joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011920
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.18004c680
movabs rax, 0x5053534d4c544e
mov byte [rsp + 0xa8], 2
mov edx, 0x80
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1800119a0
lea ebp, [rax + rax]
mov byte [rsp + 0xb0], gethostbyname
movzx eax, byte [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0xac], bpl
xor ebx, ebx
mov byte [rsp + 0xae], bpl
mov dword [rsp + 0xb4], 0xa0818203
nop dword [rax]
movsx ecx, al
call fcn.18002c2a8
mov byte [rsp + rbx + 0xd0], al
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
mov byte [rsp + rbx + 0xd1], 0
add rbx, 2
test al, al
je 0x180011a0c
cmp rbx, 0x40
jl 0x1800119e0
mov rcx, rsi
call fcn.1800364ac
mov eax, dword [r14 + 0x18c]
mov edx, 8
mov dword [rsi + 4], eax
mov rcx, rsi
movzx eax, byte [r14 + 0x18a]
xor byte [rsi + 1], al
call sym.ProxyProtocol.dll_myrand
xor byte [rsi], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 1], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 2], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 3], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 4], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 5], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 6], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 7], al
lea r8d, [rbp + 0x30]
mov rax, qword [rsi]
lea rcx, [rsp + 0xa0]
mov rdx, r15
mov qword [rsp + 0xb8], rax
call sym.ProxyProtocol.dll_en64
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.180027110
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800164b0
Capabilities:
Encode data using base64

Disassembly:
test r8d, r8d
jle 0x18001656f
lea r9, [rcx + 2]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 - 2]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [rdx], al
cmp r8d, 1
jbe 0x1800164f0
movzx eax, byte [r9 - 1]
shr eax, 4
jmp 0x1800164f2
xor eax, eax
movzx ecx, byte [r9 - 2]
and ecx, 3
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [rdx + 1], al
cmp r8d, 1
jbe 0x18001654f
cmp r8d, 2
jbe 0x18001651e
movzx eax, byte [r9]
shr eax, 6
jmp 0x180016520
xor eax, eax
movzx ecx, byte [r9 - 1]
and ecx, 0xf
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [rdx + 2], al
add rdx, 3
cmp r8d, 2
jbe 0x180016557
movzx eax, byte [r9]
and eax, 0x3f
movzx ecx, byte [rax + r11]
jmp 0x180016559
mov byte [rdx + 2], 0x3d
add rdx, 3
mov cl, 0x3d
mov byte [rdx], cl
sub r8d, 3
inc rdx
add r9, 3
test r8d, r8d
jg 0x1800164d0
mov rax, rdx
mov byte [rdx], 0
ret
Function at 0x18001bf90
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
sub rsp, 0x38
mov eax, 1
mov esi, edx
mov rbp, rcx
cmp edx, eax
jl 0x18001c022
mov qword [rsp + 0x50], rbx
mov ebx, eax
mov qword [rsp + 0x60], rdi
lea rdi, sym.ProxyProtocol.dll_sockopts
mov qword [rsp + 0x30], r14
mov r14d, 0xfffb
mov dword [rsp + 0x58], 1
test esi, eax
je 0x18001c007
mov rax, qword [rdi + 8]
movzx ecx, byte [rax]
cmp cl, 0x54
jne 0x18001bfe2
mov edx, 6
jmp 0x18001bfee
cmp cl, 0x49
mov edx, 0xffff
cmove edx, r14d
mov r8d, dword [rdi]
lea r9, [rsp + 0x58]
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
rol ebx, 1
add rdi, 0x10
mov eax, ebx
cmp esi, ebx
jge 0x18001bfc3
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x18001c420
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rcx + 0x10]
mov rbx, rcx
mov rax, qword [rsi + 0x40]
cmp rax, 0xffffffffffffffff
je 0x18001c597
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x300
mov esi, dword [rsi + 0x4c]
sar esi, 0xa
add esi, 5
je 0x18001c5d4
lea rdi, [rcx + 0xdc]
nop dword [rax]
nop word [rax + rax]
mov edx, 1
lea rcx, [rsp + 0x38]
mov r8d, 0x2328
call qword [sym.ProxyProtocol.dll_mypoll]
cmp eax, 1
jne 0x18001c5c5
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x1a8]
mov rcx, qword [rcx + 0x40]
call qword [0x180065838]
mov qword [rbx + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x18001c4ee
lea rdx, str.Connect_back_accept___failed
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
lea rdi, [rbx + 0xdc]
jmp 0x18001c588
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movups xmm0, xmmword [rbx + 0x1a8]
mov rax, qword [rbx + 0x10]
movups xmmword [rbx + 0x1b8], xmm0
cmp qword [rax + 0x140], 0
je 0x18001c52f
mov rcx, rbx
call sym.ProxyProtocol.dll_checkACL
mov dword [rdi], eax
cmp dword [rdi], 0
je 0x18001c53d
lea rdx, str.Connect_back_ACL_failed
jmp 0x18001c56e
mov rcx, qword [rbx + 0x78]
lea r8, [0x18004fd4c]
mov r9d, 1
mov dword [rsp + 0x20], 0x2328
lea rdx, [rbx + 0x1a8]
call sym.ProxyProtocol.dll_socksendto
cmp eax, 1
je 0x18001c593
lea rdx, str.Connect_back_sending_command_failed
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
mov rcx, qword [rbx + 0x78]
call qword [0x1800658a8]
mov qword [rbx + 0x78], 0xffffffffffffffff
sub esi, 1
jne 0x18001c490
jmp 0x18001c5d4
test esi, esi
je 0x18001c5d4
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180027110
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rdx, str.Connect_back_not_received__check_connback_client
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
mov rcx, rbx
mov dword [rbx + reloc.WS2_32.dll_listenc], 0xd
call sym.ProxyProtocol.dll_freeparam
jmp 0x18001c5a1
Function at 0x1800201c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov edx, dword [0x180065958]
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
add edx, 0x4000
mov dword [rsp + 0x20], 0
lea r8, [sym.ProxyProtocol.dll_startsrv]
mov dword [0x18006595c], 1
xor ecx, ecx
call fcn.180036c94
test rax, rax
je 0x18002020b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x18006595c], 0
je 0x180020228
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x18006595c], 0
jne 0x180020214
mov eax, dword [sym.ProxyProtocol.dll_haveerror]
test eax, eax
je 0x18002027e
lea rcx, str.:_insufficient_memory
mov qword [rsp + 0x30], rbx
cmp eax, 2
lea rbx, [0x18004e577]
cmove rbx, rcx
mov ecx, 2
call fcn.180036680
mov r8d, dword [sym.ProxyProtocol.dll_linenum]
lea rdx, str.Service_not_started_on_line:__d_s_n
mov rcx, rax
mov r9, rbx
call sym.ProxyProtocol.dll_fprintf
mov rbx, qword [rsp + 0x30]
mov eax, 0x28
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x180020c30
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r12d, edx
mov eax, 0x10624dd3
imul r8d
mov qword [rsp + 0x6d8], r13
mov r15, rcx
xor r13d, r13d
sar edx, 6
mov eax, edx
mov qword [rsp + 0x40], rcx
shr eax, 0x1f
mov edi, r13d
add edx, eax
mov dword [rsp + 0x50], r13d
imul eax, edx, 0x3e8
mov r9d, r13d
mov dword [rsp + 0x38], edx
mov esi, r12d
mov edx, r13d
mov dword [rbp + 0x160], r13d
mov dword [rbp + 0x370], edx
mov r14d, 0x400
sub r8d, eax
imul eax, r8d, 0x3e8
mov r8d, r13d
mov dword [rsp + 0x3c], eax
test r12d, r12d
je 0x180020ddb
mov r10, rcx
mov r14d, r12d
mov r15d, 0x300
nop word [rax + rax]
movzx ebx, word [r10 + 8]
test r15w, bx
je 0x180020d24
mov ecx, r13d
test r8d, r8d
je 0x180020d04
mov r11, qword [r10]
cmp qword [rsp + rcx*8 + 0x58], r11
je 0x180020d04
inc ecx
cmp ecx, r8d
jb 0x180020cf6
cmp ecx, r8d
jne 0x180020d24
cmp r8d, 0x40
jae 0x180020d24
mov rax, qword [r10]
mov qword [rsp + rcx*8 + 0x58], rax
mov r8d, dword [rsp + 0x50]
inc r8d
mov dword [rsp + 0x50], r8d
test bl, 0x10
je 0x180020d6c
mov ecx, r13d
test r9d, r9d
je 0x180020d45
mov r11, qword [r10]
cmp qword [rbp + rcx*8 + 0x168], r11
je 0x180020d45
inc ecx
cmp ecx, r9d
jb 0x180020d34
cmp ecx, r9d
jne 0x180020d6c
cmp r9d, 0x40
jae 0x180020d6c
mov rax, qword [r10]
mov qword [rbp + rcx*8 + 0x168], rax
mov r9d, dword [rbp + 0x160]
inc r9d
mov dword [rbp + 0x160], r9d
bt bx, 0xa
jae 0x180020db6
mov eax, r13d
test edx, edx
je 0x180020d92
mov r11, qword [r10]
nop dword [rax]
mov ecx, eax
cmp qword [rbp + rcx*8 + 0x378], r11
je 0x180020d92
inc eax
cmp eax, edx
jb 0x180020d80
cmp eax, edx
jne 0x180020db6
cmp edx, 0x40
jae 0x180020db6
mov ecx, eax
mov rax, qword [r10]
mov qword [rbp + rcx*8 + 0x378], rax
mov edx, dword [rbp + 0x370]
inc edx
mov dword [rbp + 0x370], edx
cmp qword [r10], rdi
mov word [r10 + 0xa], r13w
cmova rdi, qword [r10]
add r10, 0x10
sub r14, 1
jne 0x180020ce0
mov r15, qword [rsp + 0x40]
mov r14d, 0x400
lea rax, [rsp + 0x38]
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x370]
lea r8, [rbp + 0x160]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_select]
mov r13, qword [rsp + 0x6d8]
mov edi, eax
cmp eax, 1
jl 0x180020e72
test r12d, r12d
je 0x180020e72
lea rbx, [r15 + 0xa]
mov r15d, 0x300
nop
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x50]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020e36
or word [rbx], r15w
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x160]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020e4e
or word [rbx], 0x10
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x370]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020e66
or word [rbx], r14w
add rbx, 0x10
sub rsi, 1
jne 0x180020e20
mov eax, edi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.180027110
add rsp, 0x690
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800211e0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, r8d
mov dword [rsp + 0x20], 1
mov rbx, rdx
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov ebp, r9d
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [0x180065850]
test eax, eax
je 0x18002124e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x18002124e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
je 0x18002124e
mov eax, reloc.WS2_32.dll_listen
jmp 0x180021288
mov eax, reloc.WS2_32.dll_recv
imul r8d, ebp, 0x3e8
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x28], rsi
lea edx, [rax - 0xf]
mov word [rsp + 0x30], ax
call qword [sym.ProxyProtocol.dll_mypoll]
xor ecx, ecx
mov edx, reloc.WS2_32.dll_listen
test eax, eax
cmovle ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180027110
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800212a0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rdi
sub rsp, 0x58
xor edi, edi
mov rbx, rcx
mov edx, edi
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dl
jne 0x1800212b5
cmp rax, 0xff
jbe 0x1800212cb
mov byte [rcx + 0xff], dl
movzx eax, byte [rcx]
mov r8d, edi
test al, al
je 0x1800212f6
cmp al, 0x2e
jne 0x1800212e2
inc edx
cmp edx, 3
jg 0x1800212f6
jmp 0x1800212e8
sub al, 0x30
cmp al, 9
ja 0x1800212f6
movzx eax, byte [rcx + 1]
inc rcx
inc r8d
test al, al
jne 0x1800212d5
movsxd rax, r8d
mov qword [rsp + 0x50], rsi
cmp byte [rax + rbx], dil
jne 0x18002137f
cmp edx, 3
jne 0x18002137f
lea rax, [rsp + 0x44]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x80]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x78]
lea rax, [rsp + 0x88]
lea rdx, str._u._u._u._u__u
mov qword [rsp + 0x20], rax
call sym.ProxyProtocol.dll_sscanf
mov esi, eax
cmp eax, 4
jl 0x18002137f
mov ecx, dword [rsp + 0x78]
shl ecx, 8
xor ecx, dword [rsp + 0x80]
shl ecx, 8
xor ecx, dword [rsp + 0x88]
shl ecx, 8
xor ecx, dword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x70], eax
cmp esi, 4
je 0x18002141b
mov rsi, qword [sym.ProxyProtocol.dll_resolvfunc]
test rsi, rsi
je 0x1800213e3
lea r8, [rsp + 0x70]
mov rdx, rbx
mov ecx, 2
call rsi
test eax, eax
je 0x1800213ae
mov eax, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
mov rcx, qword [0x180065a40]
test rcx, rcx
je 0x1800213bf
call fcn.180037010
lea r8, [rsp + 0x70]
mov rdx, rbx
mov ecx, 2
call rsi
test eax, eax
cmovne edi, dword [rsp + 0x70]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180021410
mov rcx, qword [0x180065a40]
test rcx, rcx
je 0x180021419
call fcn.180037010
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180021419
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180021430
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x50
mov ebp, 2
mov rsi, r8
mov word [r8], bp
mov rbx, rdx
xor ecx, ecx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], cl
jne 0x180021450
cmp rax, 0xff
jbe 0x180021466
mov byte [rdx + 0xff], cl
movzx eax, byte [rdx]
xor r8d, r8d
test al, al
je 0x180021491
cmp al, 0x2e
jne 0x18002147d
inc ecx
cmp ecx, 3
jg 0x180021491
jmp 0x180021483
sub al, 0x30
cmp al, 9
ja 0x180021491
movzx eax, byte [rdx + 1]
inc rdx
inc r8d
test al, al
jne 0x180021470
movsxd rax, r8d
mov qword [rsp + 0x70], rdi
cmp byte [rax + rbx], 0
jne 0x18002151c
cmp ecx, 3
jne 0x18002151c
lea rax, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x88]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x80]
lea rax, [rsp + 0x40]
lea rdx, str._u._u._u._u__u
mov qword [rsp + 0x20], rax
call sym.ProxyProtocol.dll_sscanf
mov edi, eax
cmp eax, 4
jl 0x18002151c
mov ecx, dword [rsp + 0x80]
shl ecx, 8
xor ecx, dword [rsp + 0x88]
shl ecx, 8
xor ecx, dword [rsp + 0x40]
shl ecx, 8
xor ecx, dword [rsp + 0x44]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x78], eax
mov ecx, eax
cmp edi, 4
je 0x1800215a0
mov rdi, qword [sym.ProxyProtocol.dll_resolvfunc]
test rdi, rdi
je 0x180021566
lea r8, [rsp + 0x78]
mov rdx, rbx
mov ecx, ebp
call rdi
test eax, eax
je 0x18002153e
mov ecx, dword [rsp + 0x78]
jmp 0x1800215a0
mov rcx, qword [0x180065a40]
test rcx, rcx
je 0x18002154f
call fcn.180037010
lea r8, [rsp + 0x78]
mov rdx, rbx
mov ecx, ebp
call rdi
xor ecx, ecx
test eax, eax
cmovne ecx, dword [rsp + 0x78]
jmp 0x1800215a0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180021597
mov rcx, qword [0x180065a40]
test rcx, rcx
je 0x180021593
call fcn.180037010
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180021597
xor ecx, ecx
jmp 0x1800215a0
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
mov rdi, qword [rsp + 0x70]
mov dword [rsi + 4], ecx
neg ecx
sbb eax, eax
and eax, ebp
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret
Function at 0x180021610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx r8d, word [sym.ProxyProtocol.dll_randomizer]
mov eax, edx
cdq
mov r10, rcx
sub eax, edx
xor edx, edx
sar eax, 1
mov r9d, edx
movsxd r11, eax
test eax, eax
jle 0x1800216af
cmp r11d, 0x10
jb 0x1800216af
mov ecx, r11d
xorps xmm1, xmm1
xorps xmm2, xmm2
and ecx, 0x8000000f
jge 0x180021650
dec ecx
or ecx, 0xfffffff0
inc ecx
mov eax, r11d
sub eax, ecx
movsxd rcx, eax
nop dword [rax + rax]
movdqu xmm0, xmmword [r10 + rdx*2]
add r9d, 0x10
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + rdx*2 + 0x10]
add rdx, 0x10
xorps xmm2, xmm0
cmp rdx, rcx
jl 0x180021660
xorps xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
xorps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
xorps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
xorps xmm2, xmm0
movd eax, xmm2
xor r8w, ax
movsxd rax, r9d
cmp rax, r11
jge 0x1800216cd
nop word [rax + rax]
xor r8w, word [r10 + rax*2]
inc rax
cmp rax, r11
jl 0x1800216c0
movzx ecx, r8w
call fcn.180036548
call fcn.18003651c
mov dword [sym.ProxyProtocol.dll_randomizer], eax
add rsp, 0x28
jmp fcn.18003651c
Function at 0x180026330
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1f8
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov ecx, 0x101
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [0x180067ce0]
mov dword [0x180067ce0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov rcx, qword [str.3proxy.cfg]
lea rax, sym.ProxyProtocol.dll_strings
mov qword [0x180065a48], rax
call fcn.180034620
lea rcx, [0x180068380]
mov qword [0x180065928], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180068340]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180068300]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1800682c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180068280]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180068240]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1800681c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, sym.ProxyProtocol.dll_conf
call sym.ProxyProtocol.dll_freeconf
call sym.ProxyProtocol.dll_readconfig
inc dword [0x180065984]
test eax, eax
jne 0x18002644b
cmp dword [sym.ProxyProtocol.dll_service], eax
je 0x180026446
mov rax, qword [0x180065a48]
mov rcx, qword [rax + 8]
lea rax, [sym.ProxyProtocol.dll_ServiceMain]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x18002644b
call sym.ProxyProtocol.dll_cyclestep
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.180027110
add rsp, 0x1f8
ret
Function at 0x18003543c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1800273e0
sub rsp, rax
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180039c9c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18003548b
mov rax, rbp
jmp 0x180035593
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x67310]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18003a944
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x67310]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18003558f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003558f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18003a944
test rax, rax
js 0x18003558f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18003558f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180035581
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180035581
cmp byte [rcx], 0xd
jne 0x180035567
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180035576
cmp byte [rcx + 1], 0xa
jne 0x180035576
inc rcx
jmp 0x180035576
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x65de0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180035549
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180035593
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180027110
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800378e4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x180055758]
mov rbp, rcx
call fcn.180042d88
xor edi, edi
test rax, rax
je 0x1800379ca
mov ebx, edi
call fcn.18003da9c
mov r14d, dword [rax]
call fcn.18003da9c
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.180042cd4
mov rsi, rax
test rax, rax
je 0x18003795b
call fcn.18003da9c
mov dword [rax], r14d
jmp 0x180037985
call fcn.18003da9c
cmp dword [rax], 0x22
jne 0x1800379c2
call fcn.18003da9c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.180042cd4
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1800379c2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x180037989
cmp rax, 3
je 0x1800379a4
mov rcx, rsi
call fcn.180037840
test al, al
je 0x1800379b5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1800379b5
mov dil, 1
mov rcx, rbx
call fcn.18002baa0
mov al, dil
jmp 0x1800379cc
mov rcx, rbx
call fcn.18002baa0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180027110
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180039df0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18003a94c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18003a94c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180039f40
cmp rax, 0xffffffffffffffff
je 0x180039f40
xor edi, edi
test rbp, rbp
jle 0x180039eeb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18003fbfc
mov rbx, rax
test rax, rax
jne 0x180039e78
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180039ee1
mov edx, 0x8000
mov ecx, r14d
call fcn.180046588
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18003cb0c
cmp eax, 0xffffffff
je 0x180039ec1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180039e88
mov edx, r15d
mov ecx, r14d
call fcn.180046588
jmp 0x180039ee1
cmp byte [rsi + 0x38], dil
je 0x180039ed8
cmp dword [rsi + 0x34], 5
jne 0x180039ed8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x180039ee1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18003cf08
jmp 0x180039f54
jns 0x180039f54
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18003a94c
cmp rax, 0xffffffffffffffff
jne 0x180039f0c
cmp byte [rsi + 0x30], dil
je 0x180039f54
mov edi, dword [rsi + 0x2c]
jmp 0x180039f54
mov ecx, r14d
call fcn.18004141c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180039f54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x180039f54
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180039f4d
mov eax, dword [rsi + 0x2c]
jmp 0x180039f52
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18003a94c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret