joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7ea0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a7eb0
sub eax, edx
mov edi, eax
lea ebx, [edi + edi]
push ebx
call dword [0x517170]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4a7ed9
pop edi
lea eax, [esi + 0x1b]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
test edi, edi
je 0x4a7ef0
nop
mov cl, byte [eax + ebp]
mov byte [esi + eax*2], cl
mov byte [esi + eax*2 + 1], 0
inc eax
cmp eax, edi
jb 0x4a7ee0
push 0xf0000000
push 1
push 0
push 0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, dword [esp + 0x28]
test eax, eax
je 0x4a7f6f
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8002
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4a7f62
mov edx, dword [esp + 0x10]
push 0
push ebx
push esi
push edx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [edi + 0x10], eax
push esi
mov byte [edi + 0x14], al
call dword [0x517174]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x4a8380
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4a83b6
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
mov esi, dword [esp + 0x18]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a83c0
sub eax, edx
push eax
call fcn.004a2570
add esp, 4
push 0
push eax
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 2
push edx
mov dword [esp + 0x18], 0
call esi
cmp dword [esp + 4], 0x10
jne 0x4a841d
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push eax
push ecx
push 2
push edx
call esi
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x4a842d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x4a843e
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret
Function at 0x4ab580
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x4ab5a2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4ab596
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x4ab5d2
cmp dword [esi + 8], 0
jne 0x4ab5c5
mov ecx, dword [eax + 8]
push 0x5020e4
push ecx
call fcn.004b0027
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4ab5c5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.004b2192
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4ab5f4
mov eax, dword [esi + 8]
test eax, eax
je 0x4ab5ee
push eax
call fcn.004b00f2
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x4ac580
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x517170]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ac5a5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x4ac5ec
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x4ac5f0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x4ac64c
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
dec ebp
jne 0x4ac613
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x4ac688
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x4eb774
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x4eb775
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x4ac657
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x4ae123
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5176f0]
jne 0x4ae12d
repz ret
jmp fcn.004ba26c
Function at 0x4c48ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004bb51c
and dword [ebp - 0x14], 0
cmp dword [0x51be78], 0
mov dword [ebp - 0x18], eax
jne 0x4c49a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4c4a49
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4c4a49
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4ee4c4
push ebx
mov dword [0x51be78], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x51be7c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x51be80], eax
call edi
push eax
call esi
mov dword [0x51be88], eax
test eax, eax
je 0x4c49a1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x51be84], eax
mov eax, dword [0x51be84]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4c49fa
cmp dword [0x51be88], ecx
je 0x4c49fa
push eax
call esi
push dword [0x51be88]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4c49fa
test ebx, ebx
je 0x4c49fa
call edi
test eax, eax
je 0x4c49f1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4c49f1
test byte [ebp - 8], 1
jne 0x4c49fa
or dword [ebp + 0x10], 0x200000
jmp 0x4c4a2d
mov eax, dword [0x51be7c]
cmp eax, dword [ebp - 0x18]
je 0x4c4a2d
push eax
call esi
test eax, eax
je 0x4c4a2d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4c4a2d
mov eax, dword [0x51be80]
cmp eax, dword [ebp - 0x18]
je 0x4c4a2d
push eax
call esi
test eax, eax
je 0x4c4a2d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x51be78]
call esi
test eax, eax
je 0x4c4a49
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4c4a4b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae123
leave
ret

Function at 0x4d4070
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.004b28e0
add esp, 0xc
mov dword [ebp - 0x40c], 0
push 0x400
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4d40fd
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x4d40fd
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x4d40fd
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebp - 0x40c], edx
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
Function at 0xca3dfe3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0ca5a2aa
add esp, 0xc
add ecx, 0
jo 0xca3e00f
jnp 0xca3e003
xchg esi, edx
xchg esi, edx
jl 0xca3e009
xchg edi, eax
xchg edi, eax
jno 0xca3e00f
mov esp, 0xec45c646
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
lea esi, [esi + 0x3d6c]
sub esi, 0x3d6c
jnp 0xca3e062
xchg edx, edx
jno 0xca3e05d
jns 0xca3e05f
jp 0xca3e062
mov ecx, 0x80ec4d8a
jmp 0xf8f1686c
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0ca641af
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca3e0ef
jmp 0xca3e17c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0xca3e17c
ja 0xca3e117
jb 0xca3e12d
lea esp, [esp]
nop
lea edx, [edx + 0x1a65]
lea edx, [edx - 0x1a65]
jae 0xca3e12d
mov esi, 0xe8458b99
mov eax, dword [ebp - 0x18]
push eax
call fcn.0ca63482
add esp, 4
cmp esp, 0xbbb
rol esi, 0x13
ror esi, 0x13
nop
mov esp, esp
jge 0xca3e169
pushf
jae 0xca3e14e
dec ecx
inc ecx
xchg esp, esp
nop
popf
lea ecx, [ecx + 0x7ac5]
lea ecx, [ecx - 0x7ac5]
xchg esp, esp
lea esp, [esp]
jl 0xca3e169
mov ebp, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xca405d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
nop
std
cld
xchg edi, edi
jl 0xca40603
xchg ebx, eax
xchg ebx, eax
jnp 0xca405fc
lea edi, [edi]
je 0xca40600
jge 0xca40603
mov esi, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jp 0xca40639
test dword [esp], esi
js 0xca4064b
pushf
mov ecx, ecx
popf
je 0xca40646
xchg esp, esp
jns 0xca4064b
mov eax, 0x80e84d8a
jmp 0xf4f18e55
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
lea esp, [esp]
not edx
not edx
call fcn.0ca406bf
Function at 0xca40a68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
rol ecx, 0x1b
rol ecx, 5
xchg esp, esp
jne 0xca40a93
jmp 0xca40a8d
xchg ebx, eax
xchg ebx, eax
je 0xca40a93
call 0xf4e9d0d3
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
nop
test dword [esp], eax
add ebx, dword [esp]
sub ebx, dword [esp]
js 0xca40af6
pushf
add edi, 0
clc
xchg ebx, ecx
xchg ebx, ecx
push eax
add eax, 0x2104
ror eax, 0xe
pop eax
popf
jo 0xca40af3
jns 0xca40af6
jmp 0x8d8c5884
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0ca53a27
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca40b85
xor eax, eax
jmp 0xca40c1f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xca40c1d
mov esi, esi
shl edi, 0
sub esp, 0
jne 0xca40bdf
pushf
jmp 0xca40bb9
xchg ecx, ecx
lea edx, [edx + 0x7b7b]
lea edx, [edx - 0x7b7b]
or esp, 0
popf
jne 0xca40bce
lea ebx, [ebx + 0x7178]
lea ebx, [ebx - 0x7178]
jg 0xca40bdc
je 0xca40bdf
jmp 0x5d9c516e
mov eax, dword [ebp - 8]
push eax
call fcn.0ca63482
add esp, 4
xor esi, 0x286a
xor esi, 0x286a
neg esi
neg esi
jns 0xca40c0c
pushf
cmp edx, 0x501d
popf
jbe 0xca40c09
js 0xca40c0c
or dword [ebx - 0x74aeefb3], 0x8b520c55
inc ebp
or byte [eax - 1], dl
push ebp
clc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0xca40c1f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xca4934e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0ca5a2aa
add esp, 0xc
xor ebx, eax
xor ebx, eax
jmp 0xca49374
jb 0xca4937d
jl 0xca49378
jle 0xca4937a
jae 0xca4937d
mov edx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
shl edi, 0
call 0xca493b5
add esp, 4
or eax, 0
jne 0xca493bd
jns 0xca493d2
pushf
test edi, 0x2ed6
popf
jns 0xca493cb
jo 0xca493cd
jmp 0xca493cf
js 0xca493d2
mov esi, 0x80f04d8a
jmp 0xfcf21bdc
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
ror esp, 0
jle 0xca49440
xchg esi, ecx
xchg esi, ecx
jb 0xca4943d
jg 0xca49440
add eax, 0xa5e2e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0ca53a27
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca49452
xor eax, eax
jmp 0xca494a1
or eax, eax
nop
cmp esp, 0x2938
je 0xca4947e
pushf
test esp, 0x6124
xchg esp, esp
xchg edx, edx
popf
jnp 0xca4946d
jp 0xca4946f
lea edx, [edx + 0x42b]
lea edx, [edx - 0x42b]
jne 0xca4947e
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0ca5a2aa
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xca4cd0d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
ror esi, 0xa
rol esi, 0xa
cld
push edx
add edx, 0x7c89
ror edx, 0x1e
pop edx
jb 0xca4cd4d
pushf
lea ecx, [ecx]
jge 0xca4cd40
jno 0xca4cd42
xor ecx, edx
xor ecx, edx
popf
jno 0xca4cd4a
jae 0xca4cd4d
lcall 0x45c6, 0x44e845c6
in eax, dx
push esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
dec edi
inc edi
jb 0xca4cda7
jb 0xca4cd9f
mov edi, edi
ja 0xca4cda3
jae 0xca4cda7
add eax, 0xe84d8aef
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
clc
lea esi, [esi]
jnp 0xca4ce5f
jo 0xca4ce4a
lea esp, [esp]
jae 0xca4ce4f
lea ecx, [ecx + 0x17c6]
lea ecx, [ecx - 0x17c6]
jp 0xca4ce5f
add eax, 0x2b25e83a
add byte [eax], al
call 0xca4f989
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca4ce71
xor eax, eax
jmp 0xca4ced8
push ecx
add ecx, 0x79a4
ror ecx, 0x16
pop ecx
je 0xca4ce88
pushf
cld
popf
xchg edi, edi
jne 0xca4ce88
add eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0ca54a6a
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0xca4ceb2
xor eax, eax
jmp 0xca4ced8
jo 0xca4ceb4
jae 0xca4cebb
jns 0xca4ceb8
jb 0xca4cebb
mov ebx, 0x51e44d8b
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0ca63482
add esp, 4
nop
jbe 0xca4ced1
nop
jo 0xca4cecd
ja 0xca4ced1
xor eax, 0x8558b88
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xca4ebe6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
jmp 0xca4ec01
inc esi
dec esi
cmp esp, 0x3840
jnp 0xca4ec28
pushf
rol eax, 0
shl eax, 0
or ebx, ebx
popf
lea edx, [edx + 0x243b]
lea edx, [edx - 0x243b]
xchg esp, esp
jp 0xca4ec28
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
jo 0xca4ec66
xchg edx, edi
xchg edx, edi
dec ecx
inc ecx
jge 0xca4ec75
nop
ja 0xca4ec71
jl 0xca4ec75
mov esp, 0xe84d8a70
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.0ca53a27
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca4ed01
xor eax, eax
jmp 0xca4ed7a
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xca4ed78
jb 0xca4ed29
sub edx, 0
lea ecx, [ecx + 0x4206]
lea ecx, [ecx - 0x4206]
jae 0xca4ed49
pushf
inc edx
dec edx
add esp, 0
mov eax, eax
popf
nop
jb 0xca4ed49
mov edi, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0ca63482
add esp, 4
jl 0xca4ed57
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
jo 0xca4ed6b
mov ecx, ecx
jp 0xca4ed65
mov edx, edx
jno 0xca4ed6b
mov edi, 0xc4d8bb7
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0xca4ed7a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8