joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1457440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x150b70b
mov eax, dword fs:[0]
push eax
mov eax, 0x3a58
call fcn.014e2fc0
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x3a54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x153e8e8]
xor eax, esp
push eax
lea eax, [esp + 0x3a6c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3a7c]
mov edi, ecx
cmp word [edi + 0x24], 0
mov dword [esp + 0x18], esi
ja 0x1457498
call fcn.014aa1a0
lea eax, [esi + 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [edi + 0x1c], 1
jne 0x145766a
mov al, 0xcd
mov byte [esp + 0x3a48], al
mov byte [esp + 0x3a49], al
mov byte [esp + 0x3a4a], al
mov byte [esp + 0x3a4b], al
mov byte [esp + 0x3a4c], 0x18
mov byte [esp + 0x3a4d], 0x28
mov byte [esp + 0x3a4e], 0x43
mov byte [esp + 0x3a4f], 0xa2
mov byte [esp + 0x3a50], 5
mov byte [esp + 0x3a52], 0x75
mov byte [esp + 0x3a53], 0x52
mov byte [esp + 0x3a54], 0x32
mov byte [esp + 0x3a56], 0x99
mov byte [esp + 0x3a57], 0x47
mov byte [esp + 0x3a58], 0x3f
mov byte [esp + 0x3a59], 0x2e
mov byte [esp + 0x3a5a], al
mov byte [esp + 0x3a5b], al
mov byte [esp + 0x3a5c], 0x69
mov byte [esp + 0x3a5d], 0x11
mov byte [esp + 0x3a5e], 0x58
mov byte [esp + 0x3a5f], 0x7b
mov byte [esp + 0x3a60], 0xe3
mov byte [esp + 0x3a61], 0x5c
mov byte [esp + 0x3a63], 0x82
mov byte [esp + 0x3a64], 0x27
mov byte [esp + 0x3a65], 0x65
mov byte [esp + 0x3a66], 0xd9
mov byte [esp + 0x3a67], 0
mov byte [esp + 0x3a51], al
mov byte [esp + 0x3a55], al
mov byte [esp + 0x3a62], al
mov ecx, dword [esi + 0x1054]
movzx ebp, word [ecx]
lea ecx, [esp + 0x1c]
and ebp, 0x7fff
call fcn.0148aeb0
mov dword [esp + 0x3a74], 0
mov dl, byte [edi + 0x24]
lea eax, [esp + 0x3a48]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a6b], dl
call fcn.0148aed0
cmp dword [esi + 0x104c], 0x10
jg 0x14575f4
call fcn.014aa1a0
mov ebx, dword [esi + 0x1034]
add ebx, 0x10
cmp dword [esi + 0x104c], 0x10
jg 0x145760b
call fcn.014aa1a0
mov ecx, dword [esi + 0x1034]
push ebx
add ecx, 0x10
push ecx
add ebp, 0xfffffff6
push ebp
lea ecx, [esp + 0x28]
call fcn.0148af50
mov ebx, 0xa
jmp 0x1457630
cmp dword [esi + 0x1048], 0
mov ecx, esi
je 0x1457647
lea edx, [esp + 0x17]
push edx
call fcn.0143a820
jmp 0x1457651
lea eax, [esp + 0x17]
push eax
call fcn.0143a8a0
sub ebx, 1
jne 0x1457630
mov dword [esp + 0x3a74], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0148aec0
lea ecx, [esp + 0x18]
lea esi, [edi + 4]
push ecx
mov ecx, esi
call fcn.01457130
mov dword [edi + 0x14], 0
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
cmp eax, esi
ja 0x14576d4
jb 0x1457691
call fcn.01455b10
mov edx, dword [eax]
add word [edi + 0x24], 0xffff
movzx eax, word [edi + 0x24]
xor ecx, ecx
test ax, ax
sete cl
mov dword [edi + 0x2c], edx
mov al, cl
mov ecx, dword [esp + 0x3a6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3a54]
xor ecx, esp
call fcn.014e18ea
add esp, 0x3a64
ret 4
call fcn.01455b80
int3
Function at 0x147b5e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x150e538
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x153e8e8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
cmp dword [0x1561078], ebx
je 0x147b7f8
cmp dword [0x1565000], ebx
jne 0x147b62a
call fcn.014aa1a0
mov eax, dword [0x1565000]
mov esi, dword [eax + 8]
cmp esi, ebx
jne 0x147b63b
call fcn.014aa1a0
lea ecx, [esp + 0x34]
call fcn.01479f50
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x58], ebx
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.0147b490
cmp dword [esp + 0x3c], ebx
je 0x147b7e7
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
cmp eax, ecx
je 0x147b80c
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov dword [ecx], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push eax
mov dword [ecx + 4], edx
call fcn.014e1d06
sub dword [esp + 0x40], 1
add esp, 4
push ebx
push 0x153c060
push 0x153c094
push ebx
mov ecx, edi
call fcn.01479930
push eax
call fcn.014e458c
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x147b6bd
call fcn.014aa1a0
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call edx
cmp al, bl
je 0x147b796
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x147b6f1
push ecx
mov ecx, ebp
call fcn.01479a90
mov eax, dword [edi + 4]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
lea esi, [ebp + 0x400c4]
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0147af70
mov edx, dword [esp + 0x1c]
cmp edx, ebx
mov ecx, dword [esi + 4]
je 0x147b816
cmp edx, esi
jne 0x147b816
mov eax, dword [esp + 0x20]
cmp eax, ecx
sete cl
cmp cl, bl
je 0x147b758
mov eax, dword [edi + 4]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 1
call fcn.0147aeb0
jmp 0x147b7dd
cmp eax, dword [edx + 4]
je 0x147b811
add dword [eax + 0x10], 1
cmp dword [eax + 0x10], 3
jb 0x147b7dd
push str._THE_ENDLESS_LOOP_THERESHOLD_EXCEEDED__THIS_SERVER_WILL_BE_SHUT_DOWN__
push 0x2000001
call fcn.0144e9a0
mov eax, dword [esp + 0x1c]
add esp, 8
push 0x18181818
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, edi
call fcn.014c5c60
jmp 0x147b7dd
mov ecx, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ecx
lea esi, [ebp + 0x400c4]
push eax
mov ecx, esi
call fcn.0147af70
mov edx, dword [esp + 0x2c]
cmp edx, ebx
mov eax, dword [esi + 4]
je 0x147b816
cmp edx, esi
jne 0x147b816
mov ecx, dword [esp + 0x30]
cmp ecx, eax
sete al
cmp al, bl
sete al
cmp al, bl
je 0x147b7dd
cmp ecx, dword [edx + 4]
je 0x147b811
mov dword [ecx + 0x10], ebx
cmp dword [esp + 0x3c], ebx
jne 0x147b668
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0147a280
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp fcn.0147a740
jmp fcn.0147a6d0
jmp fcn.0147a630
Function at 0x1486f00
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x150f54b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x153e8e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1486f87
push 8
call fcn.014e1d0b
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x1486f53
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x1486f55
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
push 0
push 0
push esi
push 0x1486db0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1486f87
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x1487060
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x1487086
sub eax, 1
je 0x148707f
sub eax, 1
jne 0x1487086
mov eax, 1
jmp 0x148708b
mov eax, 2
jmp 0x148708b
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x156177c]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x1488500
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x208
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov al, 1
mov edi, edi
movzx edx, al
mov byte [esp + edx + 0x14], cl
mov dl, al
and dl, 0x80
mov byte [esp + ecx + 0x114], al
add ecx, 1
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x1488520
mov al, 1
lea ecx, [edi + 0x2a04]
mov esi, 0xa
lea ebx, [ebx]
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
add al, al
and edx, 0x1b
xor al, dl
sub esi, 1
jne 0x1488560
mov dword [edi + 0x1790], esi
mov dword [edi + 0x204], 0x63
mov edx, 1
lea esi, [edi + 0x208]
jmp 0x14885a0
movzx eax, byte [esp + edx + 0x14]
lea ecx, [esp + 0x213]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [esi], eax
mov dword [edi + eax*4 + 0x1604], edx
add edx, 1
add esi, 4
cmp edx, 0x100
jl 0x14885a0
lea ecx, [edi + 0x604]
mov dword [esp + 0x10], 0x100
lea esp, [esp]
mov dl, byte [ecx - 0x400]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov bl, dl
add bl, bl
movzx edx, dl
and eax, 0x1b
xor al, bl
movzx esi, al
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx], eax
ror eax, 8
mov dword [ecx + 0x400], eax
ror eax, 8
mov dword [ecx + 0x800], eax
ror eax, 8
mov dword [ecx + 0xc00], eax
mov al, byte [ecx + 0x1000]
test al, al
je 0x14886a3
movzx edx, al
movzx esi, byte [esp + edx + 0x14]
movzx eax, byte [esp + 0x1f]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x21]
add eax, esi
movzx ebp, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebx, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x22]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x114]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x114]
jmp 0x14886ab
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, ebp
mov dword [ecx + 0x1400], eax
ror eax, 8
mov dword [ecx + 0x1800], eax
ror eax, 8
mov dword [ecx + 0x1c00], eax
ror eax, 8
mov dword [ecx + 0x2000], eax
add ecx, 4
sub dword [esp + 0x10], 1
jne 0x14885f0
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.014e18ea
add esp, 0x208
ret
Function at 0x14936e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x15104c1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x153e8e8]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x79]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x80], bl
call fcn.014e21d0
lea ecx, [esp + 0x80]
push ecx
push esi
call fcn.01486af0
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x1493818
lea eax, [esp + 0x74]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1493773
sub eax, edx
push eax
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
call fcn.01433fd0
mov dword [esp + 0x184], ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
lea esi, [ebp + 0x1f4]
push ecx
mov ecx, esi
call fcn.01490940
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x20], edx
mov dword [esp + 0x184], 0xffffffff
cmp dword [esp + 0x68], 0x10
jb 0x14937d3
mov eax, dword [esp + 0x54]
push eax
call fcn.014e1d06
add esp, 4
cmp ebp, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
je 0x149393a
cmp ebp, esi
jne 0x149393a
cmp dword [esp + 0x20], eax
sete al
cmp al, bl
je 0x1493842
lea ecx, [esp + 0x74]
push ecx
push str.unknown_command_:__s
push 0x1000000
call fcn.0144e9a0
add esp, 0xc
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.014e18ea
add esp, 0x174
ret 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x184], 1
lea edx, [esp + 0x14]
push edx
push 0x151ef08
push edi
mov dword [esp + 0x20], ebx
call fcn.014e4661
add esp, 0xc
cmp eax, ebx
je 0x1493905
jmp 0x1493880
mov edi, 0xf
mov ecx, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x1493896
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.01433fd0
mov byte [esp + 0x184], 2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.01492f20
mov byte [esp + 0x184], 1
cmp dword [esp + 0x4c], 0x10
jb 0x14938de
mov ecx, dword [esp + 0x38]
push ecx
call fcn.014e1d06
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x151ef08
push ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.014e4661
add esp, 0xc
cmp eax, ebx
jne 0x1493880
mov eax, dword [esp + 0x20]
cmp eax, dword [ebp + 4]
jne 0x1493913
call fcn.0148e0e0
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
call edx
mov dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0148f0d0
jmp 0x1493818
call fcn.0148dd20
int3
Function at 0x1497830
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x504
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x500], eax
push ebp
mov ebp, dword [esp + 0x50c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0xfe
movzx esi, ax
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.014e21d0
push esi
call fcn.01496b10
push eax
lea ecx, [esp + 0x20]
push 0xff
push ecx
call fcn.014e2b5b
add esp, 0x1c
mov eax, dword [esp + 0x518]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, eax
test edi, edi
jne 0x149790a
push 0x3ff
push eax
lea ecx, [esp + 0x115]
push ecx
mov byte [esp + 0x118], al
call fcn.014e21d0
lea edx, [esp + 0x18]
push edx
movzx eax, si
push eax
push str.Cannot_find_proper_font__LangID_:_0x_X__FontName_:__s___please_contact_to_Joymax
lea ecx, [esp + 0x124]
push 0x400
push ecx
call fcn.014e2b5b
add esp, 0x20
push 0x30
push str.Error
lea edx, [esp + 0x114]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
push 0x30
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x50c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.014e18ea
add esp, 0x504
ret

Function at 0x14a3bd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1511b40
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x153e8e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.014a3aa0
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x3c]
push ecx
push 1
push 0
push esi
lea ecx, [esp + 0x18]
call fcn.014a3a30
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [esp + 0x28], 0
lea ecx, [esp + 8]
call fcn.014a3a70
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.014a3ad0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x14a52f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14a5370
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 0x10]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x14a5310
sub eax, edx
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebx
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x14a5338
sub ecx, edi
push ebx
add ecx, 1
push ecx
push eax
call fcn.0143a120
test eax, eax
je 0x14a5357
call fcn.014aa1a0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x14a8d50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
jne 0x14a8d8c
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push esi
call ebx
test eax, eax
jne 0x14a8d84
call ebp
cmp eax, 0xb7
jne 0x14a8d94
push esi
call edi
cmp eax, 0xffffffff
je 0x14a8d72
pop edi
pop esi
pop ebp
and eax, 0x10
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x14a9680
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
mov esi, dword [esp + 0x118]
push 0x151fad8
push 0x104
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.01477d20
test eax, eax
je 0x14a96c5
call fcn.014aa1a0
push str._NT_SYMBOL_PATH
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.014e5183
add esp, 0xc
test eax, eax
je 0x14a9712
push 0x151fac4
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a96f9
call fcn.014aa1a0
mov edx, dword [esp + 4]
push edx
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9712
call fcn.014aa1a0
push str._NT_ALT_SYMBOL_PATH
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.014e5183
add esp, 0xc
test eax, eax
je 0x14a975f
push 0x151fac4
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9746
call fcn.014aa1a0
mov edx, dword [esp + 4]
push edx
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a975f
call fcn.014aa1a0
push str.SYSTEMROOT
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.014e5183
add esp, 0xc
test eax, eax
je 0x14a97e8
push 0x151fac4
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9793
call fcn.014aa1a0
mov edx, dword [esp + 4]
push edx
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a97ac
call fcn.014aa1a0
push 0x151fac4
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a97c5
call fcn.014aa1a0
mov eax, dword [esp + 4]
push eax
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a97de
call fcn.014aa1a0
push str.System32
jmp 0x14a987e
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.014e21d0
add esp, 0xc
push 0x103
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x14a9892
push 0x151fac4
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a982e
call fcn.014aa1a0
lea eax, [esp + 0xc]
push eax
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9847
call fcn.014aa1a0
push 0x151fac4
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9860
call fcn.014aa1a0
lea ecx, [esp + 0xc]
push ecx
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9879
call fcn.014aa1a0
push str.System
push 0x104
push esi
call fcn.01477d20
test eax, eax
je 0x14a9892
call fcn.014aa1a0
mov ecx, dword [esp + 0x110]
pop esi
xor ecx, esp
call fcn.014e18ea
add esp, 0x110
ret
Function at 0x14aa140
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x14aa195
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi]
push 0
push 0
lea edx, [esp + 0xc]
push edx
push fcn.014a9b80
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
push 0
push 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x10
ret

Function at 0x14aa4a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x400
jge 0x14aa576
push 0x3ff
lea ecx, [esp + 5]
push 0
push ecx
mov byte [esp + 0xc], 0
call fcn.014e21d0
mov eax, dword [esp + 0x414]
lea edx, [esp + 0x418]
push edx
push eax
lea ecx, [esp + 0x14]
push 0x3ff
push ecx
call fcn.014e28ae
add esp, 0x1c
test eax, eax
jl 0x14aa51c
cmp eax, 0x3ff
ja 0x14aa51c
jne 0x14aa529
mov byte [esp + 0x3ff], 0
jmp 0x14aa529
mov byte [esp + 0x3ff], 0
call fcn.014aa1a0
call fcn.014a8da0
test al, al
je 0x14aa562
lea edx, [esp]
push edx
push 0x2000001
call fcn.014b8790
add esp, 8
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.014e18ea
add esp, 0x404
ret
push 0
push str.BSObj_Plugin
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.014e18ea
add esp, 0x404
ret
Function at 0x14aa870
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1004
call fcn.014e2fc0
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x1018]
test ebx, 0x400
push ebp
mov ebp, dword [esp + 0x1010]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1020]
je 0x14aa8bc
push edi
push esi
push ebp
call dword [0x1563c44]
add esp, 0xc
and ebx, 2
jne 0x14aa8cf
test byte [esp + 0x1024], 4
je 0x14aa9f1
push 0xfff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.014e21d0
push esi
push ebp
push edi
push str.Debug_Assertion_Failed._n_nExpression_:__s_nLine_:__d_nFile_:__s_n_n
lea ecx, [esp + 0x2c]
push 0x1000
push ecx
call fcn.01432af0
add esp, 0x24
test eax, eax
je 0x14aa923
call fcn.014aa1a0
xor al, al
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.014e18ea
add esp, 0x1004
ret
test byte [esp + 0x1024], 8
je 0x14aa976
push str.CallStack:_n
push 0x1000
lea edx, [esp + 0x18]
push edx
call fcn.01477d20
test eax, eax
jne 0x14aa903
mov eax, dword [0x1563c08]
push eax
push 0x1000
lea ecx, [esp + 0x18]
push ecx
call fcn.01477d20
test eax, eax
jne 0x14aa903
push 0x151fd28
push 0x1000
lea edx, [esp + 0x18]
push edx
call fcn.01477d20
test eax, eax
jne 0x14aa903
test ebx, ebx
je 0x14aa9c1
push str._press__ok__to_advance__press__cancel__to_exit_
push 0x1000
lea eax, [esp + 0x18]
push eax
call fcn.01477d20
test eax, eax
jne 0x14aa903
push 0x11
push str.BSLib_Debug_Module
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x14aa9f1
mov al, byte [esp + 0x1024]
shr al, 4
not al
and al, 1
jmp 0x14aa90a
push str._press__ok__to_exit_program_
push 0x1000
lea edx, [esp + 0x18]
push edx
call fcn.01477d20
test eax, eax
jne 0x14aa903
push 0x10
push str.BSLib_Debug_Module
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14ad740
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp edi, 1
mov esi, ecx
je 0x14ad756
test edi, edi
je 0x14ad756
call fcn.014aa1a0
cmp dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], edi
jne 0x14ad78d
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
jne 0x14ad78d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, esi
call fcn.014ad720
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4