joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5560
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400c55bd
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400c55b5
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c55b0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c55b0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400c560a
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c55f9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c55f9
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400c5615
inc ecx
inc rax
cmp rax, 6
jl 0x1400c55e7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1400c56e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400c573d
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400c5735
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c5730
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400c5730
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400c578a
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5779
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5779
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400c5795
inc ecx
inc rax
cmp rax, 6
jl 0x1400c5767
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x38]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1400c5860
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c5887
add rcx, 8
call fcn.140097f80
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400c58d4
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c58c3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c58c3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400c58df
inc ecx
inc rax
cmp rax, 6
jl 0x1400c58b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400c5910
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c5943
add rcx, 0x60
cmp qword [rcx + 0x20], 0
je 0x1400c593b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400c5993
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5982
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5982
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400c599e
inc ecx
inc rax
cmp rax, 2
jl 0x1400c5970
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x98]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c59d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c5a03
add rcx, 0x58
cmp qword [rcx + 0x20], 0
je 0x1400c59fb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400c5a53
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5a42
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5a42
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400c5a5e
inc ecx
inc rax
cmp rax, 2
jl 0x1400c5a30
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c5a90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c5ac3
add rcx, 0x68
cmp qword [rcx + 0x20], 0
je 0x1400c5abb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400c5b13
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5b02
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5b02
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400c5b1e
inc ecx
inc rax
cmp rax, 2
jl 0x1400c5af0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c5b50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400c5bd1
lea rcx, [rdi + 0x1c8]
cmp qword [rcx + 0x20], 0
je 0x1400c5b88
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rdi + 0x1b0]
test rbx, rbx
je 0x1400c5bc0
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c5bc0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400c5bc0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
lea rcx, [rdi + 0x48]
call fcn.140099b40
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400c5c1b
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5c0a
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5c0a
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400c5c30
inc ecx
inc rax
cmp rax, 2
jl 0x1400c5bf8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x200]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x1400c5c13
Function at 0x1400c5c50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1400c5cdd
lea rcx, [rsi + 0x70]
cmp qword [rcx + 0x20], 0
je 0x1400c5c85
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rsi + 0x68]
mov edi, 0xffffffff
test rbx, rbx
je 0x1400c5cbc
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400c5cbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400c5cbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1400c5cd5
lock xadd dword [rcx + 0xc], edi
cmp edi, 1
jne 0x1400c5cd5
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400c5d27
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5d16
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5d16
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400c5d3c
inc ecx
inc rax
cmp rax, 2
jl 0x1400c5d04
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x1400c5d1f

Function at 0x1400c5d50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1400c5db0
lea rcx, [rbx + 0x1b0]
cmp qword [rcx + 0x20], 0
je 0x1400c5d7e
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x150]
call fcn.140097f80
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400c5da8
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1400c5da8
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400c5dfa
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c5de9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5de9
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400c5e05
inc ecx
inc rax
cmp rax, 2
jl 0x1400c5dd7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1e8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c60d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov r12d, r9d
mov rcx, r8
mov r13, r8
call fcn.1400c5e30
mov rax, qword [r14 + 8]
lock inc dword [rax + 0x30]
mov rdi, qword [rsp + 0xc0]
xor ebp, ebp
mov rsi, qword [rsp + 0xc8]
test rdi, rdi
je 0x1400c6139
mov eax, ebp
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x1400c6139
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, 0x3e3
mov rdx, rsi
call fcn.1400c0680
mov r8d, dword [rsp + 0xa8]
mov r15d, 1
mov edx, dword [rsp + 0xa0]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov ecx, r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c61fd
call fcn.1400b9fe0
mov rdi, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rcx, r13
mov ebx, eax
call fcn.1400c5e30
mov qword [r13], 0xffffffffffffffff
lea r8d, [r15 + 1]
mov r14, qword [r14 + 8]
mov r9, rsi
mov dword [rsi + 0x30], r15d
xor edx, edx
mov qword [rsi], rdi
mov dword [rsi + 0x10], ebx
mov dword [rsi + 0x14], ebp
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1400c62cc
lea rcx, [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsi + 0x20], rbp
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x1400c61dc
mov qword [rax + 0x20], rsi
jmp 0x1400c61e3
mov qword [r14 + 0x90], rsi
mov qword [r14 + 0x98], rsi
lea rcx, [r14 + 0x60]
xchg dword [r14 + 0x58], r15d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400c62cc
cmp r12d, 0x17
jne 0x1400c622d
lea r9, [rsp + 0xc0]
mov dword [rsp + 0xc0], ebp
lea edx, [r12 + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [r12 + 4]
mov rcx, rbx
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov rcx, r13
call fcn.1400c5e30
mov r15, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov r8, qword [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x38], rsi
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rcx, r15
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov qword [r13], rbx
mov dword [rsp + 0x80], ebp
call sub.WSOCK32.dll_AcceptEx
mov ebx, eax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
test ebx, ebx
jne 0x1400c62a6
cmp eax, 0x3e5
je 0x1400c62a6
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call fcn.1400c0680
jmp 0x1400c62cc
test rdi, rdi
je 0x1400c62c0
lock xadd dword [rdi], ebp
cmp ebp, 1
jne 0x1400c62c0
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CancelIoEx]
mov rcx, qword [r14 + 8]
mov rdx, rsi
call fcn.1400c0970
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c71a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1400c71e9
call fcn.1400cb2a0
mov dword [rsp + 0x20], edi
lea rax, [0x1401405e8]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x1400c72fd
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
lea rcx, [rsp + 0x98]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400b4a50
test rax, rax
je 0x1400c72b9
nop dword [rax]
nop word [rax + rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400b4a50
test rax, rax
jne 0x1400c7290
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x40]
mov esi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400c72e3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add rbx, 8
sub rsi, 1
jne 0x1400c72d5
lea rcx, [rsp + 0x98]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
mov rax, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400ca730
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400ca7a9
mov dword [rdi], 0
cmp esi, 0x17
jne 0x1400ca796
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.1400b9fe0
mov rbx, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rsi, qword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
movups xmm0, xmmword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rdi
ret
Function at 0x1400caec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
test rax, rax
jne 0x1400caf23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.1400b9fe0
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400cb026
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x1400caf70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.1400b9fe0
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400cb038
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x1400cde80]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x1400cafe5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x1400cafc4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400cafd3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.1400b9fe0
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400cb014
test rdi, rdi
je 0x1400cb001
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.1400b5080
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.1400b5080
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.1400b5080
int3
Function at 0x1400cb5e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbx
push r13
push r15
sub rsp, 0x2d0
mov rax, qword [0x140140880]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, qword [rsp + 0x320]
mov rax, r8
mov qword [rsp + 0x68], rax
mov r10, r9
mov qword [rsp + 0x58], r9
movzx r13d, dl
mov r15, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400cb645
mov dword [rsp + 0x58], 0x2719
call fcn.1400b9fe0
mov qword [rsp + 0x60], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
jmp 0x1400cb80b
cmp byte [rsp + 0x318], 0
mov qword [rsp + 0x2c8], rsi
je 0x1400cb668
test r13b, 0x10
je 0x1400cb668
xor esi, esi
mov dword [rbx], esi
xor eax, eax
jmp 0x1400cb803
mov qword [rsp + 0x2f8], rbp
xor esi, esi
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2b8], r12
mov qword [rsp + 0x2b0], r14
lea r14, [rbx + 8]
nop
mov ecx, dword [rsp + 0x310]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov r8d, r10d
mov qword [rsp + 0x28], rsi
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, r15
mov dword [rsp + 0x40], esi
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebp, eax
call fcn.1400b9fe0
mov rdi, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbx], xmm0
mov ecx, dword [rbx]
cmp ecx, 0x40
jne 0x1400cb707
mov dword [rsp + 0x80], 0x2746
call fcn.1400b9fe0
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rsp + 0x80]
jmp 0x1400cb726
cmp ecx, 0x4d2
jne 0x1400cb72d
mov dword [rsp + 0x48], 0x274d
call fcn.1400b9fe0
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x48]
lea r14, [rbx + 8]
movups xmmword [rbx], xmm0
test ebp, ebp
jne 0x1400cb740
movsxd rax, dword [rsp + 0x40]
mov dword [rbx], esi
test eax, eax
jns 0x1400cb7e3
test r13b, 1
jne 0x1400cb7e1
call fcn.1400b9fe0
mov rcx, qword [r14]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x1400cb764
cmp dword [rbx], 0x2733
je 0x1400cb77e
call fcn.1400b9fe0
mov rcx, qword [r14]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x1400cb7e1
cmp dword [rbx], 0x4d5
jne 0x1400cb7e1
lea ecx, [r15 + 1]
mov qword [rsp + 0x98], r15
xor r9d, r9d
mov dword [rsp + 0x90], 1
lea r8, [rsp + 0x90]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.WSOCK32.dll_select]
test eax, eax
js 0x1400cb7c2
mov rax, qword [rsp + 0x68]
mov r10, qword [rsp + 0x58]
mov dword [rbx], esi
jmp 0x1400cb690
call fcn.1400b9fe0
mov rdi, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rdi
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm0
xor eax, eax
mov r12, qword [rsp + 0x2b8]
mov rdi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14010aaf0
add rsp, 0x2d0
pop r15
pop r13
pop rbx
ret
Function at 0x1400cdf40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1400cdf71
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1400cdf8f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400cdfd9
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x1400ce051
mov rcx, rbp
call fcn.1400ade70
cmp rbx, 0xfff
jbe 0x1400ce031
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400ce072
cmp rbx, rax
ja 0x1400ce000
test rdi, rdi
je 0x1400ce051
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x1400ce054