joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c40d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
mov rax, qword [rcx + 8]
xor esi, esi
test al, 1
jne 0x1400c4132
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rdi, [rax + 0x28]
test rax, rax
cmove rdi, rsi
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c4132
nop
cmp qword [rax], rdi
je 0x1400c41df
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400c4120
mov rdx, qword [r14]
mov eax, 1
xchg dword [rdx + 0x408], eax
test eax, eax
je 0x1400c4151
mov ecx, 0x68
call fcn.1401ae1f0
mov rdx, rax
mov qword [rdx + 0x20], rsi
lea rax, [0x1401127f0]
mov qword [rdx + 0x28], rax
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rsi
mov dword [rdx + 0x30], esi
mov rcx, qword [rbx]
mov qword [rdx + 0x38], rcx
mov rax, qword [rbx + 8]
mov qword [rdx + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rdx + 0x48], rax
mov qword [rdx + 0x50], rsi
mov qword [rdx + 0x58], rsi
mov rax, qword [rbx + 0x18]
mov qword [rdx + 0x50], rax
mov rax, qword [rbx + 0x20]
mov qword [rdx + 0x58], rax
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov rax, qword [r14]
mov qword [rdx + 0x60], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.1401257a0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
cmp qword [rax + 8], rsi
je 0x1400c4132
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
nop
lea rcx, [rsp + 0x28]
call fcn.1400f3370
nop
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c4267
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c4267
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c4267
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400c41c9
Function at 0x1400c4560
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov r14, rcx
mov rax, qword [rcx + 8]
xor ebx, ebx
test al, 1
jne 0x1400c45b8
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rdi, [rax + 0x28]
test rax, rax
cmove rdi, rbx
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c45b8
cmp qword [rax], rdi
je 0x1400c4656
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400c45a6
mov rdx, qword [r14]
mov eax, 1
xchg dword [rdx + 0x408], eax
test eax, eax
je 0x1400c45d7
mov ecx, 0x60
call fcn.1401ae1f0
mov rdx, rax
mov qword [rdx + 0x20], rbx
lea rax, [0x140112bb0]
mov qword [rdx + 0x28], rax
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rbx
mov dword [rdx + 0x30], ebx
mov rcx, qword [rsi]
mov qword [rdx + 0x38], rcx
mov rax, qword [rsi + 8]
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], rbx
mov qword [rdx + 0x50], rbx
mov rax, qword [rsi + 0x10]
mov qword [rdx + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rdx + 0x50], rax
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov rax, qword [r14]
mov qword [rdx + 0x58], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.1401257a0
nop
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
cmp qword [rax + 8], rbx
je 0x1400c45b8
mov rax, qword [rsi + 8]
mov rdi, qword [rsi + 0x18]
mov qword [rsp + 0x50], rdi
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
nop
mov rbx, qword [rax]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1400c46e5
mov rcx, qword [rbx + 0x20]
call fcn.14010bcd0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400c46b8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400c46b3
nop
cmp rbx, qword [rax + 0x10]
jne 0x1400c46b3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400c46a0
mov rbx, rax
jmp 0x1400c46df
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400c46df
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400c46d0
cmp byte [rbx + 0x19], 0
je 0x1400c4682
nop
test rdi, rdi
je 0x1400c4717
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400c4717
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], ebx
cmp ebx, 1
jne 0x1400c4717
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400c4648
Function at 0x1400c4740
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x40
mov rbx, rdx
mov r14, rcx
mov rax, qword [rcx + 8]
xor esi, esi
test al, 1
jne 0x1400c47a2
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rdi, [rax + 0x28]
test rax, rax
cmove rdi, rsi
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c47a2
nop
cmp qword [rax], rdi
je 0x1400c4848
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400c4790
mov rdx, qword [r14]
mov eax, 1
xchg dword [rdx + 0x408], eax
test eax, eax
je 0x1400c47c1
mov ecx, 0x60
call fcn.1401ae1f0
mov rdx, rax
mov qword [rdx + 0x20], rsi
lea rax, [0x140112cb0]
mov qword [rdx + 0x28], rax
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rsi
mov dword [rdx + 0x30], esi
mov rcx, qword [rbx]
mov qword [rdx + 0x38], rcx
mov rax, qword [rbx + 8]
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], rsi
mov qword [rdx + 0x50], rsi
mov rax, qword [rbx + 0x10]
mov qword [rdx + 0x48], rax
mov rax, qword [rbx + 0x18]
mov qword [rdx + 0x50], rax
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov rax, qword [r14]
mov qword [rdx + 0x58], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.1401257a0
nop
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
cmp qword [rax + 8], rsi
je 0x1400c47a2
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
nop
lea rcx, [rsp + 0x20]
call fcn.1400f5ea0
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c48c6
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c48c6
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c48c6
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400c4832
Function at 0x1400c48f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov r14, rcx
mov rax, qword [rcx + 8]
xor edi, edi
test al, 1
jne 0x1400c4948
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rbx, [rax + 0x28]
test rax, rax
cmove rbx, rdi
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c4948
cmp qword [rax], rbx
je 0x1400c49e6
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400c4936
mov rdx, qword [r14]
mov eax, 1
xchg dword [rdx + 0x408], eax
test eax, eax
je 0x1400c4967
mov ecx, 0x60
call fcn.1401ae1f0
mov rdx, rax
mov qword [rdx + 0x20], rdi
lea rax, [0x140112d80]
mov qword [rdx + 0x28], rax
mov qword [rdx], rdi
mov qword [rdx + 8], rdi
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rdi
mov dword [rdx + 0x30], edi
mov rcx, qword [rsi]
mov qword [rdx + 0x38], rcx
mov rax, qword [rsi + 8]
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], rdi
mov qword [rdx + 0x50], rdi
mov rax, qword [rsi + 0x10]
mov qword [rdx + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rdx + 0x50], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov rax, qword [r14]
mov qword [rdx + 0x58], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.1401257a0
nop
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
cmp qword [rax + 8], rdi
je 0x1400c4948
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x18]
mov qword [rsp + 0x50], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
nop
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c4a1c
mov eax, 1
xchg dword [rcx + 0x78], eax
call fcn.14010bcd0
nop
test rbx, rbx
je 0x1400c4a4e
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c4a4e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c4a4e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400c49d8
Function at 0x1400c4a70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov r14, rcx
mov rax, qword [rcx + 8]
xor edi, edi
test al, 1
jne 0x1400c4ac8
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rbx, [rax + 0x28]
test rax, rax
cmove rbx, rdi
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c4ac8
cmp qword [rax], rbx
je 0x1400c4b66
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400c4ab6
mov rdx, qword [r14]
mov eax, 1
xchg dword [rdx + 0x408], eax
test eax, eax
je 0x1400c4ae7
mov ecx, 0x60
call fcn.1401ae1f0
mov rdx, rax
mov qword [rdx + 0x20], rdi
lea rax, [0x140112e30]
mov qword [rdx + 0x28], rax
mov qword [rdx], rdi
mov qword [rdx + 8], rdi
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rdi
mov dword [rdx + 0x30], edi
mov rcx, qword [rsi]
mov qword [rdx + 0x38], rcx
mov rax, qword [rsi + 8]
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], rdi
mov qword [rdx + 0x50], rdi
mov rax, qword [rsi + 0x10]
mov qword [rdx + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rdx + 0x50], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov rax, qword [r14]
mov qword [rdx + 0x58], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.1401257a0
nop
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
cmp qword [rax + 8], rdi
je 0x1400c4ac8
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x18]
mov qword [rsp + 0x50], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
nop
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400c4b9b
mov eax, 1
xchg dword [rcx + 0x78], eax
call fcn.14010bcd0
nop
test rbx, rbx
je 0x1400c4bcd
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c4bcd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c4bcd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400c4b58
Function at 0x1400c4bf0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x50
mov rdi, rdx
mov r14, rcx
mov rax, qword [rcx + 8]
xor esi, esi
test al, 1
jne 0x1400c4c52
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rbx, [rax + 0x28]
test rax, rax
cmove rbx, rsi
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c4c52
nop
cmp qword [rax], rbx
je 0x1400c4cf7
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400c4c40
mov rdx, qword [r14]
mov eax, 1
xchg dword [rdx + 0x408], eax
test eax, eax
je 0x1400c4c71
mov ecx, 0x60
call fcn.1401ae1f0
mov rdx, rax
mov qword [rdx + 0x20], rsi
lea rax, [0x140112ee0]
mov qword [rdx + 0x28], rax
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rsi
mov dword [rdx + 0x30], esi
mov rcx, qword [rdi]
mov qword [rdx + 0x38], rcx
mov rax, qword [rdi + 8]
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], rsi
mov qword [rdx + 0x50], rsi
mov rax, qword [rdi + 0x10]
mov qword [rdx + 0x48], rax
mov rax, qword [rdi + 0x18]
mov qword [rdx + 0x50], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rax, qword [r14]
mov qword [rdx + 0x58], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.1401257a0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
cmp qword [rax + 8], rsi
je 0x1400c4c52
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x38], rbx
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
nop
lea rcx, [rsp + 0x28]
call fcn.1400f4220
nop
nop
test rbx, rbx
je 0x1400c4d6a
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c4d6a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c4d6a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400c4ce1
Function at 0x1400c5aa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
cmp qword [rcx + 0x20], 0
je 0x1400c5c6f
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400c5b0c
lea rcx, [0x1400b5f10]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rdx
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea rdx, [rbp - 0x60]
mov rcx, rsi
call rax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov r14, qword [rcx + 0x10]
mov rax, qword [rdx]
mov qword [rbp - 0x40], rax
mov rax, qword [rdx + 8]
mov qword [rbp - 0x38], rax
mov rax, qword [rdx + 0x10]
mov qword [rbp - 0x30], rax
xor ebx, ebx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rbx
mov rax, qword [rdx + 0x18]
mov qword [rbp - 0x28], rax
mov rax, qword [rdx + 0x20]
mov qword [rbp - 0x20], rax
mov qword [rdx + 0x18], rbx
mov qword [rdx + 0x20], rbx
movups xmm0, xmmword [rdx + 0x28]
movups xmmword [rbp - 0x18], xmm0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x30], rax
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5b70
mov rdx, qword [rax + 8]
jmp 0x1400c5b73
mov rdx, rbx
mov r9d, 8
mov r8d, 0x48
movzx ecx, byte [rbp + 0x20]
call fcn.1400aa770
mov rdx, rax
mov rcx, qword [rbp - 0x40]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov rcx, qword [rbp - 0x38]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rax + 0x18], rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rbx
mov rax, qword [rbp - 0x28]
mov qword [rdx + 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rdx + 0x28], rax
movdqu xmmword [rbp - 0x28], xmm0
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rdx + 0x30], xmm0
lea rax, [0x1400b5f70]
mov qword [rdx], rax
mov qword [rbp + 0x20], rdx
mov edi, 0xffffffff
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x1400c5c1d
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c5c1d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400c5c1d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x1400c5c4e
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c5c4e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c5c4e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rdx, [rbp + 0x20]
mov rcx, rsi
call r14
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400c5c6a
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x1400c5af4
lea rcx, [rbp - 0x60]
call fcn.1400d7910
nop
lea rcx, [rbp - 0x60]
call fcn.1400d01d0
int3
Function at 0x1400c5c90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rdi, rcx
cmp qword [rcx + 0x20], 0
je 0x1400c5e19
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400c5cfe
lea rcx, [0x1400b8610]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call rax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r14, qword [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400d2e90
mov rsi, rax
mov qword [rsp + 0x110], rax
mov ecx, dword [0x1403509d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5d2e
mov rdx, qword [rax + 8]
jmp 0x1400c5d30
xor edx, edx
mov r9d, 8
mov r8d, 0xb0
movzx ecx, byte [rsp + 0x100]
call fcn.1400aa770
mov rbx, rax
mov rcx, qword [rsi + 8]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rax + 0x18], xmm0
movsd xmm1, qword [rsi + 0x20]
movsd qword [rax + 0x28], xmm1
mov ecx, dword [rsi + 0x28]
mov dword [rax + 0x30], ecx
lea rcx, [rax + 0x38]
lea rdx, [rsi + 0x30]
call fcn.1400d5180
movups xmm0, xmmword [rsi + 0x88]
movups xmmword [rbx + 0x90], xmm0
mov rax, qword [rsi + 0x98]
mov qword [rbx + 0xa0], rax
lea rax, [0x1400b8640]
mov qword [rbx], rax
mov qword [rsp + 0x100], rbx
mov rcx, qword [rsi + 0x80]
test rcx, rcx
je 0x1400c5dbd
mov edx, 0xb8
call fcn.1401ae118
mov rcx, qword [rsi + 0x78]
test rcx, rcx
je 0x1400c5ddb
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1400c5ddb
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, [rsi + 0x38]
cmp qword [rcx + 0x20], 0
je 0x1400c5df0
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rdx, [rsp + 0x100]
mov rcx, rdi
call r14
nop
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1400c5e14
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x1400c5ce6
lea rcx, [rsp + 0x20]
call fcn.1400d7910
nop
lea rcx, [rsp + 0x20]
call fcn.1400d01d0
int3
Function at 0x1400c60e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov rbp, rcx
sar rdi, 2
test rdi, rdi
je 0x1400c62bf
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x60], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x1400c6130
mov eax, ntohl
jmp 0x1400c615e
cmp rdi, 0x44
jb 0x1400c613d
mov eax, 7
jmp 0x1400c615e
cmp rdi, 0x27
jb 0x1400c614a
mov eax, 5
jmp 0x1400c615e
cmp rdi, 7
jb 0x1400c6157
mov eax, 3
jmp 0x1400c615e
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x1400c6177
mov r15, rdi
mov r8, rdi
mov edx, 0x8b8b8b8b
shl r8, 2
mov rcx, rsi
call fcn.1401e4fa0
xor ecx, ecx
test r15, r15
je 0x1400c622f
mov qword [rsp + 0x58], r12
nop dword [rax + rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea r12, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [r12]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x1400c61ed
mov rax, rbx
jmp 0x1400c6202
cmp rcx, rbx
ja 0x1400c61ff
mov rax, qword [rbp]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x1400c6202
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [r12], r8d
cmp rcx, r15
jb 0x1400c61a0
mov r12, qword [rsp + 0x58]
add r15, rdi
cmp rcx, r15
jae 0x1400c62ab
inc r14
lea rbp, [rcx - 1]
inc r13
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x1400c6241
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c7f80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x10
lea r8, [rcx + 0x10]
mov rsi, rdx
cmp rcx, r8
je 0x1400c818c
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
nop word [rax + rax]
mov r11, qword [rcx + 8]
mov eax, dword [rsi]
mov r10, r11
mov r9, qword [rcx]
mov dword [rsp], eax
cmp r11, 4
jb 0x1400c8009
movzx ebx, byte [rsp + 2]
mov rdx, r11
movzx edi, byte [rsp + 1]
shr rdx, 2
imul r11, rdx, 0xfffffffffffffffc
add r11, r10
movzx r10d, byte [rsp + 3]
nop dword [rax]
nop word [rax + rax]
xor byte [r9], al
xor byte [r9 + 1], dil
xor byte [r9 + 2], bl
xor byte [r9 + 3], r10b
add r9, 4
sub rdx, 1
jne 0x1400c7ff0
test r11, r11
je 0x1400c8170
xor r10d, r10d
cmp r11, 8
jb 0x1400c8103
lea rdx, [r9 - 1]
add rdx, r11
lea rax, [rsp + r11 - 1]
cmp r9, rax
ja 0x1400c803d
lea rax, [rsp]
cmp rdx, rax
jae 0x1400c8103
cmp r11, 0x40
jb 0x1400c80ce
mov rdx, r11
mov rbx, r11
and edx, 0x3f
sub rbx, rdx
lea rdi, [rsp]
sub rdi, r9
lea rbp, [rsp + 0x10]
sub rbp, r9
lea rax, [r9 + 0x20]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
add r10, 0x40
movdqu xmm1, xmmword [rdi + rax - 0x20]
movdqu xmm2, xmmword [rdi + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
movdqu xmm1, xmmword [rax + rbp - 0x60]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax + rbp - 0x40]
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm1, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp r10, rbx
jb 0x1400c8070
cmp rdx, 8
jb 0x1400c80fe
mov rdx, r11
and rdx, 0xfffffffffffffff8
lea rbx, [rsp]
sub rbx, r9
lea rax, [r10 + r9]
movq xmm0, qword [rax]
add r10, 8
movq xmm1, qword [rbx + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r10, rdx
jb 0x1400c80e0
cmp r10, r11
jae 0x1400c8130
lea rdx, [r10 + r9]
lea rbx, [rsp]
sub rbx, r9
mov r9, r11
sub r9, r10
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400c8120
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
mov rax, r11
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [rsi], al
lea rax, [r11 + 1]
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [rsi + 1], al
lea rax, [r11 - 2]
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [rsi + 2], al
lea rax, [r11 - 1]
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
mov byte [rsi + 3], al
add rcx, 0x10
cmp rcx, r8
jne 0x1400c7fb0
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
add rsp, 0x10
pop rsi
ret