joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14c4150
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1557b88
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
cmp dword [0x15ad5b8], ebx
je 0x14c4368
cmp dword [0x15b166c], ebx
jne 0x14c419a
call fcn.014f2810
mov eax, dword [0x15b166c]
mov esi, dword [eax + 8]
cmp esi, ebx
jne 0x14c41ab
call fcn.014f2810
lea ecx, [esp + 0x34]
call fcn.014c2ac0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x58], ebx
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.014c4000
cmp dword [esp + 0x3c], ebx
je 0x14c4357
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
cmp eax, ecx
je 0x14c437c
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov dword [ecx], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push eax
mov dword [ecx + 4], edx
call fcn.0152a023
sub dword [esp + 0x40], 1
add esp, 4
push ebx
push 0x15881ec
push 0x1588220
push ebx
mov ecx, edi
call fcn.014c24a0
push eax
call fcn.0152c974
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x14c422d
call fcn.014f2810
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call edx
cmp al, bl
je 0x14c4306
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x14c4261
push ecx
mov ecx, ebp
call fcn.014c2600
mov eax, dword [edi + 4]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
lea esi, [ebp + 0x400c4]
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.014c3ae0
mov edx, dword [esp + 0x1c]
cmp edx, ebx
mov ecx, dword [esi + 4]
je 0x14c4386
cmp edx, esi
jne 0x14c4386
mov eax, dword [esp + 0x20]
cmp eax, ecx
sete cl
cmp cl, bl
je 0x14c42c8
mov eax, dword [edi + 4]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 1
call fcn.014c3a20
jmp 0x14c434d
cmp eax, dword [edx + 4]
je 0x14c4381
add dword [eax + 0x10], 1
cmp dword [eax + 0x10], 3
jb 0x14c434d
push str._THE_ENDLESS_LOOP_THERESHOLD_EXCEEDED__THIS_SERVER_WILL_BE_SHUT_DOWN__
push 0x2000001
call fcn.0148e690
mov eax, dword [esp + 0x1c]
add esp, 8
push 0x18181818
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, edi
call fcn.0150e2d0
jmp 0x14c434d
mov ecx, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ecx
lea esi, [ebp + 0x400c4]
push eax
mov ecx, esi
call fcn.014c3ae0
mov edx, dword [esp + 0x2c]
cmp edx, ebx
mov eax, dword [esi + 4]
je 0x14c4386
cmp edx, esi
jne 0x14c4386
mov ecx, dword [esp + 0x30]
cmp ecx, eax
sete al
cmp al, bl
sete al
cmp al, bl
je 0x14c434d
cmp ecx, dword [edx + 4]
je 0x14c4381
mov dword [ecx + 0x10], ebx
cmp dword [esp + 0x3c], ebx
jne 0x14c41d8
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.014c2df0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp fcn.014c32b0
jmp fcn.014c3240
jmp fcn.014c31a0
Function at 0x14cf620
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x1558b9b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x14cf6a7
push 8
call fcn.0152a4cf
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x14cf673
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x14cf675
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
push 0
push 0
push esi
push 0x14cf4d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x14cf6a7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x14cf6d0
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x14cf6f6
sub eax, 1
je 0x14cf6ef
sub eax, 1
jne 0x14cf6f6
mov eax, 1
jmp 0x14cf6fb
mov eax, 2
jmp 0x14cf6fb
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x15adde8]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x14d0b70
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x208
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov al, 1
mov edi, edi
movzx edx, al
mov byte [esp + edx + 0x14], cl
mov dl, al
and dl, 0x80
mov byte [esp + ecx + 0x114], al
add ecx, 1
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x14d0b90
mov al, 1
lea ecx, [edi + 0x2a04]
mov esi, 0xa
lea ebx, [ebx]
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
add al, al
and edx, 0x1b
xor al, dl
sub esi, 1
jne 0x14d0bd0
mov dword [edi + 0x1790], esi
mov dword [edi + 0x204], 0x63
mov edx, 1
lea esi, [edi + 0x208]
jmp 0x14d0c10
movzx eax, byte [esp + edx + 0x14]
lea ecx, [esp + 0x213]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [esi], eax
mov dword [edi + eax*4 + 0x1604], edx
add edx, 1
add esi, 4
cmp edx, 0x100
jl 0x14d0c10
lea ecx, [edi + 0x604]
mov dword [esp + 0x10], 0x100
lea esp, [esp]
mov dl, byte [ecx - 0x400]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov bl, dl
add bl, bl
movzx edx, dl
and eax, 0x1b
xor al, bl
movzx esi, al
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx], eax
ror eax, 8
mov dword [ecx + 0x400], eax
ror eax, 8
mov dword [ecx + 0x800], eax
ror eax, 8
mov dword [ecx + 0xc00], eax
mov al, byte [ecx + 0x1000]
test al, al
je 0x14d0d13
movzx edx, al
movzx esi, byte [esp + edx + 0x14]
movzx eax, byte [esp + 0x1f]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x21]
add eax, esi
movzx ebp, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebx, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x22]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x114]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x114]
jmp 0x14d0d1b
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, ebp
mov dword [ecx + 0x1400], eax
ror eax, 8
mov dword [ecx + 0x1800], eax
ror eax, 8
mov dword [ecx + 0x1c00], eax
ror eax, 8
mov dword [ecx + 0x2000], eax
add ecx, 4
sub dword [esp + 0x10], 1
jne 0x14d0c60
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.01529f5a
add esp, 0x208
ret
Function at 0x14dbd50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1559b11
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x79]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x80], bl
call fcn.0152a100
lea ecx, [esp + 0x80]
push ecx
push esi
call fcn.014c1a50
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x14dbe88
lea eax, [esp + 0x74]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x14dbde3
sub eax, edx
push eax
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
call fcn.01473f60
mov dword [esp + 0x184], ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
lea esi, [ebp + 0x1f4]
push ecx
mov ecx, esi
call fcn.014d8fb0
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x20], edx
mov dword [esp + 0x184], 0xffffffff
cmp dword [esp + 0x68], 0x10
jb 0x14dbe43
mov eax, dword [esp + 0x54]
push eax
call fcn.0152a023
add esp, 4
cmp ebp, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
je 0x14dbfaa
cmp ebp, esi
jne 0x14dbfaa
cmp dword [esp + 0x20], eax
sete al
cmp al, bl
je 0x14dbeb2
lea ecx, [esp + 0x74]
push ecx
push str.unknown_command_:__s
push 0x1000000
call fcn.0148e690
add esp, 0xc
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.01529f5a
add esp, 0x174
ret 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x184], 1
lea edx, [esp + 0x14]
push edx
push 0x1569e20
push edi
mov dword [esp + 0x20], ebx
call fcn.0152ca49
add esp, 0xc
cmp eax, ebx
je 0x14dbf75
jmp 0x14dbef0
mov edi, 0xf
mov ecx, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x14dbf06
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.01473f60
mov byte [esp + 0x184], 2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.014db590
mov byte [esp + 0x184], 1
cmp dword [esp + 0x4c], 0x10
jb 0x14dbf4e
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0152a023
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x1569e20
push ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.0152ca49
add esp, 0xc
cmp eax, ebx
jne 0x14dbef0
mov eax, dword [esp + 0x20]
cmp eax, dword [ebp + 4]
jne 0x14dbf83
call fcn.014d6750
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
call edx
mov dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.014d7740
jmp 0x14dbe88
call fcn.014d6390
int3
Function at 0x14dfea0
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x504
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x500], eax
push ebp
mov ebp, dword [esp + 0x50c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0xfe
movzx esi, ax
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.0152a100
push esi
call fcn.014df180
push eax
lea ecx, [esp + 0x20]
push 0xff
push ecx
call fcn.0152a89e
add esp, 0x1c
mov eax, dword [esp + 0x518]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, eax
test edi, edi
jne 0x14dff7a
push 0x3ff
push eax
lea ecx, [esp + 0x115]
push ecx
mov byte [esp + 0x118], al
call fcn.0152a100
lea edx, [esp + 0x18]
push edx
movzx eax, si
push eax
push str.Cannot_find_proper_font__LangID_:_0x_X__FontName_:__s___please_contact_to_Joymax
lea ecx, [esp + 0x124]
push 0x400
push ecx
call fcn.0152a89e
add esp, 0x20
push 0x30
push str.Error
lea edx, [esp + 0x114]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
push 0x30
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x50c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.01529f5a
add esp, 0x504
ret

Function at 0x14ec240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x155b190
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.014ec110
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x3c]
push ecx
push 1
push 0
push esi
lea ecx, [esp + 0x18]
call fcn.014ec0a0
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [esp + 0x28], 0
lea ecx, [esp + 8]
call fcn.014ec0e0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.014ec140
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x14ed960
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14ed9e0
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 0x10]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x14ed980
sub eax, edx
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebx
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x14ed9a8
sub ecx, edi
push ebx
add ecx, 1
push ecx
push eax
call fcn.014722e0
test eax, eax
je 0x14ed9c7
call fcn.014f2810
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x14f13c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
jne 0x14f13fc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push esi
call ebx
test eax, eax
jne 0x14f13f4
call ebp
cmp eax, 0xb7
jne 0x14f1404
push esi
call edi
cmp eax, 0xffffffff
je 0x14f13e2
pop edi
pop esi
pop ebp
and eax, 0x10
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x14f1cf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
mov esi, dword [esp + 0x118]
push 0x156a9f0
push 0x104
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.01472f30
test eax, eax
je 0x14f1d35
call fcn.014f2810
push str._NT_SYMBOL_PATH
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0152d56b
add esp, 0xc
test eax, eax
je 0x14f1d82
push 0x156a9dc
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1d69
call fcn.014f2810
mov edx, dword [esp + 4]
push edx
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1d82
call fcn.014f2810
push str._NT_ALT_SYMBOL_PATH
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0152d56b
add esp, 0xc
test eax, eax
je 0x14f1dcf
push 0x156a9dc
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1db6
call fcn.014f2810
mov edx, dword [esp + 4]
push edx
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1dcf
call fcn.014f2810
push str.SYSTEMROOT
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0152d56b
add esp, 0xc
test eax, eax
je 0x14f1e58
push 0x156a9dc
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1e03
call fcn.014f2810
mov edx, dword [esp + 4]
push edx
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1e1c
call fcn.014f2810
push 0x156a9dc
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1e35
call fcn.014f2810
mov eax, dword [esp + 4]
push eax
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1e4e
call fcn.014f2810
push str.System32
jmp 0x14f1eee
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.0152a100
add esp, 0xc
push 0x103
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x14f1f02
push 0x156a9dc
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1e9e
call fcn.014f2810
lea eax, [esp + 0xc]
push eax
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1eb7
call fcn.014f2810
push 0x156a9dc
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1ed0
call fcn.014f2810
lea ecx, [esp + 0xc]
push ecx
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1ee9
call fcn.014f2810
push str.System
push 0x104
push esi
call fcn.01472f30
test eax, eax
je 0x14f1f02
call fcn.014f2810
mov ecx, dword [esp + 0x110]
pop esi
xor ecx, esp
call fcn.01529f5a
add esp, 0x110
ret
Function at 0x14f27b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x14f2805
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi]
push 0
push 0
lea edx, [esp + 0xc]
push edx
push fcn.014f21f0
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
push 0
push 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x10
ret

Function at 0x14f2b10
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x400
jge 0x14f2be6
push 0x3ff
lea ecx, [esp + 5]
push 0
push ecx
mov byte [esp + 0xc], 0
call fcn.0152a100
mov eax, dword [esp + 0x414]
lea edx, [esp + 0x418]
push edx
push eax
lea ecx, [esp + 0x14]
push 0x3ff
push ecx
call fcn.0152b0ae
add esp, 0x1c
test eax, eax
jl 0x14f2b8c
cmp eax, 0x3ff
ja 0x14f2b8c
jne 0x14f2b99
mov byte [esp + 0x3ff], 0
jmp 0x14f2b99
mov byte [esp + 0x3ff], 0
call fcn.014f2810
call fcn.014f1410
test al, al
je 0x14f2bd2
lea edx, [esp]
push edx
push 0x2000001
call fcn.015000b0
add esp, 8
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.01529f5a
add esp, 0x404
ret
push 0
push str.BSObj_Plugin
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.01529f5a
add esp, 0x404
ret
Function at 0x14f2ee0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1004
call fcn.0152b360
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x1018]
test ebx, 0x400
push ebp
mov ebp, dword [esp + 0x1010]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1020]
je 0x14f2f2c
push edi
push esi
push ebp
call dword [0x15b02ac]
add esp, 0xc
and ebx, 2
jne 0x14f2f3f
test byte [esp + 0x1024], 4
je 0x14f3061
push 0xfff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.0152a100
push esi
push ebp
push edi
push str.Debug_Assertion_Failed._n_nExpression_:__s_nLine_:__d_nFile_:__s_n_n
lea ecx, [esp + 0x2c]
push 0x1000
push ecx
call fcn.01481be0
add esp, 0x24
test eax, eax
je 0x14f2f93
call fcn.014f2810
xor al, al
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.01529f5a
add esp, 0x1004
ret
test byte [esp + 0x1024], 8
je 0x14f2fe6
push str.CallStack:_n
push 0x1000
lea edx, [esp + 0x18]
push edx
call fcn.01472f30
test eax, eax
jne 0x14f2f73
mov eax, dword [0x15b0270]
push eax
push 0x1000
lea ecx, [esp + 0x18]
push ecx
call fcn.01472f30
test eax, eax
jne 0x14f2f73
push 0x156ac40
push 0x1000
lea edx, [esp + 0x18]
push edx
call fcn.01472f30
test eax, eax
jne 0x14f2f73
test ebx, ebx
je 0x14f3031
push str._press__ok__to_advance__press__cancel__to_exit_
push 0x1000
lea eax, [esp + 0x18]
push eax
call fcn.01472f30
test eax, eax
jne 0x14f2f73
push 0x11
push str.BSLib_Debug_Module
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x14f3061
mov al, byte [esp + 0x1024]
shr al, 4
not al
and al, 1
jmp 0x14f2f7a
push str._press__ok__to_exit_program_
push 0x1000
lea edx, [esp + 0x18]
push edx
call fcn.01472f30
test eax, eax
jne 0x14f2f73
push 0x10
push str.BSLib_Debug_Module
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14f5060
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp edi, 1
mov esi, ecx
je 0x14f5076
test edi, edi
je 0x14f5076
call fcn.014f2810
cmp dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], edi
jne 0x14f50ad
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
jne 0x14f50ad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, esi
call fcn.014f5040
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x14f5210
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x1c]
sub eax, 0
push edi
mov edi, ecx
je 0x14f524e
sub eax, 1
je 0x14f522c
call fcn.014f2810
jmp 0x14f5275
mov eax, dword [edi + 0x98]
cmp eax, dword [edi + 0x9c]
lea ecx, [edi + 0x60]
jne 0x14f5247
pop edi
mov eax, 6
pop esi
ret 4
call fcn.014f4bf0
jmp 0x14f5275
mov ecx, dword [esi + 0x1054]
mov dx, word [ecx]
and dx, 0x7fff
add dx, 6
cmp dx, 6
jae 0x14f526b
call fcn.014f2810
movzx eax, word [esi + 0x103e]
mov dword [esi + 0x24], eax
push ebx
push ebp
lea ebp, [edi + 0x154]
push ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [esi + 0x20]
mov eax, dword [edi + 0x40]
push ebx
push esi
push ebx
lea ecx, [esp + 0x20]
push ecx
push edx
add esi, 0x24
push esi
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14f531d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x14f52f6
push str.PostSend__
push str.PostSend
push esi
call fcn.01515a00
add esp, 0xc
cmp esi, 0x2733
je 0x14f5301
cmp esi, 8
je 0x14f5301
cmp esi, 0x2747
je 0x14f5301
push ebp
mov ebx, 0x8002
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
ret 4
xor ebx, ebx
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
ret 4
push esi
push str.WSASend_____NERR_TOO_MANY_OUTSTANDING:__d
push 0
call fcn.015000b0
add esp, 0xc
push ebp
mov ebx, 0x8005
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
ret 4

Function at 0x14f53d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xa4]
mov ecx, esi
call fcn.014f4d50
mov eax, dword [esi + 0x38]
cmp eax, dword [esi + 0x3c]
jge 0x14f53f2
call fcn.014f2810
mov ecx, dword [esi + 0x38]
sub ecx, dword [esi + 0x3c]
cmp ecx, 6
jl 0x14f5402
call fcn.014f2810
mov ecx, esi
call fcn.014f4bf0
cmp dword [edi + 0xc8], 0
lea ebx, [edi + 0xc8]
ja 0x14f541d
call fcn.014f2810
mov ecx, dword [edi + 0xc4]
push 0
push esi
lea edx, [esp + 0x14]
push edx
mov edx, dword [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x14f546f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jg 0x14f5475
je 0x14f5485
cmp eax, 8
je 0x14f5485
cmp eax, 0x3e5
jne 0x14f547c
xor eax, eax
add esp, 8
ret
cmp eax, 0x2747
je 0x14f5485
mov eax, 0x8002
add esp, 8
ret
mov eax, 0x8005
add esp, 8
ret