joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bf48
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x48], esi
mov edi, dword [ebp + 8]
lea ecx, [esi + 8]
call fcn.00426390
mov dword [ebp - 0x44], eax
test eax, eax
je 0x408a0e
lea eax, [ebp - 0x44]
push eax
lea ecx, [esi + 8]
call fcn.004263b0
push dword [eax]
call fcn.00429650
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x4089f2
lea ecx, [esi + 8]
call fcn.004265a0
push 0x45f264
push edi
call fcn.0042cc00
push 0xe
mov dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x4c], 0xd
call fcn.00429550
mov ebx, eax
mov edx, str.yunhozzang_
add esp, 0xc
mov dword [ebp - 0x50], ebx
sub eax, edx
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x408a43
push dword [ebp - 0x58]
add esi, 4
mov dword [ebp - 4], 0
push 1
push 4
push esi
call fcn.0042b300
add esp, 0x10
cmp eax, 1
jne 0x408a8e
movzx eax, byte [ebx]
mov edi, 4
sub byte [esi], al
movzx eax, byte [ebx + 1]
sub byte [esi + 1], al
movzx eax, byte [ebx + 2]
sub byte [esi + 2], al
movzx eax, byte [ebx + 3]
sub byte [esi + 3], al
push 0x2e
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00429fe0
add esp, 0xc
mov edi, edi
mov esi, dword [ebp - 0x58]
lea eax, [ebp - 0x40]
push esi
push 1
push 0x2e
push eax
call fcn.0042b300
add esp, 0x10
cmp eax, 1
jne 0x408b62
xor ecx, ecx
nop
xor eax, eax
cmp edi, 0xd
cmove edi, eax
movzx eax, byte [ebx + edi]
inc edi
sub byte [ebp + ecx - 0x40], al
xor eax, eax
cmp edi, 0xd
cmove edi, eax
movzx eax, byte [ebx + edi]
inc edi
sub byte [ebp + ecx - 0x3f], al
add ecx, 2
cmp ecx, 0x2e
jl 0x408ac0
cmp word [ebp - 0x40], 9
mov dword [ebp - 0x54], edi
jb 0x408b05
push 0
push 0
push 0x45f258
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x2e
call fcn.00429600
mov esi, eax
add esp, 4
test esi, esi
je 0x408b24
push 0x2e
push 0
push esi
call fcn.00429fe0
add esp, 0xc
jmp 0x408b26
xor esi, esi
movdqu xmm0, xmmword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
push esi
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ebp - 0x30]
lea ecx, [ecx + 8]
movdqu xmmword [esi + 0x10], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [esi + 0x20], xmm0
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x28], eax
mov ax, word [ebp - 0x14]
mov word [esi + 0x2c], ax
call fcn.004261e0
jmp 0x408aa0
push esi
call fcn.0042c890
push ebx
call fcn.0042e8c0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b6f0
mov esp, ebp
pop ebp
ret 4
Function at 0x408ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bf78
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
mov eax, dword [ebp + 8]
push 0x45f264
push eax
call fcn.0042cc00
push 0xe
mov dword [ebp - 0x54], eax
xor edi, edi
mov dword [ebp - 0x48], 0xd
call fcn.00429550
mov ebx, eax
mov edx, str.yunhozzang_
add esp, 0xc
mov dword [ebp - 0x4c], ebx
sub eax, edx
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x408c00
push dword [ebp - 0x54]
add esi, 4
mov dword [ebp - 4], 0
push 1
push 4
push esi
call fcn.0042b300
add esp, 0x10
cmp eax, 1
jne 0x408c4b
movzx eax, byte [ebx]
mov edi, 4
sub byte [esi], al
movzx eax, byte [ebx + 1]
sub byte [esi + 1], al
movzx eax, byte [ebx + 2]
sub byte [esi + 2], al
movzx eax, byte [ebx + 3]
sub byte [esi + 3], al
push 0x2e
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00429fe0
add esp, 0xc
mov esi, dword [ebp - 0x54]
mov edi, edi
push esi
push 1
lea eax, [ebp - 0x40]
push 0x2e
push eax
call fcn.0042b300
add esp, 0x10
cmp eax, 1
jne 0x408d16
xor ecx, ecx
lea esp, [esp]
xor eax, eax
cmp edi, 0xd
cmove edi, eax
movzx eax, byte [ebx + edi]
inc edi
sub byte [ebp + ecx - 0x40], al
xor eax, eax
cmp edi, 0xd
cmove edi, eax
movzx eax, byte [ebx + edi]
inc edi
sub byte [ebp + ecx - 0x3f], al
add ecx, 2
cmp ecx, 0x2e
jl 0x408c80
cmp word [ebp - 0x40], 2
mov dword [ebp - 0x50], edi
jne 0x408c60
push 0x2e
call fcn.00429600
mov esi, eax
add esp, 4
test esi, esi
je 0x408cd3
push 0x2e
push 0
push esi
call fcn.00429fe0
add esp, 0xc
jmp 0x408cd5
xor esi, esi
movdqu xmm0, xmmword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ebp - 0x30]
lea ecx, [ecx + 0x28]
movdqu xmmword [esi + 0x10], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [esi + 0x20], xmm0
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x28], eax
mov ax, word [ebp - 0x14]
mov word [esi + 0x2c], ax
movzx eax, word [esi + 0x26]
push eax
push esi
call fcn.00424fe0
jmp 0x408c5b
push esi
call fcn.0042c890
push ebx
call fcn.0042e8c0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b6f0
mov esp, ebp
pop ebp
ret 4
Function at 0x417760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x417792
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b6f0
mov esp, ebp
pop ebp
ret 4
push 0x45f264
push ebx
call fcn.0042cc00
add esp, 8
mov dword [edi + 4], eax
test eax, eax
je 0x41777e
push 2
push 0
push eax
call fcn.0042b560
push dword [edi + 4]
call fcn.0042fae0
push 0
push 0
push dword [edi + 4]
mov dword [ebp - 0x208], eax
call fcn.0042b560
mov ecx, dword [edi + 0x1e]
add esp, 0x1c
test ecx, ecx
je 0x4177e5
push ecx
call fcn.0042e8c0
add esp, 4
mov dword [edi + 0x1e], 0
push esi
push dword [edi + 4]
lea esi, [edi + 0x10]
mov dword [edi + 0xc], 0
push 1
push 0xc
push esi
mov dword [edi + 0x22], 0
call fcn.0042b300
mov eax, dword [esi]
lea ecx, [edi + 0x26]
sub eax, dword [edi + 0x18]
add esp, 0x10
sub eax, dword [edi + 0x14]
push eax
call fcn.00401f90
test eax, eax
jne 0x417840
push eax
push eax
push str.Bin_File_Version_Error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b6f0
mov esp, ebp
pop ebp
ret 4
lea ecx, [edi + 0x26]
call fcn.00401f30
test eax, eax
je 0x4178e8
mov esi, dword [ebp - 0x208]
add esi, 0xfffffff2
push esi
call fcn.00429550
add esp, 4
mov dword [edi + 0x1e], eax
test eax, eax
je 0x41782b
push esi
push 0
push eax
call fcn.00429fe0
add esp, 0xc
lea ecx, [edi + 0x26]
push dword [edi + 0x14]
push esi
push dword [edi + 0x1e]
push dword [edi + 4]
call fcn.00401ca0
test eax, eax
jne 0x4178b7
mov ecx, edi
call fcn.00417300
push ebx
lea eax, [ebp - 0x204]
push str.File_Open_Error_:__s
push eax
call fcn.0042cd10
add esp, 0xc
lea eax, [ebp - 0x204]
push 0
push 0
push eax
jmp 0x417823
push dword [edi + 4]
call fcn.0042c890
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 0x22], 1
mov eax, 1
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b6f0
mov esp, ebp
pop ebp
ret 4
push dword [edi + 4]
lea eax, [edi + 0x1c]
push 1
push 1
push eax
call fcn.0042b300
mov eax, dword [edi + 0x18]
add esp, 0x10
test eax, eax
je 0x41791c
push eax
call fcn.00429550
push dword [edi + 4]
mov dword [edi + 0x1e], eax
push dword [edi + 0x18]
push 1
push eax
call fcn.0042b300
add esp, 0x14
push dword [edi + 4]
lea eax, [edi + 0x1d]
push 1
push 1
push eax
call fcn.0042b300
push dword [edi + 4]
call fcn.0042c890
add esp, 0x14
mov dword [edi + 4], 0
mov ecx, edi
call fcn.00417260
test eax, eax
je 0x41782b
mov ecx, edi
call fcn.004171b0
test eax, eax
je 0x41782b
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
mov dword [edi + 0x22], 1
xor ecx, ebp
pop edi
pop ebx
call fcn.0042b6f0
mov esp, ebp
pop ebp
ret 4
Function at 0x418050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c496
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4748f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CPlustimeMgr.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0x190
mov byte [ebp - 4], 1
call fcn.00429600
mov esi, eax
add esp, 4
test esi, esi
je 0x41810d
mov dword [esi], vtable.CMemoryPoolTempl_struct_stPlusTime_.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0x10], 0
jmp 0x41810f
xor esi, esi
push 0x80
lea eax, [esi + 0x10]
mov dword [edi + 4], esi
push str.stPlusTimePool
push eax
call fcn.0042c610
lea eax, [esi + 4]
mov dword [esi + 0xc], 0xa
add esp, 0xc
cmp dword [eax], 0
jne 0x418148
push 0x32
push eax
call fcn.00418390
mov eax, dword [esi + 4]
add esp, 8
mov dword [esi + 8], eax
push 0x32
lea ecx, [edi + 8]
call fcn.00425ac0
push 0x32
lea ecx, [edi + 0x2c]
call fcn.00425ac0
mov dword [edi + 0x54], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x42243e
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x422437
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push str.._Log
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp + 0x10]
call fcn.0042c740
movzx esi, ax
push esi
push str.AgentServer__d
push 0x48c5a8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x48c5a8
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x48c5a4], eax
test eax, eax
je 0x4224a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4224a0
push dword [0x48c5a4]
jmp 0x422501
call fcn.00422300
test eax, eax
je 0x422511
push 0x4e5a
call fcn.00429600
add esp, 4
test eax, eax
je 0x4224c3
mov ecx, eax
call fcn.00422520
jmp 0x4224c5
xor eax, eax
push esi
mov ecx, eax
mov dword [0x48c5f8], eax
call fcn.00423890
mov ecx, dword [0x48c5f8]
call fcn.004229d0
mov ecx, dword [0x48c5f8]
test ecx, ecx
je 0x4224ed
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [0x48c5a4]
mov dword [0x48c5f8], 0
test eax, eax
je 0x422511
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x48c5a4], 0
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x424c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c496
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4748f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 8]
mov dword [edi], vtable.CSkillDelayManager.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0x1f4
mov byte [ebp - 4], 1
call fcn.00425ac0
push 0x190
call fcn.00429600
mov esi, eax
add esp, 4
test esi, esi
je 0x424d59
mov dword [esi], vtable.CMemoryPoolTempl_struct_SKILLUSE_.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0x10], 0
jmp 0x424d5b
xor esi, esi
push 0x80
lea eax, [esi + 0x10]
mov dword [edi + 4], esi
push str.SKILLUSE
push eax
call fcn.0042c610
lea eax, [esi + 4]
mov dword [esi + 0xc], 0xa
add esp, 0xc
cmp dword [eax], 0
jne 0x424d97
push 0x1f4
push eax
call fcn.00425240
mov eax, dword [esi + 4]
add esp, 8
mov dword [esi + 8], eax
push 0xa
lea ecx, [edi + 0x2c]
call fcn.00425ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14738e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1550e9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x30], 0x10
jb 0x1473922
mov eax, dword [esi + 0x1c]
push eax
call fcn.0152a023
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x147bf90
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x147bfb4
push str.MSP:_Cannot_terminate_forcibly__Invalid_Process_Handle_NULL_
push 0x2000001
call fcn.0148e690
add esp, 8
xor al, al
pop esi
ret 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x147bfd6
mov byte [esi + 0x60], 1
call fcn.0150b900
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
mov al, 1
pop esi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MSP:_Cannot_terminate_Process._Error__d_
push 0x2000001
call fcn.0148e690
add esp, 0xc
xor al, al
pop esi
ret 4
Function at 0x147fcc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, edx
shr eax, 0x10
and eax, 0x7fff
test ecx, ecx
mov dword [esp], str.DISCONNECT_REASON_NETENGINE_ERROR
mov dword [esp + 4], str.DISCONNECT_REASON_INTENTIONAL_KILL
mov dword [esp + 8], str.DISCONNECT_REASON_STALE_SESSION
mov dword [esp + 0xc], str.DISCONNECT_REASON_CLOSED_BY_PEER
mov dword [esp + 0x10], str.DISCONNECT_REASON_ENGINE_SHUTDOWN
mov dword [esp + 0x14], str.DISCONNECT_OVERLAPPED
mov dword [esp + 0x18], str.DISCONNECT_SENDCOUNT
mov dword [esp + 0x1c], str.NERR_GOOD
mov dword [esp + 0x20], str.NERR_TIMEOUT
mov dword [esp + 0x24], str.NERR_UNKNOWN
mov dword [esp + 0x28], str.NERR_SESSION_LOST
mov dword [esp + 0x2c], str.NERR_BUFFER_FULL
mov dword [esp + 0x30], str.NERR_TOO_MANY_OUTSTANDING
mov dword [esp + 0x34], str.NERR_NODATA_TO_SEND
mov dword [esp + 0x38], str.NERR_NO_MSGTARGET
mov dword [esp + 0x3c], str.NERR_INVALID_SOCKET
mov dword [esp + 0x40], str.NERR_INVALID_SESSION
mov dword [esp + 0x44], str.NERR_FAILED_TO_TRANSFILE
mov dword [esp + 0x48], str.NERR_INVALID_SEQUENCE
mov dword [esp + 0x4c], str.NERR_INVALID_CHECKSUM
mov dword [esp + 0x50], str.NERR_INVALID_MSGSIZE
mov dword [esp + 0x54], str.NERR_FAILED_TO_ACCEPT
mov dword [esp + 0x58], str.NERR_INVALID_TARGET_FILE
mov dword [esp + 0x5c], str.NERR_NET_ACCESSED_BEFORE_HANDSHAKE
mov dword [esp + 0x60], str.NERR_INVALID_MSG_HEADER
mov dword [esp + 0x64], str.NERR_COMPLETION_TARGET_MISMATCH
mov dword [esp + 0x68], str.NERR_TARGET_TASK_LOST
mov dword [esp + 0x6c], str.NERR_FAILED_TO_CREATE_SESSION
mov dword [esp + 0x70], str.NERR_PEER_DOESNT_RESPONSE
je 0x147fe40
test dx, dx
jne 0x147fe07
mov edx, dword [0x15ad9f8]
movzx edx, word [edx]
push edx
movzx edx, word [ecx + 6]
movzx ecx, word [ecx + 4]
push edx
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x28]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.0148e690
add esp, 0x20
add esp, 0x74
ret
mov eax, dword [0x15ad9f8]
movzx eax, word [eax]
push eax
movzx eax, word [ecx + 6]
movzx ecx, word [ecx + 4]
push eax
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, dx
mov eax, dword [esp + edx*4 + 0xc]
push eax
push ecx
push str.Session_Lost___d_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.0148e690
add esp, 0x1c
add esp, 0x74
ret
test dx, dx
mov ecx, dword [esp + 0x78]
jne 0x147fe6d
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x1c]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s
push 0x2000001
call fcn.0148e690
add esp, 0x14
add esp, 0x74
ret
movzx edx, dx
mov eax, dword [esp + edx*4]
push eax
push ecx
push str.Session_Lost___d_:__s
push 0x2000001
call fcn.0148e690
add esp, 0x10
add esp, 0x74
ret
Function at 0x148e450
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x14]
push esi
xor esi, esi
test eax, eax
push edi
mov edi, 0x1505
jbe 0x148e499
cmp esi, eax
push ebp
lea ebp, [ebx + 4]
jbe 0x148e472
call fcn.0152986d
cmp dword [ebx + 0x18], 0x10
jb 0x148e47d
mov eax, dword [ebp]
jmp 0x148e47f
mov eax, ebp
movsx eax, byte [eax + esi]
mov ecx, edi
shl ecx, 5
add ecx, edi
add eax, ecx
mov edi, eax
mov eax, dword [ebx + 0x14]
add esi, 1
cmp esi, eax
jb 0x148e472
pop ebp
mov eax, edi
pop edi
pop esi
and eax, 0x7fffffff
pop ebx
ret
Function at 0x14a1590
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1554998
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x44]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.014a11a0
mov eax, dword [esp + 0x20]
mov esi, 0x10
add esp, 0xc
cmp dword [esp + 0x28], esi
jae 0x14a1602
lea eax, [esp + 0x14]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, ebx
jne 0x14a1674
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14a163d
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x14a1636
mov eax, dword [esp + 0x14]
push eax
call fcn.0152a023
add esp, 4
mov eax, 1
jmp 0x14a1698
cmp dword [esp + 0x28], esi
mov ecx, dword [esp + 0x14]
jae 0x14a164b
lea ecx, [esp + 0x14]
push eax
push ecx
push str.Failed_to_open_TS_event._Event_Name__s___Error__d_
push 0x2000001
call fcn.0148e690
add esp, 0x10
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x14a1696
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x14a168e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x14a1696
mov edx, dword [esp + 0x14]
push edx
call fcn.0152a023
add esp, 4
xor eax, eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.01529f5a
add esp, 0x2c
ret
Function at 0x14b6960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x155674b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ServerFramework::COverlapJob.0
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x30], 0x10
jb 0x14b69a8
mov eax, dword [esi + 0x1c]
push eax
call fcn.0152a023
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x14bcbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x155733b
mov eax, dword fs:[0]
push eax
mov eax, 0x3a58
call fcn.0152b360
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x3a54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x3a6c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3a7c]
mov edi, ecx
cmp word [edi + 0x24], 0
mov dword [esp + 0x18], esi
ja 0x14bcc28
call fcn.014f2810
lea eax, [esi + 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [edi + 0x1c], 1
jne 0x14bcdfa
mov al, 0xcd
mov byte [esp + 0x3a48], al
mov byte [esp + 0x3a49], al
mov byte [esp + 0x3a4a], al
mov byte [esp + 0x3a4b], al
mov byte [esp + 0x3a4c], 0x18
mov byte [esp + 0x3a4d], 0x28
mov byte [esp + 0x3a4e], 0x43
mov byte [esp + 0x3a4f], 0xa2
mov byte [esp + 0x3a50], 5
mov byte [esp + 0x3a52], 0x75
mov byte [esp + 0x3a53], 0x52
mov byte [esp + 0x3a54], 0x32
mov byte [esp + 0x3a56], 0x99
mov byte [esp + 0x3a57], 0x47
mov byte [esp + 0x3a58], 0x3f
mov byte [esp + 0x3a59], 0x2e
mov byte [esp + 0x3a5a], al
mov byte [esp + 0x3a5b], al
mov byte [esp + 0x3a5c], 0x69
mov byte [esp + 0x3a5d], 0x11
mov byte [esp + 0x3a5e], 0x58
mov byte [esp + 0x3a5f], 0x7b
mov byte [esp + 0x3a60], 0xe3
mov byte [esp + 0x3a61], 0x5c
mov byte [esp + 0x3a63], 0x82
mov byte [esp + 0x3a64], 0x27
mov byte [esp + 0x3a65], 0x65
mov byte [esp + 0x3a66], 0xd9
mov byte [esp + 0x3a67], 0
mov byte [esp + 0x3a51], al
mov byte [esp + 0x3a55], al
mov byte [esp + 0x3a62], al
mov ecx, dword [esi + 0x1054]
movzx ebp, word [ecx]
lea ecx, [esp + 0x1c]
and ebp, 0x7fff
call fcn.014d3520
mov dword [esp + 0x3a74], 0
mov dl, byte [edi + 0x24]
lea eax, [esp + 0x3a48]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a6b], dl
call fcn.014d3540
cmp dword [esi + 0x104c], 0x10
jg 0x14bcd84
call fcn.014f2810
mov ebx, dword [esi + 0x1034]
add ebx, 0x10
cmp dword [esi + 0x104c], 0x10
jg 0x14bcd9b
call fcn.014f2810
mov ecx, dword [esi + 0x1034]
push ebx
add ecx, 0x10
push ecx
add ebp, 0xfffffff6
push ebp
lea ecx, [esp + 0x28]
call fcn.014d35c0
mov ebx, 0xa
jmp 0x14bcdc0
cmp dword [esi + 0x1048], 0
mov ecx, esi
je 0x14bcdd7
lea edx, [esp + 0x17]
push edx
call fcn.01472790
jmp 0x14bcde1
lea eax, [esp + 0x17]
push eax
call fcn.01472810
sub ebx, 1
jne 0x14bcdc0
mov dword [esp + 0x3a74], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.014d3530
lea ecx, [esp + 0x18]
lea esi, [edi + 4]
push ecx
mov ecx, esi
call fcn.014bc8c0
mov dword [edi + 0x14], 0
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
cmp eax, esi
ja 0x14bce64
jb 0x14bce21
call fcn.014bb2a0
mov edx, dword [eax]
add word [edi + 0x24], 0xffff
movzx eax, word [edi + 0x24]
xor ecx, ecx
test ax, ax
sete cl
mov dword [edi + 0x2c], edx
mov al, cl
mov ecx, dword [esp + 0x3a6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3a54]
xor ecx, esp
call fcn.01529f5a
add esp, 0x3a64
ret 4
call fcn.014bb310
int3
Function at 0x14bfa30
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x15ad5c0], 2
je 0x14bfa4e
mov eax, dword [0x15addbc]
test eax, eax
je 0x14bfa82
mov eax, dword [eax + 0xbc]
mov dword [0x15adcb8], eax
call fcn.014bf9c0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x14bf390
push 0
push 0
mov dword [0x15adcc0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x15adcbc], eax
pop ecx
ret