joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449880
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x4498c8
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x4498c8
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x4498d8
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.004327c0
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x4499b1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00432a40
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x4499b1
cmp qword [rcx + 8], rax
ja 0x4498d3
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x45c8e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c983
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00459220
nop
test bl, bl
je 0x45c97d
mov qword [rsp + 0x18], rax
lea rcx, [0x0045c9c0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046b7e0
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045c8e0

Function at 0x468920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x468a97
movzx edx, byte [rax]
test edx, edx
jne 0x468954
nop dword [rax]
test r8b, r8b
jne 0x468954
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x468967
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x468a57
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x468a45
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x468a37
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4689bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x468a00
mov eax, 1
cmp rax, rbx
ja 0x4689eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0046dca0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x468a2f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4689f3
mov rcx, r11
mov eax, r12d
jmp 0x4689c2
mov rcx, rbx
call fcn.0046dbe0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046dbe0
mov eax, r8d
mov rcx, rbx
call fcn.0046dca0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x468a8d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x468a50
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46896d
mov eax, edx
mov rcx, rbx
call fcn.0046dbe0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046dbe0
nop
int3
Function at 0x46a1e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a28f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004568e0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046b7e0
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046a1e0
Function at 0x46d700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4040c3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a020
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4040a0
cmp byte [0x00634349], 0
je 0x46d715
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46a940
jmp 0x4040a0

Function at 0x46d720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x006346e8]
mov eax, dword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006346e0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00634349], 0
je 0x46d755
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00634a20]
aesenc xmm0, xmmword [0x00634a30]
aesenc xmm0, xmmword [0x00634a40]
movq rax, xmm0
ret
jmp 0x40a200

Function at 0x46d760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x006346e8]
mov rax, qword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006346e0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00634349], 0
je 0x46d796
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00634a20]
aesenc xmm0, xmmword [0x00634a30]
aesenc xmm0, xmmword [0x00634a40]
movq rax, xmm0
ret
jmp 0x40a240

Function at 0x46f520
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46f554
mov rcx, 0x28
jmp 0x46f55f
shl rcx, 3
add rcx, 0x1480
mov qword [0x006345d0], rcx
pop rbp
ret
Function at 0x487ba0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4882df
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x487bcd
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x487e51
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x487e7d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005354c0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004dddc0]
lea rbx, [0x00532d30]
call fcn.00465fa0
inc rax
cmp rax, r8
jge 0x487ea2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x487ed7
lea rdi, [0x004dde40]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x487bc3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x487ebb
jmp 0x487e90
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00487ba0

Function at 0x488480
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x488497
inc rax
cmp rax, 4
jge 0x4884af
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x488494
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4884c0
inc rax
cmp rax, 4
jge 0x4884ce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4884f7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4884db
jmp 0x4884bd

Function at 0x48c2c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c38a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004035a0
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48c36f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004ddec0]
xor ebx, ebx
mov rcx, rdx
call fcn.00467340
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0048ce40
inc rbx
cmp rcx, rbx
jae 0x48c35e
mov edi, 1
lea rsi, [0x004ddec0]
call fcn.00467420
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00532fb8]
lea rsi, [0x005323e8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048c2c0
Function at 0x49a540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a5ec
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.004035a0
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x49a5b3
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.0044df20
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x49a5c6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x49a5d9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x49a5c3
mov byte [rax + rcx], dl
jmp 0x49a5c3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.00467be0
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.0049a540
Function at 0x4addc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adfcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4adee4
cmp rdx, 0x40
ja 0x4adfbd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4ade54
mov rax, rdx
mov rcx, rsi
call fcn.0046e560
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4adec0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004ae200
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4adfb5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4adee7
mov r8, rcx
cmp r8, 0x40
jl 0x4adf65
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004ae200
xorps xmm15, xmm15
mov r14, qword [0x006345d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4adfa8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4adfa4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046e560
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046dca0
mov rax, rdx
mov ecx, 0x40
call fcn.0046dca0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046b900
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004addc0
Function at 0x1400031a0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1400f8010]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x1401267d0], eax
inc eax
cmp eax, 1
jne 0x1400031ed
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1401267d4], eax
test dil, dil
je 0x140003200
xor eax, eax
lock xadd dword [0x1401267d4], eax
test eax, eax
jne 0x140003224
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140076f70
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x20], eax
lea rdx, str.winsock
lea rax, [0x1400ccf38]
mov byte [rsp + 0x24], 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call fcn.140002b70
int3

Function at 0x140004b00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x140128a94]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x140004b63
mov rax, qword [rax + 8]
test rax, rax
je 0x140004b63
mov rcx, qword [rax]
test rcx, rcx
je 0x140004b63
mov qword [rax], rsi
movzx eax, byte [rcx]
cmp rax, rbx
jb 0x140004b5e
mov byte [rcx + rdi], al
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call fcn.140077250
lea rcx, [rbx*4 + 1]
call fcn.140076f90
cmp rbx, 0xff
movzx ecx, bl
cmova ecx, esi
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004b90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140128a94]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140004bbd
mov r8, qword [rax + 8]
jmp 0x140004bc0
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x140004be4
test r8, r8
je 0x140004be4
cmp qword [r8], 0
jne 0x140004be4
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
mov qword [r8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140077250

Function at 0x140004f20
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140126808], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140004f7d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.140004c70]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x140005820
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
xor eax, eax
mov dword [rbp - 0x58], eax
lea rbx, [rcx + 0x28]
test rcx, rcx
cmove rbx, rax
mov ecx, dword [0x140128a94]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000598f
cmp qword [rax], rbx
je 0x140005868
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140005851
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14000598f
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140005942
cmp ecx, 1
jne 0x14000598f
mov ebx, 2
mov dword [rdi + 0x18], ebx
lea rax, [rbp - 0x30]
mov qword [rbp + 0x28], rax
lea rdx, [rdi + 0x20]
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_]
lea rax, [rbp - 0x50]
mov qword [rbp + 0x38], rax
lea rsi, vtable.std::exception.0
mov qword [rbp - 0x30], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rax, vtable.boost::asio::multiple_exceptions.0
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x18]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x40], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.140004040
mov ebx, 4
mov dword [rbp - 0x58], ebx
lea rcx, [rbp - 0x18]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
nop
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x28]
call qword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
lea rdx, [rbp - 0x40]
lea rcx, [rdi + 0x20]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrAssign_void____ptr64__void_const____ptr64_]
and ebx, 0xfffffffb
mov dword [rbp - 0x58], ebx
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rdi + 0x18], 1
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
mov ebx, 2
mov dword [rbp - 0x58], ebx
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCurrentException_void____ptr64_]
and ebx, 0xfffffffd
mov dword [rbp - 0x58], ebx
or ebx, 1
mov dword [rbp - 0x58], ebx
lea rcx, [rdi + 0x20]
lea rdx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrAssign_void____ptr64__void_const____ptr64_]
and ebx, 0xfffffffe
mov dword [rbp - 0x58], ebx
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140006260
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
mov byte [r11 + 0x18], r8b
push rbx
push rbp
push r14
push r15
sub rsp, 0x48
xor r15d, r15d
mov rbx, r9
mov r14, rdx
mov rbp, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400063c7
movzx eax, byte [rdx]
mov qword [r11 + 0x10], rdi
test al, 8
je 0x1400062c1
or al, 8
mov dword [r11 + 0x18], r15d
mov byte [rdx], al
lea r9, [r11 + 0x18]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400062c1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
test eax, eax
jne 0x1400062ee
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.1400048b0
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x40], r12
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r12, [0x1400ccf38]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], r12
movabs rdx, 0x8fafd21e25c5e09b
test eax, eax
lea rsi, [rbx + 8]
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov ecx, dword [rbx]
cmp ecx, 0x2733
jne 0x14000633e
mov rax, qword [rsi]
cmp qword [rax + 8], rdx
je 0x14000634f
cmp ecx, 0x4d5
jne 0x14000638b
mov rax, qword [rsi]
cmp qword [rax + 8], rdx
jne 0x14000638b
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], r15d
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
test eax, eax
jne 0x1400063a7
mov r8, qword [rsi]
mov rcx, rbx
call fcn.1400048b0
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], r12
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
jmp 0x14000638b
mov eax, r15d
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x1400063e0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000645f
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.1400048b0
cmp esi, 0x17
jne 0x14000644c
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rsi, qword [rsp + 0x68]
test eax, eax
mov dword [rsp + 0x38], eax
lea rax, [0x1400ccf38]
mov qword [rsp + 0x40], rax
setne byte [rsp + 0x3c]
movups xmm0, xmmword [rsp + 0x38]
mov rax, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret