joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0130
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov r14d, 0xffffffff
xor edi, edi
xor ebp, ebp
cmp r8, 0x201
jae 0x4e01c0
jmp 0x4e01af
jae 0x4e0275
cmp r8, 0x201
jae 0x4e01c0
lea r13, [rsp + 0x78]
mov esi, 0x200
mov r12, r8
jmp 0x4e0206
sub r8, rbp
sub rdi, rbp
cmp rdi, r8
jae 0x4e01e7
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.0050b5e0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rbx, r14
mov ebp, 0xffffffff
cmovb rbp, rbx
mov qword [rsp + 0x48], rbp
mov rdi, rbx
mov r13, qword [rsp + 0x28]
mov rsi, rbp
mov r12, rbp
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x50]
mov rdx, r13
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x4e0231
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4e02d3
mov r8d, r15d
cmp r12, r8
jne 0x4e01a0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4e02f3
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov r14d, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x4e01af
jmp 0x4e01c0
cmp rsi, r8
jb 0x4e030d
lea rcx, [rsp + 0x58]
mov rdx, r13
call fcn.004b82f0
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x4e02bc
add rbx, rbx
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call fcn.00442170
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rbx, rbx
jne 0x4e02a6
jmp 0x4e02bc
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00552640
jmp 0x4e0322
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.0055dfa0
ud2
Function at 0x4e0340
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov esi, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor edi, edi
xor r15d, r15d
cmp rsi, 0x201
jae 0x4e03c0
jmp 0x4e03af
jae 0x4e046f
cmp rsi, 0x201
jae 0x4e03c0
lea r13, [rsp + 0x48]
mov ebp, 0x200
mov r12, rsi
jmp 0x4e040f
sub rsi, r15
sub rdi, r15
cmp rdi, rsi
jae 0x4e03ea
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, rsi
call fcn.0050b5e0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rsp + 0x40], r15
mov rdi, rbx
mov r13, qword [rsp + 0x20]
mov rbp, r15
mov r12, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_GetSystemDirectoryW
mov r14d, eax
test eax, eax
jne 0x4e0431
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4e049c
mov esi, r14d
cmp r12, rsi
jne 0x4e03a0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4e0519
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov rsi, r12
cmp rsi, 0x201
jb 0x4e03af
jmp 0x4e03c0
cmp rbp, rsi
jb 0x4e0533
test r14d, r14d
je 0x4e04c0
lea r14, [rsi + rsi]
mov edx, 2
mov rcx, r14
call fcn.00442160
test rax, rax
je 0x4e0547
mov r15, rax
jmp 0x4e04c9
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rdi, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], 0
test rbx, rbx
jne 0x4e04ec
jmp 0x4e0502
mov r15d, 2
xor r14d, r14d
mov rcx, r15
mov rdx, r13
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x28]
mov qword [rdi], rsi
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], rsi
test rbx, rbx
je 0x4e0502
add rbx, rbx
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, rbx
call fcn.00442170
mov rax, rdi
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00552640
jmp 0x4e0554
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, rsi
mov rdx, rbp
call fcn.0055dfa0
jmp 0x4e0554
mov edx, 2
mov rcx, r14
call fcn.0052ffb0
ud2
Function at 0x4e0d40
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r14, qword [rdx]
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor r15d, r15d
mov r12d, 0xffffffff
xor edi, edi
xor esi, esi
cmp r8, 0x201
jae 0x4e0e63
jmp 0x4e0dc3
jae 0x4e0eae
cmp r8, 0x201
jae 0x4e0e63
lea rbp, [rsp + 0x68]
mov ebx, 0x200
mov r13, r8
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov dword [rsp + 0x48], r13d
mov rcx, r14
mov rdx, rbp
lea r8, [rsp + 0x48]
call sub.userenv.dll_GetUserProfileDirectoryW
test eax, eax
je 0x4e0e00
mov ecx, dword [rsp + 0x48]
dec ecx
test ecx, ecx
jne 0x4e0e2f
jmp 0x4e0e20
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4e0e20
mov ecx, dword [rsp + 0x48]
test ecx, ecx
jne 0x4e0e2f
nop word cs:[rax + rax]
call sub.kernel32.dll_GetLastError
xor ecx, ecx
test eax, eax
jne 0x4e0f0c
mov r8d, ecx
cmp r13, r8
jne 0x4e0db0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4e0f2c
add r13, r13
cmp r13, r12
cmovae r13, r12
mov r8, r13
cmp r8, 0x201
jb 0x4e0dc3
sub r8, rsi
sub rdi, rsi
cmp rdi, r8
jae 0x4e0e8a
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.0050b5e0
mov r15, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp r15, r12
mov esi, 0xffffffff
cmovb rsi, r15
mov qword [rsp + 0x40], rsi
mov rdi, r15
mov rbp, qword [rsp + 0x20]
mov rbx, rsi
mov r13, rsi
jmp 0x4e0dd0
cmp rbx, r8
jb 0x4e0f46
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.004b82f0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rsi, qword [rsp + 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r15, r15
je 0x4e0ef5
add r15, r15
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, r15
call fcn.00442170
mov rax, rsi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x28]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r15, r15
jne 0x4e0edf
jmp 0x4e0ef5
lea rcx, str.internal_error:_entered_unreachable_codedata_provided_contains_a_nul_byte
lea r8, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.00552640
jmp 0x4e0f5b
lea rax, str.library_std_src_sys_windows_mod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.0055dfa0
ud2
Function at 0x4f8210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.004e9220
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x4f8254
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4f82a7
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x4f82c8
mov rbx, qword [rsp + 0x20]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x4f829d
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x4f828a
mov r8, qword [rax + 0x10]
mov rcx, qword [rdi]
call fcn.00442170
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.00442170
mov qword [rsi + 8], 0
jmp 0x4f82c8
mov qword [rsi + 8], 0
test rbx, rbx
je 0x4f82c8
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.00442170
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x4fbf10
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0052e6e0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4fbf62
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x4fbffd
mov r8d, 1
jmp 0x4fbff8
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
movzx ebp, word [r14]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4fbfce
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x4fbfec
jmp 0x4fbffd
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x4fbffd
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.00442170
mov rax, rsi
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x4fd510
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdx, qword [r8 + 8]
mov rsi, qword [r8 + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x4fd5e5
mov rdi, r8
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx]
lea rax, [0x004fd7a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x4fd5bc
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4fd580
mov ecx, dword [rsp + 0x34]
test ecx, ecx
jne 0x4fd5c3
mov eax, dword [rsp + 0x38]
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x4fd5de
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov rsi, rcx
shl rsi, 0x20
or rsi, 2
call fcn.004de720
mov ecx, eax
xor eax, eax
cmp cl, 0xb
cmovne rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret
lea r8, [0x00686530]
mov rcx, rsi
call fcn.0055df10
ud2

Function at 0x4fdd20
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x4fde2b
mov rsi, rcx
mov rbx, qword [rdi + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x4fdd57
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x4fddf0
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x4fde0e
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x20]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4fddad
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x4fddc9
jmp 0x4fddbe
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x4fddc4
cmp eax, 0x6d
jne 0x4fdde0
mov byte [rsi + 1], 0
jmp 0x4fddd4
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x4fddd6
mov r8d, 0x10
mov rcx, rbx
call fcn.0050b380
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x4fdd64
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.0050b380
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x4fdd64
mov qword [rsp + 0x40], 0
lea rax, str.library_std_src_sys_windows_pipe.rs
mov qword [rsp + 0x20], rax
lea r8, [0x00686858]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov rdx, rdi
call fcn.004dbcb0
ud2
Function at 0x4fdf50
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov ecx, 0x10
mov edx, 8
call fcn.00442160
test rax, rax
je 0x4fe013
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x004fe070]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x4fe006
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x4fdfdf
mov r8, qword [rax + 0x10]
mov rcx, qword [rsi]
call fcn.00442170
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call fcn.00442170
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.0052ffb0
ud2

Function at 0x5012e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x501310
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x501325
cmp byte [rax + 8], 0
je 0x501325
add rax, 9
jmp 0x5013aa
mov rcx, rdi
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x501301
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x501393
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x5013a8
mov rbx, rax
test rax, rax
jne 0x501370
mov ecx, 0x10
mov edx, 8
call fcn.00442160
test rax, rax
je 0x5013be
mov rbx, rax
mov qword [rax], rdi
mov byte [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x5013b2
dec ecx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
xor ecx, ecx
test rsi, rsi
je 0x501386
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rbx + 9]
mov byte [rbx + 8], 1
mov byte [rbx + 9], cl
jmp 0x5013aa
mov rcx, rdi
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x501339
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.004de2a0
mov ecx, eax
jmp 0x501368
mov ecx, 0x10
mov edx, 8
call fcn.0052ffb0
ud2
Function at 0x5013d0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x00583948]
jmp 0x5013d0
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x501403
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x501418
mov rcx, rax
cmp qword [rax], 0
je 0x501418
add rcx, 8
jmp 0x5014f9
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x5013f1
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x5014de
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x5014f7
mov rdi, rax
test rax, rax
jne 0x501477
mov ecx, 0x20
mov edx, 8
call fcn.00442160
test rax, rax
je 0x501513
mov rdi, rax
mov qword [rax], 0
mov qword [rax + 0x18], rbx
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x501504
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x501494
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x5014c9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x5014c4
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x5014c9
call fcn.004de1e0
mov qword [rdi], 1
lea rcx, [rdi + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
jmp 0x5014f9
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x501434
xor ecx, ecx
mov rax, rcx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
jmp 0x50146f
mov ecx, 0x20
mov edx, 8
call fcn.0052ffb0
ud2
Function at 0x501530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x50162d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x501562
mov rdi, rax
cmp qword [rax], 0
jne 0x501627
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x50164b
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x501664
mov rdi, rax
test rax, rax
jne 0x5015d5
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], rbx
mov ecx, 0x18
mov edx, 8
call fcn.00442160
test rax, rax
je 0x501680
mov rdi, rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x501671
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x5015ef
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x5015f1
mov rax, qword [rsi + 8]
jmp 0x5015f1
xor eax, eax
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rdi], 1
mov qword [rdi + 8], rax
test rdx, rdx
je 0x501627
test rcx, rcx
je 0x501627
lock dec qword [rcx]
jne 0x501627
lea rcx, [rsp + 0x30]
call fcn.004eb230
add rdi, 8
jmp 0x501666
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x501555
jmp 0x501562
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x50157e
xor edi, edi
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
jmp 0x5015cd
mov ecx, 0x18
mov edx, 8
call fcn.0052ffb0
ud2

Function at 0x501830
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x501860
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x501875
cmp qword [rax], 0
je 0x501875
add rax, 8
jmp 0x501908
mov rcx, rdi
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x501851
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x5018f1
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x501906
mov rbx, rax
test rax, rax
jne 0x5018c4
mov ecx, 0x18
mov edx, 8
call fcn.00442160
test rax, rax
je 0x50191c
mov rbx, rax
mov qword [rax], 0
mov qword [rax + 0x10], rdi
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x501910
dec ecx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x5018de
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x5018e0
mov rcx, qword [rsi + 8]
jmp 0x5018e0
xor ecx, ecx
lea rax, [rbx + 8]
mov qword [rbx], 1
mov qword [rbx + 8], rcx
jmp 0x501908
mov rcx, rdi
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x501889
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.004de2a0
mov ecx, eax
jmp 0x5018bc
mov ecx, 0x18
mov edx, 8
call fcn.0052ffb0
ud2
Function at 0x501930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x501a42
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x501962
mov rdi, rax
cmp qword [rax], 0
jne 0x501a3c
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x501a60
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x501a79
mov rdi, rax
test rax, rax
jne 0x5019d5
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rbx
mov ecx, 0x20
mov edx, 8
call fcn.00442160
test rax, rax
je 0x501a95
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x501a86
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x5019f6
mov rax, qword [rsi]
mov qword [rsi], 0
mov rcx, rax
test rax, rax
je 0x5019fa
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
jmp 0x5019fa
xor eax, eax
xor ecx, ecx
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rdx
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x20], xmm0
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
cmp qword [rsp + 0x20], 0
je 0x501a3c
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x501a3c
lock dec qword [rax]
jne 0x501a3c
lea rcx, [rsp + 0x30]
call fcn.004eb360
add rdi, 8
jmp 0x501a7b
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x501955
jmp 0x501962
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x50197e
xor edi, edi
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.004de2a0
mov ecx, eax
jmp 0x5019cd
mov ecx, 0x20
mov edx, 8
call fcn.0052ffb0
ud2

Function at 0x502360
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x5023b4
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x50244a
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x5023c7
cmp eax, 0x2739
jne 0x502415
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x502410
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
je 0x50242a
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x50244a
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x50244a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret