joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400188b0
Capabilities:
Read .ini file

Disassembly:
push rbp
sub rsp, 0xe0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, rcx
call fcn.140004e50
test eax, eax
je 0x1400188e1
mov eax, 1
jmp 0x1400189e3
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0xd0], r12
xor ebx, ebx
lea r12, [0x1400ad4c0]
mov qword [rsp + 0xd8], rdi
mov esi, ebx
nop dword [rax]
cmp ebx, 0xc8
ja 0x1400189c1
xor eax, eax
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005fe50
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, esi
mov edx, SQLNumResultCols
call fcn.14005ff3c
lea r9, [rsp + 0x40]
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x140018982
inc ebx
jmp 0x1400189b3
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1400605e0
test eax, eax
je 0x1400189fc
inc esi
cmp esi, 0x3e8
jb 0x140018910
xor eax, eax
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
mov r12, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0xe0
pop rbp
ret
mov eax, 1
jmp 0x1400189c3

Function at 0x140018bb0
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SeShutdownPrivilege
mov edx, 1
call fcn.140006fd0
test eax, eax
jne 0x140018bd4
add rsp, 0x20
pop rbx
ret
lea rdx, [0x14007882c]
mov rcx, rbx
call fcn.1400605e0
test eax, eax
jne 0x140018bf8
lea ecx, [rax + 6]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rdx, [0x140078828]
mov rcx, rbx
call fcn.1400605e0
test eax, eax
jne 0x140018c1b
xor edx, edx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rdx, [0x140078824]
mov rcx, rbx
call fcn.1400605e0
test eax, eax
jne 0x140018c3f
lea ecx, [rax + 1]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rdx, [0x140078820]
mov rcx, rbx
call fcn.1400605e0
test eax, eax
jne 0x140018c63
lea ecx, [rax + 8]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14001b630
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0xd0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor esi, esi
mov r12, rdx
mov rbp, rcx
lea r13, [0x1400ad4c0]
mov qword [rsp + 0x110], rdi
mov ebx, esi
nop word [rax + rax]
cmp esi, 0xc8
ja 0x14001b71c
xor eax, eax
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
mov qword [rsp + 0x30], rax
call fcn.14005fe50
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, 7
call fcn.14005ff3c
lea r9, [rsp + 0x40]
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x14001b6dd
inc esi
jmp 0x14001b70e
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400605e0
test eax, eax
je 0x14001b745
inc ebx
cmp ebx, 0x3e8
jb 0x14001b670
xor eax, eax
mov rdi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0xd0
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x30]
mov r9, r13
mov r8, r12
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x14001b71e
Function at 0x14001d350
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x180
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov ebp, edx
mov rsi, rcx
mov byte [rsp + 0x40], 0
lea r12d, [rax + 1]
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov byte [rsp + 0x30], al
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
test edx, edx
jne 0x14001d3c8
lea rdx, str._r_nDenied_List:_r_n
call fcn.140015c20
test eax, eax
je 0x14001d542
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b8], r13
lea r13, [0x1400ad4c0]
mov qword [rsp + 0x1b0], rdi
xor ebx, ebx
nop dword [rax]
xor eax, eax
lea r8, str.DeniedIP_d
lea rcx, [rsp + 0x30]
lea edx, [rax + 0xf]
mov r9d, ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005ff3c
xor edx, edx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x40]
lea rcx, str.DeniedSettings
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x14001d4f0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
test ebp, ebp
je 0x14001d4a2
lea rcx, [0x1400abcd0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x40]
call fcn.140005ec0
lea rcx, [0x1400abcd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14001d4f0
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], 0
call fcn.14005fe50
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r8, str._d.__s_r_n
lea rcx, [rsp + 0x60]
mov edx, 0x103
mov r9d, r12d
call fcn.14005ff3c
lea rdx, [rsp + 0x60]
mov rcx, rsi
inc r12d
call fcn.140015c20
test eax, eax
je 0x14001d521
inc ebx
cmp ebx, 0x40
jb 0x14001d3f0
test ebp, ebp
jne 0x14001d525
cmp r12d, 1
jne 0x14001d50e
lea rdx, str._r_nThe_List_Is_Empty_r_n_r_n
jmp 0x14001d515
lea rdx, [0x140075890]
mov rcx, rsi
call fcn.140015c20
test eax, eax
jne 0x14001d525
xor eax, eax
jmp 0x14001d52a
mov eax, 1
mov rdi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x180
pop r12
pop rsi
pop rbp
ret
Function at 0x14001d750
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov r12d, r8d
mov rbp, rdx
mov esi, ecx
lea r13, [0x1400ad4c0]
mov ebx, edi
xor eax, eax
lea r8, str.DeniedIP_d
lea rcx, [rsp + 0x30]
lea edx, [rax + 0xf]
mov r9d, ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call fcn.14005ff3c
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.DeniedSettings
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x14001d7ea
inc edi
cmp edi, esi
je 0x14001d815
inc ebx
cmp ebx, 0x40
jb 0x14001d782
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
lea r8d, [r12 - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140060000
mov eax, ebx
jmp 0x14001d7f4
Function at 0x14001db30
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
sub rsp, 0x70
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov byte [rsp + 0x30], 0
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
xor esi, esi
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov rbp, rcx
lea r12, [0x1400ad4c0]
mov ebx, esi
mov qword [r11 + 0x18], rdi
xor eax, eax
lea r8, str.DeniedIP_d
lea rcx, [rsp + 0x50]
lea edx, [rax + 0xf]
mov r9d, ebx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call fcn.14005ff3c
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
lea r9, [rsp + 0x30]
lea rcx, str.DeniedSettings
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x14001dc16
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 1]
call fcn.140007320
inc esi
inc ebx
cmp ebx, 0x40
jb 0x14001db80
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
test esi, esi
jne 0x14001dc3e
lea rdx, str._r_nThe_Denied_List_Is_Empty_r_n_r_n
jmp 0x14001dc71
lea rcx, str.DeniedSettings
mov r9, r12
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r8, str._d_Entries_Are_Removed_r_n
lea rcx, [rsp + 0x30]
mov r9d, esi
mov edx, reloc.ODBC32.dll_SQLFreeHandle
call fcn.14005ff3c
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140015c20
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret
Function at 0x14001def0
Capabilities:
Read .ini file

Disassembly:
push rbp
sub rsp, 0x90
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rcx
call fcn.140004e50
test eax, eax
jne 0x14001e06b
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0x80], r12
mov byte [rsp + 0x30], al
xor eax, eax
xor ebx, ebx
lea r12, [0x1400ad4c0]
mov qword [rsp + 0x88], rdi
mov esi, ebx
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
nop word [rax + rax]
cmp ebx, 0xc8
ja 0x14001e04b
xor eax, eax
lea r8, str.User_d
lea rcx, [rsp + 0x50]
lea edx, [rax + 0x1f]
mov r9d, esi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.14005ff3c
xor edx, edx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x50]
lea rdx, str.UserName
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x14001dfee
inc ebx
jmp 0x14001e01f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400605e0
test eax, eax
je 0x14001e02f
inc esi
cmp esi, 0x3e8
jb 0x14001df70
jmp 0x14001e04b
lea r8, str.Disable
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x50]
mov r9, r12
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x90
pop rbp
ret
Function at 0x140020dc0
Capabilities:
Read .ini file

Disassembly:
push r12
push r13
sub rsp, 0x208
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r12, rdx
mov r13, rcx
test rdx, rdx
jne 0x140020def
xor eax, eax
jmp 0x140020ff9
mov qword [rsp + 0x230], rbx
mov qword [rsp + 0x238], rbp
lea rcx, [rsp + 0xd1]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1f0], r14
mov byte [rsp + 0xd0], 0
call fcn.14005fe50
xor esi, esi
lea r14, [0x1400ad4c0]
mov qword [rsp + 0x1f8], rdi
lea ebx, [rsi + 1]
mov ebp, esi
cmp esi, 0xc8
ja 0x140020fcc
xor eax, eax
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x80
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005fe50
lea r8, str.User_d
lea rcx, [rsp + 0x40]
mov r9d, ebp
mov edx, SQLNumResultCols
call fcn.14005ff3c
lea r9, [rsp + 0x50]
lea rdx, str.UserName
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x140020ec1
inc esi
jmp 0x140020fbe
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x50]
mov edx, edx
call fcn.14000cac0
lea r9, [rsp + 0x30]
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], SQLNumResultCols
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x140020fbe
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, str.Enable
lea rcx, [rsp + 0x30]
call fcn.1400605e0
test eax, eax
jne 0x140020f73
lea rax, [rsp + 0x50]
lea r8, str.PRIVMSG__s_:Account__d:__s_____Enable_r_n
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov r9, r12
mov edx, 0x103
mov dword [rsp + 0x20], ebx
call fcn.14005ff3c
inc ebx
jmp 0x140020f9f
lea rax, [rsp + 0x50]
lea r8, str.PRIVMSG__s_:Account__d:__s_____Disable_r_n
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov r9, r12
mov edx, 0x103
mov dword [rsp + 0x20], ebx
call fcn.14005ff3c
inc ebx
lea rdx, [rsp + 0xd0]
mov rcx, r13
call fcn.140015c20
test eax, eax
je 0x140020fcc
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x3e8
jb 0x140020e42
mov r14, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
mov rbp, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x230]
mov eax, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x208
pop r13
pop r12
ret
Function at 0x140028380
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea r11, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.AllowedIP
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028416
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140008ff0
jmp 0x140028425
lea rdx, [0x140075858]
mov rcx, rbx
call fcn.140008f50
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret

Function at 0x140028480
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea r11, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.DeniedIP
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028516
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140009190
jmp 0x140028525
lea rdx, str.None
mov rcx, rbx
call fcn.1400090f0
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret

Function at 0x140028580
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea r11, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.AllowedDestIP
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028616
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140009330
jmp 0x140028625
lea rdx, [0x140075858]
mov rcx, rbx
call fcn.140009290
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret
Function at 0x140028680
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea r11, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.DeniedDestPort
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028716
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140009480
jmp 0x140028720
xor edx, edx
mov rcx, rbx
call fcn.140009430
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret

Function at 0x140028780
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea r11, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.AllowedDestPort
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028816
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140009640
jmp 0x140028820
xor edx, edx
mov rcx, rbx
call fcn.1400095f0
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret

Function at 0x140028880
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea r11, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.DeniedDestIP
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028916
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140009850
jmp 0x140028925
lea rdx, str.None
mov rcx, rbx
call fcn.1400097b0
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret
Function at 0x140028950
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x448
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.14005fe50
lea rdx, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
lea rcx, str.GlobalSettings
lea rdx, [0x14007a0c0]
xor r8d, r8d
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140028a0a
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x440], rdi
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rcx, [rsp + 0x30]
call fcn.140009a70
mov rdi, qword [rsp + 0x440]
test eax, eax
je 0x140028a0a
mov eax, 1
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x448
ret
mov ecx, 0x438
call fcn.140009980
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x448
ret
Function at 0x14002ab10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov r15, rcx
mov r14d, r8d
mov r13, rdx
lea rcx, [rsp + 0xc1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xc0], 0
call fcn.14005fe50
xor eax, eax
xor r12d, r12d
lea rcx, [rsp + 0x41]
lea r8d, [rax + 0x7f]
xor edx, edx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov esi, r12d
mov ebp, r12d
mov byte [rsp + 0x40], al
call fcn.14005fe50
mov ebx, r12d
lea rdi, [0x1400ad4c0]
nop
cmp ebp, 0xc8
ja 0x14002ac52
xor eax, eax
lea r8, str.User_d
lea rcx, [rsp + 0x30]
lea edx, [rax + 0xf]
mov r9d, ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.14005ff3c
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
call fcn.14005fe50
lea r9, [rsp + 0x40]
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x14002ac10
inc ebp
jmp 0x14002ac44
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
mov edx, edx
call fcn.14000cac0
mov ecx, ebx
call fcn.14002aa20
lea rdi, [0x1400ad4c0]
test eax, eax
je 0x14002ac44
inc esi
inc ebx
cmp ebx, 0x3e8
jb 0x14002aba0
test r14d, r14d
jne 0x14002ac9d
mov edx, 0x103
lea rcx, [rsp + 0xc0]
test r13, r13
jne 0x14002ac7a
lea r8, str._r_n_d_Accounts_Remote_Proxy_Chain_Has_Been_Disabled_r_n_r_n
mov r9d, esi
call fcn.14005ff3c
jmp 0x14002ac8d
lea r8, str.PRIVMSG__s_:_d_Accounts_Remote_Proxy_Chain_Has_Been_Disabled_r_n
mov r9, r13
mov dword [rsp + 0x20], esi
call fcn.14005ff3c
lea rdx, [rsp + 0xc0]
mov rcx, r15
call fcn.140015c20
test esi, esi
setne r12b
mov eax, r12d
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret