Function at 0x140036e60
Capabilities:
Read .ini file
Reference 114dns dns server
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xce48]
mov eax, 0xcf88
call fcn.140167760
sub rsp, rax
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rbp + 0xce30], rax
mov rax, qword [rbp + 0xceb0]
mov rdi, rcx
mov rbx, qword [rbp + 0xceb8]
xor r15d, r15d
mov qword [rbp - 0x38], rax
mov ecx, 0x148
mov rax, qword [rbp + 0xcec0]
mov rsi, r8
mov qword [rbp - 0x40], rax
mov r14, rdx
mov rax, qword [rbp + 0xcec8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0xced0]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0xced8]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0xcee0]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0xcee8]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0xcef0]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], r9
mov dword [rbp - 0x78], r15d
mov qword [rbp - 0x68], r15
call fcn.140167a7c
lea rdx, [rbp - 0x70]
lea rcx, [0x14020f769]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x70], rax
call fcn.140057060
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x104
call fcn.14016b7a0
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x104
call fcn.14016b7a0
xor edx, edx
lea rcx, [rbp + 0x520]
mov r8d, 0x104
call fcn.14016b7a0
xor edx, edx
lea rcx, [rbp + 0xf0]
mov r8d, 0x104
call fcn.14016b7a0
xorps xmm0, xmm0
mov qword [rbp + 0x60], r15
xorps xmm1, xmm1
mov qword [rbp + 0x68], reloc.WS2_32.dll_ntohs
mov eax, r15d
mov dword [rbp - 0x80], r15d
mov r8d, 0x104
mov qword [rbp - 0x60], rax
lea rdx, [rbp + 0x200]
mov qword [rbp + 0x50], rax
xor ecx, ecx
mov dword [rbp - 0x7c], r15d
movups xmmword [rbp + 0x90], xmm0
mov dword [rbp - 0x78], r15d
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm1
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [r15 + 0x5c]
lea rcx, [rbp + 0x200]
call fcn.14016c338
lea r8, [rbp + 0x200]
lea rdx, str._sinifile.ini
lea rcx, [rbp + 0xf0]
mov byte [rax], r15b
call fcn.1400031e0
lea r9, [rbp + 0xf0]
xor r8d, r8d
lea rdx, str.linetype
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r13d, 4
lea rdx, str.g_Type_is:_d
mov r8d, eax
mov dword [section..data], eax
mov ecx, r13d
mov r15d, eax
call fcn.14002f270
lea r12, [r13 - 5]
cmp r15d, r13d
jne 0x14003714e
lea r9, [rbp + 0xf0]
xor r8d, r8d
lea rdx, str.socksport
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbp + 0xf0]
xor r8d, r8d
lea rdx, str.httpport
mov dword [r14], eax
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbp + 0xf0]
xor r8d, r8d
lea rdx, str.code
mov dword [rsi], eax
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, eax
lea r9, [rbp + 0xf0]
xor r8d, r8d
mov qword [0x14020f6d8], rax
lea rdx, [0x1401ac87c]
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbp + 0xf0]
xor r8d, r8d
lea rdx, str.exeTime
mov dword [0x14020f6e0], eax
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbp + 0xf0]
xor r8d, r8d
lea rdx, str.fixed
mov dword [0x14020f6e4], eax
lea rcx, str.main
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, dword [rbp - 0x60]
mov dword [rbp - 0x78], eax
jmp 0x1400373bf
mov rax, qword [rbp - 0x50]
lea r9, [rbp + 0x90]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x48], rax
xor r15d, r15d
mov rax, qword [rbp - 0x48]
mov rdx, rbx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov dword [r14], r15d
mov dword [rsi], r15d
mov qword [rsp + 0x20], rax
mov dword [0x14020f6e0], 1
call fcn.140031280
movsxd rbx, eax
test eax, eax
je 0x1400382fb
mov r8, rbx
mov qword [0x14020f6d8], rbx
lea rdx, str.g_code_is:_d
mov ecx, r13d
call fcn.14002f270
lea r9, [rbp + 0x25]
test ebx, ebx
jns 0x140037210
neg ebx
nop
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x1400371e0
dec r9
mov byte [r9], 0x2d
jmp 0x140037236
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x140037210
lea rax, [rbp + 0x25]
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
cmp r9, rax
je 0x140037262
lea r8, [rbp + 0x25]
mov rdx, r9
sub r8, r9
lea rcx, [rbp - 0x10]
call fcn.1400090a0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x1400372a3
mov rcx, qword [0x140201680]
inc rdx
cmp rdx, 0x1000
jb 0x14003729e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038353
mov rcx, r8
call fcn.140167ab8
mov ebx, dword [rbp - 0x60]
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
lea ecx, [rbx + 0xa]
mov dword [0x14020e968], ecx
movups xmmword [0x140201680], xmm0
movups xmmword [0x140201690], xmm1
cmp ebx, 1
jne 0x1400372e9
mov dword [0x14020f6e4], 0x15180
mov dword [r14], 0xb221
mov dword [rsi], 0xb223
mov ecx, dword [0x14020e968]
jmp 0x140037300
mov eax, dword [0x14020f6e4]
cmp ebx, 2
mov edx, 0xfd20
cmove eax, edx
mov dword [0x14020f6e4], eax
mov rax, qword [rbp - 0x38]
mov r8, r12
mov dword [rax], ecx
mov eax, dword [reloc.WS2_32.dll_bind]
mov rcx, qword [rbp - 0x30]
mov dword [rcx], eax
mov eax, dword [0x14020f6e0]
mov rcx, qword [rbp - 0x28]
mov dword [rcx], eax
lea rax, [rbp + 0x90]
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140037330
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x90]
call fcn.14016bcc0
lea rax, [rbp + 0xb0]
mov r8, r12
inc r8
cmp byte [rax + r8], r15b
jne 0x140037353
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x50]
call fcn.1400090a0
cmp qword [rbp + 0x60], 7
jbe 0x140037381
lea rdx, str.default_line_type_is_TransitLine
mov eax, 2
jmp 0x14003738d
lea rdx, str.default_line_type_is_directLine
mov eax, 1
mov ecx, r13d
mov dword [section..data], eax
call fcn.14002f270
mov r8d, dword [section..data]
lea rdx, str.g_Type_is:_d
mov ecx, r13d
call fcn.14002f270
mov rax, qword [rbp + 0x50]
mov r15d, 1
mov qword [rbp - 0x60], rax
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rdx, [0x140201680]
mov r8, qword [0x140201690]
cmovae rdx, qword [0x140201680]
mov rcx, qword [rbp - 0x18]
call fcn.14016bcc0
mov eax, dword [r14]
test eax, eax
je 0x1400373f2
cmp dword [rsi], 0
jne 0x14003743a
xor ecx, ecx
call fcn.1401760a4
mov rcx, rax
call fcn.140176468
call fcn.14017643c
mov r9d, eax
mov eax, 0x68db8bad
imul r9d
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x9c40
sub r9d, ecx
lea eax, [r9 + 0x4e22]
lea ecx, [r9 + 0x4e20]
mov dword [r14], ecx
mov dword [rsi], eax
mov eax, dword [r14]
mov rcx, qword [rbp - 0x58]
lea rdx, [rbp + 0x200]
mov dword [0x14020f6e8], eax
mov r8d, 0x104
mov eax, dword [rsi]
mov dword [0x14020f6ec], eax
movsxd rax, dword [0x14020f6e4]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x200]
call fcn.14016c338
lea r8, [rbp + 0x200]
lea rcx, [rbp + 0x410]
mov byte [rax], 0
cmp r15d, 1
jne 0x1400374a8
lea r9, str.zhilian
lea rdx, str._s_s.cfg
call fcn.1400031e0
jmp 0x1400374b7
mov r9d, dword [rsi]
lea rdx, str._s_d.cfg
call fcn.1400031e0
lea r9, str.zhilian
lea r8, [rbp + 0x200]
lea rdx, str._s_s.cfg.bak
lea rcx, [rbp + 0x520]
call fcn.1400031e0
lea rax, [rbp + 0x410]
mov ecx, 2
nop dword [rax]
nop dword [rax + rax]
lea rdi, [rdi + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdi - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdi - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdi - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdi - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdi - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdi - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdi - 0x20], xmm0
movups xmmword [rdi - 0x10], xmm1
sub rcx, 1
jne 0x1400374f0
mov eax, dword [rax]
lea rcx, [rbp + 0x630]
xor edx, edx
mov dword [rdi], eax
mov r8d, 0xc800
call fcn.14016b7a0
cmp dword [rbp - 0x80], 0
je 0x1400381dd
mov r8d, ebx
lea rdx, str.linetype:_d
mov ecx, r13d
call fcn.14002f270
lea rdi, [0x140201640]
mov r15d, 0x20
cmp ebx, 1
jne 0x140037676
lea rax, [rbp + 0x90]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400375a0
lea rdx, [rbp + 0x90]
lea rcx, [0x1402015c0]
call fcn.1400090a0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rdx, str._s_newproxy.ini
mov r8, rdi
lea rcx, [rbp + 0x310]
cmovae r8, qword [0x140201640]
call fcn.1400031e0
lea rax, [rbp + 0x310]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x30]
lea r8, [0x1401d4b53]
mov dword [rsp + 0x20], r15d
lea rdx, str.publicip
lea rcx, str.network
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rbp + 0x70]
mov rax, r12
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140037620
test rax, rax
jne 0x1400376e8
lea rcx, [rbp + 0x30]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140037640
test rax, rax
je 0x1400376e8
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r9, [0x140201600]
lea r8, [rbp + 0x30]
cmovae r9, qword [0x140201600]
lea rdx, str.publicip
jmp 0x1400376db
cmp ebx, 2
jne 0x140037690
mov eax, dword [rbp - 0x7c]
add eax, 0x2710
mov dword [r14], eax
mov eax, dword [rbp - 0x80]
add eax, 0x2710
jmp 0x14003769e
cmp ebx, 3
jne 0x1400376e8
mov eax, dword [rbp - 0x7c]
mov dword [r14], eax
mov eax, dword [rbp - 0x80]
mov dword [rsi], eax
lea rdx, str._s_newproxy.ini
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [rbp + 0x310]
mov r8, rdi
cmovae r8, qword [0x140201640]
call fcn.1400031e0
lea rdx, str.localip
lea r8, [rbp + 0x90]
lea r9, [rbp + 0x310]
lea rcx, str.network
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [r14]
mov r8, r12
mov dword [0x14020f6e8], eax
mov eax, dword [rsi]
mov dword [0x14020f6ec], eax
lea rax, [rbp + 0x70]
inc r8
cmp byte [rax + r8], 0
jne 0x140037700
lea rdx, [rbp + 0x70]
lea rcx, [0x1402015e0]
call fcn.1400090a0
movzx eax, byte [0x1401aca38]
mov esi, reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.223.5.5.5]
mov byte [rbp + 0x78], al
mov eax, dword [0x1401aca48]
mov dword [rbp + 0x18], eax
movzx eax, word [0x1401aca4c]
mov word [rbp + 0x1c], ax
movzx eax, byte [0x1401aca4e]
movsd qword [rbp + 0x70], xmm0
movsd xmm0, qword [str.114.114.114.114]
mov byte [rbp + 0x1e], al
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x80], 9
mov byte [rbp + 0x79], 0
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x20], rsi
movsd qword [rbp + 0x10], xmm0
mov byte [rbp + 0x1f], 0
cmp ebx, 1
jne 0x140037a5f
xor eax, eax
mov qword [rbp + 8], rsi
mov qword [rbp - 0x10], rax
mov r8, r12
mov qword [rbp], rax
lea rax, [rbp + 0x90]
inc r8
cmp byte [rax + r8], 0
jne 0x1400377a4
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x10]
call fcn.1400090a0
mov rdi, qword [rbp - 0x70]
mov r13, qword [rbp + 8]
mov r14, rdi
mov rsi, qword [rbp]
mov r15, qword [rbp - 0x10]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x140037824
nop dword [rax + rax]
cmp r13, 0x10
lea rdx, [rbp - 0x10]
lea rcx, [rbx + 0x20]
cmovae rdx, r15
cmp qword [rbx + 0x38], 0x10
jb 0x1400377fb
mov rcx, qword [rbx + 0x20]
mov rdi, qword [rbx + 0x30]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call fcn.14016bbc0
test eax, eax
je 0x140037861
js 0x140037866
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400377e0
mov rdi, qword [rbp - 0x70]
cmp byte [r14 + 0x19], 0
jne 0x140037871
cmp qword [r14 + 0x38], 0x10
lea rdx, [r14 + 0x20]
jb 0x14003783a
mov rdx, qword [r14 + 0x20]
mov rbx, qword [r14 + 0x30]
lea rcx, [rbp - 0x10]
cmp r13, 0x10
mov r8, rsi
cmovae rcx, r15
cmp rbx, rsi
cmovb r8, rbx
call fcn.14016bbc0
test eax, eax
je 0x14003786c
js 0x140037871
jmp 0x140037874
cmp rdi, rsi
jae 0x140037814
mov rbx, qword [rbx + 0x10]
jmp 0x14003781a
cmp rsi, rbx
jae 0x140037874
mov r14, rdi
cmp r13, 0x10
jb 0x1400378ab
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400378a3
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038341
mov rcx, r15
call fcn.140167ab8
cmp r14, qword [rbp - 0x70]
je 0x140038069
lea r8, [r14 + 0x100]
lea rax, [rbp + 0x70]
cmp rax, r8
je 0x1400378df
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x1400378d2
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp + 0x70]
call fcn.1400090a0
cmp qword [r14 + 0x130], 0
jne 0x140037933
mov eax, dword [0x1401aca48]
lea rbx, [rbp - 0x10]
movsd xmm0, qword [str.114.114.114.114]
mov dword [rbp - 8], eax
movzx eax, word [0x1401aca4c]
mov word [rbp - 4], ax
movzx eax, byte [0x1401aca4e]
mov byte [rbp - 2], al
mov eax, 1
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov qword [rbp], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x10], xmm0
mov byte [rbp - 1], 0
jmp 0x140037954
lea rdx, [r14 + 0x120]
lea rcx, [rbp + 0x30]
call fcn.140002be0
mov rbx, rax
lea rax, [rbp + 0x10]
cmp rax, rbx
je 0x1400379be
mov eax, 2
mov rcx, qword [rbp + 0x28]
mov edi, eax
cmp rcx, 0x10
jb 0x140037992
lea rdx, [rcx + 1]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003798d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038359
call fcn.140167ab8
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov ebx, edi
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm1
test dil, 2
je 0x140037a12
jmp 0x1400379c3
mov ebx, 2
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1400379fe
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400379f9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038359
call fcn.140167ab8
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], 0
test bl, 1
je 0x140038069
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140038069
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037a55
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038359
call fcn.140167ab8
jmp 0x140038069
cmp ebx, 2
jne 0x140037ebc
mov r14, qword [rbp - 0x70]
mov r15, rsi
movsd xmm0, qword [str.172.2.2.1]
mov rdi, r14
movzx eax, byte [0x1401aca58]
mov qword [rbp + 8], rsi
mov rbx, qword [r14 + 8]
mov qword [rbp], 9
movsd qword [rbp - 0x10], xmm0
mov byte [rbp - 8], al
cmp byte [rbx + 0x19], 0
mov byte [rbp - 7], 0
jne 0x140037ae8
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x38], 0x10
lea r8, [rbp - 0x10]
lea rcx, [rbx + 0x20]
jb 0x140037ac3
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x30]
mov r9d, 9
call fcn.140030640
test eax, eax
jns 0x140037adc
mov rbx, qword [rbx + 0x10]
jmp 0x140037ae2
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140037ab0
cmp byte [rdi + 0x19], 0
jne 0x140037b13
cmp qword [rdi + 0x38], 0x10
lea r8, [rdi + 0x20]
jb 0x140037afd
mov r8, qword [rdi + 0x20]
mov r9, qword [rdi + 0x30]
lea rcx, [rbp - 0x10]
mov edx, 9
call fcn.140030640
test eax, eax
jns 0x140037b16
mov rdi, r14
cmp rdi, r14
je 0x140037c51
lea r8, [rdi + 0x100]
lea rax, [rbp + 0x70]
cmp rax, r8
je 0x140037b49
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x140037b3c
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp + 0x70]
call fcn.1400090a0
cmp qword [rdi + 0x130], 0
jne 0x140037b7a
xor edi, edi
mov qword [rbp + 8], rsi
mov r8, rsi
mov qword [rbp - 0x10], rdi
lea rdx, str.114.114.114.114
mov qword [rbp], rdi
lea rcx, [rbp - 0x10]
call fcn.1400090a0
lea rbx, [rbp - 0x10]
jmp 0x140037b9e
lea rdx, [rdi + 0x120]
lea rcx, [rbp + 0x30]
call fcn.140002be0
mov rbx, rax
mov r13d, 8
lea rax, [rbp + 0x10]
cmp rax, rbx
je 0x140037bfa
xor edi, edi
mov rcx, qword [rbp + 0x28]
cmp rcx, 0x10
jb 0x140037bda
lea rdx, [rcx + 1]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037bd5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003835f
call fcn.140167ab8
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rsi
mov byte [rbx], 0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm1
test r13b, 8
je 0x140037c03
lea rcx, [rbp + 0x30]
call fcn.140002b80
test r13b, 4
je 0x140037e80
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140037e80
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037c47
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003835f
call fcn.140167ab8
jmp 0x140037e80
xor eax, eax
mov qword [rbp + 8], rsi
lea rdx, str.172.2.2.0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
mov qword [rbp], rax
lea r8d, [rax + 9]
call fcn.1400090a0
mov r15, qword [rbp - 0x70]
mov r14, qword [rbp + 8]
mov rdi, r15
mov r13, qword [rbp]
mov rsi, qword [rbp - 0x10]
mov rbx, qword [r15 + 8]
cmp byte [rbx + 0x19], 0
jne 0x140037ccd
cmp r14, 0x10
lea r8, [rbp - 0x10]
lea rcx, [rbx + 0x20]
cmovae r8, rsi
cmp qword [rbx + 0x38], 0x10
jb 0x140037cab
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x30]
mov r9, r13
call fcn.140030640
test eax, eax
jns 0x140037cc1
mov rbx, qword [rbx + 0x10]
jmp 0x140037cc7
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140037c90
cmp byte [rdi + 0x19], 0
jne 0x140037cfe
cmp qword [rdi + 0x38], 0x10
lea r8, [rdi + 0x20]
jb 0x140037ce2
mov r8, qword [rdi + 0x20]
mov r9, qword [rdi + 0x30]
lea rcx, [rbp - 0x10]
cmp r14, 0x10
mov rdx, r13
cmovae rcx, rsi
call fcn.140030640
test eax, eax
jns 0x140037d01
mov rdi, r15
cmp r14, 0x10
jb 0x140037d3c
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140037d30
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038341
mov rcx, rsi
call fcn.140167ab8
mov r15, qword [rbp - 0x70]
cmp rdi, r15
je 0x140037e7a
lea r8, [rdi + 0x100]
lea rax, [rbp + 0x70]
cmp rax, r8
je 0x140037d6f
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x140037d62
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp + 0x70]
call fcn.1400090a0
cmp qword [rdi + 0x130], 0
jne 0x140037da9
xor esi, esi
lea rdx, str.114.114.114.114
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rsi
mov r8d, r15d
mov qword [rbp], rsi
lea rcx, [rbp - 0x10]
mov qword [rbp + 8], r15
call fcn.1400090a0
lea rbx, [rbp - 0x10]
lea edi, [rsi + 0x10]
jmp 0x140037dd0
lea rdx, [rdi + 0x120]
lea rcx, [rbp + 0x30]
call fcn.140002be0
mov rbx, rax
mov edi, 0x20
lea rax, [rbp + 0x10]
lea r15d, [rdi - 0x11]
cmp rax, rbx
je 0x140037e2c
xor esi, esi
mov rcx, qword [rbp + 0x28]
cmp rcx, 0x10
jb 0x140037e0c
lea rdx, [rcx + 1]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037e07
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038347
call fcn.140167ab8
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r15
mov byte [rbx], 0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm1
test dil, 0x20
je 0x140037e35
lea rcx, [rbp + 0x30]
call fcn.140002b80
test dil, 0x10
je 0x140037e80
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140037e80
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037c47
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038347
jmp 0x140037c47
mov r15d, reloc.WS2_32.dll_ntohs
cmp qword [rbp + 0x80], 0
jne 0x140038069
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.172.2.2.254
lea rcx, [rbp + 0x70]
call fcn.1400090a0
mov r8, r15
lea rdx, str.114.114.114.114
lea rcx, [rbp + 0x10]
call fcn.1400090a0
jmp 0x140038069
cmp ebx, 3
jne 0x140038069
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rdx, str._s_newproxy.ini
lea rcx, [rbp + 0x310]
cmovae rdi, qword [0x140201640]
mov r8, rdi
call fcn.1400031e0
lea rax, [rbp + 0x310]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x30]
lea r8, [0x1401d4b53]
mov dword [rsp + 0x20], r15d
lea rdx, str.publicip
lea rcx, str.network
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edi, edi
mov qword [rbp + 8], rsi
mov qword [rbp - 0x10], rdi
lea rax, [rbp + 0x30]
mov qword [rbp], rdi
mov r8, r12
inc r8
cmp byte [rax + r8], dil
jne 0x140037f30
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400090a0
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x70]
call fcn.140033600
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140037f92
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037f8d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038365
call fcn.140167ab8
mov rbx, qword [rbp - 0x58]
cmp rbx, qword [rbp - 0x70]
je 0x140038069
lea r8, [rbx + 0x100]
lea rax, [rbp + 0x70]
cmp rax, r8
je 0x140037fca
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x140037fbd
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp + 0x70]
call fcn.1400090a0
cmp qword [rbx + 0x130], rdi
jne 0x14003803e
mov r8, rsi
mov qword [rbp - 0x10], rdi
lea rdx, str.114.114.114.114
mov qword [rbp], rdi
lea rcx, [rbp - 0x10]
mov qword [rbp + 8], rsi
call fcn.1400090a0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.14000a570
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140038069
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037a55
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003834d
jmp 0x140037a55
lea rdx, [rbx + 0x120]
lea rcx, [rbp + 0xb0]
call fcn.140002be0
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14000a570
lea rcx, [rbp + 0xb0]
call fcn.140002b80
lea rdx, [0x1401aca7c]
lea rcx, [0x1401aca80]
lea rax, [0x1401a60c8]
mov qword [rsp + 0xb0], rax
lea r9, [rbp + 0x90]
lea rax, [rbp + 0x90]
mov qword [rsp + 0xa8], rax
lea r8, str.nscache_65536_r_ntimeouts_1_5_30_60_180_1800_15_60_15_5_r_nservice_r_nlog_E:_temp_3proxy.log_H_r_nlog_r_nlogformat____t_L_C_t_U_tUnknown_tY_t_Y__m__d_t_H:_M:_S_tw3proxy_t3PROXY_t__t_n_t_R_t_r_t_D_t_O_t_I_thttp_tTCP_t_1_1T_t_2_2T_t__t__t_E_t__t__t___r_nlogformat__L_Y__m__d__H:_M:_S_C:_P_a_f_T_Q:_r_A_s_F_j_J__r_narchiver_rar_rar_a__df__inul__A__F_r_nrotate_30_r_nmaxconn_5000_r_nusers_test1:CL:654321_zhou1:CL:654321_r_nbandlimin_20000000___r_nbandlimout_20000000___r_nconnlim_200_0___r_nauth_strong_r_ndnspr_r_nauth_iponly_strong_r_nallow__r_nproxy__n__p32803__i
mov qword [rsp + 0xa0], rdx
lea rax, [rbp + 0x90]
mov qword [rsp + 0x98], rax
mov eax, dword [rbp - 0x7c]
mov qword [rsp + 0x90], rcx
mov dword [rsp + 0x88], eax
lea rax, str._r_nsocks__p
mov qword [rsp + 0x80], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rax
mov eax, dword [rbp - 0x80]
mov qword [rsp + 0x60], rcx
lea rcx, [rbp + 0x630]
mov dword [rsp + 0x58], eax
lea rax, str._r_nflush_r_nauth_iponly_strong_r_nallow__127.0.0.1__r_nparent_1000_connect_101.91.127.136_45603_jz51daili_123456_r_nproxy__n__p
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
lea rax, str._r_nsocks__p9999__i
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rdx, str._s_s_s_s_s_s_s_s_s_d_s_s_s_s_s_d_s_s_s_s_s
call fcn.1400031e0
mov rcx, qword [rbp + 0x28]
cmp rcx, 0x10
jb 0x140038199
lea rdx, [rcx + 1]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038194
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038341
call fcn.140167ab8
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14003825a
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400381d6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038341
call fcn.140167ab8
jmp 0x14003825a
mov ecx, dword [r14]
lea rax, [0x1401a60c8]
mov edx, dword [rsi]
mov qword [rsp + 0x40], rax
lea rax, str._r_nsocks__p
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
cmp r15d, 1
jne 0x140038214
lea rax, str._r_nparent_1000_socks5_ipserver.ipjl123.com_1088_r_nproxy__n__p
lea r8, str.nserver_223.5.5.5_r_nnserver_223.6.6.6_r_nnscache_65536_r_ntimeouts_1_5_30_60_1_1800_15_60_r_nservice_r_nlog_E:_temp_3proxy.log_D_r_nlog_r_nlogformat____t_L_C_t_U_tUnknown_tY_t_Y__m__d_t_H:_M:_S_tw3proxy_t3PROXY_t__t_n_t_R_t_r_t_D_t_O_t_I_thttp_tTCP_t_1_1T_t_2_2T_t__t__t_E_t__t__t___r_nlogformat__L_Y__m__d__H:_M:_S__C:_g__n__R:_r___i:_f___r_narchiver_rar_rar_a__df__inul__A__F_r_nrotate_30_r_nusers_suzqun:CL:111111_zhou1:CL:654321_r_nbandlimin_21000000__r_nbandlimout_21000000__r_nauth_strong_r_ndnspr_r_nauth_iponly_strong_r_nallow__r_nproxy__n__p32803_r_nsocks__n__p32801_r_nflush_r_nauth_iponly_strong_r_nallow_
jmp 0x140038237
cmp r15d, r13d
jne 0x140038229
lea rax, str._r_nparent_1000_http_127.0.0.1_28801_love8_111111_r_nproxy__n__p
lea r8, str.nserver_223.5.5.5_r_nnserver_223.6.6.6_r_nnscache_65536_r_ntimeouts_1_3_3_3_1_1800_15_3_r_nservice_r_nlog_E:_temp_3proxy.log_D_r_nlog_r_nlogformat____t_L_C_t_U_tUnknown_tY_t_Y__m__d_t_H:_M:_S_tw3proxy_t3PROXY_t__t_n_t_R_t_r_t_D_t_O_t_I_thttp_tTCP_t_1_1T_t_2_2T_t__t__t_E_t__t__t___r_nlogformat__L_Y__m__d__H:_M:_S__C:_g__n__R:_r___i:_f___r_narchiver_rar_rar_a__df__inul__A__F_r_nrotate_30_r_nusers_test1:CL:654321_zhou1:CL:654321_r_nbandlimin_21000000__r_nbandlimout_21000000__r_nauth_strong_r_ndnspr_r_nauth_iponly_strong_r_nallow_
jmp 0x140038237
lea rax, str._r_nparent_1000_socks5_ipserver.ipjl123.com_1088_love8_111111_r_nproxy__n__p
lea r8, str.nserver_223.5.5.5_r_nnserver_223.6.6.6_r_nnscache_65536_r_ntimeouts_1_5_5_5_1_1800_15_60_r_nservice_r_nlog_E:_temp_3proxy.log_D_r_nlog_r_nlogformat____t_L_C_t_U_tUnknown_tY_t_Y__m__d_t_H:_M:_S_tw3proxy_t3PROXY_t__t_n_t_R_t_r_t_D_t_O_t_I_thttp_tTCP_t_1_1T_t_2_2T_t__t__t_E_t__t__t___r_nlogformat__L_Y__m__d__H:_M:_S__C:_g__n__R:_r___i:_f___r_narchiver_rar_rar_a__df__inul__A__F_r_nrotate_30_r_nusers_test1:CL:654321_zhou1:CL:654321_r_nbandlimin_21000000__r_nbandlimout_21000000__r_nauth_strong_r_ndnspr_r_nauth_iponly_strong_r_nallow__r_nproxy__n__p32803_r_nsocks__n__p32801_r_nflush_r_nauth_iponly_strong_r_nallow_
mov dword [rsp + 0x28], edx
lea r9, str.127.0.0.1_
lea rdx, str._s_s_s_d_s_d_s
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x630]
call fcn.1400031e0
cmp dword [rbp - 0x78], 0
jne 0x1400382ab
lea rdx, [0x1401ac880]
lea rcx, [rbp + 0x410]
call fcn.140171448
mov rbx, rax
test rax, rax
je 0x1400382ab
lea rax, [rbp + 0x630]
inc r12
cmp byte [rax + r12], 0
jne 0x140038282
mov r8, r12
lea rcx, [rbp + 0x630]
mov r9, rbx
mov edx, 1
call fcn.14017dfe8
mov rcx, rbx
call fcn.140170fcc
mov r8d, 0x8023
lea rdx, [rbp + 0x90]
lea rcx, vtable.HttpServer.0
call fcn.140067e20
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x1400382fb
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400382f6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038341
call fcn.140167ab8
mov r8, qword [rbp - 0x70]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x70]
mov r8, qword [r8 + 8]
call fcn.1400304f0
mov rcx, qword [rbp - 0x70]
mov edx, 0x148
call fcn.140167ab8
mov rcx, qword [rbp + 0xce30]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0xcf88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3
call fcn.14017d6e4
int3