
cmp eax, 0x6c
push ebx
lea esp, [esp + 0x14]
jo 0xc3912f
je 0xc393ee
and cx, 0x978b
mov ecx, dword [ebp - 0x44]
clc
xor edx, edx
xor dl, al
ror dl, 6
mov dl, 0x55
mov dl, byte [ecx + 8]
test ebx, ebx
call fcn.00c3fecf
pushal
pushfd
call fcn.00c39608

Function at 0xc356b2
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0xc324b4
sal al, cl
ror al, cl
mov eax, dword [ebp - 0x100]
rcl ecx, 0x19
sbb cx, 0xf50b
shr cx, 1
rcr ch, 1
mov ecx, dword [eax + 0x30]
bt edx, ebx
jmp 0xc401ed
xor edx, edx
cmc
jmp 0xc3c1a4

Function at 0xc359f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0xc3555d
pushal
mov eax, dword [ebp - 0x104]
btc cx, 0xa
bsf cx, si
bswap ecx
not ch
mov ecx, dword [eax + 0x30]
mov byte [esp], 0x84
xor edx, edx
rcl dh, cl
setl dh
mov dx, word [ecx + 0x10]
push edi
test ch, al
stc
call fcn.00c3a66f
cmp edx, 0x4c
pushal
lea esp, [esp + 0x2c]
jne 0xc329e2
push edi
sete ah
lahf
push ebx
mov eax, dword [ebp - 0x44]
mov word [esp], 0x8a5d
mov byte [esp + 4], cl
mov byte [esp], ch
lea esp, [esp + 8]
jmp 0xc393f9

Function at 0xc35b32
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
cmp si, sp
sub edx, edx
bt bp, 1
cmc
mov dx, word [ecx + 0x18]
test ax, si
cmc
test edx, edx
mov byte [esp + 4], 0xc7
lea esp, [esp + 8]
jns 0xc3eb7b
push esi
lea esp, [esp + 4]
jne 0xc3555d
not ax
rdtsc
sbb al, dl
mov eax, dword [ebp - 0x104]
pushal
add edx, 0xe3acee56
rol dh, cl
pushfd
mov ecx, dword [eax + 0x3c]
setae dl
pushfd
lea esp, [esp + 0x28]
jp 0xc34e94
mov dword [ebp - 0x108], ecx

Function at 0xc35cea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0x8747
mov byte [esp + 4], cl
lea esp, [esp + 8]
jne 0xc3eab4

Function at 0xc35e0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
push ebx
sub edx, edx
setle dl
bswap dx
mov dx, word [ecx]
clc
cmp edx, 0x4e
mov byte [esp + 4], 0x5e
push dword [esp + 4]
lea esp, [esp + 0xc]
jne 0xc324b4
cmc
rcl ch, cl
shr cx, cl
xor ax, cx
mov eax, dword [ebp - 0x100]
ror ch, 3
movzx ecx, al
mov ecx, dword [eax + 0x30]
clc
xor edx, edx
ror dh, 7
btr dx, bx
mov dx, word [ecx + 2]
clc
cmc
clc
cmp edx, 0x74
pushfd
push dword [esp]
call fcn.00c384dc
test dh, 0x59
test cl, 1
cmp esi, edx
clc
test eax, eax
push eax
pushfd
push dword [esp + 4]
pushal
lea esp, [esp + 0x2c]
je 0xc368da
inc cl
mov dword [ebp - 0x90], eax
sal ah, 3
test dl, 0x3d
bt ax, bp
lea eax, [ebp - 0xc]
movsx dx, cl
pushal
mov dword [esp + 0x1c], eax
sub esp, 0xffffffe4
xor cx, 0x5f1d
setae ch
dec cl
mov ecx, dword [ebp - 0x90]
bsf dx, si
shr edx, cl
push ecx
shr dl, 3
push 0
neg dl
push 0
bswap dx
mov edx, dword [ebp - 0xac]
pushal
clc
cmc
add edx, 0x10002361
call fcn.00c3bb34
Function at 0xc35fb8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xc329e2
push 0x6ce46773
movzx ax, al
mov eax, dword [ebp - 0x44]
clc
mov byte [esp], dh
push dword [esp]
sub ecx, ecx
not cl
mov cl, byte [eax + 6]
pushal
cmp ecx, 0x2e
lea esp, [esp + 0x28]
js 0xc3874d
je 0xc34fbf
mov dh, 0x82
shld dx, bp, 1
jmp 0xc3fd97
pushfd
cmp edx, 0x32
jmp 0xc3b42f
jmp 0xc326fd
pushfd
pushfd
pushal
push 0xec8bb467
lea esp, [esp + 0x2c]
je 0xc34fbf
bswap dx
dec dx
mov edx, dword [ebp - 0x44]
bt di, 2
pushfd
xor eax, eax
pushal
pushfd
test dl, 0xde
mov al, byte [edx + 6]
cmp esi, edi
call fcn.00c3ab1f
jmp 0xc35aee
clc
cmp eax, 0x2e
push dword [esp]
push dword [esp + 4]
lea esp, [esp + 0xc]
jne 0xc329e2
shl ch, 3
bsf cx, ax
setle cl
mov ecx, dword [ebp - 0x44]
bt di, bp
sub edx, edx
pushal
cmc
ror dl, 3
xor dl, 0xef
mov dl, byte [ecx + 7]
pushal
jmp 0xc36d96
test sp, dx
mov edx, dword [ebp - 0x44]
pushfd
mov word [esp], 0xd03c
mov word [esp], cx
xor eax, eax
stc
neg al
ror al, 4
sar al, 6
mov al, byte [edx + 6]
jmp 0xc3b9c0

Function at 0xc360c6
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push dword [esp]
mov byte [esp + 4], ch
pushal
lea esp, [esp + 0x2c]
je 0xc35a79
call fcn.00c3fc08

Function at 0xc360dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 0xc]
je 0xc3f52e
call fcn.00c3ce8e

Function at 0xc360ff
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions

Disassembly:
adc al, cl
movsx ax, dl
not al
and eax, 0x95ccc48e
mov eax, dword [ebp - 0x44]
bt di, 6
stc
jmp 0xc3ed6d
lea esp, [esp + 0x34]
jne 0xc329e2
bts cx, 0xe
movsx ecx, al
mov ecx, dword [ebp - 0x44]
stc
push ebx
bt bp, ax
xor edx, edx
sal dl, 4
mov dl, byte [ecx + 4]
cmp ah, bl
cmp edx, 0x33
push 0x3efe5fb6
push dword [esp]
pushal
push dword [esp + 8]
lea esp, [esp + 0x30]
je 0xc3ce3c
jnp 0xc33cb2
add al, 0xc2
sub ax, 0x3991
mov eax, dword [ebp - 0x44]
cmp dh, 0xcc
pushfd
pushal
clc
sub ecx, ecx
push edx
ror cl, cl
mov cl, byte [eax + 4]
test dx, 0x9f28
cmp ecx, 0x33
mov byte [esp + 8], cl
mov dword [esp], 0xdfec81ce
lea esp, [esp + 0x28]
jne 0xc329e2
mov edx, 0xe4d09569
shr edx, cl
mov edx, dword [ebp - 0x44]
push ebx
xor eax, eax
and al, 0xe3
sal al, 5
rcr al, cl
mov al, byte [edx + 5]
bt di, bx
mov word [esp], 0x1761
cmp eax, 0x32
mov word [esp], 0x7f02
pushfd
mov byte [esp + 4], 0x86
lea esp, [esp + 8]
je 0xc3c327
movsx ecx, al
push edi
mov ecx, dword [ebp - 0x44]
pushal
bt dx, 0xc
pushfd
sub edx, edx
add dl, 0x57
and dl, 0x10
not dl
cmc
mov dl, byte [ecx + 5]
cmp dh, 0xaf
call fcn.00c32abe
lea esp, [esp + 4]
jne 0xc3eab4
pushal
pushfd
pushal
pushfd
lea esp, [esp + 0x48]
jmp fcn.00c36a1d
push dword [esp]
jmp 0xc34feb
push edx
stc
cmp ecx, 0x33
jmp 0xc38289
xor ecx, ecx
sal cl, cl
shr cl, cl
mov cl, byte [eax + 4]
stc
jmp 0xc3a4a8

Function at 0xc36288
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x20], al
pushfd
xchg dword [esp + 0x3c], edx
lea edx, [eax - 0x2033ad7a]
push 0xb8b26500
not edx
pushfd
mov edx, dword [ebp - 0x34]
jmp 0xc37707
jmp 0xc358b7
Function at 0xc3637b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x2c]
je 0xc34fbf
movzx edx, dl
call fcn.00c383e7

Function at 0xc363ce
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
not dh
mov dx, word [ecx + 4]
bt bx, 0xc
cmp edx, 0x64
push edi
call fcn.00c3e058
push 0xbcf784dd
mov byte [esp], al
mov eax, dword [ebp - 0x50]
push 0x3a77f34
pushal
call fcn.00c38341

Function at 0xc363e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts ax, dx
push esi
shr al, cl
mov eax, dword [ecx + 0xc]
cmc
jmp 0xc386b6
test al, 0x2d
test eax, eax
push dword [esp]
pushfd
push dword [esp + 0x18]
lea esp, [esp + 0x34]
je 0xc3cecb
add bl, 0x68
cmc
push 0x64bebac5
rcr bl, cl
add eax, edx
clc
sal bl, cl
add bl, cl
mov bl, byte [eax]
cmp di, bp
test bl, dl
push ecx
cmp bl, 0x6e
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0xc35cff
bt ax, si
push 0x542167e7
cmp bl, 0x4e
pushal
call fcn.00c374f8
mov dword [esp + 0x44], 0xc37e57
pushfd
call fcn.00c36a58

Function at 0xc36438
Capabilities:
Access peb ldr_data
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Get number of processors
Packed with generic packer

Disassembly:
inc bx
add edx, 1
not bx
bsf bx, bx
sub bl, 0xe0
mov ebx, dword [ebp - 0xcc]
test bl, ch
clc
add ebx, dword [ebp - 0xbc]
mov byte [esp + 4], bh
pushfd
lea esp, [esp + 0xc]
jmp 0xc39ade

Function at 0xc36536
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
shr dl, cl
mov dl, byte [ecx + 7]
clc
cmc
cmc
stc
cmp edx, 0x64
pushfd
jmp 0xc3813b
jmp 0xc400b6

Function at 0xc36577
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt dx, si
cmp edx, 0x4c
pushal
lea esp, [esp + 0x2c]
jne 0xc3555d
not cx
mov eax, dword [ebp - 0x104]
rol cx, 2
and ecx, ebp
mov ecx, dword [eax + 0x30]
jmp 0xc3a023

Function at 0xc365a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
clc
mov word [esp + 4], 0x7e3f
sub eax, 5
call fcn.00c3840f
lea esp, [esp + 0x2c]
je 0xc3e8d7
bt di, cx
call fcn.00c38f00
mov bl, byte [eax + 5]
test dl, bl
pushfd
cmp bl, 0x2e
push 0xf4b36de1
mov byte [esp], 4
lea esp, [esp + 0xc]
jne 0xc3eab4
pushal
inc bl
pushfd
mov bl, byte [eax + 6]
call fcn.00c38066
stc
call fcn.00c3dae4
pushal
test eax, eax
mov byte [esp + 4], 0x81
push dword [esp]
push edi
mov dword [esp + 4], 0x50e3afd2
lea esp, [esp + 0x28]
je 0xc329e2
movzx edx, al
shrd ax, bp, cl
neg dl
mov edx, dword [ebp - 0xac]
setbe ah
setle al
shr ah, cl
add edx, 0x10001efc
das
test dx, dx
rcr ax, cl
sub al, bl
mov eax, dword [ebp - 0x7c]
pushfd
mov dword [eax], edx
shrd ax, si, cl
xor dx, sp
cdq
test ch, dh
mov edx, dword [ebp - 0xac]
aas
btc eax, edx
shr ah, 2
add edx, 0x10001f34
and ah, 0x6e
mov eax, dword [ebp - 0xdc]
mov dword [esp], edx
pushal
stc
push dword [esp + 4]
sub eax, edx
jmp 0xc333f5

Function at 0xc366e0
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
push dword [ebp - 0x30]
pop dword [esp + 0x30]
mov dword [esp + 8], 0xd6f5bdf9
mov byte [esp], al
push dword [esp + 8]
call fcn.00c39362
Function at 0xc366fb
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
stc
sub edx, edx
or dl, al
setg dl
shld dx, dx, cl
dec dh
mov dx, word [ecx + 0x12]
cmp cl, 0x8a
cmp edx, 0x64
pushfd
jmp 0xc35315
pushal
lea esp, [esp + 0x28]
je 0xc3e8d7
dec ax
mov eax, dword [ebp - 0x104]
not ch
ror ch, cl
mov ecx, dword [eax + 0x30]
bt eax, 0x1a
bt edx, edi
test dh, bl
pushal
xor edx, edx
push 0xfaf602df
sal dh, 6
shr dl, cl
rcl dh, 1
mov dx, word [ecx + 0x12]
cmc
clc
pushal
cmc
cmp edx, 0x44
push ebx
lea esp, [esp + 0x48]
jne 0xc3555d
test al, cl
mov eax, dword [ebp - 0x104]
btc ecx, 4
neg cx
mov ecx, dword [eax + 0x30]
test cl, 0xd8
sub edx, edx
shrd dx, bx, cl
mov dx, word [ecx + 0x14]
push edi
jmp 0xc3c167
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0xc3555d
btr ax, 1
lea eax, [ebp + 0x22c4ffa9]
xadd al, ch
rol al, 5
mov eax, dword [ebp - 0x104]
setl ch
mov ecx, dword [eax + 0x30]
test bl, 0xc1
push 0xfb4ca264
jmp 0xc351e6
clc
sub edx, edx
add dl, ah
mov dx, word [ecx]
cmc
clc
cmp edx, 0x4e
call fcn.00c3fdfc
cmp edx, 0x6c
pushal
pushal
push ebp
mov byte [esp], 0x45
lea esp, [esp + 0x48]
je 0xc3f810
rcl ax, 5
bt ebp, 4
mov eax, dword [ebp - 0x104]
bsf ecx, edx
mov ecx, dword [eax + 0x30]
clc
pushfd
bt ecx, 0x1a
xor edx, edx
shr dh, 6
test bp, 0x158
call fcn.00c3982f
mov dl, 0xfd
shrd dx, sp, cl
mov dx, word [ecx]
stc
test bh, dl
test dl, 0x50
stc
cmp edx, 0x6e
push eax
pushal
lea esp, [esp + 0x24]
je 0xc3fe0c
bsr ax, bp
add al, 0x7a
ror ax, 6
mov eax, dword [ebp - 0x100]
or cl, dh
rcl ch, cl
mov ecx, dword [eax + 0x30]
cmc
jmp 0xc36fa6

Function at 0xc369cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xc369f9
stc
test ch, 0xd0
pushal
cmp bl, 0x44
lea esp, [esp + 0x20]
js 0xc3ec42
pushfd
pushal
push 0x5e72f464
lea esp, [esp + 0x28]
jne 0xc3eab4
call fcn.00c38dff

Function at 0xc36a13
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0xc3eab4

Function at 0xc36ab0
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xc3555d
dec ah
test cl, ch
sub eax, 0xed8fe8cc
mov eax, dword [ebp - 0x104]
movzx cx, al
stc
and cl, ah
mov ecx, dword [eax + 0x30]
clc
call fcn.00c33161

Function at 0xc36ad9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jne 0xc329e2
cmc
rcr dl, 2
cmc
bt cx, bx
mov edx, dword [ebp - 0x44]
stc
call fcn.00c3f51d

Function at 0xc36b40
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 0xc], 0xc34df0
pushal
call fcn.00c32b5a

Function at 0xc36b98
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jmp 0xc3f13f
push 0xbc469f01
mov eax, dword [edx]
pushfd
mov dword [ebp - 0x108], eax
push dword [esp + 4]
push 0xfb316c3a
lea esp, [esp + 0x10]
jmp 0xc35b8f
lea esp, [esp + 0x50]
jb 0xc3aec6
cwde
mov al, 0x55
setnp ah
mov edx, dword [ebp - 0x108]
jmp 0xc3ec79
Function at 0xc36c18
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0xc393ee
sete ch
rcr ch, cl
mov ecx, dword [ebp - 0x44]
cmc
test di, 0x6f3b
stc
call fcn.00c326d8

Function at 0xc36c49
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
bt ecx, esi
add edx, 0x10001076
bswap bx
bsr bx, si
rol bh, 1
mov ebx, dword [edx]
bsf dx, bp
add ebx, dword [ebp - 0x50]
cmc
seto dh
test ecx, 0x2e40c762
mov dword [ebp - 0x2c], ebx
movsx dx, cl
sub dl, 0x60
test dx, bx
mov edx, dword [ebp - 0xac]
bt si, sp
stc
add edx, 0x10001005
jmp 0xc3e001
lea esp, [esp + 4]
jge 0xc33b6d
pushal
call fcn.00c34c32

Function at 0xc36c96
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc3bbe0
lea esp, [esp + 0x2c]
jne 0xc3555d
stc
lahf
mov eax, dword [ebp - 0x104]
inc cl
add cl, 0x78
call fcn.00c33937

Function at 0xc36cfe
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
jb 0xc3aec6
bswap eax
jmp 0xc3802a
xchg al, dh
mov edx, dword [ebp - 0x108]
pushal
mov eax, dword [edx]
push dword [esp]
mov dword [ebp - 0x108], eax
push esi
pushfd
lea esp, [esp + 0x2c]
jmp 0xc35b8f

Function at 0xc36d6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xc33483
pushal
call fcn.00c33b64

Function at 0xc36d81
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp ecx, 0x72
mov word [esp + 8], 0x6c2c
call fcn.00c37383

Function at 0xc36d91
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ah, bl
push edi
test ax, 0xbd61
cmp bl, 0x6c
call fcn.00c3a8b7
jmp 0xc39926
mov bl, byte [eax + 8]
lea esp, [esp + 4]
jp 0xc34b0b
pushal
pushfd
cmp bl, 0x6c
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
je 0xc39275
test cl, bl
cmp bl, 0x4c
pushal
lea esp, [esp + 0x20]
jne 0xc3eab4
or bl, 4
mov bl, byte [eax + 9]
stc
pushal
clc
test bl, bl
pushfd
mov word [esp], bp
lea esp, [esp + 0x24]
je 0xc34bae
clc
stc
stc
add ecx, 0x14
pushal
mov byte [esp + 4], dh
pushal
lea esp, [esp + 0x40]
jmp 0xc3f06f
Function at 0xc36d9b
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
push ebp
test eax, eax
pushfd
lea esp, [esp + 8]
je 0xc329e2
bt ax, bp
btc edx, 0xc
mov edx, dword [ebp - 0xac]
btc eax, esp
cwde
add edx, 0x10001efc
movzx ax, al
shld eax, ebp, cl
push 0xa76b2116
mov eax, dword [ebp - 0x7c]
cmc
jmp 0xc37720
sub esp, 0xffffffdc
jnp 0xc3664e
test eax, eax
push ecx
lea esp, [esp + 4]
je 0xc329e2
shl al, 5
dec ah
mov edx, dword [ebp - 0xac]
bsr ax, di
pushal
bsr ax, cx
btc ax, cx
add edx, 0x10001efc
bts ax, dx
mov eax, dword [ebp - 0x7c]
pushfd
mov word [esp + 0xc], 0x20ed
cmp edx, 0x215671e1
mov dword [eax], edx
clc
shr ax, 0xe
cdq
neg dh
mov edx, dword [ebp - 0xac]
bt bp, 1
rcr al, cl
push 0xe4204488
add edx, 0x10001f34
btr eax, eax
cmp cl, bl
cmc
mov eax, dword [ebp - 0xdc]
cmc
sub eax, edx
test ah, al
sub eax, 5
push dword [esp + 4]
test esp, ebx
test dh, 0xbe
pushfd
mov dword [edx + 1], eax
inc ah
mov edx, dword [ebp - 0xac]
and al, 0x9b
aam 0xa3
aaa
add edx, 0x10001f04
test esi, ebx
setno ah
mov eax, dword [ebp - 0x9c]
cmp al, al
stc
cmp bp, dx
mov dword [edx + 1], eax
xor eax, eax
mov eax, dword [ebp - 0xc]
bt ebp, esi
pushfd
add esp, 0x34
jns 0xc346ef
test cl, 0x20
mov dword [edx + 6], eax
das
aaa
mov edx, dword [ebp - 0xac]
sete ah
setl ah
lahf
add edx, 0x10001f1a
pushfd
shrd ax, ax, 0xb
shrd ax, bp, cl
btr ax, di
mov eax, dword [ebp - 0xb8]
call fcn.00c32797

Function at 0xc36ffb
Capabilities:
Access peb ldr_data

Disassembly:
movsx ecx, al
aaa
xor byte [edx - 1], 0x80
shld eax, esi, 0x16
lea eax, [eax*2 - 0x448b9bcc]
clc
mov eax, dword [ebp - 0xac]
shr cl, cl
stc
sal cl, 6
add eax, 0x10002395
bswap ecx
setns dl
bsf cx, bp
mov dword [ebp - 0xb0], eax
pushfd
movsx ax, bl
cdq
aaa
push dword [esp + 8]
popfd
rcl bl, cl
add esp, 0xc
popal
sbb ah, 0x71
mov eax, dword fs:[0x30]
pushfd
mov eax, dword [eax + 0xc]
push dword [esp]
test eax, eax
call fcn.00c3f0c2

Function at 0xc37128
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x1c]
bsf eax, edx
mov eax, dword [edx]
stc
add eax, ecx
lea ecx, [ebx + 0x67077696]
call fcn.00c3f087

Function at 0xc3713e
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr bl, 1
bt sp, 8
mov bl, byte [eax + 7]
cmc
cmc
cmp bl, 0x6c
pushfd
call fcn.00c3a19c
call fcn.00c36bed
bt eax, ebp
jmp 0xc373a6
mov byte [esp], 0xba
cmp bl, 0x2e
mov byte [esp], 0x1f
lea esp, [esp + 0xc]
jnp 0xc38c16
pushfd
mov byte [esp], al
lea esp, [esp + 4]
jne 0xc3eab4
shr bl, 2
neg bl
inc bl
mov bl, byte [eax + 6]
jmp 0xc36a91
cmc
cmp bl, 0x44
pushfd
jmp 0xc3d210
cmp bl, 0x64
push eax
push eax
lea esp, [esp + 8]
je 0xc369f9
jmp 0xc3736d
lea esp, [esp + 0x20]
jne 0xc3eab4
add bl, dl
mov bl, byte [eax + 6]
stc
clc
stc
call fcn.00c3be9f
pushal
jmp 0xc381a7
mov word [esp], dx
lea esp, [esp + 4]
jne 0xc3eab4
sub bl, dh
pushal
setno bl
push dword [esp]
mov bl, byte [eax + 7]
test al, 0x28
cmp bl, 0x6c
call fcn.00c326f8

Function at 0xc37230
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pushfd
sub eax, eax
xor al, al
call fcn.00c33fb5