joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9df0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400b9e4d
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400b9e45
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400b9e40
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400b9e40
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400b9e9a
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400b9e89
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400b9e89
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400b9ea5
inc ecx
inc rax
cmp rax, 6
jl 0x1400b9e77
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret

Function at 0x1400b9f70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x1400b9fcd
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400b9fc5
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400b9fc0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400b9fc0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400ba01a
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba009
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba009
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400ba025
inc ecx
inc rax
cmp rax, 6
jl 0x1400b9ff7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x38]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1400ba0f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba117
add rcx, 8
call fcn.140096920
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba164
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba153
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba153
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400ba16f
inc ecx
inc rax
cmp rax, 6
jl 0x1400ba141
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400ba1a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba1d3
add rcx, 0x60
cmp qword [rcx + 0x20], 0
je 0x1400ba1cb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba223
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba212
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba212
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400ba22e
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba200
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x98]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ba260
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba293
add rcx, 0x58
cmp qword [rcx + 0x20], 0
je 0x1400ba28b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba2e3
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba2d2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba2d2
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400ba2ee
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba2c0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba320
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ba353
add rcx, 0x68
cmp qword [rcx + 0x20], 0
je 0x1400ba34b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba3a3
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba392
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba392
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x1400ba3ae
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba380
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ba3e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400ba461
lea rcx, [rdi + 0x1c8]
cmp qword [rcx + 0x20], 0
je 0x1400ba418
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rdi + 0x1b0]
test rbx, rbx
je 0x1400ba450
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400ba450
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400ba450
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
lea rcx, [rdi + 0x48]
call fcn.1400984e0
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400ba4ab
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba49a
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba49a
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400ba4c0
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba488
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x200]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x1400ba4a3
Function at 0x1400ba4e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1400ba56d
lea rcx, [rsi + 0x70]
cmp qword [rcx + 0x20], 0
je 0x1400ba515
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rsi + 0x68]
mov edi, 0xffffffff
test rbx, rbx
je 0x1400ba54c
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400ba54c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400ba54c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1400ba565
lock xadd dword [rcx + 0xc], edi
cmp edi, 1
jne 0x1400ba565
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov qword [rbp + 0x10], 0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400ba5b7
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba5a6
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba5a6
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400ba5cc
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba594
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x1400ba5af

Function at 0x1400ba5e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1400ba640
lea rcx, [rbx + 0x1b0]
cmp qword [rcx + 0x20], 0
je 0x1400ba60e
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x150]
call fcn.140096920
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400ba638
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1400ba638
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400ba68a
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400ba679
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ba679
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400ba695
inc ecx
inc rax
cmp rax, 2
jl 0x1400ba667
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1e8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba960
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov r12d, r9d
mov rcx, r8
mov r13, r8
call fcn.1400ba6c0
mov rax, qword [r14 + 8]
lock inc dword [rax + 0x30]
mov rdi, qword [rsp + 0xc0]
xor ebp, ebp
mov rsi, qword [rsp + 0xc8]
test rdi, rdi
je 0x1400ba9c9
mov eax, ebp
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x1400ba9c9
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, 0x3e3
mov rdx, rsi
call fcn.1400b5030
mov r8d, dword [rsp + 0xa8]
mov r15d, 1
mov edx, dword [rsp + 0xa0]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov ecx, r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400baa8d
call fcn.1400ae900
mov rdi, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rcx, r13
mov ebx, eax
call fcn.1400ba6c0
mov qword [r13], 0xffffffffffffffff
lea r8d, [r15 + 1]
mov r14, qword [r14 + 8]
mov r9, rsi
mov dword [rsi + 0x30], r15d
xor edx, edx
mov qword [rsi], rdi
mov dword [rsi + 0x10], ebx
mov dword [rsi + 0x14], ebp
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1400bab5c
lea rcx, [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsi + 0x20], rbp
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x1400baa6c
mov qword [rax + 0x20], rsi
jmp 0x1400baa73
mov qword [r14 + 0x90], rsi
mov qword [r14 + 0x98], rsi
lea rcx, [r14 + 0x60]
xchg dword [r14 + 0x58], r15d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400bab5c
cmp r12d, 0x17
jne 0x1400baabd
lea r9, [rsp + 0xc0]
mov dword [rsp + 0xc0], ebp
lea edx, [r12 + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [r12 + 4]
mov rcx, rbx
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov rcx, r13
call fcn.1400ba6c0
mov r15, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov r8, qword [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x38], rsi
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rcx, r15
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov qword [r13], rbx
mov dword [rsp + 0x80], ebp
call sub.WSOCK32.dll_AcceptEx
mov ebx, eax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
test ebx, ebx
jne 0x1400bab36
cmp eax, 0x3e5
je 0x1400bab36
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call fcn.1400b5030
jmp 0x1400bab5c
test rdi, rdi
je 0x1400bab50
lock xadd dword [rdi], ebp
cmp ebp, 1
jne 0x1400bab50
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CancelIoEx]
mov rcx, qword [r14 + 8]
mov rdx, rsi
call fcn.1400b5320
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bba30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1400bba79
call fcn.1400bfb30
mov dword [rsp + 0x20], edi
lea rax, [0x14013e5e8]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x1400bbb8d
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
lea rcx, [rsp + 0x98]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400a9370
test rax, rax
je 0x1400bbb49
nop dword [rax]
nop word [rax + rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400a9370
test rax, rax
jne 0x1400bbb20
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140143f10]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x40]
mov esi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400bbb73
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add rbx, 8
sub rsi, 1
jne 0x1400bbb65
lea rcx, [rsp + 0x98]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
mov rax, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400befc0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400bf039
mov dword [rdi], 0
cmp esi, 0x17
jne 0x1400bf026
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.1400ae900
mov rbx, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rsi, qword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
movups xmm0, xmmword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rdi
ret
Function at 0x1400bf750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
test rax, rax
jne 0x1400bf7b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.1400ae900
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400bf8b6
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x1400bf800
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.1400ae900
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400bf8c8
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x1400c2710]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x1400bf875
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x1400bf854
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400bf863
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.1400ae900
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400bf8a4
test rdi, rdi
je 0x1400bf891
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.1400a99a0
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.1400a99a0
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.1400a99a0
int3
Function at 0x1400bfe70
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbx
push r13
push r15
sub rsp, 0x2d0
mov rax, qword [0x14013e880]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, qword [rsp + 0x320]
mov rax, r8
mov qword [rsp + 0x68], rax
mov r10, r9
mov qword [rsp + 0x58], r9
movzx r13d, dl
mov r15, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400bfed5
mov dword [rsp + 0x58], 0x2719
call fcn.1400ae900
mov qword [rsp + 0x60], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
jmp 0x1400c009b
cmp byte [rsp + 0x318], 0
mov qword [rsp + 0x2c8], rsi
je 0x1400bfef8
test r13b, 0x10
je 0x1400bfef8
xor esi, esi
mov dword [rbx], esi
xor eax, eax
jmp 0x1400c0093
mov qword [rsp + 0x2f8], rbp
xor esi, esi
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2b8], r12
mov qword [rsp + 0x2b0], r14
lea r14, [rbx + 8]
nop
mov ecx, dword [rsp + 0x310]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov r8d, r10d
mov qword [rsp + 0x28], rsi
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, r15
mov dword [rsp + 0x40], esi
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebp, eax
call fcn.1400ae900
mov rdi, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbx], xmm0
mov ecx, dword [rbx]
cmp ecx, 0x40
jne 0x1400bff97
mov dword [rsp + 0x80], 0x2746
call fcn.1400ae900
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rsp + 0x80]
jmp 0x1400bffb6
cmp ecx, 0x4d2
jne 0x1400bffbd
mov dword [rsp + 0x48], 0x274d
call fcn.1400ae900
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x48]
lea r14, [rbx + 8]
movups xmmword [rbx], xmm0
test ebp, ebp
jne 0x1400bffd0
movsxd rax, dword [rsp + 0x40]
mov dword [rbx], esi
test eax, eax
jns 0x1400c0073
test r13b, 1
jne 0x1400c0071
call fcn.1400ae900
mov rcx, qword [r14]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x1400bfff4
cmp dword [rbx], 0x2733
je 0x1400c000e
call fcn.1400ae900
mov rcx, qword [r14]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x1400c0071
cmp dword [rbx], 0x4d5
jne 0x1400c0071
lea ecx, [r15 + 1]
mov qword [rsp + 0x98], r15
xor r9d, r9d
mov dword [rsp + 0x90], 1
lea r8, [rsp + 0x90]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.WSOCK32.dll_select]
test eax, eax
js 0x1400c0052
mov rax, qword [rsp + 0x68]
mov r10, qword [rsp + 0x58]
mov dword [rbx], esi
jmp 0x1400bff20
call fcn.1400ae900
mov rdi, rax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rdi
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm0
xor eax, eax
mov r12, qword [rsp + 0x2b8]
mov rdi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140104220
add rsp, 0x2d0
pop r15
pop r13
pop rbx
ret
Function at 0x1400c27d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1400c2801
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1400c281f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400c2869
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x1400c28e1
mov rcx, rbp
call fcn.1400a27d0
cmp rbx, 0xfff
jbe 0x1400c28c1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400c2902
cmp rbx, rax
ja 0x1400c2890
test rdi, rdi
je 0x1400c28e1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x1400c28e4