joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3935
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004b38b1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4b3aa4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4b3aa4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4b3a59
jg 0x4b3991
test eax, eax
je 0x4b3a4f
push 1
push 0x1000
call fcn.004ad9f6
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4b39b4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4b3a46
push 0x8000
push ebx
call fcn.004aac33
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4b39dd
jg 0x4b39d8
cmp ecx, 0x1000
jb 0x4b39dd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004ac581
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b3a22
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4b39d8
jl 0x4b3a09
test ecx, ecx
jne 0x4b39ca
push dword [ebp - 0xc]
push ebx
call fcn.004aac33
push esi
call fcn.004ad3f5
add esp, 0xc
xor ebx, ebx
jmp 0x4b3ab2
cmp byte [edi + 0x24], 0
je 0x4b3a39
cmp dword [edi + 0x20], 5
jne 0x4b3a39
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4b3a44
mov ebx, dword [edi + 0x18]
jmp 0x4b3a46
xor ebx, ebx
push esi
call fcn.004ad3f5
pop ecx
jmp 0x4b3ab2
test ecx, ecx
jg 0x4b3a1b
jl 0x4b3a59
test eax, eax
jae 0x4b3a1b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004b1dbe
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4b3a79
cmp byte [edi + 0x1c], 0
je 0x4b3a1b
jmp 0x4b3aaa
push ebx
call fcn.004af719
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4b3a1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4b3ab2
cmp byte [edi + 0x1c], 0
je 0x4b3aaf
mov ebx, dword [edi + 0x18]
jmp 0x4b3ab2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004b1dbe
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4b5aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b5acd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b5acd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x534f90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe0000]
push edi
jmp 0x534faa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x534fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534fa0
mov eax, 1
add ebx, ebx
jne 0x534fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x534fd4
jne 0x534ff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534ff3
dec eax
add ebx, ebx
jne 0x534fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x534fb8
add ebx, ebx
jne 0x534fef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x535045
xor ecx, ecx
sub eax, 3
jb 0x53500b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53507a
sar eax, 1
mov ebp, eax
jmp 0x535016
add ebx, ebx
jne 0x535016
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534fe4
inc ecx
add ebx, ebx
jne 0x535024
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534fe4
add ebx, ebx
jne 0x535031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x535026
jne 0x535042
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x535026
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x535064
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x535056
jmp 0x534fa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x535064
add edi, ecx
jmp 0x534fa6
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x535082
cmp byte [edi], 0x11
jne 0x535082
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x535087
lea edi, [esi + 0x12d000]
mov eax, dword [edi]
or eax, eax
je 0x5350ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x190e8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x191008]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5350b4
mov ecx, edi
jns 0x5350e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19100c]
or eax, eax
je 0x5350f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5350d1
call dword [esi + 0x19101c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x535130
cmp al, 0xef
ja 0x535123
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x535105
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x535112
mov ebp, dword [esi + 0x191010]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x535164
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x1c418b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b91000]
push edi
or ebp, 0xffffffff
jmp 0x1c418d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1c418d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c418c8
mov eax, 1
add ebx, ebx
jne 0x1c418eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1c418fc
jne 0x1c4191b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c4191b
dec eax
add ebx, ebx
jne 0x1c41908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1c418e0
add ebx, ebx
jne 0x1c41917
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1c4196d
xor ecx, ecx
sub eax, 3
jb 0x1c41933
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1c419a2
sar eax, 1
mov ebp, eax
jmp 0x1c4193e
add ebx, ebx
jne 0x1c4193e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c4190c
inc ecx
add ebx, ebx
jne 0x1c4194c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c4190c
add ebx, ebx
jne 0x1c41959
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1c4194e
jne 0x1c4196a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1c4194e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1c4198c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1c4197e
jmp 0x1c418ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1c4198c
add edi, ecx
jmp 0x1c418ce
pop esi
mov edi, esi
mov ecx, 0x774b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1c419aa
cmp byte [edi], 0x1e
jne 0x1c419aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1c419af
lea edi, [esi + 0x1bf5000]
mov eax, dword [edi]
or eax, eax
je 0x1c41a1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36ca2b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x36ca3c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1c419dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x36ca3cc]
or eax, eax
je 0x1c41a18
mov dword [ebx], eax
add ebx, 4
jmp 0x1c419f9
call dword [esi + 0x36ca3d4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1c41a4f
cmp al, 0xef
ja 0x1c41a42
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1c41a24
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1c41a31
mov ebp, dword [esi + 0x36ca3d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1c41a83
sub esp, 0xffffff80
jmp 0x147d54
Function at 0x417083
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4170c2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4170c2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4170c2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4170c2
cmp dword [ecx + 0x74], 0xe
jbe 0x4170c2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x429360
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42938d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42938d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100010d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 0x10], eax
mov edi, esi
push ebx
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [edi]
lea edi, [edi + 4]
mov edx, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esi + eax*4 + 0x48]
add eax, dword [esi + ecx*4 + 0x448]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [esi + ecx*4 + 0xc48]
xor eax, dword [ebp - 4]
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x100010f3
mov ecx, dword [esi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
pop ebx
pop edi
mov dword [edx], ecx
mov ecx, dword [esi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10001160
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
mov eax, 0x10020a90
mov dword [ebp - 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [ebp - 4], ebx
sub eax, ebx
mov dword [ebp - 0xc], 0x12
mov ecx, 0x400
mov dword [ebp - 0x10], eax
mov esi, 0x10020ad8
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 1]
xor edi, edi
cmp eax, 0x10
cmovl edi, eax
xor ecx, ecx
lea eax, [edi + 1]
cmp eax, 0x10
cmovl ecx, eax
xor edx, edx
lea eax, [ecx + 1]
cmp eax, 0x10
cmovl edx, eax
mov eax, dword [ebp - 8]
movzx esi, byte [ebx + eax]
mov ebx, eax
shl esi, 8
movzx eax, byte [edi + ebx]
or esi, eax
movzx eax, byte [ecx + ebx]
mov ecx, dword [ebp - 4]
shl esi, 8
or esi, eax
movzx eax, byte [edx + ebx]
shl esi, 8
xor ebx, ebx
or esi, eax
lea eax, [edx + 1]
cmp eax, 0x10
cmovl ebx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ecx + eax]
xor eax, esi
mov dword [ecx], eax
add ecx, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], ecx
jne 0x10001196
mov ebx, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.100010d0
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x10001212
lea esi, [ebx + 0x4c]
mov dword [ebp - 0xc], 4
mov edi, 0x80
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.100010d0
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x10001247
sub dword [ebp - 0xc], 1
jne 0x10001242
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100012f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x100264e0
call fcn.10004f50
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000131b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10001326
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10001331
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000133c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10001347
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10001352
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000135d
bts eax, 1
test cl, 2
je 0x10001366
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x100013ff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100013f0
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x100264e0], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10001310
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001430
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10025040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x10021c94
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call fcn.1000b494
add esp, 0xc
test eax, eax
jne 0x10001481
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003742
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.1000b6b4
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x100014d2
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100264e0]
sub edx, 1
jne 0x100014b0
cmp edi, 0x400
je 0x10001483
push dword [ebp - 0x408]
call fcn.10006e0e
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10003742
mov esp, ebp
pop ebp
ret 4
Function at 0x10001500
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.100012f0
cmp dword [0x100264a0], 1
jne 0x100015ba
push str.interface.u
call fcn.10001430
cmp eax, dword [0x100264d4]
je 0x100015ba
push 0x10021ae4
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000b494
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001565
push str.Interface_files_are_changed______Interface.u
push 0x10021af8
push eax
call fcn.10001290
push dword [ebp - 4]
call fcn.10006e0e
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x10
push 0
push str._L2J_Guard_Protection____http:__www.l2jguard.org___n_n___We_find_programs_using_the_same_function_Hackers_Bots._n___Believed_to_be_an_error_._We_inform_or_will_fix._n___Send_folder_L2JGuard__your_system_to_the_Administrator___n_n___Sorry_for_the_inconvenience__we_need_maximum_security_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100264a4], 1
jne 0x10001600
push str.interface.xdat
call fcn.10001430
cmp eax, dword [0x100264d8]
je 0x10001600
push 0x10021ae4
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000b494
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001565
push str.Interface_files_are_changed______Interface.xdat
jmp 0x1000154f
cmp dword [0x100264a8], 1
jne 0x10001646
push str.WarGuard_Protect.bmp
call fcn.10001430
cmp eax, dword [0x100264dc]
je 0x10001646
push 0x10021ae4
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000b494
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001565
push str.Interface_files_are_changed______Image_Protect_BMP
jmp 0x1000154f
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100017a0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push esi
mov esi, dword [0x1002a8fc]
push edi
mov edi, dword [0x1002a900]
cmp esi, edi
je 0x100017d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [eax]
push dword [esi]
call ebx
test eax, eax
jne 0x100017d3
add esi, 4
cmp esi, edi
jne 0x100017c0
pop ebx
pop edi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001860
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10025040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x10001916
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000190f
push esi
nop dword [eax + eax]
mov eax, ebx
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100018de
test dx, dx
je 0x100018da
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100018de
add ecx, 4
add eax, 4
test dx, dx
jne 0x100018b8
xor eax, eax
jmp 0x100018e3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100018fc
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001926
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100018b0
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10003742
mov esp, ebp
pop ebp
ret
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10021ae4
lea eax, [ebp - 0x234]
push str.WarGuard_Log.txt
push eax
call fcn.1000b494
push ebx
push str._ls___WP__n
push dword [ebp - 0x234]
call fcn.10001290
push dword [ebp - 0x234]
call fcn.10006e0e
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10001aff
push 0x10021ae4
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000b494
push esi
push str._s___TW__n
push dword [ebp - 4]
call fcn.10001290
push dword [ebp - 4]
call fcn.10006e0e
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001b10
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, str.Process_Explorer_11.33
call fcn.10001a60
mov ecx, str.Process_Explorer
call fcn.10001a60
mov ecx, str.ArtMoney_PRO_v7.27
call fcn.10001a60
mov ecx, str.ArtMoney_SE_v7.31
call fcn.10001a60
mov ecx, str.ArtMoney_SE_v7.32
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.0
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.1.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.2
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.3
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.4
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.5
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.6
call fcn.10001a60
mov ecx, str.Cheat_Engine_5.6.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_6.0
call fcn.10001a60
mov ecx, str.Cheat_Engine_6.1
call fcn.10001a60
mov ecx, str.Cheat_Engine_6.4
call fcn.10001a60
mov ecx, str.Cheat_Engine
call fcn.10001a60
mov ecx, str.Created_processes
call fcn.10001a60
mov ecx, str.SandBoxie_Plus_v0.9.3
call fcn.10001a60
mov ecx, str.Sandboxie_Control___sandboxie_plus.com
call fcn.10001a60
mov ecx, str.Created_processes
call fcn.10001a60
mov ecx, str.Lineage2_v1.71
call fcn.10001a60
mov ecx, str.XAAAA
jmp fcn.10001a60