joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18178f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18178f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18178f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18178f06f
add dl, dl
jne 0x18178f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18178f0f6
xor eax, eax
add dl, dl
jne 0x18178f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18178f1ad
add dl, dl
jne 0x18178f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18178f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18178f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18178f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18178f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18178f07e
mov eax, 1
add dl, dl
jne 0x18178f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18178f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18178f0fb
sub eax, ebx
mov ebx, 1
jne 0x18178f14c
mov ecx, 1
add dl, dl
jne 0x18178f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18178f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18178f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18178f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18178f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18178f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18178f15d
cmp eax, 0x7d00
jae 0x18178f19b
cmp eax, 0x500
jb 0x18178f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18178f07e
cmp eax, 0x7f
ja 0x18178f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18178f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18178f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18178f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003fc0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180011010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx edi, dl
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, edi
xor ebp, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9d, eax
cmp dil, 1
jne 0x18000401f
xorps xmm0, xmm0
lea r8d, [rbp + 6]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
lea rdx, str.MOUSE0
mov qword [rbx + 0x18], rbp
jmp 0x180004120
cmp dil, 2
jne 0x180004045
xorps xmm0, xmm0
lea rdx, str.MOUSE1
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8d, 6
mov qword [rbx + 0x18], rbp
jmp 0x180004120
cmp dil, 4
jne 0x18000406b
xorps xmm0, xmm0
lea rdx, str.MBUTTON
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8d, 7
mov qword [rbx + 0x18], rbp
jmp 0x180004120
cmp dil, 5
jne 0x180004091
xorps xmm0, xmm0
lea rdx, str.XBUTTON1
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8d, 8
mov qword [rbx + 0x18], rbp
jmp 0x180004120
cmp dil, 6
jne 0x1800040b4
xorps xmm0, xmm0
lea rdx, str.XBUTTON2
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8d, 8
mov qword [rbx + 0x18], rbp
jmp 0x180004120
lea eax, [rdi - 0x21]
cmp eax, 0x84
ja case.0x1800040d9.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x4158]
mov ecx, dword [rdx + rax*4 + 0x4150]
add rcx, rdx
jmp rcx
bts r9d, 8
shl r9d, 0x10
lea rdx, [rsp + 0x30]
mov ecx, r9d
mov r8d, 0x80
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
inc r8
cmp byte [rax + r8], bpl
jne 0x180004112
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000b800
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000b970
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001850
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180064c28]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x67452301
xor ebx, ebx
mov dword [rsp + 0x24], 0xefcdab89
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call sym.ProxyProtocol.dll_MD4Update
mov r8d, ebx
lea rdx, [rsp + 0x82]
lea r9d, [rbx + 2]
mov eax, r8d
lea rdx, [rdx + 4]
inc r8d
lea rcx, [rax*4]
movzx eax, byte [rsp + rcx + 0x30]
mov byte [rdx - 6], al
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rdx - 5], al
movzx eax, byte [rsp + rcx + 0x32]
mov byte [rdx - 4], al
movzx eax, byte [rsp + rcx + 0x33]
mov byte [rdx - 3], al
sub r9, 1
jne 0x1800018b2
mov ecx, dword [rsp + 0x30]
lea rdx, section..data
shr ecx, 3
mov eax, 0x78
and ecx, 0x3f
mov r8d, gethostname
sub eax, ecx
sub r8d, ecx
cmp ecx, 0x38
lea rcx, [rsp + 0x20]
cmovae r8d, eax
call sym.ProxyProtocol.dll_MD4Update
mov r8d, 8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call sym.ProxyProtocol.dll_MD4Update
lea rax, [rdi + 2]
mov r8d, 4
nop
lea rdx, [rbx*4]
movzx ecx, byte [rsp + rdx + 0x20]
lea ebx, [rbx + 1]
mov byte [rax - 2], cl
lea rax, [rax + 4]
movzx ecx, byte [rsp + rdx + 0x21]
mov byte [rax - 5], cl
movzx ecx, byte [rsp + rdx + 0x22]
mov byte [rax - 4], cl
movzx ecx, byte [rsp + rdx + 0x23]
mov byte [rax - 3], cl
sub r8, 1
jne 0x180001940
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180026c20
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x1800024a0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180064c28]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x67452301
xor ebx, ebx
mov dword [rsp + 0x24], 0xefcdab89
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call sym.ProxyProtocol.dll_librad_MD5Update
mov r8d, ebx
lea rdx, [rsp + 0x82]
lea r9d, [rbx + 2]
mov eax, r8d
lea rdx, [rdx + 4]
inc r8d
lea rcx, [rax*4]
movzx eax, byte [rsp + rcx + 0x30]
mov byte [rdx - 6], al
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rdx - 5], al
movzx eax, byte [rsp + rcx + 0x32]
mov byte [rdx - 4], al
movzx eax, byte [rsp + rcx + 0x33]
mov byte [rdx - 3], al
sub r9, 1
jne 0x180002502
mov ecx, dword [rsp + 0x30]
lea rdx, [0x18004d4f0]
shr ecx, 3
mov eax, 0x78
and ecx, 0x3f
mov r8d, gethostname
sub eax, ecx
sub r8d, ecx
cmp ecx, 0x38
lea rcx, [rsp + 0x20]
cmovae r8d, eax
call sym.ProxyProtocol.dll_librad_MD5Update
mov r8d, 8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call sym.ProxyProtocol.dll_librad_MD5Update
lea rax, [rdi + 2]
mov r8d, 4
nop
lea rdx, [rbx*4]
movzx ecx, byte [rsp + rdx + 0x20]
lea ebx, [rbx + 1]
mov byte [rax - 2], cl
lea rax, [rax + 4]
movzx ecx, byte [rsp + rdx + 0x21]
mov byte [rax - 5], cl
movzx ecx, byte [rsp + rdx + 0x22]
mov byte [rax - 4], cl
movzx ecx, byte [rsp + rdx + 0x23]
mov byte [rax - 3], cl
sub r8, 1
jne 0x180002590
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180026c20
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x180011450
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x180064c28]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.180027a80
movabs rax, 0x5053534d4c544e
mov byte [rsp + 0xa8], 2
mov edx, 0x80
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1800114d0
lea ebp, [rax + rax]
mov byte [rsp + 0xb0], gethostbyname
movzx eax, byte [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0xac], bpl
xor ebx, ebx
mov byte [rsp + 0xae], bpl
mov dword [rsp + 0xb4], 0xa0818203
nop dword [rax]
movsx ecx, al
call fcn.18002b958
mov byte [rsp + rbx + 0xd0], al
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
mov byte [rsp + rbx + 0xd1], 0
add rbx, 2
test al, al
je 0x18001153c
cmp rbx, 0x40
jl 0x180011510
mov rcx, rsi
call fcn.180035b5c
mov eax, dword [r14 + 0x18c]
mov rbx, rsi
mov dword [rsi + 4], eax
mov edi, 8
movzx eax, byte [r14 + 0x18a]
xor byte [rsi + 1], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x180011561
mov rax, qword [rsi]
lea r8d, [rbp + 0x30]
mov rdx, r15
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xa0]
call sym.ProxyProtocol.dll_en64
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.180026c20
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180015f10
Capabilities:
Encode data using base64

Disassembly:
test r8d, r8d
jle 0x180015fcf
lea r9, [rcx + 2]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 - 2]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [rdx], al
cmp r8d, 1
jbe 0x180015f50
movzx eax, byte [r9 - 1]
shr eax, 4
jmp 0x180015f52
xor eax, eax
movzx ecx, byte [r9 - 2]
and ecx, 3
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [rdx + 1], al
cmp r8d, 1
jbe 0x180015faf
cmp r8d, 2
jbe 0x180015f7e
movzx eax, byte [r9]
shr eax, 6
jmp 0x180015f80
xor eax, eax
movzx ecx, byte [r9 - 1]
and ecx, 0xf
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [rdx + 2], al
add rdx, 3
cmp r8d, 2
jbe 0x180015fb7
movzx eax, byte [r9]
and eax, 0x3f
movzx ecx, byte [rax + r11]
jmp 0x180015fb9
mov byte [rdx + 2], 0x3d
add rdx, 3
mov cl, 0x3d
mov byte [rdx], cl
sub r8d, 3
inc rdx
add r9, 3
test r8d, r8d
jg 0x180015f30
mov rax, rdx
mov byte [rdx], 0
ret
Function at 0x18001ba60
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
sub rsp, 0x38
mov eax, 1
mov esi, edx
mov rbp, rcx
cmp edx, eax
jl 0x18001baf2
mov qword [rsp + 0x50], rbx
mov ebx, eax
mov qword [rsp + 0x60], rdi
lea rdi, sym.ProxyProtocol.dll_sockopts
mov qword [rsp + 0x30], r14
mov r14d, 0xfffb
mov dword [rsp + 0x58], 1
test esi, eax
je 0x18001bad7
mov rax, qword [rdi + 8]
movzx ecx, byte [rax]
cmp cl, 0x54
jne 0x18001bab2
mov edx, 6
jmp 0x18001babe
cmp cl, 0x49
mov edx, 0xffff
cmove edx, r14d
mov r8d, dword [rdi]
lea r9, [rsp + 0x58]
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
rol ebx, 1
add rdi, 0x10
mov eax, ebx
cmp esi, ebx
jge 0x18001ba93
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop rsi
pop rbp
ret

Function at 0x18001bef0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180064c28]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
mov rbx, rcx
mov rcx, qword [rax + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x18001c058
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], 0x300
mov edi, dword [rax + 0x4c]
sar edi, 0xa
add edi, 5
je 0x18001c090
nop word [rax + rax]
mov edx, 1
lea rcx, [rsp + 0x38]
mov r8d, 0x2328
call qword [sym.ProxyProtocol.dll_mypoll]
cmp eax, 1
jne 0x18001c081
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x1a8]
mov rcx, qword [rcx + 0x40]
call qword [0x180064a08]
mov qword [rbx + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x18001bfa7
lea rdx, str.Connect_back_accept___failed
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
jmp 0x18001c049
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movups xmm0, xmmword [rbx + 0x1a8]
mov rax, qword [rbx + 0x10]
movups xmmword [rbx + 0x1b8], xmm0
cmp qword [rax + 0x140], 0
je 0x18001bfec
mov rcx, rbx
call sym.ProxyProtocol.dll_checkACL
mov dword [rbx + 0xdc], eax
cmp dword [rbx + 0xdc], 0
je 0x18001bffe
lea rdx, str.Connect_back_ACL_failed
jmp 0x18001c02f
mov rcx, qword [rbx + 0x78]
lea r8, [0x18004ed4c]
mov r9d, 1
mov dword [rsp + 0x20], 0x2328
lea rdx, [rbx + 0x1a8]
call sym.ProxyProtocol.dll_socksendto
cmp eax, 1
je 0x18001c054
lea rdx, str.Connect_back_sending_command_failed
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
mov rcx, qword [rbx + 0x78]
call qword [0x180064a78]
mov qword [rbx + 0x78], 0xffffffffffffffff
sub edi, 1
jne 0x18001bf50
jmp 0x18001c090
test edi, edi
je 0x18001c090
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180026c20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, str.Connect_back_not_received__check_connback_client
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
mov rcx, rbx
mov dword [rbx + reloc.WS2_32.dll_listenc], 0xd
call sym.ProxyProtocol.dll_freeparam
jmp 0x18001c062
Function at 0x18001fca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov edx, dword [0x1800648c8]
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
add edx, 0x4000
mov dword [rsp + 0x20], 0
lea r8, [sym.ProxyProtocol.dll_startsrv]
mov dword [0x1800648cc], 1
xor ecx, ecx
call fcn.180036344
test rax, rax
je 0x18001fceb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1800648cc], 0
je 0x18001fd08
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1800648cc], 0
jne 0x18001fcf4
mov eax, dword [sym.ProxyProtocol.dll_haveerror]
test eax, eax
je 0x18001fd5e
lea rcx, str.:_insufficient_memory
mov qword [rsp + 0x30], rbx
cmp eax, 2
lea rbx, [0x18004d577]
cmove rbx, rcx
mov ecx, 2
call fcn.180035d30
mov r8d, dword [sym.ProxyProtocol.dll_linenum]
lea rdx, str.Service_not_started_on_line:__d_s_n
mov rcx, rax
mov r9, rbx
call sym.ProxyProtocol.dll_fprintf
mov rbx, qword [rsp + 0x30]
mov eax, 0x28
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800209c0
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x180064c28]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r12d, edx
mov eax, 0x10624dd3
imul r8d
mov qword [rsp + 0x6d8], r13
mov r15, rcx
xor r13d, r13d
sar edx, 6
mov eax, edx
mov qword [rsp + 0x40], rcx
shr eax, 0x1f
mov edi, r13d
add edx, eax
mov dword [rsp + 0x50], r13d
imul eax, edx, 0x3e8
mov r9d, r13d
mov dword [rsp + 0x38], edx
mov esi, r12d
mov edx, r13d
mov dword [rbp + 0x160], r13d
mov dword [rbp + 0x370], edx
mov r14d, 0x400
sub r8d, eax
imul eax, r8d, 0x3e8
mov r8d, r13d
mov dword [rsp + 0x3c], eax
test r12d, r12d
je 0x180020b71
mov r10, rcx
mov r14d, r12d
mov r15d, 0x300
nop word [rax + rax]
movzx ebx, word [r10 + 8]
test r15w, bx
je 0x180020ab4
mov ecx, r13d
test r8d, r8d
je 0x180020a94
mov r11, qword [r10]
cmp qword [rsp + rcx*8 + 0x58], r11
je 0x180020a94
inc ecx
cmp ecx, r8d
jb 0x180020a86
cmp ecx, r8d
jne 0x180020ab4
cmp r8d, 0x40
jae 0x180020ab4
mov rax, qword [r10]
mov qword [rsp + rcx*8 + 0x58], rax
mov r8d, dword [rsp + 0x50]
inc r8d
mov dword [rsp + 0x50], r8d
test bl, 0x10
je 0x180020afc
mov ecx, r13d
test r9d, r9d
je 0x180020ad5
mov r11, qword [r10]
cmp qword [rbp + rcx*8 + 0x168], r11
je 0x180020ad5
inc ecx
cmp ecx, r9d
jb 0x180020ac4
cmp ecx, r9d
jne 0x180020afc
cmp r9d, 0x40
jae 0x180020afc
mov rax, qword [r10]
mov qword [rbp + rcx*8 + 0x168], rax
mov r9d, dword [rbp + 0x160]
inc r9d
mov dword [rbp + 0x160], r9d
bt bx, 0xa
jae 0x180020b46
mov eax, r13d
test edx, edx
je 0x180020b22
mov r11, qword [r10]
nop dword [rax]
mov ecx, eax
cmp qword [rbp + rcx*8 + 0x378], r11
je 0x180020b22
inc eax
cmp eax, edx
jb 0x180020b10
cmp eax, edx
jne 0x180020b46
cmp edx, 0x40
jae 0x180020b46
mov ecx, eax
mov rax, qword [r10]
mov qword [rbp + rcx*8 + 0x378], rax
mov edx, dword [rbp + 0x370]
inc edx
mov dword [rbp + 0x370], edx
mov rax, qword [r10]
cmp rax, rdi
mov word [r10 + 0xa], r13w
cmovbe rax, rdi
add r10, 0x10
mov rdi, rax
sub r14, 1
jne 0x180020a70
mov r15, qword [rsp + 0x40]
mov r14d, 0x400
lea rax, [rsp + 0x38]
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x370]
lea r8, [rbp + 0x160]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_select]
mov r13, qword [rsp + 0x6d8]
mov edi, eax
cmp eax, 1
jl 0x180020c12
test r12d, r12d
je 0x180020c12
lea rbx, [r15 + 0xa]
mov r15d, 0x300
nop word [rax + rax]
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x50]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020bd6
or word [rbx], r15w
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x160]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020bee
or word [rbx], 0x10
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x370]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020c06
or word [rbx], r14w
add rbx, 0x10
sub rsi, 1
jne 0x180020bc0
mov eax, edi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.180026c20
add rsp, 0x690
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180020ce0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x180064c28]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, r8d
mov dword [rsp + 0x20], 1
mov rbx, rdx
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov ebp, r9d
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [0x180064a20]
test eax, eax
je 0x180020d4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x180020d4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
je 0x180020d4e
mov eax, reloc.WS2_32.dll_listen
jmp 0x180020d88
mov eax, reloc.WS2_32.dll_recv
imul r8d, ebp, 0x3e8
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x28], rsi
lea edx, [rax - 0xf]
mov word [rsp + 0x30], ax
call qword [sym.ProxyProtocol.dll_mypoll]
xor ecx, ecx
mov edx, reloc.WS2_32.dll_listen
test eax, eax
cmovle ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180026c20
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180020da0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rdi
sub rsp, 0x58
xor edi, edi
mov rbx, rcx
mov edx, edi
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dl
jne 0x180020db5
cmp rax, 0xff
jbe 0x180020dcb
mov byte [rcx + 0xff], dl
movzx eax, byte [rcx]
mov r8d, edi
test al, al
je 0x180020df6
cmp al, 0x2e
jne 0x180020de2
inc edx
cmp edx, 3
jg 0x180020df6
jmp 0x180020de8
sub al, 0x30
cmp al, 9
ja 0x180020df6
movzx eax, byte [rcx + 1]
inc rcx
inc r8d
test al, al
jne 0x180020dd5
movsxd rax, r8d
mov qword [rsp + 0x50], rsi
cmp byte [rax + rbx], dil
jne 0x180020e7f
cmp edx, 3
jne 0x180020e7f
lea rax, [rsp + 0x44]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x80]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x78]
lea rax, [rsp + 0x88]
lea rdx, str._u._u._u._u__u
mov qword [rsp + 0x20], rax
call sym.ProxyProtocol.dll_sscanf
mov esi, eax
cmp eax, 4
jl 0x180020e7f
mov ecx, dword [rsp + 0x78]
shl ecx, 8
xor ecx, dword [rsp + 0x80]
shl ecx, 8
xor ecx, dword [rsp + 0x88]
shl ecx, 8
xor ecx, dword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x70], eax
cmp esi, 4
je 0x180020f1b
mov rsi, qword [sym.ProxyProtocol.dll_resolvfunc]
test rsi, rsi
je 0x180020ee3
lea r8, [rsp + 0x70]
mov rdx, rbx
mov ecx, 2
call rsi
test eax, eax
je 0x180020eae
mov eax, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
mov rcx, qword [0x1800649b0]
test rcx, rcx
je 0x180020ebf
call fcn.1800366c0
lea r8, [rsp + 0x70]
mov rdx, rbx
mov ecx, 2
call rsi
test eax, eax
cmovne edi, dword [rsp + 0x70]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180020f10
mov rcx, qword [0x1800649b0]
test rcx, rcx
je 0x180020f19
call fcn.1800366c0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180020f19
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180020f30
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x50
mov ebp, 2
mov rsi, r8
mov word [r8], bp
mov rbx, rdx
xor ecx, ecx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], cl
jne 0x180020f50
cmp rax, 0xff
jbe 0x180020f66
mov byte [rdx + 0xff], cl
movzx eax, byte [rdx]
xor r8d, r8d
test al, al
je 0x180020f91
cmp al, 0x2e
jne 0x180020f7d
inc ecx
cmp ecx, 3
jg 0x180020f91
jmp 0x180020f83
sub al, 0x30
cmp al, 9
ja 0x180020f91
movzx eax, byte [rdx + 1]
inc rdx
inc r8d
test al, al
jne 0x180020f70
movsxd rax, r8d
mov qword [rsp + 0x70], rdi
cmp byte [rax + rbx], 0
jne 0x18002101c
cmp ecx, 3
jne 0x18002101c
lea rax, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x88]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x80]
lea rax, [rsp + 0x40]
lea rdx, str._u._u._u._u__u
mov qword [rsp + 0x20], rax
call sym.ProxyProtocol.dll_sscanf
mov edi, eax
cmp eax, 4
jl 0x18002101c
mov ecx, dword [rsp + 0x80]
shl ecx, 8
xor ecx, dword [rsp + 0x88]
shl ecx, 8
xor ecx, dword [rsp + 0x40]
shl ecx, 8
xor ecx, dword [rsp + 0x44]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x78], eax
mov ecx, eax
cmp edi, 4
je 0x1800210a0
mov rdi, qword [sym.ProxyProtocol.dll_resolvfunc]
test rdi, rdi
je 0x180021066
lea r8, [rsp + 0x78]
mov rdx, rbx
mov ecx, ebp
call rdi
test eax, eax
je 0x18002103e
mov ecx, dword [rsp + 0x78]
jmp 0x1800210a0
mov rcx, qword [0x1800649b0]
test rcx, rcx
je 0x18002104f
call fcn.1800366c0
lea r8, [rsp + 0x78]
mov rdx, rbx
mov ecx, ebp
call rdi
xor ecx, ecx
test eax, eax
cmovne ecx, dword [rsp + 0x78]
jmp 0x1800210a0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180021097
mov rcx, qword [0x1800649b0]
test rcx, rcx
je 0x180021093
call fcn.1800366c0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180021097
xor ecx, ecx
jmp 0x1800210a0
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
mov rdi, qword [rsp + 0x70]
mov dword [rsi + 4], ecx
neg ecx
sbb eax, eax
and eax, ebp
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret

Function at 0x180021110
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx r8d, word [sym.ProxyProtocol.dll_randomizer]
mov eax, edx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov r10d, edx
movsxd r11, eax
test eax, eax
jle 0x1800211b3
cmp r11d, 0x10
jb 0x1800211b3
mov r9d, r11d
xorps xmm2, xmm2
xorps xmm1, xmm1
and r9d, 0x8000000f
jge 0x180021155
dec r9d
or r9d, 0xfffffff0
inc r9d
mov eax, r11d
sub eax, r9d
movsxd r9, eax
nop
movdqu xmm0, xmmword [rcx + rdx*2]
add r10d, 0x10
pxor xmm2, xmm0
movdqu xmm0, xmmword [rcx + rdx*2 + 0x10]
add rdx, 0x10
pxor xmm1, xmm0
cmp rdx, r9
jl 0x180021160
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movd eax, xmm1
xor r8w, ax
movsxd rax, r10d
cmp rax, r11
jge 0x1800211cd
nop dword [rax + rax]
xor r8w, word [rcx + rax*2]
inc rax
cmp rax, r11
jl 0x1800211c0
movzx ecx, r8w
call fcn.180035bf8
call fcn.180035bcc
mov dword [sym.ProxyProtocol.dll_randomizer], eax
add rsp, 0x28
jmp fcn.180035bcc