joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4997fe
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 8]
test rax, rax
je 0x499867
mov edx, dword [rcx + 0x10]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x49989c
mov rdx, qword [rcx + 0x28]
xor r8d, r8d
lea r9, [0x005d4640]
xor r10d, r10d
cmp rdx, r8
je 0x499894
movzx r11d, byte [rax + r8]
or r10d, dword [r9 + r11*4]
inc r8
jmp 0x499881
mov dword [rsp + 0x98], r10d
mov r14, qword [rcx + 0x38]
mov r15, qword [rcx + 0x40]
lea rsi, [r15*8]
test r15, r15
je 0x4998e7
xor ebx, ebx
mov rax, r15
shr rax, 0x3c
sete al
jne 0x4999bf
mov bl, al
shl rbx, 3
mov rcx, rsi
mov rdx, rbx
call fcn.00498de8
mov rdi, rax
test rax, rax
jne 0x4998ec
mov rcx, rsi
mov rdx, rbx
jmp 0x4999d0
mov edi, 8
xor eax, eax
mov rcx, rsi
test rcx, rcx
je 0x499907
mov rdx, qword [r14 + rax*8]
mov qword [rdi + rax*8], rdx
inc rax
add rcx, 0xfffffffffffffff8
jmp 0x4998f1
lea rcx, [rsp + 0x60]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x005a983e]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x49995d
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x49998c
movaps xmm6, xmmword [rsp + 0x50]
mov ecx, 0x20
mov edx, 8
call fcn.0040ad20
test rax, rax
je 0x4999c6
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm6
xor r14d, r14d
test r15, r15
je 0x4999a2
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call fcn.00499137
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.0040b3c0
ud2
mov ecx, 0x20
mov edx, 8
call fcn.0040bce0
ud2

Function at 0x499be6
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x499c0f
mov rdx, qword [rsp + 0x20]
jmp 0x499c17
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret

Function at 0x49a919
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x49a935
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret
Function at 0x49cb59
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x49cb85
xor eax, eax
jmp 0x49cb8a
call fcn.00499669
nop
add rsp, 0x38
ret

Function at 0x49cbb4
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rdx + 0x80]
call sub.ws2_32.dll_connect
test eax, eax
je 0x49cbd1
add rsp, 0x28
jmp fcn.00499669
xor eax, eax
add rsp, 0x28
ret
Function at 0x4a8270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x4a82a0
test ecx, ecx
jne 0x4a82f0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x4a82ac
test ecx, ecx
jne 0x4a82f0
mov rcx, rdi
call fcn.004a8150
movzx eax, al
test bpl, bpl
jne 0x4a82f7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x4a82e3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x004a8468]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x4a82e3.2
xor eax, eax
test bpl, bpl
je 0x4a82bc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x4a8449
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x4a832a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x4a83a9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x4a8370
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x4a838b
inc rax
dec rdi
cmp rax, 1
jne 0x4a8350
jmp 0x4a83a9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x4a838b
cmp ebx, 0x5c
je 0x4a838b
inc rax
dec rdi
cmp rax, 1
jne 0x4a8370
jmp 0x4a83a9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x4a8457
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x4a83d3
mov al, 9
cmp rdx, 2
je 0x4a83d7
cmp rdx, 1
jne 0x4a83e7
cmp byte [r8], 0x2e
jne 0x4a83e7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x4a83e7
mov al, 0xa
jmp 0x4a83e7
cmp byte [r8], 0x2e
jne 0x4a83e7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x4a82e3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x4a82e3.2
mov ecx, 2
jmp case.0x4a82e3.2
lea r8, str.library_std_src_path.rs
call fcn.00415120
ud2
lea r8, str.library_std_src_path.rs
call fcn.00415120
ud2
Function at 0x4ac660
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x005e4198]
cmp rax, 3
jne 0x4ac787
cmp rbx, 0x17f
ja 0x4ac799
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x4ac6d9
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x4ac6ec
inc rdx
cmp rcx, rdx
jne 0x4ac6c0
mov rdx, r8
test rax, rax
jne 0x4ac6f6
jmp 0x4ac750
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00414bc0
test rax, rax
jne 0x4ac6f6
jmp 0x4ac750
mov eax, 1
test rax, rax
je 0x4ac750
cmp rdx, rbx
jne 0x4ac750
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4ac764
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x4ac777
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x4ac77a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.004c7900
cmp rbx, 0x17f
jbe 0x4ac698
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x4c5e50
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0040b640
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x4c5eae
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x4c5f25
mov rcx, qword [0x005e4168]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4c5f33
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x4c5f25
mov rcx, qword [0x005e4168]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x4c5f14
jmp 0x4c5f25
Function at 0x4ac7c0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x004da130]
test ecx, ecx
je 0x4ac7f2
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4ac80b
mov rcx, rax
cmp qword [rax], 0
je 0x4ac80b
add rcx, 8
jmp 0x4ac91f
lea rcx, [0x004da118]
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4ac7e0
mov ecx, dword [0x004da130]
test ecx, ecx
je 0x4ac900
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4ac91d
mov rdi, rax
test rax, rax
jne 0x4ac899
mov rcx, qword [0x005e4168]
test rcx, rcx
jne 0x4ac856
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4ac93c
mov rcx, rax
mov qword [0x005e4168], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4ac93c
mov rdi, rax
mov qword [rax], 0
lea rax, [0x004da118]
mov qword [rdi + 0x18], rax
mov ecx, dword [0x004da130]
test ecx, ecx
je 0x4ac929
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4ac8b6
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x4ac8eb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x4ac8e6
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x4ac8eb
call fcn.004be930
mov qword [rdi], 1
lea rcx, [rdi + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
jmp 0x4ac91f
lea rcx, [0x004da118]
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4ac82a
xor ecx, ecx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004da118]
call fcn.004be9f0
mov ecx, eax
jmp 0x4ac891
mov ecx, 0x20
mov edx, 8
call fcn.0040bce0
ud2
Function at 0x4be930
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x4be966
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.004be310]
mov qword [rsp + 0x48], rax
lea rax, [0x005abbe8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_sys_windows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00413be0
ud2

Function at 0x4be9f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x4bea6e
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x4beaaf
cmp dword [rsp + 0x2c], 0
je 0x4bea93
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4bead7
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x005e4130]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x005e4130], rsi
jne 0x4bea50
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x4beaa5
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x4beb2d
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x4bea98
mov edi, dword [rsp + 0x28]
jmp 0x4beaa5
mov edi, dword [rsi + 0x18]
jmp 0x4beaa3
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], 0
lea rdx, [0x005abc38]
lea r9, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.004bd360
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x30], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.00413be0
ud2
mov qword [rsp + 0x30], 0
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rax, str.ntdll.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.004bd420
ud2
Function at 0x4c5e50
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x005e4198]
cmp rax, 3
jne 0x4ac787
cmp rbx, 0x17f
ja 0x4ac799
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x4ac6d9
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x4ac6ec
inc rdx
cmp rcx, rdx
jne 0x4ac6c0
mov rdx, r8
test rax, rax
jne 0x4ac6f6
jmp 0x4ac750
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00414bc0
test rax, rax
jne 0x4ac6f6
jmp 0x4ac750
mov eax, 1
test rax, rax
je 0x4ac750
cmp rdx, rbx
jne 0x4ac750
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4ac764
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x4ac777
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x4ac77a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.004c7900
cmp rbx, 0x17f
jbe 0x4ac698
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x4c5e50
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0040b640
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x4c5eae
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x4c5f25
mov rcx, qword [0x005e4168]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4c5f33
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x4c5f25
mov rcx, qword [0x005e4168]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x4c5f14
jmp 0x4c5f25
Function at 0x4c61f0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov rcx, qword [0x005e4168]
test rcx, rcx
jne 0x4c6230
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4c62e1
mov rcx, rax
mov qword [0x005e4168], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4c62e1
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x004c6340]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x4c62d4
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x4c62af
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x4c62a1
mov r8, qword [r8 - 8]
mov rcx, qword [0x005e4168]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x005e4168]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.0040bce0
ud2

Function at 0x4c71c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x004da180]
test ecx, ecx
je 0x4c71f3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4c720c
mov rbx, rax
cmp qword [rax], 0
je 0x4c720c
add rbx, 8
jmp 0x4c7321
lea rcx, [0x004da168]
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4c71e1
mov ecx, dword [0x004da180]
test ecx, ecx
je 0x4c7302
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4c731f
mov rdi, rax
test rax, rax
jne 0x4c72ae
mov qword [rsp + 0x20], 0
lea rax, [0x004da168]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x005e4168]
test rcx, rcx
jne 0x4c726c
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4c733f
mov rcx, rax
mov qword [0x005e4168], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4c733f
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x004da180]
test ecx, ecx
je 0x4c732c
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4c72cf
mov rax, qword [rsi]
mov qword [rsi], 0
mov rdx, rax
test rax, rax
je 0x4c72d3
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
jmp 0x4c72d3
xor eax, eax
xor edx, edx
lea rbx, [rdi + 8]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
je 0x4c7321
test rcx, rcx
je 0x4c7321
lock dec qword [rcx]
jne 0x4c7321
call fcn.004c24f0
jmp 0x4c7321
lea rcx, [0x004da168]
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4c722b
xor ebx, ebx
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x004da168]
call fcn.004be9f0
mov ecx, eax
jmp 0x4c72a6
mov ecx, 0x20
mov edx, 8
call fcn.0040bce0
ud2
Function at 0x4c79e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x4c7a10
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4c7a25
cmp byte [rax + 8], 0
je 0x4c7a25
add rax, 9
jmp 0x4c7ad8
mov rcx, rdi
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4c7a01
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x4c7abd
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4c7ad6
mov rbx, rax
test rax, rax
jne 0x4c7a9a
mov rcx, qword [0x005e4168]
test rcx, rcx
jne 0x4c7a6d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4c7aec
mov rcx, rax
mov qword [0x005e4168], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4c7aec
mov rbx, rax
mov qword [rax], rdi
mov byte [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x4c7ae0
dec ecx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
xor ecx, ecx
test rsi, rsi
je 0x4c7ab0
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rbx + 9]
mov byte [rbx + 8], 1
mov byte [rbx + 9], cl
jmp 0x4c7ad8
mov rcx, rdi
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4c7a41
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.004be9f0
mov ecx, eax
jmp 0x4c7a92
mov ecx, 0x10
mov edx, 8
call fcn.0040bce0
ud2

Function at 0x4c7b00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x004da0c8]
test ecx, ecx
je 0x4c7b2f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4c7b48
mov rdi, rax
cmp qword [rax], 0
je 0x4c7b48
add rdi, 8
jmp 0x4c7c34
lea rcx, [0x004da0b0]
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4c7b1d
mov ecx, dword [0x004da0c8]
test ecx, ecx
je 0x4c7c15
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4c7c32
mov rsi, rax
test rax, rax
jne 0x4c7be6
mov qword [rsp + 0x20], 0
lea rax, [0x004da0b0]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x005e4168]
test rcx, rcx
jne 0x4c7ba8
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4c7c4e
mov rcx, rax
mov qword [0x005e4168], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4c7c4e
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x004da0c8]
test ecx, ecx
je 0x4c7c3e
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 8]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 1
mov qword [rsi + 8], 0
je 0x4c7c34
test rcx, rcx
je 0x4c7c34
lock dec qword [rcx]
jne 0x4c7c34
call fcn.004c2480
jmp 0x4c7c34
lea rcx, [0x004da0b0]
call fcn.004be9f0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4c7b67
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004da0b0]
call fcn.004be9f0
mov ecx, eax
jmp 0x4c7bde
mov ecx, 0x18
mov edx, 8
call fcn.0040bce0
ud2