joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4deb70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fafd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004d3ab5
mov eax, dword [0x5b7c60]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004d39e7
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004df6b0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4dec17
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4dec0e
cmp al, 0xff
je 0x4dec0e
dec al
mov byte [ecx], al
jmp 0x4dec17
push ecx
call fcn.004e8a5f
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4dec48
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4dec3f
cmp al, 0xff
je 0x4dec3f
dec al
mov byte [ecx], al
jmp 0x4dec48
push ecx
call fcn.004e8a5f
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4eb0c3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4eb0fb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004e9150
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004e9128
jmp 0x4eb107
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ec7b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ec7f3
call fcn.004f2dc5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ec7f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ec7ea
xor eax, eax
jmp 0x4ec7fb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ec801
pop edi
pop esi
pop ebx
ret 4

Function at 0x4f32f5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f3323
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f3341
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f325b
jmp 0x4f3341
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f3341
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f325b
test edi, edi
mov eax, edi
jne 0x4f332b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001594
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100406a8], 0
push ebx
je 0x100015b2
xor eax, eax
jmp 0x10001604
push 3
call fcn.10001398
xor ebx, ebx
pop ecx
test eax, eax
je 0x10001613
sub esp, 0x18
mov ecx, esp
push 3
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
push 0x1002936c
mov byte [ecx], bl
call fcn.10001536
push 0x19d1
lea ecx, [ebp - 0x69]
call fcn.100016cb
lea ecx, [ebp - 0x69]
call fcn.1000171f
mov dword [0x100406a8], 1
call fcn.100067d0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push ebx
push 0x10001420
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 3
lea eax, [ebp - 0x68]
push str.You_cannot_open_more_than__d_clients_at_the_same_time.
push eax
call fcn.10001689
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x40000
push str.WARNING
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1000143d
int3

Function at 0x1000171f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.10008390
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.1000e120
add esp, 0xc
lea eax, [ebp - 0x1004]
mov esi, ebx
mov edi, ebx
push ebx
push eax
push 0x800
push 0x1002943c
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x100017a2
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x1004]
push eax
push ebx
push 0x10029460
mov ebx, str.Screen
push ebx
call esi
mov edi, eax
lea eax, [ebp - 0x1004]
push eax
push 0
push str.FullScreen
push ebx
call esi
mov esi, eax
xor ebx, ebx
mov ecx, str.shehabnagahx2024
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100017aa
sub ecx, edx
push ecx
push str.shehabnagahx2024
push dword [0x100406b8]
call fcn.100018cd
add esp, 0xc
cmp esi, 1
jl 0x100017f0
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push dword [ebp - 0x1008]
push dword [ebp - 0x100c]
jmp 0x100017fb
push ebx
push 0x300
push 0x400
call fcn.10001834
add esp, 0xc
cmp edi, 1
jl 0x10001823
push ebx
push 8
push 0x1003a13c
push dword [0x100406c0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret
Function at 0x100018cd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x40
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret

Function at 0x1000307f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x2e8
mov eax, 0x100283c0
call fcn.1000866d
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x2d0], 0x22c
lea eax, [ebp - 0x2d0]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
xor eax, eax
mov dword [ebp - 0x7c], esi
mov word [ebp - 0x8c], ax
lea ecx, [ebp - 0x8c]
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x78], 7
push eax
call fcn.10003ae9
cmp dword [ebp - 0x78], 8
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x2d1]
cmovae ecx, dword [ebp - 0x8c]
push edx
mov dword [ebp - 4], esi
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x8c]
cmovae ecx, dword [ebp - 0x8c]
push eax
push ecx
lea ecx, [ebp - 0xa4]
call fcn.10001988
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.100041df
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.10002c5c
lea ecx, [ebp - 0x2f4]
call fcn.1000195f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push 0x1003f4d4
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.100033ec
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
lea eax, [ebp - 0xa4]
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.100033ec
mov byte [ebp - 4], 1
call fcn.10003eb8
add esp, 0x30
test al, al
je 0x100031e0
push dword [ebp - 0x2c8]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100031a8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x90], 0x10
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0x74]
push 0x10029610
push eax
call fcn.10001689
lea eax, [ebp - 0x74]
push eax
call fcn.10006325
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0xa4]
call fcn.1000195f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.1000397c
lea eax, [ebp - 0x2d0]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100030b1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10008628
ret
Function at 0x1000321c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10003282
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10003268
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
push edi
call fcn.100023b2
call fcn.10006402
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000837d
mov esp, ebp
pop ebp
ret 4

Function at 0x10003294
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100032e6
push esi
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100032de
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837d
mov esp, ebp
pop ebp
ret 4

Function at 0x100039bd
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, 0x5dc
jmp 0x10003a09
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
je 0x100039fc
push str.DebuggerFound
call fcn.10004977
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100039da
push str.debugger_Detected
call fcn.10004977
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Debugger
call fcn.10006325
pop ecx
push 0
call fcn.1001273e
int3
Function at 0x10004996
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push dword [ebx + 4]
push edi
call fcn.10004a2c
mov dword [ebx + 4], eax
add eax, 5
push eax
call fcn.100087e7
mov ecx, dword [ebx + 4]
add esp, 0xc
mov esi, eax
add ecx, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebx + 4]
push edi
push esi
call fcn.1000c620
mov eax, dword [ebx + 4]
mov ecx, edi
sub ecx, esi
add esp, 0xc
sub ecx, 5
mov byte [esi + eax], 0xe9
mov eax, dword [ebx + 4]
mov dword [esi + eax + 1], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], eax
xor ecx, ebp
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
pop edi
mov dword [ebx], esi
pop esi
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret

Function at 0x10004a2c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push eax
push 0x40
push 5
pop edi
push edi
push ebx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, 0x1003a144
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, 0x1003a14c
push eax
call esi
mov eax, dword [ebx]
mov ecx, 0x1003a144
cmp eax, dword [ecx]
jne 0x10004a8b
movzx eax, byte [ebx + 4]
cmp al, byte [ecx + 4]
jne 0x10004a8b
push 0xb
pop eax
jmp 0x10004aa4
mov eax, dword [ebx]
mov ecx, 0x1003a14c
cmp eax, dword [ecx]
jne 0x10004a9f
movzx eax, byte [ebx + 4]
cmp al, byte [ecx + 4]
je 0x10004aa2
mov edi, dword [ebp + 0xc]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret
Function at 0x100055e8
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
xor eax, eax
lea edi, [ebp - 0x1c]
and dword [ebp - 0x34], eax
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
je 0x10005728
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x10e48ce8]
cmp eax, ecx
jne 0x10005667
push ecx
call fcn.100064e9
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e48cec]
cmp eax, ecx
jne 0x1000567e
push ecx
call fcn.100064e9
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e48cf0]
cmp eax, ecx
jne 0x10005695
push ecx
call fcn.100064e9
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e48cf4]
cmp eax, ecx
jne 0x100056ab
push ecx
call fcn.100064e9
mov ebx, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e48cf8]
cmp eax, ecx
jne 0x100056c1
push ecx
call fcn.100064e9
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e48cfc]
cmp eax, ecx
jne 0x100056d7
push ecx
call fcn.100064e9
mov esi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e48d00]
cmp eax, ecx
jne 0x100056ed
push ecx
call fcn.100064e9
pop ecx
mov dword [ebp - 0x34], eax
jmp 0x100056f0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], 0
je 0x10005712
cmp dword [ebp - 0x2c], 0
je 0x10005712
cmp dword [ebp - 0x30], 0
je 0x10005712
test ebx, ebx
je 0x10005712
test edi, edi
je 0x10005712
test esi, esi
je 0x10005712
test eax, eax
jne 0x10005731
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1000564d
jmp 0x10005731
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x10005762
cmp dword [ebp - 0x2c], 0
je 0x10005762
cmp dword [ebp - 0x30], 0
je 0x10005762
test ebx, ebx
je 0x10005762
test edi, edi
je 0x10005762
test esi, esi
je 0x10005762
cmp dword [ebp - 0x34], 0
je 0x10005762
xor eax, eax
jmp 0x10005765
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret
Function at 0x10005776
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
xor eax, eax
lea edi, [ebp - 0x1c]
and dword [ebp - 0x2c], eax
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [ebp - 0x24]
test eax, eax
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], 1
je 0x10005882
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
jmp 0x100057de
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10e48ce8]
mov eax, dword [ebp - 0x28]
cmove eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10e48cec]
push 1
cmove edx, dword [ebp - 0x38]
cmp eax, dword [0x10e48cf0]
mov dword [ebp - 0x30], edx
pop edx
cmove ecx, edx
cmp eax, dword [0x10e48cf4]
push 1
cmove ebx, edx
mov dword [ebp - 0x34], ecx
cmp eax, dword [0x10e48cf8]
cmove edi, edx
cmp eax, dword [0x10e48cfc]
cmove esi, edx
mov edx, dword [ebp - 0x2c]
cmp eax, dword [0x10e48d00]
mov eax, edx
mov dword [ebp - 0x2c], edx
pop edx
cmove eax, edx
cmp dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
je 0x10005866
test edx, edx
je 0x10005866
test ecx, ecx
je 0x10005866
test ebx, ebx
je 0x10005866
test edi, edi
je 0x10005866
test esi, esi
je 0x10005866
test eax, eax
jne 0x10005891
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call sub.KERNEL32.dll_Thread32Next
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
test eax, eax
jne 0x100057db
jmp 0x10005891
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x100058c2
cmp dword [ebp - 0x30], 0
je 0x100058c2
cmp dword [ebp - 0x34], 0
je 0x100058c2
test ebx, ebx
je 0x100058c2
test edi, edi
je 0x100058c2
test esi, esi
je 0x100058c2
cmp dword [ebp - 0x2c], 0
je 0x100058c2
xor eax, eax
jmp 0x100058c5
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret
Function at 0x10005915
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x10e48ccc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000593b
push ebx
push eax
call esi
push dword [0x10e48ccc]
call edi
mov eax, dword [0x10e48cd0]
test eax, eax
je 0x10005950
push ebx
push eax
call esi
push dword [0x10e48cd0]
call edi
mov eax, dword [0x10e48cd4]
test eax, eax
je 0x10005965
push ebx
push eax
call esi
push dword [0x10e48cd4]
call edi
mov eax, dword [0x10e48cd8]
test eax, eax
je 0x1000597a
push ebx
push eax
call esi
push dword [0x10e48cd8]
call edi
mov eax, dword [0x10e48cdc]
test eax, eax
je 0x1000598f
push ebx
push eax
call esi
push dword [0x10e48cdc]
call edi
mov eax, dword [0x10e48ce0]
test eax, eax
je 0x100059a4
push ebx
push eax
call esi
push dword [0x10e48ce0]
call edi
mov eax, dword [0x10e48ce4]
test eax, eax
je 0x100059b9
push ebx
push eax
call esi
push dword [0x10e48ce4]
call edi
pop edi
pop esi
pop ebx
ret
Function at 0x10006295
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1004077c], ebx
jne 0x100062c6
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
mov dword [ebp - 0xc], ebx
call fcn.1000216b
pop ecx
mov edi, 0x7042a2
mov dword [0x1004077c], ebx
push edi
push ebx
mov esi, 0x10040780
push esi
call fcn.1000e120
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push dword [0x1003a188]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
push esi
push dword [0x1003a188]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x1004077c], 1
pop ebx
call fcn.1000837d
mov esp, ebp
pop ebp
ret

Function at 0x10006325
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.Hack_detected:__s_n
call fcn.10004977
push 0xd0
call fcn.10012b24
mov edi, eax
mov ecx, esi
add esp, 0xc
mov dword [edi], 3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006353
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006364
sub ecx, edx
lea ebx, [edi + 8]
push ecx
push esi
push ebx
call fcn.10012a00
push 0x10
lea eax, [edi + 0x6c]
push 0x10040738
push eax
call fcn.10012a00
add esp, 0x18
push 0
push 0xd0
push edi
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.100124e4
push 2
call fcn.10006abb
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xffffffff
jne 0x100063cb
push str.Error_on_send_cheat_packet.
call fcn.100068ac
pop ecx
push 2
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.100068ac
push ebx
call fcn.100068ac
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10005f86
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10006402
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push 0
mov eax, 0x100285b2
call fcn.10008639
and dword [ebp - 4], 0
lea esi, [ebp + 8]
sub esp, 0x18
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push str.Hack_detected:__s_n
call fcn.10004977
mov esi, 0xd0
push esi
call fcn.10012b24
mov edi, eax
mov dword [edi], 3
lea ebx, [edi + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edi + 4], ecx
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.10012a00
push 0x10
lea eax, [edi + 0x6c]
push 0x10040738
push eax
call fcn.10012a00
add esp, 0x38
push 0
push esi
push edi
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.100124e4
push 2
call fcn.10006abb
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xffffffff
jne 0x100064a9
push str.Error_on_send_cheat_packet.
call fcn.100068ac
pop ecx
push 2
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.100068ac
push ebx
call fcn.100068ac
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10005f86
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.1000195f
call fcn.10008613
ret

Function at 0x100064e9
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x10006502
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
pop ebp
ret