joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012840
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400128a1
mov rax, qword [rdi + 0x50]
and rax, 0xfffffffffffffffc
je 0x140012873
mov rcx, qword [rax + 0x10]
call fcn.14000d390
mov rdi, qword [rdi + 0x40]
test rdi, rdi
je 0x140012899
lock dec dword [rdi + 8]
jne 0x140012899
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock dec dword [rdi + 0xc]
jne 0x140012899
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + ioctlsocket]
mov qword [rsi + 0x10], 0
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x1400128f7
mov ecx, dword [0x140033ab4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400128d1
mov rax, qword [rax + 8]
test rax, rax
je 0x1400128d1
cmp qword [rax], 0
je 0x1400128dc
cmp qword [rax + 8], 0
je 0x1400128e0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
jmp 0x1400128ef
xor ecx, ecx
jmp 0x1400128e5
mov ecx, 1
movzx edx, byte [rdi + 0x60]
mov byte [rdi], dl
mov qword [rax + rcx*8], rdi
mov qword [rsi + 8], 0
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x140012a60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x140012ac1
mov rax, qword [rdi + 0x50]
and rax, 0xfffffffffffffffc
je 0x140012a93
mov rcx, qword [rax + 0x10]
call fcn.14000d390
mov rdi, qword [rdi + 0x40]
test rdi, rdi
je 0x140012ab9
lock dec dword [rdi + 8]
jne 0x140012ab9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock dec dword [rdi + 0xc]
jne 0x140012ab9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + ioctlsocket]
mov qword [rsi + 0x10], 0
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x140012b17
mov ecx, dword [0x140033ab4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140012af1
mov rax, qword [rax + 8]
test rax, rax
je 0x140012af1
cmp qword [rax], 0
je 0x140012afc
cmp qword [rax + 8], 0
je 0x140012b00
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
jmp 0x140012b0f
xor ecx, ecx
jmp 0x140012b05
mov ecx, 1
movzx edx, byte [rdi + 0x60]
mov byte [rdi], dl
mov qword [rax + rcx*8], rdi
mov qword [rsi + 8], 0
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013970
Capabilities:
Terminate thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140013ae9
call fcn.14000d390
mov rax, qword [rsi + 0x30]
mov ecx, 1
mov edx, 1
xchg dword [rax + 0x34], edx
test edx, edx
jne 0x140013a33
xchg dword [rax + 0x38], ecx
test ecx, ecx
jne 0x140013a33
mov rcx, qword [rax + 0x28]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x140013a33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rbp - 0x20], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x1400139ff
test edi, edi
setne al
jmp 0x140013a12
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, edi
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], edi
lea rcx, [0x1400325c8]
mov qword [rbp - 0x18], rcx
test al, 1
jne 0x140013af1
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x140013ace
vpermilps xmm0, xmmword [rdi + 8], 0x4e
vmovaps xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0x50]
mov ecx, 2
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mfence
mov eax, dword [0x140033ab8]
mov rdx, qword [rdi + 8]
test eax, eax
je 0x140013a8c
mov rcx, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140013aab
lea rcx, [0x14000d760]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x140013ac6
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14001d8fc
mov qword [rsi + 0x38], 0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x140013ae1
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsi + 0x30], 0
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea r8, str.pqcs
lea rsi, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3
Function at 0x140013b50
Capabilities:
Terminate thread

Disassembly:
add rcx, 0x28
jmp 0x140013b50
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x38], 0
je 0x140013be0
test edx, edx
jne 0x140013cbc
mov rax, qword [rsi + 0x30]
mov ecx, 1
mov edx, 1
xchg dword [rax + 0x34], edx
test edx, edx
jne 0x140013c2a
xchg dword [rax + 0x38], ecx
test ecx, ecx
jne 0x140013c2a
mov rcx, qword [rax + 0x28]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x140013c2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rbp - 0x20], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x140013bf6
test edi, edi
setne al
jmp 0x140013c09
test edx, edx
je 0x140013cbc
mov rax, qword [rsi + 0x30]
xor ecx, ecx
xchg dword [rax + 0x34], ecx
jmp 0x140013cbc
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, edi
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], edi
lea rcx, [0x1400325c8]
mov qword [rbp - 0x18], rcx
test al, 1
jne 0x140013cc4
mov rdi, qword [rsi + 0x38]
vpermilps xmm0, xmmword [rdi + 8], 0x4e
vmovaps xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0x50]
mov ecx, 2
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mfence
mov eax, dword [0x140033ab8]
mov rdx, qword [rdi + 8]
test eax, eax
je 0x140013c7a
mov rcx, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140013c99
lea rcx, [0x14000d760]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x140013cb4
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14001d8fc
mov qword [rsi + 0x38], 0
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea r8, str.pqcs
lea rsi, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3
Function at 0x140017a60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140017a95
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x140017a8d
xor edx, edx
call qword [rcx]
mov qword [rsi + 0x10], 0
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x140017aeb
mov ecx, dword [0x140033ab4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140017ac5
mov rax, qword [rax + 8]
test rax, rax
je 0x140017ac5
cmp qword [rax], 0
je 0x140017ad0
cmp qword [rax + 8], 0
je 0x140017ad4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
jmp 0x140017ae3
xor ecx, ecx
jmp 0x140017ad9
mov ecx, 1
movzx edx, byte [rdi + 0x48]
mov byte [rdi], dl
mov qword [rax + rcx*8], rdi
mov qword [rsi + 8], 0
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019db0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
mov dword [rsp + 0x3c], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov rax, qword [0x1400325d0]
shr rax, 1
movabs r14, 0x595588bd12bf6fe8
cmp rax, r14
jne 0x140019e0f
test edi, edi
setne al
jmp 0x140019e22
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, edi
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov dword [rbx], edi
mov dword [rbx + 4], 0
lea r15, [0x1400325c8]
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
cmp edi, 0x4d2
je 0x140019e87
cmp edi, 0x40
jne 0x140019ed8
mov rax, qword [0x1400325d0]
shr rax, 1
cmp rax, r14
je 0x140019e7b
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2746
call qword [rax + 0x30]
test al, al
je 0x140019eb7
mov eax, 3
mov ecx, 0x2746
jmp 0x140019ecd
mov rax, qword [0x1400325d0]
shr rax, 1
cmp rax, r14
je 0x140019eb0
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x274d
call qword [rax + 0x30]
test al, al
je 0x140019ec3
mov eax, 3
jmp 0x140019ec8
mov eax, 2
mov ecx, 0x2746
jmp 0x140019ecd
mov eax, 2
mov ecx, 0x274d
mov qword [rbx], rcx
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
mov eax, 0xffffffff
test esi, esi
jne 0x140019f22
mov rcx, qword [0x1400325d0]
shr rcx, 1
mov eax, 2
cmp rcx, r14
je 0x140019f0f
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
xor edx, edx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbx], 0
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x3c]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001af70
Capabilities:
Get socket status

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x440
mov rsi, r8
cmp rcx, 0xffffffffffffffff
je 0x14001afd5
mov qword [rsp + 0x240], rcx
mov dword [rsp + 0x238], 1
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
test edx, edx
js 0x14001b032
mov eax, edx
imul rax, rax, 0x10624dd3
shr rax, 0x26
mov dword [rsp + 0x28], eax
imul eax, eax, 0x3e8
sub edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x28]
jmp 0x14001b034
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
je 0x14001b00d
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2719
call qword [rax + 0x30]
mov ecx, 2
test al, al
je 0x14001b012
mov ecx, 3
mov qword [rsi], 0x2719
lea rax, [0x1400325c8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov edi, 0xffffffff
jmp 0x14001b10f
xor eax, eax
inc ecx
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x238]
lea r9, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
test eax, eax
js 0x14001b06e
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14001b096
cmp rax, 1
jne 0x14001b09f
lea rbx, [0x1400326e0]
jmp 0x14001b0a3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14001b0dd
test ebx, ebx
setne al
jmp 0x14001b0f0
lea rbx, [0x1400325c8]
jmp 0x14001b0a3
mov rbx, qword [rsi + 8]
mov rcx, qword [rbx + 8]
shr rcx, 1
mov eax, 2
movabs rdx, 0x595588bd12bf6fe8
cmp rcx, rdx
je 0x14001b0d0
mov rax, qword [rbx]
mov rcx, rbx
xor edx, edx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rsi], 0
mov qword [rsi + 8], rbx
jmp 0x14001b10b
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, ebx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov dword [rsi], ebx
mov dword [rsi + 4], 0
lea rcx, [0x1400325c8]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov eax, edi
add rsp, 0x440
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001b550
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, r9
cmp rcx, 0xffffffffffffffff
je 0x14001b5ac
mov ebx, edx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 1
test dl, 1
jne 0x14001b609
test r8d, r8d
js 0x14001b725
mov eax, r8d
imul rax, rax, 0x10624dd3
shr rax, 0x26
mov dword [rsp + 0x30], eax
imul eax, eax, 0x3e8
sub r8d, eax
imul eax, r8d, 0x3e8
jmp 0x14001b613
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
je 0x14001b5e4
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2719
call qword [rax + 0x30]
mov ecx, 2
test al, al
je 0x14001b5e9
mov ecx, 3
mov qword [rsi], 0x2719
lea rax, [0x1400325c8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov edi, 0xffffffff
jmp 0x14001b75e
mov dword [rsp + 0x30], 0
xor eax, eax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
inc ecx
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
test eax, eax
js 0x14001b651
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14001b680
cmp rax, 1
jne 0x14001b689
lea r14, [0x1400326e0]
jmp 0x14001b68d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14001b72c
test ebx, ebx
setne al
jmp 0x14001b73f
lea r14, [0x1400325c8]
jmp 0x14001b68d
mov r14, qword [rsi + 8]
mov rcx, qword [r14 + 8]
shr rcx, 1
mov eax, 2
movabs r15, 0x595588bd12bf6fe8
cmp rcx, r15
je 0x14001b6ba
mov rax, qword [r14]
mov rcx, r14
xor edx, edx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rsi], 0
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rax
test bl, 1
je 0x14001b75e
test edi, edi
jne 0x14001b75e
mov rax, qword [0x1400325d0]
shr rax, 1
cmp rax, r15
je 0x14001b708
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2733
call qword [rax + 0x30]
mov ecx, 2
test al, al
je 0x14001b70d
mov ecx, 3
mov qword [rsi], 0x2733
lea rax, [0x1400325c8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
jmp 0x14001b75e
xor eax, eax
jmp 0x14001b61c
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, ebx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov dword [rsi], ebx
mov dword [rsi + 4], 0
lea rcx, [0x1400325c8]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov eax, edi
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001cb70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], r9d
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov rax, qword [0x1400325d0]
shr rax, 1
movabs r14, 0x595588bd12bf6fe8
cmp rax, r14
jne 0x14001cbd9
test edi, edi
setne al
jmp 0x14001cbec
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, edi
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov dword [rbx], edi
mov dword [rbx + 4], 0
lea r15, [0x1400325c8]
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
cmp edi, 0x2738
je 0x14001ccbd
cmp edi, 0x4d2
je 0x14001cc54
cmp edi, 0x40
jne 0x14001cc89
mov rax, qword [0x1400325d0]
shr rax, 1
cmp rax, r14
je 0x14001cc4d
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2746
call qword [rax + 0x30]
test al, al
je 0x14001cc9f
mov eax, 3
jmp 0x14001cca4
mov rax, qword [0x1400325d0]
shr rax, 1
cmp rax, r14
je 0x14001cc7d
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x274d
call qword [rax + 0x30]
test al, al
je 0x14001cc93
mov eax, 3
mov ecx, 0x274d
jmp 0x14001cca9
cmp edi, 0xea
jne 0x14001ccb4
jmp 0x14001ccbd
mov eax, 2
mov ecx, 0x274d
jmp 0x14001cca9
mov eax, 2
mov ecx, 0x2746
mov qword [rbx], rcx
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
mov eax, 0xffffffff
test esi, esi
jne 0x14001ccfe
mov rcx, qword [0x1400325d0]
shr rcx, 1
mov eax, 2
cmp rcx, r14
je 0x14001cceb
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
xor edx, edx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbx], 0
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x38]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001cd10
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, r9
cmp rcx, 0xffffffffffffffff
je 0x14001cd6c
mov ebx, edx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 1
test dl, 1
jne 0x14001cdc9
test r8d, r8d
js 0x14001cee6
mov eax, r8d
imul rax, rax, 0x10624dd3
shr rax, 0x26
mov dword [rsp + 0x30], eax
imul eax, eax, 0x3e8
sub r8d, eax
imul eax, r8d, 0x3e8
jmp 0x14001cdd3
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
je 0x14001cda4
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2719
call qword [rax + 0x30]
mov ecx, 2
test al, al
je 0x14001cda9
mov ecx, 3
mov qword [rsi], 0x2719
lea rax, [0x1400325c8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov edi, 0xffffffff
jmp 0x14001cf1f
mov dword [rsp + 0x30], 0
xor eax, eax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
inc ecx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
test eax, eax
js 0x14001ce12
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14001ce41
cmp rax, 1
jne 0x14001ce4a
lea r14, [0x1400326e0]
jmp 0x14001ce4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14001ceed
test ebx, ebx
setne al
jmp 0x14001cf00
lea r14, [0x1400325c8]
jmp 0x14001ce4e
mov r14, qword [rsi + 8]
mov rcx, qword [r14 + 8]
shr rcx, 1
mov eax, 2
movabs r15, 0x595588bd12bf6fe8
cmp rcx, r15
je 0x14001ce7b
mov rax, qword [r14]
mov rcx, r14
xor edx, edx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rsi], 0
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rax
test bl, 1
je 0x14001cf1f
test edi, edi
jne 0x14001cf1f
mov rax, qword [0x1400325d0]
shr rax, 1
cmp rax, r15
je 0x14001cec9
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, 0x2733
call qword [rax + 0x30]
mov ecx, 2
test al, al
je 0x14001cece
mov ecx, 3
mov qword [rsi], 0x2733
lea rax, [0x1400325c8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
jmp 0x14001cf1f
xor eax, eax
jmp 0x14001cddc
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, ebx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov dword [rsi], ebx
mov dword [rsi + 4], 0
lea rcx, [0x1400325c8]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov eax, edi
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001d420
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001d4a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp - 0x18], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14001d475
test ebx, ebx
setne al
jmp 0x14001d488
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, ebx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbp - 8], rax
mov dword [rbp - 0x18], ebx
lea rcx, [0x1400325c8]
mov qword [rbp - 0x10], rcx
test al, 1
jne 0x14001d4b3
mov dword [rsi], edi
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140024b32]
lea rsi, [rbp - 0x48]
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3

Function at 0x14001d5c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001d645
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp - 0x18], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14001d615
test ebx, ebx
setne al
jmp 0x14001d628
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, ebx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbp - 8], rax
mov dword [rbp - 0x18], ebx
lea rcx, [0x1400325c8]
mov qword [rbp - 0x10], rcx
test al, 1
jne 0x14001d653
mov dword [rsi], edi
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140024b32]
lea rsi, [rbp - 0x48]
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3

Function at 0x14001d700
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001d785
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp - 0x18], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14001d755
test ebx, ebx
setne al
jmp 0x14001d768
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, ebx
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbp - 8], rax
mov dword [rbp - 0x18], ebx
lea rcx, [0x1400325c8]
mov qword [rbp - 0x10], rcx
test al, 1
jne 0x14001d793
mov dword [rsi], edi
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140024b32]
lea rsi, [rbp - 0x48]
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3
Function at 0x14001e570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001e5ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001e5ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001e5ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001e5ba
cmp dword [rcx + 0x84], 0xe
jbe 0x14001e5ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001e5bc
xor al, al
add rsp, 0x28
ret

Function at 0x14001ee00
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14001ee3d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14001f090
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14001ef3c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14001f090
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x14001eeb0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.1400020f0
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14001ef7b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001ef7b
call fcn.14001f098
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x14001ef62
mov rcx, r14
call fcn.14001f098
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret