joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ace20
Capabilities:
Compare security identifiers

Disassembly:
push rdi
sub rsp, 0x490
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x488], rax
lea rax, [rsp + 0x68]
mov edi, 1
mov edx, edi
mov qword [rsp + 0x20], rax
mov r9d, 0x410
lea r8, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1401acef6
xor ecx, ecx
mov word [rsp + 0x484], 0x500
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
lea r8d, [rdi + 0x11]
mov dword [rsp + 0x48], ecx
xor r9d, r9d
mov dword [rsp + 0x40], ecx
movzx edx, dil
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x480], ecx
lea rcx, [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1401acef6
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x4a8], rbx
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rsp + 0x60]
test eax, eax
movzx ebx, bl
cmovne ebx, edi
call qword [sym.imp.ADVAPI32.dll_FreeSid]
movzx eax, bl
mov rbx, qword [rsp + 0x4a8]
jmp 0x1401acef8
xor al, al
mov rcx, qword [rsp + 0x488]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x490
pop rdi
ret

Function at 0x1401b3ad0
Capabilities:
Hash data with crc32

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r14d, r14d
mov qword [rsp + 0xc0], rbx
mov edi, r14d
mov rsi, rdx
mov rbp, rcx
mov r15, 0xffffffffffffffff
nop dword [rax]
cmp rdi, r15
je 0x1401b3c1c
test rdi, rdi
jne 0x1401b3b39
mov rbx, qword [rsi + 0x80]
mov rax, r14
test rbx, rbx
je 0x1401b3b46
mov rdi, qword [rbx + 0x88]
mov rax, rdi
jmp 0x1401b3b46
mov rax, qword [rdi + 0x88]
mov rbx, rdi
mov rdi, rax
test rax, rax
cmove rdi, r15
test rbx, rbx
je 0x1401b3c1c
lea rdx, [rbx + 4]
lea rcx, str.TYPE
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1401b3b10
cmp dword [rbx], 6
jne 0x1401b3b10
mov rax, qword [rbx + 0x70]
mov rdi, r14
cmp dword [rbx + 0x68], edi
je 0x1401b3b82
mov qword [rbp + 0x50], rax
jmp 0x1401b3b86
mov qword [rbp + 0x18], rax
mov esi, 1
lea r15d, [rsi + 7]
nop
mov edx, dword [rbx + 0x68]
test edx, edx
je 0x1401b3b9d
mov rax, qword [rbp + 0x50]
jmp 0x1401b3ba1
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbx + 0x78]
jae 0x1401b3bdb
test edx, edx
mov ecx, 0x40
mov r8d, esi
lea rdx, [rsp + 0x20]
cmove rcx, r15
add rcx, rbp
call fcn.1401b2ec0
test eax, eax
je 0x1401b3c1c
cmp rdi, 0x20
jae 0x1401b3c1c
movzx eax, word [rsp + 0x20]
mov word [rsp + rdi*2 + 0x30], ax
inc rdi
jmp 0x1401b3b90
cmp rdi, 0x20
jae 0x1401b3c1c
mov word [rsp + rdi*2 + 0x30], r14w
lea rbx, str.DWORD
lea rdi, [0x14020df90]
nop word [rax + rax]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1401b3c42
inc esi
add rbx, r15
cmp rbx, rdi
jl 0x1401b3c00
xor eax, eax
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, esi
jmp 0x1401b3c1e
Function at 0x1401ba560
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x30], 0
mov ebx, edx
mov word [rsp + 0x48], ax
mov rdi, rcx
lea r8, str._08x
xorps xmm0, xmm0
lea rcx, [rsp + 0x38]
mov r9d, edx
lea edx, [rax + 9]
movups xmmword [rsp + 0x38], xmm0
call fcn.140040350
cmp eax, 0xffffffff
je 0x1401ba677
mov r9d, 0x20006
mov byte [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfoAppTags
call fcn.1401a5450
test al, al
je 0x1401ba677
mov rax, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
je 0x1401ba5fe
nop
cmp dword [rax + 0x18], ebx
je 0x1401ba639
add rax, 0x20
cmp rax, rcx
jne 0x1401ba5f0
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, 0xfffffffd
mov rcx, qword [rsp + 0x30]
sete bl
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bl
jmp 0x1401ba679
mov rdx, qword [rax]
mov r9d, 3
mov rcx, qword [rax + 8]
xor r8d, r8d
sub rcx, rdx
and rcx, 0xfffffffffffffffc
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x38]
call qword [case.0x1401ba071.80]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jmp 0x1401ba61e
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1401bdb20
Capabilities:
Get common file path

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r14d, r14d
mov rdi, rcx
mov rbx, 0xffffffffffffffff
cmp qword [rcx + 0x30], r14
jne 0x1401bdc49
lea rdx, [rsp + 0x30]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x1401bdc49
mov qword [rsp + 0x280], rsi
lea rax, [rsp + 0x30]
lea rsi, [rdi + 0x20]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x1401bdb86
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140003530
mov rcx, qword [rsi + 0x18]
mov rdx, rsi
cmp rcx, 8
jb 0x1401bdbad
mov rdx, qword [rsi]
mov rax, qword [rdi + 0x30]
movzx edx, word [rdx + rax*2 - 2]
cmp dx, 0x5c
je 0x1401bdbd3
cmp dx, 0x2f
je 0x1401bdbd3
mov edx, 0x5c
mov rcx, rsi
call fcn.1400031b0
mov rcx, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov rax, rcx
sub rax, rdx
cmp rax, 0xc
jb 0x1401bdc21
mov qword [rsp + 0x278], rbp
lea rbp, [rdx + 0xc]
mov qword [rsi + 0x10], rbp
cmp rcx, 8
jb 0x1401bdbfc
mov rsi, qword [rsi]
lea rcx, [rsi + rdx*2]
mov r8d, 0x18
lea rdx, str.versions.csv
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbp*2], r14w
mov rbp, qword [rsp + 0x278]
jmp 0x1401bdc41
lfence
lea r9, str.versions.csv
mov qword [rsp + 0x20], reloc.WS2_32.dll_inet_ntoa
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, rsi
call fcn.1400033b0
mov rsi, qword [rsp + 0x280]
cmp qword [rdi + 0x10], r14
jne 0x1401bdcdb
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140195db0
test al, al
je 0x1401bdd1b
lea rcx, [rsp + 0x30]
call fcn.14018fa80
test eax, eax
jne 0x1401bdd1b
lea rax, [rsp + 0x30]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1401bdc81
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140003530
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x1401bdcf9
lea rbx, [rcx + 0xc]
mov qword [rdi + 0x10], rbx
cmp rdx, 8
jb 0x1401bdcc0
mov rdi, qword [rdi]
lea rcx, [rdi + rcx*2]
mov r8d, 0x18
lea rdx, str.versions.csv
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx*2], r14w
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x250
pop r14
pop rdi
pop rbx
ret
lfence
lea r9, str.versions.csv
mov qword [rsp + 0x20], reloc.WS2_32.dll_inet_ntoa
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, rdi
call fcn.1400033b0
jmp 0x1401bdcdb
xor al, al
jmp 0x1401bdcdd
Function at 0x1401beea0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x140210c04]
mov rbx, rcx
mov dword [rbp - 0x18], eax
mov rdx, 0xffffffffffffffff
movzx eax, word [0x140210c08]
mov word [rbp - 0x14], ax
mov qword [rbp - 0x28], 0
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x1401beee1
cmp rdx, 0xd
je 0x1401beefb
mov eax, 0xffffffff
jmp 0x1401befe2
movzx eax, word [rcx]
xor edx, edx
mov word [rbp - 0x18], ax
movzx eax, word [rcx + 2]
lea rcx, [rbp - 0x18]
mov word [rbp - 0x16], ax
lea r8d, [rdx + 0xa]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
xor edx, edx
lea rcx, [rbp - 0x18]
add eax, 0x64
mov dword [rbp - 0x2c], eax
movzx eax, word [rbx + 4]
mov word [rbp - 0x18], ax
lea r8d, [rdx + 0xa]
movzx eax, word [rbx + 6]
mov word [rbp - 0x16], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
xor edx, edx
lea rcx, [rbp - 0x18]
dec eax
mov dword [rbp - 0x30], eax
movzx eax, word [rbx + 8]
mov word [rbp - 0x18], ax
lea r8d, [rdx + 0xa]
movzx eax, word [rbx + 0xa]
mov word [rbp - 0x16], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov dword [rbp - 0x34], eax
xor edx, edx
movzx eax, word [rbx + 0xe]
lea rcx, [rbp - 0x18]
mov word [rbp - 0x18], ax
movzx eax, word [rbx + 0x10]
lea r8d, [rdx + 0xa]
mov word [rbp - 0x16], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov dword [rbp - 0x38], eax
xor edx, edx
movzx eax, word [rbx + 0x12]
lea rcx, [rbp - 0x18]
mov word [rbp - 0x18], ax
movzx eax, word [rbx + 0x14]
lea r8d, [rdx + 0xa]
mov word [rbp - 0x16], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov dword [rbp - 0x3c], eax
xor edx, edx
movzx eax, word [rbx + 0x16]
lea rcx, [rbp - 0x18]
mov word [rbp - 0x18], ax
movzx eax, word [rbx + 0x18]
lea r8d, [rdx + 0xa]
mov word [rbp - 0x16], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x20], 0xffffffff
mov dword [rbp - 0x40], eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__mktime32]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140131600
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140491ab8]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1401316ca
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x1404926f0]
lea rsi, [0x1404926e8]
mov ebx, eax
mov dword [rsp + 0x3c], 0
movabs rax, 0x4d54ee85da812030
add rdx, rax
cmp rdx, 1
jbe 0x140131675
mov rcx, qword [0x1404926e8]
mov edx, ebx
mov r8, qword [rcx + 0x30]
mov rcx, rsi
call r8
jmp 0x14013167a
test ebx, ebx
setne al
lea rcx, str.C:_vcpkg_masterinstalledx64_windows_staticinclude_boost_asiodetailimplwin_tss_ptr.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.win_tss_ptr_create
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], gethostbyname
mov dword [rsp + 0x34], 0x1a
test al, 1
je 0x1401316ca
cmp rax, 1
jne 0x1401316e4
test ebx, ebx
jne 0x1401316e4
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14035b0c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, [0x140457b8c]
lea rcx, [rsp + 0x38]
call fcn.1401314e0
int3

Function at 0x140131790
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14049b838]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401317c9
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.14014ae90
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.14014ae90

Function at 0x1401317e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x14049b838]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x140131810
mov r9, qword [rax + 8]
jmp 0x140131813
mov r9, r8
cmp rdi, 0x3fc
ja 0x140131837
test r9, r9
je 0x140131837
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x140131845
inc r8d
inc rax
cmp rax, 2
jl 0x140131824
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.14035b978
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140131ca0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140491ab8]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140131e8d
mov qword [rsp + 0xc0], rbx
test r8b, r8b
je 0x140131d1e
movzx eax, byte [rdx]
test al, 8
je 0x140131d1e
or al, 8
mov dword [rbp - 0x20], r12d
mov byte [rdx], al
lea r9, [rbp - 0x20]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x38]
setne dl
call fcn.140131be0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140131be0
test ebx, ebx
je 0x140131e89
mov qword [rsp + 0x78], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x1404926f0]
add rcx, rsi
mov qword [rsp + 0x70], r13
mov dword [rbp - 0x4c], r12d
lea r13, [0x1404926e8]
cmp rcx, 1
jbe 0x140131d88
mov rax, qword [0x1404926e8]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov rsi, qword [0x1404926f0]
jmp 0x140131d8a
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x2733
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.140130900
test al, al
jne 0x140131e27
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x4c], r12d
add rax, rsi
cmp rax, 1
jbe 0x140131ded
mov rax, qword [0x1404926e8]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x140131def
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x4d5
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.140130900
test al, al
je 0x140131e59
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140131be0
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov r13, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14035b0c0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x140131e65
mov eax, r12d
jmp 0x140131e6d
Function at 0x140131ea0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x140131f2b
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x1404926f0]
lea rbx, [0x1404926e8]
cmp rcx, 1
jbe 0x140131eed
mov rax, qword [0x1404926e8]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x140131eef
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], 0x2719
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.140131be0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140131f50
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x140131f7c
mov edx, dword [rdx]
jmp 0x140131faf
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul edx, ecx, 0x3e8
add edx, dword [rbx]
xor r14d, r14d
lea rsi, [0x1404926e8]
movabs r15, 0x4d54ee85da812030
sub edx, 0x79
je 0x14013209a
sub edx, 0x450
je 0x140132060
sub edx, 6
je 0x140132026
cmp edx, 1
jne 0x1401320eb
mov rcx, qword [0x1404926f0]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140132018
mov rax, qword [0x1404926e8]
mov edx, 0x2751
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2751
jmp 0x1401320cb
mov al, 1
mov dword [rbp - 0x20], 0x2751
jmp 0x1401320cb
mov rcx, qword [0x1404926f0]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140132055
mov rax, qword [0x1404926e8]
mov edx, 0x2743
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2743
jmp 0x1401320cb
mov al, 1
mov dword [rbp - 0x20], 0x2743
jmp 0x1401320cb
mov rcx, qword [0x1404926f0]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x14013208f
mov rax, qword [0x1404926e8]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x274d
jmp 0x1401320cb
mov al, 1
mov dword [rbp - 0x20], 0x274d
jmp 0x1401320cb
mov rcx, qword [0x1404926f0]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1401320c2
mov rax, qword [0x1404926e8]
mov edx, 0x274c
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401320c4
mov al, 1
mov dword [rbp - 0x20], 0x274c
movzx eax, al
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x140132106
cmp rax, 1
jne 0x140132188
cmp dword [rbx], r14d
jne 0x140132188
cmp rdi, 0xffffffffffffffff
jne 0x14013215f
mov rcx, qword [0x1404926f0]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140132134
mov rax, qword [0x1404926e8]
mov edx, 0x2719
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140132136
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x140132188
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.140131be0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140132760
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140491ab8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rbp - 0x18], r15d
lea r8d, [r15 + 1]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1404926f0]
lea r14, [0x1404926e8]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x1401327f3
mov rcx, qword [0x1404926e8]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x1401327f8
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x140132836
mov eax, dword [rbx]
mov r8d, eax
jmp 0x140132866
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x1401328a5
mov rcx, qword [0x1404926f0]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14013289a
mov rax, qword [0x1404926e8]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x140132912
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x140132912
cmp r9, 1
jne 0x1401328d8
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x140132932
mov rcx, qword [0x1404926f0]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x140132909
mov rax, qword [0x1404926e8]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14013290b
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14013293d
mov eax, 0xffffffff
jmp 0x140132954
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14035b0c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140133970
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140491ab8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x14049b7e0], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1401339e9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14035b0c0
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.140131ad0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14035b0c0
add rsp, 0x40
pop rbx
ret

Function at 0x1401343f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140491ab8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x140134449
call fcn.1401345c0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
movups xmmword [rsi], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rsi + 0x10], xmm0
xor eax, eax
jmp 0x140134547
mov dword [rsp + 0xa0], ebx
lea rcx, [rsp + 0xa8]
call fcn.140357e44
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [rdi + 0x28]
test rdi, rdi
cmove rax, rbx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x14049b838]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x38]
mov ecx, dword [0x14049b838]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.140134af0
test rax, rax
je 0x140134504
nop dword [rax]
lea rax, [rbx + 1]
cmp rbx, 0xffffffffffffffff
cmove rax, rbx
mov rbx, rax
mov r9, rsi
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.140134af0
test rax, rax
jne 0x1401344e0
mov rdx, qword [rsp + 0x48]
mov ecx, dword [0x14049b838]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rdi, [rsp + 0x50]
mov esi, 0xa
mov rcx, qword [rdi]
test rcx, rcx
je 0x14013452d
call fcn.14035b978
add rdi, 8
sub rsi, 1
jne 0x140134520
lea rcx, [rsp + 0xa8]
call fcn.140357ed0
mov rax, rbx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14035b0c0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret