joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a490
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013c8b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x63
lea eax, [ebp - 0x87]
mov byte [ebp - 0x88], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x13], 0
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
movq qword [ebp - 0x1b], xmm0
push 0xa
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x90], 0
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 0
push eax
lea eax, [ebp - 0x8c]
push eax
push 0x64
lea eax, [ebp - 0x88]
push eax
push 0x10016750
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x1000a5f1
sub esp, 8
lea ecx, [ebp - 0x140]
push 8
push 0x10016730
call fcn.10001710
mov edx, 0x1001674c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.10002ae0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x140]
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [ebp - 0x140]
call fcn.10001810
call fcn.1000a370
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x144], eax
lea ecx, [ebp - 0x13c]
call fcn.10001890
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0x140], eax
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x144], eax
lea ecx, [ebp - 0xe0]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x1000a5f6
call fcn.1000a250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
Function at 0x1000a610
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.MSVCR120.dll_malloc]
push edi
push 0x14
mov dword [ebp - 4], 4
call esi
add esp, 4
mov dword [ebp - 8], eax
push 0x288
call esi
mov edi, dword [sym.imp.MSVCR120.dll__wassert]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1000a65a
push 0x171
push 0x10016754
push str.AdapterInfo___NULL
call edi
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
call ebx
cmp eax, 0x6f
jne 0x1000a6f2
push dword [ebp - 4]
call esi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000a692
push 0x175
push 0x10016754
push str.AdapterInfo___NULL
call edi
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call ebx
mov edi, dword [ebp - 8]
test eax, eax
jne 0x1000a6df
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x20
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10009420
int3
Function at 0x1000d7b0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
push 0
push 0x1001f800
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edi, 0x80
xor ebx, ebx
mov edi, edi
xor edx, edx
mov eax, ebx
test bl, 1
cmovne edx, edi
shr eax, 1
test al, 1
je 0x1000d7e3
or edx, 0x40
shr eax, 1
test al, 1
je 0x1000d7ec
or edx, 0x20
shr eax, 1
test al, 1
je 0x1000d7f5
or edx, 0x10
shr eax, 1
test al, 1
je 0x1000d7fe
or edx, 8
shr eax, 1
test al, 1
je 0x1000d807
or edx, 4
shr eax, 1
test al, 1
je 0x1000d810
or edx, 2
test al, 2
je 0x1000d817
or edx, 1
shl edx, 0x18
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
xor esi, esi
mov dword [ebx*4 + 0x1001f800], edx
lea ecx, [esi + 0x1f]
mov edi, edi
test dl, 1
je 0x1000d8ee
mov eax, 1
shl eax, cl
or esi, eax
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x1000d8e0
mov dword [ebx*4 + 0x1001f800], esi
inc ebx
cmp ebx, 0xff
jle 0x1000d7d0
pop edi
pop esi
pop ebx
ret
Function at 0x1000d7b8
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
push 0
push 0x1001f800
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edi, 0x80
xor ebx, ebx
mov edi, edi
xor edx, edx
mov eax, ebx
test bl, 1
cmovne edx, edi
shr eax, 1
test al, 1
je 0x1000d7e3
or edx, 0x40
shr eax, 1
test al, 1
je 0x1000d7ec
or edx, 0x20
shr eax, 1
test al, 1
je 0x1000d7f5
or edx, 0x10
shr eax, 1
test al, 1
je 0x1000d7fe
or edx, 8
shr eax, 1
test al, 1
je 0x1000d807
or edx, 4
shr eax, 1
test al, 1
je 0x1000d810
or edx, 2
test al, 2
je 0x1000d817
or edx, 1
shl edx, 0x18
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
xor esi, esi
mov dword [ebx*4 + 0x1001f800], edx
lea ecx, [esi + 0x1f]
mov edi, edi
test dl, 1
je 0x1000d8ee
mov eax, 1
shl eax, cl
or esi, eax
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x1000d8e0
mov dword [ebx*4 + 0x1001f800], esi
inc ebx
cmp ebx, 0xff
jle 0x1000d7d0
pop edi
pop esi
pop ebx
ret

Function at 0x1000d910
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
or ebx, 0xffffffff
push edi
mov dword [ebp - 0x408], eax
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1000d96f
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1001f800]
dec edx
jne 0x1000d957
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x1000d931
push eax
call dword [sym.imp.MSVCR120.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
Function at 0x1000faf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0xf
push 0x6c387c
call edi
mov eax, 0x6c387c
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xf
push 0x6c387c
call edi
mov esi, dword [0x1001f6b0]
lea eax, [ebp - 4]
push eax
push 0x40
push 0xf
push 0x6c387c
call edi
mov eax, dword [esi]
mov ecx, 0x6c387c
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
movzx eax, byte [esi + 0xe]
mov byte [ecx + 0xe], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xf
push ecx
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4eb135
call edi
mov eax, 0x4eb135
mov dword [eax], 0
mov byte [eax + 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x4eb135
call edi
mov esi, dword [0x1001f6b4]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4eb135
call edi
mov eax, dword [esi]
mov ecx, 0x4eb135
mov dword [ecx], eax
movzx eax, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ecx
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4eb140
call edi
mov eax, 0x4eb140
mov dword [eax], 0
mov byte [eax + 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x4eb140
call edi
mov esi, dword [0x1001f6b4]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4eb140
call edi
mov eax, dword [esi]
mov ecx, 0x4eb140
mov dword [ecx], eax
movzx eax, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ecx
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0xd
push 0x6bbc14
call edi
mov eax, 0x6bbc14
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov byte [eax + 0xc], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xd
push 0x6bbc14
call edi
mov esi, dword [0x1001f6b8]
lea eax, [ebp - 4]
push eax
push 0x40
push 0xd
push 0x6bbc14
call edi
mov eax, dword [esi]
mov ecx, 0x6bbc14
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movzx eax, byte [esi + 0xc]
mov byte [ecx + 0xc], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xd
push ecx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010660
Capabilities:
Create thread
Enumerate processes
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014006
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 2
mov dword [ebp - 0x138], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100106ff
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
mov edi, edi
mov eax, edi
lea ecx, [ebp - 0x114]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100106e8
test dl, dl
je 0x100106e4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100106e8
add ecx, 2
add eax, 2
test dl, dl
jne 0x100106c8
xor eax, eax
jmp 0x100106ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x10010727
lea eax, [ebp - 0x138]
push eax
push esi
call ebx
test eax, eax
jne 0x100106c0
cmp esi, 0xffffffff
je 0x1001070b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
cmp dword [0x1001f720], 1
jne 0x1001077b
sub esp, 8
lea ecx, [ebp - 0x290]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_PID_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.10002ae0
mov edx, edi
lea ecx, [ebp - 0x290]
call fcn.10002ae0
lea ecx, [ebp - 0x290]
mov dword [ebp - 4], 0xffffffff
call fcn.10001650
cmp dword [0x1001f734], 1
jne 0x10010838
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
add esp, 4
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
push ecx
push 8
push 0x100154c0
lea ecx, [ebp - 0x1e8]
mov esi, eax
call fcn.10001710
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1e8]
call fcn.10002ae0
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
add esp, 4
lea ecx, [ebp - 0x1e8]
mov edx, eax
call fcn.10002ae0
mov edx, str.PID_Scan:
lea ecx, [ebp - 0x1e8]
call fcn.10002ae0
mov edx, edi
lea ecx, [ebp - 0x1e8]
call fcn.10002ae0
mov edx, str._n__________________
lea ecx, [ebp - 0x1e8]
call fcn.10002ae0
lea ecx, [ebp - 0x1e8]
call fcn.10001810
push 2
push 0x100154c0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x1e8]
call fcn.10001650
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x1001086a
push 0
push 0
push 0x10010640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1001087a
push 0
push 0
push 0x10010620
jmp 0x1001084d
cmp eax, 3
jne 0x10010864
push 0
push 0
push 0x10001350
jmp 0x1001084d
Function at 0x10010c30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a0c
call fcn.100136c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
push esi
push esi
mov dword [ebp - 0x20a04], eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x10010d2c
lea ebx, [ebp - 0x209fc]
lea esp, [esp]
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10010d0a
lea eax, [ebp - 0x20a08]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x20a08]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x10010d0a
mov eax, dword [ebp - 0x20a08]
mov dword [ebx], eax
lea eax, [ebx + 4]
push 0xff
push eax
push edi
mov dword [ebx - 4], edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xff
lea eax, [ebx + 0x103]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
inc dword [ebp - 0x20a04]
add ebx, 0x208
mov ecx, dword [ebp - 0x20a08]
xor eax, eax
test esi, esi
jle 0x10010cfe
lea ebx, [ebx]
cmp ecx, dword [ebp + eax*4 - 0x408]
je 0x10010cfe
inc eax
cmp eax, esi
jl 0x10010cf0
cmp eax, esi
jne 0x10010d0a
mov dword [ebp + esi*4 - 0x408], ecx
inc esi
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x10010c70
mov eax, dword [ebp - 0x20a04]
test eax, eax
je 0x10010d2c
cmp esi, 1
jg 0x10010d45
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012bb9
mov esp, ebp
pop ebp
ret
call fcn.100109f0
int3
Function at 0x100118d0
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x10011902
push 0
push 0
push 0x100118b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10011912
push 0
push 0
push 0x10011890
jmp 0x100118e5
cmp eax, 3
jne 0x10011922
push 0
push 0
push 0x10001350
jmp 0x100118e5
jmp 0x100118fc
Function at 0x10011d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10013b8b
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
cmp dword [0x1001f720], 1
jne 0x10011e1b
sub esp, 8
lea ecx, [esp + 0xc]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_AKS_Scan:
mov dword [esp + 0xb8], 0
lea ecx, [esp + 4]
call fcn.10002ae0
mov edx, str.Thread_attack_
lea ecx, [esp + 4]
call fcn.10002ae0
lea ecx, [esp + 4]
call fcn.10001810
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + eax + 4], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [esp + ecx], eax
lea ecx, [esp + 8]
call fcn.10001890
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [esp + ecx + 4], eax
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [esp + ecx], eax
lea ecx, [esp + 0x64]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x10011e4d
push 0
push 0
push 0x10011d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10011e5d
push 0
push 0
push 0x10011cd0
jmp 0x10011e30
cmp eax, 3
jne 0x10011e6d
push 0
push 0
push 0x10001350
jmp 0x10011e30
jmp 0x10011e47
Function at 0x10012020
Capabilities:
Create thread
Terminate process

Disassembly:
mov dword [0x10020460], 0
mov dword [0x10020464], 0
mov dword [0x10020474], 0
mov dword [0x10020424], 0
mov dword [0x10020418], 0
mov dword [0x10020408], 0
mov dword [0x10020448], 0
mov dword [0x10020454], 0
mov dword [0x10020440], 0
mov dword [0x1002041c], 0
mov dword [0x10020468], 0
mov dword [0x10020458], 0
mov dword [0x1002042c], 0
mov dword [0x10020470], 0
mov dword [0x10020428], 0
mov dword [0x10020478], 0
mov dword [0x1002043c], 0
mov dword [0x1002047c], 0
mov dword [0x10020444], 0
mov dword [0x10020420], 0
mov dword [0x10020404], 0
mov dword [0x1002040c], 0
mov dword [0x1002044c], 0
mov dword [0x10020430], 0
mov dword [0x10020438], 0
mov dword [0x10020434], 0
ret
mov eax, dword [0x10020434]
add eax, dword [0x10020438]
add eax, dword [0x10020430]
add eax, dword [0x1002044c]
add eax, dword [0x1002040c]
add eax, dword [0x10020404]
add eax, dword [0x10020420]
add eax, dword [0x10020444]
add eax, dword [0x1002047c]
add eax, dword [0x1002043c]
add eax, dword [0x10020478]
add eax, dword [0x10020428]
add eax, dword [0x10020470]
add eax, dword [0x1002042c]
add eax, dword [0x10020458]
add eax, dword [0x10020468]
add eax, dword [0x1002041c]
add eax, dword [0x10020440]
add eax, dword [0x10020454]
add eax, dword [0x10020448]
add eax, dword [0x10020408]
add eax, dword [0x10020418]
add eax, dword [0x10020424]
add eax, dword [0x10020474]
add eax, dword [0x10020464]
add eax, dword [0x10020460]
cmp eax, dword [0x1002046c]
jne fcn.10011d50
jmp 0x10011f10

Function at 0x10012140
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push fcn.10007390
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [0x1001f7a0]
cdq
sub eax, edx
mov dword [0x10020464], 1
sar eax, 1
push eax
mov dword [0x10020420], 1
call ebx
mov eax, 0x10624dd3
inc esi
imul dword [0x1001f788]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jne 0x10012162
push 0
push 0
push 0
push fcn.10007390
push 0
push 0
call edi
jmp 0x10012160
Function at 0x10012280
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001410b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1001f720], 1
jne 0x1001235f
sub esp, 8
lea ecx, [ebp - 0xb8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_VM_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.10002ae0
mov edx, str.Virtual_memory_Value_changed_
lea ecx, [ebp - 0xb8]
call fcn.10002ae0
lea ecx, [ebp - 0xb8]
call fcn.10001810
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xb8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0xbc], eax
lea ecx, [ebp - 0xb4]
call fcn.10001890
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xbc], eax
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x10012391
push 0
push 0
push 0x10012260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100123a1
push 0
push 0
push 0x10012240
jmp 0x10012374
cmp eax, 3
jne 0x100123b1
push 0
push 0
push 0x10001350
jmp 0x10012374
jmp 0x1001238b
Function at 0x10012400
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001410b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1001f720], 1
jne 0x100124df
sub esp, 8
lea ecx, [ebp - 0xb8]
push 8
push str.GameGuard_Log.txt
call fcn.10001710
mov edx, str._n_VML_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.10002ae0
mov edx, str.Virtual_memory_value_changed_
lea ecx, [ebp - 0xb8]
call fcn.10002ae0
lea ecx, [ebp - 0xb8]
call fcn.10001810
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xb8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0xbc], eax
lea ecx, [ebp - 0xb4]
call fcn.10001890
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.MSVCP120.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xbc], eax
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x1001f724]
push 0
cmp eax, 1
jne 0x10012511
push 0
push 0
push 0x100123e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10012521
push 0
push 0
push 0x100123c0
jmp 0x100124f4
cmp eax, 3
jne 0x10012531
push 0
push 0
push 0x10001350
jmp 0x100124f4
jmp 0x1001250b