joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d0d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea rax, [rsp + 0x38]
mov ebx, r8d
mov r9d, 0xf003f
xor r8d, r8d
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000d129
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x18000d269
mov ebp, 0x100
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8, rbp
call fcn.180052810
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0xc0]
mov r9d, ebp
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x18000d259
lea rcx, [rsp + 0x1c0]
mov r8, rbp
xor edx, edx
mov dword [rsp + 0x30], ebp
call fcn.180052810
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.18000cf64
test eax, eax
je 0x18000d248
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.180053170
lea rdx, str.00000
lea rcx, [rsp + 0x40]
call fcn.180053170
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1800530d0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x40]
call fcn.18000ce78
test eax, eax
je 0x18000d248
movsxd rax, dword [0x18009b6b0]
cmp eax, 0x12b
jge 0x18000d248
mov rcx, rax
lea rax, [0x180084a20]
lea rdx, [rsp + 0xc0]
shl rcx, 8
add rcx, rax
call fcn.180053170
movsxd r11, dword [0x18009b6b0]
mov rax, qword [rsp + 0x1f0]
lea rcx, [0x1800976d0]
mov r8, r11
shl r8, 5
inc r11d
mov qword [r8 + rcx], rax
mov rax, qword [rsp + 0x208]
mov dword [0x18009b6b0], r11d
mov qword [r8 + rcx + 8], rax
mov byte [r8 + rcx + 0x10], 0
lea r8d, [rbx + 1]
mov rdx, rsi
mov rcx, rdi
call fcn.18000d0d0
jmp 0x18000d269
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000e188
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rsi, rcx
cmp rcx, rbx
je 0x18000e20e
lea r8d, [rbx + 2]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
cmp rax, rbx
je 0x18000e20e
lea r8d, [rbx + 4]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
cmp rax, rbx
je 0x18000e205
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
cmp eax, ebx
je 0x18000e1ff
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x24], 4
sete bl
mov eax, ebx
jmp 0x18000e210
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18000fa3c
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [str.GlobalMySyrinxObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor ebx, ebx
mov qword [0x18009b800], rax
cmp rax, rbx
jne 0x18000fa66
lea eax, [rbx + 1]
jmp 0x18000fa76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18000fb00
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rsi, rcx
cmp rcx, rbx
je 0x18000fb84
lea r8d, [rbx + 2]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
cmp rax, rbx
je 0x18000fb84
lea r8d, [rbx + 4]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
cmp rax, rbx
je 0x18000fb7b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
cmp eax, ebx
je 0x18000fb75
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x24], 4
sete al
jmp 0x18000fb86
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800123a0
Capabilities:
Acquire debug privileges

Disassembly:
test rcx, rcx
je 0x180012408
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800123fe
lea rcx, str.SeDebugPrivilege
mov edx, 1
call fcn.180006814
call fcn.180001010
call fcn.1800013d0
test al, al
je 0x1800123f2
lea rcx, str.Get_Sql_Port_Ok
call fcn.180001030
mov rdx, rbx
mov rcx, rdi
call fcn.180002080
jmp 0x1800123fe
lea rcx, str.Fail_To_Get_Sql_Port
call fcn.180001030
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180012ed8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x1f0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x51]
lea r8d, [rax + 0x7f]
xor edx, edx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], al
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
call fcn.180052810
mov r12d, 0x103
lea rcx, [rsp + 0xd1]
mov r8, r12
xor edx, edx
mov byte [rsp + 0xd0], 0
call fcn.180052810
lea rdx, [0x180067870]
mov rcx, rsi
xor edi, edi
call fcn.180012d7c
test eax, eax
je 0x1800130dd
xor ebx, ebx
lea r14, [0x18009b470]
cmp edi, 0xc8
ja 0x1800130d8
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x10]
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x80
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
lea r9, [rsp + 0x50]
lea rdx, str.UserName
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x180013011
inc edi
jmp 0x1800130ca
lea rcx, [rsp + 0x50]
call fcn.1800529c0
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.18000b550
lea r9, [rsp + 0x30]
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], SQLNumResultCols
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1800130ca
lea rcx, [rsp + 0x30]
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.18000b550
lea rdx, str.Enable
lea rcx, [rsp + 0x30]
call fcn.180053060
lea r9d, [rbx + 1]
mov rdx, r12
test eax, eax
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r8, str.Account__d:__s_____Enable_r_n
je 0x1800130a6
lea r8, str.Account__d:__s_____Disable_r_n
call fcn.1800528fc
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.180012d7c
test eax, eax
je 0x1800130d8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3e8
jb 0x180012f88
mov eax, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x180013108
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x41]
lea r8d, [rax + 0x7f]
xor edx, edx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], al
call fcn.180052810
xor edi, edi
xor ebx, ebx
cmp edi, 0xc8
ja 0x180013213
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x1800131dd
inc edi
jmp 0x180013205
lea rcx, [rsp + 0x40]
call fcn.1800529c0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18000b550
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.180053060
test eax, eax
je 0x18001323b
inc ebx
cmp ebx, 0x3e8
jb 0x180013160
or eax, 0xffffffff
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, ebx
jmp 0x180013216
Function at 0x180014704
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov ebx, ecx
lea rcx, [rsp + 0x30]
lea r8d, [rax + 0x10]
xor edx, edx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x40], 0
call fcn.180052810
mov ebx, 0x100
lea rcx, [rsp + 0x40]
mov r8, rbx
xor edx, edx
call fcn.180052810
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x1800147c0
xor eax, eax
jmp 0x18001481a
lea rcx, [rsp + 0x40]
call fcn.1800529c0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18000b550
lea rcx, [0x18009ad78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x18009b440]
jmp 0x180014805
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180053060
test eax, eax
je 0x18001480a
mov rbx, qword [rbx + 0x1b0]
test rbx, rbx
jne 0x1800147ed
lea rcx, [0x18009ad78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800527e0
add rsp, 0x150
pop rbx
ret
Function at 0x180014958
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov ebx, edx
xor edx, edx
lea rcx, [rsp + 0x31]
lea r8d, [rdx + 0x3f]
mov byte [rsp + 0x30], 0
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x71]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x70], 0
call fcn.180052810
xor edi, edi
lea rcx, [rsp + 0x30]
lea r8d, [rdi + 0x40]
xor edx, edx
call fcn.180052810
mov esi, 0x80
lea rcx, [rsp + 0x70]
mov r8, rsi
xor edx, edx
call fcn.180052810
lea r8, str.User_d
lea edx, [rdi + 0x3f]
lea rcx, [rsp + 0x30]
mov r9d, ebx
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], r11
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x180014ab6
lea rcx, [rsp + 0x70]
call fcn.1800529c0
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.18000b550
lea rcx, [0x18009ad78]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x18009b440]
jmp 0x180014a5e
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.180053060
test eax, eax
je 0x180014a65
mov rbx, qword [rbx + 0x1b0]
test rbx, rbx
jne 0x180014a46
jmp 0x180014a73
and dword [rbx + 0x138], 0
mov edi, 1
mov esi, edi
lea rcx, [0x18009ad78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x180014ab4
mov rcx, rbx
call fcn.1800082d0
mov rcx, rbx
call fcn.180008424
mov rcx, rbx
call fcn.1800089ec
mov rcx, rbx
call fcn.180008578
mov rcx, rbx
call fcn.18000885c
mov rcx, rbx
call fcn.1800086cc
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800154dc
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rcx
call fcn.180004a30
test eax, eax
je 0x180015516
mov eax, 1
jmp 0x180015600
xor eax, eax
lea rcx, [rsp + 0x41]
xor edx, edx
lea r8d, [rax + 0x7f]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], al
call fcn.180052810
xor edi, edi
xor ebx, ebx
cmp edi, 0xc8
ja 0x1800155fe
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x1800155c4
inc edi
jmp 0x1800155f0
lea rcx, [rsp + 0x40]
call fcn.1800529c0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18000b550
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.180053060
test eax, eax
je 0x18001550c
inc ebx
cmp ebx, 0x3e8
jb 0x180015547
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180015790
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SeShutdownPrivilege
mov edx, 1
call fcn.180006814
test eax, eax
je 0x18001581c
lea rdx, [0x180069e44]
mov rcx, rbx
call fcn.180053060
test eax, eax
jne 0x1800157ce
lea ecx, [rax + 6]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x18001581c
lea rdx, [0x180069e40]
mov rcx, rbx
call fcn.180053060
test eax, eax
jne 0x1800157e7
xor edx, edx
xor ecx, ecx
jmp 0x1800157c6
lea rdx, [0x180069e3c]
mov rcx, rbx
call fcn.180053060
test eax, eax
jne 0x1800157ff
lea ecx, [rax + 1]
jmp 0x1800157c4
lea rdx, [0x180069e38]
mov rcx, rbx
call fcn.180053060
test eax, eax
jne 0x180015817
lea ecx, [rax + 8]
jmp 0x1800157c4
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180017ccc
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0xd0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rdx
xor edx, edx
mov rbp, rcx
lea rcx, [rsp + 0x41]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x40], 0
call fcn.180052810
xor eax, eax
xor edi, edi
mov byte [rsp + 0x30], 0
xor ebx, ebx
lea r12, [0x18009b470]
mov dword [rsp + 0x31], eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
cmp edi, 0xc8
ja 0x180017dd9
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 8]
call fcn.180052810
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, 7
call fcn.1800528fc
lea r9, [rsp + 0x40]
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x180017da3
inc edi
jmp 0x180017dcb
lea rcx, [rsp + 0x40]
call fcn.1800529c0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18000b550
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.180053060
test eax, eax
je 0x180017e03
inc ebx
cmp ebx, 0x3e8
jb 0x180017d2d
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x30]
mov r9, r12
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x180017ddb
Function at 0x1800196f8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov esi, edx
mov rbx, rcx
mov byte [rsp + 0x40], 0
lea ebp, [rax + 1]
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov byte [rsp + 0x30], al
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
test edx, edx
jne 0x18001977d
lea rdx, str._r_nDenied_List:_r_n
call fcn.180012d7c
test eax, eax
jne 0x18001977d
xor eax, eax
jmp 0x1800198b0
xor edi, edi
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea r8, str.DeniedIP_d
lea rcx, [rsp + 0x30]
mov r9d, edi
mov edx, SQLNumResultCols
call fcn.1800528fc
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x20]
call fcn.180052810
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x30]
lea rcx, str.DeniedSettings
xor r8d, r8d
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x180019880
lea rcx, [rsp + 0x40]
call fcn.1800529c0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18000b550
test esi, esi
je 0x18001982f
lea rcx, [0x180099cc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x40]
call fcn.180005888
lea rcx, [0x180099cc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180019880
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], 0
call fcn.180052810
lea r11, [rsp + 0x40]
lea r8, str._d.__s_r_n
lea rcx, [rsp + 0x60]
mov r9d, ebp
mov edx, 0x103
mov qword [rsp + 0x20], r11
call fcn.1800528fc
lea rdx, [rsp + 0x60]
mov rcx, rbx
inc ebp
call fcn.180012d7c
test eax, eax
je 0x180019776
inc edi
cmp edi, 0x40
jb 0x18001977f
test esi, esi
jne 0x1800198ab
mov rcx, rbx
cmp ebp, 1
jne 0x1800198d9
lea rdx, str._r_nThe_List_Is_Empty_r_n_r_n
call fcn.180012d7c
test eax, eax
je 0x180019776
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rdx, [0x180067870]
jmp 0x18001989e
Function at 0x180019e4c
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x70
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov byte [rsp + 0x40], 0
xor edi, edi
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
mov byte [rsp + 0x30], al
mov qword [r11 - 0x47], rax
mov rsi, rcx
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
xor ebx, ebx
lea r12, [0x18009b470]
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea r8, str.DeniedIP_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x20]
call fcn.180052810
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.DeniedSettings
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x180019f40
lea rcx, [rsp + 0x40]
call fcn.1800529c0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18000b550
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 1]
call fcn.180006b5c
inc edi
inc ebx
cmp ebx, 0x40
jb 0x180019eb3
test edi, edi
jne 0x180019f58
lea rdx, str._r_nThe_Denied_List_Is_Empty_r_n_r_n
jmp 0x180019f8b
lea rcx, str.DeniedSettings
mov r9, r12
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r8, str._d_Entries_Are_Removed_r_n
lea rcx, [rsp + 0x40]
mov r9d, edi
mov edx, reloc.ODBC32.dll_SQLFreeHandle
call fcn.1800528fc
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180012d7c
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18001a1f8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rcx
call fcn.180004a30
test eax, eax
jne 0x18001a343
mov byte [rsp + 0x50], al
xor eax, eax
xor edi, edi
xor ebx, ebx
lea rbp, [0x18009b470]
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
mov byte [rsp + 0x30], al
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
cmp edi, 0xc8
ja 0x18001a343
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x20]
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, reloc.ODBC32.dll_SQLFreeHandle
call fcn.1800528fc
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x20]
call fcn.180052810
lea r9, [rsp + 0x30]
lea rdx, str.UserName
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x18001a2ef
inc edi
jmp 0x18001a317
lea rcx, [rsp + 0x30]
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.18000b550
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180053060
test eax, eax
je 0x18001a327
inc ebx
cmp ebx, 0x3e8
jb 0x18001a27b
jmp 0x18001a343
lea r8, str.Disable
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x50]
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret