Download: http://www.mediafire.com/file/rz7j2g97d5xa1jw/NoDevFee8.0.zip
v8.0
TCP packets checking speed is improved (checking function is replaced with assembly code to speed up checking)
Fixed bug with automatic adding to startup (this feature is deleted).
New Logo
how do I take out ur address?
hexedit?
No - my initial analysis indicates the user address is used most of the time, with a switch to something else which has yet to be determined. It's a string (seemingly) that is sourced from the stack - not embedded in the binary, but probably made at runtime in some way. Currently doing just static analysis.
Nope, stack usage doesn't mean that something "embedded in the binary" wasn't just loaded there, even the static const.
Actually the address is a string, it is even not encrypted in that sample.
Also the OP implemented some one-hand patchable script kiddie protection there.
Won't place the address here, it is only the OP's business to share his address.
Commitment
sha256(string_with_address) is 1d7d2c0110e1a1a397963dd663ae0abe1af186eed55ab33b7e84c457588574f5
.text:0000000140001DD1 movups [rbp+2460h+var_2430], xmm0
.text:0000000140001DD5 movups xmm1, cs:xmmword_140007730
.text:0000000140001DDC movups [rbp+2460h+var_2420], xmm1
.text:0000000140001DE0 movsd xmm0, cs:qword_140007740
.text:0000000140001DE8 movsd [rbp+2460h+var_2410], xmm0
.text:0000000140001DED movzx eax, cs:word_140007748
.text:0000000140001DF4 mov [rbp+2460h+var_2408], ax
.text:0000000140001DF8 movzx eax, cs:byte_14000774A
.text:0000000140001DFF mov [rbp+2460h+var_2406], al
And the "protection" follows right after.