joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b960
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18000b988
xor eax, eax
lea r8, [0x180004ce0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000be30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x18000bec8
test r8, r8
jle 0x18000bec0
nop word [rax + rax]
mov rcx, rdi
call fcn.18000e9d0
test rax, rax
jle 0x18000be9e
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.18002b070
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x18000beb8
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000bec0
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x18000be60
sub r14, rbx
mov rax, r14
jmp 0x18000bf46
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x18000bee1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18000bee3
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x18000bf3b
test ecx, ecx
jle 0x18000bf1c
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.18002b070
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x18000bf3b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18000bf3b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.18003bcdc
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18000bf60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18000bf82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18000bffc
mov rdi, r14
mov rcx, rbx
call fcn.18000e9f0
test rax, rax
jle 0x18000bfd4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.18002b070
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000bfec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18000bff4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18000bf96
sub r14, rdi
jmp 0x18000c0df
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18000c013
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000c015
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000c047
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18002b070
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000c0dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000c082
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18000c0bd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18003bfc0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18000c0dc
cmp rbp, rax
ja 0x18000c090
test rbp, rbp
je 0x18000c0dc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18003bfc0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x18000c500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800801d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000c52d
xor eax, eax
jmp 0x18000c673
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000c567
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18000c567
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18000c673
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18000c666
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000c5aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000c5b9
movsx ecx, dil
jmp 0x18000c60d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x18000c627
sub eax, 1
je 0x18000c627
cmp eax, 2
jne 0x18000c666
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.18003a8f0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000c66b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18000c654
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.18003bcdc
cmp rsi, rax
jne 0x18000c666
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18000c66b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180028cf0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180022850
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1800229a4
cmp r9, 4
jb 0x18002289a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x180022880
xor r11d, r11d
test r9, r9
je 0x1800229a4
cmp r9, 0x40
jb 0x180022983
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1800228cc
cmp rdx, r8
jae 0x180022983
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1800228e1
cmp rdx, r10
jae 0x180022983
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, r9
and rsi, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x180022910
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r11, r9
jae 0x1800229a4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180022990
add rsp, 8
ret
Function at 0x180001a00
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x67452301
xor ebx, ebx
mov dword [rsp + 0x24], 0xefcdab89
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call sym.ProxyProtocol.dll_MD4Update
mov r8d, ebx
lea rdx, [rsp + 0x82]
lea r9d, [rbx + 2]
mov eax, r8d
lea rdx, [rdx + 4]
inc r8d
lea rcx, [rax*4]
movzx eax, byte [rsp + rcx + 0x30]
mov byte [rdx - 6], al
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rdx - 5], al
movzx eax, byte [rsp + rcx + 0x32]
mov byte [rdx - 4], al
movzx eax, byte [rsp + rcx + 0x33]
mov byte [rdx - 3], al
sub r9, 1
jne 0x180001a62
mov ecx, dword [rsp + 0x30]
lea rdx, section..data
shr ecx, 3
mov eax, 0x78
and ecx, 0x3f
mov r8d, gethostname
sub eax, ecx
sub r8d, ecx
cmp ecx, 0x38
lea rcx, [rsp + 0x20]
cmovae r8d, eax
call sym.ProxyProtocol.dll_MD4Update
mov r8d, 8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call sym.ProxyProtocol.dll_MD4Update
lea rax, [rdi + 2]
mov r8d, 4
nop
lea rdx, [rbx*4]
movzx ecx, byte [rsp + rdx + 0x20]
lea ebx, [rbx + 1]
mov byte [rax - 2], cl
lea rax, [rax + 4]
movzx ecx, byte [rsp + rdx + 0x21]
mov byte [rax - 5], cl
movzx ecx, byte [rsp + rdx + 0x22]
mov byte [rax - 4], cl
movzx ecx, byte [rsp + rdx + 0x23]
mov byte [rax - 3], cl
sub r8, 1
jne 0x180001af0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180027290
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x180002650
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x67452301
xor ebx, ebx
mov dword [rsp + 0x24], 0xefcdab89
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call sym.ProxyProtocol.dll_librad_MD5Update
mov r8d, ebx
lea rdx, [rsp + 0x82]
lea r9d, [rbx + 2]
mov eax, r8d
lea rdx, [rdx + 4]
inc r8d
lea rcx, [rax*4]
movzx eax, byte [rsp + rcx + 0x30]
mov byte [rdx - 6], al
movzx eax, byte [rsp + rcx + 0x31]
mov byte [rdx - 5], al
movzx eax, byte [rsp + rcx + 0x32]
mov byte [rdx - 4], al
movzx eax, byte [rsp + rcx + 0x33]
mov byte [rdx - 3], al
sub r9, 1
jne 0x1800026b2
mov ecx, dword [rsp + 0x30]
lea rdx, [0x18004e4f0]
shr ecx, 3
mov eax, 0x78
and ecx, 0x3f
mov r8d, gethostname
sub eax, ecx
sub r8d, ecx
cmp ecx, 0x38
lea rcx, [rsp + 0x20]
cmovae r8d, eax
call sym.ProxyProtocol.dll_librad_MD5Update
mov r8d, 8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call sym.ProxyProtocol.dll_librad_MD5Update
lea rax, [rdi + 2]
mov r8d, 4
nop
lea rdx, [rbx*4]
movzx ecx, byte [rsp + rdx + 0x20]
lea ebx, [rbx + 1]
mov byte [rax - 2], cl
lea rax, [rax + 4]
movzx ecx, byte [rsp + rdx + 0x21]
mov byte [rax - 5], cl
movzx ecx, byte [rsp + rdx + 0x22]
mov byte [rax - 4], cl
movzx ecx, byte [rsp + rdx + 0x23]
mov byte [rax - 3], cl
sub r8, 1
jne 0x180002740
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180027290
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x180011a80
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.18004c7e0
movabs rax, 0x5053534d4c544e
mov byte [rsp + 0xa8], 2
mov edx, 0x80
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x180011b00
lea ebp, [rax + rax]
mov byte [rsp + 0xb0], gethostbyname
movzx eax, byte [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0xac], bpl
xor ebx, ebx
mov byte [rsp + 0xae], bpl
mov dword [rsp + 0xb4], 0xa0818203
nop dword [rax]
movsx ecx, al
call fcn.18002c428
mov byte [rsp + rbx + 0xd0], al
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
mov byte [rsp + rbx + 0xd1], 0
add rbx, 2
test al, al
je 0x180011b6c
cmp rbx, 0x40
jl 0x180011b40
mov rcx, rsi
call fcn.18003661c
mov eax, dword [r14 + 0x18c]
mov edx, 8
mov dword [rsi + 4], eax
mov rcx, rsi
movzx eax, byte [r14 + 0x18a]
xor byte [rsi + 1], al
call sym.ProxyProtocol.dll_myrand
xor byte [rsi], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 1], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 2], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 3], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 4], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 5], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 6], al
mov edx, 8
mov rcx, rsi
call sym.ProxyProtocol.dll_myrand
xor byte [rsi + 7], al
lea r8d, [rbp + 0x30]
mov rax, qword [rsi]
lea rcx, [rsp + 0xa0]
mov rdx, r15
mov qword [rsp + 0xb8], rax
call sym.ProxyProtocol.dll_en64
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.180027290
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180016610
Capabilities:
Encode data using base64

Disassembly:
test r8d, r8d
jle 0x1800166cf
lea r9, [rcx + 2]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 - 2]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [rdx], al
cmp r8d, 1
jbe 0x180016650
movzx eax, byte [r9 - 1]
shr eax, 4
jmp 0x180016652
xor eax, eax
movzx ecx, byte [r9 - 2]
and ecx, 3
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [rdx + 1], al
cmp r8d, 1
jbe 0x1800166af
cmp r8d, 2
jbe 0x18001667e
movzx eax, byte [r9]
shr eax, 6
jmp 0x180016680
xor eax, eax
movzx ecx, byte [r9 - 1]
and ecx, 0xf
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [rdx + 2], al
add rdx, 3
cmp r8d, 2
jbe 0x1800166b7
movzx eax, byte [r9]
and eax, 0x3f
movzx ecx, byte [rax + r11]
jmp 0x1800166b9
mov byte [rdx + 2], 0x3d
add rdx, 3
mov cl, 0x3d
mov byte [rdx], cl
sub r8d, 3
inc rdx
add r9, 3
test r8d, r8d
jg 0x180016630
mov rax, rdx
mov byte [rdx], 0
ret
Function at 0x18001c0f0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
sub rsp, 0x38
mov eax, 1
mov esi, edx
mov rbp, rcx
cmp edx, eax
jl 0x18001c182
mov qword [rsp + 0x50], rbx
mov ebx, eax
mov qword [rsp + 0x60], rdi
lea rdi, sym.ProxyProtocol.dll_sockopts
mov qword [rsp + 0x30], r14
mov r14d, 0xfffb
mov dword [rsp + 0x58], 1
test esi, eax
je 0x18001c167
mov rax, qword [rdi + 8]
movzx ecx, byte [rax]
cmp cl, 0x54
jne 0x18001c142
mov edx, 6
jmp 0x18001c14e
cmp cl, 0x49
mov edx, 0xffff
cmove edx, r14d
mov r8d, dword [rdi]
lea r9, [rsp + 0x58]
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
rol ebx, 1
add rdi, 0x10
mov eax, ebx
cmp esi, ebx
jge 0x18001c123
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x18001c580
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rcx + 0x10]
mov rbx, rcx
mov rax, qword [rsi + 0x40]
cmp rax, 0xffffffffffffffff
je 0x18001c6f7
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x300
mov esi, dword [rsi + 0x4c]
sar esi, 0xa
add esi, 5
je 0x18001c734
lea rdi, [rcx + 0xdc]
nop dword [rax]
nop word [rax + rax]
mov edx, 1
lea rcx, [rsp + 0x38]
mov r8d, 0x2328
call qword [sym.ProxyProtocol.dll_mypoll]
cmp eax, 1
jne 0x18001c725
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x1a8]
mov rcx, qword [rcx + 0x40]
call qword [0x180065838]
mov qword [rbx + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x18001c64e
lea rdx, str.Connect_back_accept___failed
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
lea rdi, [rbx + 0xdc]
jmp 0x18001c6e8
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movups xmm0, xmmword [rbx + 0x1a8]
mov rax, qword [rbx + 0x10]
movups xmmword [rbx + 0x1b8], xmm0
cmp qword [rax + 0x140], 0
je 0x18001c68f
mov rcx, rbx
call sym.ProxyProtocol.dll_checkACL
mov dword [rdi], eax
cmp dword [rdi], 0
je 0x18001c69d
lea rdx, str.Connect_back_ACL_failed
jmp 0x18001c6ce
mov rcx, qword [rbx + 0x78]
lea r8, [0x18004fd4c]
mov r9d, 1
mov dword [rsp + 0x20], 0x2328
lea rdx, [rbx + 0x1a8]
call sym.ProxyProtocol.dll_socksendto
cmp eax, 1
je 0x18001c6f3
lea rdx, str.Connect_back_sending_command_failed
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
mov rcx, qword [rbx + 0x78]
call qword [0x1800658a8]
mov qword [rbx + 0x78], 0xffffffffffffffff
sub esi, 1
jne 0x18001c5f0
jmp 0x18001c734
test esi, esi
je 0x18001c734
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180027290
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rdx, str.Connect_back_not_received__check_connback_client
mov rcx, rbx
call sym.ProxyProtocol.dll_dolog
mov rcx, rbx
mov dword [rbx + reloc.WS2_32.dll_listenc], 0xd
call sym.ProxyProtocol.dll_freeparam
jmp 0x18001c701
Function at 0x180020340
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov edx, dword [0x180065958]
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
add edx, 0x4000
mov dword [rsp + 0x20], 0
lea r8, [sym.ProxyProtocol.dll_startsrv]
mov dword [0x18006595c], 1
xor ecx, ecx
call fcn.180036e04
test rax, rax
je 0x18002038b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x18006595c], 0
je 0x1800203a8
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x18006595c], 0
jne 0x180020394
mov eax, dword [sym.ProxyProtocol.dll_haveerror]
test eax, eax
je 0x1800203fe
lea rcx, str.:_insufficient_memory
mov qword [rsp + 0x30], rbx
cmp eax, 2
lea rbx, [0x18004e577]
cmove rbx, rcx
mov ecx, 2
call fcn.1800367f0
mov r8d, dword [sym.ProxyProtocol.dll_linenum]
lea rdx, str.Service_not_started_on_line:__d_s_n
mov rcx, rax
mov r9, rbx
call sym.ProxyProtocol.dll_fprintf
mov rbx, qword [rsp + 0x30]
mov eax, 0x28
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x180020db0
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x180065c40]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r12d, edx
mov eax, 0x10624dd3
imul r8d
mov qword [rsp + 0x6d8], r13
mov r15, rcx
xor r13d, r13d
sar edx, 6
mov eax, edx
mov qword [rsp + 0x40], rcx
shr eax, 0x1f
mov edi, r13d
add edx, eax
mov dword [rsp + 0x50], r13d
imul eax, edx, 0x3e8
mov r9d, r13d
mov dword [rsp + 0x38], edx
mov esi, r12d
mov edx, r13d
mov dword [rbp + 0x160], r13d
mov dword [rbp + 0x370], edx
mov r14d, 0x400
sub r8d, eax
imul eax, r8d, 0x3e8
mov r8d, r13d
mov dword [rsp + 0x3c], eax
test r12d, r12d
je 0x180020f5b
mov r10, rcx
mov r14d, r12d
mov r15d, 0x300
nop word [rax + rax]
movzx ebx, word [r10 + 8]
test r15w, bx
je 0x180020ea4
mov ecx, r13d
test r8d, r8d
je 0x180020e84
mov r11, qword [r10]
cmp qword [rsp + rcx*8 + 0x58], r11
je 0x180020e84
inc ecx
cmp ecx, r8d
jb 0x180020e76
cmp ecx, r8d
jne 0x180020ea4
cmp r8d, 0x40
jae 0x180020ea4
mov rax, qword [r10]
mov qword [rsp + rcx*8 + 0x58], rax
mov r8d, dword [rsp + 0x50]
inc r8d
mov dword [rsp + 0x50], r8d
test bl, 0x10
je 0x180020eec
mov ecx, r13d
test r9d, r9d
je 0x180020ec5
mov r11, qword [r10]
cmp qword [rbp + rcx*8 + 0x168], r11
je 0x180020ec5
inc ecx
cmp ecx, r9d
jb 0x180020eb4
cmp ecx, r9d
jne 0x180020eec
cmp r9d, 0x40
jae 0x180020eec
mov rax, qword [r10]
mov qword [rbp + rcx*8 + 0x168], rax
mov r9d, dword [rbp + 0x160]
inc r9d
mov dword [rbp + 0x160], r9d
bt bx, 0xa
jae 0x180020f36
mov eax, r13d
test edx, edx
je 0x180020f12
mov r11, qword [r10]
nop dword [rax]
mov ecx, eax
cmp qword [rbp + rcx*8 + 0x378], r11
je 0x180020f12
inc eax
cmp eax, edx
jb 0x180020f00
cmp eax, edx
jne 0x180020f36
cmp edx, 0x40
jae 0x180020f36
mov ecx, eax
mov rax, qword [r10]
mov qword [rbp + rcx*8 + 0x378], rax
mov edx, dword [rbp + 0x370]
inc edx
mov dword [rbp + 0x370], edx
cmp qword [r10], rdi
mov word [r10 + 0xa], r13w
cmova rdi, qword [r10]
add r10, 0x10
sub r14, 1
jne 0x180020e60
mov r15, qword [rsp + 0x40]
mov r14d, 0x400
lea rax, [rsp + 0x38]
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x370]
lea r8, [rbp + 0x160]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_select]
mov r13, qword [rsp + 0x6d8]
mov edi, eax
cmp eax, 1
jl 0x180020ff2
test r12d, r12d
je 0x180020ff2
lea rbx, [r15 + 0xa]
mov r15d, 0x300
nop
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x50]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020fb6
or word [rbx], r15w
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x160]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020fce
or word [rbx], 0x10
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x370]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180020fe6
or word [rbx], r14w
add rbx, 0x10
sub rsi, 1
jne 0x180020fa0
mov eax, edi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.180027290
add rsp, 0x690
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret