joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14920f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x156d9db
mov eax, dword fs:[0]
push eax
mov eax, 0x3a58
call fcn.0153ed50
mov eax, dword [0x15b0648]
xor eax, esp
mov dword [esp + 0x3a54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0x3a6c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3a7c]
mov edi, ecx
cmp word [edi + 0x24], 0
mov dword [esp + 0x18], esi
ja 0x1492148
call fcn.014fbaa0
lea eax, [esi + 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [edi + 0x1c], 1
jne 0x149231a
mov al, 0xcd
mov byte [esp + 0x3a48], al
mov byte [esp + 0x3a49], al
mov byte [esp + 0x3a4a], al
mov byte [esp + 0x3a4b], al
mov byte [esp + 0x3a4c], 0x18
mov byte [esp + 0x3a4d], 0x28
mov byte [esp + 0x3a4e], 0x43
mov byte [esp + 0x3a4f], 0xa2
mov byte [esp + 0x3a50], 5
mov byte [esp + 0x3a52], 0x75
mov byte [esp + 0x3a53], 0x52
mov byte [esp + 0x3a54], 0x32
mov byte [esp + 0x3a56], 0x99
mov byte [esp + 0x3a57], 0x47
mov byte [esp + 0x3a58], 0x3f
mov byte [esp + 0x3a59], 0x2e
mov byte [esp + 0x3a5a], al
mov byte [esp + 0x3a5b], al
mov byte [esp + 0x3a5c], 0x69
mov byte [esp + 0x3a5d], 0x11
mov byte [esp + 0x3a5e], 0x58
mov byte [esp + 0x3a5f], 0x7b
mov byte [esp + 0x3a60], 0xe3
mov byte [esp + 0x3a61], 0x5c
mov byte [esp + 0x3a63], 0x82
mov byte [esp + 0x3a64], 0x27
mov byte [esp + 0x3a65], 0x65
mov byte [esp + 0x3a66], 0xd9
mov byte [esp + 0x3a67], 0
mov byte [esp + 0x3a51], al
mov byte [esp + 0x3a55], al
mov byte [esp + 0x3a62], al
mov ecx, dword [esi + 0x1054]
movzx ebp, word [ecx]
lea ecx, [esp + 0x1c]
and ebp, 0x7fff
call fcn.014dcde0
mov dword [esp + 0x3a74], 0
mov dl, byte [edi + 0x24]
lea eax, [esp + 0x3a48]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a6b], dl
call fcn.014dce00
cmp dword [esi + 0x104c], 0x10
jg 0x14922a4
call fcn.014fbaa0
mov ebx, dword [esi + 0x1034]
add ebx, 0x10
cmp dword [esi + 0x104c], 0x10
jg 0x14922bb
call fcn.014fbaa0
mov ecx, dword [esi + 0x1034]
push ebx
add ecx, 0x10
push ecx
add ebp, 0xfffffff6
push ebp
lea ecx, [esp + 0x28]
call fcn.014dce80
mov ebx, 0xa
jmp 0x14922e0
cmp dword [esi + 0x1048], 0
mov ecx, esi
je 0x14922f7
lea edx, [esp + 0x17]
push edx
call fcn.014567e0
jmp 0x1492301
lea eax, [esp + 0x17]
push eax
call fcn.01456860
sub ebx, 1
jne 0x14922e0
mov dword [esp + 0x3a74], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.014dcdf0
lea ecx, [esp + 0x18]
lea esi, [edi + 4]
push ecx
mov ecx, esi
call fcn.01491de0
mov dword [edi + 0x14], 0
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
cmp eax, esi
ja 0x1492384
jb 0x1492341
call fcn.014907c0
mov edx, dword [eax]
add word [edi + 0x24], 0xffff
movzx eax, word [edi + 0x24]
xor ecx, ecx
test ax, ax
sete cl
mov dword [edi + 0x2c], edx
mov al, cl
mov ecx, dword [esp + 0x3a6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3a54]
xor ecx, esp
call fcn.0153eb33
add esp, 0x3a64
ret 4
call fcn.01490830
int3
Function at 0x1492dc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push 0x40
mov esi, ecx
push edi
push esi
mov ebx, edx
call ebp
push edi
push esi
push ebx
call fcn.01541420
lea eax, [ebx + edi]
mov ecx, esi
sub ecx, eax
add esp, 0xc
lea edx, [ecx + edi - 5]
mov dword [eax + 1], edx
mov edx, dword [esp + 0x18]
mov byte [eax], 0xe9
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
sub eax, esi
push edi
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1493570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call esi
push str.ntdll
mov dword [0x15d29e8], eax
call esi
mov ecx, dword [0x15d29e8]
test ecx, ecx
mov dword [0x15d29ec], eax
jne 0x14935a0
mov eax, 3
pop esi
ret
test eax, eax
jne 0x14935ab
mov eax, 4
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1583a84
push ecx
call esi
test eax, eax
mov dword [0x15d29e4], eax
jne 0x14935d5
mov eax, dword [0x15d29e8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 5
pop esi
ret
mov ecx, dword [0x15d29e8]
push str.LoadLibraryW
push ecx
call esi
test eax, eax
mov dword [0x15d29e0], eax
jne 0x1493600
mov edx, dword [0x15d29e8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 6
pop esi
ret
mov eax, dword [0x15d29ec]
push str.LdrLoadDll
push eax
call esi
test eax, eax
mov dword [0x15d29dc], eax
jne 0x149362a
mov ecx, dword [0x15d29ec]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 7
pop esi
ret
push 0x40
push 0x1000
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x15d29dc]
push 5
push 0x1493550
mov edx, eax
mov dword [0x15d29d8], eax
call fcn.01492dc0
xor eax, eax
pop esi
ret

Function at 0x1493aa0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x14]
push esi
xor esi, esi
test eax, eax
push edi
mov edi, 0x1505
jbe 0x1493ae9
cmp esi, eax
push ebp
lea ebp, [ebx + 4]
jbe 0x1493ac2
call fcn.0153d94d
cmp dword [ebx + 0x18], 0x10
jb 0x1493acd
mov eax, dword [ebp]
jmp 0x1493acf
mov eax, ebp
movsx eax, byte [eax + esi]
mov ecx, edi
shl ecx, 5
add ecx, edi
add eax, ecx
mov edi, eax
mov eax, dword [ebx + 0x14]
add esi, 1
cmp esi, eax
jb 0x1493ac2
pop ebp
mov eax, edi
pop edi
pop esi
and eax, 0x7fffffff
pop ebx
ret
Function at 0x14b63d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, edx
shr eax, 0x10
and eax, 0x7fff
test ecx, ecx
mov dword [esp], str.DISCONNECT_REASON_NETENGINE_ERROR
mov dword [esp + 4], str.DISCONNECT_REASON_INTENTIONAL_KILL
mov dword [esp + 8], str.DISCONNECT_REASON_STALE_SESSION
mov dword [esp + 0xc], str.DISCONNECT_REASON_CLOSED_BY_PEER
mov dword [esp + 0x10], str.DISCONNECT_REASON_ENGINE_SHUTDOWN
mov dword [esp + 0x14], str.DISCONNECT_OVERLAPPED
mov dword [esp + 0x18], str.DISCONNECT_SENDCOUNT
mov dword [esp + 0x1c], str.NERR_GOOD
mov dword [esp + 0x20], str.NERR_TIMEOUT
mov dword [esp + 0x24], str.NERR_UNKNOWN
mov dword [esp + 0x28], str.NERR_SESSION_LOST
mov dword [esp + 0x2c], str.NERR_BUFFER_FULL
mov dword [esp + 0x30], str.NERR_TOO_MANY_OUTSTANDING
mov dword [esp + 0x34], str.NERR_NODATA_TO_SEND
mov dword [esp + 0x38], str.NERR_NO_MSGTARGET
mov dword [esp + 0x3c], str.NERR_INVALID_SOCKET
mov dword [esp + 0x40], str.NERR_INVALID_SESSION
mov dword [esp + 0x44], str.NERR_FAILED_TO_TRANSFILE
mov dword [esp + 0x48], str.NERR_INVALID_SEQUENCE
mov dword [esp + 0x4c], str.NERR_INVALID_CHECKSUM
mov dword [esp + 0x50], str.NERR_INVALID_MSGSIZE
mov dword [esp + 0x54], str.NERR_FAILED_TO_ACCEPT
mov dword [esp + 0x58], str.NERR_INVALID_TARGET_FILE
mov dword [esp + 0x5c], str.NERR_NET_ACCESSED_BEFORE_HANDSHAKE
mov dword [esp + 0x60], str.NERR_INVALID_MSG_HEADER
mov dword [esp + 0x64], str.NERR_COMPLETION_TARGET_MISMATCH
mov dword [esp + 0x68], str.NERR_TARGET_TASK_LOST
mov dword [esp + 0x6c], str.NERR_FAILED_TO_CREATE_SESSION
mov dword [esp + 0x70], str.NERR_PEER_DOESNT_RESPONSE
je 0x14b6550
test dx, dx
jne 0x14b6517
mov edx, dword [0x15d2dd8]
movzx edx, word [edx]
push edx
movzx edx, word [ecx + 6]
movzx ecx, word [ecx + 4]
push edx
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x28]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.01493ce0
add esp, 0x20
add esp, 0x74
ret
mov eax, dword [0x15d2dd8]
movzx eax, word [eax]
push eax
movzx eax, word [ecx + 6]
movzx ecx, word [ecx + 4]
push eax
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, dx
mov eax, dword [esp + edx*4 + 0xc]
push eax
push ecx
push str.Session_Lost___d_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.01493ce0
add esp, 0x1c
add esp, 0x74
ret
test dx, dx
mov ecx, dword [esp + 0x78]
jne 0x14b657d
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x1c]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s
push 0x2000001
call fcn.01493ce0
add esp, 0x14
add esp, 0x74
ret
movzx edx, dx
mov eax, dword [esp + edx*4]
push eax
push ecx
push str.Session_Lost___d_:__s
push 0x2000001
call fcn.01493ce0
add esp, 0x10
add esp, 0x74
ret
Function at 0x14cc550
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2808
call fcn.0153ed50
mov eax, dword [0x15b0648]
xor eax, esp
mov dword [esp + 0x2804], eax
push ebp
mov ebp, dword [esp + 0x2814]
push esi
mov esi, dword [esp + 0x2814]
push edi
push 0x15839a8
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x18], 0
call fcn.01541be3
mov edi, eax
add esp, 0xc
test edi, edi
je 0x14cc5f2
push 0x27ff
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.0153ecd0
push ebp
push edi
push esi
push str.ServerFramework::SaveRawLogToFile
push str._s__File__s__Open_Failed._ErrorCode__d___Log:__s_
lea edx, [esp + 0x30]
push 0x2800
push edx
call fcn.01467780
add esp, 0x28
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2804]
xor ecx, esp
call fcn.0153eb33
add esp, 0x2808
ret
mov ecx, dword [esp + 0xc]
push ecx
push ebp
call fcn.015423dd
mov edx, dword [esp + 0x14]
push edx
call fcn.015418c3
mov ecx, dword [esp + 0x281c]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0153eb33
add esp, 0x2808
ret

Function at 0x14cfc90
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x15d29f8], 2
je 0x14cfcae
mov eax, dword [0x15d397c]
test eax, eax
je 0x14cfce2
mov eax, dword [eax + 0xbc]
mov dword [0x15d3910], eax
call fcn.014cfc20
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x14cf5f0
push 0
push 0
mov dword [0x15d3918], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x15d3914], eax
pop ecx
ret

Function at 0x14d1c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x157270b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ServerFramework::COverlapJob.0
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x30], 0x10
jb 0x14d1c78
mov eax, dword [esi + 0x1c]
push eax
call fcn.0153e380
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x14da430
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x208
mov eax, dword [0x15b0648]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov al, 1
mov edi, edi
movzx edx, al
mov byte [esp + edx + 0x14], cl
mov dl, al
and dl, 0x80
mov byte [esp + ecx + 0x114], al
add ecx, 1
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x14da450
mov al, 1
lea ecx, [edi + 0x2a04]
mov esi, 0xa
lea ebx, [ebx]
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
add al, al
and edx, 0x1b
xor al, dl
sub esi, 1
jne 0x14da490
mov dword [edi + 0x1790], esi
mov dword [edi + 0x204], 0x63
mov edx, 1
lea esi, [edi + 0x208]
jmp 0x14da4d0
movzx eax, byte [esp + edx + 0x14]
lea ecx, [esp + 0x213]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [esi], eax
mov dword [edi + eax*4 + 0x1604], edx
add edx, 1
add esi, 4
cmp edx, 0x100
jl 0x14da4d0
lea ecx, [edi + 0x604]
mov dword [esp + 0x10], 0x100
lea esp, [esp]
mov dl, byte [ecx - 0x400]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov bl, dl
add bl, bl
movzx edx, dl
and eax, 0x1b
xor al, bl
movzx esi, al
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx], eax
ror eax, 8
mov dword [ecx + 0x400], eax
ror eax, 8
mov dword [ecx + 0x800], eax
ror eax, 8
mov dword [ecx + 0xc00], eax
mov al, byte [ecx + 0x1000]
test al, al
je 0x14da5d3
movzx edx, al
movzx esi, byte [esp + edx + 0x14]
movzx eax, byte [esp + 0x1f]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x21]
add eax, esi
movzx ebp, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebx, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x22]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x114]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x114]
jmp 0x14da5db
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, ebp
mov dword [ecx + 0x1400], eax
ror eax, 8
mov dword [ecx + 0x1800], eax
ror eax, 8
mov dword [ecx + 0x1c00], eax
ror eax, 8
mov dword [ecx + 0x2000], eax
add ecx, 4
sub dword [esp + 0x10], 1
jne 0x14da520
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0153eb33
add esp, 0x208
ret
Function at 0x14dd7d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x157382b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x14dd857
push 8
call fcn.0153ec1a
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x14dd823
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x14dd825
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
push 0
push 0
push esi
push 0x14dd680
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x14dd857
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x14dd930
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x14dd956
sub eax, 1
je 0x14dd94f
sub eax, 1
jne 0x14dd956
mov eax, 1
jmp 0x14dd95b
mov eax, 2
jmp 0x14dd95b
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x15d3a88]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x14e7420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1574771
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x15b0648]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x79]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x80], bl
call fcn.0153ecd0
lea ecx, [esp + 0x80]
push ecx
push esi
call fcn.014dd3c0
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x14e7558
lea eax, [esp + 0x74]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x14e74b3
sub eax, edx
push eax
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
call fcn.01452170
mov dword [esp + 0x184], ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
lea esi, [ebp + 0x1f4]
push ecx
mov ecx, esi
call fcn.014e4680
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x20], edx
mov dword [esp + 0x184], 0xffffffff
cmp dword [esp + 0x68], 0x10
jb 0x14e7513
mov eax, dword [esp + 0x54]
push eax
call fcn.0153e380
add esp, 4
cmp ebp, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
je 0x14e767a
cmp ebp, esi
jne 0x14e767a
cmp dword [esp + 0x20], eax
sete al
cmp al, bl
je 0x14e7582
lea ecx, [esp + 0x74]
push ecx
push str.unknown_command_:__s
push 0x1000000
call fcn.01493ce0
add esp, 0xc
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0153eb33
add esp, 0x174
ret 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x184], 1
lea edx, [esp + 0x14]
push edx
push 0x1586c4c
push edi
mov dword [esp + 0x20], ebx
call fcn.01542917
add esp, 0xc
cmp eax, ebx
je 0x14e7645
jmp 0x14e75c0
mov edi, 0xf
mov ecx, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x14e75d6
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.01452170
mov byte [esp + 0x184], 2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.014e6c60
mov byte [esp + 0x184], 1
cmp dword [esp + 0x4c], 0x10
jb 0x14e761e
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0153e380
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x1586c4c
push ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.01542917
add esp, 0xc
cmp eax, ebx
jne 0x14e75c0
mov eax, dword [esp + 0x20]
cmp eax, dword [ebp + 4]
jne 0x14e7653
call fcn.014e1e60
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
call edx
mov dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.014e2e10
jmp 0x14e7558
call fcn.014e1b10
int3
Function at 0x14eaa40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1574b68
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
cmp dword [0x15d29f0], ebx
je 0x14eac58
cmp dword [0x15d7354], ebx
jne 0x14eaa8a
call fcn.014fbaa0
mov eax, dword [0x15d7354]
mov esi, dword [eax + 8]
cmp esi, ebx
jne 0x14eaa9b
call fcn.014fbaa0
lea ecx, [esp + 0x34]
call fcn.014ea2b0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x58], ebx
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.014ea8f0
cmp dword [esp + 0x3c], ebx
je 0x14eac47
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
cmp eax, ecx
je 0x14eac6c
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov dword [ecx], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push eax
mov dword [ecx + 4], edx
call fcn.0153e380
sub dword [esp + 0x40], 1
add esp, 4
push ebx
push 0x15ad250
push 0x15ad284
push ebx
mov ecx, edi
call fcn.014612b0
push eax
call fcn.0154303c
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x14eab1d
call fcn.014fbaa0
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call edx
cmp al, bl
je 0x14eabf6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x14eab51
push ecx
mov ecx, ebp
call fcn.014e9df0
mov eax, dword [edi + 4]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
lea esi, [ebp + 0x400c4]
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.01487e60
mov edx, dword [esp + 0x1c]
cmp edx, ebx
mov ecx, dword [esi + 4]
je 0x14eac76
cmp edx, esi
jne 0x14eac76
mov eax, dword [esp + 0x20]
cmp eax, ecx
sete cl
cmp cl, bl
je 0x14eabb8
mov eax, dword [edi + 4]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 1
call fcn.01487da0
jmp 0x14eac3d
cmp eax, dword [edx + 4]
je 0x14eac71
add dword [eax + 0x10], 1
cmp dword [eax + 0x10], 3
jb 0x14eac3d
push str._THE_ENDLESS_LOOP_THERESHOLD_EXCEEDED__THIS_SERVER_WILL_BE_SHUT_DOWN__
push 0x2000001
call fcn.01493ce0
mov eax, dword [esp + 0x1c]
add esp, 8
push 0x18181818
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, edi
call fcn.01524260
jmp 0x14eac3d
mov ecx, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ecx
lea esi, [ebp + 0x400c4]
push eax
mov ecx, esi
call fcn.01487e60
mov edx, dword [esp + 0x2c]
cmp edx, ebx
mov eax, dword [esi + 4]
je 0x14eac76
cmp edx, esi
jne 0x14eac76
mov ecx, dword [esp + 0x30]
cmp ecx, eax
sete al
cmp al, bl
sete al
cmp al, bl
je 0x14eac3d
cmp ecx, dword [edx + 4]
je 0x14eac71
mov dword [ecx + 0x10], ebx
cmp dword [esp + 0x3c], ebx
jne 0x14eaac8
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.014ea440
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp fcn.014ea5e0
jmp fcn.014875e0
jmp fcn.01487570
Function at 0x14ee700
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x504
mov eax, dword [0x15b0648]
xor eax, esp
mov dword [esp + 0x500], eax
push ebp
mov ebp, dword [esp + 0x50c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0xfe
movzx esi, ax
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.0153ecd0
push esi
call fcn.014eda00
push eax
lea ecx, [esp + 0x20]
push 0xff
push ecx
call fcn.0153f56d
add esp, 0x1c
mov eax, dword [esp + 0x518]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, eax
test edi, edi
jne 0x14ee7da
push 0x3ff
push eax
lea ecx, [esp + 0x115]
push ecx
mov byte [esp + 0x118], al
call fcn.0153ecd0
lea edx, [esp + 0x18]
push edx
movzx eax, si
push eax
push str.Cannot_find_proper_font__LangID_:_0x_X__FontName_:__s___please_contact_to_Joymax
lea ecx, [esp + 0x124]
push 0x400
push ecx
call fcn.0153f56d
add esp, 0x20
push 0x30
push str.Error
lea edx, [esp + 0x114]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
push 0x30
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x50c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0153eb33
add esp, 0x504
ret

Function at 0x14f4ac0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14f4b40
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 0x10]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x14f4ae0
sub eax, edx
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebx
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x14f4b08
sub ecx, edi
push ebx
add ecx, 1
push ecx
push eax
call fcn.014519a0
test eax, eax
je 0x14f4b27
call fcn.014fbaa0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret