joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4034a7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x41889c]
sub esi, dword [0x40c808]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x42630c], eax
jle 0x403611
push dword [0x4208ac]
call fcn.00403655
push ebx
push ebx
push dword [0x40c808]
push dword [0x40a674]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x4208a8], esi
mov dword [0x418898], ebx
mov ebp, 0x40c898
mov eax, dword [0x4188a0]
mov edi, 0x4000
sub eax, dword [0x4208ac]
cmp eax, edi
jg 0x40351c
mov edi, eax
mov esi, 0x414898
push edi
push esi
call fcn.00403623
test eax, eax
je 0x403603
add dword [0x4208ac], edi
mov dword [0x40c828], esi
mov dword [0x40c82c], edi
cmp dword [0x426310], ebx
je 0x403573
cmp dword [0x4263a0], ebx
jne 0x403573
mov eax, dword [0x4208a8]
push ebx
sub eax, dword [0x41889c]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40c808]
mov dword [0x418898], eax
call fcn.00403037
pop ecx
mov ecx, str._Mn9Q_
mov dword [0x40c830], ebp
mov dword [0x40c834], 0x8000
call fcn.004066cb
test eax, eax
jl 0x40360c
mov esi, dword [0x40c830]
sub esi, ebp
je 0x4035cd
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x40a674]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403608
cmp esi, dword [esp + 0x10]
jne 0x403608
add dword [0x40c808], esi
cmp dword [0x40c82c], ebx
jne 0x403542
jmp 0x4035d9
cmp dword [0x40c82c], ebx
jne 0x40360c
cmp edi, ebx
je 0x40360c
mov eax, dword [0x41889c]
mov ecx, eax
sub ecx, dword [0x40c808]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x403506
push ebx
push ebx
push eax
push dword [0x40a674]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x403611
or eax, 0xffffffff
jmp 0x40361b
push 0xfffffffffffffffe
jmp 0x40360e
push 0xfffffffffffffffd
pop eax
jmp 0x40361b
push 1
call fcn.00403037
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x401d39
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + 8]
test eax, eax
jbe 0x401cf6
mov ecx, eax
mov eax, dword [edi]
cmp ecx, eax
jbe 0x401cd9
mov ecx, eax
mov eax, dword [edi + 0xc]
push ecx
add eax, dword [ebp + 8]
push eax
push ebx
call fcn.00402340
push dword [esi + 0x38]
push dword [edi]
call fcn.00401d1d
add esp, 0x14
jmp 0x401d07
mov eax, dword [edi]
test eax, eax
je 0x401d09
push dword [esi + 0x38]
push eax
call fcn.00401d1d
pop ecx
pop ecx
add ebx, eax
movzx eax, word [esi + 6]
inc dword [ebp + 0x18]
add edi, 0x28
cmp dword [ebp + 0x18], eax
jl 0x401cc8
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, 0xae39f19e
or cl, byte [edi + 0x21f000b6]
je 0x401cf8
mov ebp, eax
mov edx, 0xc16bf531
mov eax, dword [0x227a015c]
test eax, 0xd3a15cfd
and edx, dword [eax + 4]
mov al, 0xd6
sub ebp, esp
dec ecx
and edi, ebp
aas
pop ecx
mov ch, 0xf0
ror byte [ebp + 0x1b7d4d2c], 1
or ah, byte [ebp + 0x242b9785]
or ecx, dword [edi - 0x47]
sub al, 0x34
lahf
test al, 0xc
sub ebp, dword [eax + eax*8]
pop edx
xchg ebx, eax
cmp al, 5
mov al, 0x2e
add ecx, ebp
lodsd eax, dword [esi]
push es
scasb al, byte es:[edi]
xor cl, al
lodsb al, byte [esi]
insd dword es:[edi], dx
inc esp
cwde
inc ebx
mov eax, dword [0x1edb28a4]
mov al, byte [0x70b8e157]
out 0x8c, al
dec ebp
aaa
lahf
cmpsd dword [esi], dword es:[edi]
out dx, al
inc eax
loope 0x401d62
mul byte [esi]
adc esp, dword [eax - 0x43]
idiv byte [ebx + 0x31]
lea esp, [ebp - 2]
pop edi
mov word [edi - 0x6e], ss
mov byte [0x9ec32ea7], al
push ecx
and bl, byte [esp + esi*4]
add dword [esi*2 + 0x3abaf227], ebx
xchg esi, eax
xchg edi, eax
mov eax, dword [0xe2e5d14e]
mov bh, 0x8b
inc ecx
jmp 0x2787fa4a

Function at 0x40181c
Capabilities:
Hash data using murmur3

Disassembly:
ror ecx, 0x10
mov dword [ebp - 0x74], ecx
pop ebx
pop esi
pop edi
ret
push edi
push esi
push ebx
mov ebx, dword [ebp - 0x60]
test ebx, ebx
rol ebx, 0xf
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x20]
test ebx, eax
ror eax, 0x11
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x200000
rol ecx, 0xd
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x24]
test edi, eax
rol eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x800000
ror ecx, 0x15
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x2c]
test edi, eax
rol eax, 0x12
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x8000000
ror ecx, 0x19
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x38]
test esi, eax
ror eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x1000
ror ecx, 0xa
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
test esi, eax
rol eax, 0xf
cmp ecx, eax
jne 0x4018d4
jmp 0x401990
xor ecx, eax
xor esi, esi
mov edx, 0xff
ror edx, 8
jmp 0x401a00
cmp ecx, esi
je 0x401990
mov ecx, esi
jmp 0x401808
inc ecx
jmp 0x401808
mov edi, eax
and edi, edx
cmp edi, edx
jne 0x40197c
shl ecx, 8
shl eax, 8
jmp 0x401a00
Function at 0x10002590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10013838
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x10002717
cmp byte [edi + 0x45], 0
je 0x10002717
push 0xffffffffffffffff
call fcn.10001930
cmp eax, 0xffffffff
jne 0x100025f0
xor al, al
jmp 0x10002719
sub esp, 8
lea ecx, [esp + 0x20]
call fcn.100022c0
mov dword [esp + 0x40], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x1000264f
dec eax
je 0x10002653
sub eax, 2
je 0x100026fd
xor bl, bl
jmp 0x100026ff
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x1000268b
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10002648
cmp byte [edi + 0x45], 0
je 0x100026fd
test esi, esi
jne 0x10002604
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x100026f2
lea esi, [ecx + 8]
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.100028b0
test al, al
je 0x10002604
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x28]
xorps xmm0, xmm0
cmovae ecx, dword [esp + 0x18]
movq qword [ecx + eax], xmm0
lea eax, [esp + 0x18]
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], esi
cmovae eax, dword [esp + 0x18]
mov byte [eax + esi], 0
jmp 0x10002604
push str.string_too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x10002713
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x10002719
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
Function at 0x10005140
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100138f6
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push esi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1001f720], 1
jne 0x100051fe
sub esp, 8
lea ecx, [ebp - 0x168]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_FTP_Server_connection_fail_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.10002ae0
lea ecx, [ebp - 0x168]
call fcn.10001810
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x168]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x16c], eax
lea ecx, [ebp - 0x164]
call fcn.10001890
lea ecx, [ebp - 0x160]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x108]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x1001f734], 1
jne 0x100052f3
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
add esp, 4
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
push ecx
push 8
push 0x100154c0
lea ecx, [ebp - 0xc0]
mov esi, eax
call fcn.10001710
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.10002ae0
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
add esp, 4
lea ecx, [ebp - 0xc0]
mov edx, eax
call fcn.10002ae0
mov edx, str.FTP_Server_connection_fail_
lea ecx, [ebp - 0xc0]
call fcn.10002ae0
mov edx, str._n__________________
lea ecx, [ebp - 0xc0]
call fcn.10002ae0
lea ecx, [ebp - 0xc0]
call fcn.10001810
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0xbc]
call fcn.10001890
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x10005339
cmp eax, 3
je 0x10005339
push 0
cmp eax, 2
jne 0x1000532f
push 0
push 0
push 0x10005100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x10005329
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10005120
jmp 0x10005312
Function at 0x10005390
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100138f6
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push esi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1001f720], 1
jne 0x1000544e
sub esp, 8
lea ecx, [ebp - 0x168]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_HTTP_Server_connection_fail_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.10002ae0
lea ecx, [ebp - 0x168]
call fcn.10001810
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x168]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x16c], eax
lea ecx, [ebp - 0x164]
call fcn.10001890
lea ecx, [ebp - 0x160]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x108]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x1001f734], 1
jne 0x10005543
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
add esp, 4
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
push ecx
push 8
push 0x100154c0
lea ecx, [ebp - 0xc0]
mov esi, eax
call fcn.10001710
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.10002ae0
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
add esp, 4
lea ecx, [ebp - 0xc0]
mov edx, eax
call fcn.10002ae0
mov edx, str.HTTP_Server_connection_fail_
lea ecx, [ebp - 0xc0]
call fcn.10002ae0
mov edx, str._n__________________
lea ecx, [ebp - 0xc0]
call fcn.10002ae0
lea ecx, [ebp - 0xc0]
call fcn.10001810
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0xbc]
call fcn.10001890
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x10005589
cmp eax, 3
je 0x10005589
push 0
cmp eax, 2
jne 0x1000557f
push 0
push 0
push 0x10005350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x10005579
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10005370
jmp 0x10005562
Function at 0x100055a0
Capabilities:
Connect to http server
Create http request
Delete file
Get session user name
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 0x64
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000563e
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 1
push dword [0x1001f694]
mov edi, eax
push dword [0x1001f690]
push 0x15
push dword [0x1001f68c]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
mov esi, eax
lea eax, [ebp - 0x70]
push 2
push eax
push str.List
push esi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x1000564e
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.MSVCR120.dll_remove]
push str.List
call esi
add esp, 4
push 0x100154c0
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
push str.List
call dword [sym.imp.MSVCR120.dll_remove]
add esp, 4
call fcn.10005140
int3
Function at 0x10005d30
Capabilities:
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013a0b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0
push eax
push 1
push 0
push str.SoftwareWebzenMuConfig
push 0x80000001
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jle 0x10005da2
call fcn.10005c20
jmp 0x10005e6f
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
push str.SoftwareWebzenMuConfig
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005e63
lea eax, [ebp - 0x124]
mov dword [ebp - 0x120], 1
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x120]
push eax
push 0
push 0x10015e6c
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005e5e
sub esp, 8
lea ecx, [ebp - 0x1d0]
push 8
push str.Temp
call fcn.10001710
mov edx, str._nLauncher_defalt_login:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1d0]
call fcn.10002ae0
lea edx, [ebp - 0x118]
mov ecx, eax
call fcn.10002ae0
lea ecx, [ebp - 0x1d0]
call fcn.10001810
push 2
push str.Temp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.10005c20
lea ecx, [ebp - 0x1d0]
call fcn.10001650
jmp 0x10005e63
call fcn.10005c20
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
Function at 0x10006a10
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x10006a42
push 0
push 0
push 0x100069f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10006a52
push 0
push 0
push 0x100069d0
jmp 0x10006a25
cmp eax, 3
jne 0x10006a62
push 0
push 0
push 0x10001350
jmp 0x10006a25
jmp 0x10006a3c
Function at 0x100075b0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10013b8b
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
cmp dword [0x1001f720], 1
jne 0x1000767b
sub esp, 8
lea ecx, [esp + 0xc]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_AKT_Scan:
mov dword [esp + 0xb8], 0
lea ecx, [esp + 4]
call fcn.10002ae0
mov edx, str.Thread_attack_
lea ecx, [esp + 4]
call fcn.10002ae0
lea ecx, [esp + 4]
call fcn.10001810
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + eax + 4], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [esp + ecx], eax
lea ecx, [esp + 8]
call fcn.10001890
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [esp + ecx + 4], eax
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [esp + ecx], eax
lea ecx, [esp + 0x64]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x100076ad
push 0
push 0
push 0x10007590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100076bd
push 0
push 0
push 0x10007570
jmp 0x10007690
cmp eax, 3
jne 0x100076cd
push 0
push 0
push 0x10001350
jmp 0x10007690
jmp 0x100076a7

Function at 0x100076d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x15640
mov dword [ebp - 4], ecx
call fcn.10012bb0
add esp, 4
mov edi, eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000770c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x10007714
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push edi
push esi
call ebx
test eax, eax
je 0x10007764
lea eax, [edi + 0x24]
mov ecx, dword [ebp - 4]
lea esp, [esp]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10007750
test dl, dl
je 0x1000774c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10007750
add ecx, 2
add eax, 2
test dl, dl
jne 0x10007730
xor eax, eax
jmp 0x10007755
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000776d
push edi
push esi
call ebx
test eax, eax
lea eax, [edi + 0x24]
jne 0x10007726
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a0c0
Capabilities:
Connect to http server
Create http request
Delete file
Set file attributes

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x8000000
push 1
push dword [0x1001f694]
mov edi, eax
push dword [0x1001f690]
push 0x15
push dword [0x1001f68c]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 1
push 0x80
push 1
push 0x1001672c
mov esi, eax
push str.1Hardware_Banlist.txt
push esi
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x1000a13d
push 2
push 0x1001672c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
call fcn.10009dd0
pop edi
pop esi
pop ecx
ret
mov esi, dword [sym.imp.MSVCR120.dll_remove]
push 0x1001672c
call esi
add esp, 4
push 0x10016730
call esi
add esp, 4
call fcn.100096a0
int3

Function at 0x1000a160
Capabilities:
Capture public ip
Connect to http server
Create http request
Delete file
Read data from internet
Receive data
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push 0
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push dword [0x1001f694]
push dword [0x1001f690]
push 0x15
push dword [0x1001f68c]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call esi
push 0
push 0x80000000
push 0
push 0
mov ebx, eax
push str.http:__icanhazip.com_
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000a246
lea eax, [ebp - 0x38]
push eax
push 0x2f
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x38]
cmp eax, 0x2f
jae 0x1000a241
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + eax - 0x34], 0
call esi
push 0
push 2
lea eax, [ebp - 0x34]
push eax
push 0x10016730
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x1000a22e
push edi
call esi
push ebx
call esi
call fcn.1000a0c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
push 0x10016730
call dword [sym.imp.MSVCR120.dll_remove]
add esp, 4
call fcn.100096a0
call fcn.10012e68
call fcn.10009900
int3