joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056174
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1404be160]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebx, reloc.WS2_32.dll_recv
lea r8, [0x140056090]
mov edx, ebx
lea ecx, [rbx + 0x28]
call fcn.140075fec
xor r8d, r8d
mov qword [0x1404c56c0], rax
xor edx, edx
mov ecx, ebx
call fcn.140075570
xor ebx, ebx
mov qword [0x1404c7a80], rax
cmp word [0x1404c56b8], bx
jne 0x1400562a9
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
test eax, eax
jne 0x1400561ee
movzx eax, di
jmp 0x1400561f0
mov eax, ebx
lea rcx, str.ws2_32.dll
mov word [0x1404c56b8], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1404c56c8], rax
test rax, rax
je 0x1400562a9
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1404c56c8]
lea rdx, str.freeaddrinfo
mov qword [0x1404c5698], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1404c56c8]
lea rdx, str.getnameinfo
mov qword [0x1404c56a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1404c56c8]
lea rdx, str.WSAStringToAddressA
mov qword [0x1404c56a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1404c5698], rbx
mov qword [0x1404c56b0], rax
je 0x1400562a9
cmp qword [0x1404c56a0], rbx
je 0x1400562a9
cmp qword [0x1404c56a8], rbx
je 0x1400562a9
mov ecx, dword [0x1404c56bc]
test rax, rax
cmovne ecx, edi
mov dword [0x1404c56bc], ecx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400d2f30
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret

Function at 0x14005d1d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1404c7840]
call fcn.140075ebc
xor ebp, ebp
mov rsi, rax
test rax, rax
je 0x14005d250
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x14005d215
mov edx, ebx
mov rcx, rsi
call rax
jmp 0x14005d250
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, eax
mov edx, ebx
mov edi, eax
call fcn.140076980
lea r8d, [rdi + 1]
mov rdx, rax
mov rbx, rax
mov word [rax], bp
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
call fcn.140034dd4
sub edi, eax
mov ecx, edi
call fcn.140076a30
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140062a68
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1404be160]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetPropW]
lea r13d, [rbx + 9]
mov rsi, rax
test rax, rax
je 0x140062b27
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140062b27
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x20], eax
jne 0x140062b27
mov rcx, qword [0x1404c7860]
lea rdx, [rsi - 1]
call fcn.140075ebc
mov rbx, rax
lea ebp, [r13 - 8]
cmp dword [rax + 0x20], 0
jle 0x140062b27
mov rcx, qword [rax + 8]
xor edx, edx
movsxd rax, dword [rax + 0x20]
add rcx, 4
cmp word [rcx - 2], r13w
jne 0x140062b17
mov r8d, 0xfa01
cmp word [rcx], r8w
je 0x140062b25
inc rdx
add rcx, 6
cmp rdx, rax
jge 0x140062b27
jmp 0x140062b04
xor ebp, ebp
mov sil, pe_nt_image_headers64
test rdi, rdi
je 0x140062bf7
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x140062bf7
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140062bf7
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140062bf7
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140062bf7
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x140062bf7
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x28]
call fcn.14003684c
test eax, eax
je 0x140062bc7
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x28]
call fcn.14003684c
test eax, eax
jne 0x140062be2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x140062c5e
lea rdx, str.Scintilla
lea rcx, [rsp + 0x28]
call fcn.14003c184
test eax, eax
je 0x140062c5e
test r14, r14
je 0x140062c39
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140062c2c
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140062c2c
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x140062c39
mov edx, 1
mov rcx, r14
call fcn.140062c88
test rdi, rdi
je 0x140062c53
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x140062c5e
test rbx, rbx
je 0x140062c5e
mov rax, qword [rbx + 0x10]
jmp 0x140062c60
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d2f30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x1400630a4
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1404be160]
xor rax, rsp
mov qword [rbp + 0x380], rax
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140063235
cmp word [rcx], di
je 0x140063235
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rbp + 0x170]
call fcn.1400f300c
lea rcx, [rbp + 0x170]
mov word [rbp + 0x378], di
call fcn.140034dd4
mov rdx, rax
cdqe
lea rcx, [rbp + rax*2 + 0x16e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x140063168
cmp word [rbp + 0x172], 0x3a
jne 0x140063168
cmp edx, 2
jne 0x140063146
lea rdx, [0x14013f948]
lea rcx, [rbp + 0x170]
call fcn.1400f3054
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140063235
mov rbx, 0xfffffffffffffffe
jmp 0x140063235
cmp word [rcx], 0x5c
je 0x140063174
cmp word [rcx], 0x2f
jne 0x14006317d
mov word [rcx], di
sub rcx, 2
jmp 0x140063168
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x1400631be
test byte [rsp + 0x20], 0x10
je 0x1400631a7
mov rbx, 0xfffffffffffffffe
jmp 0x1400631b6
mov ebx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x40]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140063235
movzx ecx, word [rbp + 0x170]
movzx eax, word [rbp + 0x172]
cmp cx, 0x5c
jne 0x1400631d7
cmp ax, cx
je 0x1400631ed
cmp cx, 0x2f
jne 0x1400631e2
cmp ax, cx
je 0x1400631ed
cmp cx, 0x2e
jne 0x140063235
cmp ax, cx
jne 0x140063235
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140063214
not eax
mov rbx, 0xfffffffffffffffe
shr rax, 4
and eax, 1
or rbx, rax
jmp 0x140063235
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
mov rax, rbx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1400d2f30
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14006367c
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400636a7
test dl, 2
je 0x14006369a
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x1400636a9
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140063760
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140063773
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x140063775
xor eax, eax
add rsp, 0x28
ret

Function at 0x14006377c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.140076980
mov rdx, rax
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, str.Kernel32.DLL
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rbp, rax
test rax, rax
je 0x1400637f6
lea rdx, str.GetLongPathNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400637ed
mov r8d, ebx
mov rdx, rdi
mov rcx, rdi
call rax
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, esi
mov ecx, ebx
call fcn.140076a30
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd rax, esi
mov rsi, qword [rsp + 0x40]
mov word [rdi + rax*2], r14w
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140063f90
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x1404c7d80]
jne 0x140063fb0
add rsp, 0x30
pop rdi
jmp fcn.140075830
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.140075ebc
mov rbx, rax
test rax, rax
je 0x140064025
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14006400d
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x140063ffa
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x1404c3788]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1404c7d80]
mov rdx, rdi
call fcn.140075e50
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140064030
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140064074
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret
Function at 0x140064780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov dword [rsp + 0x48], ebx
mov rsi, rdx
test rdx, rdx
je 0x1400647f8
test r8d, r8d
je 0x1400647f8
mov rdx, rcx
mov rcx, qword [0x1404c7d80]
call fcn.140075ebc
test rax, rax
je 0x1400647f4
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x1400647e1
mov rcx, rax
call fcn.140065080
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140064810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rdx, rcx
mov rcx, qword [0x1404c7d80]
call fcn.140075ebc
mov rbx, rax
test rax, rax
je 0x140064860
mov r8d, dword [rax + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140064ee0
mov r8d, dword [rbx + 0x20]
lea rdx, [0x140147dc0]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140064ee0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140064ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x48], esi
test rdx, rdx
je 0x140064fd7
cmp word [rdx], si
je 0x140064fd7
test r8d, r8d
jne 0x140064f0e
mov r8d, dword [rcx + 0x20]
cmp r8d, 0x19
jne 0x140064f6e
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140064f20
lea r8d, [rax + rax]
cmp qword [rcx + 8], rsi
je 0x140064f4b
call fcn.140065080
mov dword [rsp + 0x48], eax
cdqe
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp r8d, 2
mov qword [rsp + 0x40], rdi
mov ecx, 0xfde9
lea r8, [rsp + 0x58]
cmovne ecx, esi
call fcn.1400658c0
mov rdi, rax
test rax, rax
je 0x140064fd2
mov rdx, rax
mov r8d, dword [rsp + 0x58]
cmp qword [rbx + 8], rsi
je 0x140064fad
mov rcx, rbx
call fcn.140065080
mov dword [rsp + 0x48], eax
jmp 0x140064fc0
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1404c3788]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x140065080
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x14006517a
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x1400650db
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x14006513c
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x140065134
sub edx, 1
je 0x14006512b
cmp edx, 2
je 0x140065124
mov r8, rbx
mov rdx, r14
call fcn.1400450d0
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x14006510a
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x14006510a
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x14006510a
mov rcx, rsi
call fcn.140064030
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x14006516b
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x140065110
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x140065105
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x140069604
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1404c7ea0], eax
add rsp, 0x28
ret

Function at 0x1400696a0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x140069715
call qword [rcx + 0xb0]
mov edx, dword [rbx + 0xf4]
mov rdi, rax
mov dword [rbx + 0x108], edx
mov edx, dword [rbx + 0xf8]
mov dword [rbx + 0x10c], edx
test rax, rax
jne 0x140069715
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x1400696ed
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x1404c3788]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1404c7ea0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1404c7ec0], 0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140069724
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1404c7ea0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [rax + IsNetDrive]
Function at 0x140069748
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x30
mov r15d, ecx
mov edi, r9d
mov ecx, dword [0x1404c7ea0]
mov esi, r8d
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [rsp + 0x60]
mov rbx, rax
cmp edx, dword [rax + 0x120]
je 0x140069797
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
mov r8d, dword [rbx + 0x104]
mov r9d, esi
mov edx, dword [rbx + 0x100]
add r8d, r14d
add edx, r15d
mov dword [rsp + 0x60], edi
mov rcx, rbx
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
jmp rax

Function at 0x1400697d8
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1404c7ea0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [rax + 0x11c], ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400697f8
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1404c7ea0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [rax + 0x118], ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400699e0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov esi, ecx
mov ebp, r9d
mov ecx, dword [0x1404c7ea0]
mov ebx, r8d
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov r11d, dword [rax + 0x100]
add esi, r11d
mov r10d, dword [rax + 0x104]
add ebx, r11d
mov eax, dword [rax + 0xe8]
add r14d, r10d
add ebp, r10d
cmp eax, 0xc
ja 0x140069bd0
mov ecx, 0x110c
bt ecx, eax
jae 0x140069bd0
mov r15d, ebx
mov dword [rdi + 0x1a8], esi
sub r15d, esi
mov dword [rdi + 0x1ac], r14d
mov eax, r15d
mov dword [rdi + 0x1b0], ebx
imul eax, r15d
mov r12d, ebp
sub r12d, r14d
mov dword [rdi + 0x1b4], ebp
mov ecx, r12d
imul ecx, r12d
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
call fcn.1401044d0
movss dword [rdi + 0x1b8], xmm0
cmp r14d, ebp
jne 0x140069ab5
lea rax, [0x14006990c]
cmp esi, ebx
lea rcx, [0x140069940]
cmovg rax, rcx
jmp 0x140069bc9
cmp esi, ebx
jne 0x140069acc
lea rax, [0x140069974]
cmp r14d, ebp
lea rcx, [0x1400699ac]
jmp 0x140069aac
mov ecx, r15d
call fcn.140104570
mov ecx, r12d
mov ebx, eax
call fcn.140104570
mov r10d, 1
cmp ebx, eax
jl 0x140069afe
and dword [rdi + 0x1c0], 0
mov ecx, dword [rdi + 0x1b4]
mov r8d, dword [rdi + 0x1ac]
jmp 0x140069b37
mov eax, dword [rdi + 0x1ac]
mov r8d, dword [rdi + 0x1a8]
mov ecx, dword [rdi + 0x1b0]
mov dword [rdi + 0x1a8], eax
mov eax, dword [rdi + 0x1b4]
mov dword [rdi + 0x1b4], ecx
mov dword [rdi + 0x1b0], eax
mov dword [rdi + 0x1c0], r10d
mov dword [rdi + 0x1ac], r8d
mov r9d, dword [rdi + 0x1a8]
mov edx, dword [rdi + 0x1b0]
cmp r9d, edx
jge 0x140069b52
and dword [rdi + 0x1bc], 0
jmp 0x140069b87
mov r8d, dword [rdi + 0x1b4]
mov eax, r9d
mov ecx, dword [rdi + 0x1ac]
mov r9d, edx
mov dword [rdi + 0x1a8], edx
mov edx, eax
mov dword [rdi + 0x1b0], eax
mov dword [rdi + 0x1bc], r10d
mov dword [rdi + 0x1b4], ecx
mov dword [rdi + 0x1ac], r8d
sub ecx, r8d
lea rax, [0x140069818]
sub edx, r9d
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movss dword [rdi + 0x1c4], xmm1
movsd xmm1, qword [0x140148788]
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [rdi + 0x1c8], xmm0
mov qword [rdi + 0x128], rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140069bf0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, ecx
mov ebp, r9d
mov ecx, dword [0x1404c7ea0]
mov esi, r8d
mov edi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15d, esi
mov r14, rax
mov r11d, dword [rax + 0x100]
mov edx, dword [rax + 0x104]
add r11d, ebx
add edx, edi
mov edi, ebp
test esi, esi
lea r12d, [r11 + rsi]
cmovns r12d, r11d
lea r13d, [rdx + rbp]
neg r15d
test esi, esi
cmovns r15d, esi
mov esi, dword [rsp + 0x90]
test ebp, ebp
cmovns r13d, edx
neg edi
test ebp, ebp
lea eax, [rsi + rsi]
cmovns edi, ebp
cmp eax, r15d
jle 0x140069c79
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
mov ebx, dword [rsp + 0x98]
lea ecx, [rbx + rbx]
cmp ecx, edi
jle 0x140069c90
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
mov edx, dword [r14 + 0x118]
cmp edx, dword [r14 + 0x120]
je 0x140069cb1
mov rcx, r14
mov dword [r14 + 0x120], edx
call qword [r14 + pe_nt_image_headers64]
mov dword [rsp + 0x30], ebx
mov r9d, r15d
mov dword [rsp + 0x28], esi
mov r8d, r13d
mov edx, r12d
mov dword [rsp + 0x20], edi
mov rcx, r14
call qword [r14 + reloc.WS2_32.dll_recv]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140069cec
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x30
mov r15d, ecx
mov edi, r9d
mov ecx, dword [0x1404c7ea0]
mov esi, r8d
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov edx, dword [rax + 0x118]
cmp edx, dword [rax + 0x120]
je 0x140069d3d
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
mov r8d, dword [rbx + 0x104]
mov r9d, esi
mov edx, dword [rbx + 0x100]
add r8d, r14d
add edx, r15d
mov dword [rsp + 0x20], edi
mov rcx, rbx
call qword [rbx + htons]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret

Function at 0x140069dac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1404c7ea0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140069e0d
mov rcx, rax
call qword [rax + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140069de5
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x1404c3788]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1404c7ea0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1404c7ec0], 0
add rsp, 0x20
pop rbx
ret