joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dfea0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
sub esp, 0x414
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x410], eax
push edi
lea eax, [esp + 4]
push eax
push 1
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 4
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4dff85
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
push edi
push str.ProxyEnable
push eax
call ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.ProxyServer
push eax
call ebx
test eax, eax
jne 0x4dff57
cmp dword [esp + 0x10], 1
jne 0x4dff57
test esi, esi
je 0x4dff50
mov ecx, dword [esi + 0x1e4]
push ecx
call fcn.004934fd
lea edx, [esp + 0x1c]
push edx
call fcn.004b3007
add esp, 8
mov dword [esi + 0x1e4], eax
mov edi, 1
jmp 0x4dff79
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push str.AutoConfigURL
push edx
mov dword [esp + 0x24], 0x400
call ebx
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [esp + 0x414]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00493d56
add esp, 0x414
ret

Function at 0x4e0140
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esi + 0x64]
cmp ebx, 0x19
jne 0x4e0217
push ebp
push edi
lea eax, [esi + 4]
lea edi, [ebx - 0x16]
lea edx, [ebx - 7]
mov ecx, dword [eax - 4]
mov ebp, ecx
shr ecx, 1
and ebp, 1
xor ecx, dword [ebp*4 + 0x5700c0]
add eax, 0x18
xor ecx, dword [eax]
mov dword [eax - 0x1c], ecx
mov ecx, dword [eax - 0x18]
mov ebp, ecx
shr ecx, 1
and ebp, 1
xor ecx, dword [ebp*4 + 0x5700c0]
xor ecx, dword [eax + 4]
mov dword [eax - 0x18], ecx
mov ecx, dword [eax - 0x14]
mov ebp, ecx
shr ecx, 1
and ebp, 1
xor ecx, dword [ebp*4 + 0x5700c0]
xor ecx, dword [eax + 8]
mov dword [eax - 0x14], ecx
mov ecx, dword [eax - 0x10]
mov ebp, ecx
shr ecx, 1
and ebp, 1
xor ecx, dword [ebp*4 + 0x5700c0]
xor ecx, dword [eax + 0xc]
mov dword [eax - 0x10], ecx
mov ecx, dword [eax - 0xc]
mov ebp, ecx
shr ecx, 1
and ebp, 1
xor ecx, dword [ebp*4 + 0x5700c0]
xor ecx, dword [eax + 0x10]
mov dword [eax - 0xc], ecx
mov ecx, dword [eax - 8]
mov ebp, ecx
shr ecx, 1
and ebp, 1
xor ecx, dword [ebp*4 + 0x5700c0]
xor ecx, dword [eax + 0x14]
sub edi, 1
mov dword [eax - 8], ecx
jne 0x4e0158
pop edi
pop ebp
nop
mov eax, dword [esi + edx*4]
mov ecx, eax
and ecx, 1
mov ecx, dword [ecx*4 + 0x5700c0]
xor ecx, dword [esi + edx*4 - 0x48]
shr eax, 1
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0x19
jl 0x4e01f0
mov dword [esi + 0x64], 0
mov ecx, dword [esi + ebx*4]
inc dword [esi + 0x64]
mov edx, ecx
and edx, 0x56b64a
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffb716
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebx
ret
Function at 0x4e0570
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ecx
cmp dword [0x5743c0], 0
jne 0x4e07d4
push ebx
push esi
push edi
mov eax, 0x5742a0
dec eax
mov edi, 0x5742a0
mov dword [0x5743c0], 1
mov byte [0x573da0], 0
mov byte [0x5742a0], 1
mov byte [0x573da1], 0
mov byte [0x5742a1], 3
mov byte [0x573da3], 1
mov ebx, 2
lea esi, [eax + 2]
sub edi, eax
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov cl, dl
add cl, cl
and al, 0x1b
xor cl, dl
