joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f350
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x40], rax
lea rdx, [rcx + 0x18]
lea rcx, [rsp + 0x48]
call fcn.14004fc50
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov rax, qword [rbx + 0x78]
test rax, rax
je 0x14005f39f
lock inc dword [rax + 8]
mov rax, qword [rbx + 0x70]
mov qword [rsp + 0xa0], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0xa8], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xb0], xmm0
mov rsi, qword [rbx]
lea rdi, [rbx + 8]
mov rbx, qword [rdi]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005f3f2
nop dword [rax]
cmp qword [rax], rbx
je 0x14005f4d5
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14005f3e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov ecx, 0xc0
call fcn.14001dd90
mov rbx, rax
mov qword [rax + 0x20], rbp
lea rax, [0x140061ea0]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x38], rax
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x48]
call fcn.1400383e0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rbx + 0xa8], xmm0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140022420
nop
lea rcx, [rsp + 0x28]
call fcn.140061e00
nop
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x14005f4b2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14005f4b2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14005f4b2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, [rsp + 0x48]
call fcn.14002d7e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rax + 8], 0
je 0x14005f3f2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14005bc00
nop
jmp 0x14005f479
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rcx, 0x70
lea rdx, [rcx + 0x80]
add rsp, 0x28
jmp 0x14005f350
Function at 0x14005fe70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x190
mov rdi, rdx
mov rbx, rcx
add rdx, 0x60
lea rcx, [rsp + 0x40]
call fcn.140055dd0
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.14005e980
movups xmm0, xmmword [rbx + 0xc0]
movaps xmmword [rsp + 0x160], xmm0
mov rax, qword [rbx + 0xd0]
mov qword [rsp + 0x170], rax
mov rsi, qword [rdi + 0x50]
mov rbx, qword [rdi + 0x58]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005fef2
nop word [rax + rax]
cmp qword [rax], rbx
je 0x14005ff86
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14005fee0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x100]
mov ecx, 0x178
call fcn.14001dd90
mov rbx, rax
xor ebp, ebp
mov qword [rax + 0x20], rbp
lea rax, [0x140062fe0]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
lea rcx, [rbx + 0x38]
lea rdx, [rsp + 0x40]
call fcn.140063180
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov r8, rbx
lea rdx, [rdi + 0x58]
mov rcx, rsi
call fcn.140022420
nop
lea rcx, [rsp + 0xa0]
call fcn.140055d60
lea rcx, [rsp + 0x48]
call fcn.14002d7e0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
cmp qword [rax + 8], 0
je 0x14005fef2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140063770
nop
jmp 0x14005ff5c
Function at 0x140060d80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x1b0
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x40], rax
add rdx, 0x18
lea rcx, [rsp + 0x48]
call fcn.14004fc50
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov rax, qword [rdi + 0x78]
test rax, rax
je 0x140060dcb
lock inc dword [rax + 8]
mov rax, qword [rdi + 0x70]
mov qword [rsp + 0xa0], rax
mov rax, qword [rdi + 0x78]
mov qword [rsp + 0xa8], rax
mov rax, qword [rdi + 0x80]
mov qword [rsp + 0xb0], rax
mov rdx, rsi
lea rcx, [rsp + 0xb8]
call fcn.140056350
movups xmm0, xmmword [rsi + 0xd0]
movups xmmword [rsp + 0x188], xmm0
mov rbp, qword [rdi]
lea rsi, [rdi + 8]
mov rbx, qword [rsi]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140060e42
nop dword [rax]
cmp qword [rax], rbx
je 0x140060f50
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140060e30
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x110]
mov ecx, 0x198
call fcn.14001dd90
mov rdi, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [0x140062520]
mov qword [rdi + 0x28], rax
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
mov dword [rdi + 0x30], r14d
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x38], rax
lea rdx, [rsp + 0x48]
lea rcx, [rdi + 0x40]
call fcn.1400383e0
mov rax, qword [rsp + 0xb0]
mov qword [rdi + 0xa8], rax
lea rdx, [rsp + 0xb8]
lea rcx, [rdi + 0xb0]
call fcn.140056350
movups xmm0, xmmword [rsp + 0x188]
movups xmmword [rdi + 0x180], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140022420
nop
lea rcx, [rsp + 0xb8]
call fcn.140044220
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x140060f2e
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140060f2e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140060f2e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, [rsp + 0x48]
call fcn.14002d7e0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
cmp qword [rax + 8], 0
je 0x140060e42
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140063210
nop
jmp 0x140060ee8
Function at 0x1400613d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x60]
mov qword [rsp + 0x40], rax
add rdx, 0x68
lea rcx, [rsp + 0x48]
call fcn.14004fce0
mov rdx, rbx
lea rcx, [rsp + 0xa8]
call fcn.140060c20
movups xmm0, xmmword [rbx + 0xc8]
movaps xmmword [rsp + 0x170], xmm0
mov rax, qword [rbx + 0xd8]
mov qword [rsp + 0x180], rax
mov rsi, qword [rdi + 0x50]
mov rbx, qword [rdi + 0x58]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140061451
cmp qword [rax], rbx
je 0x140061475
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140061443
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x108]
cmp byte [rbx + 0x400], 0
jne 0x14006148e
mov byte [rbx + 0x400], 1
jmp 0x14006149b
cmp qword [rax + 8], 0
je 0x140061451
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400637b0
nop
jmp 0x1400614f1
mov ecx, 0x188
call fcn.1400a0f60
mov rbx, rax
xor ebp, ebp
mov qword [rbx + 0x20], rbp
lea rax, [0x1400634c0]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
lea rcx, [rbx + 0x38]
lea rdx, [rsp + 0x40]
call fcn.140063690
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov r8, rbx
lea rdx, [rdi + 0x58]
mov rcx, rsi
call fcn.140022420
nop
lea rcx, [rsp + 0x20]
call fcn.140063440
nop
lea rcx, [rsp + 0xa8]
call fcn.14005bf70
lea rcx, [rsp + 0x50]
call fcn.14002d7e0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140061520
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x180
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x40]
mov qword [rsp + 0x40], rax
add rdx, 0x48
lea rcx, [rsp + 0x48]
call fcn.14004fce0
mov rdx, rbx
lea rcx, [rsp + 0xa8]
call fcn.140061d80
nop
mov rbp, qword [rdi + 0x30]
lea rsi, [rdi + 0x38]
mov rbx, qword [rsi]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006158e
nop
cmp qword [rax], rbx
je 0x1400615b2
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140061580
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0xe8]
cmp byte [rdi + 0x400], 0
jne 0x1400615cb
mov byte [rdi + 0x400], 1
jmp 0x1400615d8
cmp qword [rax + 8], 0
je 0x14006158e
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400637f0
nop
jmp 0x140061643
mov ecx, 0x168
call fcn.1400a0f60
mov rdi, rax
xor r14d, r14d
mov qword [rdi + 0x20], r14
lea rax, [0x1400632f0]
mov qword [rdi + 0x28], rax
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
mov dword [rdi + 0x30], r14d
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x38]
call fcn.140050ac0
lea rcx, [rdi + 0xa0]
lea rdx, [rsp + 0xa8]
call fcn.140061d80
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140022420
nop
lea rcx, [rsp + 0x20]
call fcn.140063270
nop
lea rcx, [rsp + 0xf8]
call fcn.14002d7e0
lea rcx, [rsp + 0x50]
call fcn.14002d7e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140061920
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140061947
add rcx, 8
call fcn.14004fb50
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140061993
mov ecx, dword [0x140119f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140061983
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140061983
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14006199e
inc ecx
inc rax
cmp rax, 6
jl 0x140061971
mov rcx, rbx
call fcn.14007dc1c
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xd8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140061a90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140061ab7
add rcx, 8
call fcn.140055d60
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140061b03
mov ecx, dword [0x140119f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140061af3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140061af3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140061b0e
inc ecx
inc rax
cmp rax, 6
jl 0x140061ae1
mov rcx, rbx
call fcn.14007dc1c
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xe8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140061b40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x40], rax
lea rdx, [rcx + 0x18]
lea rcx, [rsp + 0x48]
call fcn.14004fc50
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov rax, qword [rbx + 0x78]
test rax, rax
je 0x14005f39f
lock inc dword [rax + 8]
mov rax, qword [rbx + 0x70]
mov qword [rsp + 0xa0], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0xa8], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xb0], xmm0
mov rsi, qword [rbx]
lea rdi, [rbx + 8]
mov rbx, qword [rdi]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005f3f2
nop dword [rax]
cmp qword [rax], rbx
je 0x14005f4d5
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14005f3e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov ecx, 0xc0
call fcn.14001dd90
mov rbx, rax
mov qword [rax + 0x20], rbp
lea rax, [0x140061ea0]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x38], rax
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x48]
call fcn.1400383e0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rbx + 0xa8], xmm0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140022420
nop
lea rcx, [rsp + 0x28]
call fcn.140061e00
nop
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x14005f4b2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14005f4b2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14005f4b2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, [rsp + 0x48]
call fcn.14002d7e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rax + 8], 0
je 0x14005f3f2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14005bc00
nop
jmp 0x14005f479
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rcx, 0x70
lea rdx, [rcx + 0x80]
add rsp, 0x28
jmp 0x14005f350
Function at 0x140061b70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor ebp, ebp
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14005c640
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rbp
mov rax, qword [rdi + 8]
test rax, rax
je 0x14005f1e0
lock inc dword [rax + 8]
mov rax, qword [rdi]
mov qword [rsp + 0xc8], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0xd0], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0xd8], rax
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005f232
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x14005f323
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14005f220
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov ecx, 0xe0
call fcn.14001dd90
mov rbx, rax
mov qword [rax + 0x20], rbp
lea rax, [0x140062070]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
lea rcx, [rbx + 0x38]
lea rdx, [rsp + 0x40]
call fcn.14005d190
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov r8, rbx
lea rdx, [rsi + 8]
mov rcx, rdi
call fcn.140022420
nop
mov edi, 0xffffffff
mov rbx, qword [rsp + 0xd0]
test rbx, rbx
je 0x14005f2d2
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14005f2d2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005f2d2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x14005f306
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14005f306
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14005f306
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, [rsp + 0x48]
call fcn.14002d7e0
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
cmp qword [rax + 8], 0
je 0x14005f232
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14005be80
nop
jmp 0x14005f297
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rcx, 0x78
lea r8, [rcx + 0x98]
lea rdx, [rcx + 0x88]
add rsp, 0x28
jmp 0x14005f190
Function at 0x1400626b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400626d7
add rcx, 0x58
call fcn.14002d7e0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140062723
mov ecx, dword [0x140119f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140062713
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140062713
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14006272e
inc ecx
inc rax
cmp rax, 6
jl 0x140062701
mov rcx, rbx
call fcn.14007dc1c
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xd0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140062760
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140062787
add rcx, 8
call fcn.14005bf70
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400627d3
mov ecx, dword [0x140119f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400627c3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400627c3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400627de
inc ecx
inc rax
cmp rax, 6
jl 0x1400627b1
mov rcx, rbx
call fcn.14007dc1c
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xf0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140062810
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea rbx, [rcx + 0x50]
mov rbp, qword [rcx + 0x40]
lea rsi, [rcx + 0x48]
mov rdi, qword [rsi]
mov ecx, dword [0x140119f58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006285e
nop dword [rax]
cmp qword [rax], rdi
je 0x1400628d2
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140062850
mov qword [rsp + 0x20], rbx
mov rdx, rbx
mov ecx, 0x80
call fcn.14001dd90
mov rdi, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [0x14005a090]
mov qword [rdi + 0x28], rax
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
mov dword [rdi + 0x30], r14d
lea rcx, [rdi + 0x38]
mov rdx, rbx
call fcn.140038460
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140022420
nop
lea rcx, [rsp + 0x20]
call fcn.14005a020
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rax + 8], 0
je 0x14006285e
mov rdx, rbx
mov rcx, rbx
call fcn.14005ddd0
nop
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140063ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x60]
xor r15d, r15d
mov rax, qword [rsp + 0x68]
mov r13, rdx
mov r10, qword [rsp + 0x78]
mov qword [r14], r8
mov qword [r10], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140063ea5
mov r12, qword [rsp + 0x70]
lea r8d, [r15 + 1]
mov rsi, qword [r10]
mov r9d, 0x3ff
mov r11d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x140063ea5
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rax]
cmp r8w, dx
jae 0x140063d7a
lea eax, [r11 + rcx]
cmp ax, r9w
ja 0x140063ec5
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140063d90
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x140063d90
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140063da3
movzx r9d, al
mov r11d, r15d
mov ebx, r15d
jmp 0x140063dee
mov r9d, eax
cmp eax, 0x800
jae 0x140063dbd
shr r9d, 6
mov r11d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x140063dee
cmp eax, 0x10000
jae 0x140063dd7
shr r9d, 0xc
mov r11d, 2
or r9b, 0xe0
mov ebx, r11d
jmp 0x140063dee
shr r9d, 0x12
mov r11d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdi, r12
sub rdi, rsi
mov ecx, r8d
cmp rdi, rcx
jl 0x140063ea5
test dx, dx
jne 0x140063e39
mov rcx, qword [rsp + 0x40]
test byte [rcx + 0x14], 2
je 0x140063e39
lea edx, [r8 + 3]
cmp rdi, rdx
jl 0x140063ea5
mov byte [rsi], 0xef
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbb
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbf
inc qword [r10]
add qword [r14], 2
test bpl, bpl
jne 0x140063e48
cmp r11d, 3
jae 0x140063e54
mov rcx, qword [r10]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jle 0x140063e80
lea ecx, [r11 + r11*2]
add ecx, ecx
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jg 0x140063e62
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rax, qword [r14]
cmp rax, qword [rsp + 0x58]
jne 0x140063d2f
mov rax, qword [rsp + 0x50]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x48]
mov eax, 2
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400662a0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1401121f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x48], rcx
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x48], 0x2c0
lea ecx, [r14 + 0x12]
call fcn.1400b3278
mov ecx, 0x2c0
mov rsi, rax
call fcn.1400b3278
mov rbp, rax
test rax, rax
jne 0x140066328
mov rcx, rsi
call fcn.1400af210
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
nop dword [rax]
inc r8
cmp byte [r14 + r8], r14b
jne 0x140066310
xor edx, edx
mov rcx, rdi
call fcn.140003a30
jmp 0x14006645c
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140066389
mov rcx, rbp
call fcn.1400af210
mov ecx, dword [rsp + 0x48]
call fcn.1400b3278
mov rbp, rax
test rax, rax
jne 0x140066389
mov rcx, rsi
call fcn.1400af210
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
inc r8
cmp byte [r14 + r8], r14b
jne 0x140066371
xor edx, edx
mov rcx, rdi
call fcn.140003a30
jmp 0x14006645c
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14006640d
mov qword [rsp + 0xa8], rbx
mov rbx, rbp
nop word [rax + rax]
movzx ecx, byte [rbx + 0x19c]
movzx edx, byte [rbx + 0x19b]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x19a]
movzx r9d, byte [rbx + 0x199]
movzx r8d, byte [rbx + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov rcx, rsi
mov dword [rsp + 0x28], edx
lea rdx, str._02X:_02X:_02X:_02X:_02X:_02X
mov dword [rsp + 0x20], r10d
call fcn.140063880
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400663b0
mov rbx, qword [rsp + 0xa8]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x50], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x60], xmm1
inc r8
cmp byte [rsi + r8], r14b
jne 0x140066425
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140003a30
mov rcx, rbp
call fcn.1400af210
mov rcx, rsi
call fcn.1400af210
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a0cd0
mov rbp, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret