joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012f60
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100324a6
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push esi
mov eax, dword [0x1003e6c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10044644], 1
jne 0x1001303c
push 8
push str.GameGuard_Log.txt
lea eax, [ebp - 0x168]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x168]
push str._nFN_Scan:____Thats_not_my_window_Name__My_window_name_is:
push ecx
mov dword [ebp - 4], 0
call fcn.10003a90
mov edx, dword [0x100445a8]
push edx
lea eax, [ebp - 0x168]
push eax
call fcn.10003a90
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.10002fb0
test eax, eax
jne 0x10013011
mov ecx, dword [ebp - 0x168]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0x15c]
lea ecx, [ebp + ecx - 0x168]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10013009
or eax, 4
push 0
push eax
call fcn.10001570
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea edx, [ebp - 0x108]
push edx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
cmp dword [0x10044654], 1
jne 0x10013144
lea eax, [ebp - 0x18]
push eax
call fcn.1001a8a0
lea ecx, [ebp - 0x18]
add esp, 4
push ecx
call fcn.1001a747
add esp, 4
push 8
push 0x10036584
lea edx, [ebp - 0xc0]
push edx
mov esi, eax
call fcn.10001fe0
lea eax, [ebp - 0xc0]
push str._nLocal_Time:
push eax
mov dword [ebp - 4], 1
call fcn.10003a90
push esi
call fcn.1001a090
add esp, 0xc
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.10003a90
lea edx, [ebp - 0xc0]
push str.FN_Scan:____Thats_not_my_Window_name__My_Window_Name_is:
push edx
call fcn.10003a90
mov eax, dword [0x100445a8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.10003a90
lea edx, [ebp - 0xc0]
push str._n__________________
push edx
call fcn.10003a90
add esp, 0x20
lea ecx, [ebp - 0xbc]
call fcn.10002fb0
test eax, eax
jne 0x10013115
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0xb4]
lea ecx, [ebp + ecx - 0xc0]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x1001310d
or eax, 4
push 0
push eax
call fcn.10001570
push 2
push 0x10036584
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea ecx, [ebp - 0x60]
push ecx
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
mov eax, dword [0x10044648]
push 0
cmp eax, 1
jne 0x10013176
push 0
push 0
push 0x10012ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10013186
push 0
push 0
push 0x10012f10
jmp 0x10013159
cmp eax, 3
jne 0x10013196
push 0
push 0
push 0x10012f30
jmp 0x10013159
cmp eax, 4
jne 0x100131c9
push 0
push 0
push 0x10017bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x100445a8]
push 0x200010
push str.FN_Scan
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001316e
jmp 0x10013170
Function at 0x100131d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032918
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1003e6c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor ebx, ebx
mov edi, eax
push ebx
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.100033f0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x10013234
lea eax, [ebp - 0x2c]
inc edi
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x100445a8]
mov eax, ecx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013250
mov edi, dword [ebp - 0x1c]
sub eax, esi
mov esi, eax
mov eax, edi
cmp edi, esi
jb 0x10013266
mov eax, esi
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp ebx, 0x10
jae 0x10013274
lea edx, [ebp - 0x2c]
call fcn.1000c270
test eax, eax
jne 0x1001328a
cmp edi, esi
jb 0x1001328a
cmp edi, esi
setne al
test eax, eax
je 0x1001328f
call fcn.10012f60
cmp ebx, 0x10
jb 0x100132a0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1001a26e
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019013
mov esp, ebp
pop ebp
ret
Function at 0x10013550
Capabilities:
Hash data using crc32b

Disassembly:
push 0x400
push 0
push 0x10044730
call fcn.1001ead0
add esp, 0xc
push esi
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10013574
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10013580
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x1001358a
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10013594
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1001359e
or eax, 8
shr ecx, 1
test cl, 1
je 0x100135a8
or eax, 4
shr ecx, 1
test cl, 1
je 0x100135b2
or eax, 2
test cl, 2
je 0x100135ba
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor esi, esi
mov dword [edx*4 + 0x10044730], ecx