xor cl, al
movzx eax, cl
mov byte [eax + 0x573da0], bl
mov byte [edi + esi], cl
inc ebx
inc esi
cmp ebx, 0x100
jl 0x4e05c3
mov byte [0x573628], 0x63
mov byte [0x57358b], 0
mov ecx, 1
movzx edx, cl
movzx eax, byte [edx + 0x573da0]
mov edx, 0x57439f
sub edx, eax
mov dl, byte [edx]
mov al, dl
rol al, 1
xor dl, al
rol al, 1
xor dl, al
rol al, 1
mov bl, al
rol al, 1
xor al, dl
xor al, bl
xor al, 0x63
mov byte [ecx + 0x573628], al
movzx eax, al
mov byte [eax + 0x573528], cl
inc ecx
cmp ecx, 0x100
jl 0x4e0600
mov cl, 1
mov edx, 0x573b40
movzx eax, cl
mov dword [edx], eax
mov al, cl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
add cl, cl
add edx, 4
xor cl, al
cmp edx, 0x573bb8
jl 0x4e0648
xor esi, esi
jmp 0x4e0670
mov dl, byte [esi + 0x573628]
mov al, dl
and al, 0x80
mov cl, al
neg cl
sbb cl, cl
and cl, 0x1b
add dl, dl
mov bl, dl
xor bl, cl
xor bl, byte [esi + 0x573628]
neg al
sbb al, al
and al, 0x1b
xor dl, al
movzx eax, byte [esi + 0x573628]
movzx ecx, bl
mov ebx, dword [0x5700d4]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx edx, dl
or ecx, edx
mov dword [esi*4 + 0x573ea0], ecx
mov cl, byte [esi + 0x573528]
test bl, bl
je 0x4e06f8
test cl, cl
je 0x4e06f8
movzx eax, bl
movzx eax, byte [eax + 0x573da0]
movzx edx, cl
movzx edx, byte [edx + 0x573da0]
add eax, edx
cdq
mov edi, 0xff
idiv edi
mov al, byte [edx + 0x5742a0]
mov byte [esp + 0xe], al
jmp 0x4e06fd
mov byte [esp + 0xe], 0
test bh, bh
je 0x4e072f
test cl, cl
je 0x4e072f
movzx edx, bh
movzx eax, byte [edx + 0x573da0]
movzx edx, cl
movzx edx, byte [edx + 0x573da0]
add eax, edx
cdq
mov edi, 0xff
idiv edi
mov al, byte [edx + 0x5742a0]
mov byte [esp + 0xf], al
jmp 0x4e0734
mov byte [esp + 0xf], 0
mov al, byte [0x5700d6]
test al, al
je 0x4e0767
test cl, cl
je 0x4e0767
movzx edx, al
movzx eax, byte [edx + 0x573da0]
movzx edx, cl
movzx edx, byte [edx + 0x573da0]
add eax, edx
cdq
mov edi, 0xff
idiv edi
mov bl, byte [edx + 0x5742a0]
jmp 0x4e0769
xor bl, bl
mov al, byte [0x5700d7]
test al, al
je 0x4e079c
test cl, cl
je 0x4e079c
movzx eax, al
movzx eax, byte [eax + 0x573da0]
movzx ecx, cl
movzx edx, byte [ecx + 0x573da0]
add eax, edx
cdq
mov ecx, 0xff
idiv ecx
mov dl, byte [edx + 0x5742a0]
jmp 0x4e079e
xor dl, dl
movzx eax, byte [esp + 0xe]
movzx ecx, byte [esp + 0xf]
shl eax, 8
or eax, ecx
shl eax, 8
movzx ecx, bl
or eax, ecx
movzx edx, dl
shl eax, 8
or eax, edx
mov dword [esi*4 + 0x573728], eax
inc esi
cmp esi, 0x100
jl 0x4e0670
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4e0b90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebx
mov ebx, dword [0x573508]
push ebp
push esi
xor ecx, ecx
push edi
test ebx, ebx
jle 0x4e0be1
mov eax, dword [esp + 0x60]
add eax, 2
lea ebx, [ebx]
movzx edx, byte [eax + 1]
movzx esi, byte [eax]
shl edx, 8
or edx, esi
movzx esi, byte [eax - 1]
shl edx, 8
or edx, esi
movzx esi, byte [eax - 2]
shl edx, 8
or edx, esi
xor edx, dword [ecx*4 + 0x573bb8]
inc ecx
mov dword [esp + ecx*4 + 0x18], edx
add eax, 4
cmp ecx, ebx
jl 0x4e0bb0
mov ecx, dword [0x573524]
cmp ecx, 1
lea esi, [esp + 0x3c]
mov edi, ebx
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], esi
jle 0x4e0c96
dec ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
jle 0x4e0c81
mov ebp, eax
mov ecx, 0x57350c
sub ebp, esi
mov dword [esp + 0x10], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x573ea0]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x573ea0]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x573ea0]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x573ea0]
inc edi
xor edx, dword [edi*4 + 0x573bb4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x4e0c14
mov esi, dword [esp + 0x14]
mov ebx, dword [0x573508]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x4e0c03
test ebx, ebx
jle 0x4e0d72
lea edx, [edi*4 + 0x573bb8]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
mov ecx, 0x57350c
mov ebp, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x573628]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x573628]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x573628]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x10]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x573628]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x4e0cc0
test ebx, ebx
jle 0x4e0d72
mov edx, dword [esp + 0x60]
mov edi, eax
add edx, 2
sub edi, esi
mov ebp, ebx
nop
mov ecx, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [edx - 1], al
mov eax, ecx
mov byte [edx - 2], cl
shr eax, 0x10
shr ecx, 0x18
mov dword [esi], 0
mov byte [edx], al
mov byte [edx + 1], cl
mov dword [edi + esi], 0
add esi, 4
add edx, 4
sub ebp, 1
jne 0x4e0d40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x4e1440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
cmp ebp, 0x100
jae 0x4e1482
mov cl, byte [eax]
xor dl, dl
mov esi, eax
test cl, cl
je 0x4e146e
movsx ecx, cl
movzx edx, dl
xor ecx, edx
mov dl, byte [ecx + 0x570870]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4e1458
test edi, edi
je 0x4e1476
sub eax, esi
mov dword [edi], eax
movzx eax, dl
xor edx, edx
div ebp
pop esi
pop ebp
mov eax, edx
ret
push ebx
mov bl, byte [eax]
test bl, bl
jne 0x4e148f
pop ebx
pop esi
xor eax, eax
pop ebp
ret
mov cl, byte [eax + 1]
inc eax
mov dl, bl
inc bl
test cl, cl
je 0x4e14c1
jmp 0x4e14a0
movsx ecx, cl
movzx edx, dl
movzx esi, bl
xor edx, ecx
mov dl, byte [edx + 0x570870]
xor esi, ecx
mov cl, byte [eax + 1]
mov bl, byte [esi + 0x570870]
inc eax
test cl, cl
jne 0x4e14a0
movzx eax, dl
movzx ecx, bl
shl eax, 8
or eax, ecx
xor edx, edx
div ebp
pop ebx
pop esi
pop ebp
mov eax, edx
ret
Function at 0x4e36d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
test ebx, ebx
je 0x4e38ce
test eax, eax
je 0x4e38ce
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e3700
sub eax, edx
push esi
mov esi, eax
mov eax, dword [ebx + 0x1fc]
mov dword [esp + 0xc], esi
test eax, eax
je 0x4e3723
push eax
call fcn.004934fd
add esp, 4
lea eax, [esi + esi + 0x11]
push eax
call fcn.00494940
add esp, 4
cmp dword [ebx + 0xcc], 0
mov dword [ebx + 0x1fc], eax
jne 0x4e3788
lea ecx, [esp + 0x10]
push ecx
call fcn.00499296
mov edx, dword [esp + 0x14]
add esp, 4
or edx, 1
mov dword [ebx + 0x64], edx
mov eax, 1
jmp 0x4e3760
mov ecx, dword [ebx + eax*4 + 0x60]
imul ecx, ecx, 0x10dcd
mov dword [ebx + eax*4 + 0x64], ecx
inc eax
cmp eax, 0x19
jl 0x4e3760
mov dword [ebx + 0xc8], 0
mov dword [ebx + 0xcc], 1
push ebp
push edi
lea esi, [ebx + 0x64]
call fcn.004e0140
push eax
call fcn.004e0140
mov edx, dword [ebx + 0x1fc]
push eax
push str._08x_08x
push edx
call fcn.00496d63
mov eax, dword [ebx + 0x1fc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x38], ecx
xor ecx, ecx
lea ebp, [esp + 0x42]
add esp, 0x10
mov dword [esp + 0x2c], edx
lea edi, [ecx + 3]
lea esi, [ecx + 2]
sub ebp, 3
lea ecx, [ecx]
mov eax, 0xba2e8ba3
mul ecx
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700c8]
xor dl, byte [ecx + 0x56ec40]
mov eax, 0xba2e8ba3
mov byte [esp + ecx + 0x30], dl
lea edx, [esi - 1]
mul edx
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700c9]
xor dl, byte [ecx + 0x56ec41]
mov eax, 0xba2e8ba3
mov byte [esp + ecx + 0x31], dl
mul esi
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700ca]
xor dl, byte [esi + 0x56ec40]
mov eax, 0xba2e8ba3
mov byte [edi + ebp], dl
mul edi
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700cb]
xor dl, byte [edi + 0x56ec40]
add esi, 4
mov byte [esp + ecx + 0x33], dl
add ecx, 4
add edi, 4
cmp esi, 0x12
jl 0x4e37e0
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
mov edi, 1
mov ecx, ebp
call fcn.004e0db0
mov ebx, dword [ebx + 0x1fc]
mov edi, dword [esp + 0x1c]
add esp, 8
xor esi, esi
add ebx, 0x10
test edi, edi
jle 0x4e38cb
lea esp, [esp]
movzx edx, byte [esi + ebp]
push edx
push 0x56ec5c
push ebx
call fcn.00496d63
inc esi
add esp, 0xc
add ebx, 2
cmp esi, edi
jl 0x4e38b0
pop edi
pop ebp
pop esi
mov ecx, dword [esp + 0x34]
pop ebx
xor ecx, esp
call fcn.00493d56
add esp, 0x34
ret
Function at 0x4e38e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x28], eax
test ebx, ebx
je 0x4e3a75
mov eax, ebx
lea edx, [eax + 1]
jmp 0x4e3900
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e3900
sub eax, edx
cmp eax, 0x10
jl 0x4e3a75
mov ecx, eax
and ecx, 0x80000001
jns 0x4e3921
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x4e3a75
add eax, 0xfffffff0
cdq
push ebp
sub eax, edx
push esi
sar eax, 1
add eax, 2
push edi
push eax
call fcn.00494940
mov edx, dword [ebx]
mov ecx, dword [ebx + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 0xc]
mov dword [esp + 0x20], ecx
xor ecx, ecx
lea ebp, [esp + 0x2a]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
lea edi, [ecx + 3]
lea esi, [ecx + 2]
sub ebp, 3
lea esp, [esp]
mov eax, 0xba2e8ba3
mul ecx
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700c8]
xor dl, byte [ecx + str.Preventon_Technologies_Ltd.]
mov eax, 0xba2e8ba3
mov byte [esp + ecx + 0x24], dl
lea edx, [esi - 1]
mul edx
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700c9]
xor dl, byte [ecx + 0x56ec65]
mov eax, 0xba2e8ba3
mov byte [esp + ecx + 0x25], dl
mul esi
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700ca]
xor dl, byte [esi + str.Preventon_Technologies_Ltd.]
mov eax, 0xba2e8ba3
mov byte [edi + ebp], dl
mul edi
shr edx, 3
imul edx, edx, 0xb
mov eax, ecx
sub eax, edx
movzx edx, byte [eax + 0x5700cb]
xor dl, byte [edi + str.Preventon_Technologies_Ltd.]
add esi, 4
mov byte [esp + ecx + 0x27], dl
add ecx, 4
add edi, 4
cmp esi, 0x12
jl 0x4e3970
lea esi, [ebx + 0x10]
xor edi, edi
cmp byte [esi], 0
je 0x4e3a43
cmp byte [esi + 1], 0
je 0x4e3a43
lea eax, [esp + 0x10]
push eax
push 0x56ec80
push esi
call fcn.00505cc3
mov cl, byte [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov byte [edi + edx], cl
add esi, 2
add esp, 0xc
inc edi
cmp byte [esi], 0
jne 0x4e3a16
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
mov byte [edi + esi], 0
push ecx
xor edi, edi
mov ecx, esi
call fcn.004e0db0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00493d56
add esp, 0x2c
ret
mov ecx, dword [esp + 0x28]
xor ecx, esp
xor eax, eax
call fcn.00493d56
add esp, 0x2c
ret
Function at 0x4e44b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x110], eax
test byte [edi + 0x1e8], 4
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x4e4693
lea eax, [esp + 0xc]
mov ecx, edi
call fcn.004dfae0
test eax, eax
je 0x4e4693
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004ddf50
lea ecx, [esp + 0x14]
push 0x56ff84
push ecx
call fcn.005047a9
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4e4692
and dword [edi + 0x1e8], 0xfffffffb
cmp dword [edi + 0x1e4], 0
je 0x4e45d8
push esi
push str.Proxy__________:
call fcn.00506255
mov edx, dword [edi + 0x1e4]
push esi
push edx
call fcn.00506255
push esi
push 0x56ff9c
call fcn.00506255
lea eax, [esp + 0x20]
push eax
mov eax, dword [edi + 0x1e4]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.004dffa0
add esp, 0x24
test eax, eax
je 0x4e45d8
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x4e45aa
push esi
push str.Proxy_Host_____:
call fcn.00506255
mov eax, dword [esp + 0x10]
push esi
push ebx
push 1
push eax
call fcn.0049814f
push esi
push 0x56ffb4
call fcn.00506255
add esp, 0x20
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4e45d7
push esi
push str.Proxy_Port_____:
call fcn.00506255
push ebx
push 0x56ffcc
push esi
call fcn.00506143
push esi
push 0x56ffd0
call fcn.00506255
add esp, 0x1c
pop ebx
push esi
push str.Proxy_Flag_____:
call fcn.00506255
mov ecx, dword [edi + 0x1e8]
push ecx
push 0x56ffe8
push esi
call fcn.00506143
push esi
push 0x56ffec
call fcn.00506255
add esp, 0x1c
cmp dword [edi + 0x1f8], 0
je 0x4e4632
push esi
push str.Proxy_User_____:
call fcn.00506255
mov edx, dword [edi + 0x1f8]
push esi
push edx
call fcn.00506255
push esi
push 0x570004
call fcn.00506255
add esp, 0x18
cmp dword [edi + 0x1fc], 0
je 0x4e4661
push esi
push str.Proxy_Password_:
call fcn.00506255
mov eax, dword [edi + 0x1fc]
push esi
push eax
call fcn.00506255
push esi
push 0x57001c
call fcn.00506255
add esp, 0x18
push esi
push str.Proxy_State____:
call fcn.00506255
mov ecx, dword [edi + 0x1ec]
push ecx
push 0x570034
push esi
call fcn.00506143
push esi
push 0x570038
call fcn.00506255
push esi
call fcn.00497adb
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00493d56
add esp, 0x114
ret
Function at 0x4ec720
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xd0
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xd4]
push eax
push ecx
lea edx, [esp + 0x70]
push str._08lX:_08X
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00496d63
lea eax, [esp + 0x78]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ec786
push ebp
push esi
lea ecx, [esp + 0x70]
push edi
sub eax, edx
push ecx
lea esi, [esp + 0x10]
call fcn.004e82f0
mov edx, esi
lea ecx, [esp + 0x68]
call fcn.004e83a0
push 0x21
call fcn.00494940
mov ebp, eax
add esp, 8
xor esi, esi
mov edi, ebp
jmp 0x4ec7c0
movzx edx, byte [esp + esi + 0x64]
push edx
push 0x56ebe4
push edi
call fcn.00496d63
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x4ec7c0
mov ecx, dword [esp + 0xd8]
mov byte [edi], 0
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00493d56
add esp, 0xd0
ret
Function at 0x4ec800
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x1c4], eax
push ebp
push esi
push edi
push 0x94
lea eax, [esp + 0x3c]
push 0
push eax
mov edi, ecx
call fcn.004948b0
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4ec876
lea esi, [esp + 0x38]
jmp 0x4ec888
call ebp
push eax
push 0x56ebec
call fcn.004ddcb0
add esp, 8
xor esi, esi
push 0x104
lea edx, [esp + 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4ec8bd
call ebp
push eax
push str.F_d
call fcn.004ddcb0
mov eax, dword [0x56ebfc]
add esp, 8
mov dword [esp + 0xcc], eax
jmp 0x4ec8c5
mov byte [esp + 0xcf], 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
lea edx, [esp + 0xe8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4ec8f8
call ebp
push eax
push str.G_d
call fcn.004ddcb0
add esp, 8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x64
call fcn.00494940
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0x49
mov byte [ebp + 1], 0
call fcn.004e2f30
push esi
mov eax, edi
lea esi, [esp + 0x20]
mov edi, ebp
call fcn.004e79e0
mov eax, ebp
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ec931
movzx ecx, word [esp + 0x36]
sub eax, edx
movzx edx, word [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
add eax, ebp
push str.:_08lX:_02lX:_04X:_04X
push eax
call fcn.00496d63
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
call fcn.004ec720
mov ecx, dword [esp + 0x1ec]
add esp, 0x1c
pop edi
mov dword [ebx], eax
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00493d56
add esp, 0x1c8
ret
Function at 0x4f1f20
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push 0x328
call fcn.00494940
push 0x328
mov esi, eax
push 0
push esi
call fcn.004948b0
add esp, 0x10
cmp dword [esi + 0x298], 0
mov dword [esi + 0x29c], 0xc001c001
jl 0x4f1f65
push 0x56de8c
mov ecx, 0x5743a1
mov ebx, esi
call fcn.004e2040
add esp, 4
cmp dword [0x5743a8], 0
jne 0x4f1f9c
cmp dword [esi + 0x298], 0
jl 0x4f1f8b
push 0x56e42c
mov ecx, 0x5743a1
mov ebx, esi
call fcn.004e2040
add esp, 4
push 0x573310
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
inc dword [0x5743a8]
push edi
push 0
push 0
mov eax, esi
call fcn.004e7040
push esi
call fcn.004e2340
mov dword [esi + 0x248], eax
mov dword [esi + 0x24c], edx
mov dword [esi + 0x1c], 0xff
mov dword [esi + 0x10], 0x1000
call fcn.004e3630
lea edi, [esi + 0x208]
push 8
push edi
mov dword [esi + 0x200], eax
call fcn.004ddda0
push str.CProgra
push edi
call fcn.00504e37
add esp, 0x1c
test eax, eax
jne 0x4f202c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
test edi, edi
jne 0x4f2004
mov edi, 0x56de98
push 0x56dea0
call fcn.004aba60
add esp, 4
test eax, eax
jne 0x4f201a
mov eax, 0x56deb0
push eax
push edi
push str.zaG_s__s
lea edi, [esi + 0x18]
call fcn.004ddcb0
add esp, 0xc
lea ecx, [esi + 0x18]
lea ebx, [esi + 0x284]
call fcn.004ec800
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x10]
push eax
call fcn.004b3007
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esi + 0x14c], eax
call fcn.004b3007
mov dword [esi + 0x150], eax
call fcn.004de310
push str.I3c00
mov dword [esi + 0x320], eax
call fcn.004b3007
mov dword [esi + 0x2c], eax
push 0x21
mov edi, 0x898e5
mov eax, esi
call fcn.004e71e0
add esp, 0x10
cmp dword [esi + 0x298], 0
pop edi
jl 0x4f20a4
push 0x56decc
mov ecx, 0x5743a1
mov ebx, esi
call fcn.004e2040
add esp, 4
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4fc5b0
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
test eax, eax
je 0x4fc5ef
cmp dword [eax + 0x10], 0
je 0x4fc5ef
mov edi, dword [eax + 0x38]
mov esi, dword [eax + 0x34]
xor eax, eax
call fcn.004fc220
test eax, eax
je 0x4fc621
push esi
mov ecx, eax
call fcn.004fc3c0
add esp, 4
test eax, eax
je 0x4fc621
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_AnimateWindow]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
ret
xor eax, eax
call fcn.004fc220
test eax, eax
je 0x4fc621
push 2
mov ecx, eax
call fcn.004fc3c0
add esp, 4
test eax, eax
je 0x4fc621
push eax
push 0x12c
push ebx
call dword [sym.imp.USER32.dll_AnimateWindow]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
ret
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
ret