Function at 0x14000f1c0
Capabilities:
Check mutex on windows
Check os version
Create thread
Get file version info
Get system information on windows
Initialize winsock library
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x760]
sub rsp, 0x860
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rbp + 0x750], rax
mov r13, rdx
mov r15d, ecx
xor r12d, r12d
lea rcx, [rbp + 0x640]
xor edx, edx
mov r8d, 0x104
mov r14d, r12d
call fcn.14016b7a0
xor edx, edx
lea rcx, [rbp + 0x210]
mov r8d, 0x104
call fcn.14016b7a0
mov edi, 1
lea rcx, [rbp + 0x320]
xor edx, edx
mov dword [0x14020ea74], edi
mov r8d, 0x104
call fcn.14016b7a0
lea rcx, [rbp + 0x320]
call fcn.140034360
mov ecx, r12d
lea rbx, [0x14020e860]
movzx eax, byte [rbp + rcx + 0x320]
mov byte [rcx + rbx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000f261
lea rcx, [rbp + 0x320]
dec rcx
nop
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x14000f280
movsd xmm0, qword [str.Chrome_]
movzx eax, byte [0x1401a5da8]
movsd qword [rcx], xmm0
mov byte [rcx + 8], al
lea rcx, [0x14000e2c0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rax, [rbp + 0x200]
mov qword [rbp + 0x200], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumps
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000f323
lea rax, [rsp + 0x74]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumps
lea rax, [rbp + 0x200]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rbp + 0x200]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140036360
mov ecx, 0x101
lea rdx, [rbp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [0x140212f60]
mov dword [0x140212f60], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [reloc.WS2_32.dll_connect]
lea rdx, [rbp + 0x320]
call fcn.14002f310
mov r8d, 0x104
lea rdx, [rbp + 0x430]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea rcx, [rbp + 0x430]
xor edx, edx
mov dword [rbp + 0x200], eax
mov byte [rbp + 0x204], al
call fcn.140176114
test eax, eax
je 0x14000f3aa
mov eax, r12d
jmp 0x14000f482
lea rdx, [rsp + 0x74]
lea rcx, [rbp + 0x430]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test eax, eax
je 0x14000f463
mov edx, esi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [rsp + 0x74]
lea rcx, [rbp + 0x430]
mov r9, rax
mov r8d, esi
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoA
lea r9, [rsp + 0x78]
mov rcx, rbx
lea r8, [rbp - 0x80]
lea rdx, [0x1401a5d5c]
call sub.VERSION.dll_VerQueryValueA
mov rax, qword [rbp - 0x80]
lea rdx, str._d_d_d_d
mov r8d, dword [rax + 0x10]
mov ecx, dword [rax + 0x14]
movzx eax, cx
shr ecx, 0x10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rbp + 0x200]
movzx r9d, r8w
shr r8d, 0x10
call fcn.1400031e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rbx, [0x14020e860]
mov edi, 1
jmp 0x14000f476
lea rdx, [rbp + 0x430]
lea rcx, str.Can_not_GetFileVersionInfoSize__s_...___n
call fcn.14000fa00
lea rcx, [rbp + 0x200]
call fcn.140174eb8
cmp dword [0x14020eb8c], r12d
mov dword [0x14020ec9c], eax
jne 0x14000f496
call fcn.140036d10
lea rax, [0x1401fe008]
mov qword [rsp + 0x60], rax
lea rsi, [0x14020eca0]
lea rax, [0x1401fe004]
mov qword [rsp + 0x58], rax
lea r9, [0x140212ff8]
lea rax, [0x14020ec98]
mov qword [rsp + 0x50], rax
lea r8, [0x14020e96c]
lea rax, [0x1401fe010]
mov qword [rsp + 0x48], rax
lea rdx, [0x14020ec94]
lea rax, [0x140213020]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x640]
mov qword [rsp + 0x38], rsi
lea rax, [0x14020eb90]
mov qword [rsp + 0x30], rax
lea rax, [0x14020ea80]
mov qword [rsp + 0x28], rax
lea rax, [0x14020e968]
mov qword [rsp + 0x20], rax
call fcn.140036e60
cmp dword [0x14020ec94], r12d
jne 0x14000f540
mov dword [0x14020ec94], 0x2710
mov dword [0x14020e96c], 0x2711
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x14020eda8], rax
test rax, rax
je 0x14000f9dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000f9dc
lea rdx, str.WinMain_start
mov ecx, 4
call fcn.14002f270
lea rdx, str.__START__
mov ecx, 4
call fcn.14002f270
cmp r15d, 2
jne 0x14000f5aa
mov r8, qword [r13 + 8]
lea rdx, [0x1401a5c50]
lea ecx, [r15 + 2]
call fcn.14002f270
lea rcx, [0x140213020]
call fcn.14002bd20
xor edx, edx
lea rcx, [rbp + 0x540]
mov r8d, 0x100
call fcn.14016b7a0
mov r8, rbx
lea rdx, str._s_newproxy.ini
lea rcx, [rbp + 0x540]
call fcn.1400031e0
lea rdx, str.SERVER_START
mov ecx, 4
call fcn.14002f270
cmp dword [0x14020eb8c], r12d
jne 0x14000f88f
xorps xmm1, xmm1
mov dword [rbp - 0x40], 0x9c
xorps xmm0, xmm0
lea rcx, [rbp - 0x40]
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp + 0x54], rax
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x3c], xmm1
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
movups xmmword [rbp + 4], xmm1
movups xmmword [rbp + 0x14], xmm1
movups xmmword [rbp + 0x24], xmm1
movups xmmword [rbp + 0x34], xmm1
movups xmmword [rbp + 0x44], xmm1
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14000f660
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, [0x1401a5bf0]
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1401a5bd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp - 0x30], 2
jne 0x14000f701
mov eax, dword [rbp - 0x3c]
cmp eax, 6
jne 0x14000f6c9
mov eax, dword [rbp - 0x38]
cmp eax, 2
jne 0x14000f6ab
cmp byte [rbp + 0x5a], 1
jne 0x14000f701
lea ebx, [rax + 5]
jmp 0x14000f701
cmp eax, 1
jne 0x14000f6ba
cmp byte [rbp + 0x5a], al
jne 0x14000f701
lea ebx, [rax + 2]
jmp 0x14000f701
test eax, eax
jne 0x14000f701
cmp byte [rbp + 0x5a], 1
jne 0x14000f701
lea ebx, [rax + 2]
jmp 0x14000f701
cmp eax, 5
jne 0x14000f6fb
mov eax, dword [rbp - 0x38]
cmp eax, 2
jne 0x14000f6ea
lea ecx, [rax + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [rbp - 0x3c]
cmp eax, 5
jne 0x14000f6fb
mov eax, dword [rbp - 0x38]
cmp eax, 1
jne 0x14000f6f3
mov ebx, edi
jmp 0x14000f701
test eax, eax
jne 0x14000f701
mov ebx, edi
jmp 0x14000f701
cmp eax, 4
cmovbe ebx, edi
lea rdx, str.IFLogin
mov dword [0x14020e964], ebx
mov ecx, 4
call fcn.14002f270
call fcn.140036180
lea rdx, str.IFLogin_end
mov ecx, 4
call fcn.14002f270
cmp dword [0x14020e968], 0xb
je 0x14000f7a8
call fcn.140035400
mov dword [0x14020ea7c], eax
test eax, eax
jg 0x14000f763
lea rdx, str.IFGetDialInterval_error_
mov ecx, 4
call fcn.14002f270
mov eax, dword [0x1401fe014]
mov dword [0x14020ea7c], eax
mov r8d, eax
lea rdx, str.IFGetDialInterval:_d
mov ecx, 4
call fcn.14002f270
mov eax, dword [0x14020ea7c]
lea r8, [0x14000e4e0]
mov dword [0x14020eb84], eax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov edx, 0x4000
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call fcn.140176340
lea rax, [rbp + 0x540]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x210]
lea r8, [0x1401d4b53]
mov dword [rsp + 0x20], 0x104
lea rdx, str.publicip
lea rcx, str.network
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rbp + 0x210]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x14000f7f0
test rax, rax
jne 0x14000f818
lea r8, [0x140213020]
lea rdx, [0x1401a5c50]
lea rcx, [rbp + 0x210]
call fcn.1400031e0
lea r8, [rbp + 0x210]
mov ecx, 4
lea rdx, str.Obtained_IP:_s
call fcn.14002f270
lea rax, [rsp + 0x70]
mov edx, 0x4000
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x210]
lea r8, [0x14000fa60]
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call fcn.140176340
lea rdx, str.begin_heartbeatfunc_thread
mov ecx, 4
call fcn.14002f270
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x14000f0e0]
mov edx, 0x4000
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call fcn.140176340
lea rdx, str.finish
mov ecx, 4
call fcn.14002f270
call fcn.140034430
call fcn.140034a50
lea rax, str.3proxy_tiny_proxy_server_3proxy_0.9.4_stringtable_file
lea rcx, [rbp + 0x640]
mov qword [0x1401fe490], rax
call fcn.140183a70
mov qword [0x1401fe328], rax
test rax, rax
je 0x14000f8dd
cmp byte [rax], 0x2d
je 0x14000f8dd
call fcn.140016c40
mov r14, rax
lea rcx, [0x140212ee0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140212ea0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140212e60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140212e20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140212de0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140212da0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140212d00]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1401fe2f0]
call fcn.1400170e0
mov rcx, r14
call fcn.140018370
inc dword [0x1401fe388]
test eax, eax
jne 0x14000f9aa
cmp qword [0x140212d98], r12
jne 0x14000f967
mov rcx, r14
call fcn.140170fcc
call fcn.140036dd0
cmp dword [0x14020eda4], r12d
je 0x14000f9a5
mov rax, qword [0x1401fe490]
mov rcx, qword [rax + 8]
lea rax, [0x14000e5b0]
mov qword [rbp - 0x78], rcx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x14000f9aa
call fcn.14000e710
xor eax, eax
mov rcx, qword [rbp + 0x750]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.WinMain_start0
mov ecx, 4
call fcn.14002f270
mov ecx, edi
call fcn.1401740f4
int3