joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424664
Capabilities:
Set file attributes

Disassembly:
push 0x160
mov eax, 0x580428
call fcn.0055dd89
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_FindWindowExA]
push esi
push edi
push esi
push esi
call ebx
test eax, eax
je 0x4248f0
push esi
push esi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x69682c], 1
jne 0x4246f4
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xc4]
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], esi
push str._nCN_Close:
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x4247b3
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
push 0x58dacc
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str.CN_Close:
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x2c
lea ecx, [ebp - 0xc4]
call fcn.00424a62
push 2
push 0x58dacc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
xor esi, esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
push esi
push esi
call ebx
test eax, eax
je 0x4248f0
xor ebx, ebx
inc ebx
cmp dword [0x69682c], ebx
jne 0x424836
push ebx
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xc4]
call fcn.0042443d
push str._cant_be_closed__exiting_game_
push edi
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 2
push str._nCN_Close:
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0xc4]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
cmp dword [0x69683c], ebx
jne 0x4248eb
lea eax, [ebp - 0x14]
push eax
call fcn.0056300a
lea eax, [ebp - 0x14]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push ebx
push 0x40
push 8
mov ebx, 0x58dacc
lea ecx, [ebp - 0x16c]
push ebx
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0x16c]
mov dword [ebp - 4], 3
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0042141f
add esp, 0x14
lea eax, [ebp - 0x16c]
push str._cant_be_closed__exiting_game_
push edi
push str.CN_Close:
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
lea eax, [ebp - 0x16c]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x16c]
call fcn.00424a62
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.004245d6
call fcn.0055dd66
ret
Function at 0x4248f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58db38
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424952
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
pop ecx
test esi, esi
mov dword [ebp - 4], eax
pop esi
je 0x424949
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0xf]
jb 0x42492e
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push edi
call fcn.00424664
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42495f
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x424630
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x424a94
Capabilities:
Set file attributes

Disassembly:
push 0x160
mov eax, 0x580428
call fcn.0055dd89
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
push edi
push esi
call ebx
test eax, eax
je 0x424d1c
push esi
push esi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x69682c], 1
jne 0x424b22
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xc4]
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], esi
push str._nW_Close:
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x424be1
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
push 0x58dacc
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str.W_Close:
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x2c
lea ecx, [ebp - 0xc4]
call fcn.00424a62
push 2
push 0x58dacc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
xor esi, esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push esi
call ebx
test eax, eax
je 0x424d1c
xor ebx, ebx
inc ebx
cmp dword [0x69682c], ebx
jne 0x424c62
push ebx
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xc4]
call fcn.0042443d
push str._cant_be_closed__exiting_game_
push edi
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 2
push str._n_W_Close:
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0xc4]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
cmp dword [0x69683c], ebx
jne 0x424d17
lea eax, [ebp - 0x14]
push eax
call fcn.0056300a
lea eax, [ebp - 0x14]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push ebx
push 0x40
push 8
mov ebx, 0x58dacc
lea ecx, [ebp - 0x16c]
push ebx
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0x16c]
mov dword [ebp - 4], 3
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0042141f
add esp, 0x14
lea eax, [ebp - 0x16c]
push str._cant_be_closed__exiting_game_
push edi
push str.W_Close:
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
lea eax, [ebp - 0x16c]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x16c]
call fcn.00424a62
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00424d58
mov al, 1
call fcn.0055dd66
ret
Function at 0x424d58
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x696830]
push esi
cmp eax, 1
je 0x424da6
cmp eax, 4
je 0x424da6
cmp eax, 2
jne 0x424d91
xor esi, esi
push esi
push esi
push esi
push 0x424e2e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x424da2
xor esi, esi
push esi
push esi
push esi
push 0x42ddfe
jmp 0x424d77
push 0
jmp 0x424d8b
xor esi, esi
push esi
push esi
push esi
push 0x424ea6
jmp 0x424d77

