joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023ec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
lea r15, [0x1405a3e20]
test rax, rax
jne 0x140023f32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x14002403e
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x140023f81
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x140024050
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x140024070]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call fcn.1402d3f48
mov qword [rbp + 8], rax
test rax, rax
jne 0x140023ff7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x140023fd4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140023fe3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x14002402c
test rdi, rdi
je 0x140024013
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.140017430
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.140017430
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.140017430
int3

Function at 0x1400240d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0x28]
xor edi, edi
test rcx, rcx
mov ecx, dword [0x1406782b0]
cmove rbx, rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14002411b
cmp qword [rax], rbx
je 0x140024117
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400240f8
test rdi, rdi
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rax + 8]
mov rbx, qword [rsp + 0x30]
test rdi, rdi
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x140024740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x140024790
call fcn.1400248c0
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x24], bl
lea rax, [0x1405a3e20]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp], xmm0
xor eax, eax
jmp 0x140024860
mov dword [rsp + 0x50], ebx
lea rcx, [rsp + 0x58]
call fcn.140277b50
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
lea rax, [rsi + 0x28]
test rsi, rsi
cmove rax, rbx
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1406782b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x1406782b0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rdi, rbx
mov r9, rbp
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.140024c60
test rax, rax
je 0x140024825
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r9, rbp
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.140024c60
test rax, rax
jne 0x140024801
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x1406782b0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x38]
call fcn.1402bfe3c
inc rbx
cmp rbx, 3
jl 0x140024840
lea rcx, [rsp + 0x58]
call fcn.140277bdc
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400250c0
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rbx
push rbp
push r14
push r15
sub rsp, 0x48
xor r15d, r15d
mov rbx, r9
mov r14, rdx
mov rbp, rcx
cmp rcx, 0xffffffffffffffff
je 0x140025226
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x28], r12
lea r12, [0x1405a3e20]
test r8b, r8b
je 0x14002513c
movzx eax, byte [rdx]
test al, 8
je 0x14002513c
or al, 8
mov dword [r11 + 8], r15d
mov byte [rdx], al
lea r9, [r11 + 8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x140025136
mov r8, r12
lea rcx, [rsp + 0x30]
call fcn.140023920
jmp 0x14002513c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
test eax, eax
jne 0x14002515c
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.140023920
jmp 0x1400251ec
mov qword [rsp + 0x78], rsi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], r12
lea rsi, [rbx + 8]
test eax, eax
mov dword [rsp + 0x30], eax
movabs rdx, 0x8fafd21e25c5e09b
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov ecx, dword [rbx]
cmp ecx, 0x2733
jne 0x1400251a0
mov rax, qword [rsi]
cmp qword [rax + 8], rdx
je 0x1400251b1
cmp ecx, 0x4d5
jne 0x1400251e7
mov rax, qword [rsi]
cmp qword [rax + 8], rdx
jne 0x1400251e7
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, eax
test eax, eax
jne 0x140025206
mov r8, qword [rsi]
mov rcx, rbx
call fcn.140023920
mov rsi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], r12
setne byte [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
jmp 0x1400251e7
mov eax, r15d
add rsp, 0x48
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x140025750
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x78]
xor eax, eax
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x50], 1
lea r8d, [rax + 1]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x40], eax
lea rcx, [0x1405a3e20]
setne byte [rsp + 0x44]
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
cmp eax, 0x40
jne 0x1400257d2
mov dword [rsp + 0x40], 0x2746
jmp 0x1400257e1
cmp eax, 0x4d2
jne 0x1400257f6
mov dword [rsp + 0x40], 0x274d
mov byte [rsp + 0x44], 1
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
test ebx, ebx
jne 0x140025809
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.140023920
add rsp, 0x60
pop rbx
ret
Function at 0x140025af0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r12d, r9d
mov rsi, r8
mov rdi, rdx
mov r13, rcx
cmp qword [r8], 0xffffffffffffffff
je 0x140025b84
mov dword [rbp - 0x10], 1
movabs rcx, 0x8fafd21e25c5e09b
lea rbx, [0x14061e810]
mov rax, qword [0x14061e818]
cmp rax, rcx
je 0x140025b68
movabs rcx, 0xb2ab117a257edf0d
cmp rax, rcx
je 0x140025b68
mov edx, 1
mov rcx, rbx
mov rax, qword [0x14061e810]
call qword [rax + 0x30]
jmp 0x140025b6a
mov al, 1
mov byte [rbp - 0xc], al
mov qword [rbp - 8], rbx
mov rax, qword [rbp + 0x60]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax], xmm0
movups xmmword [rdi], xmm0
jmp 0x140025cf7
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0x58]
mov r14d, dword [rbp + 0x50]
mov edx, r14d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140025bf9
mov rbx, qword [rbp + 0x60]
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.140023920
cmp r12d, 0x17
jne 0x140025bf0
mov dword [rbp + 0x40], 0
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x40]
lea edx, [r12 + 0x12]
lea r8d, [r12 + 4]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r12, [0x1405a3e20]
jmp 0x140025c25
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp - 0x10], eax
test eax, eax
setne byte [rbp - 0xc]
lea r12, [0x1405a3e20]
mov qword [rbp - 8], r12
mov rbx, qword [rbp + 0x60]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbx], xmm0
mov r15, 0xffffffffffffffff
cmp r15, 0xffffffffffffffff
jne 0x140025c33
movups xmm0, xmmword [rbx]
jmp 0x140025cf4
mov rdx, qword [r13 + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdx + 0x28]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x140025c63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], eax
test eax, eax
setne byte [rbp - 0xc]
xor r13d, r13d
jmp 0x140025c6e
xor r13d, r13d
mov dword [rbp - 0x10], r13d
mov byte [rbp - 0xc], r13b
mov qword [rbp - 8], r12
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbx], xmm0
mov rax, qword [rbx]
shr rax, 0x20
test al, al
je 0x140025cac
movups xmmword [rdi], xmm0
mov dword [rbp - 0x10], r13d
mov byte [rbp - 0xc], 0
mov qword [rbp - 8], r12
mov byte [rbp + 0x40], 0
lea r9, [rbp - 0x10]
mov r8b, 1
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.1400250c0
jmp 0x140025cf7
mov qword [rbp - 0x10], 0xffffffffffffffff
mov qword [rsi], r15
sub r14d, 1
je 0x140025ccf
cmp r14d, 1
je 0x140025cc9
mov byte [rsi + 8], 0
jmp 0x140025cd3
mov byte [rsi + 8], 0x20
jmp 0x140025cd3
mov byte [rsi + 8], reloc.WS2_32.dll_recv
lea rcx, [rsi + 0x10]
movzx r8d, byte [rbp + 0x40]
call fcn.14002b7e0
mov dword [rbp - 0x10], r13d
mov byte [rbp - 0xc], 0
mov qword [rbp - 8], r12
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbx], xmm0
movups xmmword [rdi], xmm0
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140025d20
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r10, r9
mov r11, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x140025d5a
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
mov rcx, qword [rcx + 8]
xor r8d, r8d
add rsp, 0x40
pop rdi
jmp fcn.140024bc0
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140025d82
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
mov rcx, qword [rdi + 8]
mov r8d, 0x2719
add rsp, 0x40
pop rdi
jmp fcn.140024bc0
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], eax
mov r8d, r10d
mov eax, dword [rsp + 0x70]
mov rdx, r11
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x140025e01
cmp eax, 0x3e5
je 0x140025e01
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.140024bc0
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.140024b20
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140025e20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r10, r9
mov r11, r8
mov rbx, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x140025e5a
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
mov rcx, qword [rcx + 8]
xor r8d, r8d
add rsp, 0x40
pop rbx
jmp fcn.140024bc0
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140025e82
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
mov rcx, qword [rbx + 8]
mov r8d, 0x2719
add rsp, 0x40
pop rbx
jmp fcn.140024bc0
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x50]
mov dword [rsp + 0x78], edx
mov r8d, r10d
mov qword [rsp + 0x58], rsi
mov rdx, r11
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x80]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x140025edb
mov eax, 0x2746
jmp 0x140025ee8
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x58]
je 0x140025f17
cmp eax, 0x3e5
je 0x140025f17
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.140024bc0
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.140024b20
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbx
ret
Function at 0x14002be20
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx + 8]
lea rbx, [0x1405a3e20]
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x34], 0
mov qword [rsp + 0x38], rbx
cmp rcx, 0xffffffffffffffff
jne 0x14002be58
mov dword [rsp + 0x30], 0x2719
mov byte [rsp + 0x34], 1
jmp 0x14002be98
mov r9, rdx
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14002be87
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.140023920
jmp 0x14002bea8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x30], eax
setne byte [rsp + 0x34]
mov qword [rsp + 0x38], rbx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x30]
shr rax, 0x20
test al, al
jne 0x14002bebb
add rsp, 0x40
pop rbx
ret
lea rdx, str.set_option
lea rcx, [rsp + 0x30]
call fcn.140017430
int3

Function at 0x14002f4d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14061da68]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov dword [rsp + 0x24], 0
cmp qword [rcx + 0x18], 0
jne 0x14002f514
mov rdx, r8
mov rcx, rdi
call fcn.14002fa50
jmp 0x14002f637
mov rbx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x10]
call qword [rax + 0x18]
mov rdx, rax
lea r8, [rsp + 0x28]
lea rcx, [rbp - 0x21]
call qword [rbx + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.14002f100
mov dword [rsp + 0x24], 4
lea rcx, [rbp - 0x21]
mov rax, qword [rbp - 0x11]
call qword [rax]
nop
lea rdx, [rbp - 0x51]
lea rcx, [rbp + 0xf]
call fcn.14002f100
mov rbx, rax
mov dword [rsp + 0x24], 3
lea rcx, [rbp - 0x51]
mov rdx, qword [rbp - 0x41]
call qword [rdx]
nop
mov rcx, qword [rbx + 0x20]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14002f59d
lea rcx, [0x140030d60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rax
jmp 0x14002f62c
mov rsi, qword [rdi]
movups xmm0, xmmword [rdi + 8]
movups xmmword [rbp - 0x61], xmm0
lea rax, [rsp + 0x20]
mov qword [rbp - 0x79], rax
mov ecx, dword [0x1406782b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14002f5c8
mov rdx, qword [rax + 8]
jmp 0x14002f5ca
xor edx, edx
mov r8d, reloc.Cabinet.dll_CreateDecompressor
call fcn.140030d80
mov qword [rbp - 0x69], 0
mov qword [rax + 8], rsi
movups xmm0, xmmword [rbp - 0x61]
movups xmmword [rax + 0x10], xmm0
lea rcx, [0x140030ea0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x71], 0
lea rcx, [rbp - 0x79]
call fcn.140030be0
nop
mov rax, qword [rbx + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14002f62c
xor edx, edx
mov rcx, rax
call qword [rax]
nop
lea rcx, [rbp + 0xf]
mov rax, qword [rbp + 0x1f]
call qword [rax]
nop
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1402bf7f0
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400303b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x1406782c0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030402
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x140030535
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400303f0
mov qword [rsp + 0x58], rdi
mov rdx, rdi
mov ecx, 0x80
call fcn.140023ae0
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rcx, qword [rsi + 0x28]
xor r15d, r15d
mov qword [rax + 0x20], r15
lea rax, [fcn.140030980]
mov qword [rbx + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x30], r15d
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 0x38], xmm0
mov qword [rbx + 0x48], r15
mov qword [rbx + 0x50], r15
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x58], xmm0
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x70], rcx
mov dword [rbx + 0x7c], r15d
test rcx, rcx
je 0x140030496
mov rax, qword [rcx + 0x10]
lock inc dword [rax + 0x30]
mov rbx, qword [rsp + 0x60]
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.140026770
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
test al, al
je 0x1400305a5
mov rax, qword [r14]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1406782c0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov ecx, dword [0x1406782c0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rsi, qword [rsi + 0x30]
mov qword [rsp + 0x20], rsi
mov rdi, qword [r14]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.140030980
nop
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140030565
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x14003054e
mov qword [rax + 0x20], rcx
jmp 0x140030552
cmp qword [rax + 8], 0
je 0x140030402
mov rdx, rdi
mov rcx, rdi
call fcn.14002fa20
nop
jmp 0x1400305af
mov qword [rdi + 0x78], rcx
mov rax, qword [rdi + 0x70]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x68], r15
mov qword [rdi + 0x70], r15
mov rbx, qword [rdi + 0x78]
test rbx, rbx
setne al
mov byte [rdi + 0x60], al
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140030593
lock inc dword [rsi + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140024a90
nop
mov rdx, qword [rsp + 0x50]
mov ecx, dword [0x1406782c0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rcx, [rsp + 0x58]
call fcn.140030c60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140030be0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x140030bfc
mov qword [rcx + 0x10], 0
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x140030c53
mov ecx, dword [0x1406782b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030c43
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140030c43
cmp qword [rcx + 0x10], 0
jne 0x140030c43
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
mov qword [rcx + 0x10], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.1402bfe3c
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140030f60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rbx, rcx
mov rax, qword [rcx + 0x20]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140030fa1
lea rax, [0x1400313b0]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rdx
lea rdx, [rbp - 0x59]
call r8
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
mov rax, qword [rdx]
mov qword [rbp - 0x39], rax
mov rax, qword [rdx + 8]
mov qword [rbp - 0x31], rax
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rdx + 0x20]
movups xmmword [rbp - 0x19], xmm1
xor edi, edi
mov qword [rdx + 0x20], rdi
mov qword [rdx + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rdx + 0x10], dil
mov eax, dword [rdx + 0x30]
mov dword [rbp - 9], eax
mov rax, qword [rdx + 0x38]
mov qword [rbp - 1], rax
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rbp + 7], xmm0
mov rax, qword [rdx + 0x50]
mov qword [rbp + 0x17], rax
mov rax, qword [rdx + 0x58]
mov qword [rbp + 0x1f], rax
mov qword [rdx + 0x50], rdi
mov qword [rdx + 0x58], rdi
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rbp + 0x27], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rbp + 0x37], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x7f], rax
lea rax, [rbp + 0x67]
mov qword [rbp - 0x59], rax
mov ecx, dword [0x1406782b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140031037
mov rdx, qword [rax + 8]
jmp 0x14003103a
mov rdx, rdi
mov r8d, 0x88
call fcn.140030d80
mov rdx, rax
mov qword [rbp - 0x49], rdi
mov rcx, qword [rbp - 0x39]
mov qword [rax + 8], rcx
mov rcx, qword [rbp - 0x31]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rax + 0x18], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rax + 0x28], xmm1
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
mov eax, dword [rbp - 9]
mov dword [rdx + 0x38], eax
mov rax, qword [rbp - 1]
mov qword [rdx + 0x40], rax
movups xmm0, xmmword [rbp + 7]
movups xmmword [rdx + 0x48], xmm0
mov qword [rdx + 0x58], rdi
mov qword [rdx + 0x60], rdi
mov rax, qword [rbp + 0x17]
mov qword [rdx + 0x58], rax
mov rax, qword [rbp + 0x1f]
mov qword [rdx + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rdx + 0x68], xmm0
mov rax, qword [rbp + 0x37]
mov qword [rdx + 0x78], rax
lea rax, [0x1400317d0]
mov qword [rdx], rax
mov qword [rbp + 0x77], rdx
mov qword [rbp - 0x51], rdi
lea rcx, [rbp - 0x59]
call fcn.140031320
nop
lea rcx, [rbp - 0x39]
call fcn.14002e010
nop
mov rax, qword [rbx + 0x20]
lea rdx, [rbp + 0x77]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x140031110
xor edx, edx
mov rcx, rax
call qword [rax]
nop
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret