Function at 0x1000dc60
Capabilities:
Create thread
Encode data using xor
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013ea9
mov eax, dword fs:[0]
push eax
sub esp, 0x564
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1000d7b0
cmp dword [0x1001f700], 1
mov esi, dword [sym.imp.MSVCR120.dll_fopen]
jne 0x1000dde9
push 0x10016df4
push dword [0x1001f67c]
or ebx, 0xffffffff
call esi
add esp, 8
mov dword [ebp - 0x414], eax
test eax, eax
jne 0x1000dcd0
or ebx, 0xffffffff
jmp 0x1000dd2e
push eax
push 0x400
lea eax, [ebp - 0x410]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov edi, eax
lea esi, [ebp - 0x410]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1000dd0e
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1001f800]
dec edx
jne 0x1000dcf6
mov eax, dword [ebp - 0x414]
cmp edi, 0x400
je 0x1000dcd0
push eax
call dword [sym.imp.MSVCR120.dll_fclose]
mov esi, dword [sym.imp.MSVCR120.dll_fopen]
add esp, 4
not ebx
cmp ebx, dword [0x1001f7d0]
je 0x1000dde9
cmp dword [0x1001f720], 1
jne 0x1000dd96
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, dword [0x1001f67c]
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000dddc
cmp eax, 3
je 0x1000dddc
push 0
cmp eax, 2
jne 0x1000ddd2
push 0
push 0
push 0x1000d9a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x1000ddcc
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000d9c0
jmp 0x1000ddb5
cmp dword [0x1001f6f4], 1
jne 0x1000deb7
push 0x10016df4
push str.Data_Player_player.bmd
call esi
add esp, 8
test eax, eax
jne 0x1000de0e
or eax, 0xffffffff
jmp 0x1000de15
mov ecx, eax
call fcn.1000d910
cmp eax, dword [0x1001f7d4]
je 0x1000deb7
cmp dword [0x1001f720], 1
jne 0x1000de7c
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_Player_player.bmd
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000dea7
cmp eax, 3
je 0x1000dea7
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000d9e0
jmp 0x1000ddb5
push 0
jmp 0x1000ddcc
push 0
push 0
push 0
push 0x1000da00
jmp 0x1000ddb5
cmp dword [0x1001f6f8], 1
jne 0x1000df82
push 0x10016df4
push str.GameGuard_Protect.bmp
call esi
add esp, 8
test eax, eax
jne 0x1000dedc
or eax, 0xffffffff
jmp 0x1000dee3
mov ecx, eax
call fcn.1000d910
cmp eax, dword [0x1001f7d8]
je 0x1000df82
cmp dword [0x1001f720], 1
jne 0x1000df4a
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.GameGuard_Protect.bmp
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000df72
cmp eax, 3
je 0x1000df72
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000da20
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000da40
jmp 0x1000ddb5
cmp dword [0x1001f6fc], 1
jne 0x1000e04d
push 0x10016df4
push str.Data_Local_Webzenlogo.OZJ
call esi
add esp, 8
test eax, eax
jne 0x1000dfa7
or eax, 0xffffffff
jmp 0x1000dfae
mov ecx, eax
call fcn.1000d910
cmp eax, dword [0x1001f7dc]
je 0x1000e04d
cmp dword [0x1001f720], 1
jne 0x1000e015
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_Local_Webzenlogo.OZJ
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e03d
cmp eax, 3
je 0x1000e03d
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000da60
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000da80
jmp 0x1000ddb5
cmp dword [0x1001f6f0], 1
jne 0x1000e5dc
push 0x10016df4
push str.Data_World1_EncTerrain1.att
call esi
add esp, 8
test eax, eax
jne 0x1000e079
mov dword [ebp - 0x414], 0xffffffff
jmp 0x1000e086
mov ecx, eax
call fcn.1000d910
mov dword [ebp - 0x414], eax
push 0x10016df4
push str.Data_World2_EncTerrain2.att
call esi
add esp, 8
test eax, eax
jne 0x1000e0a5
mov dword [ebp - 0x420], 0xffffffff
jmp 0x1000e0b2
mov ecx, eax
call fcn.1000d910
mov dword [ebp - 0x420], eax
push 0x10016df4
push str.Data_World3_EncTerrain3.att
call esi
add esp, 8
test eax, eax
jne 0x1000e0d1
mov dword [ebp - 0x41c], 0xffffffff
jmp 0x1000e0de
mov ecx, eax
call fcn.1000d910
mov dword [ebp - 0x41c], eax
push 0x10016df4
push str.Data_World4_EncTerrain4.att
call esi
add esp, 8
test eax, eax
jne 0x1000e0fd
mov dword [ebp - 0x418], 0xffffffff
jmp 0x1000e10a
mov ecx, eax
call fcn.1000d910
mov dword [ebp - 0x418], eax
push 0x10016df4
push str.Data_World5_EncTerrain5.att
call esi
add esp, 8
test eax, eax
jne 0x1000e122
or ebx, 0xffffffff
jmp 0x1000e12b
mov ecx, eax
call fcn.1000d910
mov ebx, eax
push 0x10016df4
push str.Data_World6_EncTerrain6.att
call esi
add esp, 8
test eax, eax
jne 0x1000e143
or edi, 0xffffffff
jmp 0x1000e14c
mov ecx, eax
call fcn.1000d910
mov edi, eax
push 0x10016df4
push str.Data_World7_EncTerrain7.att
call esi
add esp, 8
test eax, eax
jne 0x1000e164
or eax, 0xffffffff
jmp 0x1000e16b
mov ecx, eax
call fcn.1000d910
mov ecx, dword [ebp - 0x414]
cmp ecx, dword [0x1001f7e0]
je 0x1000e210
cmp dword [0x1001f720], 1
jne 0x1000e1d8
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_World1_EncTerrain1.att
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e200
cmp eax, 3
je 0x1000e200
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000daa0
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000dac0
jmp 0x1000ddb5
mov ecx, dword [ebp - 0x420]
cmp ecx, dword [0x1001f7e4]
je 0x1000e2b5
cmp dword [0x1001f720], 1
jne 0x1000e27d
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_World2_EncTerrain2.att
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e2a5
cmp eax, 3
je 0x1000e2a5
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000dae0
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000db00
jmp 0x1000ddb5
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [0x1001f7e8]
je 0x1000e35a
cmp dword [0x1001f720], 1
jne 0x1000e322
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_World3_EncTerrain3.att
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e34a
cmp eax, 3
je 0x1000e34a
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000db20
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000db40
jmp 0x1000ddb5
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [0x1001f7ec]
je 0x1000e3ff
cmp dword [0x1001f720], 1
jne 0x1000e3c7
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_World4_EncTerrain4.att
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e3ef
cmp eax, 3
je 0x1000e3ef
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000db60
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000db80
jmp 0x1000ddb5
cmp ebx, dword [0x1001f7f0]
je 0x1000e49e
cmp dword [0x1001f720], 1
jne 0x1000e466
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_World5_EncTerrain5.att
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e48e
cmp eax, 3
je 0x1000e48e
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000dba0
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000dbc0
jmp 0x1000ddb5
cmp edi, dword [0x1001f7f4]
je 0x1000e53d
cmp dword [0x1001f720], 1
jne 0x1000e505
sub esp, 8
lea ecx, [ebp - 0x4c8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
mov edx, str.Data_World6_EncTerrain6.att
lea ecx, [ebp - 0x4c8]
call fcn.10002ae0
lea ecx, [ebp - 0x4c8]
call fcn.10001810
lea ecx, [ebp - 0x4c8]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e52d
cmp eax, 3
je 0x1000e52d
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000dbe0
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000dc00
jmp 0x1000ddb5
cmp eax, dword [0x1001f7f8]
je 0x1000e5dc
cmp dword [0x1001f720], 1
jne 0x1000e5a4
sub esp, 8
lea ecx, [ebp - 0x570]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_CRC_Scan:
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x570]
call fcn.10002ae0
mov edx, str.Data_World7_EncTerrain7.att
lea ecx, [ebp - 0x570]
call fcn.10002ae0
lea ecx, [ebp - 0x570]
call fcn.10001810
lea ecx, [ebp - 0x570]
call fcn.10001650
mov eax, dword [0x1001f724]
cmp eax, 1
je 0x1000e5cc
cmp eax, 3
je 0x1000e5cc
cmp eax, 2
jne 0x1000dea0
push 0
push 0
push 0
push 0x1000dc20
jmp 0x1000ddb5
push 0
push 0
push 0
push 0x1000dc40
jmp 0x1000ddb5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012bb9
mov esp, ebp
pop ebp
ret