Function at 0x6bf6c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
push esi
push edi
push dword [0x884c50]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
mov dword [esp + 0x18], esi
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bf70a
mov dword [ecx], str.LtProcessCollColl
mov dword [ecx + 0xc], str.StInit
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
lea eax, [ecx + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
call edx
push dword [0x884adc]
mov dword [esp + 0x2c], eax
call edi
cmp dword [eax + 8], 0x4000
mov edi, dword [eax + 0xc]
mov dword [esp + 0x2c], edi
lea ecx, [edi + 0x4000]
jl 0x6bf761
cmp ecx, dword [eax + 0x10]
ja 0x6bf761
mov dword [eax + 0xc], ecx
jmp 0x6bf773
push 0x4000
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bf794
mov dword [ecx], str.Stquery
rdtsc
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
push edi
push dword [esp + 0x2c]
push dword [esp + 0x24]
push dword [ebp + 8]
call fcn.006be650
add esp, 0x10
mov dword [esp + 0x20], eax
test eax, eax
jns 0x6bf809
push dword [0x884adc]
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
cmp dword [eax + 8], 0x4000
jl 0x6bf7db
lea ecx, [edi + 0x4000]
cmp ecx, dword [eax + 0xc]
jne 0x6bf7db
cmp dword [eax + 0x14], edi
je 0x6bf7db
mov dword [eax + 0xc], edi
jmp 0x6bf7e8
push 0x4000
push edi
mov ecx, eax
call fcn.0046a590
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bfa63
mov dword [ecx], 0x77f784
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
jmp 0x6bfa5a
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bf82a
mov dword [ecx], str.Stprocess
rdtsc
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x6bf851
push dword [ebp + 0x18]
push edi
push dword [esp + 0x30]
push dword [esp + 0x28]
push eax
push dword [esp + 0x28]
call fcn.006da710
add esp, 0x18
jmp 0x6bf9ea
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bf872
mov dword [ecx], str.Stshrink
rdtsc
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
push dword [0x884adc]
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
mov edx, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax*4 + 0x83]
mov eax, dword [edx + 0xc]
and ecx, 0xffffff80
mov dword [esp + 0x1c], eax
add eax, ecx
mov dword [esp + 0x24], ecx
cmp ecx, dword [edx + 8]
jg 0x6bf8ab
cmp eax, dword [edx + 0x10]
ja 0x6bf8ab
mov dword [edx + 0xc], eax
jmp 0x6bf8b7
push ecx
mov ecx, edx
call fcn.0046a3c0
mov dword [esp + 0x1c], eax
xor ecx, ecx
cmp dword [esp + 0x20], ecx
jl 0x6bf8e5
mov esi, dword [esp + 0x1c]
lea edx, [edi + 4]
mov edi, dword [esp + 0x20]
nop word [eax + eax]
mov eax, dword [edx]
lea edx, [edx + 8]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jle 0x6bf8d0
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x38], 0
mov eax, dword [ecx + 4]
movups xmm0, xmmword [ecx + 0x50]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0xc]
movups xmm3, xmmword [ecx + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [ecx + 0x10]
movups xmm2, xmmword [ecx + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [ecx + 0x60]
movups xmm1, xmmword [ecx + 0x40]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 8]
movaps xmmword [esp + 0x80], xmm0
movups xmm0, xmmword [ecx + 0x70]
mov ecx, dword [esi + 4]
movaps xmmword [esp + 0x50], xmm3
movaps xmmword [esp + 0x60], xmm2
movaps xmmword [esp + 0x70], xmm1
movups xmmword [esp + 0xa0], xmm0
mov dword [esp + 0x30], eax
cmp ecx, dword [esi + 0xc]
jae 0x6bf96a
mov dword [ecx], str.Stprocess
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
push dword [ebp + 0x18]
lea eax, [esp + 0x34]
push dword [esp + 0x20]
push dword [esp + 0x30]
push eax
push dword [esp + 0x24]
call fcn.006d9470
mov ecx, dword [esi + 4]
add esp, 0x14
cmp ecx, dword [esi + 0xc]
jae 0x6bf9a7
mov dword [ecx], str.Stdealloc
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov eax, dword [esp + 0x24]
lea ecx, [eax + 0xf]
and ecx, 0xfffffff0
cmp eax, dword [edx + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
jg 0x6bf9e1
add ecx, eax
cmp ecx, dword [edx + 0xc]
jne 0x6bf9dd
cmp dword [edx + 0x14], eax
je 0x6bf9dd
mov dword [edx + 0xc], eax
jmp 0x6bf9ea
mov ecx, dword [esp + 0x14]
push ecx
push eax
mov ecx, edx
call fcn.0046a590
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bfa0b
mov dword [ecx], str.Stdealloc
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 8], 0x4000
jl 0x6bfa35
lea ecx, [edi + 0x4000]
cmp ecx, dword [eax + 0xc]
jne 0x6bfa35
cmp dword [eax + 0x14], edi
je 0x6bfa35
mov dword [eax + 0xc], edi
jmp 0x6bfa42
push 0x4000
push edi
mov ecx, eax
call fcn.0046a590
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6bfa63
mov dword [ecx], 0x77f784
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
pop edi
add eax, 0x10
pop esi
mov esp, ebp
pop ebp
ret