Function at 0x424db2
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x424d24
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x424dc5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58dc1c
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424e21
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
pop ecx
test esi, esi
mov dword [ebp - 4], eax
pop esi
je 0x424e18
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0xf]
jb 0x424dfd
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push edi
call fcn.00424a94
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424f1e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
or dword [ebp - 0x408], 0xffffffff
push ebx
push edi
push 0x58a9b0
push edx
mov ebx, ecx
call fcn.0055f14b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x424f57
or eax, 0xffffffff
jmp 0x424f9f
push esi
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0055f6f7
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x404]
mov ecx, ebx
push esi
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.00425010
cmp esi, 0x400
je 0x424f58
push edi
call fcn.0055f010
mov eax, dword [ebp - 0x408]
pop ecx
not eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret 4

Function at 0x424fb1
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
xor esi, esi
mov ebx, ecx
push esi
push ebx
call fcn.0055ecc0
add esp, 0xc
mov edi, ebx
push 8
push esi
mov ecx, ebx
call fcn.00425049
shl eax, 0x18
push 8
mov dword [edi], eax
pop edx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor eax, ecx
dec edx
jne 0x424fdb
push 0x20
push eax
mov ecx, ebx
call fcn.00425049
mov dword [edi], eax
inc esi
add edi, 4
cmp esi, 0xff
jle 0x424fc9
pop edi
pop esi
pop ebx
ret
Function at 0x425010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
je 0x425042
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
mov eax, dword [ebp - 4]
xor edx, dword [eax + ecx*4]
inc edi
mov dword [ebx], edx
dec esi
jne 0x425027
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x426810
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x68dc50]
add eax, dword [0x68dc4c]
add eax, dword [0x68dc48]
add eax, dword [0x68dc44]
add eax, dword [0x68dc40]
add eax, dword [0x68dc3c]
add eax, dword [0x68dc38]
add eax, dword [0x68dc34]
add eax, dword [0x68dc30]
add eax, dword [0x68dc2c]
add eax, dword [0x68dc28]
add eax, dword [0x68dc24]
add eax, dword [0x68dc20]
add eax, dword [0x68dc1c]
add eax, dword [0x68dc18]
add eax, dword [0x68dc14]
add eax, dword [0x68dc10]
add eax, dword [0x68dc0c]
add eax, dword [0x68dc08]
add eax, dword [0x68dc04]
add eax, dword [0x68dc00]
add eax, dword [0x68dbfc]
mov edx, dword [0x68dc54]
add eax, dword [0x68dbf8]
inc edx
mov dword [0x68dc54], edx
cmp eax, dword [0x68dbe8]
je 0x4268b7
cmp edx, 5
jg fcn.004269b2
jmp 0x426d31
xor eax, eax
mov dword [0x68dbf8], eax
mov dword [0x68dbfc], eax
mov dword [0x68dc00], eax
mov dword [0x68dc04], eax
mov dword [0x68dc08], eax
mov dword [0x68dc0c], eax
mov dword [0x68dc10], eax
mov dword [0x68dc14], eax
mov dword [0x68dc18], eax
mov dword [0x68dc1c], eax
mov dword [0x68dc20], eax
mov dword [0x68dc24], eax
mov dword [0x68dc28], eax
mov dword [0x68dc2c], eax
mov dword [0x68dc30], eax
mov dword [0x68dc34], eax
mov dword [0x68dc38], eax
mov dword [0x68dc3c], eax
mov dword [0x68dc40], eax
mov dword [0x68dc44], eax
mov dword [0x68dc48], eax
mov dword [0x68dc4c], eax
mov dword [0x68dc50], eax
ret

Function at 0x426976
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4268bc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x426989
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x42690c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4269b2
Capabilities:
Create thread
Terminate process

Disassembly:
push 0xa8
mov eax, 0x580bc6
call fcn.0055dd89
xor esi, esi
cmp dword [0x69682c], 1
jne 0x426a20
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xb4]
call fcn.0042443d
lea eax, [ebp - 0xb4]
mov dword [ebp - 4], esi
push str._nAKS_Scan:
push eax
call fcn.0042141f
lea eax, [ebp - 0xb4]
push str.Thread_attack_
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xb4]
call fcn.00424a62
lea ecx, [ebp - 0xb4]
call fcn.00424592
mov eax, dword [0x696830]
cmp eax, 1
je 0x426a66
cmp eax, 4
je 0x426a66
push esi
cmp eax, 2
jne 0x426a56
push esi
push esi
push 0x426c09
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x426a64
push esi
push esi
push 0x42ddfe
jmp 0x426a3c
jmp 0x426a50
push esi
push esi
push esi
push 0x426c9d
jmp 0x426a3c

Function at 0x426da7
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x426dba
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x427c0a
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x427c9d
push esi
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x427c85
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x427c85
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x427c89
xor eax, eax
jmp 0x427c9c
push esi
push esi
push esi
push 0x42780a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret

Function at 0x427cab
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x427cbe
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x42d024
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x42d4e9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x42d539
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x42dccc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x42dcfb
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x42de30
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x431d86
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x580590
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x431df8
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0042443d
lea eax, [ebp - 0x164]
mov dword [ebp - 4], ebx
push str._nHT_Scan:
push eax
call fcn.0042141f
lea eax, [ebp - 0x164]
push str.Hide_windows_detected_
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x431eb2
lea eax, [ebp - 0x14]
push eax
call fcn.0056300a
lea eax, [ebp - 0x14]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x58dacc
lea ecx, [ebp - 0xbc]
push edi
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str.HT_Scan:
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str.Hide_windows_detected_
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x2c
lea ecx, [ebp - 0xbc]
call fcn.00424a62
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00424592
mov eax, dword [0x696830]
push ebx
cmp eax, 1
jne 0x431ede
push ebx
push ebx
push 0x4320fc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x431eec
push ebx
push ebx
push 0x432084
jmp 0x431ec4
cmp eax, 3
jne 0x431efa
push ebx
push ebx
push 0x42ddfe
jmp 0x431ec4
cmp eax, 4
jne 0x431f26
push ebx
push ebx
push 0x426bb1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.H_Scan
push str.Generic_Hide_Window
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x431ed7
jmp 0x431ed8

Function at 0x431f28
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x432050
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x431f3b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20804
call fcn.0055f2c0
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x432031
lea eax, [ebp - 0x207f8]
mov dword [ebp - 0x20800], eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x432015
lea eax, [ebp - 0x20804]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x20804]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x432015
mov ecx, dword [ebp - 0x20800]
mov eax, dword [ebp - 0x20804]
push 0xff
mov dword [ecx], eax
lea eax, [ecx + 4]
push eax
push esi
mov dword [ecx - 4], esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x20800]
push 0xff
add eax, 0x103
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
add dword [ebp - 0x20800], 0x206
inc ebx
mov ecx, dword [ebp - 0x20804]
xor eax, eax
test edi, edi
jle 0x432009
cmp ecx, dword [ebp + eax*4 - 0x400]
je 0x432009
inc eax
cmp eax, edi
jl 0x431ffb
cmp eax, edi
jne 0x432015
mov dword [ebp + edi*4 - 0x400], ecx
inc edi
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x431f77
test ebx, ebx
je 0x432031
cmp edi, 1
jg 0x43204a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
call fcn.00431d86
int3

Function at 0x432174
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x432187
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4328f3
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x580590
call fcn.0055dd89
xor ebx, ebx
mov esi, str.Dll_injection_
cmp dword [0x69682c], 1
jne 0x432966
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0042443d
lea eax, [ebp - 0x164]
mov dword [ebp - 4], ebx
push str._nI_Scan:
push eax
call fcn.0042141f
lea eax, [ebp - 0x164]
push esi
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x432a21
lea eax, [ebp - 0x14]
push eax
call fcn.0056300a
lea eax, [ebp - 0x14]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x58dacc
lea ecx, [ebp - 0xbc]
push edi
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str.I_Scan:
push eax
call fcn.0042141f
mov esi, str.Dll_injection_
lea eax, [ebp - 0xbc]
push esi
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x2c
lea ecx, [ebp - 0xbc]
call fcn.00424a62
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00424592
mov eax, dword [0x696830]
push ebx
cmp eax, 1
jne 0x432a4d
push ebx
push ebx
push 0x432b0b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x432a5b
push ebx
push ebx
push 0x432a93
jmp 0x432a33
cmp eax, 3
jne 0x432a69
push ebx
push ebx
push 0x42ddfe
jmp 0x432a33
cmp eax, 4
jne 0x432a91
push ebx
push ebx
push 0x426bb1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.I_Scan
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x432a46
jmp 0x432a47
Function at 0x4344f4
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4340f9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4362d3
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4369cc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret