joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push str.Protection:_Auth
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov eax, dword [ebp + 8]
push 0x100
push 0
push 0x505dc8
mov dword [0x4fea48], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x478070]
xor cl, 0xb0
mov byte [eax + 0x505dc8], cl
inc eax
cmp eax, 0x1b
jl 0x40f8a0
mov ecx, 0x505dc8
call fcn.0040f430
push 0x100
push 0
push 0x505dc8
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x40f8e0
mov dl, byte [eax + 0x47808c]
xor dl, 0xb0
mov byte [eax + 0x505dc8], dl
inc eax
cmp eax, 0x1f
jl 0x40f8e0
mov ecx, 0x505dc8
call fcn.0040f430
mov eax, dword [0x4fea44]
mov ecx, dword [0x4fea48]
push eax
xor edx, edx
call fcn.0040f990
test al, al
jne 0x40f96f
mov ecx, dword [0x4fea44]
push ecx
mov ecx, dword [0x4fea48]
mov edx, 1
call fcn.0040f990
test al, al
jne 0x40f96f
mov edx, dword [0x4fea44]
mov ecx, dword [0x4fea48]
push edx
mov edx, 2
call fcn.0040f990
test al, al
jne 0x40f96f
cmp byte [0x4feb24], al
jne 0x40f96f
push 0x477d74
mov esi, 0x23
call fcn.004177a0
add esp, 4
push eax
call fcn.0040ffa0
add esp, 4
mov byte [0x4feb24], 1
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop esi
pop ebp
ret 4
Function at 0x411f20
Capabilities:
Create directory

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push str.ScreenShots
mov dword [0x4feb80], esi
mov dword [0x4feb84], esi
mov dword [0x4feb88], esi
mov dword [0x4feb90], esi
mov dword [0x4feb94], esi
mov dword [0x4feb98], esi
mov dword [0x4feba0], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x4feb80]
mov ecx, dword [0x4feb84]
mov ebx, dword [sym.imp.MSVCR100.dll_memmove]
mov edi, eax
cmp eax, ecx
je 0x411f80
push esi
push ecx
push eax
call ebx
add esp, 0xc
mov dword [0x4feb84], edi
mov eax, dword [0x4feb90]
mov ecx, dword [0x4feb94]
mov edi, eax
cmp eax, ecx
je 0x411f9f
push esi
push ecx
push eax
call ebx
add esp, 0xc
mov dword [0x4feb94], edi
pop edi
pop esi
mov eax, 0x4feb80
pop ebx
ret
Function at 0x411ff0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x24], edi
jne 0x41203d
mov eax, dword [0x4feb80]
mov ecx, dword [0x4feb84]
mov dword [0x505db8], edi
mov esi, eax
cmp eax, ecx
je 0x41202b
push edi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov dword [0x4feb84], esi
push edi
push str.ScreenShots
mov dword [0x4feba0], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
inc dword [0x505db8]
cmp dword [ebx + 0x1c], edi
jle 0x4121d6
mov ecx, dword [0x4feb80]
mov eax, 0xffffffd8
sub eax, ebx
lea edi, [ebx + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [0x4feb84]
mov dword [esp + 8], edi
jmp 0x412074
mov edi, dword [esp + 8]
cmp edi, eax
jae 0x4120d8
cmp ecx, edi
ja 0x4120d8
mov esi, dword [0x4feb88]
sub edi, ecx
cmp eax, esi
jne 0x4120cd
mov edx, eax
sub edx, ecx
cmp edx, 0xfffffffe
ja 0x4121de
inc edx
sub esi, ecx
cmp edx, esi
jbe 0x4120cd
mov eax, esi
mov ecx, eax
shr ecx, 1
or esi, 0xffffffff
sub esi, ecx
cmp esi, eax
jae 0x4120af
xor eax, eax
jmp 0x4120b1
add eax, ecx
cmp eax, edx
jae 0x4120b7
mov eax, edx
push eax
mov esi, 0x4feb80
call fcn.00412810
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
test eax, eax
je 0x41213e
mov cl, byte [ecx + edi]
mov byte [eax], cl
jmp 0x412133
mov esi, dword [0x4feb88]
cmp eax, esi
jne 0x41212b
mov edx, eax
sub edx, ecx
cmp edx, 0xfffffffe
ja 0x4121de
inc edx
sub esi, ecx
cmp edx, esi
jbe 0x412127
mov eax, esi
mov ecx, eax
shr ecx, 1
or esi, 0xffffffff
sub esi, ecx
cmp esi, eax
jae 0x412109
xor eax, eax
jmp 0x41210b
add eax, ecx
cmp eax, edx
jae 0x412111
mov eax, edx
push eax
mov esi, 0x4feb80
call fcn.00412810
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
mov edi, dword [esp + 8]
test eax, eax
je 0x41213e
mov dl, byte [edi]
mov byte [eax], dl
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
inc dword [0x4feba0]
inc eax
mov edx, eax
mov dword [0x4feb84], eax
mov esi, dword [ebx + 0x20]
sub edx, ecx
cmp edx, esi
jne 0x4121a2
mov eax, dword [0x4feb90]
mov ecx, dword [0x4feb94]
mov esi, eax
cmp eax, ecx
je 0x412179
push 0
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov dword [0x4feb94], esi
mov eax, 0x4feb80
mov ecx, 0x4feb90
call fcn.004126d0
cmp dword [0x4feba0], 0
je 0x4121b3
mov edx, dword [ebp + 8]
lea eax, [ebx + 5]
lea ecx, [ebx + 0x10]
push eax
call fcn.004121f0
jmp 0x4121b3
jb 0x4121be
push str.ERROR__Buffer_length_bigger_then_expected_size_
push 2
call fcn.00417090
add esp, 8
mov eax, dword [0x4feb84]
mov ecx, dword [0x4feb80]
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
inc edx
add esi, edx
mov dword [esp + 8], edx
cmp esi, dword [ebx + 0x1c]
jl 0x412070
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x412ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x412af8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412b2a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x412b26
cmp esi, eax
jae 0x412b2a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x412b18
cmp esi, eax
jb 0x412b30
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x414600
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
push ebx
push ebx
push ebx
push fcn.00414a20
push ebx
push ebx
mov dword [0x4feba8], 0x46fb00
mov dword [0x4febac], ebx
mov dword [0x4febb0], ebx
mov dword [0x4febb4], ebx
mov dword [0x4febbc], ebx
mov dword [0x4febc0], ebx
mov dword [0x4febc4], ebx
mov dword [0x4febcc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x4febac]
mov ecx, dword [0x4febb0]
mov edi, dword [sym.imp.MSVCR100.dll_memmove]
mov byte [0x4febd0], bl
mov dword [0x4febd4], ebx
mov esi, eax
cmp eax, ecx
je 0x414683
push ebx
push ecx
push eax
call edi
add esp, 0xc
mov dword [0x4febb0], esi
mov eax, dword [0x4febbc]
mov ecx, dword [0x4febc0]
mov esi, eax
cmp eax, ecx
je 0x4146a2
push ebx
push ecx
push eax
call edi
add esp, 0xc
mov dword [0x4febc0], esi
mov byte [0x4febe0], bl
mov dword [0x4febe4], 0xffffffff
mov dword [0x4febf0], ebx
mov dword [0x4febf4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x4febf8], eax
mov dword [0x4fec00], ebx
mov dword [0x4febfc], 0x64
mov eax, 0x4feba8
pop ebx
ret
Function at 0x414d00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call ebx
push 0xa
push esi
mov edi, eax
call ebx
push esi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
cmp edi, eax
jle 0x414d46
cmp ebx, dword [ecx + 8]
jle 0x414d46
mov dword [0x4febe8], eax
mov ecx, dword [ecx + 8]
jmp 0x414d59
mov eax, edi
mov dword [0x4febe8], eax
mov ecx, ebx
mov dword [0x4fec00], 0x64
push 1
mov dword [0x4febec], ecx
add ecx, 0x1e
push ecx
push eax
mov eax, dword [0x4febd4]
push 0
push 0
push eax
mov byte [0x4febd0], 1
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x4febd4]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x415010
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ServerDisplayer:_SafeExitProcess
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
call fcn.004171b0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x208]
push str.Computer:__d
push eax
call ebx
mov edx, dword [0x4fec0c]
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x4fec0c]
push 0x3f7
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [0x4fec0c]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x230]
push ecx
push edx
mov esi, eax
call edi
lea eax, [ebp - 0x240]
push eax
push esi
call edi
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x23c]
push 1
mov edx, eax
sub edx, ecx
push edx
mov edx, dword [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x224]
sub edx, eax
add edx, ecx
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x220]
push eax
push 6
push 0x404
push esi
mov dword [ebp - 0x220], 0x78
mov dword [ebp - 0x21c], 0xd2
mov dword [ebp - 0x218], 0x118
mov dword [ebp - 0x214], 0x1c2
mov dword [ebp - 0x210], 0x244
mov dword [ebp - 0x20c], 0xffffffff
call edi
push str.PREMIUM
lea ecx, [ebp - 0x108]
push str.License:__s
push ecx
call ebx
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0
push 0x401
push esi
call edi
push str.1.8.0
lea eax, [ebp - 0x108]
push str.Version:__s
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0x401
push esi
call edi
call fcn.004171b0
push eax
lea edx, [ebp - 0x108]
push str.Computer:__d
push edx
call ebx
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 2
push 0x401
push esi
call edi
push 0
push 3
push 0x401
push esi
call edi
push 0x4feaf8
lea ecx, [ebp - 0x108]
push str.Expire:__s
push ecx
call ebx
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 4
push 0x401
push esi
call edi
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004183ef
mov esp, ebp
pop ebp
ret
Function at 0x416010
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x74]
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
xor edi, edi
cmp eax, edi
je 0x416038
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x74]
push eax
call ebx
mov dword [esi + 0x74], edi
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x416045
push eax
call ebx
mov dword [esi + 0x70], edi
lea ecx, [esi + 0x38]
call fcn.00410450
lea edi, [esi + 0x14]
mov dword [ebp - 4], 8
mov eax, dword [edi]
test eax, eax
je 0x416071
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi]
push ecx
call ebx
mov dword [edi], 0
add edi, 4
dec dword [ebp - 4]
jne 0x416057
mov eax, dword [esi + 0x10]
test eax, eax
je 0x416096
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edx
call ebx
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x4160a7
push eax
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4160bd
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4160d0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [0x505d24], eax
cmp eax, 0xffffffff
jne 0x416122
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketManager__WSASocket___failed_with_error:__d
push 1
call fcn.00417090
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004183ef
mov esp, ebp
pop ebp
ret
mov eax, 2
push 0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [0x505d2c]
push ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x14]
mov word [ebp - 0x12], ax
mov eax, dword [0x505d24]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x416185
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketManager__bind___failed_with_error:__d
push 1
call fcn.00417090
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004183ef
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x505d24]
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4161bf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketManager__listen___failed_with_error:__d
push 1
call fcn.00417090
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004183ef
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.004183ef
mov esp, ebp
pop ebp
ret
Function at 0x4162b0
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
cmp eax, 8
jbe 0x4162cd
mov eax, 8
push ebx
push esi
push edi
xor edi, edi
mov dword [0x505d54], eax
test eax, eax
je 0x416319
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, 0x505d34
push 0
push 0
push 0x505d20
push 0x416df0
push 0
push 0
call ebx
mov dword [esi], eax
test eax, eax
je 0x416322
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x416341
inc edi
add esi, 4
cmp edi, dword [0x505d54]
jb 0x4162e6
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketManager__CreateThread___failed_with_error:__d
push 1
call fcn.00417090
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketManager__SetThreadPriority___failed_with_error:__d
push 1
call fcn.00417090
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416980
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0x7c
push edi
mov esi, eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ebx, ebx
js 0x4169be
xor eax, eax
cmp ebx, 0x1388
setl al
test eax, eax
je 0x4169be
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4169cd
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004168d0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
add dword [esi + 0x80024], eax
mov eax, dword [ebp + 8]
push ebx
lea edi, [esi + 0x24]
push eax
call fcn.00416400
test al, al
jne 0x416a00
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004168d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x80024]
lea edx, [eax + esi + 0x24]
mov dword [esi + 0x18], edx
mov edx, 0x80000
sub edx, eax
xor eax, eax
push eax
mov dword [esi + 0x1c], eax
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
lea ecx, [esi + 0x14]
imul eax, eax, 0x6c
mov dword [ecx], edx
lea edx, [ebp - 0xc]
push edx
push 1
push ecx
mov ecx, dword [eax + 0x47ac9c]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x416a85
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x416a85
call esi
push eax
push str.Cnh_bo_Client_mt_kt_ni:__d___Bypass
push 1
call fcn.00417090
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, ebx
call fcn.004168d0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x416aa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ebx + 0x7c]
push edi
mov esi, eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x416ade
xor ecx, ecx
cmp eax, 0x1388
setl cl
test ecx, ecx
je 0x416ade
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x416aee
mov ecx, ebx
call fcn.004168d0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add dword [esi + 0x80024], ecx
mov ecx, dword [esi + 0x80024]
mov ebx, eax
mov eax, dword [esi + 0x20]
imul ebx, ebx, 0x6c
add ebx, 0x47ac80
cmp ecx, eax
jl 0x416bd2
mov eax, dword [esi + 0x180028]
test eax, eax
jg 0x416b31
push edi
mov dword [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edi, [esi + 0x24]
cmp eax, 0x80000
jle 0x416ba0
lea eax, [esi + 0x80028]
push 0x80000
push eax
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [esi + 0x180028]
sub eax, 0x80000
push eax
lea ecx, [esi + 0x100028]
mov dword [esi + 0x18], edi
push ecx
lea eax, [esi + 0x80028]
lea edi, [esi + 0x14]
push eax
mov dword [edi], 0x80000
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0x80000
mov dword [esi + 0x80024], 0
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0x18
add dword [esi + 0x180028], 0xfff80000
jmp 0x416be7
push eax
lea edx, [esi + 0x80028]
push edx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [esi + 0x180028]
mov dword [esi + 0x18], edi
lea edi, [esi + 0x14]
add esp, 0xc
mov dword [edi], eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x80024], eax
mov dword [esi + 0x180028], eax
jmp 0x416be0
lea edx, [ecx + esi + 0x24]
lea edi, [esi + 0x14]
sub eax, ecx
mov dword [esi + 0x18], edx
mov dword [edi], eax
mov dword [esi + 0x1c], 1
mov ecx, dword [ebx + 0x1c]
push 0
push esi
push 0
lea eax, [ebp - 8]
push eax
push 1
push edi
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x416c48
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x416c48
call esi
push eax
push str._SocketManager__WSASend___failed_with_error:__d
push 1
call fcn.00417090
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 0xc
call fcn.004168d0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
add esp, 0x1c
push 0x10
push str.Error
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call edi
push eax
call esi
jmp dword [pe_dos_header]

Function at 0x417650
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x476018]
xor eax, ebp
mov dword [ebp - 4], eax
push str.Util:_GetHardwareId
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
push 0x100
push 0
push 0x505dc8
call sub.MSVCR100.dll_memset
mov eax, dword [0x47648c]
mov dl, byte [0x47648e]
add esp, 0xc
push 0
push 0
push 0
push 0
xor al, 0xb0
lea ecx, [ebp - 0x18]
push ecx
mov byte [0x505dc8], al
mov al, byte [0x47648f]
push 0
push 0
xor ah, 0xb0
xor dl, 0xb0
xor al, 0xb0
push 0x505dc8
mov byte [0x505dc9], ah
mov byte [0x505dca], dl
mov byte [0x505dcb], al
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x417731
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [ebp - 0x1a]
movzx edx, word [ebp - 0x1c]
movzx eax, word [ebp - 0x3c]
shl ecx, 0x10
or ecx, edx
mov edx, dword [ebp - 0xa]
xor ecx, 0xb542d8e1
push ecx
movzx ecx, word [ebp - 6]
shl eax, 0x10
or eax, ecx
xor eax, 0xf45bc123
push eax
mov eax, dword [ebp - 0x18]
xor edx, 0x5d78a569
push edx
xor eax, 0x12b586fe
push eax
push 0x47044c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004183ef
mov esp, ebp
pop ebp
ret

Function at 0x4177a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x100
push 0
push 0x505dc8
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
test esi, esi
jle 0x4177e5
mov ecx, dword [ebp + 8]
sub ecx, 0x505dc8
jmp 0x4177d0
mov dl, byte [ecx + eax + 0x505dc8]
xor dl, 0xb0
mov byte [eax + 0x505dc8], dl
inc eax
cmp eax, esi
jl 0x4177d0
mov eax, 0x505dc8
pop ebp
ret