joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x118
mov eax, ecx
push edi
sub eax, 0x80
je 0x407c0a
sub eax, 0x40
je 0x407bff
sub eax, 0x40
jne 0x407db3
mov edi, dword [ebp + 8]
mov dword [edi], 0xe
jmp 0x407c13
mov edi, dword [ebp + 8]
mov dword [edi], 0xc
jmp 0x407c13
mov edi, dword [ebp + 8]
mov dword [edi], 0xa
push esi
push ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00407dc0
mov eax, dword [ebp - 0x118]
add esp, 0xc
shl eax, 4
add eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x407d9c
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0x6b2578]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0x6b4378]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3f78]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3b78]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3778]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0x6b2578]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0x6b3778]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b4378]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3f78]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3b78]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0x6b2578]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0x6b3778]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b4378]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3f78]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3b78]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0x6b2578]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0x6b3778]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b4378]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3f78]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0x6b2578]
xor edx, dword [ecx*4 + 0x6b3b78]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x407c63
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x409120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x586528
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x409259
cmp byte [edi + 0x45], 0
je 0x409259
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40916f
xor al, al
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
push ebx
push esi
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x48]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x4091de
dec eax
je 0x4091e2
sub eax, 2
je 0x409233
xor bl, bl
jmp 0x409235
mov byte [edi + 0x45], 0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp ebx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, ecx
sub esi, eax
je 0x409215
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x4091da
cmp byte [edi + 0x45], 0
je 0x409233
test esi, esi
lea esi, [edi + 0x48]
jne 0x4091a4
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409410
jmp 0x4091a1
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x409246
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov al, bl
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ac60
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6bd790]
push ebx
push esi
push edi
cmp eax, 1
jne 0x40ace2
mov dword [ebp - 4], 0x58cbc0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40acc6
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40acbd
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40aca4
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6bd70c]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40ad5e
mov dword [ebp - 4], 0x58cc40
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40ad42
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40ad39
sub edi, ecx
lea ebx, [ebx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40ad20
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6bd70c]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x58cbc0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40adb3
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40adaa
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40ad91
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6bd70c]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40add0
Capabilities:
Create thread

Disassembly:
cmp dword [0x6b47b8], 0
jne 0x40adee
push 0
push 0
push 0
push 0x40b960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x6b47b4], 0
jne 0x40ae0c
push 0
push 0
push 0
push fcn.0040ae10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret
Function at 0x40afa0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0040b480
mov eax, dword [0x6bd790]
cmp eax, 1
jne 0x40b02e
mov dword [ebp - 4], 0x58ca88
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b012
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b009
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40aff0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6bd70c]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40b0a4
mov dword [ebp - 4], 0x58cb20
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b088
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b07f
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b066
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6bd70c]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x58ca88
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b0f9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b0f0
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b0d7
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6bd70c]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40b190
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x58cd68
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b1f2
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x40b1e9
sub edi, ecx
lea ecx, [ecx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b1d0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop ebx
test eax, eax
jne 0x40b240
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b23b
call fcn.0040b3e0
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.0040b330
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40b350
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov word [ebp - 0x10], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40b39f
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40b3a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40b3bc
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 4], 0
test esi, esi
jne 0x40b3c8
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x5b30c4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
call sub.MSVCR120.dll__CxxThrowException
int3

Function at 0x40b3f0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40b410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40b920
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x40b7b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x6b47ac]
inc eax
mov dword [0x6b47ac], eax
cmp eax, 1
je 0x40b780
xor eax, eax
ret

Function at 0x40bbe0
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x6bd790]
cmp eax, 1
je 0x40bc2e
cmp eax, 4
je 0x40bc2e
push 0
cmp eax, 2
jne 0x40bc1c
push 0
push 0
push 0x40c090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40bc2c
push 0
push 0
push 0x40fac0
jmp 0x40bbff
jmp 0x40bc16
push 0
push 0
push 0
push 0x40c110
jmp 0x40bbff
Function at 0x40bff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58cf30
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40c052
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x40c049
sub edi, ecx
jmp 0x40c030
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40c030
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call fcn.0040bc80
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c070
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40bc40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40c560
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x6bd790]
cmp eax, 1
je 0x40c5ae
cmp eax, 4
je 0x40c5ae
push 0
cmp eax, 2
jne 0x40c59c
push 0
push 0
push 0x40c660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40c5ac
push 0
push 0
push 0x40fac0
jmp 0x40c57f
jmp 0x40c596
push 0
push 0
push 0
push 0x40c6e0
jmp 0x40c57f

Function at 0x40c5c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40c520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40c5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58d014
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40c642
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x40c639
sub edi, ecx
jmp 0x40c620
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40c620
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call fcn.0040c1c0
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push edi
push 0x58d03c
push dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCR120.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x40c795
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_fread]
push esi
lea ecx, [ecx]
push edi
push 0x400
lea eax, [ebp - 0x408]
push 1
push eax
call ebx
mov ecx, dword [ebp - 8]
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x408]
push esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040c8f0
cmp esi, 0x400
je 0x40c7a0
push edi
call dword [sym.imp.MSVCR120.dll_fclose]
mov eax, dword [ebp - 4]
add esp, 4
not eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x40c7f0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
mov ebx, ecx
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
xor edi, edi
push 8
push edi
mov ecx, ebx
call fcn.0040c930
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
push 0x20
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov esi, edx
and esi, 0x80000000
neg esi
lea eax, [edx + edx]
sbb esi, esi
and esi, 0x4c11db7
xor esi, eax
mov ecx, esi
and ecx, 0x80000000
neg ecx
lea eax, [esi + esi]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
push ecx
mov ecx, ebx
call fcn.0040c930
mov dword [ebx + edi*4], eax
inc edi
cmp edi, 0xff
jle 0x40c807
pop edi
pop esi
pop ebx
ret

Function at 0x40c8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
je 0x40c925
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
lea edi, [edi + 1]
movzx eax, byte [edi - 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
mov eax, dword [ebp - 4]
xor edx, dword [eax + ecx*4]
mov dword [ebx], edx
dec esi
jne 0x40c907
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e340
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6b4c28]
add eax, dword [0x6b4c24]
add eax, dword [0x6b4c20]
add eax, dword [0x6b4c1c]
add eax, dword [0x6b4c18]
add eax, dword [0x6b4c14]
add eax, dword [0x6b4c10]
add eax, dword [0x6b4c0c]
add eax, dword [0x6b4c08]
add eax, dword [0x6b4c04]
add eax, dword [0x6b4c00]
add eax, dword [0x6b4bfc]
add eax, dword [0x6b4bf8]
add eax, dword [0x6b4bf4]
add eax, dword [0x6b4bf0]
add eax, dword [0x6b4bec]
add eax, dword [0x6b4be8]
add eax, dword [0x6b4be4]
add eax, dword [0x6b4be0]
add eax, dword [0x6b4bdc]
add eax, dword [0x6b4bd8]
add eax, dword [0x6b4bd4]
mov edx, dword [0x6b4c2c]
add eax, dword [0x6b4bd0]
inc edx
mov dword [0x6b4c2c], edx
cmp eax, dword [0x6b4bc0]
je 0x40e3e7
cmp edx, 5
jg fcn.0040e540
jmp 0x40e9b0
mov dword [0x6b4bd0], 0
mov dword [0x6b4bd4], 0
mov dword [0x6b4bd8], 0
mov dword [0x6b4bdc], 0
mov dword [0x6b4be0], 0
mov dword [0x6b4be4], 0
mov dword [0x6b4be8], 0
mov dword [0x6b4bec], 0
mov dword [0x6b4bf0], 0
mov dword [0x6b4bf4], 0
mov dword [0x6b4bf8], 0
mov dword [0x6b4bfc], 0
mov dword [0x6b4c00], 0
mov dword [0x6b4c04], 0
mov dword [0x6b4c08], 0
mov dword [0x6b4c0c], 0
mov dword [0x6b4c10], 0
mov dword [0x6b4c14], 0
mov dword [0x6b4c18], 0
mov dword [0x6b4c1c], 0
mov dword [0x6b4c20], 0
mov dword [0x6b4c24], 0
mov dword [0x6b4c28], 0
ret
Function at 0x40e4b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40e3f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40e4d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40e440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40e540
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x584b0b
push eax
mov dword fs:[0], esp
sub esp, 0xa8
cmp dword [0x6bd78c], 1
jne 0x40e5e3
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xb4]
call fcn.0040ba20
lea eax, [ebp - 0xb4]
mov dword [ebp - 4], 0
push str._nAKS_Scan:
push eax
call fcn.0040a570
lea eax, [ebp - 0xb4]
push str.Thread_attack_
push eax
call fcn.0040a570
add esp, 0x10
lea ecx, [ebp - 0xb0]
call fcn.004096e0
test eax, eax
jne 0x40e5d2
push eax
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x54]
call fcn.0040bb20
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x6bd790]
cmp eax, 1
je 0x40e631
cmp eax, 4
je 0x40e631
push 0
cmp eax, 2
jne 0x40e61f
push 0
push 0
push 0x40e840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40e62f
push 0
push 0
push 0x40fac0
jmp 0x40e602
jmp 0x40e619
push 0
push 0
push 0
push 0x40e8f0
jmp 0x40e602

Function at 0x40eab0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40ead0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40faf0
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40fb13
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40fb0d
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40fb0d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40fb0d
push 0
push 0
push 0
push 0x40f630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40fb90
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40fbb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x414e60
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x415400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x415460
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x415c80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x415cb0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x415de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret