joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad1f46a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push dword [ebx]
mov esi, dword [sym.imp.msvcrt.dll__get_osfhandle]
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebx]
call fcn.4ad03ab3
push 0
push dword [ebp + 0xc]
call fcn.4ad11f66
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4ad1f4b8
push dword [ebp + 0xc]
push 1
push 0x4000271f
call fcn.4ad06d44
xor eax, eax
add esp, 0xc
inc eax
jmp 0x4ad1f54f
push edi
mov edi, dword [ebp + 0x10]
push 2
mov ecx, edi
push 0
neg ecx
push ecx
push eax
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0x18]
push dword [ebx]
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebx]
test eax, eax
je 0x4ad1f4ff
cmp dword [ebp + 8], edi
jne 0x4ad1f4ff
mov esi, dword [ebp + 0x14]
mov ecx, edi
mov edi, dword [ebp + 0x18]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4ad1f509
call fcn.4ad03ab3
or dword [ebx], 0xffffffff
jmp 0x4ad1f522
call fcn.4ad03ab3
xor esi, esi
push esi
push 1
push dword [ebp + 0xc]
call fcn.4ad1fdfd
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4ad1f539
push dword [ebp + 0xc]
push 1
push 0x4000271f
call fcn.4ad06d44
xor eax, eax
add esp, 0xc
inc eax
jmp 0x4ad1f54e
push 2
push esi
push esi
push eax
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4ad20202
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10], 0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 3
jne 0x4ad20244
cmp word [ebp - 0xa], 0x3a
jne 0x4ad20244
cmp word [ebp - 8], 0x5c
jne 0x4ad20244
xor eax, eax
jmp 0x4ad20299
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call ebx
test eax, eax
jne 0x4ad20295
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 0x10], eax
cmp eax, 5
jne 0x4ad20294
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad20294
test al, 1
je 0x4ad20294
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ad20294
push esi
call ebx
test eax, eax
je 0x4ad2028f
and dword [ebp - 0x10], 0
jmp 0x4ad20294
call edi
mov dword [ebp - 0x10], eax
pop edi
mov eax, dword [ebp - 0x10]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.4ad013a9
leave
ret 4
Function at 0x4ad208fb
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x280], ax
mov word [ebp - 0x27e], ax
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x284], ebx
lea edi, [ebp - 0x27c]
stosd dword es:[edi], eax
mov word [ebp - 0x278], ax
mov word [ebp - 0x276], ax
lea edi, [ebp - 0x274]
stosd dword es:[edi], eax
mov word [ebp - 0x270], ax
mov word [ebp - 0x26e], ax
lea edi, [ebp - 0x26c]
stosd dword es:[edi], eax
mov word [ebp - 0x268], ax
mov word [ebp - 0x266], ax
mov ecx, dword [ebp + 8]
lea edi, [ebp - 0x264]
stosd dword es:[edi], eax
mov word [ebp - 0x260], ax
mov word [ebp - 0x25e], ax
lea edi, [ebp - 0x25c]
stosd dword es:[edi], eax
mov word [ebp - 0x258], ax
mov word [ebp - 0x256], ax
lea edi, [ebp - 0x254]
stosd dword es:[edi], eax
lea edi, [ebp - 0x250]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov byte [ebp - 0x23c], bl
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x4ad24104]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x290]
push eax
push ecx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x28c], 6
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x234], ebx
call fcn.4ad202ad
cmp eax, 1
jne 0x4ad20a1b
xor eax, eax
inc eax
jmp 0x4ad20b40
push ebx
push 0x106
lea eax, [ebp - 0x210]
push eax
call fcn.4ad02c56
mov edi, dword [ebp - 0x248]
cmp edi, ebx
jne 0x4ad20a46
push ebx
push 0x232a
call fcn.4ad06d44
pop ecx
pop ecx
jmp 0x4ad20a13
lea ecx, [ebp - 0x244]
push esi
mov eax, dword [ecx]
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x4ad20a52
sub eax, esi
sar eax, 1
je 0x4ad20ab3
dec edi
mov ecx, dword [ecx + 0xc]
jne 0x4ad20a4d
mov eax, dword [ebp - 0x248]
mov edi, dword [ebp - 0x290]
lea esi, [ebp - 0x244]
mov dword [ebp - 0x21c], eax
and edi, 0x10
cmp edi, ebx
je 0x4ad20ae8
test dword [ebp - 0x290], 0x2000
jne 0x4ad20ac5
push 0x2328
push 0x234e
push dword [esi]
call fcn.4ad1fe1b
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4ad20ac5
mov dword [ebp - 0x214], ecx
jmp 0x4ad20b09
push ebx
push 0x232a
call fcn.4ad06d44
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4ad20b3f
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call fcn.4ad20492
cmp eax, ebx
je 0x4ad20b09
cmp eax, 0x91
jne 0x4ad20afa
cmp dword [ebp - 0x218], ebx
jne 0x4ad20afa
jmp 0x4ad20b09
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4ad20b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
mov dword [ebp - 0x214], eax
call fcn.4ad06d44
pop ecx
pop ecx
dec dword [ebp - 0x21c]
mov esi, dword [esi + 0xc]
jne 0x4ad20a83
lea eax, [ebp - 0x210]
push eax
push 0x104
push 0x4ad25260
call fcn.4ad0185a
push dword [ebp - 0x220]
call fcn.4ad01911
mov eax, dword [ebp - 0x214]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 4
Function at 0x4ad21e5f
Capabilities:
Create directory
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 8]
xor ebx, ebx
xor eax, eax
xor edi, edi
inc ebx
mov dword [ebp - 4], ebx
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.4ad21b0b
push dword [esi + 0xc]
mov dword [ebp + 8], eax
call fcn.4ad21b0b
mov esi, eax
mov dword [ebp - 8], esi
cmp dword [ebp + 8], edi
je 0x4ad21ffa
cmp esi, edi
je 0x4ad21ffa
push dword [ebp + 8]
call fcn.4ad21bcf
test eax, eax
jne 0x4ad21eca
push 0x4000272e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ad21ffa
push esi
call fcn.4ad21b70
test eax, eax
jne 0x4ad21edb
push 0x40002749
jmp 0x4ad21ebf
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4ad21ffa
push edi
push 0x2000000
push 3
push edi
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x4ad21ffa
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x4ad21f26
movzx ecx, word [ebp - 0x18]
sub eax, edx
sar eax, 1
lea ebx, [ecx + eax*2 + 0x14]
push ebx
call fcn.4ad01896
mov esi, eax
cmp esi, edi
je 0x4ad21ff1
push ebx
push edi
push esi
call sub.msvcrt.dll_memset
xor ecx, ecx
mov dword [esi], 0xa0000003
lea eax, [ebx - 8]
mov word [esi + 4], ax
mov word [esi + 8], cx
mov cx, word [ebp - 0x18]
mov word [esi + 0xa], cx
movzx ecx, word [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea eax, [esi + 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov ax, word [esi + 0xa]
add esp, 0x18
add ax, 2
mov word [esi + 0xc], ax
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x4ad21f95
sub eax, ecx
sar eax, 1
add eax, eax
mov word [esi + 0xe], ax
movzx eax, ax
push eax
movzx eax, word [esi + 0xa]
push dword [ebp - 8]
lea eax, [eax + esi + 0x12]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
push edi
push ebx
push esi
push 0x900a4
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
cmp eax, edi
jge 0x4ad21fee
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ad21ff1
mov dword [ebp - 4], edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x4ad22015
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 4], edi
je 0x4ad22028
cmp dword [ebp - 0x10], edi
je 0x4ad22028
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100012f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x100254e0
call fcn.10004f20
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000131b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10001326
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10001331
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000133c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10001347
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10001352
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000135d
bts eax, 1
test cl, 2
je 0x10001366
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x100013ff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100013f0
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x100254e0], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10001310
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001430
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10024040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x10021cac
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call fcn.1000b464
add esp, 0xc
test eax, eax
jne 0x10001481
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003712
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.1000b684
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x100014d2
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100254e0]
sub edx, 1
jne 0x100014b0
cmp edi, 0x400
je 0x10001483
push dword [ebp - 0x408]
call fcn.10006dde
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10003712
mov esp, ebp
pop ebp
ret 4
Function at 0x10001500
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.100012f0
cmp dword [0x100254a0], 1
jne 0x100015ba
push str.interface.u
call fcn.10001430
cmp eax, dword [0x100254d4]
je 0x100015ba
push 0x10021af8
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000b464
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001565
push str.Interface_files_are_changed______Interface.u
push 0x10021b0c
push eax
call fcn.10001290
push dword [ebp - 4]
call fcn.10006dde
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x10
push 0
push str._L2J_Guard_Protection____http:__www.l2jguard.org___n_n___We_find_programs_using_the_same_function_Hackers_Bots._n___Believed_to_be_an_error_._We_inform_or_will_fix._n___Send_folder_L2JGuard__your_system_to_the_Administrator___n_n___Sorry_for_the_inconvenience__we_need_maximum_security_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100254a4], 1
jne 0x10001600
push str.interface.xdat
call fcn.10001430
cmp eax, dword [0x100254d8]
je 0x10001600
push 0x10021af8
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000b464
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001565
push str.Interface_files_are_changed______Interface.xdat
jmp 0x1000154f
cmp dword [0x100254a8], 1
jne 0x10001646
push str.WarGuard_Protect.bmp
call fcn.10001430
cmp eax, dword [0x100254dc]
je 0x10001646
push 0x10021af8
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000b464
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001565
push str.Interface_files_are_changed______Image_Protect_BMP
jmp 0x1000154f
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100017a0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push esi
mov esi, dword [0x100298fc]
push edi
mov edi, dword [0x10029900]
cmp esi, edi
je 0x100017d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [eax]
push dword [esi]
call ebx
test eax, eax
jne 0x100017d3
add esi, 4
cmp esi, edi
jne 0x100017c0
pop ebx
pop edi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001860
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10024040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x10001916
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000190f
push esi
nop dword [eax + eax]
mov eax, ebx
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100018de
test dx, dx
je 0x100018da
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100018de
add ecx, 4
add eax, 4
test dx, dx
jne 0x100018b8
xor eax, eax
jmp 0x100018e3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100018fc
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001926
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100018b0
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10003712
mov esp, ebp
pop ebp
ret
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10021af8
lea eax, [ebp - 0x234]
push str.WarGuard_Log.txt
push eax
call fcn.1000b464
push ebx
push str._ls___WP__n
push dword [ebp - 0x234]
call fcn.10001290
push dword [ebp - 0x234]
call fcn.10006dde
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10001aff
push 0x10021af8
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000b464
push esi
push str._s___TW__n
push dword [ebp - 4]
call fcn.10001290
push dword [ebp - 4]
call fcn.10006dde
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001b10
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, str.Process_Explorer_11.33
call fcn.10001a60
mov ecx, str.Process_Explorer
call fcn.10001a60
mov ecx, str.ArtMoney_PRO_v7.27
call fcn.10001a60
mov ecx, str.ArtMoney_SE_v7.31
call fcn.10001a60
mov ecx, str.ArtMoney_SE_v7.32
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.0
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.1.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.2
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.3
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.4
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.5
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.6
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.6.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_6.0
call fcn.10001a60
mov ecx, str.Cheat_Engine_6.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_6.4
call fcn.10001a60
mov ecx, str.Cheat_Engine
call fcn.10001a60
mov ecx, str.Created_processes
call fcn.10001a60
mov ecx, str.SandBoxie_Plus_v0.9.3
call fcn.10001a60
mov ecx, str.Sandboxie_Control___sandboxie_plus.com
call fcn.10001a60
mov ecx, str.Created_processes
call fcn.10001a60
mov ecx, str.Lineage2_v1.71
call fcn.10001a60
mov ecx, str.XAAAA
jmp fcn.10001a60
Function at 0x10001c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x10001cc3
push 0x10021af8
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000b464
push esi
push str._s___CW__n
push dword [ebp - 4]
call fcn.10001290
push dword [ebp - 4]
call fcn.10006dde
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001cd0
Capabilities:
Create process on windows
Set registry value
Terminate process

Disassembly:
mov ecx, str.PROCEXPL
call fcn.10001c20
mov ecx, str.TreeListWindowClass
call fcn.10001c20
mov ecx, str.ProcessHacker
call fcn.10001c20
mov ecx, str.RegEdit_RegEdit
call fcn.10001c20
mov ecx, str.ProcessThreadsView
call fcn.10001c20
mov ecx, str.TreeListWindowClass
call fcn.10001c20
mov ecx, str.PhTreeNew
call fcn.10001c20
mov ecx, 0x100221bc
call fcn.10001c20
mov ecx, str.TformSettings
call fcn.10001c20
mov ecx, str.TWildProxyMain
call fcn.10001c20
mov ecx, str.TUserdefinedform
call fcn.10001c20
mov ecx, str.TformAddressChange
call fcn.10001c20
mov ecx, str.TMemoryBrowser
call fcn.10001c20
mov ecx, str.TFoundCodeDialog
call fcn.10001c20
mov ecx, str.TL2PacketHackMain
call fcn.10001c20
mov ecx, str.vxwindowclassnr
call fcn.10001c20
mov ecx, str.l2packet
call fcn.10001c20
mov ecx, str.hlapex
call fcn.10001c20
mov ecx, str.wp_v5
call fcn.10001c20
mov ecx, 0x1002226c
call fcn.10001c20
mov ecx, str.TfProcessRawLog
call fcn.10001c20
mov ecx, str.TfScriptEditor
call fcn.10001c20
mov ecx, str.TfScript
call fcn.10001c20
mov ecx, str.TTabSheet
call fcn.10001c20
mov ecx, str.TJvSpinEdit
call fcn.10001c20
mov ecx, str.PhTreeNew
call fcn.10001c20
mov ecx, str.TPaintPanel
call fcn.10001c20
mov ecx, str.ThtmlLiteEx
call fcn.10001c20
mov ecx, str.TfmMain
call fcn.10001c20
mov ecx, str.TvkProgressBar
call fcn.10001c20
mov ecx, str.TTabSheet
call fcn.10001c20
mov ecx, str.SandboxieControlWnsClass
call fcn.10001c20
mov ecx, str.0x150114__1376532_
call fcn.10001c20
mov ecx, str.0x507B6__329654_
jmp fcn.10001c20
Function at 0x100020a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x100020c6
mov ecx, dword [ebx + 1]
add ecx, 5
add ecx, ebx
call fcn.100020a0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10024d78]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1002990c]
cmp eax, dword [ecx + 4]
jle 0x1000211e
push 0x1002990c
call fcn.10003aec
add esp, 4
cmp dword [0x1002990c], 0xffffffff
jne 0x1000211e
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x1002990c
mov dword [0x10029908], eax
call fcn.10003a9b
add esp, 4
push esi
mov esi, dword [0x10029908]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x10002143
lea ecx, [esi + 0x1c]
call fcn.10002090
test eax, eax
je 0x10002145
add esi, 0x20
cmp esi, edx
jne 0x10002130
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10001e50
add edi, eax
cmp edi, 5
jl 0x10002147
mov ecx, esi
sub ebx, esi
mov edx, edi
nop dword [eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10002160
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [ebx - 5]
add eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x10021af8
lea eax, [ebp - 4]
mov esi, ecx
push str.Protection.log
push eax
call fcn.1000b464
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x1000226b
push esi
push 0x10021b0c
push eax
call fcn.10001290
push dword [ebp - 4]
call fcn.10006dde
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]