joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cfd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx + 0x320]
test rcx, rcx
je 0x14002d16e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
imul r14, qword [rdi + 0x2e0], 0xf4240
mov rbp, qword [rdi + 0x1f8]
lea rsi, [rdi + 0x200]
lea rcx, [rsp + 0x70]
call fcn.14002cb30
mov rax, qword [rsp + 0x70]
test rax, rax
js 0x14002d03f
movabs rbx, 0x7fffffffffffffff
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jge 0x14002d054
jmp 0x14002d058
movabs rbx, 0x8000000000000000
mov rcx, rbx
sub rcx, rax
cmp r14, rcx
jl 0x14002d058
lea rbx, [r14 + rax]
cmp byte [rsi + 8], 0
je 0x14002d07a
lea r8, [rsi + 0x10]
lea rdx, [rbp + 0x28]
mov r9, 0xffffffffffffffff
mov rcx, qword [rbp + 0x58]
call fcn.14000bd40
mov byte [rsi + 8], 0
mov qword [rsi], rbx
mov qword [rsp + 0x70], rdi
mov rbp, qword [rdi + 0x1f8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r14d, r14d
test rax, rax
je 0x14002d0ad
mov rdx, qword [rax + 8]
jmp 0x14002d0b0
mov rdx, r14
mov r9d, 8
mov r8d, 0x90
movzx ecx, byte [rsp + 0x70]
call fcn.14000b3a0
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rax + 0x20], r14
lea rax, [0x140023780]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
mov dword [rbx + 0x38], r14d
lea rax, [0x1400d03d0]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], r14
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x50], rax
lea rcx, [rbx + 0x58]
lea r9, [rdi + 0x238]
xor r8d, r8d
xor edx, edx
call fcn.140012380
mov qword [rsp + 0x40], rbx
mov byte [rsi + 8], 1
lea r9, [rsi + 0x10]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rcx, qword [rbp + 0x58]
call fcn.14000f8d0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x30]
call fcn.1400308a0
nop
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x14002d670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d0580]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14002d69d
xor eax, eax
jmp 0x14002d806
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14002d6dd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14002d6dd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14002d7fe
cmp qword [rdi + 0x80], 0
je 0x14002d7f9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14002d717
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14002d742
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14002d7fe
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002d7b1
sub eax, 1
je 0x14002d7b1
cmp eax, 2
jne 0x14002d7f9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14002d7fe
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14002d7df
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14002d7f9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14002d7fe
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400897d0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140030200
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003025d
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x140030255
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140030250
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140030250
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400302a7
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030296
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030296
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400302b2
inc ecx
inc rax
cmp rax, 2
jl 0x140030284
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x50]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1400302e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003030f
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140030307
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140030359
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030348
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030348
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140030364
inc ecx
inc rax
cmp rax, 2
jl 0x140030336
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140030430
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003048d
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140030485
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140030480
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140030480
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400304da
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400304c9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400304c9
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400304e5
inc ecx
inc rax
cmp rax, 6
jl 0x1400304b7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1400305b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003060d
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140030605
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140030600
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140030600
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14003065a
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030649
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030649
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140030665
inc ecx
inc rax
cmp rax, 6
jl 0x140030637
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x38]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140030730
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030757
add rcx, 8
call fcn.1400160d0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400307a4
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030793
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030793
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400307af
inc ecx
inc rax
cmp rax, 6
jl 0x140030781
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400307e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030813
add rcx, 0x60
cmp qword [rcx + 0x20], 0
je 0x14003080b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140030863
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030852
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030852
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14003086e
inc ecx
inc rax
cmp rax, 2
jl 0x140030840
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x98]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400308a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400308d3
add rcx, 0x58
cmp qword [rcx + 0x20], 0
je 0x1400308cb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140030923
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030912
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030912
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14003092e
inc ecx
inc rax
cmp rax, 2
jl 0x140030900
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140030960
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030993
add rcx, 0x68
cmp qword [rcx + 0x20], 0
je 0x14003098b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400309e3
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400309d2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400309d2
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400309ee
inc ecx
inc rax
cmp rax, 2
jl 0x1400309c0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140030a20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
xor r14d, r14d
test rdi, rdi
je 0x140030aca
lea rcx, [rdi + 0x1c8]
cmp qword [rcx + 0x20], r14
je 0x140030a5c
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rdi + 0x1b0]
test rbx, rbx
je 0x140030a94
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140030a94
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140030a94
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x140030ac6
mov qword [rsp + 0x20], r14
lea rax, [0x1400d03d0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x50], 0
lea r9, [rsp + 0x20]
mov r8b, 1
lea rdx, [rsp + 0x50]
call fcn.140022200
mov qword [rbp + 0x10], r14
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x140030b12
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030b05
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030b05
mov ecx, r14d
mov rax, r14
cmp qword [rdx + rax*8], 0
je 0x140030b25
inc ecx
inc rax
cmp rax, 2
jl 0x140030af3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
movzx eax, byte [rbx + 0x200]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x140030b0e
Function at 0x140030b40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x140030bcd
lea rcx, [rsi + 0x70]
cmp qword [rcx + 0x20], 0
je 0x140030b75
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rsi + 0x68]
mov edi, 0xffffffff
test rbx, rbx
je 0x140030bac
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140030bac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140030bac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x140030bc5
lock xadd dword [rcx + 0xc], edi
cmp edi, 1
jne 0x140030bc5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x140030c17
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030c06
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030c06
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140030c2c
inc ecx
inc rax
cmp rax, 2
jl 0x140030bf4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x140030c0f

Function at 0x140030c40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x140030ca0
lea rcx, [rbx + 0x1b0]
cmp qword [rcx + 0x20], 0
je 0x140030c6e
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x150]
call fcn.1400160d0
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140030c98
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140030c98
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140030cea
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030cd9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030cd9
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140030cf5
inc ecx
inc rax
cmp rax, 2
jl 0x140030cc7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1e8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140032110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400d0580]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x140032166
call fcn.140034610
mov dword [rbp - 0x59], ebx
lea rax, [0x1400d03d0]
mov qword [rbp - 0x51], rax
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x140032256
mov dword [rbp + 0x17], ebx
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
lea rcx, [rbp + 0x1f]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
xor eax, eax
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], rax
lea rax, [rdi + 0x28]
test rdi, rdi
cmove rax, rbx
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x51], rax
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x59]
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rbp - 0x39]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.1400246f0
test rax, rax
je 0x140032218
nop dword [rax]
lea rax, [rbx + 1]
cmp rbx, 0xffffffffffffffff
cmove rax, rbx
mov rbx, rax
mov r9, rsi
lea r8, [rbp - 0x39]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.1400246f0
test rax, rax
jne 0x1400321f0
mov rdx, qword [rbp - 0x49]
mov ecx, dword [0x1400d9750]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rdi, [rbp - 0x39]
mov esi, 0xa
mov rcx, qword [rdi]
test rcx, rcx
je 0x140032240
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add rdi, 8
sub rsi, 1
jne 0x140032232
lea rcx, [rbp + 0x1f]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400897d0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140033030
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1400d0580]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xb0]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call fcn.140027570
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
mov ecx, dword [rdi]
cmp ecx, 0x40
jne 0x1400330a2
mov dword [rsp + 0x40], 0x2746
jmp 0x1400330b2
cmp ecx, 0x4d2
jne 0x1400330c4
mov dword [rsp + 0x40], 0x274d
call fcn.140027570
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
test esi, esi
je 0x1400330cf
mov eax, 0xffffffff
jmp 0x1400330d5
mov eax, dword [rsp + 0x50]
mov dword [rdi], ebp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400897d0
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140033c20
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d0580]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140033c93
mov dword [rdi], 0
cmp esi, 0x17
jne 0x140033c8e
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
jmp 0x140033cb9
call fcn.140027570
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400897d0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret