joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac30
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6c0798]
push ebx
push esi
push edi
cmp eax, 1
jne 0x40acb2
mov dword [ebp - 4], 0x58fbe0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40ac96
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40ac8d
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40ac74
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40ad2e
mov dword [ebp - 4], 0x58fc60
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40ad12
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40ad09
sub edi, ecx
lea ebx, [ebx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40acf0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x58fbe0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40ad83
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40ad7a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40ad61
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40ada0
Capabilities:
Create thread

Disassembly:
cmp dword [0x6b77b8], 0
jne 0x40adbe
push 0
push 0
push 0
push 0x40b930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x6b77b4], 0
jne 0x40addc
push 0
push 0
push 0
push fcn.0040ade0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret
Function at 0x40af70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0040b450
mov eax, dword [0x6c0798]
cmp eax, 1
jne 0x40affe
mov dword [ebp - 4], 0x58faa8
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40afe2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40afd9
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40afc0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40b074
mov dword [ebp - 4], 0x58fb40
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b058
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b04f
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b036
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x58faa8
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b0c9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b0c0
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b0a7
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40b160
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x58fd88
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b1c2
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x40b1b9
sub edi, ecx
lea ecx, [ecx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b1a0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop ebx
test eax, eax
jne 0x40b210
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b20b
call fcn.0040b3b0
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.0040b300
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40b320
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov word [ebp - 0x10], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40b36f
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40b377
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40b38c
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 4], 0
test esi, esi
jne 0x40b398
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x5b6558
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
call sub.MSVCR120.dll__CxxThrowException
int3

Function at 0x40b3c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40b3e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40b8f0
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x40b780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x6b77ac]
inc eax
mov dword [0x6b77ac], eax
cmp eax, 1
je 0x40b750
xor eax, eax
ret

Function at 0x40bbb0
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x6c0798]
cmp eax, 1
je 0x40bbfe
cmp eax, 4
je 0x40bbfe
push 0
cmp eax, 2
jne 0x40bbec
push 0
push 0
push 0x40c060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40bbfc
push 0
push 0
push 0x425710
jmp 0x40bbcf
jmp 0x40bbe6
push 0
push 0
push 0
push 0x40c0e0
jmp 0x40bbcf
Function at 0x40bfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58ff50
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40c022
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x40c019
sub edi, ecx
jmp 0x40c000
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40c000
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call fcn.0040bc50
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c040
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40bc10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40c530
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x6c0798]
cmp eax, 1
je 0x40c57e
cmp eax, 4
je 0x40c57e
push 0
cmp eax, 2
jne 0x40c56c
push 0
push 0
push 0x40c630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40c57c
push 0
push 0
push 0x425710
jmp 0x40c54f
jmp 0x40c566
push 0
push 0
push 0
push 0x40c6b0
jmp 0x40c54f

Function at 0x40c590
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40c4f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40c5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x590034
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40c612
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x40c609
sub edi, ecx
jmp 0x40c5f0
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40c5f0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call fcn.0040c190
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push edi
push 0x59005c
push dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCR120.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x40c765
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_fread]
push esi
lea ecx, [ecx]
push edi
push 0x400
lea eax, [ebp - 0x408]
push 1
push eax
call ebx
mov ecx, dword [ebp - 8]
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x408]
push esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040c8c0
cmp esi, 0x400
je 0x40c770
push edi
call dword [sym.imp.MSVCR120.dll_fclose]
mov eax, dword [ebp - 4]
add esp, 4
not eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x40c7c0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
mov ebx, ecx
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
xor edi, edi
push 8
push edi
mov ecx, ebx
call fcn.0040c900
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
push 0x20
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov esi, edx
and esi, 0x80000000
neg esi
lea eax, [edx + edx]
sbb esi, esi
and esi, 0x4c11db7
xor esi, eax
mov ecx, esi
and ecx, 0x80000000
neg ecx
lea eax, [esi + esi]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
push ecx
mov ecx, ebx
call fcn.0040c900
mov dword [ebx + edi*4], eax
inc edi
cmp edi, 0xff
jle 0x40c7d7
pop edi
pop esi
pop ebx
ret

Function at 0x40c8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
je 0x40c8f5
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
lea edi, [edi + 1]
movzx eax, byte [edi - 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
mov eax, dword [ebp - 4]
xor edx, dword [eax + ecx*4]
mov dword [ebx], edx
dec esi
jne 0x40c8d7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e310
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6b7c28]
add eax, dword [0x6b7c24]
add eax, dword [0x6b7c20]
add eax, dword [0x6b7c1c]
add eax, dword [0x6b7c18]
add eax, dword [0x6b7c14]
add eax, dword [0x6b7c10]
add eax, dword [0x6b7c0c]
add eax, dword [0x6b7c08]
add eax, dword [0x6b7c04]
add eax, dword [0x6b7c00]
add eax, dword [0x6b7bfc]
add eax, dword [0x6b7bf8]
add eax, dword [0x6b7bf4]
add eax, dword [0x6b7bf0]
add eax, dword [0x6b7bec]
add eax, dword [0x6b7be8]
add eax, dword [0x6b7be4]
add eax, dword [0x6b7be0]
add eax, dword [0x6b7bdc]
add eax, dword [0x6b7bd8]
add eax, dword [0x6b7bd4]
mov edx, dword [0x6b7c2c]
add eax, dword [0x6b7bd0]
inc edx
mov dword [0x6b7c2c], edx
cmp eax, dword [0x6b7bc0]
je 0x40e3b7
cmp edx, 5
jg fcn.0040e510
jmp 0x40e990
mov dword [0x6b7bd0], 0
mov dword [0x6b7bd4], 0
mov dword [0x6b7bd8], 0
mov dword [0x6b7bdc], 0
mov dword [0x6b7be0], 0
mov dword [0x6b7be4], 0
mov dword [0x6b7be8], 0
mov dword [0x6b7bec], 0
mov dword [0x6b7bf0], 0
mov dword [0x6b7bf4], 0
mov dword [0x6b7bf8], 0
mov dword [0x6b7bfc], 0
mov dword [0x6b7c00], 0
mov dword [0x6b7c04], 0
mov dword [0x6b7c08], 0
mov dword [0x6b7c0c], 0
mov dword [0x6b7c10], 0
mov dword [0x6b7c14], 0
mov dword [0x6b7c18], 0
mov dword [0x6b7c1c], 0
mov dword [0x6b7c20], 0
mov dword [0x6b7c24], 0
mov dword [0x6b7c28], 0
ret
Function at 0x40e480
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40e3c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40e4a0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40e410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40e510
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58750b
push eax
mov dword fs:[0], esp
sub esp, 0xa8
cmp dword [0x6c0794], 1
jne 0x40e5b3
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0xb4]
call fcn.0040b9f0
lea eax, [ebp - 0xb4]
mov dword [ebp - 4], 0
push str._nAKS_Scan:
push eax
call fcn.0040a540
lea eax, [ebp - 0xb4]
push str.Thread_attack_
push eax
call fcn.0040a540
add esp, 0x10
lea ecx, [ebp - 0xb0]
call fcn.004096b0
test eax, eax
jne 0x40e5a2
push eax
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x54]
call fcn.0040baf0
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x6c0798]
cmp eax, 1
je 0x40e601
cmp eax, 4
je 0x40e601
push 0
cmp eax, 2
jne 0x40e5ef
push 0
push 0
push 0x40e820
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40e5ff
push 0
push 0
push 0x425710
jmp 0x40e5d2
jmp 0x40e5e9
push 0
push 0
push 0
push 0x40e8d0
jmp 0x40e5d2

Function at 0x40ea90
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40eab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40faa0
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40fac3
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40fabd
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40fabd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40fabd
push 0
push 0
push 0
push 0x40f610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40fb40
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40fb60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x414e50
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x415400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x415460
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x415c80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x415cb0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x415de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x41a8d0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x587536
push eax
mov dword fs:[0], esp
sub esp, 0x158
cmp dword [0x6c0794], 1
push esi
jne 0x41a985
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0040b9f0
lea eax, [ebp - 0x164]
mov dword [ebp - 4], 0
push str._nHT_Scan:
push eax
call fcn.0040a540
lea eax, [ebp - 0x164]
push str.Hide_windows_detected_
push eax
call fcn.0040a540
add esp, 0x10
lea ecx, [ebp - 0x160]
call fcn.004096b0
test eax, eax
jne 0x41a967
push eax
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x164]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], 0xffffffff
call fcn.0040baf0
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6c07a4], 1
jne 0x41aa6a
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xbc]
mov esi, eax
push 1
push 0x40
push 8
push 0x58fee4
call fcn.0040b9f0
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0040a540
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str.HT_Scan:
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str.Hide_windows_detected_
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0040a540
add esp, 0x2c
lea ecx, [ebp - 0xb8]
call fcn.004096b0
test eax, eax
jne 0x41aa4c
push eax
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x58fee4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x5c]
call fcn.0040baf0
lea ecx, [ebp - 0x5c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x6c0798]
push 0
cmp eax, 1
jne 0x41aa9c
push 0
push 0
push 0x41acc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x41aaac
push 0
push 0
push 0x41ac40
jmp 0x41aa7f
cmp eax, 3
jne 0x41aabc
push 0
push 0
push 0x425710
jmp 0x41aa7f
cmp eax, 4
jne 0x41aaed
push 0
push 0
push 0x40e7b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.H_Scan
push str.Generic_Hide_Window
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41aa94
jmp 0x41aa96

Function at 0x41aaf0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x41ac00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x41ab10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x209fc
call fcn.00585e80
push esi
push edi
xor esi, esi
xor eax, eax
push esi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x41abe1
push ebx
lea ebx, [ebp - 0x209f8]
nop
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x41abc1
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x41abc1
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
push 0xff
push eax
push edi
mov dword [ebx - 4], edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xff
lea eax, [ebx + 0x103]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
inc dword [ebp - 4]
add ebx, 0x208
mov ecx, dword [ebp - 8]
xor eax, eax
test esi, esi
jle 0x41abb5
cmp ecx, dword [ebp + eax*4 - 0x404]
je 0x41abb5
inc eax
cmp eax, esi
jl 0x41aba7
cmp eax, esi
jne 0x41abc1
mov dword [ebp + esi*4 - 0x404], ecx
inc esi
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x41ab40
mov eax, dword [ebp - 4]
pop ebx
test eax, eax
je 0x41abe1
cmp esi, 1
jg 0x41abef
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0041a8d0
int3

Function at 0x41ad40
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x41ad60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret