joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de20
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push ebx
push edi
mov ebx, ecx
test eax, eax
je 0x40de4f
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 4], 0
push ebx
push 0x46f048
lea edx, [ebp - 0x108]
call fcn.0040e250
add esp, 8
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40de91
push ebx
push str._s_file_not_found
call fcn.00417b60
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [esi + 8], eax
call fcn.00418a84
add esp, 4
mov dword [esi + 4], eax
cmp eax, ebx
je 0x40ded3
mov edx, dword [esi + 8]
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push edx
push eax
push edi
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
jne 0x40dee7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], ebx
je 0x40df17
xor eax, eax
cmp dword [esi + 8], ebx
jbe 0x40df17
lea esp, [esp]
mov ecx, dword [esi + 4]
add byte [ecx + eax], 0x95
mov edx, dword [esi + 4]
xor byte [eax + edx], 0xca
lea ecx, [eax + edx]
inc eax
cmp eax, dword [esi + 8]
jb 0x40df00
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x7c], eax
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
Function at 0x40ef70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.0045f3c0
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x479b6c], ebx
je 0x40f11b
push ebx
lea eax, [ebp - 0x110]
push eax
push 0x104
push str.HackDetect.dll
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x40efc7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1220]
push ecx
push 0x1000
lea edx, [ebp - 0x1218]
push edx
mov dword [ebp - 0x1220], ebx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x40efb4
mov eax, dword [ebp - 0x1220]
shr eax, 2
mov dword [ebp - 0x121c], ebx
mov dword [ebp - 0x1224], eax
cmp eax, ebx
jle 0x40f11b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ecx]
mov esi, dword [ebp + ebx*4 - 0x1218]
test esi, esi
je 0x40f102
call fcn.0040f490
test al, al
je 0x40f102
mov eax, dword [ebp + ebx*4 - 0x1218]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40f102
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
test eax, eax
je 0x40f0ff
mov ecx, str.GameServer.exe
lea eax, [ebp - 0x218]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f093
test dl, dl
je 0x40f08f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f093
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f073
xor eax, eax
jmp 0x40f098
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f0ff
lea edx, [ebp - 0x110]
push edx
mov ebx, esi
call fcn.0040f130
test al, al
jne 0x40f0ff
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f0b7
sub eax, edx
lea ecx, [ebp - 0x110]
push ecx
mov ebx, eax
call fcn.0040f210
test al, al
mov eax, dword [ebp - 0x121c]
mov ecx, dword [ebp + eax*4 - 0x1218]
lea edx, [ebp - 0x218]
push edx
push ecx
jne 0x40f0f0
push str._ProcessManager___d___s__Could_not_initialize_process_
push 1
jmp 0x40f0f7
push str._ProcessManager___d___s__Initialization_successful_
push 3
call fcn.00417be0
add esp, 0x10
push esi
call edi
mov ebx, dword [ebp - 0x121c]
inc ebx
mov dword [ebp - 0x121c], ebx
cmp ebx, dword [ebp - 0x1224]
jl 0x40f010
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
Function at 0x40f130
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.0045f3c0
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea ecx, [ebp - 0x110c]
push ecx
xor esi, esi
push ebx
mov dword [ebp - 0x10c], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x40f181
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [ebp - 0x10c]
shr edi, 2
test edi, edi
jle 0x40f1e6
nop
mov eax, dword [ebp + esi*4 - 0x110c]
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x40f1e1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f1d8
test dl, dl
je 0x40f1d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f1d8
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f1b8
xor eax, eax
jmp 0x40f1dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f1fa
inc esi
cmp esi, edi
jl 0x40f190
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
Function at 0x40f210
Capabilities:
Check mutex on windows
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 4
push 0x1000
push ebx
push 0
push esi
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x40f25f
mov ecx, dword [ebp - 0x48]
push 0
push ebx
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40f272
push 0x8000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
push 0x46f738
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x40f251
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
lea edx, [ebp - 0x44]
push str.XTMPID_d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x40f251
mov ecx, dword [ebp - 0x4c]
push 0
push 0
push edi
push ecx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x40f302
push 0x8000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push edi
push esi
test eax, eax
je 0x40f33a
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop edi
call fcn.00418a8f
mov esp, ebp
pop ebp
ret 4
Function at 0x4103b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push str.Protection:_Auth
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov eax, dword [ebp + 8]
push 0x100
push 0
push 0x505dc8
mov dword [0x4fea48], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x478070]
xor cl, 0xb0
mov byte [eax + 0x505dc8], cl
inc eax
cmp eax, 0x1b
jl 0x4103e0
mov ecx, 0x505dc8
call fcn.0040ff40
push 0x100
push 0
push 0x505dc8
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x410420
mov dl, byte [eax + 0x47808c]
xor dl, 0xb0
mov byte [eax + 0x505dc8], dl
inc eax
cmp eax, 0x1f
jl 0x410420
mov ecx, 0x505dc8
call fcn.0040ff40
mov eax, dword [0x4fea44]
mov ecx, dword [0x4fea48]
push eax
xor edx, edx
call fcn.004104d0
test al, al
jne 0x4104b4
mov ecx, dword [0x4fea44]
push ecx
mov ecx, dword [0x4fea48]
mov edx, 1
call fcn.004104d0
test al, al
jne 0x4104b4
mov edx, dword [0x4fea44]
mov ecx, dword [0x4fea48]
push edx
mov edx, 2
call fcn.004104d0
test al, al
jne 0x4104b4
cmp byte [0x4feb24], al
jne 0x4104af
push 0x477d74
mov esi, 0x23
call fcn.004182f0
add esp, 4
push eax
call fcn.00410aa0
add esp, 4
call fcn.00410b10
mov byte [0x4feb24], 1
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop esi
pop ebp
ret 4
Function at 0x412a70
Capabilities:
Create directory

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push str.ScreenShots
mov dword [0x4feb80], esi
mov dword [0x4feb84], esi
mov dword [0x4feb88], esi
mov dword [0x4feb90], esi
mov dword [0x4feb94], esi
mov dword [0x4feb98], esi
mov dword [0x4feba0], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x4feb80]
mov ecx, dword [0x4feb84]
mov ebx, dword [sym.imp.MSVCR100.dll_memmove]
mov edi, eax
cmp eax, ecx
je 0x412ad0
push esi
push ecx
push eax
call ebx
add esp, 0xc
mov dword [0x4feb84], edi
mov eax, dword [0x4feb90]
mov ecx, dword [0x4feb94]
mov edi, eax
cmp eax, ecx
je 0x412aef
push esi
push ecx
push eax
call ebx
add esp, 0xc
mov dword [0x4feb94], edi
pop edi
pop esi
mov eax, 0x4feb80
pop ebx
ret
Function at 0x412b40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x24], edi
jne 0x412b8d
mov eax, dword [0x4feb80]
mov ecx, dword [0x4feb84]
mov dword [0x505db8], edi
mov esi, eax
cmp eax, ecx
je 0x412b7b
push edi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov dword [0x4feb84], esi
push edi
push str.ScreenShots
mov dword [0x4feba0], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
inc dword [0x505db8]
cmp dword [ebx + 0x1c], edi
jle 0x412d26
mov ecx, dword [0x4feb80]
mov eax, 0xffffffd8
sub eax, ebx
lea edi, [ebx + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [0x4feb84]
mov dword [esp + 8], edi
jmp 0x412bc4
mov edi, dword [esp + 8]
cmp edi, eax
jae 0x412c28
cmp ecx, edi
ja 0x412c28
mov esi, dword [0x4feb88]
sub edi, ecx
cmp eax, esi
jne 0x412c1d
mov edx, eax
sub edx, ecx
cmp edx, 0xfffffffe
ja 0x412d2e
inc edx
sub esi, ecx
cmp edx, esi
jbe 0x412c1d
mov eax, esi
mov ecx, eax
shr ecx, 1
or esi, 0xffffffff
sub esi, ecx
cmp esi, eax
jae 0x412bff
xor eax, eax
jmp 0x412c01
add eax, ecx
cmp eax, edx
jae 0x412c07
mov eax, edx
push eax
mov esi, 0x4feb80
call fcn.00413360
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
test eax, eax
je 0x412c8e
mov cl, byte [ecx + edi]
mov byte [eax], cl
jmp 0x412c83
mov esi, dword [0x4feb88]
cmp eax, esi
jne 0x412c7b
mov edx, eax
sub edx, ecx
cmp edx, 0xfffffffe
ja 0x412d2e
inc edx
sub esi, ecx
cmp edx, esi
jbe 0x412c77
mov eax, esi
mov ecx, eax
shr ecx, 1
or esi, 0xffffffff
sub esi, ecx
cmp esi, eax
jae 0x412c59
xor eax, eax
jmp 0x412c5b
add eax, ecx
cmp eax, edx
jae 0x412c61
mov eax, edx
push eax
mov esi, 0x4feb80
call fcn.00413360
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
mov edi, dword [esp + 8]
test eax, eax
je 0x412c8e
mov dl, byte [edi]
mov byte [eax], dl
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
inc dword [0x4feba0]
inc eax
mov edx, eax
mov dword [0x4feb84], eax
mov esi, dword [ebx + 0x20]
sub edx, ecx
cmp edx, esi
jne 0x412cf2
mov eax, dword [0x4feb90]
mov ecx, dword [0x4feb94]
mov esi, eax
cmp eax, ecx
je 0x412cc9
push 0
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov dword [0x4feb94], esi
mov eax, 0x4feb80
mov ecx, 0x4feb90
call fcn.00413220
cmp dword [0x4feba0], 0
je 0x412d03
mov edx, dword [ebp + 8]
lea eax, [ebx + 5]
lea ecx, [ebx + 0x10]
push eax
call fcn.00412d40
jmp 0x412d03
jb 0x412d0e
push str.ERROR__Buffer_length_bigger_then_expected_size_
push 2
call fcn.00417be0
add esp, 8
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
inc edx
add esi, edx
mov dword [esp + 8], edx
cmp esi, dword [ebx + 0x1c]
jl 0x412bc0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x413630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x413648
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41367a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x413676
cmp esi, eax
jae 0x41367a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x413668
cmp esi, eax
jb 0x413680
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x415150
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
push ebx
push ebx
push ebx
push fcn.00415570
push ebx
push ebx
mov dword [0x4feba8], 0x46fb74
mov dword [0x4febac], ebx
mov dword [0x4febb0], ebx
mov dword [0x4febb4], ebx
mov dword [0x4febbc], ebx
mov dword [0x4febc0], ebx
mov dword [0x4febc4], ebx
mov dword [0x4febcc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x4febac]
mov ecx, dword [0x4febb0]
mov edi, dword [sym.imp.MSVCR100.dll_memmove]
mov byte [0x4febd0], bl
mov dword [0x4febd4], ebx
mov esi, eax
cmp eax, ecx
je 0x4151d3
push ebx
push ecx
push eax
call edi
add esp, 0xc
mov dword [0x4febb0], esi
mov eax, dword [0x4febbc]
mov ecx, dword [0x4febc0]
mov esi, eax
cmp eax, ecx
je 0x4151f2
push ebx
push ecx
push eax
call edi
add esp, 0xc
mov dword [0x4febc0], esi
mov byte [0x4febe0], bl
mov dword [0x4febe4], 0xffffffff
mov dword [0x4febf0], ebx
mov dword [0x4febf4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x4febf8], eax
mov dword [0x4fec00], ebx
mov dword [0x4febfc], 0x64
mov eax, 0x4feba8
pop ebx
ret
Function at 0x415850
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call ebx
push 0xa
push esi
mov edi, eax
call ebx
push esi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
cmp edi, eax
jle 0x415896
cmp ebx, dword [ecx + 8]
jle 0x415896
mov dword [0x4febe8], eax
mov ecx, dword [ecx + 8]
jmp 0x4158a9
mov eax, edi
mov dword [0x4febe8], eax
mov ecx, ebx
mov dword [0x4fec00], 0x64
push 1
mov dword [0x4febec], ecx
add ecx, 0x1e
push ecx
push eax
mov eax, dword [0x4febd4]
push 0
push 0
push eax
mov byte [0x4febd0], 1
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x4febd4]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x415b60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ServerDisplayer:_SafeExitProcess
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
call fcn.00417d00
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x208]
push str.Computer:__d
push eax
call ebx
mov edx, dword [0x4fec0c]
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x4fec0c]
push 0x3f7
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [0x4fec0c]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x230]
push ecx
push edx
mov esi, eax
call edi
lea eax, [ebp - 0x240]
push eax
push esi
call edi
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x23c]
push 1
mov edx, eax
sub edx, ecx
push edx
mov edx, dword [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x224]
sub edx, eax
add edx, ecx
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x220]
push eax
push 6
push 0x404
push esi
mov dword [ebp - 0x220], 0x78
mov dword [ebp - 0x21c], 0xd2
mov dword [ebp - 0x218], 0x118
mov dword [ebp - 0x214], 0x1c2
mov dword [ebp - 0x210], 0x244
mov dword [ebp - 0x20c], 0xffffffff
call edi
push str.PREMIUM
lea ecx, [ebp - 0x108]
push str.License:__s
push ecx
call ebx
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0
push 0x401
push esi
call edi
push str.1.8.0
lea eax, [ebp - 0x108]
push str.Version:__s
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0x401
push esi
call edi
call fcn.00417d00
push eax
lea edx, [ebp - 0x108]
push str.Computer:__d
push edx
call ebx
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 2
push 0x401
push esi
call edi
push 0
push 3
push 0x401
push esi
call edi
push 0x4feaf8
lea ecx, [ebp - 0x108]
push str.Expire:__s
push ecx
call ebx
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 4
push 0x401
push esi
call edi
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
Function at 0x416b60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x74]
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
xor edi, edi
cmp eax, edi
je 0x416b88
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x74]
push eax
call ebx
mov dword [esi + 0x74], edi
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x416b95
push eax
call ebx
mov dword [esi + 0x70], edi
lea ecx, [esi + 0x38]
call fcn.00410fa0
lea edi, [esi + 0x14]
mov dword [ebp - 4], 8
mov eax, dword [edi]
test eax, eax
je 0x416bc1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi]
push ecx
call ebx
mov dword [edi], 0
add edi, 4
dec dword [ebp - 4]
jne 0x416ba7
mov eax, dword [esi + 0x10]
test eax, eax
je 0x416be6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edx
call ebx
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x416bf7
push eax
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x416c0d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416c20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [0x505d24], eax
cmp eax, 0xffffffff
jne 0x416c72
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketManager__WSASocket___failed_with_error:__d
push 1
call fcn.00417be0
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
mov eax, 2
push 0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [0x505d2c]
push ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x14]
mov word [ebp - 0x12], ax
mov eax, dword [0x505d24]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x416cd5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketManager__bind___failed_with_error:__d
push 1
call fcn.00417be0
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x505d24]
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x416d0f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketManager__listen___failed_with_error:__d
push 1
call fcn.00417be0
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.00418a8f
mov esp, ebp
pop ebp
ret
Function at 0x416e00
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
cmp eax, 8
jbe 0x416e1d
mov eax, 8
push ebx
push esi
push edi
xor edi, edi
mov dword [0x505d54], eax
test eax, eax
je 0x416e69
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, 0x505d34
push 0
push 0
push 0x505d20
push 0x417940
push 0
push 0
call ebx
mov dword [esi], eax
test eax, eax
je 0x416e72
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x416e91
inc edi
add esi, 4
cmp edi, dword [0x505d54]
jb 0x416e36
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketManager__CreateThread___failed_with_error:__d
push 1
call fcn.00417be0
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketManager__SetThreadPriority___failed_with_error:__d
push 1
call fcn.00417be0
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4174d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0x7c
push edi
mov esi, eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ebx, ebx
js 0x41750e
xor eax, eax
cmp ebx, 0x1388
setl al
test eax, eax
je 0x41750e
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41751d
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00417420
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
add dword [esi + 0x80024], eax
mov eax, dword [ebp + 8]
push ebx
lea edi, [esi + 0x24]
push eax
call fcn.00416f50
test al, al
jne 0x417550
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00417420
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x80024]
lea edx, [eax + esi + 0x24]
mov dword [esi + 0x18], edx
mov edx, 0x80000
sub edx, eax
xor eax, eax
push eax
mov dword [esi + 0x1c], eax
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
lea ecx, [esi + 0x14]
imul eax, eax, 0x6c
mov dword [ecx], edx
lea edx, [ebp - 0xc]
push edx
push 1
push ecx
mov ecx, dword [eax + 0x47ac9c]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x4175d5
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x4175d5
call esi
push eax
push str.Cnh_bo_Client_mt_kt_ni:__d___Bypass
push 1
call fcn.00417be0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, ebx
call fcn.00417420
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8