mov eax, ecx
lea ecx, [esi + 0x1f]
test al, 1
je 0x10013680
mov edi, 1
shl edi, cl
or esi, edi
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10013673
mov dword [edx*4 + 0x10044730], esi
inc edx
cmp edx, 0xff
jle 0x10013568
pop edi
pop esi
ret

Function at 0x100136a0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1003e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x408], edi
or esi, 0xffffffff
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.1001b921
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x10013705
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
shr esi, 8
xor esi, dword [edi*4 + 0x10044730]
inc edx
dec ecx
jne 0x100136e4
mov edi, dword [ebp - 0x408]
cmp eax, 0x400
je 0x100136c1
push edi
call fcn.1001a82c
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
not eax
pop ebx
call fcn.10019013
mov esp, ebp
pop ebp
ret
Function at 0x10015860
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1003e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10015897
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019013
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10015887
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x18]
push 0
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10015887
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10015887
push 0
push 0
push 0
push 0x10015810
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.10019013
mov esp, ebp
pop ebp
ret
Function at 0x10015980
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100324a6
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push esi
mov eax, dword [0x1003e6c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ebx
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10015bf8
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x10044644], 1
jne 0x10015a74
push 8
push str.GameGuard_Log.txt
lea eax, [ebp - 0x168]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x168]
push str._nWN_Scan:
push ecx
mov dword [ebp - 4], 0
call fcn.10003a90
lea edx, [ebp - 0x168]
push ebx
push edx
call fcn.10003a90
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.10002fb0
test eax, eax
jne 0x10015a49
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x15c]
lea ecx, [ebp + ecx - 0x168]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10015a41
or eax, 4
push 0
push eax
call fcn.10001570
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
cmp dword [0x10044654], 1
jne 0x10015b77
lea edx, [ebp - 0x18]
push edx
call fcn.1001a8a0
lea eax, [ebp - 0x18]
add esp, 4
push eax
call fcn.1001a747
add esp, 4
push 8
push 0x10036584
lea ecx, [ebp - 0xc0]
push ecx
mov esi, eax
call fcn.10001fe0
lea edx, [ebp - 0xc0]
push str._nLocal_Time:
push edx
mov dword [ebp - 4], 1
call fcn.10003a90
push esi
call fcn.1001a090
add esp, 0xc
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.10003a90
lea ecx, [ebp - 0xc0]
push str.WN_Scan:
push ecx
call fcn.10003a90
lea edx, [ebp - 0xc0]
push ebx
push edx
call fcn.10003a90
lea eax, [ebp - 0xc0]
push str._n__________________
push eax
call fcn.10003a90
add esp, 0x20
lea ecx, [ebp - 0xbc]
call fcn.10002fb0
test eax, eax
jne 0x10015b48
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0xb4]
lea ecx, [ebp + ecx - 0xc0]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10015b40
or eax, 4
push 0
push eax
call fcn.10001570
push 2
push 0x10036584
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea edx, [ebp - 0x60]
push edx
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
mov eax, dword [0x10044648]
push 0
cmp eax, 1
jne 0x10015ba9
push 0
push 0
push 0x10015950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10015bb9
push 0
push 0
push 0x10015920
jmp 0x10015b8c
cmp eax, 3
jne 0x10015bc9
push 0
push 0
push 0x10012f30
jmp 0x10015b8c
cmp eax, 4
jne 0x10015bf6
push 0
push 0
push 0x10017bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.WN_Scan
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10015ba1
jmp 0x10015ba3
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016980
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100324a6
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push esi
mov eax, dword [0x1003e6c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10044644], 1
jne 0x10016a5a
push 8
push str.GameGuard_Log.txt
lea eax, [ebp - 0x168]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x168]
push str._nI_Scan:
push ecx
mov dword [ebp - 4], 0
call fcn.10003a90
lea edx, [ebp - 0x168]
push str.Dll_injection_
push edx
call fcn.10003a90
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.10002fb0
test eax, eax
jne 0x10016a2f
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x15c]
lea ecx, [ebp + ecx - 0x168]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10016a27
or eax, 4
push 0
push eax
call fcn.10001570
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
cmp dword [0x10044654], 1
jne 0x10016b61
lea edx, [ebp - 0x18]
push edx
call fcn.1001a8a0
lea eax, [ebp - 0x18]
add esp, 4
push eax
call fcn.1001a747
add esp, 4
push 8
push 0x10036584
lea ecx, [ebp - 0xc0]
push ecx
mov esi, eax
call fcn.10001fe0
lea edx, [ebp - 0xc0]
push str._nLocal_Time:
push edx
mov dword [ebp - 4], 1
call fcn.10003a90
push esi
call fcn.1001a090
add esp, 0xc
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.10003a90
lea ecx, [ebp - 0xc0]
push str.I_Scan:
push ecx
call fcn.10003a90
lea edx, [ebp - 0xc0]
push str.Dll_injection_
push edx
call fcn.10003a90
lea eax, [ebp - 0xc0]
push str._n__________________
push eax
call fcn.10003a90
add esp, 0x20
lea ecx, [ebp - 0xbc]
call fcn.10002fb0
test eax, eax
jne 0x10016b32
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0xb4]
lea ecx, [ebp + ecx - 0xc0]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10016b2a
or eax, 4
push 0
push eax
call fcn.10001570
push 2
push 0x10036584
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea edx, [ebp - 0x60]
push edx
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
mov eax, dword [0x10044648]
push 0
cmp eax, 1
jne 0x10016b93
push 0
push 0
push 0x10016950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10016ba3
push 0
push 0
push 0x10016920
jmp 0x10016b76
cmp eax, 3
jne 0x10016bb3
push 0
push 0
push 0x10012f30
jmp 0x10016b76
cmp eax, 4
jne 0x10016be4
push 0
push 0
push 0x10017bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.I_Scan
push str.Dll_injection_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10016b8b
jmp 0x10016b8d
Function at 0x10017320
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100324a6
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push esi
mov eax, dword [0x1003e6c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10044644], 1
jne 0x100173fa
push 8
push str.GameGuard_Log.txt
lea eax, [ebp - 0x168]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x168]
push str._nHT_Scan:
push ecx
mov dword [ebp - 4], 0
call fcn.10003a90
lea edx, [ebp - 0x168]
push str.Hide_windows_detected_
push edx
call fcn.10003a90
add esp, 0x10
lea ecx, [ebp - 0x164]
call fcn.10002fb0
test eax, eax
jne 0x100173cf
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x15c]
lea ecx, [ebp + ecx - 0x168]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x100173c7
or eax, 4
push 0
push eax
call fcn.10001570
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
cmp dword [0x10044654], 1
jne 0x10017501
lea edx, [ebp - 0x18]
push edx
call fcn.1001a8a0
lea eax, [ebp - 0x18]
add esp, 4
push eax
call fcn.1001a747
add esp, 4
push 8
push 0x10036584
lea ecx, [ebp - 0xc0]
push ecx
mov esi, eax
call fcn.10001fe0
lea edx, [ebp - 0xc0]
push str._nLocal_Time:
push edx
mov dword [ebp - 4], 1
call fcn.10003a90
push esi
call fcn.1001a090
add esp, 0xc
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.10003a90
lea ecx, [ebp - 0xc0]
push str.HT_Scan:
push ecx
call fcn.10003a90
lea edx, [ebp - 0xc0]
push str.Hide_windows_detected_
push edx
call fcn.10003a90
lea eax, [ebp - 0xc0]
push str._n__________________
push eax
call fcn.10003a90
add esp, 0x20
lea ecx, [ebp - 0xbc]
call fcn.10002fb0
test eax, eax
jne 0x100174d2
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0xb4]
lea ecx, [ebp + ecx - 0xc0]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x100174ca
or eax, 4
push 0
push eax
call fcn.10001570
push 2
push 0x10036584
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.10002140
lea edx, [ebp - 0x60]
push edx
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
mov eax, dword [0x10044648]
push 0
cmp eax, 1
jne 0x10017533
push 0
push 0
push 0x100172f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10017543
push 0
push 0
push 0x100172c0
jmp 0x10017516
cmp eax, 3
jne 0x10017553
push 0
push 0
push 0x10012f30
jmp 0x10017516
cmp eax, 4
jne 0x10017584
push 0
push 0
push 0x10017bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.H_Scan
push str.Generic_Hide_Window
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001752b
jmp 0x1001752d
Function at 0x10017590
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a0c
call fcn.1002a3e0
mov eax, dword [0x1003e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x20a04], ebx
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
jbe 0x1001768f
lea edi, [ebp - 0x209fc]
lea ebx, [ebx]
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x1001766a
lea eax, [ebp - 0x20a08]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x20a08]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x1001766a
mov edx, dword [ebp - 0x20a08]
push 0xff
lea eax, [edi + 4]
push eax
push esi
mov dword [edi - 4], esi
mov dword [edi], edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xff
lea ecx, [edi + 0x103]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
inc dword [ebp - 0x20a04]
mov ecx, dword [ebp - 0x20a08]
add edi, 0x208
xor eax, eax
test ebx, ebx
jle 0x1001765e
jmp 0x10017650
cmp ecx, dword [ebp + eax*4 - 0x408]
je 0x1001765e
inc eax
cmp eax, ebx
jl 0x10017650
cmp eax, ebx
jne 0x1001766a
mov dword [ebp + ebx*4 - 0x408], ecx
inc ebx
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x100175d0
cmp dword [ebp - 0x20a04], eax
je 0x1001768f
cmp ebx, 1
jle 0x1001768f
call fcn.10017320
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019013
mov esp, ebp
pop ebp
ret

Function at 0x10017760
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x10044648]
cmp eax, 1
je 0x100177ae
cmp eax, 4
je 0x100177ae
push 0
cmp eax, 2
jne 0x1001779c
push 0
push 0
push 0x10017700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x100177ac
push 0
push 0
push 0x10012f30
jmp 0x1001777f
jmp 0x10017796
push 0
push 0
push 0
push 0x10017730
jmp 0x1001777f
Function at 0x10017cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10032dbb
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x1003e6c4]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
cmp dword [0x10044644], 1
jne 0x10017d82
push 8
push str.GameGuard_Log.txt
lea eax, [esp + 0xc]
push eax
call fcn.10001fe0
lea ecx, [esp + 4]
push str._nAKS_Scan:
push ecx
mov dword [esp + 0xc0], 0
call fcn.10003a90
lea edx, [esp + 0xc]
push str.Thread_attack_
push edx
call fcn.10003a90
add esp, 0x10
lea ecx, [esp + 8]
call fcn.10002fb0
test eax, eax
jne 0x10017d59
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0x10]
lea ecx, [esp + ecx + 4]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10017d51
or eax, 4
push 0
push eax
call fcn.10001570
lea ecx, [esp + 0x64]
mov dword [esp + 0xb8], 0xffffffff
call fcn.10002140
lea ecx, [esp + 0x64]
push ecx
mov dword [esp + 0x68], vtable.std::ios_base.0
call fcn.10018604
add esp, 4
mov eax, dword [0x10044648]
cmp eax, 1
je 0x10017dd0
cmp eax, 4
je 0x10017dd0
push 0
cmp eax, 2
jne 0x10017dbe
push 0
push 0
push 0x10017c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x10017dce
push 0
push 0
push 0x10012f30
jmp 0x10017da1
jmp 0x10017db8
push 0
push 0
push 0
push 0x10017c60
jmp 0x10017da1

Function at 0x10017ef0
Capabilities:
Create thread
Terminate process

Disassembly:
xor eax, eax
mov dword [0x10045378], eax
mov dword [0x1004537c], eax
mov dword [0x10045348], eax
mov dword [0x1004533c], eax
mov dword [0x10045330], eax
mov dword [0x10045364], eax
mov dword [0x1004536c], eax
mov dword [0x1004535c], eax
mov dword [0x10045340], eax
mov dword [0x10045384], eax
mov dword [0x10045370], eax
mov dword [0x10045350], eax
mov dword [0x1004538c], eax
mov dword [0x1004534c], eax
mov dword [0x10045390], eax
mov dword [0x10045358], eax
mov dword [0x10045394], eax
mov dword [0x10045360], eax
mov dword [0x10045344], eax
mov dword [0x1004472c], eax
mov dword [0x10045334], eax
mov dword [0x10045380], eax
mov dword [0x10045354], eax
ret
mov eax, dword [0x10045354]
add eax, dword [0x10045380]
inc dword [0x1004a3b8]
add eax, dword [0x10045334]
add eax, dword [0x1004472c]
add eax, dword [0x10045344]
add eax, dword [0x10045360]
add eax, dword [0x10045394]
add eax, dword [0x10045358]
add eax, dword [0x10045390]
add eax, dword [0x1004534c]
add eax, dword [0x1004538c]
add eax, dword [0x10045350]
add eax, dword [0x10045370]
add eax, dword [0x10045384]
add eax, dword [0x10045340]
add eax, dword [0x1004535c]
add eax, dword [0x1004536c]
add eax, dword [0x10045364]
add eax, dword [0x10045330]
add eax, dword [0x1004533c]
add eax, dword [0x10045348]
add eax, dword [0x1004537c]
add eax, dword [0x10045378]
cmp eax, dword [0x10045388]
je 0x10017f95
cmp dword [0x1004a3b8], 5
jle 0x10017f95
jmp fcn.10017cb0
jmp 0x10017e70