joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035590
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov esi, 1
mov qword [rsp + 0x38], rbp
call fcn.140038890
mov rdi, rax
test rax, rax
jne 0x1400355f0
test rbx, rbx
je 0x1400357c5
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400357c5
mov rcx, qword [rbx]
lea r8, str.Failed_to_create_WMI_object
lea edx, [rsi + 8]
mov r9d, 0x133
call rax
jmp 0x1400357c5
lea rdx, str.SELECT_Name_FROM_Win32_PROCESSOR
mov r8, rbx
mov rcx, rax
call fcn.140038ce0
test eax, eax
jne 0x14003569d
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
je 0x1400356c2
nop dword [rax]
lea r8, [rsp + 0x38]
lea rdx, str.Name
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x140035651
mov rcx, qword [rsp + 0x38]
lea rdx, str.QEMU_Virtual_CPU
mov r8, rbx
call fcn.14002ae90
test rax, rax
jne 0x14003567e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140035665
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
mov rcx, rdi
call fcn.140038cf0
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
jne 0x140035620
jmp 0x1400356c2
mov rcx, qword [rsp + 0x38]
mov esi, ebp
test rcx, rcx
je 0x1400357c5
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
jmp 0x1400357c5
test rbx, rbx
je 0x1400356c2
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400356c2
mov rcx, qword [rbx]
lea r8, str.Error:_Cmn_Wmi_query_failed
mov r9d, 0x156
mov edx, 9
call rax
lea rdx, str.SELECT__FROM_Win32_DiskDrive
mov r8, rbx
mov rcx, rdi
call fcn.140038ce0
test eax, eax
jne 0x14003579f
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
je 0x1400357c5
nop
lea r8, [rsp + 0x38]
lea rdx, str.Caption
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x140035725
mov rcx, qword [rsp + 0x38]
lea rdx, str.QEMU
mov r8, rbx
call fcn.14002ae90
test rax, rax
jne 0x14003567e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140035739
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x38]
lea rdx, str.Model
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x14003576e
mov rcx, qword [rsp + 0x38]
lea rdx, str.QEMU
mov r8, rbx
call fcn.14002ae90
test rax, rax
jne 0x14003567e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140035782
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
mov rcx, rdi
call fcn.140038cf0
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
jne 0x1400356f0
jmp 0x1400357c5
test rbx, rbx
je 0x1400357c5
mov r10, qword [rbx + 0x10]
test r10, r10
je 0x1400357c5
mov rcx, qword [rbx]
lea r8, str.Error:_Cmn_Wmi_query_failed
mov r9d, 0x198
mov edx, 9
call r10
mov rcx, rdi
call fcn.140038c20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140035920
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov esi, 1
mov qword [rsp + 0x38], rbp
call fcn.140038890
mov rdi, rax
test rax, rax
jne 0x140035980
test rbx, rbx
je 0x140035a93
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140035a93
mov rcx, qword [rbx]
lea r8, str.Failed_to_create_WMI_object
lea edx, [rsi + 8]
mov r9d, 0x9c
call rax
jmp 0x140035a93
lea rdx, str.SELECT__FROM_Win32_BIOS
mov r8, rbx
mov rcx, rax
call fcn.140038ce0
test eax, eax
jne 0x140035a6d
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
je 0x140035a93
nop dword [rax]
lea r8, [rsp + 0x38]
lea rdx, str.Manufacturer
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x1400359e0
mov rcx, qword [rsp + 0x38]
lea rdx, str.innotek_GmbH
mov r8, rbx
call fcn.14002a750
test eax, eax
je 0x140035a55
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400359f4
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x38]
lea rdx, str.SMBIOSBIOSVersion
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x140035a24
mov rcx, qword [rsp + 0x38]
lea rdx, str.VirtualBox
mov r8, rbx
call fcn.14002a750
test eax, eax
je 0x140035a55
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140035a38
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
mov rcx, rdi
call fcn.140038cf0
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
jne 0x1400359b0
jmp 0x140035a93
mov rcx, qword [rsp + 0x38]
mov esi, ebp
test rcx, rcx
je 0x140035a93
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
jmp 0x140035a93
test rbx, rbx
je 0x140035a93
mov r10, qword [rbx + 0x10]
test r10, r10
je 0x140035a93
mov rcx, qword [rbx]
lea r8, str.Error:_Cmn_Wmi_query_failed
mov r9d, 0xda
mov edx, 9
call r10
mov rcx, rdi
call fcn.140038c20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140036f80
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0xd0]
mov r12, rcx
xor edi, edi
mov rcx, rbx
mov r14, r9
mov ebp, r8d
mov r15, rdx
mov esi, edi
call fcn.140038060
mov qword [rsp + 0x20], rdi
test r12, r12
je 0x140037163
test r15, r15
je 0x140037163
cmp ebp, 0xffff
ja 0x140037163
lea r8, [0x14010fccc]
lea edx, [rdi + 6]
lea rcx, [rsp + 0x58]
mov r9d, ebp
call fcn.1400405b0
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
test r14, r14
je 0x140037072
mov r8d, dword [r14 + 4]
cmp r8d, 0x17
ja 0x14003704c
mov eax, 0x800005
bt eax, r8d
jae 0x14003704c
mov eax, dword [r14 + 8]
mov dword [rsp + 0x2c], r8d
mov dword [rsp + 0x30], eax
mov eax, dword [r14 + 0xc]
mov dword [rsp + 0x34], eax
mov eax, dword [r14]
jmp 0x140037076
mov edi, 1
test rbx, rbx
je 0x140037186
mov rax, qword [rbx + 8]
test rax, rax
je 0x140037186
mov r9d, 0xb0
jmp 0x14003717f
mov eax, dword [rsp + 0x28]
or eax, 8
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x58]
mov rcx, r15
mov dword [rsp + 0x28], eax
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400370ca
mov edi, 2
test rbx, rbx
je 0x140037186
mov r10, qword [rbx + 8]
test r10, r10
je 0x140037186
mov rcx, qword [rbx]
mov r9d, 0xbf
mov r8d, eax
mov edx, edi
call r10
jmp 0x140037186
mov edx, 0x20
lea ecx, [rdx - 0x1f]
call fcn.140022b68
mov rsi, rax
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x20]
movzx eax, word [rdx]
test ax, ax
je 0x1400370f1
cmp ax, 2
jne 0x14003710b
lea rcx, [rsi + 4]
mov r9, rbx
mov r8d, reloc.WS2_32.dll_recv
mov dword [rsi], reloc.WS2_32.dll_recv
call fcn.14002a480
jmp 0x14003714e
cmp ax, 0x17
jne 0x14003712b
lea rcx, [rsi + 4]
mov r9, rbx
mov r8d, 0x1c
mov dword [rsi], 0x1c
call fcn.14002a480
jmp 0x14003714e
mov edi, 1
test rbx, rbx
je 0x14003714e
mov r10, qword [rbx + 8]
test r10, r10
je 0x14003714e
mov rcx, qword [rbx]
lea r9d, [rdi + 0x64]
movzx r8d, ax
mov edx, edi
call r10
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
jne 0x140037186
mov qword [r12], rsi
jmp 0x14003718e
mov edi, 1
test rbx, rbx
je 0x140037186
mov rax, qword [rbx + 8]
test rax, rax
je 0x140037186
mov r9d, 0x9d
xor r8d, r8d
mov rcx, qword [rbx]
mov edx, edi
call rax
mov rcx, rsi
call fcn.1400108e4
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400371b0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, qword [rsp + 0x220]
mov r14d, r9d
mov ebp, r8d
mov edi, edx
mov rsi, rcx
test rcx, rcx
jne 0x140037211
test rbx, rbx
je 0x140037207
mov rax, qword [rbx + 8]
test rax, rax
je 0x140037207
lea edx, [rcx + 1]
mov rcx, qword [rbx]
mov r9d, 0x105
xor r8d, r8d
call rax
mov eax, 1
jmp 0x140037304
lea rcx, [0x1401319b8]
call fcn.14003bd30
test eax, eax
jne 0x140037284
cmp dword [0x14013ea30], eax
jne 0x140037274
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r8d, eax
test eax, eax
jne 0x14003724e
lea rcx, [0x1400380e0]
call fcn.14000cf6c
jmp 0x14003726a
test rbx, rbx
je 0x14003726a
mov rax, qword [rbx + 8]
test rax, rax
je 0x14003726a
mov rcx, qword [rbx]
mov edx, 2
lea r9d, [rdx + 0x48]
call rax
mov dword [0x14013ea30], 0xffffffff
lea rcx, [0x1401319b8]
call fcn.14003c120
test eax, eax
je 0x1400372a8
test rbx, rbx
je 0x1400372a8
cmp qword [rbx + 8], 0
je 0x1400372a8
call fcn.140011a10
mov rcx, qword [rbx]
mov r9d, 0x3d
mov r8d, dword [rax]
lea edx, [r9 - 0x29]
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r8d, r14d
mov edx, ebp
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400372e9
test rbx, rbx
je 0x1400372e2
cmp qword [rbx + 8], 0
je 0x1400372e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rbx]
lea edx, [rdi + 3]
mov r8d, eax
mov r9d, 0x10f
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, 2
jmp 0x140037304
mov edx, reloc.WS2_32.dll_recv
lea ecx, [rdx - 0xf]
call fcn.140022b68
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax], rdi
mov qword [rsi], rax
mov eax, ecx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0x1d0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400373a0
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
test rcx, rcx
je 0x14003741d
test rdx, rdx
je 0x14003741d
mov r8d, dword [rdx]
test r8d, r8d
je 0x14003741d
mov rcx, qword [rcx]
add rdx, 4
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140037415
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [rax - 0x2733]
cmp ecx, 1
jbe 0x14003740a
test rbx, rbx
je 0x1400373ff
mov r10, qword [rbx + 8]
test r10, r10
je 0x1400373ff
mov rcx, qword [rbx]
mov r9d, 0x26d
mov r8d, eax
mov edx, 2
call r10
mov eax, 2
add rsp, 0x20
pop rbx
ret
mov eax, 0x1b
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
test rbx, rbx
je 0x14003743e
mov r10, qword [rbx + 8]
test r10, r10
je 0x14003743e
mov rcx, qword [rbx]
xor r8d, r8d
mov r9d, 0x25e
lea edx, [r8 + 1]
call r10
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140037610
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r9
mov rdi, r8
test rcx, rcx
je 0x1400376b7
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400376b7
test rdx, rdx
je 0x1400376b7
test r8, r8
je 0x1400376b7
mov r8d, dword [r8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1400376a4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14003766e
mov eax, 0x1b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x140037694
cmp qword [rbx + 8], 0
je 0x140037694
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rbx]
mov edx, 2
mov r8d, eax
mov r9d, 0x290
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rcx, eax
xor eax, eax
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x1400376d8
mov r10, qword [r9 + 8]
test r10, r10
je 0x1400376d8
mov rcx, qword [rbx]
xor r8d, r8d
mov r9d, 0x283
lea edx, [r8 + 1]
call r10
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400379b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r9
mov rdi, r8
test rcx, rcx
je 0x140037a57
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140037a57
test rdx, rdx
je 0x140037a57
test r8, r8
je 0x140037a57
mov r8d, dword [r8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140037a44
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140037a0e
mov eax, 0x1b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x140037a34
cmp qword [rbx + 8], 0
je 0x140037a34
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rbx]
