joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d99a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000d99e5
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rsi, rsi
je 0x1000d99f5
mov qword [rsi + 0x228], 0
mov qword [rbx + 0x228], rdi
mov qword [rdi + 0xd8], rbx
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1000d9a30
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x1000d9a30
mov r8d, 0x10
mov rcx, rdi
cmp rax, r8
cmovl r8, rax
shl r8, 3
call sub.MSVCR100.dll_memcpy
jmp 0x1000d9a40
xor edx, edx
mov r8d, 0x80
mov rcx, rdi
call sub.MSVCR100.dll_memset
mov eax, dword [rdi + 0xe0]
mov ecx, eax
xor ecx, 1
and ecx, eax
mov eax, ecx
xor eax, 2
and eax, ecx
mov rcx, rdi
mov dword [rdi + 0xe0], eax
mov edx, dword [rbx + 0x7c]
call fcn.100089910
mov rdi, qword [rbx + 0x228]
mov rdx, qword [rbx + 0x1d8]
cmp qword [rdi + 0x108], rdx
je 0x1000d9aca
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x1000d9abc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x1004df358]
lea rdx, [0x1004df350]
mov dword [rsp + 0x28], eax
lea rax, [0x1004df390]
mov r9d, 0xdca
mov ecx, 1
mov qword [rsp + 0x20], rax
call fcn.1001522c0
mov rax, qword [rbx + 0x1d8]
mov qword [rdi + 0x108], rax
test rsi, rsi
je 0x1000d9ae2
mov eax, dword [rsi + 0x2e0]
xor eax, dword [rbx + 0x2e0]
test eax, 0x8001f
je 0x1000d9b03
call qword [sym.imp.MSVCR100.dll__clearfp]
test al, 0x10
je 0x1000d9af2
call qword [sym.imp.MSVCR100.dll__fpreset]
mov ecx, dword [rbx + 0x2e0]
mov edx, 0x8001f
call qword [sym.imp.MSVCR100.dll__controlfp]
mov rcx, qword [rbx + 0x238]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SwitchToFiber]
Function at 0x1000d9c90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov r14, rcx
mov esi, 1
mov dword [rsp + 0x30], esi
call fcn.100068a00
mov rdi, rax
mov rdx, qword gs:[0x30]
lea rbx, [rdx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d9ce5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000d9cf6
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000d9d2e
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d9d27
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rdi, qword [rax + 0x3f8]
mov qword [rsp + 0xb8], rdi
lea rcx, [0x100061000]
mov qword [rax + 0x3f8], rcx
mov qword [rsp + 0xc0], rdi
xor edx, edx
lea rax, [0x100062030]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x68]
call fcn.10005b410
nop
mov rcx, qword [r14 + 0x1020]
test rcx, rcx
je 0x1000d9dd6
cmp qword [rcx + 0x218], 0
je 0x1000d9dd6
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, qword [rcx + 0x2f8]
cmp rax, r8
ja 0x1000d9dcb
mov rcx, qword [rcx + 0x218]
mov rdx, qword [rcx + 0xab0]
mov rcx, r8
sub rcx, rax
cmp rcx, rdx
jbe 0x1000d9dc5
movabs rax, 0x7fffffffffffffff
cmp r8, rax
jne 0x1000d9dcb
xor eax, eax
mov esi, eax
jmp 0x1000d9dcd
xor eax, eax
test esi, esi
sete al
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x68]
call fcn.10005b4f0
nop
jmp 0x1000d9deb
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d9e17
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000d9e28
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000d9e60
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d9e59
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rax, qword [rsi + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000d9e6f
call fcn.1000618f0
nop
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d9e9a
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000d9eab
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000d9ee2
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d9edb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov qword [rax + 0x3f8], rdi
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
Function at 0x1000da490
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rbx, qword [rcx + 0x218]
xor r15d, r15d
mov r14d, edx
mov rdi, rcx
test rbx, rbx
je 0x1000da5ce
cmp qword [rbx + 0x6ed8], r15
je 0x1000da5ce
call fcn.10011b7d0
test eax, eax
je 0x1000da4ef
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rbp + 0x40]
jmp 0x1000da4f7
mov r11, qword [0x7ffe0008]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rbx + 0x6ed8]
xor eax, eax
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov dword [rbp + 8], r15d
mov qword [rbp + 0x10], r15
cmp qword [rbx + 0x40], rax
je 0x1000da5a4
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0xa8
call sub.MSVCR100.dll_memset
call fcn.10006b740
mov edx, 0x10
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x78]
lea ecx, [rdx - 0xf]
call rax
mov ecx, dword [rbp - 0x80]
movzx r11d, ax
mov eax, ecx
shl eax, 0xf
mov dword [rbp + 8], r11d
not eax
add ecx, eax
mov eax, ecx
shr eax, 0xa
xor eax, ecx
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 6
xor ecx, eax
mov eax, ecx
shl eax, 0xb
not eax
add ecx, eax
mov eax, ecx
shr eax, 0x10
xor ecx, eax
mov dword [rbp - 0x80], ecx
call fcn.10006ec80
test eax, eax
je 0x1000da5bc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1000f74a0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1000f5f90
mov ecx, 3
mov eax, 1
lock cmpxchg dword [rdi + 0x2a0], ecx
call fcn.100068a00
mov rsi, qword gs:[0x30]
mov rcx, rax
mov rbx, rax
add rsi, rax
call fcn.10006c530
test eax, eax
jne 0x1000da60b
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov edx, r14d
mov rcx, rsi
call fcn.1000646f0
mov ebx, eax
test eax, eax
jne 0x1000da624
mov ebx, dword [rdi + 0x384]
jmp 0x1000da645
mov rcx, rdi
call fcn.1000653e0
test eax, eax
je 0x1000da645
call fcn.10006af90
mov rcx, rsi
mov edx, eax
call fcn.1000646f0
mov ebx, eax
test eax, eax
jne 0x1000da630
lea r11, [rsp + 0x120]
mov qword [rdi + 0x290], r15
mov qword [rdi + 0x298], r15
mov rsi, qword [r11 + 0x30]
mov dword [rdi + 0x2a0], 1
mov rdi, qword [r11 + 0x38]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1000db3d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x120
mov eax, 2
mov dword [rcx + 0x384], edx
xor r12d, r12d
xchg dword [rcx + 0x2a0], eax
mov rdi, qword [rcx + 0x210]
mov r15, r8
mov rbx, rcx
test rdi, rdi
je 0x1000db439
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rdi + 0x90], edx
je 0x1000db424
lea rcx, [rdi + 0x90]
call fcn.100057ac0
add dword [rdi + 0x100], 2
mov qword [rdi + 0xc0], r12
mov dword [rdi + 0x90], r12d
call fcn.10006bc70
test eax, eax
je 0x1000db44c
mov rax, qword [r15]
mov qword [rbx + 0xb8], rax
mov rdi, qword [rbx + 0x218]
test rdi, rdi
je 0x1000db618
cmp qword [rdi + 0x6ed8], r12
je 0x1000db618
mov eax, dword [rbx + 0x2d8]
mov qword [rsp + 0x150], rbp
mov qword [rsp + 0x160], r14
test al, 4
je 0x1000db48c
bt eax, 0xc
mov eax, r12d
jae 0x1000db491
mov eax, 1
mov ecx, 0x12
test eax, eax
mov r14d, 5
cmovne r14d, ecx
call fcn.100068a00
mov rsi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rsi, rax
call fcn.10006c530
test eax, eax
jne 0x1000db4cd
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rsi, rsi
je 0x1000db4de
mov rcx, qword [rsi + 0xd8]
test rcx, rcx
jne 0x1000db515
call fcn.100063d30
call fcn.100068a00
mov rsi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rsi, rax
call fcn.10006c530
test eax, eax
jne 0x1000db50e
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rcx, qword [rsi + 0xd8]
mov rbp, qword [rsp + 0x150]
xor eax, eax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x20], rax
mov rax, qword [r15]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rdi + 0x6ed8]
mov dword [rsp + 0x38], r14d
mov r14, qword [rsp + 0x160]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x108], r12d
mov qword [rsp + 0x110], r12
cmp qword [rbx + 0x40], r12
je 0x1000db5ee
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0xa8
call sub.MSVCR100.dll_memset
call fcn.10006b740
mov edx, 0x10
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x88]
lea ecx, [rdx - 0xf]
call rax
mov ecx, dword [rsp + 0x80]
movzx r11d, ax
mov eax, ecx
shl eax, 0xf
mov dword [rsp + 0x108], r11d
not eax
add ecx, eax
mov eax, ecx
shr eax, 0xa
xor eax, ecx
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 6
xor ecx, eax
mov eax, ecx
shl eax, 0xb
not eax
add ecx, eax
mov eax, ecx
shr eax, 0x10
xor ecx, eax
mov dword [rsp + 0x80], ecx
call fcn.10006ec80
test eax, eax
je 0x1000db606
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1000f74a0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1000f5f90
add rsp, 0x120
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000e0270
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov rdi, rcx
lea rsi, [rcx + 0x1b8]
mov qword [rsp + 0x38], rsi
call fcn.10011b7d0
test eax, eax
je 0x1000e02c1
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0xd0]
jmp 0x1000e02ce
mov rbx, qword [0x7ffe0008]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsi]
cmp rbx, rcx
jbe 0x1000e03ef
mov rax, rbx
sub rax, rcx
cmp rax, qword [0x1002465c8]
jb 0x1000e03ef
mov rcx, rdi
call fcn.1000e1490
lock inc dword [rdi + 0x14]
