joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140202200
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
add edx, 0xffffff38
cmp edx, 0x64
jae 0x14020225c
lea rdx, str.Connect_data_stream_actively
mov rcx, rsi
call fcn.1401955d0
mov rdi, qword [rsi + 0x18]
mov byte [rdi + 0x6ae], 0
mov rax, qword [rsi + 0x1a0]
cmp dword [rax + 0x10], 0
je 0x140202287
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
mov r8, 0xffffffffffffffff
xor r9d, r9d
call fcn.1401f7ff0
jmp 0x14020228e
mov rdi, qword [rsi + 0x18]
mov edx, dword [rdi + 0x6a0]
test edx, edx
je 0x14020229e
inc edx
cmp edx, 2
jne 0x1402022b9
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.140195520
mov eax, 0x1e
jmp 0x140202297
or byte [rdi + 0x2c9], 0x20
or byte [rdi + 0x6b4], 4
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rdx, str.disabling_EPRT_usage
mov rcx, rsi
call fcn.1401955d0
and byte [rdi + 0x2ca], 0xfb
mov edx, 1
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140202d40
Function at 0x140203aa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rdi, qword [rcx + 0x18]
mov rbx, qword [rdi + 0x1b0]
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140203afa
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rsi
call fcn.140195520
mov ebx, 0x1e
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140203ad8
mov rbx, rax
lea rdx, str.Connection_accepted_from_server
mov rcx, rsi
call fcn.1401955d0
and byte [rdi + 0x2c9], 0xdf
mov rcx, rbx
mov edx, 1
call fcn.1402475e0
lea r9, [rsp + 0x30]
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
call fcn.14021a570
mov ebx, eax
test eax, eax
jne 0x140203aec
cmp qword [rsi + 0x268], 0
je 0x140203bcc
mov rcx, rsi
mov dl, 1
call fcn.1401a1910
mov rcx, qword [rsi + 0x270]
mov rdx, qword [rsp + 0x30]
mov r8d, 1
call qword [rsi + 0x268]
mov ebp, eax
xor ebx, ebx
mov rcx, rsi
xor edx, edx
call fcn.1401a1910
test ebp, ebp
je 0x140203aec
mov rcx, rsi
mov edx, 1
call fcn.1401a6a50
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
call fcn.1401a69f0
mov ebx, 0x2a
jmp 0x140203aec
xor ebx, ebx
jmp 0x140203aec
Function at 0x140209510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140209657
mov ebx, edx
mov rsi, rcx
xor r14d, r14d
mov ecx, 1
mov rdx, rsi
xor r15d, r15d
xor eax, eax
jmp 0x140209546
inc r14
inc rdx
movzx r8d, byte [rdx]
cmp r8d, 0x22
je 0x1402095e0
cmp r8d, 0x5c
je 0x140209540
test r8d, r8d
je 0x1402095eb
test bl, bl
jne 0x1402095e3
mov r9d, eax
and r9b, 1
jne 0x1402095e3
cmp r8b, 0x28
movzx eax, al
cmove eax, ecx
test al, 1
jne 0x1402095e3
cmp r8b, 0x29
movzx eax, al
cmove eax, ecx
test al, 1
jne 0x1402095e3
cmp r8b, 0x7b
movzx eax, al
cmove eax, ecx
test al, 1
jne 0x1402095e3
cmp r8b, 0x20
movzx eax, al
cmove eax, ecx
test al, 1
jne 0x1402095e3
cmp r8b, 0x25
movzx eax, al
cmove eax, ecx
test al, 1
jne 0x1402095e3
cmp r8b, 0x2a
movzx eax, al
cmove eax, ecx
test al, 1
jne 0x1402095e3
cmp r8b, 0x5d
movzx eax, al
cmove eax, ecx
inc rdx
jmp 0x140209546
inc r15
inc rdx
jmp 0x140209546
test r14, r14
jne 0x140209611
test r15, r15
jne 0x140209611
and al, 1
jne 0x140209611
mov rax, qword [0x1402654d0]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [rax]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdi, rax
mov eax, ebx
xor al, 1
movzx eax, al
lea r14, [r14 + rax*2]
add r14, r15
mov rax, qword [0x1402654c8]
lea rcx, [rdi + r14]
inc rcx
call qword [rax]
test rax, rax
je 0x140209657
add r14, rdi
mov rcx, rax
test bl, bl
jne 0x14020965e
mov byte [rax], 0x22
mov byte [r14 + rax - 1], 0x22
mov rcx, rax
jmp 0x14020965b
xor eax, eax
jmp 0x140209674
inc rcx
movzx edx, byte [rsi]
cmp edx, 0x22
je 0x140209680
cmp edx, 0x5c
je 0x140209680
test edx, edx
jne 0x140209689
mov byte [rax + r14], 0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov byte [rcx], 0x5c
inc rcx
movzx edx, byte [rsi]
mov byte [rcx], dl
inc rsi
jmp 0x14020965b
Function at 0x14020b7c0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov r12, qword [rcx + 0x1a0]
lea rbp, str.BINARY
xor ebx, ebx
lea rdi, [rsp + 0x32]
mov r14, qword [sym.imp.WS2_32.dll_send]
lea r15, str.SENT
lea r13, [rsp + 0x35]
jmp 0x14020b821
cmp dword [rax + rbx*4 + 0x1008], 0
je 0x14020b8c4
nop dword [rax + rax]
inc rbx
add rbp, 8
cmp rbx, 0x28
je 0x14020ba00
cmp rbx, 1
je 0x14020b810
cmp dword [r12 + rbx*4 + 0x808], 1
jne 0x14020b920
mov rax, qword [rsi + 0x1a0]
mov ecx, dword [rax + rbx*4 + 8]
cmp ecx, 3
je 0x14020b892
cmp ecx, 2
je 0x14020b8ad
test ecx, ecx
jne 0x14020b920
mov dword [rax + rbx*4 + 8], 2
mov rax, qword [rsi + 0x18]
mov word [rsp + 0x32], 0xfbff
mov byte [rsp + 0x34], bl
mov rcx, qword [rax + 0x1a8]
mov rdx, rdi
mov r8d, 3
xor r9d, r9d
call r14
test eax, eax
js 0x14020b8d4
test byte [rsi + 0xa8b], 0x20
jne 0x14020b8f5
jmp 0x14020b920
cmp dword [rax + rbx*4 + 0x408], 0
jne 0x14020b920
mov dword [rax + rbx*4 + 0x408], 1
jmp 0x14020b920
cmp dword [rax + rbx*4 + 0x408], 1
jne 0x14020b920
mov dword [rax + rbx*4 + 0x408], 0
jmp 0x14020b920
mov dword [rax + rbx*4 + 0x1008], 1
jmp 0x14020b810
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rsi
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
call fcn.140195520
test byte [rsi + 0xa8b], 0x20
je 0x14020b920
mov rax, qword [rbp]
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea rdx, str._s__s__s
mov r8, r15
lea r9, str.WILL
call fcn.1401955d0
nop word [rax + rax]
cmp dword [r12 + rbx*4 + 0x1408], 1
jne 0x14020b810
mov rax, qword [rsi + 0x1a0]
mov ecx, dword [rax + rbx*4 + 0xc08]
cmp ecx, 3
je 0x14020b7fd
cmp ecx, 2
je 0x14020b996
test ecx, ecx
jne 0x14020b810
mov dword [rax + rbx*4 + 0xc08], 2
mov rax, qword [rsi + 0x18]
mov word [rsp + 0x35], 0xfdff
mov byte [rsp + 0x37], bl
mov rcx, qword [rax + 0x1a8]
mov rdx, r13
mov r8d, 3
xor r9d, r9d
call r14
test eax, eax
js 0x14020b9b4
test byte [rsi + 0xa8b], 0x20
je 0x14020b810
jmp 0x14020b9d9
cmp dword [rax + rbx*4 + 0x1008], 1
jne 0x14020b810
mov dword [rax + rbx*4 + 0x1008], 0
jmp 0x14020b810
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rsi
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
call fcn.140195520
test byte [rsi + 0xa8b], 0x20
je 0x14020b810
mov rax, qword [rbp]
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea rdx, str._s__s__s
mov r8, r15
lea r9, [0x14027d7a4]
call fcn.1401955d0
jmp 0x14020b810
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14020ba20
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x858
mov rsi, rcx
mov r13, qword [rcx + 0x18]
mov rdi, qword [rcx + 0x1a0]
lea r8, [rdi + 0x1cb8]
mov r9, qword [rdi + 0x1ec0]
sub r9, qword [rdi + 0x1eb8]
add r9, 2
mov edx, 0x3c
call fcn.14020bee0
mov rax, qword [rdi + 0x1eb8]
lea rcx, [rax + 1]
mov qword [rdi + 0x1eb8], rcx
movzx eax, byte [rax]
cmp eax, 0x27
je 0x14020bad1
cmp eax, 0x23
je 0x14020bbbb
cmp eax, 0x18
jne 0x14020bcd8
add rdi, 0x1c08
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov r14, rax
lea rbx, [rax + 4]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x48], 0xf0
mov dword [rsp + 0x40], 0xff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x18
jmp 0x14020bbf7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x27
mov dword [rsp + 0x20], 0xfa
lea r8, str._c_c_c_c
lea rcx, [rsp + 0x50]
mov ebx, 0x800
mov edx, 0x800
mov r9d, 0xff
call fcn.1401ac550
mov rbp, qword [rdi + 0x1cb0]
mov edi, 4
test rbp, rbp
je 0x14020bc66
lea r14, str._c_s
lea r15, str._c_.s_c_s
jmp 0x14020bb75
mov r8d, eax
sub r8d, r12d
mov edx, 0x800
sub rdx, rdi
inc rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r8d
mov dword [rsp + 0x30], 1
mov r8, r15
xor r9d, r9d
call fcn.1401ac550
cdqe
add rdi, rax
mov rbp, qword [rbp + 8]
test rbp, rbp
je 0x14020bc66
mov r12, qword [rbp]
mov rcx, r12
call sub.msvcrt.dll_strlen
add rax, rdi
inc rax
cmp rax, 0x7f9
ja 0x14020bb68
mov rcx, r12
mov edx, 0x2c
call sub.msvcrt.dll_strchr
lea rcx, [rsp + rdi]
add rcx, 0x50
test rax, rax
jne 0x14020bb30
mov edx, 0x800
sub rdx, rdi
mov qword [rsp + 0x20], r12
mov r8, r14
jmp 0x14020bb5b
add rdi, 0x1c28
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov r14, rax
lea rbx, [rax + 4]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x48], 0xf0
mov dword [rsp + 0x40], 0xff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x23
mov dword [rsp + 0x20], 0xfa
lea r8, str._c_c_c_c_s_c_c
lea rdi, [rsp + 0x50]
mov edx, 0x800
mov rcx, rdi
mov r9d, 0xff
call fcn.1401ac550
mov rcx, qword [r13 + 0x1a8]
add r14d, 6
mov rdx, rdi
mov r8d, r14d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14020bc54
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140195520
lea r8, [rsp + 0x52]
mov rcx, rsi
mov edx, 0x3e
mov r9, rbx
jmp 0x14020bcd3
lea rcx, [rsp + rdi]
add rcx, 0x50
sub rbx, rdi
mov dword [rsp + 0x20], 0xf0
lea r8, str._c_c
mov rdx, rbx
mov r9d, 0xff
call fcn.1401ac550
mov rcx, qword [r13 + 0x1a8]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14020bcc3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140195520
lea r8, [rsp + 0x52]
mov rcx, rsi
mov edx, 0x3e
mov r9, rdi
call fcn.14020bee0
nop
add rsp, 0x858
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14020bcf0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1f
jne 0x14020be5e
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rdi, qword [rcx + 0x1a0]
lea r12, [rdi + 0x1eb8]
mov word [rdi + 0x1cb8], 0xfaff
lea rbx, [rdi + 0x1cbb]
mov qword [rdi + 0x1eb8], rbx
mov byte [rdi + 0x1cba], 0x1f
movzx ecx, word [rdi + 0x1ca8]
mov r14, qword [sym.imp.WS2_32.dll_htons]
call r14
mov ebp, eax
movzx ecx, word [rdi + 0x1caa]
call r14
mov r9, qword [rdi + 0x1eb8]
cmp r9, r12
jb 0x14020be6e
cmp r9, r12
jb 0x14020be86
cmp r9, r12
jb 0x14020bea1
cmp r9, r12
jb 0x14020beb9
cmp r9, r12
jae 0x14020bd97
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xff
mov r9, qword [r12]
lea r14, [rdi + 0x1cb8]
lea r8, [rdi + 0x1cba]
cmp r9, r12
jae 0x14020bdba
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xf0
mov r9, qword [r12]
mov qword [rdi + 0x1ec0], r9
mov qword [rdi + 0x1eb8], r14
sub r9, r14
add r9, 0xfffffffffffffffe
mov rcx, rsi
mov edx, 0x3e
call fcn.14020bee0
mov rcx, qword [r15 + 0x1a8]
mov rdx, r14
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14020be11
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140195520
mov r8d, 4
mov rcx, rsi
mov rdx, rbx
call fcn.14020b540
mov rcx, qword [r15 + 0x1a8]
add rdi, 0x1cbf
mov rdx, rdi
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14020be5e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140195520
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x14020bd70
shr ebp, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x14020bd79
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x14020bd82
shr eax, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jb 0x14020bd87
jmp 0x14020bd97
Function at 0x140214570
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x38]
call fcn.1401a97e0
mov rcx, rdi
call sub.msvcrt.dll__strdup
mov rdi, rax
mov rcx, rsi
call sub.msvcrt.dll__strdup
mov rsi, rax
mov rcx, rdi
mov rdx, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.DLL_MoveFileExA]
test eax, eax
jne 0x140214620
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x20]
mov r15, qword [sym.imp.KERNEL32.DLL_Sleep]
mov r12, qword [sym.imp.KERNEL32.DLL_MoveFileExA]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1401a97e0
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.1401a9880
cmp rax, 0x3e9
jae 0x14021464c
mov ecx, 1
call r15
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call r12
test eax, eax
je 0x1402145e0
test rdi, rdi
je 0x14021462d
mov rcx, rdi
call fcn.140257dd0
xor edi, edi
test rsi, rsi
je 0x14021463c
mov rcx, rsi
call fcn.140257dd0
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test rdi, rdi
je 0x140214659
mov rcx, rdi
call fcn.140257dd0
mov edi, 1
test rsi, rsi
jne 0x140214634
jmp 0x14021463c

Function at 0x1402193e0
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov dword [rsp + 0x3c], 0x4020
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
mov eax, dword [0x1402d7294]
cmp eax, 2
je 0x14021949c
mov rsi, rcx
test eax, eax
jne 0x14021944a
mov dword [rsp + 0x20], 3
mov ecx, 6
xor edx, edx
xor r8d, r8d
mov r9d, 2
call fcn.1401ed150
test al, al
je 0x140219440
mov dword [0x1402d7294], 2
jmp 0x14021949c
mov dword [0x1402d7294], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14021947b
cmp dword [rsp + 0x34], 0x4020
jg 0x14021949c
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rsi
ret
Function at 0x14021a470
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rsi, rdx
mov rdi, qword [rcx + 0x10]
mov dword [rsp + 0x2c], 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov rcx, qword [rdi + 0x98]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14021a4fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
call fcn.1401f8a10
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x14021a54a
mov edx, dword [rsp + 0x2c]
lea r8, [rdi + 0xd4]
add rdi, 0x104
lea rcx, [rsp + 0x30]
mov r9, rdi
call fcn.1401a7ec0
test al, al
jne 0x14021a558
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
mov edi, dword [rax]
call rbx
mov ecx, dword [rax]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
call fcn.1401f8a10
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, rsi
mov r8d, edi
mov r9, rax
call fcn.140195520
nop
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14021b0b0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov eax, dword [rcx + 0xa8c]
shr eax, 9
and eax, 1
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x54]
mov rcx, rdx
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x14021b18c
mov dword [rsp + 0x58], 1
mov ecx, dword [rdi + 0xa14]
call fcn.1401a1dd0
imul eax, eax, 0x3e8
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x5c], eax
mov ecx, dword [rdi + 0xa18]
call fcn.1401a1dd0
imul eax, eax, 0x3e8
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x60], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x58]
mov rcx, rsi
mov edx, 0x98000004
mov r9d, 0xc
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14021b19e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
mov rcx, rdi
mov r8d, esi
mov r9d, eax
call fcn.1401955d0
jmp 0x14021b19e
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d
mov rcx, rdi
mov r8, rsi
call fcn.1401955d0
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x140243500
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
call fcn.140244d10
mov ecx, dword [0x1402d6550]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
jne 0x140243630
call fcn.140245260
mov rsi, rax
xor eax, eax
cmp qword [0x140287968], 0
je 0x140243630
test rsi, rsi
je 0x140243630
mov dword [rsi + 0x44], 1
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [rsi + 0x70], eax
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
lea rcx, [rsi + 0x68]
call fcn.140250cd0
cmp eax, 1
je 0x140243644
mov qword [rsi + 0x68], 0xffffffffffffffff
mov dword [rsi + 0xb8], 0
mov rdi, rsi
add rdi, 0x28
mov qword [rsi + 0x28], 0
mov r15, qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
call r15
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov r14, rax
call r15
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r8, rax
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x14024363f
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov dword [rsi + 0xc0], eax
mov dword [rsi + 0xbc], 0
mov eax, dword [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov dword [rsi + 0x40], eax
mov ecx, dword [0x1402d6550]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov ecx, eax
mov rax, rsi
test ecx, ecx
je 0x14024363f
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call sub.msvcrt.dll_abort
movups xmm0, xmmword [0x14028655b]
movups xmmword [rsp + 0x9b], xmm0
movaps xmm0, xmmword [0x140286550]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x140286540]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x140286530]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140286520]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140286510]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea rdx, [rsp + 0x67]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.msvcrt.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp byte [rsp + rcx + 0x40], 0
je 0x1402436d2
cmp rcx, 0x6a
jb 0x1402436bf
cmp rcx, 0x69
ja 0x1402436df
mov word [rsp + rax + 0x3f], 0xa
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call sub.msvcrt.dll_abort
int3
Function at 0x1402441d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140243500
mov rdi, rax
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
call fcn.140243ef0
test byte [rdi + 0x40], 0x30
jne 0x14024420c
add rdi, 0xd0
mov rcx, rdi
mov edx, 1
call qword [sym.imp.msvcrt.dll_longjmp]
mov ecx, dword [0x1402d6550]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x1402442a7
mov rdi, rax
cmp qword [rax + 0x28], 0
jne 0x14024424e
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x140244240
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi + 0x30], 0
mov rsi, qword [rdi + 8]
jmp 0x140244291
mov rsi, qword [rdi + 8]
mov rcx, qword [rdi + 0x30]
mov dword [rdi + 0xbc], 1
test rcx, rcx
je 0x14024426b
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi + 0x30], 0
test byte [rdi + 0x44], 4
je 0x1402442a7
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi + 0x28], 0
mov rcx, rdi
call fcn.1402442b0
mov ecx, dword [0x1402d6550]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
int3

Function at 0x140244d10
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x1402d6804], 1
jne 0x140244d26
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402d6558]
call fcn.140250ce0
mov rcx, qword [0x1402d6828]
test rcx, rcx
je 0x140244d63
lea rax, [0x1402d6804]
nop word cs:[rax + rax]
mov rsi, rcx
cmp qword [rcx], rax
je 0x140244dad
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x140244d50
jmp 0x140244d65
xor esi, esi
mov ecx, 1
mov edx, 0x20
call sub.msvcrt.dll_calloc
mov rdi, rax
lea rax, [0x1402d6804]
mov qword [rdi], rax
mov dword [rdi + 0x10], 1
lea rax, [rsi + 0x18]
test rsi, rsi
lea rcx, [0x1402d6828]
cmovne rcx, rax
mov qword [rcx], rdi
lea rcx, [rdi + 8]
xor edx, edx
call fcn.1401ed5b0
mov rsi, rdi
jmp 0x140244db0
inc dword [rsi + 0x10]
lea rcx, [0x1402d6558]
call fcn.140250d20
lea rdi, [rsi + 8]
mov rcx, rdi
call fcn.1401ed330
mov eax, dword [0x1402d6804]
cmp eax, 1
je 0x140244e1c
test eax, eax
jne 0x140244df4
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov dword [0x1402d6550], eax
cmp eax, 0xffffffff
je 0x140244e32
mov dword [0x1402d6804], 1
jmp 0x140244e1c
mov ecx, 2
call qword [fcn.14009dfe0]
mov r9d, dword [0x1402d6804]
lea r8, [0x1402d6804]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rcx, rdi
call fcn.1401ed4a0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140243a70
call sub.msvcrt.dll_abort
int3
Function at 0x140245310
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x90
test rcx, rcx
je 0x140245331
mov rsi, rcx
call fcn.140250cd0
cmp eax, 1
je 0x14024533a
mov qword [rsi], 0xffffffffffffffff
add rsp, 0x90
pop rsi
ret
movups xmm0, xmmword [0x14028655b]
movups xmmword [rsp + 0x7b], xmm0
movaps xmm0, xmmword [0x140286550]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140286540]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140286530]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140286520]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x140286510]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.msvcrt.dll__ultoa]
mov eax, 0x27
nop dword [rax]
mov rcx, rax
inc rax
cmp byte [rsp + rcx + 0x20], 0
je 0x1402453c3
cmp rcx, 0x6a
jb 0x1402453b0
cmp rcx, 0x69
ja 0x1402453d0
mov word [rsp + rax + 0x1f], 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call sub.msvcrt.dll_abort
int3