joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5910
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx + 0x320]
test rcx, rcx
je 0x1400b5a57
mov rax, qword [rcx]
call qword [rax + 0x10]
imul rax, qword [rdi + 0x2e0], 0xf4240
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 0x1f8]
call fcn.1400ace20
mov qword [rsp + 0x70], rdi
mov rsi, qword [rdi + 0x1f8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
xor r14d, r14d
test rax, rax
je 0x1400b598c
mov rdx, qword [rax + 8]
jmp 0x1400b598f
mov rdx, r14
mov r9d, 8
mov r8d, 0x90
movzx ecx, byte [rsp + 0x70]
call fcn.14007f670
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rax + 0x20], r14
lea rax, [0x1400a88f0]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
mov dword [rbx + 0x38], r14d
lea rax, [0x1401355e8]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], r14
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x50], rax
lea rcx, [rbx + 0x58]
lea r9, [rdi + 0x238]
xor r8d, r8d
xor edx, edx
call fcn.14008a830
mov qword [rsp + 0x40], rbx
mov byte [rdi + 0x208], 1
lea r9, [rdi + 0x210]
lea rdx, [rsi + 0x28]
mov qword [rsp + 0x20], rbx
lea r8, [rdi + 0x200]
mov rcx, qword [rsi + 0x58]
call fcn.140087b50
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x30]
call fcn.1400ba8d0
nop
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call sub.msvcp140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x1400b95c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140135880]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x30], rdx
xor ebp, ebp
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1400b9600
mov rcx, qword [rdx]
lea rdx, [0x14010bb64]
call qword [sym.imp.ucrtbase.dll_fopen]
mov rsi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x1400b9633
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], al
jmp 0x1400b96fd
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jns 0x1400b9660
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
jmp 0x1400b96f3
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_ftell]
movsxd rbx, eax
test eax, eax
js 0x1400b9646
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_fseek]
xorps xmm0, xmm0
test eax, eax
js 0x1400b9649
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14010e320]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400bae00
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
mov r9, rsi
mov r8, rbx
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fread]
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x14010e320]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_fclose]
nop
mov rcx, r14
call fcn.140072710
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ff9a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ba230
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400ba28d
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x1400ba285
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400ba280
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400ba280
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400ba2d7
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba2c6
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba2c6
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400ba2e2
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba2b4
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x50]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1400ba310
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba33f
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x1400ba337
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba389
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba378
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba378
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400ba394
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba366
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba460
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400ba4bd
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400ba4b5
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400ba4b0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400ba4b0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400ba50a
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba4f9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba4f9
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400ba515
inc ecx
inc rax
cmp rax, 6
jl 0x1400ba4e7
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1400ba5e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400ba63d
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400ba635
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400ba630
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400ba630
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400ba68a
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba679
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba679
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400ba695
inc ecx
inc rax
cmp rax, 6
jl 0x1400ba667
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x38]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1400ba760
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba787
add rcx, 8
call fcn.14008eb10
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba7d4
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba7c3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba7c3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400ba7df
inc ecx
inc rax
cmp rax, 6
jl 0x1400ba7b1
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400ba810
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba843
add rcx, 0x60
cmp qword [rcx + 0x20], 0
je 0x1400ba83b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba893
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba882
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba882
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400ba89e
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba870
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x98]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ba8d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba903
add rcx, 0x58
cmp qword [rcx + 0x20], 0
je 0x1400ba8fb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba953
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400ba942
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba942
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400ba95e
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba930
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba990
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba9c3
add rcx, 0x68
cmp qword [rcx + 0x20], 0
je 0x1400ba9bb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400baa13
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400baa02
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400baa02
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400baa1e
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba9f0
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400baa50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400baad1
lea rcx, [rdi + 0x1c8]
cmp qword [rcx + 0x20], 0
je 0x1400baa88
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rdi + 0x1b0]
test rbx, rbx
je 0x1400baac0
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400baac0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400baac0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lea rcx, [rdi + 0x48]
call fcn.1400906d0
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400bab1b
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400bab0a
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400bab0a
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400bab30
inc ecx
inc rax
cmp rax, 2
jl 0x1400baaf8
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x200]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x1400bab13
Function at 0x1400bab50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1400babdd
lea rcx, [rsi + 0x70]
cmp qword [rcx + 0x20], 0
je 0x1400bab85
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rsi + 0x68]
mov edi, 0xffffffff
test rbx, rbx
je 0x1400babbc
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400babbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400babbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1400babd5
lock xadd dword [rcx + 0xc], edi
cmp edi, 1
jne 0x1400babd5
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400bac27
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400bac16
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400bac16
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400bac3c
inc ecx
inc rax
cmp rax, 2
jl 0x1400bac04
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x1400bac1f

Function at 0x1400bac50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1400bacb0
lea rcx, [rbx + 0x1b0]
cmp qword [rcx + 0x20], 0
je 0x1400bac7e
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x150]
call fcn.14008eb10
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400baca8
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1400baca8
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400bacfa
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x1400bace9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400bace9
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400bad05
inc ecx
inc rax
cmp rax, 2
jl 0x1400bacd7
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1e8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bad30
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
cmp rbx, 0xffffffffffffffff
je 0x1400bade7
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_closesocket]
test eax, eax
je 0x1400bade0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
call fcn.1400aeee0
mov rbp, rax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.1400aeee0
mov rcx, qword [rax + 8]
cmp qword [rbp + 8], rcx
jne 0x1400bad8c
cmp esi, 0x2733
je 0x1400bada3
call fcn.1400aeee0
mov rdx, qword [rax + 8]
cmp qword [rbp + 8], rdx
jne 0x1400badd6
cmp esi, 0x4d5
jne 0x1400badd6
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_ioctlsocket]
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_closesocket]
test eax, eax
je 0x1400badd6
call fcn.1400aeee0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi], 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bafd0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov r12d, r9d
mov rcx, r8
mov r13, r8
call fcn.1400bad30
mov rax, qword [r14 + 8]
lock inc dword [rax + 0x30]
mov rdi, qword [rsp + 0xc0]
xor ebp, ebp
mov rsi, qword [rsp + 0xc8]
test rdi, rdi
je 0x1400bb039
mov eax, ebp
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x1400bb039
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, 0x3e3
mov rdx, rsi
call fcn.1400b5580
mov r8d, dword [rsp + 0xa8]
mov r15d, 1
mov edx, dword [rsp + 0xa0]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov ecx, r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400bb0fd
call fcn.1400aeee0
mov rdi, rax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rcx, r13
mov ebx, eax
call fcn.1400bad30
mov qword [r13], 0xffffffffffffffff
lea r8d, [r15 + 1]
mov r14, qword [r14 + 8]
mov r9, rsi
mov dword [rsi + 0x30], r15d
xor edx, edx
mov qword [rsi], rdi
mov dword [rsi + 0x10], ebx
mov dword [rsi + 0x14], ebp
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1400bb1cc
lea rcx, [r14 + 0x60]
call qword [sym.imp.kernel32.dll_EnterCriticalSection]
mov qword [rsi + 0x20], rbp
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x1400bb0dc
mov qword [rax + 0x20], rsi
jmp 0x1400bb0e3
mov qword [r14 + 0x90], rsi
mov qword [r14 + 0x98], rsi
lea rcx, [r14 + 0x60]
xchg dword [r14 + 0x58], r15d
call qword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x1400bb1cc
cmp r12d, 0x17
jne 0x1400bb12d
lea r9, [rsp + 0xc0]
mov dword [rsp + 0xc0], ebp
lea edx, [r12 + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [r12 + 4]
mov rcx, rbx
call qword [sym.imp.wsock32.dll_setsockopt]
mov rcx, r13
call fcn.1400bad30
mov r15, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov r8, qword [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x38], rsi
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rcx, r15
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov qword [r13], rbx
mov dword [rsp + 0x80], ebp
call sub.wsock32.dll_AcceptEx
mov ebx, eax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x1400bb1a6
cmp eax, 0x3e5
je 0x1400bb1a6
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call fcn.1400b5580
jmp 0x1400bb1cc
test rdi, rdi
je 0x1400bb1c0
lock xadd dword [rdi], ebp
cmp ebp, 1
jne 0x1400bb1c0
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.kernel32.dll_CancelIoEx]
mov rcx, qword [r14 + 8]
mov rdx, rsi
call fcn.1400b5870
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bc0a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1400bc0e9
call fcn.1400c01a0
mov dword [rsp + 0x20], edi
lea rax, [0x1401355e8]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x1400bc1fd
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
lea rcx, [rsp + 0x98]
call sub.msvcp140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400a9950
test rax, rax
je 0x1400bc1b9
nop dword [rax]
nop word [rax + rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400a9950
test rax, rax
jne 0x1400bc190
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x14013af08]
call qword [sym.imp.kernel32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x40]
mov esi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400bc1e3
call qword [sym.imp.ucrtbase.dll__aligned_free]
add rbx, 8
sub rsi, 1
jne 0x1400bc1d5
lea rcx, [rsp + 0x98]
call sub.msvcp140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
mov rax, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400bf630
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400bf6a9
mov dword [rdi], 0
cmp esi, 0x17
jne 0x1400bf696
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rax
call qword [sym.imp.wsock32.dll_setsockopt]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.1400aeee0
mov rbx, rax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rsi, qword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
movups xmm0, xmmword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rdi
ret