joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5438f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x438acd
cmp byte [ebx + 0x3e], 0
je 0x438acd
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
sete al
test al, al
je 0x4389f4
xor al, al
jmp 0x438acf
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00420910
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x438a5e
sub eax, 1
je 0x438a62
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x438ab5
xor bl, bl
jmp 0x438ab7
mov byte [ebx + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x438a97
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0052c294
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x438a5a
cmp byte [ebx + 0x3e], 0
je 0x438ab5
test esi, esi
jne 0x438a20
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00407310
jmp 0x438a19
mov bl, 1
cmp ecx, 0x10
jb 0x438ac9
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00403980
mov al, bl
jmp 0x438acf
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret

Function at 0x439d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.00516d20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x439e00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_get_TEMP_path
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
sub esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.00428480
mov esi, eax
test esi, esi
je 0x439e1c
push str.Failed_to_initialize_legacy_logging_system
jmp 0x439de0
push 0x56ed74
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052c2ec
lea eax, [ebp - 0x20c]
push eax
push 0x104
push edi
call fcn.0052c361
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
Function at 0x43ad10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x43ad41
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x43ad30
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x443460
Capabilities:
Continue service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x24
lea eax, [ebp - 0x2c]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x443480
mov ecx, 0x1c
lea eax, [ebp - 0x48]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x443493
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x4434d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_open_SCM
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x44362f
push 0x5c
push str.QualysAgent
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x44360f
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0x28], 4
je 0x443635
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4435f2
mov eax, dword [ebp - 0x28]
cmp eax, 1
jne 0x443567
push str.Service_is_stopped___issuing_start_command
push 0x58ba20
call fcn.00437360
add esp, 8
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4435c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.QualysAgent
mov esi, eax
push str.Failed_to_start_service__s
push esi
push 0x58ba20
call fcn.00437520
add esp, 0x10
jmp 0x4435c3
cmp eax, 7
jne 0x4435ac
push str.Service_is_paused___issuing_continue_command
push 0x58ba20
call fcn.00437360
add esp, 8
lea eax, [ebp - 0x48]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4435c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_Continue_service
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x4435c3
cmp eax, 4
jne 0x4435c9
push str.Service_is_running.
push 0x58ba20
call fcn.00437360
add esp, 8
cmp dword [ebp - 0x28], 4
je 0x4435e6
push str.Service_is_not_running___pausing_1_second...
push 0x58ba20
call fcn.00437360
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1e
jb 0x4434f3
jmp 0x44362f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_query_service_status
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x44362f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.QualysAgent
mov esi, eax
push str.Failed_to_open_service___s_
push esi
push 0x58ba20
call fcn.00437520
add esp, 0x10
cmp dword [ebp - 0x28], 4
jne 0x443637
xor esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x443644
push edi
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x44364e
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
Function at 0x443cb0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
xor esi, esi
mov dword [ebp - 0x30], eax
push 0x80000000
push esi
push esi
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0xc], esi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x443d1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_open_service_manager
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 8
push ebx
push 0x80000000
push str.QualysAgent
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x443d5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.QualysAgent
mov esi, eax
push str.Failed_to_open__s_service_handle
push esi
push 0x58ba20
call fcn.00437520
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
jmp 0x443da7
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x443d96
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.QualysAgent
mov esi, eax
push str.Failed_to_query__s_service_state
push esi
push 0x58ba20
call fcn.00437520
add esp, 0x10
jmp 0x443d9e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov dword [ecx], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 8
Function at 0x443dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544160
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5868f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], esi
add esi, 0x48
mov dword [ebp - 0x1c], 0
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x443e0f
mov eax, dword [esi]
jmp 0x443e11
mov eax, esi
xor ecx, ecx
mov dword [ebp - 4], ecx
push ecx
mov word [eax], cx
push ecx
cmp byte [0x58b4bd], cl
je 0x443e2b
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x443e31
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x443f61
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004feec5
add esp, 4
mov edi, eax
cmp byte [0x58b4bd], 0
mov dword [ebp - 0x1c], edi
push ebx
push edi
je 0x443e6c
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x443e72
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test edi, edi
je 0x443f61
cmp word [edi], 0
jne 0x443e84
xor ecx, ecx
jmp 0x443e9f
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x443e90
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00403fe0
cmp dword [esi + 0x14], 8
jb 0x443eb2
mov ecx, dword [esi]
jmp 0x443eb4
mov ecx, esi
mov eax, dword [esi + 0x10]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x443ecd
push 1
push 0x565aa8
mov ecx, esi
call fcn.0040c930
push 0xc
push str.MSIEXEC.EXE
mov ecx, esi
call fcn.0040c930
mov eax, dword [ebp - 0x18]
mov ecx, esi
push 4
cmp byte [eax + 0x3a8], 0
jne 0x443ef2
push str._I__
jmp 0x443ef7
push str._X__
call fcn.0040c930
mov ebx, dword [ebp - 0x14]
mov ecx, esi
cmp dword [ebx + 0x28], 0
lea eax, [ebx + 0x18]
push 0xffffffffffffffff
push 0
jne 0x443f11
push ebx
jmp 0x443f12
push eax
call fcn.0040ce80
push 1
push 0x564e24
mov ecx, esi
call fcn.0040c930
push 5
push str.__QN
mov ecx, esi
call fcn.0040c930
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x3a9], 0
je 0x443f4e
push 8
push str._FORCE1
lea ecx, [ebx + 0x30]
call fcn.0040c930
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x30]
mov ecx, esi
push eax
call fcn.0040ce80
xor ebx, ebx
jmp 0x443fb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_retrieve_system_directory_path
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x443fc4
push edi
call fcn.004fdfa4
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x447340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x180], 0
je 0x4473e4
cmp dword [ecx + 0x184], 8
lea eax, [ecx + 0x170]
mov dword [ebp - 4], eax
jb 0x447368
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4473e4
push edi
push ebx
xor edi, edi
push esi
lea ebx, [edi + eax]
movzx eax, word [edi + str.explorer.exe]
push eax
call fcn.0051f78b
movzx ecx, word [ebx]
mov si, ax
push ecx
call fcn.0051f78b
add esp, 8
cmp ax, si
jne 0x4473e1
mov eax, dword [ebp - 4]
add edi, 2
cmp word [ebx], 0
jne 0x447371
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x10
push str.Qualys_Cloud_Security_Agent
push str.Installation_of_Qualys_Cloud_Agent_by_double_clicking_the_executable_or_installer_file_is_not_supported._For_installation_instructions__refer_to_How_to_install_the_Cloud_Agent_section_in_https:__www.qualys.com_docs_qualys_cloud_agent_windows_install_guide.pdf
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x4473e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_show_message_box_of_install_instructions
push eax
push 0x58ba20
call fcn.00437520
add esp, 0xc
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x448ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], eax
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
jb 0x448cc9
mov esi, dword [ebx]
jmp 0x448ccb
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x448ce7
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x448cd6
and edx, dword [0x58d76c]
mov ecx, dword [0x58d760]
mov edi, dword [0x58d758]
lea eax, [edx + edx]
mov esi, dword [ecx + edx*8]
lea eax, [eax + 1]
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
nop
cmp edx, edi
jne 0x448d18
mov eax, edi
jmp 0x448d1c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x448d5f
push ebx
lea ecx, [esi + 8]
call fcn.00407260
test eax, eax
je 0x448d37
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x448d10
lea edx, [esi + 8]
mov ecx, ebx
push edx
call fcn.00407260
test eax, eax
mov eax, dword [ebp - 8]
cmovne esi, edi
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
pop ebx
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 8
Function at 0x449aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5449a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], eax
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x449af3
mov esi, dword [eax]
jmp 0x449af5
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x449b11
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x449b00
mov eax, dword [ebx + 0x18]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], ecx
mov edi, dword [eax + ecx]
cmp edi, dword [ebx + 4]
jne 0x449b30
mov esi, dword [ebx + 4]
jmp 0x449b36
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x449b57
nop word [eax + eax]
mov esi, dword [esi + 4]
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push eax
call fcn.00407260
test eax, eax
je 0x449ba5
cmp esi, edi
jne 0x449b40
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x449b84
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x20]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x449c21
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x449c41
mov edx, dword [ebp + 0x10]
lea edi, [edx + 8]
mov dword [ebp - 0x18], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x449bd6
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00403300
mov edx, dword [ebp - 0x18]
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x449bec
mov edi, dword [edi]
xor eax, eax
push edx
mov word [edi], ax
call fcn.00451480
mov eax, dword [ebp - 0x1c]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x449c29
mov dword [ecx], edi
jmp 0x449c41
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x449c41
add edx, dword [ebx + 0xc]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00449cf0
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x449c03
Function at 0x449d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x449dbd
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x449dd9
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x449dc8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x449e0f
cmp dword [ecx], edi
jne 0x449e07
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x449e17
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x449e17
cmp dword [ecx], edi
jne 0x449e1a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ebx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [edx + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 8
jb 0x449e42
inc eax
mov ecx, ebx
push eax
push dword [ebx]
call fcn.00403300
mov dword [ebx + 0x14], 7
cmp dword [ebx + 0x14], 8
mov dword [ebx + 0x10], 0
jb 0x449e58
mov ebx, dword [ebx]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.00451480
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 8
Function at 0x44bd70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
push edi
mov edi, edx
test ebx, ebx
je 0x44be75
test edi, edi
je 0x44be75
cmp word [ebx], 0
je 0x44be75
cmp word [edi], 0
je 0x44be75
lea eax, [ebp - 8]
push eax
push 0x10100
push 0
push ebx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
jne 0x44bde5
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x44be4d
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp esi, 2
jne 0x44be18
push dword [ebp - 8]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x44be31
push esi
push edi
push ebx
push str.Could_not_delete_registry_key___s_s_:__ud
push 0x58ba20
call fcn.004372e0
add esp, 0x14
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
push str.Could_not_open_registry_key___s_s_:__ud
push 0x58ba20
call fcn.004372e0
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
Function at 0x44c520
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x1c], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
push 1
push str.O:BAD:_A_OICI_GA___BA__A_OICI_GA___SY_
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x44c592
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Could_not_create_security_descriptor
jmp 0x44c63e
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20106
push 0
push 0
push 0
push str.SoftwareQualysProxy
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x44c5c4
push str.Could_not_create_security_descriptor
jmp 0x44c63e
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ebx, ebx
je 0x44c5f4
mov ecx, ebx
call fcn.004088a0
add eax, eax
push eax
push ebx
push 1
push 0
push 0x5629cc
push dword [ebp - 8]
call edi
mov esi, eax
test esi, esi
je 0x44c5f4
push str.Could_not_create_URL_value
jmp 0x44c63e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x44c61a
push dword [ebp - 0x1c]
push eax
push 3
push 0
push str.Username
push dword [ebp - 8]
call edi
mov esi, eax
test esi, esi
je 0x44c61a
push str.Could_not_create_username_value
jmp 0x44c63e
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44c64c
push dword [ebp - 0x24]
push eax
push 3
push 0
push str.Password
push dword [ebp - 8]
call edi
mov esi, eax
test esi, esi
je 0x44c64c
push str.Could_not_create_password_value
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44c663
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret