joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ca40
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
movsx rax, byte [rdx]
mov rbx, rdx
mov r9, rcx
mov r8, rdx
mov r10d, 0x1505
test rax, rax
je 0x14000ca74
nop dword [rax]
imul r10, r10, 0x21
lea r8, [r8 + 1]
add r10, rax
movsx rax, byte [r8]
test rax, rax
jne 0x14000ca60
mov rcx, qword [rcx + 0x10]
lea r8, reloc.WS2_32.dll_getpeername
xor edx, edx
mov rax, r10
div qword [r8 + rcx*8]
lea rax, [r9 + 0x18]
mov r11, rdx
shl r11, 4
add r11, qword [r9 + 8]
mov r8, qword [r11]
cmp r8, rax
jne 0x14000caa5
cmp r8, qword [r11 + 8]
je 0x14000caed
cmp qword [r8 - 8], r10
jne 0x14000cad7
lea rax, [r8 + 0x20]
mov r9, rbx
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14000cad3
inc rax
test ecx, ecx
jne 0x14000cac0
test edx, edx
je 0x14000cae3
cmp r8, qword [r11 + 8]
je 0x14000caed
mov r8, qword [r8 + 8]
jmp 0x14000caa5
mov rax, qword [r8 + 0x10]
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
xor eax, eax
ret

Function at 0x140010310
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [0x1400a7b1c], 0
mov edi, ecx
je 0x140010342
cmp dword [0x1400a7fc8], 0
jne 0x140010342
lea r8, str.restart_threads
mov ecx, 4
lea rdx, [0x14007dcfc]
call fcn.14001ae00
mov r8d, dword [0x1400959e0]
xor ecx, ecx
test r8d, r8d
jle 0x140010371
mov rdx, qword [0x1400a8100]
test rdx, rdx
je 0x140010371
movsxd rax, ecx
inc ecx
shl rax, 7
mov dword [rax + rdx], 1
cmp ecx, r8d
jl 0x140010357
mov eax, dword [0x1400a80f0]
test eax, eax
jne 0x14001049a
xor r8d, r8d
mov qword [rsp + 0x40], rbx
lea edx, [rax + 1]
mov dword [0x1400a80f0], 1
xor ecx, ecx
mov qword [rsp + 0x48], 0xffffffffffe17b80
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x48]
mov rcx, rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
test edi, edi
jne 0x1400103f6
mov eax, dword [0x1400959e4]
test eax, eax
cmovne edi, eax
lea rcx, [0x14008eaa0]
call fcn.140027690
cmp dword [0x14008e858], 0
je 0x140010410
call fcn.140020d80
call fcn.140022440
lea rcx, [0x14008eaa0]
call fcn.140027c70
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov rcx, qword [0x1400a84a8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400a84b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400a6d38]
test rcx, rcx
je 0x140010458
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140095258]
test rcx, rcx
je 0x14001046a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400a84c0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400a84b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400a84a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x30
pop rdi
ret
Function at 0x14001be60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x14008d0f8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rdx
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x20], xmm0
xor edi, edi
call fcn.14002aed0
mov rbx, rax
test rax, rax
jne 0x14001bec7
lea rdx, str.Remote_config_init_failed_
xor ecx, ecx
call fcn.14001ae00
xor eax, eax
jmp 0x14001c048
mov r8, rbp
mov edx, 0x2712
mov rcx, rbx
call fcn.14002b060
mov edx, 0x4a
mov rcx, rbx
lea r8d, [rdx - 0x49]
call fcn.14002b060
mov edx, Ordinal_79
mov rcx, rbx
lea r8d, [rdx - 0x3f]
call fcn.14002b060
lea r8, [rsp + 0x30]
mov edx, 0x271a
mov rcx, rbx
call fcn.14002b060
mov edx, 0x63
mov rcx, rbx
lea r8d, [rdx - 0x62]
call fcn.14002b060
mov edx, 0x79
mov rcx, rbx
lea r8d, [rdx - 0x78]
call fcn.14002b060
lea r8, [0x14001b290]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.14002b060
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, rbx
call fcn.14002b060
mov r8, qword [0x14008eab0]
test r8, r8
je 0x14001bf82
mov edx, 0x2714
mov rcx, rbx
call fcn.14002b060
mov r8d, dword [0x14008ea94]
mov edx, 0x65
mov rcx, rbx
call fcn.14002b060
jmp 0x14001bff0
lea rcx, str.http_proxy
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001bff0
lea rcx, str.all_proxy
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001bfb8
lea rcx, str.all_proxy
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r8, rax
jmp 0x14001bfe3
lea rcx, str.ALL_PROXY
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001bfdc
lea rcx, str.ALL_PROXY
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r8, rax
jmp 0x14001bfe3
lea r8, [0x14007d76a]
mov edx, 0x2714
mov rcx, rbx
call fcn.14002b060
mov rcx, rbx
call fcn.14002af90
test eax, eax
je 0x14001c011
lea r8, [rsp + 0x30]
xor ecx, ecx
lea rdx, str.Remote_config_read_failed:__s
call fcn.14001ae00
jmp 0x14001c03d
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14001c02f
cmp qword [rsp + 0x28], rdi
je 0x14001c02f
mov r8, rsi
call fcn.14000e130
mov rdi, rax
jmp 0x14001c03d
lea rdx, str.Empty_data_received_for_config
xor ecx, ecx
call fcn.14001ae00
mov rcx, rbx
call fcn.14002ae90
mov rax, rdi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14006df60
mov rbx, qword [rsp + 0x170]
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c290
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x260
mov rax, qword [0x14008d0f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r15d, r15d
mov rsi, rdx
mov edi, r15d
or rbx, 0xffffffffffffffff
mov rbp, rcx
inc rbx
cmp byte [rdx + rbx], dil
jne 0x14001c2c0
movsxd rax, ebx
inc ebx
mov qword [rsp + 0x2a0], r14
mov byte [rax + rdx], 0xa
test ebx, ebx
jle 0x14001c345
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbp
xor edx, edx
mov dword [rsp + 0x40], 1
lea ecx, [rbp + 1]
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jl 0x14001c370
movsxd rdx, edi
xor r9d, r9d
add rdx, rsi
mov r8d, ebx
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14001c33d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001c370
mov eax, r15d
add edi, eax
sub ebx, eax
test ebx, ebx
jg 0x14001c2e0
mov eax, 1
mov r14, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006df60
add rsp, 0x260
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x14001c34a

Function at 0x14001c380
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x268
mov rax, qword [0x14008d0f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdx, qword [rcx + 0x128]
mov r8d, dword [0x14008d188]
test rdx, rdx
jne 0x14001c3c6
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006df60
add rsp, 0x268
ret
mov qword [rsp + 0x260], rbx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14001c3d2
test rax, rax
jne 0x14001c421
mov rax, qword [rcx + 0x118]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov dword [rsp + 0x30], r8d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 1
lea ecx, [rax + 1]
mov dword [rsp + 0x34], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x14001c426
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006df60
add rsp, 0x268
ret
Function at 0x140025b20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, r8
mov r10, rdx
not ecx
test r8, r8
je 0x140025b60
lea r11, [0x140081bd0]
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [r11 + r8*4]
xor ecx, eax
sub r9, 1
jne 0x140025b40
not ecx
mov eax, ecx
ret

Function at 0x140025cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x18
vmovdqa xmm5, xmmword [rdx + 0x10]
vaesenc xmm1, xmm5, xmmword [0x1400a8230]
vaesenc xmm2, xmm1, xmmword [0x1400a8250]
vmovaps xmmword [rsp], xmm6
vmovdqa xmm6, xmmword [rdx]
vaesenc xmm0, xmm6, xmmword [0x1400a8220]
vaesenc xmm3, xmm0, xmmword [0x1400a8240]
vpunpckldq xmm0, xmm3, xmm2
vpunpckhdq xmm1, xmm3, xmm2
vaesenc xmm3, xmm0, xmmword [0x1400a8260]
vaesenc xmm2, xmm1, xmmword [0x1400a8270]
vaesenc xmm4, xmm3, xmmword [0x1400a8280]
vaesenc xmm0, xmm2, xmmword [0x1400a8290]
vpunpckldq xmm1, xmm4, xmm0
vaesenc xmm3, xmm1, xmmword [0x1400a82a0]
vpunpckhdq xmm2, xmm4, xmm0
vaesenc xmm4, xmm3, xmmword [0x1400a82c0]
vaesenc xmm0, xmm2, xmmword [0x1400a82b0]
vaesenc xmm1, xmm0, xmmword [0x1400a82d0]
vpunpckldq xmm2, xmm4, xmm1
vaesenc xmm3, xmm2, xmmword [0x1400a82e0]
vpunpckhdq xmm0, xmm4, xmm1
vaesenc xmm4, xmm3, xmmword [0x1400a8300]
vaesenc xmm1, xmm0, xmmword [0x1400a82f0]
vaesenc xmm0, xmm1, xmmword [0x1400a8310]
vpunpckldq xmm2, xmm4, xmm0
vaesenc xmm3, xmm2, xmmword [0x1400a8320]
vpunpckhdq xmm1, xmm4, xmm0
vaesenc xmm0, xmm1, xmmword [0x1400a8330]
vaesenc xmm4, xmm3, xmmword [0x1400a8340]
vaesenc xmm1, xmm0, xmmword [0x1400a8350]
vpunpckldq xmm2, xmm4, xmm1
vpxor xmm3, xmm6, xmm2
vmovaps xmm6, xmmword [rsp]
vpunpckhdq xmm0, xmm4, xmm1
vpxor xmm1, xmm5, xmm0
vmovdqu xmmword [rcx], xmm3
vmovdqu xmmword [rcx + 0x10], xmm1
add rsp, 0x18
ret
Function at 0x140026060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
vmovdqa xmm0, xmmword [rdx + 0x30]
vaesenc xmm4, xmm0, xmmword [r8 + 0x30]
vmovdqa xmm1, xmmword [rdx]
vaesenc xmm1, xmm1, xmmword [r8]
vaesenc xmm5, xmm1, xmmword [r8 + 0x40]
vaesenc xmm1, xmm4, xmmword [r8 + 0x70]
vmovdqa xmm2, xmmword [rdx + 0x10]
vaesenc xmm2, xmm2, xmmword [r8 + 0x10]
vaesenc xmm0, xmm2, xmmword [r8 + 0x50]
vmovdqa xmm3, xmmword [rdx + 0x20]
vaesenc xmm3, xmm3, xmmword [r8 + 0x20]
vaesenc xmm3, xmm3, xmmword [r8 + 0x60]
vpunpckhdq xmm2, xmm5, xmm0
vpunpckldq xmm4, xmm3, xmm1
vmovaps xmmword [rsp + 0x10], xmm6
mov r9, rcx
mov ecx, dword [rdx + 0x34]
vpunpckldq xmm6, xmm5, xmm0
vpunpckhdq xmm0, xmm3, xmm1
vpunpckldq xmm5, xmm2, xmm0
vpunpckhdq xmm1, xmm2, xmm0
vaesenc xmm2, xmm1, xmmword [r8 + 0x80]
vpunpckhdq xmm3, xmm4, xmm6
vaesenc xmm1, xmm3, xmmword [r8 + 0xa0]
vmovaps xmmword [rsp], xmm7
vpunpckldq xmm0, xmm4, xmm6
vaesenc xmm4, xmm0, xmmword [r8 + 0x90]
vaesenc xmm0, xmm5, xmmword [r8 + 0xb0]
vaesenc xmm5, xmm2, xmmword [r8 + 0xc0]
vaesenc xmm2, xmm0, xmmword [r8 + 0xf0]
vaesenc xmm3, xmm4, xmmword [r8 + 0xd0]
vaesenc xmm4, xmm1, xmmword [r8 + 0xe0]
vpunpckldq xmm6, xmm5, xmm3
vpunpckhdq xmm0, xmm4, xmm2
vpunpckhdq xmm1, xmm5, xmm3
vpunpckldq xmm5, xmm1, xmm0
vpunpckhdq xmm1, xmm1, xmm0
vpunpckldq xmm3, xmm4, xmm2
vpunpckldq xmm0, xmm3, xmm6
vaesenc xmm4, xmm0, xmmword [r8 + 0x110]
vaesenc xmm0, xmm5, xmmword [r8 + 0x130]
vpunpckhdq xmm2, xmm3, xmm6
vaesenc xmm3, xmm1, xmmword [r8 + 0x100]
vaesenc xmm1, xmm2, xmmword [r8 + 0x120]
vaesenc xmm5, xmm3, xmmword [r8 + 0x140]
vaesenc xmm3, xmm0, xmmword [r8 + 0x170]
vaesenc xmm2, xmm4, xmmword [r8 + 0x150]
vaesenc xmm4, xmm1, xmmword [r8 + 0x160]
vpunpckhdq xmm1, xmm5, xmm2
vpunpckldq xmm6, xmm5, xmm2
vpunpckhdq xmm0, xmm4, xmm3
vpunpckldq xmm7, xmm1, xmm0
vpunpckhdq xmm1, xmm1, xmm0
vpunpckldq xmm5, xmm4, xmm3
vaesenc xmm3, xmm1, xmmword [r8 + 0x180]
vaesenc xmm3, xmm3, xmmword [r8 + 0x1c0]
vpunpckldq xmm0, xmm5, xmm6
vaesenc xmm4, xmm0, xmmword [r8 + 0x190]
vaesenc xmm0, xmm7, xmmword [r8 + 0x1b0]
vaesenc xmm0, xmm0, xmmword [r8 + 0x1f0]
vaesenc xmm1, xmm4, xmmword [r8 + 0x1d0]
vmovaps xmm7, xmmword [rsp]
vpunpckhdq xmm2, xmm5, xmm6
vaesenc xmm5, xmm2, xmmword [r8 + 0x1a0]
vaesenc xmm2, xmm5, xmmword [r8 + 0x1e0]
vmovaps xmm6, xmmword [rsp + 0x10]
vpunpckldq xmm0, xmm2, xmm0
vpunpckldq xmm1, xmm3, xmm1
vpunpckhdq xmm0, xmm0, xmm1
vaesenc xmm1, xmm0, xmmword [r8 + 0x220]
vaesenc xmm2, xmm1, xmmword [r8 + 0x260]
vpextrd eax, xmm2, 2
xor ecx, eax
mov dword [r9 + 0x1c], ecx
add rsp, 0x28
ret
Function at 0x140026bd0
Capabilities:
Get thread local storage value

Disassembly:
xor r8d, r8d
jmp 0x140029260
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x50
xor ebp, ebp
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov dword [rsp + 0x70], ebp
test rcx, rcx
je 0x1400293a4
mov rax, qword [rcx]
test rax, rax
je 0x1400293a4
cmp rax, 0xffffffffffffffff
jne 0x1400292a8
call fcn.140029130
mov dword [rsp + 0x70], eax
test eax, 0xffffffef
jne 0x1400292df
mov qword [rsp + 0x80], rdi
mov rdi, qword [rbx]
lea rcx, [rdi + 0x18]
call fcn.14002ac20
test eax, eax
jne 0x1400292cf
inc dword [rdi]
lea rcx, [rdi + 0x18]
call fcn.14002a960
test eax, eax
je 0x1400292f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rsi
mov rsi, qword [0x14008df98]
mov qword [rsp + 0x30], rax
lea rax, [0x140029500]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x40], rax
test rsi, rsi
je 0x14002934e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [0x14008df98]
lea rdx, [rsp + 0x38]
mov rcx, rsi
mov qword [rsp + 0x48], rbp
call fcn.140028100
mov rcx, r14
call fcn.140027c70
mov rsi, qword [rsp + 0x78]
mov dword [rsp + 0x70], eax
test eax, eax
jne 0x140029391
lea rcx, [rdi + 0x10]
mov rdx, r15
call fcn.14002aae0
test eax, eax
je 0x140029391
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
mov dword [rsp + 0x70], ecx
mov ecx, 1
call fcn.140029970
mov eax, dword [rsp + 0x70]
jmp 0x1400292d7
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140026be0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
xor eax, eax
movaps xmmword [rsp + 0x70], xmm6
mov r14, r9
mov r12, r8
mov r13, rcx
mov ebx, reloc.WS2_32.dll_inet_addr
mov esi, eax
mov dword [rcx + 8], eax
test rdx, rdx
je 0x140026c1d
mov rdi, qword [rdx]
jmp 0x140026c20
mov rdi, rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xb0], r15
call fcn.140029880
movups xmm6, xmmword [rax]
movq rbp, xmm6
test rbp, rbp
je 0x140026d1d
mov r15d, dword [rbp + 0x188]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140026d1d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r14
movups xmmword [rax], xmm6
test rdi, rdi
je 0x140026d15
mov eax, dword [rdi + 0x18]
mov r14d, dword [rdi + 0x10]
mov dword [rbp + 0x184], eax
cmp dword [rdi + 0x20], 0
mov r15d, dword [rdi + 0x1c]
jne 0x140026ca0
lea rcx, [rsp + 0x60]
call fcn.140027dc0
mov rax, qword [rax]
mov r15d, dword [rax + 0x188]
xor r12d, r12d
lea rax, [rbp + 0x198]
lea r8, [0x14002a3c0]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, r14d
xor ecx, ecx
mov dword [rbp + 0x28], r12d
mov qword [rbp + 0x58], r12
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
je 0x140026d03
test rdi, rdi
je 0x140026cfa
lea rcx, [rsp + 0x30]
mov r8d, r15d
xor edx, edx
movdqa xmmword [rsp + 0x30], xmm6
call fcn.140029e90
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test r14, r14
cmovne ebx, r12d
test ebx, ebx
jne 0x140026d1d
movups xmmword [r13], xmm6
jmp 0x140026d3b
xor r12d, r12d
mov r14d, r12d
jmp 0x140026ca3
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm6
call fcn.14002a040
test rsi, rsi
je 0x140026d3b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbp, qword [r11 + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140027dc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rdi, qword [0x14008df90]
xor r15d, r15d
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
test rdi, rdi
je 0x140027e22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140027e22
movups xmm6, xmmword [rdi + 0x10]
jmp 0x140027ed4
lea rcx, [rsp + 0x50]
call fcn.140029880
movups xmm6, xmmword [rax]
movq rbp, xmm6
test rbp, rbp
je 0x140027ed4
or dword [rbp + 0x194], 1
mov dword [rbp + 0x184], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x198], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rbp + 8]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x140027eb5
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm6
call fcn.14002a260
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x140027ed7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rbp
mov dword [rbp + 0x188], eax
mov rcx, qword [0x14008df90]
call fcn.140028100
movups xmmword [rsi], xmm6
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rax, rsi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140028100
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rsi, qword [0x14008df90]
mov r14, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x140028142
lea rcx, [rbp - 0x50]
call fcn.140027dc0
mov rbx, qword [rax]
test rbx, rbx
jne 0x14002817e
mov eax, 2
jmp 0x1400282a9
test rsi, rsi
je 0x14002816d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x14002816d
movups xmm0, xmmword [rsi + 0x10]
jmp 0x140028176
test r14, r14
je 0x140028138
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x50], xmm0
mov rbx, qword [rbp - 0x50]
mov qword [rsp + 0x90], r15
xor r15d, r15d
mov esi, r15d
test rdi, rdi
je 0x14002829f
test rbx, rbx
je 0x14002828a
cmp qword [rdi + 8], rsi
je 0x14002828a
test r14, r14
je 0x14002828a
lea rcx, [rdi + 0x10]
lea rdx, [rbp - 0x20]
call fcn.140029630
lea rcx, [rbx + 0x30]
lea rdx, [rbp - 0x40]
call fcn.140029630
mov rax, qword [rbx + 0x58]
test rax, rax
je 0x1400281e3
cmp qword [rax + 8], rdi
je 0x1400281f0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400281d4
mov rdx, rdi
mov rcx, rbx
call fcn.14002a680
mov esi, eax
mov rdx, qword [rbp - 0x40]
mov rcx, r15
lock xadd qword [rbp - 0x38], rcx
or rbx, 0xffffffffffffffff
test rcx, rcx
jne 0x14002822a
lea rax, [rbp - 0x40]
lock cmpxchg qword [rdx], r15
lea rcx, [rbp - 0x40]
cmp rcx, rax
je 0x14002823d
lea rcx, [rbp - 0x28]
call fcn.1400295d0
mov rcx, r15
lock xadd qword [rbp - 0x38], rcx
xor eax, eax
lock cmpxchg qword [rcx + 0x10], rbx
je 0x14002823d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rdx, qword [rbp - 0x20]
mov rcx, r15
lock xadd qword [rbp - 0x18], rcx
test rcx, rcx
jne 0x140028273
lea rax, [rbp - 0x20]
lock cmpxchg qword [rdx], r15
lea rcx, [rbp - 0x20]
cmp rcx, rax
je 0x140028286
lea rcx, [rbp - 8]
call fcn.1400295d0
mov rcx, r15
lock xadd qword [rbp - 0x18], rcx
xor eax, eax
lock cmpxchg qword [rcx + 0x10], rbx
je 0x140028286
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test esi, esi
jne 0x14002829f
mov ecx, dword [rdi]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, reloc.WS2_32.dll_inet_addr
test eax, eax
cmove esi, ecx
mov r15, qword [rsp + 0x90]
mov eax, esi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140028660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp dword [0x14008df88], 0
je 0x140028888
mov qword [rsp + 0x80], rdi
mov rdi, qword [0x14008df90]
test rdi, rdi
je 0x140028875
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14002885d
movups xmm0, xmmword [rdi + 0x10]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x88], r14
movaps xmmword [rbp - 0x40], xmm0
call fcn.140028910
xor esi, esi
lea rcx, [rdi + 0x38]
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rcx
xchg qword [rcx], rdx
or r14, 0xffffffffffffffff
test rdx, rdx
je 0x140028756
lea rax, [rbp - 0x20]
mov qword [rdx + 8], rax
xor eax, eax
lock cmpxchg qword [rdx + 0x18], r14
je 0x140028716
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, rsi
lock xadd qword [rbp - 0x10], rax
test rax, rax
jne 0x140028756
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
xor eax, eax
lock cmpxchg qword [rbp - 0x10], rbx
jne 0x14002874d
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x20]
mov dword [rdi + 0x28], 6
mov rcx, rsi
lock xadd qword [rbp - 0x18], rcx
test rcx, rcx
jne 0x140028793
lea rax, [rbp - 0x20]
lock cmpxchg qword [rdx], rsi
lea rcx, [rbp - 0x20]
cmp rcx, rax
je 0x1400287a6
lea rcx, [rbp - 8]
call fcn.1400295d0
mov rcx, rsi
lock xadd qword [rbp - 0x18], rcx
xor eax, eax
lock cmpxchg qword [rcx + 0x10], r14
je 0x1400287a6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [rdi + 0x178], 0
mov rsi, qword [rsp + 0x78]
je 0x14002882a
nop word [rax + rax]
mov rax, qword [rdi + 0x178]
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x28]
mov r8, qword [rcx + 0x10]
mov qword [rcx + 0x10], rdi
mov r9, qword [rdx + 0x18]
test r9, r9
je 0x1400287e7
mov rax, qword [rdx + 0x10]
mov qword [r9 + 0x10], rax
mov r9, qword [rdx + 0x10]
test r9, r9
je 0x1400287f8
mov rax, qword [rdx + 0x18]
mov qword [r9 + 0x18], rax
cmp qword [r8 + 0x178], rdx
jne 0x14002880c
mov rax, qword [rdx + 0x18]
mov qword [r8 + 0x178], rax
mov rdx, qword [rcx + 0x28]
mov eax, r14d
xchg dword [rdx + 8], eax
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [rdi + 0x178], 0
jne 0x1400287c0
cmp dword [rdi + 0x184], 1
mov r14, qword [rsp + 0x88]
jne 0x14002885d
movups xmm0, xmmword [rdi + 0x10]
lea rcx, [rbp - 0x30]
movaps xmmword [rbp - 0x30], xmm0
call fcn.14002a040
mov rax, qword [0x14008df90]
mov ecx, dword [rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
mov eax, 1
add rsp, 0x60
pop rbp
ret
mov eax, 1
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
mov eax, 1
add rsp, 0x60
pop rbp
ret