joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d6d00
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6d6db6
mov rcx, qword [rbx + 0x10]
call fcn.005d9d60
mov rcx, qword [0x005ed378]
mov dl, 1
mov r8, rax
call fcn.005d0a30
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005f40d0
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006d6370]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005d9d60
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005d9d60
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6d6e61
mov rcx, qword [rbx + 0x10]
call fcn.005d9d60
mov rcx, qword [0x005ed378]
mov dl, 1
mov r8, rax
call fcn.005d0a30
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005f40d0
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006d63d0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005d9d60
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005d9d60
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6d6efd
mov rcx, qword [rbx + 0x10]
call fcn.005d9d60
mov rcx, qword [0x005ee350]
mov dl, 1
mov r8, rax
call fcn.005d0a30
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x480], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005d9d60
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005d9d60
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x14004058c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140096268]
test rax, rax
je 0x1400405d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400405d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400405d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400405d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400405d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400405d8
xor al, al
add rsp, 0x28
ret

Function at 0x140079d1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140079b18
Function at 0x1400110b9
Capabilities:
Create udp socket
Send data
Send data on socket
Terminate process

Disassembly:
jmp 0x1400118e0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x250
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x58
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x278]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x218], rax
lea rcx, [0x1400240a9]
call fcn.1400113de
nop
mov r8d, reloc.WSOCK32.dll_recvfrom
mov edx, 2
mov ecx, 2
call qword [sym.imp.WSOCK32.dll_socket]
mov dword [0x14001e1b0], eax
cmp dword [0x14001e1b0], 0
jg 0x14001196d
lea rcx, str.failed_to_create_socket
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov eax, 2
mov word [0x14001e1b4], ax
movzx ecx, word [rbp + 0x240]
call qword [sym.imp.WSOCK32.dll_htons]
mov word [0x14001e1b6], ax
lea r8, [0x14001e1b8]
mov rdx, qword [rbp + 0x248]
mov ecx, 2
call fcn.14001101e
test eax, eax
jg 0x1400119c3
lea rcx, str.Error_al_convertir_la_direcci
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, [rbp + 0x10]
lea rcx, str.Hola_desde_el_cliente
mov rdi, rax
mov rsi, rcx
mov ecx, socket
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x26]
mov rdi, rax
xor eax, eax
mov ecx, 0xea
rep stosb byte [rdi], al
mov dword [rbp + 0x124], 0x100
movsxd rax, dword [0x14001e1b0]
mov dword [rsp + 0x28], recvfrom
lea rcx, [0x14001e1b4]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x124]
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_sendto]
mov dword [rbp + 0x144], eax
mov eax, dword [rbp + 0x124]
cmp dword [rbp + 0x144], eax
je 0x140011a54
lea rcx, str.failed_to_send_packet_n
call fcn.1400111c7
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, str._n_____Cliente_iniciado______n_n
call fcn.1400111c7
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac00]
call fcn.14001136b
mov rcx, qword [rbp + 0x218]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x220]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001118b
Capabilities:
Create udp socket
Terminate process

Disassembly:
jmp 0x140012030
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x140024175]
call fcn.1400113de
nop
mov r8d, reloc.WSOCK32.dll_recvfrom
mov edx, 2
mov ecx, 2
call qword [sym.imp.WSOCK32.dll_socket]
mov dword [0x14001e1e0], eax
cmp dword [0x14001e1e0], 0
jg 0x14001208e
lea rcx, str.failed_to_create_socket
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov eax, 2
mov word [0x14001e380], ax
mov dword [0x14001e384], 0
movzx ecx, word [rbp + 0xe0]
call qword [sym.imp.WSOCK32.dll_htons]
mov word [0x14001e382], ax
movsxd rax, dword [0x14001e1e0]
mov r8d, recvfrom
lea rdx, [0x14001e380]
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_bind]
test eax, eax
jge 0x1400120f3
lea rcx, str.failed_to_bind_socket
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, str._n_____Servidor_iniciado______n_n
call fcn.1400111c7
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140011226
Capabilities:
Terminate process

Disassembly:
jmp 0x140013880
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112c1
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140012210
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x14002423f]
call fcn.1400113de
nop
lea rdx, [rbp + 0x30]
mov cx, 0x202
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x140012274
lea rdx, str.Error_en_la_inicializacion_del_coso_n
lea rcx, [0x14001b17c]
call fcn.1400111c7
nop
lea rcx, str.1__Servidor___2__Cliente_:
call fcn.1400111c7
nop
lea rdx, [rbp + 4]
lea rcx, [0x14001b1a4]
call fcn.14001123a
nop
cmp dword [rbp + 4], 1
jne 0x1400122b1
mov ecx, 0x7530
call fcn.14001118b
nop
call fcn.14001131b
nop
call fcn.1400112b7
nop
jmp 0x1400122e4
cmp dword [rbp + 4], 2
jne 0x1400122d7
lea rdx, str.192.168.1.38
mov ecx, 0x7530
call fcn.1400110b9
nop
call fcn.1400110cd
nop
call fcn.14001137a
nop
jmp 0x1400122e4
lea rcx, str._nEsa_opcion_no_existe_n
call fcn.1400111c7
nop
call qword [sym.imp.WSOCK32.dll_WSACleanup]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WSOCK32.dll_bind
call fcn.14001136b
mov eax, edi
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret
Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014bc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014be0
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014bf3
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014c1d
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014c31
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014c43
xor al, al
jmp 0x140014c61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014c5f
xor al, al
jmp 0x140014c61
mov al, 1
add rsp, 0x38
ret
Function at 0x14001131b
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x140011e90
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xbe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x140024175]
call fcn.1400113de
nop
xor eax, eax
cmp eax, 1
je 0x140011fb3
mov dword [rbp + 0x244], 0x100
mov dword [rbp + 0x294], recvfrom
movsxd rax, dword [rbp + 0x294]
mov r8, rax
xor edx, edx
lea rcx, [rbp + 0x268]
call fcn.140011316
nop
movsxd rax, dword [0x14001e1e0]
lea rcx, [rbp + 0x294]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x268]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x244]
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_recvfrom]
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
jg 0x140011f4d
jmp 0x140011fb3
mov r9d, 0x100
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x26c]
mov ecx, 2
call fcn.14001122b
nop
movzx ecx, word [rbp + 0x26a]
call qword [sym.imp.WSOCK32.dll_ntohs]
movzx eax, ax
mov dword [rbp + 0x2d4], eax
lea rdx, [rbp + 0x10]
lea rcx, [0x14001afe4]
call fcn.1400111c7
nop
mov r8d, dword [rbp + 0x2d4]
lea rdx, [rbp + 0x130]
lea rcx, str.package_received_from__s:_i__n_n
call fcn.1400111c7
nop
jmp 0x140011ece
lea rcx, [rbp - 0x30]
lea rdx, [0x14001af50]
call fcn.14001136b
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x478]
pop rdi
pop rbp
ret
Function at 0x140012ac0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011406
movzx eax, al
test eax, eax
jne 0x140012ae0
mov ecx, 7
call fcn.140011375
nop
mov byte [rsp + 0x20], 0
call fcn.14001138e
mov byte [rsp + 0x21], al
cmp dword [0x14001ea98], 1
jne 0x140012b04
mov ecx, 7
call fcn.140011375
nop
jmp 0x140012b5c
cmp dword [0x14001ea98], 0
jne 0x140012b57
mov dword [0x14001ea98], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111cc
test eax, eax
je 0x140012b38
mov eax, 0xff
jmp 0x140012c61
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011384
mov dword [0x14001ea98], 2
jmp 0x140012b5c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011361
call fcn.1400112ee
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012bb9
mov rcx, qword [rsp + 0x30]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x140012bb9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.14001132a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012bed
mov rcx, qword [rsp + 0x38]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x140012bed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113c5
nop
call fcn.140012d10
mov dword [rsp + 0x28], eax
call fcn.1400112cb
movzx eax, al
test eax, eax
jne 0x140012c0c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012c1b
call fcn.1400113cf
nop
xor edx, edx
mov cl, 1
call fcn.140011168
mov eax, dword [rsp + 0x28]
jmp 0x140012c61
add rsp, 0x68
ret

Function at 0x140001320
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
lea rcx, [0x1400063a8]
jmp 0x14000b3fe

Function at 0x140001bc0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rcx, [0x140006194]
jmp 0x14000c14b

Function at 0x140001d00
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rcx, [0x140006418]
jmp 0x14000c34c

Function at 0x140002730
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x300
lea rcx, [0x140006458]
jmp 0x14000d44d

Function at 0x140003360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x68
lea rcx, [0x1400063b0]
jmp 0x14000e889

Function at 0x140003590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rcx, [0x1400061d4]
jmp 0x14000ebb8

Function at 0x1400044c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rcx, [0x140006188]
jmp 0x14001053c
Function at 0x1400188fb
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
sub rsp, 0x28
mov rdx, rsp
mov rcx, 4
call fcn.140028f00
mov rcx, 0x300033
call fcn.140018bda
pushfq
push rcx
mov rcx, 0x300034
call fcn.140018c32
popfq
mov rdx, qword [rsp + 0x38]
pushfq
push rcx
mov rcx, 0x300035
call fcn.140018c32
popfq
mov rcx, qword [rsp + 0x40]
pushfq
push rcx
mov rcx, 0x300036
call fcn.140018c32
popfq
mov eax, dword [rsp + 0x30]
pushfq
push rcx
mov rcx, 0x300037
call fcn.140018c32
popfq
push rbx
pushfq
push rcx
mov rcx, 0x300038
call fcn.140018c32
popfq
push rsi
pushfq
push rcx
mov rcx, 0x300039
call fcn.140018c32
popfq
push rdi
pushfq
push rcx
mov rcx, 0x30003a
call fcn.140018c32
popfq
lea rdi, [0x14006a630]
pushfq
push rcx
mov rcx, 0x30003b
call fcn.140018c32
popfq
not eax
pushfq
push rcx
mov rcx, 0x30003c
call fcn.140018c32
popfq
sub rcx, 4
jb 0x140018ae2
pushfq
push rcx
mov rcx, 0x30003f
call fcn.140018c32
popfq
mov ebx, dword [rdx]
pushfq
push rcx
mov rcx, 0x300040
call fcn.140018c32
popfq
xor ebx, eax
pushfq
push rcx
mov rcx, 0x300041
call fcn.140018c32
popfq
movzx esi, bl
pushfq
push rcx
mov rcx, 0x300042
call fcn.140018c32
popfq
mov eax, dword [rdi + rsi*4 + 0xc00]
pushfq
push rcx
mov rcx, 0x300043
call fcn.140018c32
popfq
shr ebx, 8
pushfq
push rcx
mov rcx, 0x300044
call fcn.140018c32
popfq
movzx esi, bl
pushfq
push rcx
mov rcx, 0x300045
call fcn.140018c32
popfq
xor eax, dword [rdi + rsi*4 + 0x800]
pushfq
push rcx
mov rcx, 0x300046
call fcn.140018c32
popfq
shr ebx, 8
pushfq
push rcx
mov rcx, 0x300047
call fcn.140018c32
popfq
movzx esi, bl
pushfq
push rcx
mov rcx, 0x300048
call fcn.140018c32
popfq
xor eax, dword [rdi + rsi*4 + 0x400]
pushfq
push rcx
mov rcx, 0x300049
call fcn.140018c32
popfq
shr ebx, 8
pushfq
push rcx
mov rcx, 0x30004a
call fcn.140018c32
popfq
xor eax, dword [rdi + rbx*4]
pushfq
push rcx
mov rcx, 0x30004b
call fcn.140018c32
popfq
add rdx, 4
pushfq
push rcx
mov rcx, 0x30004c
call fcn.140018c32
popfq
sub rcx, 4
jae 0x1400189d4
pushfq
push rcx
mov rcx, 0x30004f
call fcn.140018c32
popfq
add rcx, 4
je 0x140018b66
pushfq
push rcx
mov rcx, 0x300052
call fcn.140018c32
popfq
movzx ebx, byte [rdx]
pushfq
push rcx
mov rcx, 0x300053
call fcn.140018c32
popfq
xor bl, al
pushfq
push rcx
mov rcx, 0x300054
call fcn.140018c32
popfq
shr eax, 8
pushfq
push rcx
mov rcx, 0x300055
call fcn.140018c32
popfq
xor eax, dword [rdi + rbx*4]
pushfq
push rcx
mov rcx, 0x300056
call fcn.140018c32
popfq
add rdx, 1
pushfq
push rcx
mov rcx, 0x300057
call fcn.140018c32
popfq
sub rcx, 1
jne 0x140018af7
pushfq
push rcx
mov rcx, 0x30005a
call fcn.140018c32
popfq
pop rdi
pushfq
push rcx
mov rcx, 0x30005b
call fcn.140018c32
popfq
pop rsi
pushfq
push rcx
mov rcx, 0x30005c
call fcn.140018c32
popfq
pop rbx
pushfq
push rcx
mov rcx, 0x30005d
call fcn.140018c32
popfq
not eax
mov rcx, 0x30005e
call fcn.140018bda
jmp 0x140018bc4
push rax
push rax
sub rsp, 0x20
call fcn.140029170
add rsp, 0x20
pop rax
pop rax
add rsp, 0x28
ret
Function at 0x140018e88
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140073eb4]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140019350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400773c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400193aa
mov r8, qword [0x1400661b3]
mov rcx, qword [0x140076f14]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400773c4]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.140018e6e
lea rcx, [0x140019328]
mov rdx, rbx
call fcn.140019618
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400193b4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400773c4], eax
add rsp, 0x28
jmp fcn.140019350
Function at 0x140019618
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400773c8], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1400773d8]
jne 0x140019665
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140077400], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400773c8], 1
mov ecx, dword [0x140077400]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x14001973a
mov rcx, qword [0x140076f14]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140019765
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400773d0]
test rax, rax
je 0x1400196b5
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400773d0], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x140019780]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140077400]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140076f14]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140019765
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001a09c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14001a162
lea rcx, [0x14007cda0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400775a8]
jmp 0x14001a126
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001a123
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400775a8]
mov rdx, rsi
call fcn.140026af0
jmp 0x14001a126
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14001a0f3
mov rdx, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x1400775a8]
mov rdi, rdx
inc rdx
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.140026b38
lea rcx, [0x14007cda0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x14001a700
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1400283a0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14004ace4
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14001a730
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400284e0

Function at 0x14001aa50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r15
sub rsp, 0x28
mov ebp, r9d
mov edi, edx
mov rsi, rcx
test r8, r8
je 0x14001ab3a
movzx r15d, word [r8]
test r15w, r15w
je 0x14001ab3a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x20], r14
cmovs edi, r13d
test rcx, rcx
je 0x14001aabd
cmp word [rcx], r13w
je 0x14001aabd
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], r13w
jne 0x14001aaa5
cmp ebx, edi
cmovg ebx, edi
sub edi, ebx
jns 0x14001aac0
mov edi, r13d
jmp 0x14001aac0
mov ebx, r13d
call fcn.140028520
lea ecx, [rbx + rdi]
mov edx, ebp
mov r12d, eax
call fcn.1400283a0
mov r14, rax
test r12d, r12d
je 0x14001aae5
mov ecx, r12d
call fcn.140028590
mov rsi, rax
mov r12, qword [rsp + 0x58]
test ebx, ebx
je 0x14001ab03
movsxd rcx, edi
movsxd r8, ebx
mov rdx, rsi
lea rcx, [r14 + rcx*2]
add r8, r8
call sub.msvcrt.dll_memmove
test edi, edi
je 0x14001ab19
mov edx, edi
mov rdi, r14
movzx eax, r15w
mov ecx, edx
lea r14, [r14 + rdx*2]
rep stosw word [rdi], ax
movsxd rax, ebx
mov rbx, qword [rsp + 0x50]
mov word [r14 + rax*2], r13w
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
add rsp, 0x28
pop r15
pop rdi
pop rsi
pop rbp
ret
mov ecx, r9d
add rsp, 0x28
pop r15
pop rdi
pop rsi
pop rbp
jmp fcn.1400285c0