joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10091f10
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.100db9a0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10091f6f
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x10091fe6
mov r8, rdx
not r8
shr r8, 0x3f
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.100028e0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x10091ff3
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x10091fe6
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.100028e0
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x10091fd5
jmp 0x10091fe6
Function at 0x10092c40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.1010cda0
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rdi, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x100a07b0]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, r15
mov rdx, rdi
mov r8d, 0x1000
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x10092dfa
mov r14d, 0xffffffff
lea r12, [rsp + 0x40]
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 1
jne 0x10092cf0
cmp dword [rsp + 0x34], 0
jne 0x10092dff
mov eax, dword [rsp + 0x38]
mov edi, eax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], rdi
test eax, eax
je 0x10092dff
cmp edi, 0x1000
ja 0x10092e3f
xor ebx, ebx
nop dword [rax + rax]
cmp rbx, rdi
ja 0x10092e2b
lea rdx, [rsp + rbx]
add rdx, 0x80
mov r8, rdi
sub r8, rbx
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, r12
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x10092dfa
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 1
jne 0x10092d90
cmp dword [rsp + 0x34], 0
jne 0x10092dff
mov eax, dword [rsp + 0x38]
add rbx, rax
cmp rbx, rdi
jne 0x10092d40
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, r15
lea rdx, [rsp + 0x80]
mov r8d, 0x1000
mov r9, r12
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x10092cf0
call sub.kernel32.dll_GetLastError
mov rcx, r15
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1080]
add rsp, 0x1098
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, rbx
mov rdx, rdi
call fcn.100ee460
jmp 0x10092e53
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, rdi
call fcn.100ee380
ud2
Function at 0x10097990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x101102a0]
test ecx, ecx
je 0x100979c3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100979dc
mov rbx, rax
cmp qword [rax], 0
je 0x100979dc
add rbx, 8
jmp 0x10097ac5
lea rcx, [0x10110288]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100979b1
mov ecx, dword [0x101102a0]
test ecx, ecx
je 0x10097aa6
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10097ac3
mov rdi, rax
test rax, rax
jne 0x10097a48
mov ecx, 0x18
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x10097ae3
mov rdi, rax
mov qword [rax], 0
lea rax, [0x10110288]
mov qword [rdi + 0x10], rax
mov ecx, dword [0x101102a0]
test ecx, ecx
je 0x10097ad0
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x10097a76
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rsi], 0
test rax, rax
je 0x10097a76
cmp rax, 1
je 0x10097a78
test rcx, rcx
je 0x10097a76
lock dec qword [rcx]
jne 0x10097a76
call fcn.100667d0
xor ecx, ecx
lea rbx, [rdi + 8]
mov rax, qword [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 1
mov qword [rdi + 8], rcx
je 0x10097ac5
test rax, rax
je 0x10097ac5
lock dec qword [rax]
jne 0x10097ac5
mov rcx, rax
call fcn.100667d0
jmp 0x10097ac5
lea rcx, [0x10110288]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x100979fb
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x10110288]
call fcn.100a5dd0
mov ecx, eax
jmp 0x10097a40
mov ecx, 0x18
mov edx, 8
call fcn.100db070
ud2

Function at 0x1009a470
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1009f570
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
test rdi, rdi
je 0x1009a4ab
mov rcx, rdi
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x1009a4b0
xor ebx, ebx
test rsi, rsi
jne 0x1009a4c4
jmp 0x1009a4d8
mov rbx, rsi
jmp 0x1009a4d8
call sub.kernel32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x1009a4d8
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.100028e0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1009cb30
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1009cb84
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1009cc1a
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x1009cb97
cmp eax, 0x2739
jne 0x1009cbe5
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1009cbe0
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
je 0x1009cbfa
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1009cc1a
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1009cc1a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x100a08a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx + 0x20], 0
jne 0x100a09ae
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x100a08d9
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x100a0971
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x100a0990
sub rax, rdx
add rdx, qword [rbx]
mov rbx, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x100a092d
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x100a0949
jmp 0x100a093e
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x100a0944
cmp eax, 0x6d
jne 0x100a0961
mov byte [rsi + 1], 0
jmp 0x100a0955
mov ecx, 1
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x100a0957
mov r8d, 0x10
mov rcx, rbx
call fcn.10067610
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x100a08e6
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.10067610
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x100a08e6
mov qword [rsp + 0x30], 0
add rdi, 0x20
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1005f460
ud2
Function at 0x100a4e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movdqa xmmword [rsp + 0x40], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x28]
call fcn.1009f570
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x100a4e51
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x100a4eae
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x100a4ea1
mov rbx, qword [rsp + 0x30]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x100a4e9a
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x100a4e87
mov r8, qword [rax + 0x10]
mov rcx, qword [rdi]
call fcn.100028e0
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.100028e0
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rdx, xmm6
test rdx, rdx
je 0x100a4ea1
add rdx, rdx
mov r8d, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.100028e0

Function at 0x100a5970
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0x80
mov dword [rsp + 0x28], ecx
mov rsi, qword [0x1016d238]
mov qword [rsp + 0x30], rsi
test rsi, rsi
jne 0x100a59d0
lea rdx, [0x10124950]
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor r9d, r9d
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x100a5a05
mov rcx, qword [rsp + 0x30]
xor eax, eax
lock cmpxchg qword [0x1016d238], rcx
jne 0x100a59c1
mov rsi, qword [rsp + 0x30]
jmp 0x100a59d0
mov rsi, rax
mov rcx, qword [rsp + 0x30]
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x10
xor r9d, r9d
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x100a5a05
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.100f95d0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x2c]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x101249a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
lea rax, [0x101249c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
lea rdx, str.library_std_src_syswindows_rand.rsRNG_broken:___fallback_RNG_broken:
lea rcx, [rsp + 0x30]
call fcn.100e75e0
ud2
Function at 0x100a5a80
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov ecx, 0x10
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x100a5b46
mov rsi, rax
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x100a5ba0]
xor ebx, ebx
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rcx, rax
test rax, rax
jne 0x100a5b36
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x100a5b0f
mov r8, qword [rax + 0x10]
mov rcx, qword [rsi]
call fcn.100028e0
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call fcn.100028e0
call sub.kernel32.dll_GetLastError
mov ecx, eax
shl rcx, 0x20
or rcx, 2
mov ebx, 1
mov rax, rbx
mov rdx, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop rsi
ret
mov ecx, 0x10
mov edx, 8
call fcn.100db070
ud2

Function at 0x100a5dd0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x100a5e4e
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x100a5e8f
cmp dword [rsp + 0x2c], 0
je 0x100a5e73
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x100a5eb7
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1016d240]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1016d240], rsi
jne 0x100a5e30
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x100a5e85
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x100a5f0d
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x100a5e78
mov edi, dword [rsp + 0x28]
jmp 0x100a5e85
mov edi, dword [rsi + 0x18]
jmp 0x100a5e83
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x10124b18]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.1005f3a0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea rax, str.capacity_overflow
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.100e75e0
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea rax, str.capacity_overflow
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1005f330
ud2
Function at 0x100a9570
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x10110320]
test ecx, ecx
je 0x100a959f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100a95b8
cmp byte [rax + 8], 0
je 0x100a95b8
add rax, 9
jmp 0x100a964f
lea rcx, [0x10110308]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100a9590
mov ecx, dword [0x10110320]
test ecx, ecx
je 0x100a9634
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x100a964d
mov rdi, rax
test rax, rax
jne 0x100a9610
mov ecx, 0x10
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x100a9666
mov rdi, rax
mov byte [rax + 8], 0
lea rax, [0x10110308]
mov qword [rdi], rax
mov ecx, dword [0x10110320]
test ecx, ecx
je 0x100a9656
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x100a9625
movzx ecx, byte [rsi]
and cl, 1
neg cl
mov byte [rsi], 0
and cl, byte [rsi + 1]
jmp 0x100a9627
xor ecx, ecx
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x100a964f
lea rcx, [0x10110308]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x100a95cf
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x10110308]
call fcn.100a5dd0
mov ecx, eax
jmp 0x100a9608
mov ecx, 0x10
mov edx, 8
call fcn.100db070
ud2

Function at 0x100a9680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x10110340]
test ecx, ecx
je 0x100a96b3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100a96cc
mov rbx, rax
cmp qword [rax], 0
je 0x100a96cc
add rbx, 8
jmp 0x100a97c8
lea rcx, [0x10110328]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100a96a1
mov ecx, dword [0x10110340]
test ecx, ecx
je 0x100a97a9
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x100a97c6
mov rdi, rax
test rax, rax
jne 0x100a9738
mov ecx, 0x20
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x100a97e6
mov rdi, rax
mov qword [rax], 0
lea rax, [0x10110328]
mov qword [rdi + 0x18], rax
mov ecx, dword [0x10110340]
test ecx, ecx
je 0x100a97d3
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x100a9776
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsi], 0
test rdx, rdx
je 0x100a9776
cmp rdx, 1
jne 0x100a975f
mov rdx, rcx
jmp 0x100a977a
test rcx, rcx
je 0x100a9776
xor eax, eax
lock dec qword [rcx]
mov edx, 0
jne 0x100a977a
call fcn.10066880
xor eax, eax
xor edx, edx
lea rbx, [rdi + 8]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
je 0x100a97c8
test rcx, rcx
je 0x100a97c8
lock dec qword [rcx]
jne 0x100a97c8
call fcn.10066880
jmp 0x100a97c8
lea rcx, [0x10110328]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x100a96eb
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x10110328]
call fcn.100a5dd0
mov ecx, eax
jmp 0x100a9730
mov ecx, 0x20
mov edx, 8
call fcn.100db070
ud2
Function at 0x100a9a10
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov rdi, qword [rdx]
mov rbx, qword [rdx + 8]
movzx r14d, word [rdx + 0x10]
mov rax, qword [0x1016d210]
cmp rax, 3
jne 0x100a9b05
cmp rbx, 0x17f
ja 0x100a9b17
lea rbp, [rsp + 0x70]
mov rcx, rbp
mov rdx, rdi
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, rbp
mov r8, rbx
call fcn.100e6f30
cmp qword [rsp + 0x28], 0
je 0x100a9a94
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x100a9b28
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x100a9aec
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x100a9b28
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], r14w
xor eax, eax
mov qword [rsi], rax
jmp 0x100a9b28
call fcn.10091020
cmp rbx, 0x17f
jbe 0x100a9a4a
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9d, r14d
call fcn.10091f10
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x100aa0e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x100aa193
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x100aa1a2
cmp ecx, 0x17
jne 0x100aa1da
cmp eax, 0x1c
jb 0x100aa1f3
movzx eax, word [rsp + 0x32]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
rol ax, 8
mov word [rsi], 1
mov dword [rsi + 4], ecx
mov dword [rsi + 8], edx
mov word [rsi + 0xc], ax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi + 0xe], xmm0
add rsp, 0xb0
pop rsi
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x100aa1e1
cmp eax, 0x10
jb 0x100aa20d
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov rdx, rcx
shl rdx, 0x10
movzx eax, ax
or rax, rdx
mov word [rsi], 0
shr rcx, 0x10
mov word [rsi + 6], cx
mov dword [rsi + 2], eax
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___library_std_src_sys_common_net.rs
lea r8, [0x10125820]
mov edx, 0x43
call fcn.100e76b0
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
lea r8, [0x10125880]
mov edx, 0x42
call fcn.100e76b0
ud2
Function at 0x100aa800
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x10110360]
test ecx, ecx
je 0x100aa82f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100aa848
cmp qword [rax], 0
je 0x100aa848
add rax, 8
jmp 0x100aa8fd
lea rcx, [0x10110348]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100aa820
mov ecx, dword [0x10110360]
test ecx, ecx
je 0x100aa8de
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x100aa8fb
mov rdi, rax
test rax, rax
jne 0x100aa8b0
mov ecx, 0x18
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x100aa914
mov rdi, rax
mov qword [rax], 0
lea rax, [0x10110348]
mov qword [rdi + 0x10], rax
mov ecx, dword [0x10110360]
test ecx, ecx
je 0x100aa904
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x100aa8cb
mov rax, qword [rsi]
mov qword [rsi], 0
cmp rax, 1
jne 0x100aa8cb
mov rcx, qword [rsi + 8]
jmp 0x100aa8cd
xor ecx, ecx
lea rax, [rdi + 8]
mov qword [rdi], 1
mov qword [rdi + 8], rcx
jmp 0x100aa8fd
lea rcx, [0x10110348]
call fcn.100a5dd0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x100aa867
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x10110348]
call fcn.100a5dd0
mov ecx, eax
jmp 0x100aa8a8
mov ecx, 0x18
mov edx, 8
call fcn.100db070
ud2