joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400635d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140063642
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x140063620
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140063610
jmp 0x140063642
cmp qword [rax + 8], 0
je 0x140063642
lock or dword [rsp], 0
mov rdx, rdi
mov rcx, rdi
call fcn.14005fdf0
nop
lock or dword [rsp], 0
jmp 0x140063743
mov qword [rsp + 0x48], rdi
mov rdx, rdi
mov ecx, 0x160
call fcn.14007b390
mov rbx, rax
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400636a2
mov qword [rax + 0x20], r14
lea rax, [fcn.140081a30]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14006b060
nop
jmp 0x1400636a5
mov rbx, r14
mov qword [rsp + 0x58], rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140082fd0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
test al, al
je 0x140063743
mov rax, qword [rsi]
mov qword [rsp + 0x60], rax
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
call fcn.14005d8e0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.140081a30
nop
lea rcx, [rsp + 0x28]
call fcn.140071b70
nop
mov rdx, qword [rsp + 0x70]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140063800
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140063872
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x140063850
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140063840
jmp 0x140063872
cmp qword [rax + 8], 0
je 0x140063872
lock or dword [rsp], 0
mov rdx, rdi
mov rcx, rdi
call fcn.14005fe30
nop
lock or dword [rsp], 0
jmp 0x140063973
mov qword [rsp + 0x48], rdi
mov rdx, rdi
mov ecx, 0x178
call fcn.14007b390
mov rbx, rax
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400638d2
mov qword [rax + 0x20], r14
lea rax, [fcn.140081c10]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14006b0e0
nop
jmp 0x1400638d5
mov rbx, r14
mov qword [rsp + 0x58], rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140082fd0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
test al, al
je 0x140063973
mov rax, qword [rsi]
mov qword [rsp + 0x60], rax
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
call fcn.14005d8e0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.140081c10
nop
lea rcx, [rsp + 0x28]
call fcn.140071b70
nop
mov rdx, qword [rsp + 0x70]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140063a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140063ab2
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x140063a90
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140063a80
jmp 0x140063ab2
cmp qword [rax + 8], 0
je 0x140063ab2
lock or dword [rsp], 0
mov rdx, rdi
mov rcx, rdi
call fcn.14005fe70
nop
lock or dword [rsp], 0
jmp 0x140063bc5
mov qword [rsp + 0x48], rdi
mov rbx, qword [rdi]
cmp byte [rbx + 0x400], 0
jne 0x140063acc
mov byte [rbx + 0x400], 1
jmp 0x140063ad9
mov ecx, 0x188
call fcn.1400dba80
mov rbx, rax
mov qword [rsp + 0x50], rbx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0xa8], rbx
test rbx, rbx
je 0x140063b24
mov qword [rbx + 0x20], r14
lea rax, [fcn.140081df0]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14006b160
nop
jmp 0x140063b27
mov rbx, r14
mov qword [rsp + 0x58], rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140082fd0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
test al, al
je 0x140063bc5
mov rax, qword [rsi]
mov qword [rsp + 0x60], rax
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
call fcn.14005d8e0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.140081df0
nop
lea rcx, [rsp + 0x28]
call fcn.140071b70
nop
mov rdx, qword [rsp + 0x70]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140063c90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov rdi, qword [rdx]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140063d02
nop dword [rax]
cmp qword [rax], rdi
je 0x140063ce0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140063cd0
jmp 0x140063d02
cmp qword [rax + 8], 0
je 0x140063d02
lock or dword [rsp], 0
mov rdx, rbx
mov rcx, rbx
call fcn.14005feb0
nop
lock or dword [rsp], 0
jmp 0x140063dde
mov qword [rsp + 0x48], rbx
mov rdx, rbx
mov ecx, 0xc8
call fcn.14007b390
mov qword [rsp + 0x50], rax
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x98], rax
test rax, rax
je 0x140063d3d
mov rdx, rbx
mov rcx, rax
call fcn.140069cd0
mov rbx, rax
jmp 0x140063d40
mov rbx, rdi
mov qword [rsp + 0x58], rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140082fd0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
test al, al
je 0x140063dde
mov rax, qword [rsi]
mov qword [rsp + 0x60], rax
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
call fcn.14005d8e0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.140082030
nop
lea rcx, [rsp + 0x28]
call fcn.140071b70
nop
mov rdx, qword [rsp + 0x70]
mov ecx, dword [0x140311a40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14006c570
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1f0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov eax, 1
lock xadd dword [0x140311a30], eax
inc eax
cmp eax, 1
jne 0x14006c5ce
lea ecx, [rax + 1]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WSOCK32.dll_WSAStartup]
xchg dword [0x140311a34], eax
xor esi, esi
mov edi, esi
lock xadd dword [0x140311a34], edi
test edi, edi
je 0x14006c5fe
call fcn.14009f200
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rax
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
call fcn.140084720
nop
mov ecx, gethostname
call fcn.1400dba80
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14006c627
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14005b120
mov rsi, rax
mov qword [rbx + 8], rsi
mov rcx, rsi
call fcn.1400494d0
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14007b390
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov ecx, dword [0x140311a2c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
test rax, rax
je 0x14007b3e9
mov rax, qword [rax + 8]
test rax, rax
je 0x14007b3e9
mov rcx, qword [rax]
test rcx, rcx
je 0x14007b3e9
mov qword [rax], rdi
movzx eax, byte [rcx]
cmp rax, rbx
jb 0x14007b3e4
mov byte [rcx + rbx], al
mov rax, rcx
add rsp, 0x28
pop rdi
pop rbx
ret
call fcn.1400dbae0
lea rcx, [rbx + 1]
call fcn.1400dba80
cmp rbx, 0xff
ja 0x14007b3fe
movzx edi, bl
mov byte [rax + rbx], dil
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x14007b410
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140311a2c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007b43d
mov r8, qword [rax + 8]
jmp 0x14007b440
xor r8d, r8d
cmp rdi, 0xff
ja 0x14007b464
test r8, r8
je 0x14007b464
cmp qword [r8], 0
jne 0x14007b464
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
mov qword [r8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.1400dbae0
Function at 0x14007c6d0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor r15d, r15d
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov r14, r8
mov dword [rsp + 0x28], 0x98badcfe
mov rbp, rdx
mov dword [rsp + 0x2c], 0x10325476
mov rsi, rcx
mov dword [rsp + 0x30], 0xc3d2e1f0
mov ebx, r15d
cmp rdx, 0x40
jb 0x14007c796
lea rdi, [rdx - 0x40]
nop
lea r8, [rbx + 0x40]
cmp rbx, r8
jae 0x14007c782
lea rdx, [rsp + 0x40]
nop
movzx eax, byte [rsi + rbx + 1]
lea rdx, [rdx + 4]
movzx ecx, byte [rsi + rbx]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + rbx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + rbx + 3]
shl ecx, 8
add rbx, 4
or ecx, eax
mov dword [rdx - 4], ecx
cmp rbx, r8
jb 0x14007c750
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14008f520
cmp rbx, rdi
jbe 0x14007c740
mov r10, rbp
mov edi, reloc.WSOCK32.dll_ntohs
sub r10, rbx
mov eax, edi
mov dword [rsp + rax*4 + 0x40], r15d
sub rax, 1
jns 0x14007c7a3
mov r9, r15
mov r11d, 3
test r10, r10
je 0x14007c7f3
lea r8, [rbx + rsi]
mov rax, r9
lea rdx, [rsp + 0x40]
shr rax, 2
movzx ecx, r9b
lea rdx, [rdx + rax*4]
and cl, r11b
mov eax, r11d
sub al, cl
movzx ecx, al
movzx eax, byte [r8 + r9]
shl cl, 3
inc r9
shl eax, cl
or dword [rdx], eax
cmp r9, r10
jb 0x14007c7c0
mov rax, r9
lea r8, [rsp + 0x40]
and r9b, r11b
shr rax, 2
sub r11b, r9b
lea r8, [r8 + rax*4]
movzx ecx, r11b
mov edx, 0x80
shl cl, 3
shl edx, cl
or dword [r8], edx
cmp r10, 0x38
jb 0x14007c83b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14008f520
nop
mov dword [rsp + rdi*4 + 0x40], r15d
sub rdi, 1
jns 0x14007c830
lea rax, [rbp*8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x20]
call fcn.14008f520
lea r8, [r14 + 0x13]
mov edx, 0x98
mov r9d, reloc.WS2_32.dll_send
nop word [rax + rax]
mov rax, r9
lea r8, [r8 - 1]
sar rax, 2
mov ecx, edx
not ecx
dec r9
and ecx, 0x18
mov eax, dword [rsp + rax*4 + 0x20]
shr eax, cl
sub edx, 8
mov byte [r8 + 1], al
jns 0x14007c870
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14007de80
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rdi, r9
mov rbp, rdx
mov r14, rcx
mov esi, r15d
cmp rcx, 0xffffffffffffffff
je 0x14007dfca
test r8b, r8b
je 0x14007df08
test byte [rdx], 8
je 0x14007df08
mov dword [rsp + 0x60], r15d
call fcn.14005d8e0
or byte [rbp], 8
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov ebx, eax
call fcn.14009f200
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
test ebx, ebx
jne 0x14007df08
call fcn.14005d8e0
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WSOCK32.dll_closesocket]
mov esi, eax
call fcn.14009f200
mov rbx, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
test esi, esi
je 0x14007dfca
call fcn.14009f200
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x14007df5d
cmp dword [rdi], 0x2733
je 0x14007df78
call fcn.14009f200
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x14007dfc6
cmp dword [rdi], 0x4d5
jne 0x14007dfc6
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WSOCK32.dll_ioctlsocket]
and byte [rbp], 0xfc
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WSOCK32.dll_closesocket]
mov esi, eax
call fcn.14009f200
mov rbx, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
test esi, esi
jne 0x14007dfe1
mov dword [rsp + 0x30], r15d
call fcn.14005d8e0
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov rbx, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14007e070
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, qword [rbp + 0x60]
mov rdi, r9
mov r14d, r8d
mov r12, rdx
mov r15, rcx
cmp dword [rsi], 0x40
jne 0x14007e0b3
mov dword [rbp - 0x28], 0x2745
call fcn.14009f200
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
cmp dword [rsi], 0
jne 0x14007e1e3
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], r13
xor r13d, r13d
test rdi, rdi
je 0x14007e159
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x14007e159
lea rax, [rbp + 0x60]
mov qword [rbp - 0x30], r13
mov qword [rsp + 0x38], rax
mov r9d, r14d
lea rax, [rbp - 0x38]
mov dword [rbp - 0x40], r13d
mov qword [rsp + 0x30], rax
mov r8d, r14d
lea rax, [rbp - 0x40]
mov qword [rbp - 0x38], r13
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov dword [rbp + 0x60], r13d
mov rcx, r12
mov qword [rsp + 0x20], rax
call sub.WSOCK32.dll_GetAcceptExSockaddrs
movsxd r14, dword [rbp + 0x60]
cmp r14, qword [rbx]
jbe 0x14007e147
mov dword [rbp - 0x18], 0x2726
call fcn.14009f200
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rsi], xmm0
jmp 0x14007e159
mov rdx, qword [rbp - 0x38]
mov r8, r14
mov rcx, rdi
call fcn.1401415b0
mov qword [rbx], r14
mov rbx, qword [rbp + 0x58]
mov qword [rbp - 0x28], r15
cmp rbx, 0xffffffffffffffff
jne 0x14007e175
mov dword [rbp - 0x18], 0x2719
call fcn.14009f200
jmp 0x14007e1c8
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
lea r9, [rbp - 0x28]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
mov rcx, rbx
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov edi, eax
call fcn.14009f200
mov rbx, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov qword [rbp - 0x10], rbx
mov dword [rbp - 0x18], eax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rsi], xmm0
test edi, edi
jne 0x14007e1d3
mov dword [rbp - 0x18], r13d
call fcn.14005d8e0
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rsi], xmm0
mov rbx, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140082fd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x28]
mov rbp, rcx
mov ecx, dword [0x140311a2c]
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140083010
cmp qword [rax], rsi
je 0x140083045
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140083002
xor esi, esi
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rsi, rsi
je 0x14008304b
mov rax, qword [rdi]
cmp byte [rax + 0x60], 0
jne 0x14008304b
mov byte [rax + 0x60], 1
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x1400830ca
mov rsi, qword [rax + 8]
jmp 0x140083012
mov rax, qword [rdi]
cmp byte [rax + 0x60], 0
je 0x140083082
mov qword [rbx + 0x20], 0
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x14008306b
mov qword [rcx + 0x20], rbx
jmp 0x14008306f
mov qword [rax + 0x68], rbx
mov qword [rax + 0x70], rbx
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400830c8
mov byte [rax + 0x60], 1
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
add rax, 0x78
mov qword [rbx + 0x20], 0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400830b1
mov qword [rcx + 0x20], rbx
jmp 0x1400830b4
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x28]
lock inc dword [rcx + 0x30]
call fcn.1400948f0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140084b90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r11, rdx
mov rdx, rcx
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
movzx eax, byte [r8 + 1]
mov rbx, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [rdx + 0x18]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rdx + 0x30]
mov rdx, qword [rdx + 8]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [r8 + rax*8]
mov r9, qword [r8 + rcx*8]
lea r10, [r8 + rcx*8]
cmp r9, rdx
jne 0x140084c3f
mov rcx, rdx
jmp 0x140084c46
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140084c96
mov rcx, qword [rbx]
cmp qword [rax + 0x10], rcx
je 0x140084c59
mov rax, qword [rax]
jmp 0x140084c35
mov rbx, qword [rbx]
mov rcx, rax
nop
cmp r9, rdx
jne 0x140084c6a
mov r8, rdx
jmp 0x140084c71
mov r8, qword [r10 + 8]
mov r8, qword [r8]
cmp rax, r8
je 0x140084c81
cmp rbx, qword [rax + 0x10]
jne 0x140084c81
mov rax, qword [rax]
jmp 0x140084c60
cmp rcx, rax
je 0x140084c96
mov qword [r11 + 8], rax
mov rax, r11
mov qword [r11], rcx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, r11
mov qword [r11], rdx
mov qword [r11 + 8], rdx
ret
Function at 0x140084cb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x140084d71
cmp qword [rcx], r8
jne 0x140084d67
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x140084d7c
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x140084d7c
cmp qword [rcx], r8
jne 0x140084d81
mov rax, qword [r8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x40]
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.140085850
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400893d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x140089415
mov dword [rsp + 0x20], 0x2719
call fcn.14009f200
mov qword [rsp + 0x28], rax
or eax, ebx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
jmp 0x14008947a
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
mov eax, dword [r14]
lea r8, [rsp + 0x40]
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov rcx, rbx
call qword [sym.imp.WSOCK32.dll_getsockname]
movsxd rcx, dword [rsp + 0x40]
mov esi, eax
mov qword [r14], rcx
call fcn.14009f200
mov rbx, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
test esi, esi
jne 0x140089478
mov dword [rsp + 0x20], esi
call fcn.14005d8e0
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov eax, esi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret