joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408955
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408971
xor dword [ecx], edx
add eax, eax
sub eax, 0xa068b5c5
inc ecx
or eax, eax
cmp ecx, esi
jne main
ret

Function at 0x42f1e7
Capabilities:
Encode data using xor

Disassembly:
xor dword [0x3855d301], 0xffffffa6
sbb bl, dl
push ebp
jge fcn.0042f1e7
das
pop ds
jmp 0x42f1e0

Function at 0x48bc7f
Capabilities:
Encode data using xor

Disassembly:
test al, 0x74
mov dword [0x49d18d7d], eax
sub al, 0x21
and dword [ebx + 0xa], ebp
dec ecx
or dword [ebx - 0x401936d6], eax
outsd dx, dword [esi]
and byte [ebx + 0x15], ch
popfd
mov ah, 0xce
into
js 0x48bc1a
call 0x4ce72aea

Function at 0x4a305b
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x863884ce
xor dh, byte [0xe5909a5c]
invalid
nop
invalid
test byte [eax], bh
xchg byte [edx], dh
xor eax, 0xe5909a5c
invalid
nop
invalid
test dword [edi], 0xfee13000
movsd dword es:[edi], dword [esi]
mov edi, 0x4d51dd9d
mov byte [ebx - 0x5ac0be21], dl
sbb edx, esi
pushfd
insb byte es:[edi], dx
je 0x4a3055
sahf
outsd dx, dword [esi]
push esi
daa
add eax, esp
ljmp 0x2f83

Function at 0x4bb7bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33c0
cmp edx, dword [eax]
je 0x4bb7df
add eax, 8
inc ecx
cmp eax, 0x4c3450
jl 0x4bb7d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33c0]
jne 0x4bb90d
mov eax, dword [0x4c8df4]
cmp eax, 1
je 0x4bb8e7
test eax, eax
jne 0x4bb810
cmp dword [0x4c32ec], 1
je 0x4bb8e7
cmp edx, 0xfc
je 0x4bb90d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb847
lea eax, [ebp - 0x1a4]
push 0x4c09e0
push eax
call fcn.004bc1a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc630
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb88a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc630
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09dc
push edi
call fcn.004be500
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c09c0
push eax
call fcn.004bc1a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc1b0
lea eax, [ebp - 0xa0]
push 0x4c09bc
push eax
call fcn.004bc1b0
push dword [esi + 0x4c33c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc1b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0994
push eax
call fcn.004be474
add esp, 0x2c
pop edi
jmp 0x4bb90d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33c4]
push 0
push eax
push dword [esi]
call fcn.004bc630
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4f650b]
shl eax, 2
mov dword [0x4f650f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004e0b28
pop edx
call fcn.004e0a8c
call fcn.004e0b68
push 0
call fcn.004e1f2c
pop ecx
push 0x4f64b4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4f6513], eax
push 0
jmp fcn.004eb9dc
Function at 0x417c04
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov eax, 0x503c4c
call fcn.004e1300
mov dword [ebp - 0x20], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004f419c
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 8
mov dword [ebp - 0x40], 0x103
push 0x44
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.004e0e7c
add esp, 0xc
mov dword [ebp - 0x84], 0x44
lea ecx, [ebp - 0x94]
push ecx
lea eax, [ebp - 0x84]
push eax
mov word [ebp - 0x2c], 0x14
xor edx, edx
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
inc dword [ebp - 0x20]
call fcn.004d6ac0
mov edx, dword [ebp - 4]
test edx, edx
je 0x417c86
mov ecx, dword [ebp - 4]
jmp 0x417c8b
mov ecx, 0x4ff2d1
push ecx
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x417ca2
mov edx, dword [ebp + 8]
jmp 0x417ca7
mov edx, 0x4ff2d0
push edx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
sete al
and eax, 1
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004f4308
pop ecx
test cl, cl
je 0x417dbd
mov word [ebp - 0x2c], 0x20
xor eax, eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
inc dword [ebp - 0x20]
lea edx, [ebp + 8]
mov eax, 0x4ff2d2
call fcn.004f486c
lea edx, [ebp - 8]
push edx
mov edx, 0x4ff2e4
lea eax, [ebp - 0xc]
call fcn.004f4164
inc dword [ebp - 0x20]
lea edx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x20]
pop eax
call fcn.004f4360
lea edx, [ebp - 0x10]
push edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x14]
push eax
inc dword [ebp - 0x20]
call fcn.00416b00
pop ecx
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
pop eax
call fcn.004f4360
lea edx, [ebp - 0x18]
push dword [edx]
call fcn.0041c3a8
pop ecx
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004f4308
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004f4308
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004f4308
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004f4308
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004f4308
or eax, 0xffffffff
push eax
dec dword [ebp - 0x20]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004f4308
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x417e2b
mov cl, byte [ebp + 0xc]
test cl, cl
je 0x417df3
mov eax, dword [ebp - 0x40]
cmp eax, 0x103
jne 0x417df3
push 0x1c2
call fcn.004145d4
pop ecx
lea edx, [ebp - 0x40]
push edx
push dword [ebp - 0x94]
call sub.KERNEL32.DLL_GetExitCodeProcess
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x103
je 0x417dce
push dword [ebp - 0x90]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x94]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x8c]
push eax
dec dword [ebp - 0x20]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004f4308
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x41ac98
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x504a44
call fcn.004e1300
mov dword [ebp - 8], 2
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.004f419c
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004f419c
inc dword [ebp - 8]
push 0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x41acdf
mov ecx, dword [ebp + 0xc]
jmp 0x41ace4
mov ecx, 0x4ffa0a
push ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41acf1
mov edx, dword [ebp + 8]
jmp 0x41acf6
mov edx, 0x4ffa09
push edx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
je 0x41ad30
mov al, 1
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004f4308
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004f4308
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41ad5e
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004f4308
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004f4308
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x41bf60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x505348
call fcn.004e1300
mov byte [ebp - 0x37], 0x3a
mov byte [ebp - 0x36], 0x5c
mov byte [ebp - 0x35], 0
mov dword [ebp - 0x3c], 0x43
mov dl, byte [ebp - 0x3c]
mov byte [ebp - 0x38], dl
lea ecx, [ebp - 0x38]
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
je 0x41bfa2
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x5b
jl 0x41bf83
mov edx, dword [ebp - 0x3c]
cmp edx, 0x5b
jl 0x41bffb
mov word [ebp - 0x1c], 8
mov edx, 0x4ffb74
lea eax, [ebp - 4]
call fcn.004f4164
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004f4338
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x14
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004f4308
pop eax
mov word [ebp - 0x1c], 8
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x41c047
mov word [ebp - 0x1c], 0x20
lea edx, [ebp - 0x38]
lea eax, [ebp - 8]
call fcn.004f4164
mov edx, eax
inc dword [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.004f4338
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x2c
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004f4308
pop eax
mov word [ebp - 0x1c], 0x20
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x41c04c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
mov eax, 0x5053ac
call fcn.004e1300
mov dword [ebp - 0x2c], 0x3e6
mov byte [ebp - 0x414], 0
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x414]
push ecx
call sub.ADVAPI32.DLL_GetUserNameA
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x414]
lea eax, [ebp - 4]
call fcn.004f4164
mov edx, eax
inc dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004f4338
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x14
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004f4308
pop eax
mov word [ebp - 0x18], 8
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x42d4d4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004de568
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
test eax, eax
jns 0x42d4f4
call fcn.004dd5b4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x42d503
test byte [ebp - 0xc], 0x10
jne 0x42d507
xor eax, eax
jmp 0x42d509
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4309c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Wsocket_TSslContext_Lock_qqrv
xor eax, eax
push ebp
push 0x430b4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5c], edx
test byte [ebp - 8], 1
je 0x4309fa
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x400000
test byte [ebp - 8], 2
je 0x430a06
mov eax, dword [ebp - 4]
inc dword [eax + 0x5c]
test byte [ebp - 8], 4
je 0x430a13
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 2
test byte [ebp - 8], 8
je 0x430a20
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 8
test byte [ebp - 8], 0x10
je 0x430a2d
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x10
test byte [ebp - 8], 0x20
je 0x430a3a
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x20
test byte [ebp - 8], 0x40
je 0x430a47
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x40
test byte [ebp - 8], 0x80
je 0x430a57
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x80
test byte [ebp - 7], 1
je 0x430a67
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x100
test byte [ebp - 7], 2
je 0x430a77
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x200
test byte [ebp - 7], 4
je 0x430a87
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x800000
test byte [ebp - 7], 8
je 0x430a97
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x800
test byte [ebp - 7], 0x10
je 0x430aa7
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x100000
test byte [ebp - 7], 0x20
je 0x430ab7
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x200000
test byte [ebp - 7], 0x40
je 0x430ac7
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x1000000
test byte [ebp - 7], 0x80
je 0x430ad7
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x2000000
test byte [ebp - 6], 1
je 0x430ae7
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x4000000
test byte [ebp - 6], 2
je 0x430af7
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x8000000
test byte [ebp - 6], 4
je 0x430b07
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x10000000
test byte [ebp - 6], 8
je 0x430b17
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x20000000
test byte [ebp - 6], 0x10
je 0x430b27
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x10000
test byte [ebp - 6], 0x20
je 0x430b37
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x40000000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430b54
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Wsocket_TSslContext_Unlock_qqrv
ret
Function at 0x45b8f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004de558
xor eax, eax
push ebp
push 0x45b98f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
push 0xf
push 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b996
lea eax, [ebp - 8]
call fcn.004de124
ret

Function at 0x45b9a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004de558
xor eax, eax
push ebp
push 0x45ba3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
push 1
push 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ba42
lea eax, [ebp - 8]
call fcn.004de124
ret
Function at 0x45ba4c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004de558
xor eax, eax
push ebp
push 0x45baf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov eax, dword [ebp - 0xc]
cmp eax, 0xffff
jbe 0x45baa9
call fcn.004dd5b4
push eax
push 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45baff
lea eax, [ebp - 8]
call fcn.004de124
ret

Function at 0x45bb08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004de558
xor eax, eax
push ebp
push 0x45bbc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
push 0xc
push 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call sym.mjrwmon.exe__Dnsquery_ReverseIP_qqrx17System_AnsiString
lea eax, [ebp - 0x10]
mov edx, 0x45bbe0
call fcn.004de3ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bbcf
lea eax, [ebp - 0x10]
call fcn.004de124
lea eax, [ebp - 8]
call fcn.004de124
ret
Function at 0x45d5fc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x45d605
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d7b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Icslogger_TIcsLogger_Lock_qqrv
xor eax, eax
push ebp
push 0x45d791
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 8
je 0x45d651
call fcn.004dde8c
jmp 0x45d798
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 8
je 0x45d71a
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 1
je 0x45d6a4
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x45d6a4
lea eax, [ebp - 0x14]
call sym.mjrwmon.exe__Icslogger_IcsLoggerAddTimeStamp_qqrv
push dword [ebp - 0x14]
push 0x45d7cc
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004de464
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 4
je 0x45d6db
lea eax, [ebp - 0x1c]
call sym.mjrwmon.exe__Icslogger_IcsLoggerAddTimeStamp_qqrv
push dword [ebp - 0x1c]
push 0x45d7cc
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004de464
mov eax, dword [ebp - 0x18]
call fcn.004de568
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 2
je 0x45d77b
lea eax, [ebp - 0x24]
call sym.mjrwmon.exe__Icslogger_IcsLoggerAddTimeStamp_qqrv
push dword [ebp - 0x24]
push 0x45d7cc
push dword [ebp + 8]
push 0x45d7d8
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004de464
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Icslogger_TIcsLogger_WriteToLogFile_qqrx17System_AnsiString
jmp 0x45d77b
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 1
je 0x45d740
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x45d740
mov eax, dword [ebp + 8]
push eax
mov ebx, dword [ebp - 4]
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 4
je 0x45d757
mov eax, dword [ebp + 8]
call fcn.004de568
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 2
je 0x45d77b
lea eax, [ebp - 0x28]
mov ecx, 0x45d7d8
mov edx, dword [ebp + 8]
call fcn.004de3f0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Icslogger_TIcsLogger_WriteToLogFile_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d798
mov eax, dword [ebp - 4]
call sym.mjrwmon.exe__Icslogger_TIcsLogger_UnLock_qqrv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d7ba
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.004de148
ret
Function at 0x45da8c
Capabilities:
Link many functions at runtime

Disassembly:
sub dword [eax], eax
add byte [eax], al
and byte [ecx + 0x63], cl
jae 0x45dae1
dec ecx
inc edx
inc ebp
inc ecx
pop ecx
and byte [eax], ch
arpl word [ecx], bp
and byte [edx], dh
xor byte [eax], dh
xor ebp, dword [0x37303032]
and byte [esi + 0x2e], al
and byte [eax + 0x69], dl
je 0x45db25
and byte gs:[esi + 0x31], dl
xor byte cs:[eax], dh
and byte [eax], al
add byte [eax], al
or bl, bl
inc ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], cl
fild dword [ebp]
or al, 0
add byte [eax], al
add byte [eax - 0x67ffb2b1], ah
dec ecx
inc edx
inc ebp
inc ecx
pop ecx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add byte [eax], al
add byte [eax], al
Function at 0x45db4c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45eddc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [sym.mjrwmon.exe__Icslibeay_ICS_OPENSSL_VERSION_NUMBER], eax
cmp dword [sym.mjrwmon.exe__Icslibeay_GLIBEAY_DLL_Handle], 0
je 0x45db81
mov byte [ebp - 1], 1
jmp 0x45edc1
mov eax, dword [sym.mjrwmon.exe__Icslibeay_GLIBEAY_DLL_Name]
call fcn.004de568
Function at 0x461fa0
Capabilities:
Get file version info

Disassembly:
sub dword [eax], eax
add byte [eax], al
and byte [ecx + 0x63], cl
jae 0x461ffc
push ebx
dec esp
inc ebp
inc ecx
pop ecx
and byte [eax], ch
arpl word [ecx], bp
and byte [edx], dh
xor byte [eax], dh
xor ebp, dword [0x37303032]
and byte [esi + 0x2e], al
and byte [eax + 0x69], dl
cwde
Function at 0x46730c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 4]
mov al, byte [eax]
shl eax, 7
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
shr edx, 1
or al, dl
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
shl eax, 6
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
shr edx, 2
or al, dl
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 2]
shl eax, 5
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 3]
shr edx, 3
or al, dl
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 3]
shl eax, 4
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 4]
shr edx, 4
or al, dl
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 4]
shl eax, 3
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 5]
shr edx, 5
or al, dl
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
shl eax, 2
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 6]
shr edx, 6
or al, dl
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add eax, eax
and al, 0xff
mov byte [ebp - 0x1d], al
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x24]
shl eax, cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
and eax, 1
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jne 0x4673d6
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x24]
and al, 0xfe
or al, byte [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x24], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4673cf
mov eax, dword [ebp - 0xc]
mov edx, 8
call fcn.004de6d8
push 1
mov eax, dword [ebp - 0xc]
call fcn.004de574
mov edx, eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call sym.mjrwmon.exe__Icsdes_DES_qqrpxucpuct1o
mov esp, ebp
pop ebp
ret