mov edx, 2
mov r8d, eax
mov r9d, 0x2b5
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rcx, eax
xor eax, eax
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x140037a78
mov r10, qword [r9 + 8]
test r10, r10
je 0x140037a78
mov rcx, qword [rbx]
xor r8d, r8d
mov r9d, reloc.SHELL32.dll_IsUserAnAdmin
lea edx, [r8 + 1]
call r10
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140037a90
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xea580]
mov eax, 0xea680
call fcn.14000c990
sub rsp, rax
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rbp + 0xea570], rax
xor r12d, r12d
mov ebx, edx
mov r15, r8
mov r14, rcx
mov eax, 0x10624dd3
mov ecx, r15d
mov r9d, r12d
mov dword [rsp + 0x40], r12d
mov r10d, r12d
imul r15d
sar edx, 6
mov dword [rbp + 0x4e150], r12d
mov r8d, r12d
mov eax, edx
mov dword [rbp + 0x9c360], r12d
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x30], edx
imul eax, edx, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x34], eax
test ebx, ebx
je 0x140037cc7
mov r11, r14
mov esi, ebx
mov edi, ebx
mov r13d, 0x300
nop dword [rax]
movzx ebx, word [r11 + 8]
test r13w, bx
je 0x140037b77
mov ecx, r12d
test r9d, r9d
je 0x140037b54
mov rdx, qword [r11]
cmp qword [rsp + rcx*8 + 0x48], rdx
je 0x140037b54
inc ecx
cmp ecx, r9d
jb 0x140037b46
cmp ecx, r9d
jne 0x140037b77
cmp r9d, 0x9c40
jae 0x140037b77
mov rax, qword [r11]
mov qword [rsp + rcx*8 + 0x48], rax
mov r9d, dword [rsp + 0x40]
inc r9d
mov dword [rsp + 0x40], r9d
test bl, 0x10
je 0x140037bcb
mov ecx, r12d
test r10d, r10d
je 0x140037ba1
mov rdx, qword [r11]
nop word [rax + rax]
cmp qword [rbp + rcx*8 + 0x4e158], rdx
je 0x140037ba1
inc ecx
cmp ecx, r10d
jb 0x140037b90
cmp ecx, r10d
jne 0x140037bcb
cmp r10d, 0x9c40
jae 0x140037bcb
mov rax, qword [r11]
mov qword [rbp + rcx*8 + 0x4e158], rax
mov r10d, dword [rbp + 0x4e150]
inc r10d
mov dword [rbp + 0x4e150], r10d
test bl, 1
je 0x140037c1f
mov eax, r12d
test r8d, r8d
je 0x140037bf3
mov rdx, qword [r11]
nop dword [rax + rax]
mov ecx, eax
cmp qword [rbp + rcx*8 + 0x9c368], rdx
je 0x140037bf3
inc eax
cmp eax, r8d
jb 0x140037be0
cmp eax, r8d
jne 0x140037c1f
cmp r8d, 0x9c40
jae 0x140037c1f
mov ecx, eax
mov rax, qword [r11]
mov qword [rbp + rcx*8 + 0x9c368], rax
mov r8d, dword [rbp + 0x9c360]
inc r8d
mov dword [rbp + 0x9c360], r8d
add r11, 0x10
dec rdi
jne 0x140037b30
test r9d, r9d
jne 0x140037c3f
test r10d, r10d
jne 0x140037c3f
test r8d, r8d
je 0x140037cc7
lea rax, [rsp + 0x30]
lea r9, [rbp + 0x9c360]
lea r8, [rbp + 0x4e150]
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
test eax, eax
jle 0x140037cd3
lea rbx, [r14 + 0xa]
nop
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x40]
mov word [rbx], r12w
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140037c8a
or word [rbx], r13w
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x4e150]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140037ca2
or word [rbx], 0x10
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x9c360]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140037cba
or word [rbx], 1
add rbx, 0x10
dec rsi
jne 0x140037c70
mov eax, edi
jmp 0x140037cd3
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, r12d
mov rcx, qword [rbp + 0xea570]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0xea6c8]
add rsp, 0xea680
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400380f0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r8d, eax
test eax, eax
jne 0x140038133
lea rcx, [0x1400380e0]
call fcn.14000cf6c
jmp 0x14003814f
test rbx, rbx
je 0x14003814f
mov rax, qword [rbx + 8]
test rax, rax
je 0x14003814f
mov rcx, qword [rbx]
mov edx, 2
lea r9d, [rdx + 0x48]
call rax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0x1d0
pop rbx
ret
Function at 0x14003b3b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov esi, ecx
mov qword [rsp + 0x30], rdi
mov rbx, qword [0x14013ea68]
test rbx, rbx
je 0x14003b411
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x14003b411
test esi, esi
je 0x14003b3ff
mov rax, qword [rbx]
test rax, rax
je 0x14003b3ff
mov rcx, qword [rbx + 8]
call rax
mov rdx, qword [rbx + 0x10]
mov rcx, qword [0x14013ea68]
call fcn.14003c400
jmp 0x14003b3c1
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x14003b710
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [0x14013ea60]
xor esi, esi
mov ebp, ecx
test rdi, rdi
jne 0x14003b733
mov edi, esi
jmp 0x14003b758
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
lea ecx, [rbp - 1]
mov dword [rdi + 0x28], 6
cmp ecx, 1
jbe 0x14003b772
mov ecx, 1
call fcn.1400125a4
int3
test byte [rdi + 0x194], 1
je 0x14003b79d
mov eax, ebp
sub eax, 1
je 0x14003b78e
cmp eax, 1
jne 0x14003b791
mov esi, 0xffffffff
jmp 0x14003b791
mov esi, dword [rdi + 0x48]
call fcn.14003c8a0
mov ecx, esi
call fcn.140040a3c
mov ecx, 1
call fcn.14003b3b0
lea rcx, [rdi + 0x70]
mov edx, ebp
call fcn.140040950
int3

Function at 0x14003b850
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14003b866
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14003b8a0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
lea ecx, [rdx - 0x1f]
call fcn.140022b68
mov rbx, rax
test rax, rax
jne 0x14003b8e0
lea eax, [rbx + 0xc]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
cmp eax, 0xffffffff
jne 0x14003b911
mov rcx, rbx
call fcn.1400108e4
mov eax, reloc.WS2_32.dll_inet_addr
mov qword [rdi], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
test rsi, rsi
je 0x14003b920
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rsi
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c260
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, qword [0x14013ea60]
xor esi, esi
movaps xmmword [rsp + 0x70], xmm6
mov r14, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
test rdi, rdi
je 0x14003c2bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14003c2bc
movups xmm6, xmmword [rdi + 0x10]
jmp 0x14003c3d9
lea rcx, [rsp + 0x60]
call fcn.14003b190
movups xmm6, xmmword [rax]
movq rbp, xmm6
test rbp, rbp
je 0x14003c3d2
or dword [rbp + 0x194], 1
mov dword [rbp + 0x184], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x198], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rbp + 8]
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rdi
mov dword [rsp + 0x20], esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14003c3b7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x14003c38f
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rbx, rax
test rax, rax
je 0x14003c38f
mov rcx, qword [rbp + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
test rax, rax
je 0x14003c38f
mov qword [rbp + 0x1a0], rbx
jmp 0x14003c394
mov esi, 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbp + 0x188], eax
mov rdx, rbp
mov rcx, qword [0x14013ea60]
call fcn.14003c400
test esi, esi
je 0x14003c3d2
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm6
call fcn.14003b5d0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
jmp 0x14003c3dd
mov dword [rbp + 0x28], 2
movups xmmword [r14], xmm6
mov rbx, qword [rsp + 0xc0]
mov rax, r14
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret