joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140120e40
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x68]
xor eax, eax
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov r8d, 1
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x68], eax
call qword [sym.imp.WS2_32.dll_WSASend]
call fcn.14004cfa0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x140120ea0
cmp eax, 0x4d2
jne 0x140120ea5
call fcn.14004cfa0
add rsp, 0x58
ret

Function at 0x1401216f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14032aa00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 8]
xor ebp, ebp
mov dword [rsp + 0x58], ebp
xorps xmm0, xmm0
mov qword [rsp + 0x40], 2
mov rsi, r8
mov rdi, rdx
movdqu xmmword [rsp + 0x48], xmm0
cmp rcx, 0xffffffffffffffff
jne 0x140121745
mov dword [rsp + 0x30], 0x2719
call fcn.14004cfa0
mov qword [rsp + 0x38], rax
jmp 0x1401217ae
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, dword [rsp + 0x20]
test eax, eax
jne 0x14012178d
mov dword [rsi], ebp
cmp rcx, 0x80
ja 0x1401217e2
movups xmm0, xmmword [rsp + 0x40]
mov eax, dword [rsp + 0x58]
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov dword [rdi + 0x18], eax
jmp 0x1401217c8
mov qword [rsp + 0x70], rbx
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x70]
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
mov dword [rdi + 0x18], ebp
mov qword [rdi], 2
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401ae6a0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x30], 0x2726
call fcn.14004cfa0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14011acf0
int3
Function at 0x140121810
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14032aa00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [r8]
xor ebp, ebp
mov dword [rsp + 0x58], ebp
xorps xmm0, xmm0
mov qword [rsp + 0x40], 2
mov rsi, r9
mov rdi, rdx
movdqu xmmword [rsp + 0x48], xmm0
cmp rcx, 0xffffffffffffffff
jne 0x140121864
mov dword [rsp + 0x30], 0x2719
call fcn.14004cfa0
mov qword [rsp + 0x38], rax
jmp 0x1401218cd
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, dword [rsp + 0x20]
test eax, eax
jne 0x1401218ac
mov dword [rsi], ebp
cmp rcx, 0x80
ja 0x140121901
movups xmm0, xmmword [rsp + 0x40]
mov ecx, dword [rsp + 0x58]
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov dword [rdi + 0x18], ecx
jmp 0x1401218e7
mov qword [rsp + 0x70], rbx
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x70]
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
mov dword [rdi + 0x18], ebp
mov qword [rdi], 2
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401ae6a0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x30], 0x2726
call fcn.14004cfa0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14011acf0
int3
Function at 0x140121fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
mov r9, qword [rcx + 8]
mov r11, rdx
mov eax, dword [rdx]
mov rcx, qword [rcx]
mov dword [rsp], eax
cmp r9, 4
jb 0x140121ff6
movzx edx, byte [rsp + 3]
mov r10, r9
movzx ebx, byte [rsp + 1]
shr r10, 2
imul r8, r10, 0xfffffffffffffffc
add r9, r8
movzx r8d, byte [rsp + 2]
nop dword [rax]
xor byte [rcx], al
xor byte [rcx + 1], bl
xor byte [rcx + 2], r8b
xor byte [rcx + 3], dl
add rcx, 4
sub r10, 1
jne 0x140121fe0
test r9, r9
je 0x140122176
xor r8d, r8d
cmp r9, 8
jb 0x140122104
lea rdx, [rcx - 1]
add rdx, r9
lea rax, [rsp + r9 - 1]
cmp rcx, rax
ja 0x14012202a
lea rax, [rsp]
cmp rdx, rax
jae 0x140122104
cmp r9, 0x40
jb 0x1401220c4
mov rdx, r9
mov qword [rsp + 0x28], rdi
and edx, 0x3f
mov r10, r9
sub r10, rdx
lea rbx, [rsp]
sub rbx, rcx
lea rdi, [rsp + 0x10]
sub rdi, rcx
lea rax, [rcx + 0x20]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
add r8, 0x40
movdqu xmm1, xmmword [rbx + rax - 0x20]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
movdqu xmm1, xmmword [rdi + rax - 0x60]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rbx + rax - 0x40]
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm2, xmmword [rax - 0x40]
xorps xmm2, xmm0
movdqu xmm0, xmmword [rdi + rax - 0x40]
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm1, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp r8, r10
jb 0x140122060
mov rdi, qword [rsp + 0x28]
cmp rdx, 8
jb 0x1401220ff
mov rdx, r9
and rdx, 0xfffffffffffffff8
lea r10, [rsp]
sub r10, rcx
lea rax, [r8 + rcx]
nop word [rax + rax]
movq xmm0, qword [rax]
add r8, 8
movq xmm1, qword [rax + r10]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r8, rdx
jb 0x1401220e0
cmp r8, r9
jae 0x140122131
lea rdx, [r8 + rcx]
lea r10, [rsp]
sub r10, rcx
mov rcx, r9
sub rcx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x140122120
mov eax, dword [r11]
mov dword [rsp + 0x20], eax
mov rax, r9
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [r11], al
lea rax, [r9 + 1]
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [r11 + 1], al
lea rax, [r9 - 2]
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [r11 + 2], al
lea rax, [r9 - 1]
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [r11 + 3], al
add rsp, 0x10
pop rbx
ret
Function at 0x140125e20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov rax, qword [rcx]
mov rcx, qword [rax]
mov edx, r15d
mov r9d, r15d
test rcx, rcx
je 0x140125e7e
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r9, qword [rax]
mov qword [r14], r9
mov rdx, qword [rax + 8]
mov qword [r14 + 8], rdx
mov rax, qword [rbx]
mov qword [rax], r15
cmp rbp, rdx
ja 0x140125e94
xor edx, edx
mov rax, r9
div rsi
test rdx, rdx
je 0x140125fd7
mov ebx, 6
test r9, r9
je 0x140125eef
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140125eb5
mov rdx, qword [rax + 8]
jmp 0x140125eb8
mov rdx, r15
mov r9, qword [r14 + 8]
mov r8, qword [r14]
cmp r9, 0x3fc
ja 0x140125ee7
test rdx, rdx
je 0x140125ee7
mov ecx, ebx
mov rax, rbx
cmp qword [rdx + rax*8], r15
je 0x140125f5b
inc ecx
inc rax
cmp rax, 8
jl 0x140125ed2
mov rcx, r8
call fcn.1401c23c4
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rbp + 3]
shr rdi, 2
test rax, rax
je 0x140125f84
mov r10, qword [rax + 8]
test r10, r10
je 0x140125f84
mov r8d, ebx
lea r9, [r10 + 0x30]
mov rcx, qword [r9]
test rcx, rcx
je 0x140125f35
movzx eax, byte [rcx]
cmp rax, rdi
jb 0x140125f35
xor edx, edx
mov rax, rcx
div rsi
test rdx, rdx
je 0x140125f6c
inc r8d
add r9, 8
cmp r8d, 8
jl 0x140125f18
mov rax, rbx
mov rcx, qword [r10 + rax*8]
test rcx, rcx
jne 0x140125f78
inc ebx
inc rax
cmp rax, 8
jl 0x140125f45
jmp 0x140125f84
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x140125eef
movsxd rax, r8d
mov qword [r10 + rax*8], r15
movzx eax, byte [rcx]
jmp 0x140125fcd
movsxd rax, ebx
mov qword [r10 + rax*8], r15
call fcn.1401c23c4
lea rcx, [rdi*4 + 1]
mov eax, select
cmp rsi, rax
cmovb rsi, rax
xor edx, edx
mov rax, rcx
div rsi
test rdx, rdx
je 0x140125fae
mov rax, rsi
sub rax, rdx
add rcx, rax
mov rdx, rsi
call fcn.1401c23e0
mov rcx, rax
test rax, rax
je 0x140125ff3
movzx eax, dil
cmp rdi, 0xff
cmova eax, r15d
mov byte [rcx + rbp], al
mov qword [r14], rcx
mov qword [r14 + 8], rbp
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.1400d78a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400d01a0
int3
Function at 0x140126870
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r9
movzx ecx, word [rcx + 8]
mov rsi, rdx
cmp cx, word [rdi + 0xa]
jb 0x1401268b5
mov rdx, qword [rdi]
sub rdx, r8
mov r8, rbx
add rdx, rcx
mov rcx, rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401e4900
xor edx, edx
mov qword [rsp + 0x30], r14
movzx r14d, word [rdi + 0xc]
mov eax, r14d
sub rax, r8
add rax, rcx
mov rcx, rsi
div r14
sub r14, rdx
add rdx, qword [rdi]
cmp rbx, r14
jbe 0x1401268ed
mov r8, r14
call fcn.1401e4900
mov rdx, qword [rdi]
lea rcx, [r14 + rsi]
sub rbx, r14
mov r8, rbx
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401e4900

Function at 0x140126f90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov dword [r11 + 0x18], r9d
mov qword [r11 - 0x28], rsi
lea rax, [r11 + 0x18]
mov qword [r11 - 0x30], rsi
lea r9, [r11 + 0x20]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x78], esi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call fcn.14004cfa0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x80]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
mov ecx, dword [rbx]
cmp ecx, 0x40
jne 0x140126ffe
mov dword [rsp + 0x40], 0x2746
jmp 0x14012700e
cmp ecx, 0x4d2
jne 0x140127022
mov dword [rsp + 0x40], 0x274d
call fcn.14004cfa0
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
jmp 0x140127032
cmp ecx, 0x2738
je 0x14012704b
cmp ecx, 0xea
je 0x14012704b
test edi, edi
je 0x14012704b
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x78]
mov dword [rbx], esi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1401278e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14012793d
mov rbx, qword [rbx + 0x48]
test rbx, rbx
je 0x140127935
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140127930
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140127930
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140127986
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140127976
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140127976
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140127991
inc ecx
inc rax
cmp rax, 2
jl 0x140127964
mov rcx, rbx
call fcn.1401c23c4
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x58]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1401279c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x140127a1d
mov rbx, qword [rbx + 0x50]
test rbx, rbx
je 0x140127a15
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140127a10
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140127a10
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140127a66
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140127a56
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140127a56
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140127a71
inc ecx
inc rax
cmp rax, 2
jl 0x140127a44
mov rcx, rbx
call fcn.1401c23c4
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x60]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140127b30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x140127b8d
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x140127b85
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140127b80
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140127b80
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140127bd6
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140127bc6
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140127bc6
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140127be1
inc ecx
inc rax
cmp rax, 2
jl 0x140127bb4
mov rcx, rbx
call fcn.1401c23c4
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x50]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x140128aa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140128acf
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140128ac7
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140128b18
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128b08
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140128b08
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140128b23
inc ecx
inc rax
cmp rax, 2
jl 0x140128af6
mov rcx, rbx
call fcn.1401c23c4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140128b50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x140128bb6
lea rcx, [rbx + 0x20]
call fcn.1400df690
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140128bae
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140128ba9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140128ba9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140128c02
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128bf2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140128bf2
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140128c0d
inc ecx
inc rax
cmp rax, 6
jl 0x140128be0
mov rcx, rbx
call fcn.1401c23c4
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x140128c30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x140128c96
lea rcx, [rbx + 0x20]
call fcn.1400df840
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140128c8e
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140128c89
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140128c89
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140128ce2
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128cd2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140128cd2
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140128ced
inc ecx
inc rax
cmp rax, 6
jl 0x140128cc0
mov rcx, rbx
call fcn.1401c23c4
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0xd0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140128d10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140128d37
add rcx, 8
call fcn.1400df420
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140128d83
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128d73
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140128d73
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140128d8e
inc ecx
inc rax
cmp rax, 6
jl 0x140128d61
mov rcx, rbx
call fcn.1401c23c4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x220]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140128dc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140128de7
add rcx, 8
call fcn.1400df4a0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140128e33
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128e23
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140128e23
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140128e3e
inc ecx
inc rax
cmp rax, 6
jl 0x140128e11
mov rcx, rbx
call fcn.1401c23c4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1f8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140128e70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140128e97
add rcx, 0x10
call fcn.1400dcbe0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140128ee3
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128ed3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140128ed3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140128eee
inc ecx
inc rax
cmp rax, 6
jl 0x140128ec1
mov rcx, rbx
call fcn.1401c23c4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x98]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1401291a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x140129203
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1401291d7
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1401291d7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, [rbx + 0x40]
cmp byte [rcx + 0x38], 0
je 0x1401291f2
cmp qword [rcx + 0x20], 0
je 0x1401291f2
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x18]
call fcn.1400dc360
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140129252
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140129242
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140129242
mov ecx, 4
mov eax, ecx
nop dword [rax]
cmp qword [rdx + rax*8], 0
je 0x14012925d
inc ecx
inc rax
cmp rax, 6
jl 0x140129230
mov rcx, rbx
call fcn.1401c23c4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xe0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140129280
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1401292c5
lea rcx, [rbx + 0x108]
cmp byte [rcx + 0x38], 0
je 0x1401292b4
cmp qword [rcx + 0x20], 0
je 0x1401292b4
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x10]
call fcn.1400df300
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140129312
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140129302
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140129302
mov ecx, 4
mov eax, ecx
nop
cmp qword [rdx + rax*8], 0
je 0x14012931d
inc ecx
inc rax
cmp rax, 6
jl 0x1401292f0
mov rcx, rbx
call fcn.1401c23c4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x180]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret