joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001665
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x40
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000741e
leave
ret

Function at 0x10002edf
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x2e8
mov eax, 0x100246a4
call fcn.100074bc
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x2d0], 0x22c
lea eax, [ebp - 0x2d0]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
xor eax, eax
mov dword [ebp - 0x7c], esi
mov word [ebp - 0x8c], ax
lea ecx, [ebp - 0x8c]
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x78], 7
push eax
call fcn.10003a13
cmp dword [ebp - 0x78], 8
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x2d1]
cmovae ecx, dword [ebp - 0x8c]
push edx
mov dword [ebp - 4], esi
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x8c]
cmovae ecx, dword [ebp - 0x8c]
push eax
push ecx
lea ecx, [ebp - 0xa4]
call fcn.1000171b
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.1000409e
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.10002a70
lea ecx, [ebp - 0x2f4]
call fcn.100016f5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push 0x1003c34c
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.10003241
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
lea eax, [ebp - 0xa4]
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.10003241
mov byte [ebp - 4], 1
call fcn.10003de3
add esp, 0x30
test al, al
je 0x10003040
push dword [ebp - 0x2c8]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10003008
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x90], 0x10
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0x74]
push 0x10025580
push eax
call fcn.10001491
lea eax, [ebp - 0x74]
push eax
call fcn.10005a8d
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0xa4]
call fcn.100016f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.10003865
lea eax, [ebp - 0x2d0]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10002f11
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10007477
ret
Function at 0x1000307c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100030e2
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100030c8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
push edi
call fcn.10002180
call fcn.10005b6a
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000741e
leave
ret 4

Function at 0x100030f2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10003144
push esi
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000313c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000741e
leave
ret 4

Function at 0x100038e7
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, 0x5dc
jmp 0x10003933
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
je 0x10003926
push str.DebuggerFound
call fcn.10004765
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10003904
push str.debugger_Detected
call fcn.10004765
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Debugger
call fcn.10005a8d
pop ecx
push 0
call fcn.1000f96e
int3
Function at 0x10004784
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push dword [ebx + 4]
push edi
call fcn.10004818
mov dword [ebx + 4], eax
add eax, 5
push eax
call fcn.10007637
mov ecx, dword [ebx + 4]
add esp, 0xc
mov esi, eax
add ecx, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebx + 4]
push edi
push esi
call fcn.10009840
mov eax, dword [ebx + 4]
mov ecx, edi
sub ecx, esi
add esp, 0xc
sub ecx, 5
mov byte [esi + eax], 0xe9
mov eax, dword [ebx + 4]
mov dword [esi + eax + 1], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], eax
xor ecx, ebp
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
pop edi
mov dword [ebx], esi
pop esi
pop ebx
call fcn.1000741e
leave
ret

Function at 0x10004818
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push eax
push 0x40
push 5
pop edi
push edi
push ebx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, 0x10037054
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, 0x1003705c
push eax
call esi
mov eax, dword [ebx]
mov ecx, 0x10037054
cmp eax, dword [ecx]
jne 0x10004877
movzx eax, byte [ebx + 4]
cmp al, byte [ecx + 4]
jne 0x10004877
push 0xb
pop eax
jmp 0x10004890
mov eax, dword [ebx]
mov ecx, 0x1003705c
cmp eax, dword [ecx]
jne 0x1000488b
movzx eax, byte [ebx + 4]
cmp al, byte [ecx + 4]
je 0x1000488e
mov edi, dword [ebp + 0xc]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000741e
leave
ret
Function at 0x10004f0d
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
test eax, eax
je 0x10005010
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x10e45bb4]
cmp eax, ecx
jne 0x10004f89
push ecx
call fcn.10005c51
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e45bb8]
cmp eax, ecx
jne 0x10004f9f
push ecx
call fcn.10005c51
mov ebx, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e45bbc]
cmp eax, ecx
jne 0x10004fb5
push ecx
call fcn.10005c51
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e45bc0]
cmp eax, ecx
jne 0x10004fcb
push ecx
call fcn.10005c51
mov esi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e45bc4]
cmp eax, ecx
jne 0x10004fe1
push ecx
call fcn.10005c51
pop ecx
mov dword [ebp - 0x2c], eax
jmp 0x10004fe4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x28], 0
je 0x10004ffa
test ebx, ebx
je 0x10004ffa
test edi, edi
je 0x10004ffa
test esi, esi
je 0x10004ffa
test eax, eax
jne 0x10005016
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10004f6f
jmp 0x10005016
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x1000503b
test ebx, ebx
je 0x1000503b
test edi, edi
je 0x1000503b
test esi, esi
je 0x1000503b
cmp dword [ebp - 0x2c], 0
je 0x1000503b
xor eax, eax
jmp 0x1000503e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000741e
leave
ret
Function at 0x1000504d
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [ebp - 0x24]
xor edx, edx
mov edi, dword [ebp - 0x24]
inc edx
mov esi, dword [ebp - 0x24]
test eax, eax
je 0x10005115
mov ecx, dword [ebp - 0x24]
jmp 0x100050b0
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10e45bb4]
push 1
cmove ecx, edx
cmp eax, dword [0x10e45bb8]
mov dword [ebp - 0x28], ecx
cmove ebx, edx
cmp eax, dword [0x10e45bbc]
cmove edi, edx
cmp eax, dword [0x10e45bc0]
cmove esi, edx
cmp eax, dword [0x10e45bc4]
mov edx, dword [ebp - 0x2c]
pop eax
cmove edx, eax
mov dword [ebp - 0x2c], edx
test ecx, ecx
je 0x10005100
test ebx, ebx
je 0x10005100
test edi, edi
je 0x10005100
test esi, esi
je 0x10005100
test edx, edx
jne 0x1000511b
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call sub.KERNEL32.dll_Thread32Next
mov ecx, dword [ebp - 0x28]
test eax, eax
jne 0x100050ad
jmp 0x1000511b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x10005140
test ebx, ebx
je 0x10005140
test edi, edi
je 0x10005140
test esi, esi
je 0x10005140
cmp dword [ebp - 0x2c], 0
je 0x10005140
xor eax, eax
jmp 0x10005143
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000741e
leave
ret

Function at 0x10005152
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x107418fc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10005178
push ebx
push eax
call esi
push dword [0x107418fc]
call edi
mov eax, dword [0x10e45ba4]
test eax, eax
je 0x1000518d
push ebx
push eax
call esi
push dword [0x10e45ba4]
call edi
mov eax, dword [0x10e45ba8]
test eax, eax
je 0x100051a2
push ebx
push eax
call esi
push dword [0x10e45ba8]
call edi
mov eax, dword [0x10e45bac]
test eax, eax
je 0x100051b7
push ebx
push eax
call esi
push dword [0x10e45bac]
call edi
mov eax, dword [0x10e45bb0]
test eax, eax
je 0x100051cc
push ebx
push eax
call esi
push dword [0x10e45bb0]
call edi
pop edi
pop esi
pop ebx
ret
Function at 0x100059ff
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003c398]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1003d650], ebx
jne 0x10005a30
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
mov dword [ebp - 0xc], ebx
call fcn.10001f33
pop ecx
mov edi, 0x7042a2
mov dword [0x1003d650], ebx
push edi
push ebx
mov esi, 0x1003d658
push esi
call fcn.1000b2e0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push dword [0x1003c32c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
push esi
push dword [0x1003c32c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x1003d650], 1
pop ebx
call fcn.1000741e
leave
ret

Function at 0x10005a8d
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.Hack_detected:__s_n
call fcn.10004765
push 0xd0
call fcn.1000fc84
mov edi, eax
mov ecx, esi
add esp, 0xc
mov dword [edi], 3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005abb
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005acc
sub ecx, edx
lea ebx, [edi + 8]
push ecx
push esi
push ebx
call fcn.1000fb60
push 0x10
lea eax, [edi + 0x6c]
push 0x1003d610
push eax
call fcn.1000fb60
add esp, 0x18
push 0
push 0xd0
push edi
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.1000f714
push 2
call fcn.10006189
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xffffffff
jne 0x10005b33
push str.Error_on_send_cheat_packet.
call fcn.10006070
pop ecx
push 2
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.10006070
push ebx
call fcn.10006070
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10005795
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10005b6a
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push 0
mov eax, 0x10024833
call fcn.10007488
and dword [ebp - 4], 0
lea esi, [ebp + 8]
sub esp, 0x18
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push str.Hack_detected:__s_n
call fcn.10004765
mov esi, 0xd0
push esi
call fcn.1000fc84
mov edi, eax
mov dword [edi], 3
lea ebx, [edi + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edi + 4], ecx
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.1000fb60
push 0x10
lea eax, [edi + 0x6c]
push 0x1003d610
push eax
call fcn.1000fb60
add esp, 0x38
push 0
push esi
push edi
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.1000f714
push 2
call fcn.10006189
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xffffffff
jne 0x10005c11
push str.Error_on_send_cheat_packet.
call fcn.10006070
pop ecx
push 2
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.10006070
push ebx
call fcn.10006070
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10005795
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.100016f5
call fcn.10007462
ret

Function at 0x10005c51
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10005c76
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x10005c76
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10005f00
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
push 0
push 2
push 0x1003d5a4
push 0x943796
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.10005f2f
call fcn.10006a0d
call fcn.100062ba
jmp fcn.10005c7a

Function at 0x10005f2f
Capabilities:
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push 0x264
mov eax, 0x10024861
call fcn.100074bc
push 0x1003c330
push 0x10e45be0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x270]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10005f76
push eax
push str.WSAStartup_failed_with_error:__d_n
call fcn.10004765
pop ecx
pop ecx
jmp 0x1000606a
push 0xb8
xor ebx, ebx
lea eax, [ebp - 0xe0]
push ebx
push eax
call fcn.1000b2e0
add esp, 0xc
lea ecx, [ebp - 0xe0]
push 1
push 0x40
push 1
push str.config.ini
call fcn.10004bc2
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], ebx
je 0x10006046
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.10004ad6
pop ecx
pop ecx
lea ecx, [ebp - 0xe0]
call fcn.100069db
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x1003d620
cmovae eax, dword [ebp - 0x28]
xorps xmm0, xmm0
push 0x1003d628
push str.4040
push eax
mov dword [0x1003d628], ebx
movlpd qword [0x1003d638], xmm0
movlpd qword [0x1003d640], xmm0
mov dword [0x1003d62c], ebx
mov dword [0x1003d630], 1
mov dword [0x1003d634], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x10006057
push eax
push str.getaddrinfo_failed_with_error:__d_n
call fcn.10004765
pop ecx
jmp 0x10006050
push str.Failed_to_open_config.ini_n
call fcn.10004765
pop ecx
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [ebp - 0x28]
call fcn.100016f5
lea ecx, [ebp - 0xe0]
call fcn.10004d59
call fcn.10007477
ret
Function at 0x100060d7
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push 0x20
mov eax, 0x10024891
call fcn.100074bc
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [0x1003d38c], eax
mov ecx, 0x1003c334
lea eax, [ebp + 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.10004d30
lea eax, [ebp - 0x2c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10006177
lea eax, [ebp - 0x18]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10006177
mov eax, dword [ebp - 0x18]
xor esi, esi
push edi
push edi
mov dword [ebp - 0x24], eax
inc esi
mov eax, dword [ebp - 0x14]
push 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10006177
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10006177
push edi
push edi
push edi
push 0x1000627e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10006179
mov esi, edi
lea ecx, [ebp + 0xc]
call fcn.100016f5
mov eax, esi
call fcn.10007477
ret
Function at 0x100062ba
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push 0x1003d3a0
push str.Conquer.exe
call fcn.1000579b
mov edi, 0x1003d3c4
push edi
push str...iniMagictype.dat
call fcn.1000579b
push 0x1003d3e8
push str..._servers.dat
call fcn.1000579b
mov ebx, 0x1003d40c
push ebx
push str...iniMagicEffect.ini
call fcn.1000579b
mov esi, 0x1003d430
push esi
push str...iniStrRes.ini
call fcn.1000579b
push 0x1003d478
push 0x10025bbc
call fcn.1000579b
add esp, 0x30
cmp byte [edi], 0x2d
jne 0x100063d3
cmp byte [edi + 1], 0x31
jne 0x100063d3
movzx eax, byte [edi + 2]
test al, al
jne 0x100063d3
cmp byte [ebx], 0x2d
jne 0x100063d3
cmp byte [ebx + 1], 0x31
jne 0x100063d3
movzx eax, byte [ebx + 2]
test al, al
jne 0x100063d3
cmp byte [esi], 0x2d
jne 0x100063d3
cmp byte [esi + 1], 0x31
jne 0x100063d3
movzx eax, byte [esi + 2]
test al, al
jne 0x100063d3
mov ecx, 0x1003d454
cmp byte [ecx], 0x2d
jne 0x100063d3
cmp byte [ecx + 1], 0x31
jne 0x100063d3
movzx eax, byte [ecx + 2]
test al, al
jne 0x100063d3
push 0x1003d3a0
push str.Env_DX8_Conquer.exe
call fcn.1000579b
push edi
push str.ini_Magictype.dat
call fcn.1000579b
push 0x1003d3e8
push str.servers.dat
call fcn.1000579b
push ebx
push str.ini_MagicEffect.ini
call fcn.1000579b
push esi
push str.ini_StrRes.ini
call fcn.1000579b
push 0x1003d478
push str.Env_DX8_CO2Helper.dll
call fcn.1000579b
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push str.Connected_to_the_server..._Sending_the_welcome_hash.
mov dword [0x1003d4d4], eax
call fcn.10004765
push 0xcc
call fcn.1000fc84
mov edi, eax
mov eax, 0x1003d3a0
pop ecx
mov edx, edi
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax + 0x25], cl
inc eax
test cl, cl
jne 0x100063ff
mov edx, edi
mov ecx, 0x1003d3c4
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 4], al
inc ecx
test al, al
jne 0x10006413
mov ecx, edi
sub ecx, ebx
mov al, byte [ebx]
mov byte [ecx + ebx + 0x46], al
inc ebx
test al, al
jne 0x10006422
mov edx, edi
mov ecx, 0x1003d3e8
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 0x67], al
inc ecx
test al, al
jne 0x10006436
mov ecx, edi
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi + 0x88], al
inc esi
test al, al
jne 0x10006445
mov edx, edi
mov ecx, 0x1003d478
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 0xa9], al
inc ecx
test al, al
jne 0x1000645c
push 0
push 0xcc
push edi
mov dword [edi], 1
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.1000f714
pop ecx
pop edi
cmp esi, 0xffffffff
pop esi
pop ebx
je 0x10006496
ret
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Error_with_welcome_buff_n
call fcn.10006070
pop ecx
push 2
push dword [0x1003c300]
call dword [sym.imp.WS2_32.dll_shutdown]
call fcn.10006b7c
int3