joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f41d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov qword [rsp + 0x50], rdx
mov r14, rcx
mov qword [rsp + 0x48], r8
mov rcx, r8
call fcn.14006f6db
mov rbx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rdi, [rsp + 0x92]
lea rsi, [rsp + 0x42]
lea r13, [r14 + 0x10]
xor eax, eax
cmp qword [r14 + 0x10], 0xffffffffffffffff
cmove r13, rax
mov ebp, 0x7fffffff
cmp rdx, rbp
cmovb rbp, rdx
lea r15, [rsp + 0x88]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov rdx, qword [r14 + 8]
mov rcx, r15
mov r8, qword [rsp + 0x50]
xor r9d, r9d
call fcn.1400d3ca9
mov al, byte [rsp + 0x91]
cmp al, 3
je 0x14006f5cc
mov r12, qword [rsp + 0x88]
cmp al, 2
je 0x14006f5f2
mov cl, byte [rsp + 0x90]
movzx edx, word [rdi + 4]
mov word [rsi + 4], dx
mov edx, dword [rdi]
mov dword [rsi], edx
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x41], al
mov rcx, r13
lea rdx, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.38.0_src_io_poll_evented.rs
call fcn.1400d2f50
mov rcx, qword [r13]
mov rdx, rbx
mov r8d, ebp
xor r9d, r9d
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x14006f5d3
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x274a
je 0x14006f5e4
mov r12d, eax
shl r12, 0x20
or r12, 2
mov rcx, r12
call fcn.140019bd4
cmp al, 0xd
jne 0x14006f59e
mov rax, qword [r13 + 8]
test rax, rax
je 0x14006f59e
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x14006f649
mov r14, rbx
mov r13, rsi
mov rbx, rdi
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.140037f5b
mov rdi, rax
xor ecx, ecx
call fcn.140039499
test rdi, rdi
je 0x14006f58b
mov ecx, 1
mov rdx, r12
call fcn.1400380f7
mov r12, rdi
mov rdi, rbx
mov rsi, r13
mov rbx, r14
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rcx, r12
call fcn.1400ce434
cmp al, 0xd
jne 0x14006f5f2
mov qword [rsp + 0x88], r12
mov rcx, r14
lea rdx, [rsp + 0x38]
call fcn.1400d3bd0
mov rcx, r15
call fcn.1400ce1fc
jmp 0x14006f494
mov edi, 1
jmp 0x14006f5f4
cdqe
test rax, rax
je 0x14006f5e8
mov qword [rsp + 0x80], rax
jmp 0x14006f5ea
xor eax, eax
jmp 0x14006f5ea
jne 0x14006f64d
mov qword [rsp + 0x78], rax
xor r12d, r12d
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
test rdi, rdi
jne 0x14006f62f
test r12, r12
jne 0x14006f62f
lea rcx, [rsp + 0x68]
call fcn.14006784c
mov rsi, rdx
lea rcx, [rsp + 0x58]
call fcn.1400678ab
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.14006f6f2
xor r12d, r12d
mov rax, rdi
mov rdx, r12
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rax, [0x14011f6a8]
lea rcx, [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x140145a70]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.38.0_src_io_poll_evented.rs
call fcn.140009fc0
ud2
Function at 0x14006fc0e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rcx, r8
call fcn.14006f6db
lea rcx, [rsp + 0x50]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
mov qword [rdi + 0x50], rbx
call fcn.14006fb06
mov rbx, rax
mov r14, rdx
lea r15, [rsp + 0x28]
mov rcx, rdi
call fcn.14006fba7
test rdx, rdx
jne 0x14006f9a5
mov rcx, r15
mov rdx, rdi
call fcn.14006e038
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x14006fa3a
test eax, eax
je 0x14006f9a5
cmp qword [rdi + 0xf0], 0
je 0x14006f988
mov rcx, r15
mov rdx, rdi
call fcn.14006ef11
cmp qword [rsp + 0x28], 0
jne 0x14006fa3a
cmp qword [rsp + 0x30], 0
je 0x14006f9a5
and qword [rdi + 0xf0], 0
mov rcx, r15
mov rdx, rdi
call fcn.14006f203
cmp byte [rsp + 0x28], 0
jne 0x14006fa3a
cmp byte [rsp + 0x29], 0
je 0x14006f92e
mov rcx, rdi
call fcn.14006fba7
mov r13, rax
mov r15, rdx
test rax, rax
je 0x14006fa3f
cmp r14, r15
mov r12, r15
cmovb r12, r14
lea r9, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, r12
mov rdx, rbx
mov r8, r14
call fcn.14006ee7e
mov rbx, rax
mov r14, rdx
lea r9, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, r13
mov rdx, r15
mov r8, r12
call fcn.140050105
mov r9, rdx
lea rcx, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.140036ddd
mov rax, qword [rdi + 0x70]
add rax, r12
cmp rax, qword [rdi + 0x68]
ja 0x14006fabf
mov qword [rdi + 0x70], rax
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.14006fb73
xor r15d, r15d
jmp 0x14006fa68
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov rcx, r15
call fcn.140019bd4
cmp al, 0xd
jne 0x14006fa68
and qword [rdi + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14003d54b
mov edi, 1
xor eax, eax
jmp 0x14006fa71
and qword [rdi + 0x50], 0
mov al, 1
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
test al, al
je 0x14006faa9
test r15, r15
jne 0x14006faa9
lea rcx, [rsp + 0x50]
call fcn.14006784c
mov rbx, rdx
lea rcx, [rsp + 0x40]
call fcn.1400678ab
mov rcx, rsi
mov rdx, rbx
call fcn.14006f6f2
xor r15d, r15d
mov rax, rdi
mov rdx, r15
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
lea r8, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov edx, 0x3b
call fcn.14000ae60
ud2
cmp dword [rcx], 2
jne 0x14006f8e7
add rcx, 8
jmp fcn.14006f41d
Function at 0x14007157f
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x190]
mov rcx, qword [rdx + 0x178]
mov rdx, qword [rdx + 0x188]
lea r9, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
call fcn.14006ee0c
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1b8]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x140071662
test eax, eax
je 0x140071681
cmp eax, 0x90317
je 0x140071702
cmp eax, 0x90321
jne 0x14007170a
mov dword [rdi + 0x138], 0x10000
xor ebx, ebx
mov byte [rdi + 0x13c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x190]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14007151f
and qword [rdi + 0x1f0], 0
mov byte [rsi + 1], bl
jmp 0x140071718
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f0], rax
mov byte [rsi + 1], 0
jmp 0x140071706
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x178]
mov rdx, qword [rdi + 0x188]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x158]
and qword [rdi + 0x168], 0
call fcn.14006f38e
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.140007d9e
and qword [rdi + 0x170], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x190]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14007151f
xor eax, eax
cmp qword [rdi + 0x190], rbx
sete al
mov qword [rdi + 0x1f0], rax
mov byte [rsi + 1], 0
jmp 0x140071718
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140071718
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008daf5
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x58]
mov r8d, 0xb
mov rdx, rax
call fcn.14008dc4c
mov dword [rsp + 0x38], 0x800
and dword [rsp + 0x3c], 0
mov ecx, 0x800
xor edx, edx
call fcn.140008aaf
lea r15, [rsp + 0x40]
mov qword [r15], rax
mov qword [r15 + 8], rdx
and qword [r15 + 0x10], 0
mov rsi, qword [rsp + 0x58]
lea r13, [rsp + 0x38]
lea r12, [rsp + 0x3c]
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
mov r9, r12
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14008db8e
mov edx, dword [rsp + 0x38]
mov rcx, r15
call fcn.140007c41
jmp 0x14008db59
test eax, eax
jne 0x14008dbb0
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14008dbce
movabs rax, 0xde00000002
jmp 0x14008dbb8
shl rax, 0x20
or rax, 2
mov qword [rdi], rax
mov byte [rdi + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, r14
call fcn.140008b0b
jmp 0x14008dbe2
mov rcx, qword [rsp + 0x50]
mov qword [rdi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
mov byte [rdi + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400e0ba2
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140092f30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.14000a550
cmp rax, rcx
je 0x140092f55
cmp rdx, 4
jae 0x140092f58
xor r8d, r8d
xor eax, eax
jmp 0x140092ff0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400e59d0]
movdqa xmm3, xmmword [0x1400e59e0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140092f80
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140093007
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140092ff0
ret
Function at 0x140093f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x140093feb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x140093feb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x140094006
cmp eax, 0x42
jne 0x140093feb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1400940b6
cmp byte [r9 + r11], 0x5f
jne 0x1400940b6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14009411e
mov rcx, rsi
xor edx, edx
call fcn.14008f9a0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14008f9a0
test al, al
jne 0x1400941b1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140094042
lea rdx, [0x14011a0ab]
mov r8d, 1
call fcn.14000ab40
test al, al
jne 0x1400941b1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x140093ffa
xor r14d, r14d
lea rbx, [0x14011a460]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140094074
cmp byte [rax + rcx], 0x45
je 0x1400941d3
sub r14, 1
jb 0x140094099
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140094099
mov r8d, 2
mov rdx, rbx
call fcn.14000ab40
test al, al
jne 0x1400941b1
mov rcx, rsi
call fcn.1400911a0
test al, al
jne 0x1400941b1
mov rax, qword [rsi]
test rax, rax
jne 0x140094060
jmp 0x140093ffa
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x140094178
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140094112
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400940fc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400940eb
add dl, 0xa9
jmp 0x1400940fa
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140094178
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140094178
movzx edx, bl
add rax, rdx
jae 0x1400940c0
jmp 0x140094178
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140094178
cmp rax, rcx
jae 0x140094175
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1400941cb
cmp qword [rsi + 0x20], 0
je 0x1400941c4
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140093f90
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140093ffc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400941b9
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x14011a420]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.14000ab40
test al, al
je 0x1400941b9
mov dil, 2
jmp 0x140093ffa
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x140093ffa
mov dil, 1
xor r8d, r8d
jmp 0x14009417a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x140093ffa
Function at 0x140096778
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x88], 4
mov dword [rsp + 0xd0], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400967dd
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0xb0], edx
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14009681a
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x14009680f
xor r9d, r9d
lea r10, [0x1401464c8]
xor r8d, r8d
movzx r11d, byte [rax + r9]
or r8d, dword [r10 + r11*4]
inc r9
cmp rdx, r9
jne 0x1400967fc
jmp 0x140096812
xor r8d, r8d
mov dword [rsp + 0xc0], r8d
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x14009686a
mov rax, rsi
shr rax, 0x3c
jne 0x14009692c
mov r14, qword [rcx]
lea rbx, [rsi*8]
mov ecx, 8
mov rdx, rbx
call fcn.140007d74
test rax, rax
je 0x140096933
mov rdi, rax
xor eax, eax
mov rcx, qword [r14 + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp rsi, rax
jne 0x140096856
mov eax, esi
jmp 0x140096871
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x88]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.Secur32.dll_AcquireCredentialsHandleA
mov ebx, eax
test eax, eax
je 0x1400968ca
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x14009690e
movaps xmm0, xmmword [rsp + 0x50]
mov eax, 1
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x78], xmm0
mov ecx, 8
mov edx, 0x20
call fcn.140007d74
test rax, rax
je 0x140096942
mov rbx, rax
movups xmm0, xmmword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor r14d, r14d
mov rcx, rdi
mov rdx, rsi
call fcn.1400ceedb
mov rax, r14
mov rdx, rbx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140006b20
ud2
mov ecx, 8
mov rdx, rbx
call fcn.140006b60
ud2
mov ecx, 8
mov edx, 0x20
call fcn.140006b60
ud2

Function at 0x14009701e
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call sub.Secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x140097047
mov rdx, qword [rsp + 0x20]
jmp 0x14009704f
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x14009764d
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140097679
xor eax, eax
jmp 0x14009767e
call fcn.140037435
nop
add rsp, 0x38
ret

Function at 0x140098b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov ecx, dword [0x1400e3168]
test ecx, ecx
je 0x140098c23
dec ecx
call fcn.1400e0e9c
cmp rax, 1
jbe 0x140098b64
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140098b64
add rdi, 0x10
jmp 0x140098c19
mov ecx, dword [0x1400e3168]
test ecx, ecx
je 0x140098c36
dec ecx
call fcn.1400e0e9c
cmp rax, 1
je 0x140098c17
mov rsi, rax
test rax, rax
jne 0x140098be7
mov qword [rsp + 0x30], 0
lea rax, [0x1400e3150]
mov qword [rsp + 0x28], rax
movzx eax, byte [0x1401661f8]
mov ecx, 0x20
mov edx, 8
call fcn.140006580
test rax, rax
je 0x140098c59
mov rsi, rax
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x1400e3168]
test ecx, ecx
je 0x140098c49
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
cmp qword [rsi + 8], 0
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 8], 1
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
je 0x140098c19
test rcx, rcx
je 0x140098c19
lock dec qword [rcx]
jne 0x140098c19
call fcn.140098ca0
jmp 0x140098c19
xor edi, edi
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
lea rcx, [0x1400e3150]
call fcn.140098ed0
mov ecx, eax
jmp 0x140098b46
lea rcx, [0x1400e3150]
call fcn.140098ed0
mov ecx, eax
jmp 0x140098b74
lea rcx, [0x1400e3150]
call fcn.140098ed0
mov ecx, eax
jmp 0x140098bdf
mov ecx, 8
mov edx, 0x20
call fcn.140006b60
ud2
Function at 0x140098ed0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140098f55
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140098f96
cmp dword [rsp + 0x2c], 0
je 0x140098f7a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140098fbe
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x140166168]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140166168], rsi
jne 0x140098f30
mov byte [0x140166160], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140098f8c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14009900a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140098f7f
mov edi, dword [rsp + 0x28]
jmp 0x140098f8c
mov edi, dword [rsi + 0x18]
jmp 0x140098f8a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x14011d5b0]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.140099070
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x140145a70]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140009fc0
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x140145a70]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1400990b0
ud2

Function at 0x140099730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1400e3188]
test ecx, ecx
je 0x1400997cf
dec ecx
call fcn.1400e0e9c
cmp rax, 1
jbe 0x140099759
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1400997be
mov ecx, dword [0x1400e3188]
test ecx, ecx
je 0x1400997e2
dec ecx
call fcn.1400e0e9c
cmp rax, 1
je 0x1400997c4
mov rsi, rax
test rax, rax
jne 0x1400997b8
movzx eax, byte [0x1401661f8]
mov ecx, 0x10
mov edx, 8
call fcn.140006580
test rax, rax
je 0x140099805
mov rsi, rax
lea rax, [0x1400e3170]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1400e3188]
test ecx, ecx
je 0x1400997f5
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1400997c6
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1400e3170]
call fcn.140098ed0
mov ecx, eax
jmp 0x140099745
lea rcx, [0x1400e3170]
call fcn.140098ed0
mov ecx, eax
jmp 0x140099765
lea rcx, [0x1400e3170]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400997b0
mov ecx, 8
mov edx, 0x10
call fcn.140006b60
ud2
Function at 0x14009a6e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1400e3148]
test ecx, ecx
je 0x14009a79d
dec ecx
call fcn.1400e0e9c
cmp rax, 1
jbe 0x14009a710
cmp qword [rax + 8], 0
je 0x14009a710
add rax, 0x10
jmp 0x14009a797
mov ecx, dword [0x1400e3148]
test ecx, ecx
je 0x14009a7b0
dec ecx
call fcn.1400e0e9c
cmp rax, 1
je 0x14009a795
mov rsi, rax
test rax, rax
jne 0x14009a77b
movzx eax, byte [0x1401661f8]
mov ecx, 0x20
mov edx, 8
call fcn.140006580
test rax, rax
je 0x14009a7d3
mov rsi, rax
lea rax, [0x1400e3130]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400e3148]
test ecx, ecx
je 0x14009a7c3
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x14009a797
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1400e3130]
call fcn.140098ed0
mov ecx, eax
jmp 0x14009a6f5
lea rcx, [0x1400e3130]
call fcn.140098ed0
mov ecx, eax
jmp 0x14009a720
lea rcx, [0x1400e3130]
call fcn.140098ed0
mov ecx, eax
jmp 0x14009a773
mov ecx, 8
mov edx, 0x20
call fcn.140006b60
ud2
Function at 0x1400ba4c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x1400e31a8]
test ecx, ecx
je 0x1400ba5b4
dec ecx
call fcn.1400e0e9c
cmp rax, 1
jbe 0x1400ba4f4
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400ba4f4
add rdi, 0x10
jmp 0x1400ba5aa
mov ecx, dword [0x1400e31a8]
test ecx, ecx
je 0x1400ba5c7
dec ecx
call fcn.1400e0e9c
cmp rax, 1
je 0x1400ba5a8
mov rsi, rax
test rax, rax
jne 0x1400ba577
mov qword [rsp + 0x28], 0
lea rax, [0x1400e3190]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x1401661f8]
mov ecx, 0x18
mov edx, 8
call fcn.140006580
test rax, rax
je 0x1400ba5ea
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x1400e31a8]
test ecx, ecx
je 0x1400ba5da
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400ba5aa
test rcx, rcx
je 0x1400ba5aa
lock dec qword [rcx]
jne 0x1400ba5aa
call fcn.1400ba620
jmp 0x1400ba5aa
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x1400e3190]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400ba4d6
lea rcx, [0x1400e3190]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400ba504
lea rcx, [0x1400e3190]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400ba56f
mov ecx, 8
mov edx, 0x18
call fcn.140006b60
ud2