Function at 0x148c270
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2808
call fcn.0152b360
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x2804], eax
push ebp
mov ebp, dword [esp + 0x2814]
push esi
mov esi, dword [esp + 0x2814]
push edi
push 0x1567884
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x18], 0
call fcn.0152b8b8
mov edi, eax
add esp, 0xc
test edi, edi
je 0x148c312
push 0x27ff
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.0152a100
push ebp
push edi
push esi
push str.ServerFramework::SaveRawLogToFile
push str._s__File__s__Open_Failed._ErrorCode__d___Log:__s_
lea edx, [esp + 0x30]
push 0x2800
push edx
call fcn.01481be0
add esp, 0x28
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2804]
xor ecx, esp
call fcn.01529f5a
add esp, 0x2808
ret
mov ecx, dword [esp + 0xc]
push ecx
push ebp
call fcn.0152b908
mov edx, dword [esp + 0x14]
push edx
call fcn.0152b5de
mov ecx, dword [esp + 0x281c]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.01529f5a
add esp, 0x2808
ret

Function at 0x148d7c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push 0x40
mov esi, ecx
push edi
push esi
mov ebx, edx
call ebp
push edi
push esi
push ebx
call fcn.0152bab0
lea eax, [ebx + edi]
mov ecx, esi
sub ecx, eax
add esp, 0xc
lea edx, [ecx + edi - 5]
mov dword [eax + 1], edx
mov edx, dword [esp + 0x18]
mov byte [eax], 0xe9
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
sub eax, esi
push edi
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x148df20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call esi
push str.ntdll
mov dword [0x15ad5b0], eax
call esi
mov ecx, dword [0x15ad5b0]
test ecx, ecx
mov dword [0x15ad5b4], eax
jne 0x148df50
mov eax, 3
pop esi
ret
test eax, eax
jne 0x148df5b
mov eax, 4
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1567f8c
push ecx
call esi
test eax, eax
mov dword [0x15ad5ac], eax
jne 0x148df85
mov eax, dword [0x15ad5b0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 5
pop esi
ret
mov ecx, dword [0x15ad5b0]
push str.LoadLibraryW
push ecx
call esi
test eax, eax
mov dword [0x15ad5a8], eax
jne 0x148dfb0
mov edx, dword [0x15ad5b0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 6
pop esi
ret
mov eax, dword [0x15ad5b4]
push str.LdrLoadDll
push eax
call esi
test eax, eax
mov dword [0x15ad5a4], eax
jne 0x148dfda
mov ecx, dword [0x15ad5b4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 7
pop esi
ret
push 0x40
push 0x1000
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x15ad5a4]
push 5
push 0x148df00
mov edx, eax
mov dword [0x15ad5a0], eax
call fcn.0148d7c0
xor eax, eax
pop esi
ret