joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023eb10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rsp, 0x28
jmp 0x14025f8d0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x145ef49b8]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.140256ff0
movups xmm0, xmmword [rbx + 0xe0]
movaps xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rbx + 0xf0]
movaps xmmword [rbp + 0x140], xmm1
cmp qword [rbx + 0x120], 0
je 0x14025fadf
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14025f96f
lea rcx, [0x1402440a0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x100]
call rax
jmp 0x14025fa69
mov r14, qword [rcx + 0x10]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.140256ff0
movaps xmm0, xmmword [rbp + 0x130]
movups xmmword [rbp + 0x30], xmm0
movaps xmm1, xmmword [rbp + 0x140]
movups xmmword [rbp + 0x40], xmm1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x14025f9b8
mov rdx, qword [rax + 8]
jmp 0x14025f9ba
xor edx, edx
mov r9d, 1
mov r8d, 0x110
movzx ecx, byte [rsp + 0x20]
call fcn.14023e830
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rax + 8]
call fcn.140256ff0
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdi + 0xe8], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdi + 0xf8], xmm1
lea rax, [0x1402440b0]
mov qword [rdi], rax
mov qword [rsp + 0x28], rdi
cmp byte [rbp - 0x28], 0
je 0x14025fa25
cmp qword [rbp], 0
je 0x14025fa21
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
lea rcx, [rbp - 0x20]
call rdx
nop
mov byte [rbp - 0x28], 0
cmp byte [rsp + 0x68], 0
je 0x14025fa47
cmp qword [rbp - 0x70], 0
je 0x14025fa42
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax]
lea rcx, [rsp + 0x70]
call rdx
nop
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x28]
lea rcx, [rbx + 0x100]
call r14
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14025fa69
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp byte [rbp + 0xd8], 0
je 0x14025fa97
cmp qword [rbp + 0x100], 0
je 0x14025fa90
mov rax, qword [rbp + 0xf8]
mov rdx, qword [rax]
lea rcx, [rbp + 0xe0]
call rdx
nop
mov byte [rbp + 0xd8], 0
cmp byte [rbp + 0x68], 0
je 0x14025fab8
cmp qword [rbp + 0x90], 0
je 0x14025fab8
mov rax, qword [rbp + 0x88]
mov rdx, qword [rax]
lea rcx, [rbp + 0x70]
call rdx
nop
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140567130
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.1402573b0
nop
lea rcx, [rsp + 0x30]
call fcn.1402526b0
int3
Function at 0x14023eb30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rsp, 0x28
jmp 0x14025fb00
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x145ef49b8]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdi, [rcx + 0x70]
mov rdx, rcx
lea rcx, [rsp + 0xc0]
call fcn.140254560
nop
cmp qword [rdi + 0x20], 0
je 0x14025fc67
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14025fb79
lea rcx, [0x1402441c0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rax
jmp 0x14025fc21
mov rsi, qword [rcx + 0x10]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.140254560
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x14025fbb0
mov rdx, qword [rax + 8]
jmp 0x14025fbb2
xor edx, edx
mov r9d, 1
lea r8d, [r9 + 0x7f]
movzx ecx, byte [rsp + 0x20]
call fcn.14023e830
mov rbx, rax
lea rcx, [rax + 8]
lea rdx, [rsp + 0x50]
call fcn.140254560
lea rax, [0x1402441d0]
mov qword [rbx], rax
mov qword [rsp + 0x28], rbx
cmp qword [rsp + 0x98], 0
je 0x14025fc04
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax]
lea rcx, [rsp + 0x78]
call rdx
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call rsi
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14025fc21
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp qword [rsp + 0x108], 0
je 0x14025fc42
mov rax, qword [rsp + 0x100]
mov rdx, qword [rax]
lea rcx, [rsp + 0xe8]
call rdx
nop
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140567130
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x30]
call fcn.1402573b0
nop
lea rcx, [rsp + 0x30]
call fcn.1402526b0
int3
Function at 0x14023eb50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rsp, 0x28
jmp 0x14025fc80
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x145ef49b8]
xor rax, rsp
mov qword [rbp + 0x50], rax
lea rdi, [rcx + 0x80]
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.140256dc0
nop
cmp qword [rdi + 0x20], 0
je 0x14025fde4
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14025fcfa
lea rcx, [0x140244280]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rax
jmp 0x14025fda4
mov rsi, qword [rcx + 0x10]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140256dc0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x14025fd2d
mov rdx, qword [rax + 8]
jmp 0x14025fd2f
xor edx, edx
mov r9d, 1
mov r8d, 0x90
movzx ecx, byte [rsp + 0x20]
call fcn.14023e830
mov rbx, rax
lea rcx, [rax + 8]
lea rdx, [rsp + 0x50]
call fcn.140256dc0
lea rax, [0x1402442c0]
mov qword [rbx], rax
mov qword [rsp + 0x28], rbx
cmp byte [rsp + 0x60], 0
je 0x14025fd87
cmp qword [rbp - 0x78], 0
je 0x14025fd82
mov rax, qword [rbp - 0x80]
mov rdx, qword [rax]
lea rcx, [rsp + 0x68]
call rdx
nop
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call rsi
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14025fda4
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp byte [rbp - 0x20], 0
je 0x14025fdbf
cmp qword [rbp + 8], 0
je 0x14025fdbf
mov rax, qword [rbp]
mov rdx, qword [rax]
lea rcx, [rbp - 0x18]
call rdx
nop
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140567130
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.1402573b0
nop
lea rcx, [rsp + 0x30]
call fcn.1402526b0
int3
Function at 0x14023eb70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rsp, 0x28
jmp 0x14025fe00
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x145ef49b8]
xor rax, rsp
mov qword [rbp + 0x50], rax
lea rdi, [rcx + 0x80]
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.140256e70
nop
cmp qword [rdi + 0x20], 0
je 0x14025ff64
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14025fe7a
lea rcx, [0x140244370]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rax
jmp 0x14025ff24
mov rsi, qword [rcx + 0x10]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140256e70
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x14025fead
mov rdx, qword [rax + 8]
jmp 0x14025feaf
xor edx, edx
mov r9d, 1
mov r8d, 0x90
movzx ecx, byte [rsp + 0x20]
call fcn.14023e830
mov rbx, rax
lea rcx, [rax + 8]
lea rdx, [rsp + 0x50]
call fcn.140256e70
lea rax, [0x1402443b0]
mov qword [rbx], rax
mov qword [rsp + 0x28], rbx
cmp byte [rsp + 0x60], 0
je 0x14025ff07
cmp qword [rbp - 0x78], 0
je 0x14025ff02
mov rax, qword [rbp - 0x80]
mov rdx, qword [rax]
lea rcx, [rsp + 0x68]
call rdx
nop
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call rsi
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14025ff24
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp byte [rbp - 0x20], 0
je 0x14025ff3f
cmp qword [rbp + 8], 0
je 0x14025ff3f
mov rax, qword [rbp]
mov rdx, qword [rax]
lea rcx, [rbp - 0x18]
call rdx
nop
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140567130
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.1402573b0
nop
lea rcx, [rsp + 0x30]
call fcn.1402526b0
int3
Function at 0x140244940
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rbx, rdx
cmp qword [rcx + 0x20], 0
jne 0x14024498f
cmp qword [rcx + 0x58], 0
jne 0x14024498f
lea rdx, [r8 + 0x10]
mov rcx, rbx
call fcn.14023ea90
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rsi, [rcx + 0x38]
cmp qword [rsi + 0x20], 0
je 0x140244ad5
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1402449c8
lea rcx, [0x140244af0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call rax
jmp 0x140244977
mov r14, qword [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140256f20
movups xmm0, xmmword [rbx + 0xe0]
movups xmmword [rbp + 0x20], xmm0
movsd xmm1, qword [rbx + 0xf0]
movsd qword [rbp + 0x30], xmm1
mov rax, qword [rbx + 0xf8]
mov qword [rbp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x78], rax
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140244a19
mov rdx, qword [rax + 8]
jmp 0x140244a1b
xor edx, edx
mov r9d, 1
mov r8d, 0x110
movzx ecx, byte [rbp + 0x60]
call fcn.14023e830
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rax + 8]
call fcn.140256f20
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rdi + 0xe8], xmm0
movsd xmm1, qword [rbp + 0x30]
movsd qword [rdi + 0xf8], xmm1
mov rcx, qword [rbp + 0x38]
mov qword [rdi + 0x100], rcx
lea rax, [0x140244b00]
mov qword [rdi], rax
mov qword [rbp + 0x60], rdi
cmp byte [rbp - 0x38], 0
je 0x140244a91
cmp qword [rbp - 0x10], 0
je 0x140244a8d
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
lea rcx, [rbp - 0x30]
call rdx
nop
mov byte [rbp - 0x38], 0
cmp byte [rsp + 0x58], 0
je 0x140244ab4
cmp qword [rbp - 0x80], 0
je 0x140244aaf
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
lea rcx, [rsp + 0x60]
call rdx
nop
mov byte [rsp + 0x58], 0
lea rdx, [rbp + 0x60]
mov rcx, rsi
call r14
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140244ad0
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x140244977
lea rcx, [rsp + 0x20]
call fcn.1402573b0
nop
lea rcx, [rsp + 0x20]
call fcn.1402526b0
int3
Function at 0x140244c20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rbx, rdx
cmp qword [rcx + 0x20], 0
jne 0x140244c6f
cmp qword [rcx + 0x58], 0
jne 0x140244c6f
lea rdx, [r8 + 0x10]
mov rcx, rbx
call fcn.14023eab0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rsi, [rcx + 0x38]
cmp qword [rsi + 0x20], 0
je 0x140244db5
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140244ca8
lea rcx, [0x140244dd0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call rax
jmp 0x140244c57
mov r14, qword [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140256ff0
movups xmm0, xmmword [rbx + 0xe0]
movups xmmword [rbp + 0x20], xmm0
movsd xmm1, qword [rbx + 0xf0]
movsd qword [rbp + 0x30], xmm1
mov rax, qword [rbx + 0xf8]
mov qword [rbp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x78], rax
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140244cf9
mov rdx, qword [rax + 8]
jmp 0x140244cfb
xor edx, edx
mov r9d, 1
mov r8d, 0x110
movzx ecx, byte [rbp + 0x60]
call fcn.14023e830
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rax + 8]
call fcn.140256ff0
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rdi + 0xe8], xmm0
movsd xmm1, qword [rbp + 0x30]
movsd qword [rdi + 0xf8], xmm1
mov rcx, qword [rbp + 0x38]
mov qword [rdi + 0x100], rcx
lea rax, [0x140244de0]
mov qword [rdi], rax
mov qword [rbp + 0x60], rdi
cmp byte [rbp - 0x38], 0
je 0x140244d71
cmp qword [rbp - 0x10], 0
je 0x140244d6d
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
lea rcx, [rbp - 0x30]
call rdx
nop
mov byte [rbp - 0x38], 0
cmp byte [rsp + 0x58], 0
je 0x140244d94
cmp qword [rbp - 0x80], 0
je 0x140244d8f
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
lea rcx, [rsp + 0x60]
call rdx
nop
mov byte [rsp + 0x58], 0
lea rdx, [rbp + 0x60]
mov rcx, rsi
call r14
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140244db0
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x140244c57
lea rcx, [rsp + 0x20]
call fcn.1402573b0
nop
lea rcx, [rsp + 0x20]
call fcn.1402526b0
int3

Function at 0x140248060
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
cmp rcx, rdx
je 0x14024809a
nop dword [rax + rax]
movsx r9d, byte [rcx]
mov rax, r8
shl rax, 6
sub r9d, 0x61c88647
add r9, rax
inc rcx
mov rax, r8
shr rax, 2
add r9, rax
xor r8, r9
cmp rcx, rdx
jne 0x140248070
movabs rax, 0x200000005
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x1e
imul eax, eax, 0x7fffffff
sub r8d, eax
bts r8d, 0x1e
mov eax, r8d
ret
Function at 0x140255970
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x145ef49b8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x145efecf8], eax
inc eax
cmp eax, 1
jne 0x1402559bd
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x145efecfc], eax
test bl, bl
je 0x140255a61
xor ebx, ebx
lock xadd dword [0x145efecfc], ebx
test ebx, ebx
je 0x140255a61
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x140a28de8]
lea rsi, [0x140a28de0]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x140255a16
mov rax, qword [0x140a28de0]
mov edx, ebx
mov rcx, rsi
call qword [rax + Ordinal_50]
jmp 0x140255a18
mov al, 1
lea rcx, str.C:_Boost_include_boost_1_82_boost_asio_detail_impl_winsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], Ordinal_79
mov dword [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_26
test al, 1
jne 0x140255a85
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140567130
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1400e3640
int3

Function at 0x1402714d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x1402714fe
mov rdx, qword [rax + 8]
jmp 0x140271500
xor edx, edx
movzx ecx, byte [rsp + 0x20]
mov r9d, 1
mov r8, rbx
add rsp, 0x30
pop rbx
jmp fcn.14023e750

Function at 0x140271520
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x140271550
mov r9, qword [rax + 8]
jmp 0x140271553
mov r9, r8
cmp rdi, 0x3fc
ja 0x140271577
test r9, r9
je 0x140271577
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x140271585
inc r8d
inc rax
cmp rax, 2
jl 0x140271564
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.1403bbc60
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x1402722c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx]
mov rbx, rcx
test rax, rax
je 0x140272344
mov rcx, qword [rax]
test rcx, rcx
je 0x140272344
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [0x145f0aebc]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x1402722fb
mov rdx, qword [rax + 8]
jmp 0x1402722fd
xor edx, edx
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
cmp r9, 0x3fc
ja 0x140272332
test rdx, rdx
je 0x140272332
mov ecx, 6
mov eax, ecx
nop dword [rax]
cmp qword [rdx + rax*8], 0
je 0x14027234a
inc ecx
inc rax
cmp rax, 8
jl 0x140272320
mov rcx, r8
call fcn.1403bbc60
mov rax, qword [rbx]
mov qword [rax], 0
add rsp, 0x30
pop rbx
ret
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
mov rax, qword [rbx]
mov qword [rax], 0
add rsp, 0x30
pop rbx
ret
Function at 0x140272920
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140272af6
mov qword [rsp + 0x98], rbx
test r8b, r8b
je 0x14027298c
movzx eax, byte [rdx]
test al, 8
je 0x14027298c
or al, 8
mov dword [rbp + 0x30], r12d
mov byte [rdx], al
lea r9, [rbp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x18]
setne dl
call fcn.14027fa70
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14027fa70
test ebx, ebx
je 0x140272af2
mov qword [rsp + 0xa0], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0xa8], r14
lea r13, [0x140a28de0]
mov r14, qword [0x140a28de8]
add rcx, r14
mov dword [rbp - 0x2c], r12d
cmp rcx, 1
jbe 0x1402729fc
mov rax, qword [0x140a28de0]
mov edx, 0x2733
mov rcx, r13
call qword [rax + Ordinal_50]
mov r14, qword [0x140a28de8]
jmp 0x1402729fe
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x2733
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14025dd50
test al, al
jne 0x140272a9b
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r12d
add rax, r14
cmp rax, 1
jbe 0x140272a61
mov rax, qword [0x140a28de0]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + Ordinal_50]
jmp 0x140272a63
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x4d5
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14025dd50
test al, al
je 0x140272acc
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14027fa70
mov r13, qword [rsp + 0xa0]
mov eax, ebx
mov r14, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x140272ade
mov eax, r12d
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140272bd0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, qword [rbp + 0x60]
mov r14, r9
mov esi, r8d
mov r12, rdx
mov r15, rcx
cmp qword [rbx + 0x10], 1
je 0x140272c0d
mov eax, dword [rbx]
jmp 0x140272c40
mov rcx, qword [rbx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, dword [rbx]
xor r13d, r13d
lea rdi, [0x140a28de0]
movabs rcx, 0x4d54ee85da812030
cmp eax, 0x40
jne 0x140272ca7
add rcx, qword [0x140a28de8]
mov dword [rbp - 0x1c], r13d
cmp rcx, 1
jbe 0x140272c7e
mov rax, qword [0x140a28de0]
mov edx, 0x2745
mov rcx, rdi
call qword [rax + Ordinal_50]
jmp 0x140272c80
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2745
add rax, 2
mov qword [rbp - 0x18], rdi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x140272cc2
cmp rax, 1
jne 0x140272dd7
cmp dword [rbx], r13d
jne 0x140272dd7
test r14, r14
je 0x140272d45
mov rdi, qword [rbp + 0x50]
test rdi, rdi
je 0x140272d3e
lea rax, [rbp + 0x60]
mov qword [rbp - 0x30], r13
mov qword [rsp + 0x38], rax
mov r9d, esi
lea rax, [rbp - 0x38]
mov dword [rbp - 0x40], r13d
mov qword [rsp + 0x30], rax
mov r8d, esi
lea rax, [rbp - 0x40]
mov qword [rbp - 0x38], r13
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov dword [rbp + 0x60], r13d
mov rcx, r12
mov qword [rsp + 0x20], rax
call sub.MSWSOCK.dll_GetAcceptExSockaddrs
movsxd rsi, dword [rbp + 0x60]
cmp rsi, qword [rdi]
jbe 0x140272d2c
mov edx, 0x2726
mov rcx, rbx
call fcn.14023b150
jmp 0x140272d3e
mov rdx, qword [rbp - 0x38]
mov r8, rsi
mov rcx, r14
call fcn.14056b5e0
mov qword [rdi], rsi
lea rdi, [0x140a28de0]
mov rcx, qword [rbp + 0x58]
mov qword [rbp - 0x28], r15
cmp rcx, 0xffffffffffffffff
jne 0x140272dad
movabs rcx, 0x4d54ee85da812030
mov dword [rbp - 0x1c], r13d
add rcx, qword [0x140a28de8]
cmp rcx, 1
jbe 0x140272d82
mov rax, qword [0x140a28de0]
mov edx, 0x2719
mov rcx, rdi
call qword [rax + Ordinal_50]
jmp 0x140272d84
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rdi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x140272dd7
lea r9, [rbp - 0x28]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.14027fa70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret