joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436af0
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x436cba
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x436b03
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x580590
call fcn.0055dd89
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x436cb4
xor ebx, ebx
mov esi, str.Speed_Hack_detected_
cmp dword [0x69682c], 1
jne 0x436b87
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0042443d
lea eax, [ebp - 0x164]
mov dword [ebp - 4], ebx
push str._nSP_Scan:
push eax
call fcn.0042141f
lea eax, [ebp - 0x164]
push esi
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x436c42
lea eax, [ebp - 0x14]
push eax
call fcn.0056300a
lea eax, [ebp - 0x14]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x58dacc
lea ecx, [ebp - 0xbc]
push edi
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str.SP_Scan:
push eax
call fcn.0042141f
mov esi, str.Speed_Hack_detected_
lea eax, [ebp - 0xbc]
push esi
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x2c
lea ecx, [ebp - 0xbc]
call fcn.00424a62
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00424592
mov eax, dword [0x696830]
push ebx
cmp eax, 1
jne 0x436c6e
push ebx
push ebx
push 0x436a78
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x436c7c
push ebx
push ebx
push 0x436a00
jmp 0x436c54
cmp eax, 3
jne 0x436c8a
push ebx
push ebx
push 0x42ddfe
jmp 0x436c54
cmp eax, 4
jne 0x436cb2
push ebx
push ebx
push 0x426bb1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.SP_Scan
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x436c67
jmp 0x436c68
call fcn.0055dd66
ret

Function at 0x436cee
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x436df1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x437131
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push 0xac
mov eax, 0x580804
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x437249
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xb8]
call fcn.0042443d
mov dword [ebp - 0x10], 0x5925c4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4371bc
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4371b3
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x437198
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0042141f
mov dword [ebp - 0x10], 0x5925e8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
cmp byte [ebx + 0x13], 0
pop ecx
je 0x437222
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x437216
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4371fb
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x437224
xor ebx, ebx
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.00424a62
lea ecx, [ebp - 0xb8]
call fcn.00424592
mov eax, dword [0x696830]
push ebx
cmp eax, 1
jne 0x437275
push ebx
push ebx
push 0x437390
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x437283
push ebx
push ebx
push 0x437318
jmp 0x43725b
cmp eax, 3
jne 0x437291
push ebx
push ebx
push 0x42ddfe
jmp 0x43725b
cmp eax, 4
jne 0x437313
push ebx
push ebx
push 0x426bb1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], 0x5925e8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4372f9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4372f0
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4372d5
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 0x200010
push str.VM_Scan
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
jmp 0x43726f
jmp 0x43726f
Function at 0x437408
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x696840], 1
push ebx
push esi
push edi
jne 0x4374ac
movzx eax, word [0x449081]
push eax
lea eax, [ebp - 0x10]
push 0x58b300
push eax
call fcn.0055f31c
mov dword [ebp - 0x14], str.A__XE
add esp, 0xc
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x437495
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x14], eax
pop ecx
test esi, esi
je 0x43748c
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ebx + 0xf]
jb 0x437471
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 0x30
push edi
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x7361
cmp word [0x449081], ax
jne 0x4374cd
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
call fcn.00437131
int3

Function at 0x437507
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4374d3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x43751a
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43cf60
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43cd9d
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x580590
call fcn.0055dd89
push dword [ebp + 8]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x43cf58
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x69682c], 1
jne 0x43ce2a
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0042443d
lea eax, [ebp - 0x164]
mov dword [ebp - 4], ebx
push str._nWN_Scan:
push eax
call fcn.0042141f
push dword [ebp + 8]
lea eax, [ebp - 0x164]
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x43cee4
lea eax, [ebp - 0x14]
push eax
call fcn.0056300a
lea eax, [ebp - 0x14]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
mov ebx, 0x58dacc
lea ecx, [ebp - 0xbc]
push ebx
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str.WN_Scan:
push eax
call fcn.0042141f
push dword [ebp + 8]
lea eax, [ebp - 0xbc]
push eax
call fcn.0042141f
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x2c
lea ecx, [ebp - 0xbc]
call fcn.00424a62
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00424592
xor ebx, ebx
mov eax, dword [0x696830]
push ebx
cmp eax, 1
jne 0x43cf10
push ebx
push ebx
push 0x4375a5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x43cf1e
push ebx
push ebx
push 0x43752d
jmp 0x43cef6
cmp eax, 3
jne 0x43cf2c
push ebx
push ebx
push 0x42ddfe
jmp 0x43cef6
cmp eax, 4
jne 0x43cf56
push ebx
push ebx
push 0x426bb1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.WN_Scan
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x43cf09
jmp 0x43cf0a
mov al, 1
call fcn.0055dd66
ret
Function at 0x43d1a4
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
inc edi
cmp dword [0x696854], edi
jne 0x43d1c8
call fcn.0043d637
jmp 0x43d242
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43d1e3
xor eax, eax
jmp 0x43d244
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x43d1df
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x43d1df
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x43d1df
push esi
push esi
push esi
push 0x43d12c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
Function at 0x43d254
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push 0xac
mov eax, 0x580804
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x43d36d
mov dword [ebp - 0x10], 0x58e78c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43d2c6
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x43d2bd
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x43d2a2
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xb8]
call fcn.0042443d
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x591c60
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43d333
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x43d327
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x43d30c
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x43d335
xor ebx, ebx
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0042141f
push dword [0x69677c]
lea eax, [ebp - 0xb8]
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xb8]
call fcn.00424a62
lea ecx, [ebp - 0xb8]
call fcn.00424592
mov eax, dword [0x696830]
cmp eax, 1
je 0x43d3aa
cmp eax, 3
je 0x43d3aa
cmp eax, 4
je 0x43d3aa
push ebx
cmp eax, 2
jne 0x43d3a8
push ebx
push ebx
push 0x43d486
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43d3a2
push ebx
push ebx
push ebx
push 0x43d4fe
jmp 0x43d38e

Function at 0x43d588
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0x5948c0
push 0x58fe24
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d5ac
push 4
push 0x3000
sub ecx, edx
push ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [ebp + 0xc]
mov edi, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x43d5d0
push 0
sub edx, eax
push edx
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
push eax
push eax
push edi
push ebx
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x43d637
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43d576
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43d6ff
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
xor edi, edi
push edi
push edi
push edi
push 0x43e07f
push edi
push edi
call esi
push edi
push edi
push edi
push 0x43e090
push edi
push edi
call esi
push edi
push edi
push edi
push 0x43df08
push edi
push edi
call esi
pop edi
pop esi
ret

Function at 0x43e569
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push 0x160
mov eax, 0x5808a3
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x43e622
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x16c]
call fcn.0042443d
mov dword [ebp - 0x10], 0x594afc
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43e5f7
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x43e5eb
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x43e5d0
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x43e5f9
xor ebx, ebx
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0x16c]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x43e712
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
push 0x58dacc
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
mov dword [ebp - 0x10], 0x594b30
add esp, 0x14
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [eax + 0x13], 0
je 0x43e6db
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
test esi, esi
mov edx, eax
mov esi, dword [ebp - 0x14]
pop ecx
je 0x43e6d1
sub edi, edx
mov eax, ebx
lea ecx, [ebx + edx]
and eax, 7
mov al, byte [eax + esi + 7]
xor al, byte [edi + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [esi + 0xf]
jb 0x43e6ba
mov eax, dword [esi + 0xf]
xor ebx, ebx
mov edi, edx
mov byte [edx + eax], bl
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00424a62
lea ecx, [ebp - 0xc4]
call fcn.00424592
mov eax, dword [0x696830]
cmp eax, 1
je 0x43e74f
cmp eax, 3
je 0x43e74f
cmp eax, 4
je 0x43e74f
push ebx
cmp eax, 2
jne 0x43e74d
push ebx
push ebx
push 0x43e759
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43e747
push ebx
push ebx
push ebx
push 0x43e7d1
jmp 0x43e733
Function at 0x43e849
Capabilities:
Connect to http server
Create http request
Get session user name
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x64
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x43e8e0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push ebx
push 1
push dword [0x6967a0]
mov edi, eax
push dword [0x69679c]
push 0x15
push dword [0x696798]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push ebx
mov esi, eax
mov ebx, str.List
push 2
lea eax, [ebp - 0x68]
push eax
push ebx
push esi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x43e8ee
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
push ebx
call fcn.0056325c
mov dword [esp], 0x58dacc
call fcn.0056325c
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0056325c
pop ecx
call fcn.0043e569
int3
Function at 0x43ebaf
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push 0x160
mov eax, 0x5808a3
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x43ec68
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x16c]
call fcn.0042443d
mov dword [ebp - 0x10], 0x594bf8
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43ec3d
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x43ec31
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x43ec16
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x43ec3f
xor ebx, ebx
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0x16c]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x43ed58
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
push 0x58dacc
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
mov dword [ebp - 0x10], 0x594c2c
add esp, 0x14
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [eax + 0x13], 0
je 0x43ed21
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
test esi, esi
mov edx, eax
mov esi, dword [ebp - 0x14]
pop ecx
je 0x43ed17
sub edi, edx
mov eax, ebx
lea ecx, [ebx + edx]
and eax, 7
mov al, byte [eax + esi + 7]
xor al, byte [edi + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [esi + 0xf]
jb 0x43ed00
mov eax, dword [esi + 0xf]
xor ebx, ebx
mov edi, edx
mov byte [edx + eax], bl
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00424a62
lea ecx, [ebp - 0xc4]
call fcn.00424592
mov eax, dword [0x696830]
cmp eax, 1
je 0x43ed95
cmp eax, 3
je 0x43ed95
cmp eax, 4
je 0x43ed95
push ebx
cmp eax, 2
jne 0x43ed93
push ebx
push ebx
push 0x43ed9f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43ed8d
push ebx
push ebx
push ebx
push 0x43ee17
jmp 0x43ed79

Function at 0x43ee8f
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43efdc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43eea2
Capabilities:
Capture public ip
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
push 0xec
mov eax, 0x5809e0
call fcn.0055ddbc
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push closesocket
push ebx
push ebx
push str.http:__icanhazip.com_
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
mov dword [ebp - 0x50], ebx
test ebx, ebx
je 0x43efd6
lea eax, [ebp - 0x4c]
push eax
push 0x2f
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x4c]
cmp eax, 0x2f
jae 0x43efd1
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xf8]
mov byte [ebp + eax - 0x40], 0
call fcn.0042443d
and dword [ebp - 4], 0
lea eax, [ebp - 0xf8]
push str._nPublic_IP:
push eax
call fcn.0042141f
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0042141f
mov dword [ebp - 0x44], 0x594ca0
add esp, 0x10
mov eax, dword [ebp - 0x44]
mov edi, dword [ebp - 0x44]
add edi, 0x14
mov dword [ebp - 0x48], eax
cmp byte [eax + 0x13], 0
je 0x43ef9a
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
and dword [ebp - 0x44], 0
mov edx, eax
test esi, esi
mov esi, dword [ebp - 0x48]
pop ecx
je 0x43ef91
mov ebx, dword [ebp - 0x44]
sub edi, edx
mov eax, ebx
lea ecx, [ebx + edx]
and eax, 7
mov al, byte [eax + esi + 7]
xor al, byte [edi + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [esi + 0xf]
jb 0x43ef77
mov ebx, dword [ebp - 0x50]
mov eax, dword [esi + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xf8]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0xf8]
call fcn.00424a62
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.0043f05d
lea ecx, [ebp - 0xf8]
call fcn.00424592
call fcn.0055dd7a
ret
call fcn.00561f0b
call fcn.0043ebaf
int3