joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000139e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1003a2c0], 0
push ebx
je 0x100013bc
xor eax, eax
jmp 0x1000140e
push 3
call fcn.1000122a
xor ebx, ebx
pop ecx
test eax, eax
je 0x1000141b
sub esp, 0x18
mov ecx, esp
push 3
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
push 0x1002330c
mov byte [ecx], bl
call fcn.10001340
push 0x19d1
lea ecx, [ebp - 0x69]
call fcn.100014d3
lea ecx, [ebp - 0x69]
call fcn.1000151b
mov dword [0x1003a2c0], 1
call fcn.10005d05
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10006764
leave
ret
push ebx
push ebx
push ebx
push 0x100012b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 3
lea eax, [ebp - 0x68]
push str.You_cannot_open_more_than__d_clients_at_the_same_time.
push eax
call fcn.10001491
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x40000
push str.WARNING
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.100012cd
int3

Function at 0x1000151b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.10006780
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
xor edi, edi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.1000a560
add esp, 0xc
lea eax, [ebp - 0x1004]
mov ebx, edi
push edi
push eax
push 0x800
push 0x100233ac
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1000159c
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x1004]
push eax
push edi
push 0x100233d0
push str.Screen
call esi
mov ebx, eax
lea eax, [ebp - 0x1004]
push eax
push edi
push str.FullScreen
push str.Screen
call esi
mov edi, eax
mov esi, str.shehabloader2023
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100015a6
sub ecx, edx
push ecx
push esi
push dword [0x1003a2d0]
call fcn.10001665
add esp, 0xc
cmp edi, 1
jl 0x100015ee
lea eax, [ebp - 0x1018]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push dword [ebp - 0x100c]
push dword [ebp - 0x1010]
call fcn.10001621
add esp, 0xc
pop edi
pop esi
cmp ebx, 1
pop ebx
jl 0x10001615
push 2
lea eax, [ebp - 0x1008]
mov word [ebp - 0x1008], 0xdeb
push eax
push 0x6c6c7e
call fcn.10001665
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006764
leave
ret
Function at 0x10001665
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x40
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10006764
leave
ret

Function at 0x10002edf
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x2e8
mov eax, 0x10022a34
call fcn.1000680c
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x2d0], 0x22c
lea eax, [ebp - 0x2d0]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
xor eax, eax
mov dword [ebp - 0x7c], esi
mov word [ebp - 0x8c], ax
lea ecx, [ebp - 0x8c]
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x78], 7
push eax
call fcn.10003a13
cmp dword [ebp - 0x78], 8
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x2d1]
cmovae ecx, dword [ebp - 0x8c]
push edx
mov dword [ebp - 4], esi
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x8c]
cmovae ecx, dword [ebp - 0x8c]
push eax
push ecx
lea ecx, [ebp - 0xa4]
call fcn.1000171b
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.1000409e
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.10002a70
lea ecx, [ebp - 0x2f4]
call fcn.100016f5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push 0x1003936c
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.10003241
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
lea eax, [ebp - 0xa4]
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.10003241
mov byte [ebp - 4], 1
call fcn.10003de3
add esp, 0x30
test al, al
je 0x10003040
push dword [ebp - 0x2c8]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10003008
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x90], 0x10
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0x74]
push 0x10023580
push eax
call fcn.10001491
lea eax, [ebp - 0x74]
push eax
call fcn.1000587d
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0xa4]
call fcn.100016f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.10003865
lea eax, [ebp - 0x2d0]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10002f11
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100067c7
ret
Function at 0x1000307c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100030e2
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100030c8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
push edi
call fcn.10002180
call fcn.1000595a
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10006764
leave
ret 4

Function at 0x100030f2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10003144
push esi
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000313c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006764
leave
ret 4

Function at 0x100038e7
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, 0x5dc
jmp 0x10003933
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
je 0x10003926
push str.DebuggerFound
call fcn.10004765
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10003904
push str.debugger_Detected
call fcn.10004765
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Debugger
call fcn.1000587d
pop ecx
push 0
call fcn.1000ebee
int3
Function at 0x10004784
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push dword [ebx + 4]
push edi
call fcn.10004818
mov dword [ebx + 4], eax
add eax, 5
push eax
call fcn.10006987
mov ecx, dword [ebx + 4]
add esp, 0xc
mov esi, eax
add ecx, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebx + 4]
push edi
push esi
call fcn.10008ac0
mov eax, dword [ebx + 4]
mov ecx, edi
sub ecx, esi
add esp, 0xc
sub ecx, 5
mov byte [esi + eax], 0xe9
mov eax, dword [ebx + 4]
mov dword [esi + eax + 1], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], eax
xor ecx, ebp
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
pop edi
mov dword [ebx], esi
pop esi
pop ebx
call fcn.10006764
leave
ret

Function at 0x10004818
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push eax
push 0x40
push 5
pop edi
push edi
push ebx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, 0x10034054
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, 0x1003405c
push eax
call esi
mov eax, dword [ebx]
mov ecx, 0x10034054
cmp eax, dword [ecx]
jne 0x10004877
movzx eax, byte [ebx + 4]
cmp al, byte [ecx + 4]
jne 0x10004877
push 0xb
pop eax
jmp 0x10004890
mov eax, dword [ebx]
mov ecx, 0x1003405c
cmp eax, dword [ecx]
jne 0x1000488b
movzx eax, byte [ebx + 4]
cmp al, byte [ecx + 4]
je 0x1000488e
mov edi, dword [ebp + 0xc]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006764
leave
ret
Function at 0x10004c8b
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x30], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
je 0x10004db1
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x10e42b18]
cmp eax, ecx
jne 0x10004d0d
push ecx
call fcn.10005a41
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e42b1c]
cmp eax, ecx
jne 0x10004d24
push ecx
call fcn.10005a41
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e42b20]
cmp eax, ecx
jne 0x10004d3a
push ecx
call fcn.10005a41
mov ebx, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e42b24]
cmp eax, ecx
jne 0x10004d50
push ecx
call fcn.10005a41
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e42b28]
cmp eax, ecx
jne 0x10004d66
push ecx
call fcn.10005a41
mov esi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e42b2c]
cmp eax, ecx
jne 0x10004d7c
push ecx
call fcn.10005a41
pop ecx
mov dword [ebp - 0x30], eax
jmp 0x10004d7f
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], 0
je 0x10004d9b
cmp dword [ebp - 0x2c], 0
je 0x10004d9b
test ebx, ebx
je 0x10004d9b
test edi, edi
je 0x10004d9b
test esi, esi
je 0x10004d9b
test eax, eax
jne 0x10004db7
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10004cf3
jmp 0x10004db7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x10004de2
cmp dword [ebp - 0x2c], 0
je 0x10004de2
test ebx, ebx
je 0x10004de2
test edi, edi
je 0x10004de2
test esi, esi
je 0x10004de2
cmp dword [ebp - 0x30], 0
je 0x10004de2
xor eax, eax
jmp 0x10004de5
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006764
leave
ret
Function at 0x10004df4
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x28], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x34], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov dword [ebp - 0x24], 1
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
test eax, eax
je 0x10004ee4
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10e42b18]
push 1
cmove edx, dword [ebp - 0x24]
cmp eax, dword [0x10e42b1c]
mov dword [ebp - 0x2c], edx
pop edx
cmove ecx, edx
cmp eax, dword [0x10e42b20]
push 1
cmove ebx, edx
mov dword [ebp - 0x30], ecx
cmp eax, dword [0x10e42b24]
cmove edi, edx
cmp eax, dword [0x10e42b28]
cmove esi, edx
mov edx, dword [ebp - 0x28]
cmp eax, dword [0x10e42b2c]
mov eax, edx
mov dword [ebp - 0x28], edx
pop edx
cmove eax, edx
cmp dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], eax
je 0x10004ec8
test ecx, ecx
je 0x10004ec8
test ebx, ebx
je 0x10004ec8
test edi, edi
je 0x10004ec8
test esi, esi
je 0x10004ec8
test eax, eax
jne 0x10004ef0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x34]
call sub.KERNEL32.dll_Thread32Next
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
test eax, eax
jne 0x10004e5d
jmp 0x10004ef0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 0
je 0x10004f1b
cmp dword [ebp - 0x30], 0
je 0x10004f1b
test ebx, ebx
je 0x10004f1b
test edi, edi
je 0x10004f1b
test esi, esi
je 0x10004f1b
cmp dword [ebp - 0x28], 0
je 0x10004f1b
xor eax, eax
jmp 0x10004f1e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006764
leave
ret

Function at 0x10004f2d
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x1073e85c]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10004f53
push ebx
push eax
call esi
push dword [0x1073e85c]
call edi
mov eax, dword [0x10e42b04]
test eax, eax
je 0x10004f68
push ebx
push eax
call esi
push dword [0x10e42b04]
call edi
mov eax, dword [0x10e42b08]
test eax, eax
je 0x10004f7d
push ebx
push eax
call esi
push dword [0x10e42b08]
call edi
mov eax, dword [0x10e42b0c]
test eax, eax
je 0x10004f92
push ebx
push eax
call esi
push dword [0x10e42b0c]
call edi
mov eax, dword [0x10e42b10]
test eax, eax
je 0x10004fa7
push ebx
push eax
call esi
push dword [0x10e42b10]
call edi
mov eax, dword [0x10e42b14]
test eax, eax
je 0x10004fbc
push ebx
push eax
call esi
push dword [0x10e42b14]
call edi
pop edi
pop esi
pop ebx
ret
Function at 0x100057ef
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1003a5b0], ebx
jne 0x10005820
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
mov dword [ebp - 0xc], ebx
call fcn.10001f33
pop ecx
mov edi, 0x7042a2
mov dword [0x1003a5b0], ebx
push edi
push ebx
mov esi, 0x1003a5b8
push esi
call fcn.1000a560
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push dword [0x1003934c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
push esi
push dword [0x1003934c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x1003a5b0], 1
pop ebx
call fcn.10006764
leave
ret

Function at 0x1000587d
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.Hack_detected:__s_n
call fcn.10004765
push 0xd0
call fcn.1000eeb4
mov edi, eax
mov ecx, esi
add esp, 0xc
mov dword [edi], 3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100058ab
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100058bc
sub ecx, edx
lea ebx, [edi + 8]
push ecx
push esi
push ebx
call fcn.1000ed90
push 0x10
lea eax, [edi + 0x6c]
push 0x1003a570
push eax
call fcn.1000ed90
add esp, 0x18
push 0
push 0xd0
push edi
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.1000e994
push 2
call fcn.10005f07
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xffffffff
jne 0x10005923
push str.Error_on_send_cheat_packet.
call fcn.10005dee
pop ecx
push 2
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.10005dee
push ebx
call fcn.10005dee
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10005585
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000595a
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push 0
mov eax, 0x10022b76
call fcn.100067d8
and dword [ebp - 4], 0
lea esi, [ebp + 8]
sub esp, 0x18
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push str.Hack_detected:__s_n
call fcn.10004765
mov esi, 0xd0
push esi
call fcn.1000eeb4
mov edi, eax
mov dword [edi], 3
lea ebx, [edi + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edi + 4], ecx
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.1000ed90
push 0x10
lea eax, [edi + 0x6c]
push 0x1003a570
push eax
call fcn.1000ed90
add esp, 0x38
push 0
push esi
push edi
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.1000e994
push 2
call fcn.10005f07
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xffffffff
jne 0x10005a01
push str.Error_on_send_cheat_packet.
call fcn.10005dee
pop ecx
push 2
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.10005dee
push ebx
call fcn.10005dee
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10005585
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.100016f5
call fcn.100067b2
ret

Function at 0x10005a41
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10005a66
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x10005a66
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10005d05
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
push 0
push 2
push 0x1003a504
push 0x943796
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.10005d34
call fcn.10006537
call fcn.10006038
jmp fcn.10005a6a

Function at 0x10005e55
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push 0x20
mov eax, 0x10022b99
call fcn.1000680c
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [0x1003a2ec], eax
mov ecx, 0x10039354
lea eax, [ebp + 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.10004b6f
lea eax, [ebp - 0x2c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10005ef5
lea eax, [ebp - 0x18]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10005ef5
mov eax, dword [ebp - 0x18]
xor esi, esi
push edi
push edi
mov dword [ebp - 0x24], eax
inc esi
mov eax, dword [ebp - 0x14]
push 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10005ef5
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10005ef5
push edi
push edi
push edi
push 0x10005ffc
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10005ef7
mov esi, edi
lea ecx, [ebp + 0xc]
call fcn.100016f5
mov eax, esi
call fcn.100067c7
ret
Function at 0x10006038
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push 0x1003a300
push str.Conquer.exe
call fcn.1000558b
mov edi, 0x1003a324
push edi
push str...iniMagictype.dat
call fcn.1000558b
push 0x1003a348
push str..._servers.dat
call fcn.1000558b
mov ebx, 0x1003a36c
push ebx
push str...iniMagicEffect.ini
call fcn.1000558b
mov esi, 0x1003a390
push esi
push str...iniStrRes.ini
call fcn.1000558b
push 0x1003a3d8
push 0x10023b44
call fcn.1000558b
add esp, 0x30
cmp byte [edi], 0x2d
jne 0x10006151
cmp byte [edi + 1], 0x31
jne 0x10006151
movzx eax, byte [edi + 2]
test al, al
jne 0x10006151
cmp byte [ebx], 0x2d
jne 0x10006151
cmp byte [ebx + 1], 0x31
jne 0x10006151
movzx eax, byte [ebx + 2]
test al, al
jne 0x10006151
cmp byte [esi], 0x2d
jne 0x10006151
cmp byte [esi + 1], 0x31
jne 0x10006151
movzx eax, byte [esi + 2]
test al, al
jne 0x10006151
mov ecx, 0x1003a3b4
cmp byte [ecx], 0x2d
jne 0x10006151
cmp byte [ecx + 1], 0x31
jne 0x10006151
movzx eax, byte [ecx + 2]
test al, al
jne 0x10006151
push 0x1003a300
push str.Env_DX8_Conquer.exe
call fcn.1000558b
push edi
push str.ini_Magictype.dat
call fcn.1000558b
push 0x1003a348
push str.servers.dat
call fcn.1000558b
push ebx
push str.ini_MagicEffect.ini
call fcn.1000558b
push esi
push str.ini_StrRes.ini
call fcn.1000558b
push 0x1003a3d8
push str.Env_DX8_CO2Helper.dll
call fcn.1000558b
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push str.Connected_to_the_server..._Sending_the_welcome_hash.
mov dword [0x1003a434], eax
call fcn.10004765
push 0xcc
call fcn.1000eeb4
mov edi, eax
mov eax, 0x1003a300
pop ecx
mov edx, edi
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax + 0x25], cl
inc eax
test cl, cl
jne 0x1000617d
mov edx, edi
mov ecx, 0x1003a324
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 4], al
inc ecx
test al, al
jne 0x10006191
mov ecx, edi
sub ecx, ebx
mov al, byte [ebx]
mov byte [ecx + ebx + 0x46], al
inc ebx
test al, al
jne 0x100061a0
mov edx, edi
mov ecx, 0x1003a348
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 0x67], al
inc ecx
test al, al
jne 0x100061b4
mov ecx, edi
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi + 0x88], al
inc esi
test al, al
jne 0x100061c3
mov edx, edi
mov ecx, 0x1003a3d8
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 0xa9], al
inc ecx
test al, al
jne 0x100061da
push 0
push 0xcc
push edi
mov dword [edi], 1
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.1000e994
pop ecx
pop edi
cmp esi, 0xffffffff
pop esi
pop ebx
je 0x10006214
ret
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Error_with_welcome_buff_n
call fcn.10005dee
pop ecx
push 2
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_shutdown]
call fcn.1000660f
int3