joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069b80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x298], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x48], rax
add rdx, 0x20
lea rcx, [rsp + 0x50]
call fcn.1400676d0
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x160], xmm0
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x170]
call fcn.140068ff0
nop
lea rsi, [rdi + 8]
mov rdi, qword [rdi]
mov rbx, qword [rsi]
mov ecx, dword [0x1403a2748]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140069c14
cmp qword [rax], rbx
je 0x140069cfb
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140069c02
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
mov ecx, 0x290
call fcn.140035580
mov r9, rax
xor r10d, r10d
mov qword [rax + 0x20], r10
lea rax, [0x14006a820]
mov qword [r9 + 0x28], rax
mov qword [r9], r10
mov qword [r9 + 8], r10
mov qword [r9 + 0x10], r10
mov qword [r9 + 0x18], r10
mov dword [r9 + 0x30], r10d
lea rcx, [r9 + 0x38]
lea rdx, [rsp + 0x40]
call fcn.140068ff0
movaps xmm2, xmmword [rsp + 0x160]
movups xmmword [rcx + 0x120], xmm2
add rcx, 0x130
lea rdx, [rsp + 0x170]
call fcn.140068ff0
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r10
mov r8, r9
mov rdx, rsi
mov rcx, rdi
call fcn.140037790
nop
lea rcx, [rsp + 0x260]
call sym.ethminer.exe_public:_void___cdecl_Json::PathArgument::destructor_void____ptr64
lea rcx, [rsp + 0x1b0]
call sym.ethminer.exe_public:_void___cdecl_Json::PathArgument::destructor_void____ptr64
lea rcx, [rsp + 0x130]
call sym.ethminer.exe_public:_void___cdecl_Json::PathArgument::destructor_void____ptr64
lea rcx, [rsp + 0x80]
call sym.ethminer.exe_public:_void___cdecl_Json::PathArgument::destructor_void____ptr64
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rax + 8], 0
je 0x140069c14
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14006aaf0
nop
nop
jmp 0x140069ca2
Function at 0x14006aaf0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
lea rdi, [rcx + 0x130]
lea rsi, [rcx + 0x128]
mov rbp, qword [rcx + 0x120]
mov rbx, qword [rsi]
mov ecx, dword [0x1403a2748]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006ab3e
cmp qword [rax], rbx
je 0x14006aba6
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14006ab30
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov ecx, 0x160
call fcn.140035580
mov r9, rax
xor r10d, r10d
mov qword [rax + 0x20], r10
lea rax, [0x14006ac30]
mov qword [r9 + 0x28], rax
mov qword [r9], r10
mov qword [r9 + 8], r10
mov qword [r9 + 0x10], r10
mov qword [r9 + 0x18], r10
mov dword [r9 + 0x30], r10d
lea rcx, [r9 + 0x38]
mov rdx, rdi
call fcn.140068ff0
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r10
mov r8, r9
mov rdx, rsi
mov rcx, rbp
call fcn.140037790
nop
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rax + 8], 0
je 0x14006ab3e
nop
mov rdx, rdi
mov rcx, rdi
call fcn.140063fb0
nop
nop
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14006aea0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x14006aec8
mov qword [rdi], 0
mov rax, rdi
add rsp, 0x20
pop rdi
ret
cmp qword [rsp + 0x40], 0
jle 0x14006aeb8
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14006aefc
inc ebx
cmp ebx, 3
ja 0x14006af32
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14006aee6
mov rbx, qword [rsp + 0x30]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x38]
xorps xmm0, xmm0
mulsd xmm1, qword [0x1403444b0]
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14006cff0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
lea rsi, [rdx + 0x10]
mov rdx, qword [rsi]
call fcn.1400496d0
lea r15d, [rbp - 6]
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006d057
mov r14, qword [rdi]
mov rdi, r14
mov r13, qword [rsi]
add r13, rdi
cmp r14, r13
je 0x14006d15f
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
shl ebp, 8
movzx eax, byte [r14]
add ebp, eax
add r15d, 8
js 0x14006d0fd
movsxd r12, ebp
movsxd rdi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
nop dword [rax + rax]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14006d0dd
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14006d0d2
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14006d0f3
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140054a50
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub rsi, 1
jne 0x14006d0a0
inc r14
cmp r14, r13
jne 0x14006d070
cmp r15d, 0xfffffffa
jle 0x14006d15f
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rdx, ebp
sar rdx, cl
and edx, 0x3f
movzx r9d, byte [rdx + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14006d150
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14006d145
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14006d15f
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140054a50
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x14006d1b0
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14006d195
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14006d18d
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14006d1a7
mov r9b, 0x3d
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140054a50
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x14006d170
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14006ddd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
nop dword [rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x14006de13
call fcn.140266a88
cmp dword [rax], 4
je 0x14006ddf0
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006de30
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14006de9f
call fcn.140266a88
cmp dword [rax], 4
je 0x14006de70
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140255050
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x14006ded0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14006df3e
call fcn.140266a88
cmp dword [rax], 4
je 0x14006df10
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140255050
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x14006e4b0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14006e59a
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x14006e50f
cmp ax, 0x17
jne 0x14006e51f
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.140257fe0
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x14006e59a
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006e580
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140012e90
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140255050
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x14006e4b0

Function at 0x140072e50
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
call qword [rax + 0x10]
test al, al
jne 0x140072e89
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsi + 8]
mov eax, 0x7fffffff
cmp rdi, rax
mov qword [rsp + 0x30], rbx
cmova rdi, rax
nop
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140072ec3
call fcn.140266a88
cmp dword [rax], 4
je 0x140072ea0
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140072ee0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14006e59a
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x14006e50f
cmp ax, 0x17
jne 0x14006e51f
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.140257fe0
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x14006e59a
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006e580
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140012e90
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140255050
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x14006e4b0
Function at 0x140079e90
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, qword [rcx + 0x400]
mov rbp, rcx
mov r14, qword [rdx]
mov rbx, rdx
mov qword [rsp + 0x20], rcx
add rcx, 0x408
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
call fcn.1402329f8
test eax, eax
jne 0x14007a039
mov rcx, rdi
mov qword [rsp + 0x68], r15
call fcn.14010bcc0
lea rcx, [rbp + 0x408]
mov rdi, rax
call fcn.140232a1c
test rdi, rdi
je 0x140079fed
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, r14d
call fcn.14014f770
xor r9d, r9d
mov rcx, rax
mov r15, rax
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
call fcn.140155100
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.14010c500
cmp qword [rbp + 0x20], 0x10
lea r9, [rbp + 8]
jb 0x140079f51
mov r9, qword [r9]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x37]
call fcn.14010af70
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14007a050
cmp al, 1
jne 0x140079fa6
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
lea edx, [r9 + 0x66]
call fcn.140155100
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov al, 1
mov qword [rbx + 8], rdi
jmp 0x14007a019
mov rcx, rdi
call fcn.14010c860
lea rcx, [rbp + 0x408]
call fcn.1402329f8
test eax, eax
jne 0x14007a031
mov rcx, rdi
call fcn.14010b3e0
lea rcx, [rbp + 0x408]
call fcn.140232a1c
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14007a017
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14007a017
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
xor al, al
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.140231d34
int3
mov ecx, eax
call fcn.140231d34
int3
Function at 0x14007a410
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x30], rcx
cmp qword [rcx + 0x20], 0x10
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jb 0x14007a454
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14007a470
mov r15d, 0x10
jmp 0x14007a494
cmp qword [rsi + 0x18], 0x10
jb 0x14007a47a
mov rsi, qword [rsi]
lea r8, [rsp + 0x24]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14007a499
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call fcn.14014e7c0
mov r12, rax
test rax, rax
je 0x14007a582
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call fcn.14014fdd0
mov dword [rsp + 0x28], eax
test eax, eax
jle 0x14007a575
nop
test r14b, r14b
jne 0x14007a570
mov edx, ebx
mov rcx, r12
call fcn.140150030
mov rsi, rax
cmp dword [rax], edi
jne 0x14007a55a
mov rcx, qword [rax + 8]
call fcn.140072ef0
mov rcx, qword [rsi + 8]
mov rbp, rax
call fcn.14010c920
movsxd r8, eax
cmp edi, 2
je 0x14007a549
cmp edi, 7
jne 0x14007a55a
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.140258180
test eax, eax
je 0x14007a544
mov r8, r15
lea rcx, [rsp + 0x24]
mov rdx, rbp
call fcn.140258180
test eax, eax
jne 0x14007a55a
mov r13b, 1
jmp 0x14007a55a
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
call fcn.14007a5b0
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x28]
jl 0x14007a4e0
test r14b, r14b
jne 0x14007a570
test r13b, r13b
je 0x14007a575
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call fcn.1401502d0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140255050
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400901b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400901e4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400901d0
ret
Function at 0x1400971f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rcx]
movups xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x58], xmm0
lea rdi, [rdx + 8]
mov rsi, qword [rdx]
mov rbx, qword [rdi]
mov ecx, dword [0x1403a2748]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140097246
cmp qword [rax], rbx
je 0x1400972c9
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140097234
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
mov ecx, 0x70
call fcn.140035580
nop
xor edx, edx
mov qword [rax + 0x20], rdx
lea rcx, [0x140099690]
mov qword [rax + 0x28], rcx
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov dword [rax + 0x30], edx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rax + 0x38], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rax + 0x48], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rax + 0x58], xmm1
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov r8, rax
mov rdx, rdi
mov rcx, rsi
call fcn.140037790
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
cmp qword [rax + 8], 0
je 0x140097246
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.140099730
nop
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140099730
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
lea rdi, [rcx + 0x20]
lea rsi, [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov rbx, qword [rsi]
mov ecx, dword [0x1403a2748]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140099775
cmp qword [rax], rbx
je 0x1400997d4
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140099767
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov ecx, 0x50
call fcn.140035580
nop
xor edx, edx
mov qword [rax + 0x20], rdx
lea rcx, [0x140099840]
mov qword [rax + 0x28], rcx
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov dword [rax + 0x30], edx
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x38], xmm0
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov r8, rax
mov rdx, rsi
mov rcx, rbp
call fcn.140037790
nop
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rax + 8], 0
je 0x140099775
nop
mov rdx, rdi
mov rcx, rdi
call fcn.1400998a0
nop
nop
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a33c0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x48
xor r15d, r15d
mov rbx, r9
mov r14, rdx
mov rbp, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400a351c
mov qword [rsp + 0x80], rdi
test r8b, r8b
je 0x1400a3426
movzx eax, byte [rdx]
test al, 8
je 0x1400a3426
or al, 8
mov dword [rsp + 0x70], r15d
mov byte [rdx], al
lea r9, [rsp + 0x70]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400a3426
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
test eax, eax
jne 0x1400a3446
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.140099c10
jmp 0x1400a34e7
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], r12
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r12, [0x140339bc0]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], r12
movabs rdx, 0x8fafd21e25c5e09b
test eax, eax
lea rsi, [rbx + 8]
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov ecx, dword [rbx]
cmp ecx, 0x2733
jne 0x1400a3496
mov rax, qword [rsi]
cmp qword [rax + 8], rdx
je 0x1400a34a7
cmp ecx, 0x4d5
jne 0x1400a34dd
mov rax, qword [rsi]
cmp qword [rax + 8], rdx
jne 0x1400a34dd
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
test eax, eax
jne 0x1400a34fc
mov r8, qword [rsi]
mov rcx, rbx
call fcn.140099c10
mov rsi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], r12
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
jmp 0x1400a34dd
mov eax, r15d
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x1400a3530
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
cmp rcx, 0xffffffffffffffff
jne 0x1400a3569
lea rax, [0x140339bc0]
mov dword [rsp + 0x20], 0x2719
mov qword [rsp + 0x28], rax
mov eax, ecx
mov byte [rsp + 0x24], 1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r9], xmm0
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x40], rdi
call qword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test eax, eax
jne 0x1400a3593
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.140099c10
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
test eax, eax
lea rax, [0x140339bc0]
mov qword [rsp + 0x28], rax
setne byte [rsp + 0x24]
movups xmm0, xmmword [rsp + 0x20]
mov eax, edi
mov rdi, qword [rsp + 0x40]
movups xmmword [rbx], xmm0
add rsp, 0x30
pop rbx
ret