joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140267ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14029b280]
test ecx, ecx
je 0x140267b00
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140267b19
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140267b19
add rdi, 0x10
jmp 0x140267bfa
lea rcx, [0x14029b268]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x140267aed
mov ecx, dword [0x14029b280]
test ecx, ecx
je 0x140267bdb
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140267bf8
mov rsi, rax
test rax, rax
jne 0x140267baa
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140267b6b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140267c14
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140267c14
mov rsi, rax
lea rax, [0x14029b268]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14029b280]
test ecx, ecx
je 0x140267c04
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140267bfa
test rcx, rcx
je 0x140267bfa
lock dec qword [rcx]
jne 0x140267bfa
call fcn.140267c30
jmp 0x140267bfa
lea rcx, [0x14029b268]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140267b38
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14029b268]
call fcn.140242d30
mov ecx, eax
jmp 0x140267ba2
mov ecx, 8
mov edx, 0x18
call fcn.1400a81e0
int3
Function at 0x14026fd90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.1402456d0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp rcx, rbx
jne 0x14026fdcd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
jmp 0x14026fdfa
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14026fcb0
mov r14, qword [rsp + 0x28]
cmp r14, rbx
jne 0x14026fe13
lea rcx, [rsp + 0x30]
call fcn.140242490
mov qword [rsi], rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14026fe37
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x14026fe07
mov qword [rsi], rbx
test r14, r14
je 0x14026fe07
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14029804c
Function at 0x140271b30
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140271b6d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140271c1d
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140271c1d
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140271c90]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140271c10
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140271beb
cmp qword [rbx + 0x10], 0x11
jb 0x140271bda
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rdi
call fcn.14029804c
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rsi
call fcn.14029804c
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400a81e0
ud2

Function at 0x140271f70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.140297d70
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
xorps xmm6, xmm6
lea r15, [rsp + 0x3c]
lea rbx, [0x140269450]
lea r13, [rsp + 0x60]
lea r12, [0x1402a5db8]
mov qword [rsp + 0x48], rdi

Function at 0x140272490
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1402724c6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140263840]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.1400aae40
ud2
Function at 0x140274920
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140274a71
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x140274957
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140274a36
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140274a54
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x1402749b8
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x1402749e9
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x1402749ed
call sub.kernel32.dll_GetLastError
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x1402749f1
cmp eax, 0x6d
jne 0x140274a1c
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x1402749f6
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x140274a22
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.140242490
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140274a2c
cmp rax, 1
je 0x1402749a1
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x1402749ab
mov r8d, 0x10
mov rcx, rbx
call fcn.140248d90
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140274964
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.140248d90
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x140274964
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140274a90
int3

Function at 0x140279c10
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x20]
call fcn.1402456d0
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
cmp rax, rdi
je 0x140279cc7
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.1402624d0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp rbx, rdi
je 0x140279cc7
mov rcx, rsi
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x140279c9f
test rbx, rbx
je 0x140279c9b
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rsi
call fcn.14029804c
xor esi, esi
jmp 0x140279cc7
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
test rbx, rbx
je 0x140279cc4
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rsi
call fcn.14029804c
mov rsi, rdi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140279f40
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x140279f6b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x1403ac168]
cmp rax, 3
jne 0x14027a0e7
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140279fe0
cmp word [rbx], 0
je 0x14027a056
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x14027a06b
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x140279ffa
mov r14d, eax
cmp eax, 0x2726
jne 0x14027a0d6
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14027a0ce
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x140279fb8
call sub.kernel32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x14027a0d6
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x34], r9w
mov word [rsp + 0x36], cx
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], edx
lea rdx, [rsp + 0x34]
mov rcx, rdi
call sub.ws2_32.dll_bind
cmp eax, 0xffffffff
je 0x14027a0a9
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x140279f60
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x140279f60
call sub.ws2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x140279f59
call fcn.140268bc0
jmp 0x140279f7c
Function at 0x14027a140
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14029b2a0]
test ecx, ecx
je 0x14027a16d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14027a186
cmp qword [rax + 8], 0
je 0x14027a186
add rax, 0x10
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14029b288]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14027a15c
mov ecx, dword [0x14029b2a0]
test ecx, ecx
je 0x14027a26d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14027a28a
mov rsi, rax
test rax, rax
jne 0x14027a21b
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14027a1d8
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14027a2a5
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14027a2a5
mov rsi, rax
lea rax, [0x14029b288]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14029b2a0]
test ecx, ecx
je 0x14027a292
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14027a24b
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14027a253
call fcn.140272490
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14029b288]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14027a1a5
xor eax, eax
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14029b288]
call fcn.140242d30
mov ecx, eax
jmp 0x14027a213
mov ecx, 8
mov edx, 0x20
call fcn.1400a81e0
int3
Function at 0x14027ba80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14027bac2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14027baca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14027badb
jmp 0x14027baf2
xor r10d, r10d
jmp 0x14027bb7d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14027baf2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14027bb09
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14027bb29
add r11, r8
jmp 0x14027bc5a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14027bbf2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14027bba0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14027bc10
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14027bc22
jmp 0x14027bc3c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14027bc3c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14027bc56
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14027bc70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x14029b2c8]
test ecx, ecx
je 0x14027bdda
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14027bca1
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14027be0c
mov ecx, dword [0x14029b2c8]
test ecx, ecx
je 0x14027be12
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14027be2f
mov rsi, rax
test rax, rax
jne 0x14027bd36
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14027bcf3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14027be50
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x60
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14027be50
mov rsi, rax
lea rax, [0x14029b2b0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14029b2c8]
test ecx, ecx
je 0x14027be3d
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsi + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmm3, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [0x14036bd28]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [0x14036bd18]
movups xmmword [rsi + 0x40], xmm0
movups xmm0, xmmword [0x14036bd08]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x14036bcf8]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x14036bce8]
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x14027be0c
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x14027be0c
lea rcx, [rsp + 0x38]
test rax, rax
je 0x14027bdfc
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14027be0c
call fcn.14027a890
jmp 0x14027be0c
lea rcx, [0x14029b2b0]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14027bc93
jmp 0x14027bca1
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14027be0c
call fcn.14027a7d0
add rsi, 0x10
jmp 0x14027be31
lea rcx, [0x14029b2b0]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14027bcc0
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rsi
ret
lea rcx, [0x14029b2b0]
call fcn.140242d30
mov ecx, eax
jmp 0x14027bd2e
mov ecx, 8
mov edx, 0x60
call fcn.1400a81e0
int3
Function at 0x14027e930
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov rdi, r8
mov qword [rsp + 0x28], rcx
mov rbx, qword [rdx + 0x10]
mov r15, qword [rdx + 0x18]
cmp r15, 0xffffffffffffffff
je 0x14027eac2
mov rax, qword [rsp + 0xb0]
cmp rax, 0x7fffffff
mov r12d, 0x7fffffff
cmovb r12, rax
mov r13, qword [rdx + 0x20]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
mov r9b, 1
call fcn.14027e2c0
movzx eax, byte [rsp + 0x39]
cmp al, 3
je 0x14027eade
mov rsi, qword [rsp + 0x30]
cmp al, 2
je 0x14027eaf5
movzx r14d, byte [rsp + 0x38]
mov rcx, r15
mov rdx, qword [rsp + 0x40]
mov r8d, r12d
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x14027eb07
call sub.ws2_32.dll_WSAGetLastError
mov ebp, eax
shl rbp, 0x20
or rbp, 2
mov rcx, rbp
call fcn.1400fe500
cmp al, 0xd
jne 0x14027ea1a
test r13, r13
je 0x14027ea1a
mov rcx, qword [r13]
mov rdx, qword [r13 + 8]
lock inc qword [rdx]
jle 0x14027eb3c
add rcx, 0x10
mov r8, qword [r13 + 0x10]
movzx r9d, byte [r13 + 0x18]
call fcn.1400fd630
test rax, rax
cmovne rbp, rax
mov rcx, rbp
call fcn.1400fe500
cmp al, 0xd
jne 0x14027eb1b
and esi, 0x23
mov rax, qword [rbx + 0x90]
mov rcx, r14
shl rcx, 0x10
xor rsi, 0x2f
nop
mov edx, eax
shr edx, 0x10
cmp r14b, dl
jne 0x14027ea5c
mov edx, eax
and edx, esi
or rdx, rcx
lock cmpxchg qword [rbx + 0x90], rdx
jne 0x14027ea40
mov eax, ebp
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14027e980
test rax, rax
je 0x14027e980
mov rsi, qword [rbp - 1]
mov r14, qword [rbp + 7]
mov rcx, rsi
call qword [r14]
cmp qword [r14 + 8], 0
je 0x14027eaa9
cmp qword [r14 + 0x10], 0x11
jb 0x14027ea98
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rsi
call fcn.14029804c
dec rbp
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rbp
call fcn.14029804c
jmp 0x14027e980
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
mov r9b, 1
call fcn.14027e2c0
movzx eax, byte [rsp + 0x39]
cmp al, 3
jne 0x14027eaec
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x14027eb2b
cmp al, 2
jne 0x14027eb3e
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
jmp 0x14027eb2b
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x14027eb2b
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rbp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str._home_hj_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.36.0_src_io_poll_evented.rs
mov edx, 0x2b
call fcn.1400abba0
int3
Function at 0x14027eb60
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x58], r9
mov rdi, r8
mov qword [rsp + 0x40], rcx
mov rbx, qword [rdx + 0x10]
mov r15, qword [rdx + 0x18]
cmp r15, 0xffffffffffffffff
je 0x14027ed12
mov rax, qword [rsp + 0xe0]
mov r12d, 0xffffffff
cmp rax, r12
cmovb r12, rax
mov r13, qword [rdx + 0x20]
xorps xmm6, xmm6
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
mov r9b, 1
call fcn.14027e2c0
movzx eax, byte [rsp + 0x51]
cmp al, 3
je 0x14027ed2e
mov rsi, qword [rsp + 0x48]
cmp al, 2
je 0x14027ed45
movzx r14d, byte [rsp + 0x50]
mov dword [rsp + 0x48], 0
movups xmmword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], 0
mov rcx, r15
mov rdx, qword [rsp + 0x58]
mov r8d, r12d
mov r9, rbp
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
jne 0x14027ed57
call sub.ws2_32.dll_WSAGetLastError
mov ebp, eax
shl rbp, 0x20
or rbp, 2
mov rcx, rbp
call fcn.1400fe500
cmp al, 0xd
jne 0x14027ec62
test r13, r13
je 0x14027ec62
mov rcx, qword [r13]
mov rdx, qword [r13 + 8]
lock inc qword [rdx]
jle 0x14027ed93
add rcx, 0x10
mov r8, qword [r13 + 0x10]
movzx r9d, byte [r13 + 0x18]
call fcn.1400fd630
test rax, rax
cmovne rbp, rax
mov rcx, rbp
call fcn.1400fe500
cmp al, 0xd
jne 0x14027ed6d
and esi, 0x23
mov rax, qword [rbx + 0x90]
mov rcx, r14
shl rcx, 0x10
xor rsi, 0x2f
nop word [rax + rax]
mov edx, eax
shr edx, 0x10
cmp r14b, dl
jne 0x14027ecac
mov edx, eax
and edx, esi
or rdx, rcx
lock cmpxchg qword [rbx + 0x90], rdx
jne 0x14027ec90
mov eax, ebp
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14027ebb0
test rax, rax
je 0x14027ebb0
mov rsi, qword [rbp - 1]
mov r14, qword [rbp + 7]
mov rcx, rsi
call qword [r14]
cmp qword [r14 + 8], 0
je 0x14027ecf9
cmp qword [r14 + 0x10], 0x11
jb 0x14027ece8
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rsi
call fcn.14029804c
dec rbp
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rbp
call fcn.14029804c
jmp 0x14027ebb0
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8, rdi
mov r9b, 1
call fcn.14027e2c0
movzx eax, byte [rsp + 0x51]
cmp al, 3
jne 0x14027ed3c
mov rax, qword [rsp + 0x40]
mov qword [rax], 2
jmp 0x14027ed7d
cmp al, 2
jne 0x14027ed95
mov rsi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov qword [rax], 1
mov qword [rax + 8], rsi
jmp 0x14027ed7d
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x14027ed7d
mov rax, qword [rsp + 0x40]
mov qword [rax], 1
mov qword [rax + 8], rbp
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str._home_hj_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.36.0_src_io_poll_evented.rs
mov edx, 0x2b
call fcn.1400abba0
int3
Function at 0x14027ef80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14029b2e8]
test ecx, ecx
je 0x14027efaf
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14027efc8
mov rsi, rax
cmp qword [rax + 8], 0
je 0x14027efc8
add rsi, 8
jmp 0x14027f0ef
lea rcx, [0x14029b2d0]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14027ef9c
mov ecx, dword [0x14029b2e8]
test ecx, ecx
je 0x14027f0d0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14027f0ed
mov rsi, rax
test rax, rax
jne 0x14027f05d
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14027f01a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14027f11a
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14027f11a
mov rsi, rax
lea rax, [0x14029b2d0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14029b2e8]
test ecx, ecx
je 0x14027f0f8
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14027f088
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14027f10b
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x28
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14027f10b
add rsi, 8
mov qword [rax], 1
mov qword [rax + 8], 1
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov byte [rax + 0x20], 0
mov rcx, qword [rsi]
mov qword [rsi], rax
test rcx, rcx
je 0x14027f0ef
lock dec qword [rcx]
jne 0x14027f0ef
call fcn.140024fb0
jmp 0x14027f0ef
lea rcx, [0x14029b2d0]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14027efe7
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14029b2d0]
call fcn.140242d30
mov ecx, eax
jmp 0x14027f055
mov ecx, 8
mov edx, 0x28
call fcn.1400a81e0
mov ecx, 8
mov edx, 0x10
call fcn.1400a81e0
int3