joyce8/EMBER2024-capa huggingface dataset:
Function at 0xca523f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0ca5a2aa
add esp, 0xc
cmp ebx, 0x5247
jg 0xca52421
jns 0xca5241c
jle 0xca52421
mov eax, 0x45c67670
in al, 0x48
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xe], 0x66
call fcn.0ca5246a
Function at 0xca54d48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0ca5a2aa
add esp, 0xc
rol ecx, 0
nop
jge 0xca54d74
pushf
test eax, edi
popf
xchg esp, esp
jp 0xca54d71
jl 0xca54d74
sub eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
ror edi, 0xa
rol edi, 0xa
jb 0xca54db6
ja 0xca54dae
jge 0xca54db0
mov esp, esp
jae 0xca54db6
jmp 0xf8f2d7f8
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jge 0xca54e18
shr eax, 0
xchg ecx, ebx
xchg ecx, ebx
ror esi, 0
js 0xca54e3c
pushf
add esi, dword [esp]
sub esi, dword [esp]
call 0xca54e31
lea esp, [esp + 4]
popf
jb 0xca54e39
jns 0xca54e3c
mov ebx, 0xf36ee8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0ca641af
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xca54e51
xor eax, eax
jmp 0xca54f04
and esp, 0xffffffff
add eax, dword [esp]
sub eax, dword [esp]
jb 0xca54e74
pushf
mov esi, esi
cmp ebx, 0x1850
ror esp, 0
test dword [esp + 4], ecx
popf
xchg edi, eax
xchg edi, eax
jae 0xca54e74
mov eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 4], 0
je 0xca54ef0
jmp 0xca54e9c
sub esp, 0
jae 0xca54eba
pushf
xor edx, 0x1383
xor edx, 0x1383
popf
lea esi, [esi]
mov esp, esp
js 0xca54eb7
jb 0xca54eba
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0ca63482
add esp, 4
add esp, 0
xchg edx, ecx
xchg edx, ecx
ja 0xca54f02
pushf
and ebx, 0xffffffff
popf
js 0xca54eff
jbe 0xca54f02
mov ebp, 0x5e5fc033
xor eax, eax
Function at 0xca54f0d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0xca2f760]
cmp eax, 1
jne 0xca54f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xca550bc
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0ca5a2aa
add esp, 0xc
or edx, edx
mov edx, edx
cmc
jne 0xca54f55
pushf
jle 0xca54f49
cmp edx, dword [esp]
jns 0xca54f4e
popf
jno 0xca54f52
je 0xca54f55
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
xor edx, 0
jae 0xca54f95
mov esp, esp
jb 0xca54f95
mov ebx, 0x558a9935
call 0x94a73a1c
push ebp
call 0x3992952c
add dword [eax + 0x4d8aed45], ecx
sub cl, 1
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jl 0xca54fff
add edi, 0
clc
jbe 0xca55019
pushf
add edi, 0
cmp esi, dword [esp + 0x10]
rol esp, 0
popf
jo 0xca55015
nop
ja 0xca55019
mov ebx, 0xf191e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0ca641af
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xca5502e
xor eax, eax
jmp 0xca550bc
jnp 0xca55030
jae 0xca55047
pushf
add edx, dword [esp]
sub edx, dword [esp]
popf
xchg edi, eax
xchg edi, eax
jnp 0xca55040
xchg edi, edx
xchg edi, edx
jb 0xca55047
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0ca54a6a
mov dword [ebp - 4], eax
mov eax, eax
ror esp, 0
jae 0xca55063
jb 0xca55060
jb 0xca55063
add eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xca5507d
xor eax, eax
jmp 0xca550bc
test eax, edx
cmp edi, dword [esp + 0x10]
xchg edx, esi
xchg edx, esi
xchg edx, edx
je 0xca5509f
pushf
shl esp, 0
mov esp, esp
add esp, 0
cmc
popf
jg 0xca5509a
xchg edi, edi
jne 0xca5509f
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0ca63482
add esp, 4
shl edx, 0
cld
cmc
jnp 0xca550b9
jge 0xca550b4
jp 0xca550b6
jp 0xca550b9
xor eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xca55a98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0ca5a2aa
add esp, 0xc
xchg esp, esp
jne 0xca55abc
jno 0xca55acf
pushf
shr esp, 0
test esi, edx
stc
popf
lea edi, [edi]
mov edx, edx
jo 0xca55acf
mov ebx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0ca641af
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca55b9a
xor eax, eax
jmp 0xca55c1c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0xca55bc4
xor eax, eax
jmp 0xca55c1c
jo 0xca55bc6
ror eax, 0x1b
ror eax, 5
shr ecx, 0
jb 0xca55beb
pushf
jl 0xca55bd5
push ecx
add ecx, 0x65cc
ror ecx, 0x1e
pop ecx
popf
xchg edi, esi
xchg edi, esi
jp 0xca55be8
jae 0xca55beb
mov esp, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0ca63482
add esp, 4
lea esp, [esp]
ror eax, 0xb
rol eax, 0xb
clc
jo 0xca55c11
pushf
add esp, 0
lea ebx, [ebx]
popf
jmp 0xca55c0e
jno 0xca55c11
or dword [ebx - 0x74aef3b3], 0xff520855
push ebp
call 0x9800ba7f
in eax, 0x5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xca5638b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0xca5639f
jmp 0xca5653f
xor ebx, 0
nop
je 0xca563b2
lea esp, [esp]
jbe 0xca563aa
jle 0xca563ac
jp 0xca563ae
jne 0xca563b2
mov edi, 0x8458bf1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0xca38388], edx
xor edi, dword [esp]
xor edi, dword [esp]
js 0xca563cb
jmp 0xca563cd
jge 0xca563cf
jle 0xca563d9
jbe 0xca563d3
jl 0xca563d5
jg 0xca563d9
adc dword [ebx - 0x75], 0x488bec45
add al, 0x89
or eax, 0xca36efc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0xca36efc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0xca36ef8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0xca36fdc], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0xca36fe0], ecx
test esp, 0x4277
nop
test dword [esp], edx
lea esp, [esp]
jae 0xca5642a
pushf
mov esi, esi
jl 0xca5641d
popf
xchg ebx, ebx
xchg ebx, esi
xchg ebx, esi
jg 0xca56427
jb 0xca5642a
mov edx, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
nop
jo 0xca56472
pushf
cmp eax, 0x725a
popf
nop
jge 0xca5646d
js 0xca5646f
jno 0xca56472
call 0x8d95ba00
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
std
cld
jbe 0xca564de
neg esi
neg esi
xor esp, 0
jbe 0xca564f6
pushf
ror eax, 0x1a
ror eax, 6
popf
xchg esp, esp
ja 0xca564f6
mov ebx, 0x6ef83d83
mov dword [0x1474000c], eax
cmp dword [0xca36ef8], 0
je 0xca56513
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0xca36ef8]
push eax
call fcn.0ca54a6a
mov dword [0xca38384], eax
add eax, dword [esp]
sub eax, dword [esp]
lea edi, [edi]
ror edx, 0x15
rol edx, 0x15
jns 0xca5652f
jnp 0xca56525
mov eax, eax
mov esp, esp
jno 0xca5652b
js 0xca5652f
mov edi, 0x6a0d6a68
add byte [ebp - 0x17ae0fb3], cl
outsb dx, byte [esi]
cmp eax, 0xc4830000
or al, 0x5f
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0ca5a2aa
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xca56548
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0ca5a2aa
add esp, 0xc
jl 0xca56563
lea esi, [esi]
nop
lea ecx, [ecx + 0xbc1]
lea ecx, [ecx - 0xbc1]
jne 0xca56581
pushf
not esi
not esi
popf
mov ecx, ecx
je 0xca56581
mov edx, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
call fcn.0ca565b6
Function at 0xca59db2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0ca5a2aa
add esp, 0xc
or eax, 0
add edx, 0x2bf2
sub edx, 0x2bf2
jl 0xca59df0
jbe 0xca59dde
xchg ecx, ecx
lea edx, [edx + 0x5015]
lea edx, [edx - 0x5015]
jge 0xca59df0
mov ebp, 0xf045c607
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
inc eax
dec eax
ror eax, 0x19
ror eax, 7
jmp 0xca59e2a
cmp ecx, 0x7c48
jle 0xca59e49
pushf
call 0xca59e39
add esp, 4
sub esp, 0
nop
jle 0xca59e42
popf
jbe 0xca59e46
jg 0xca59e49
lcall 0x1e9, 0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
add dword [eax + 0x558af44d], ecx
stc
sub dl, 1
mov byte [ebp - 7], dl
mov esp, esp
jno 0xca59ebe
jl 0xca59eaf
lea ebx, [ebx + 0x2dc4]
lea ebx, [ebx - 0x2dc4]
jo 0xca59ebe
sub eax, 0xa2ec
call fcn.0ca641af
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xca59ed0
xor eax, eax
jmp 0xca59f09
mov esp, esp
ror edx, 0
rol esp, 0
test dword [esp], eax
je 0xca59ee6
jle 0xca59edf
jp 0xca59ee1
jne 0xca59ee3
jne 0xca59ee6
or dword [ebp - 0x74af0fbb], 0xe851fc4d
ja 0xca59e9c
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0ca54a6a
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0ca5a2aa
add esp, 0xc
mov eax, dword [ebp - 0x14]
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xca5e96b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0xca38478
call fcn.0ca480a2
add esp, 0xc
mov byte [0xca38478], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0xca60c74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0ca5a2aa
add esp, 0xc
push 0x21
push 0xca38a74
lea ecx, [ebp - 0x138]
push ecx
call fcn.0ca5c80c
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0xca60d7c
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0ca5a2aa
add esp, 0xc
push 0xb
push 0xca38a98
lea edx, [ebp - 0x138]
push edx
call fcn.0ca5c80c
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0xca60d6f
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0ca5c80c
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0xca60d7e
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xca63ef2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
shl esi, 0
jno 0xca63f29
pushf
clc
cmc
popf
lea eax, [eax]
lea edi, [edi + 0x6fa9]
lea edi, [edi - 0x6fa9]
lea ecx, [ecx]
jo 0xca63f29
mov ebp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
ja 0xca63f63
lea ebx, [ebx + 0x4767]
sub ebx, 0x4767
lea edx, [edx]
jbe 0xca63f7e
xchg ebx, edx
xchg ebx, edx
jo 0xca63f79
jns 0xca63f7b
ja 0xca63f7e
mov esi, 0x80e84d8a
jmp 0xf4f3c788
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0ca53a27
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xca64004
xor eax, eax
jmp 0xca64097
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0ca54a6a
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0ca5a2aa
add esp, 0xc
cmp dword [ebp - 4], 0
je 0xca64095
or esp, 0
or ecx, 0
jo 0xca6405a
pushf
mov edi, edi
shr esp, 0
jle 0xca6403b
popf
lea edx, [edx + 0x773a]
lea edx, [edx - 0x773a]
lea edi, [edi + 0x7edd]
lea edi, [edi - 0x7edd]
mov edi, edi
jno 0xca6405a
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0ca63482
add esp, 4
cmp ebx, dword [esp]
inc edx
dec edx
dec eax
inc eax
call 0xca64072
add esp, 4
ja 0xca64080
lea eax, [eax]
jno 0xca6407b
ja 0xca6407d
jbe 0xca64080
ljmp 0x4d8b:0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0xca64097
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xca6424a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0ca5a2aa
add esp, 0xc
test dword [esp], ebx
xor esp, 0
je 0xca6428e
pushf
shr esp, 0
xor ebx, 0x4cc6
xor ebx, 0x4cc6
lea ecx, [ecx]
rol edi, 6
rol edi, 0x1a
popf
ja 0xca64288
nop
jne 0xca6428b
jne 0xca6428e
mov ebx, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
test dword [esp + 0xc], eax
jle 0xca642d5
jle 0xca642ce
ja 0xca642d0
lea ecx, [ecx]
jg 0xca642d5
mov ecx, 0x80f44d8a
jmp 0xf3cadf
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
ja 0xca64348
jne 0xca6434a
nop
jg 0xca6435d
lea ecx, [ecx + 0x6e99]
lea ecx, [ecx - 0x6e99]
jle 0xca6435d
lcall 0xffff, 0xfe4de82a
call fcn.0ca641af
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xca64370
jmp 0xca6441e
ror edi, 0
jb 0xca6438c
pushf
lea ebx, [ebx + 0x2715]
lea ebx, [ebx - 0x2715]
popf
jle 0xca64387
lea ebx, [ebx]
jae 0xca6438c
or dword [ebp - 0x74ad17ab], 0xe850f845
rol dword [esi], 1
invalid
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0ca54a6a
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0ca5a2aa
add esp, 0xc
cmc
or esp, 0
jge 0xca643ce
pushf
xchg esp, esp
lea ebx, [ebx + 0x2b9a]
lea ebx, [ebx - 0x2b9a]
popf
lea ecx, [ecx]
lea edx, [edx]
lea esp, [esp]
jl 0xca643ce
mov eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0xca643d6
jmp 0xca6441e
lea edx, [edx]
jnp 0xca643da
rol esp, 0
jbe 0xca643e4
ja 0xca643e1
ja 0xca643e4
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0ca63482
add esp, 4
xor edi, dword [esp]
xor edi, dword [esp]
rol ebx, 7
ror ebx, 7
lea ecx, [ecx + 0x6db7]
lea ecx, [ecx - 0x6db7]
rol eax, 0x1c
ror eax, 0x1c
je 0xca64417
mov ebx, ebx
jbe 0xca64414
jne 0xca64417
mov edi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4