or dword [rdi + 0x14c], 6
xor edx, edx
lea rax, [fcn.100062040]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x70]
call fcn.10005b410
nop
call fcn.1000cf2c0
nop
lea rcx, [rsp + 0x70]
call fcn.10005b4f0
nop
jmp 0x1000e034a
call fcn.100068a00
mov r14, rax
mov rsi, qword gs:[0x30]
add rsi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e0376
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rsi, rsi
je 0x1000e0387
mov rax, qword [rsi + 0xd8]
test rax, rax
jne 0x1000e03bf
call fcn.100063d30
call fcn.100068a00
mov r14, rax
mov rsi, qword gs:[0x30]
add rsi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e03b8
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rax, qword [rsi + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000e03cd
call fcn.1000618f0
mov eax, dword [rdi + 0x14c]
mov ecx, eax
xor ecx, 4
and ecx, eax
mov eax, ecx
xor eax, 2
and eax, ecx
mov dword [rdi + 0x14c], eax
mov rax, qword [rsp + 0x38]
mov qword [rax], rbx
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x1000e1490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rbx + 0x10]
jbe 0x1000e14f2
mov ecx, dword [rbx + 0x160]
mov qword [rsp + 0x60], rdi
xor edi, edi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x400069
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
call fcn.100058870
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x100282c54]
add edx, eax
cmp edx, eax
cmovb edx, edi
mov rdi, qword [rsp + 0x60]
mov dword [rbx + 0x10], edx
add rsp, 0x50
pop rbx
ret
Function at 0x1000e2180
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x118]
mov r14, r8
mov r15d, edx
mov rbp, qword [rax + 0x560]
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000e21da
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000e21eb
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x1000e2222
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000e221b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rax, qword [rax + 0x210]
mov edx, dword [rbx + 0x150]
mov rcx, qword [rax + 0x1a0]
cmp r15d, edx
jne 0x1000e227d
cmp rcx, qword [rbx + 0x158]
jne 0x1000e227d
mov dword [r14], 0
cmp rbp, qword [rbx + 0x168]
jbe 0x1000e22a7
mov edx, dword [rbx + 0x160]
lea rax, [rbp + 0x20]
mov qword [rbx + 0x168], rax
add edx, dword [0x100282c58]
mov eax, 0x3e8
cmp edx, eax
cmovb eax, edx
mov dword [rbx + 0x160], eax
jmp 0x1000e22a7
lea rax, [rbp + 0x20]
mov qword [rbx + 0x168], rax
mov eax, dword [0x100282c58]
mov dword [rbx + 0x160], eax
cmp r15d, edx
je 0x1000e22a0
mov dword [r14], 1
mov qword [rbx + 0x158], rcx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1000e2c80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov eax, dword [rcx + 0x548]
mov r13d, dword [rcx + 0x54c]
mov r14, rcx
mov edi, dword [r14 + 0x558]
mov esi, dword [r14 + 0x550]
neg eax
sbb ecx, ecx
mov r15, r8
mov rbp, rdx
and ecx, 3
mov dword [rsp + 0x50], ecx
lea rcx, [r14 - 0x40]
call fcn.1000e3de0
mov rdx, qword [r14]
mov rcx, r14
mov ebx, eax
call qword [rdx + 0x20]
mov r9d, r13d
mov rcx, rax
mov eax, 0x40
mov r8d, esi
mov word [rsp + 0x40], ax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.100086200
mov rdi, rax
test rax, rax
je 0x1000e2e9b
mov edx, dword [rsp + 0x50]
lea rcx, [r14 + 0x40]
dec edx
movsxd r8, edx
lea rdx, [r8 + r8*4]
shl rdx, 6
add rcx, rdx
mov rdx, rbp
call fcn.100092f60
test eax, eax
je 0x1000e2d8a
mov rax, qword [r14]
mov ebx, dword [r14 + 0x558]
mov rcx, r14
call qword [rax + 0x20]
mov r9d, dword [rsp + 0x50]
xor esi, esi
mov dword [rsp + 0x30], esi
mov r8, rbp
mov rdx, rdi
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r13d
call fcn.100086260
mov edi, esi
mov dword [rsp + 0x50], esi
call fcn.100072da0
test eax, eax
je 0x1000e2e9b
lea rcx, [rsp + 0x60]
call fcn.100072d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e2dcc
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e2ddd
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
jne 0x1000e2e14
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e2e0d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rdx, qword [rbx + 0xd8]
lea rcx, [rsp + 0x60]
call fcn.100072dc0
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.100072dd0
lea rcx, [rsp + 0x60]
mov edx, 0x2000
call fcn.100072de0
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.100072df0
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.100072e00
lea rcx, [r14 - 0x40]
call fcn.1000e3de0
lea rcx, [rsp + 0x60]
mov edx, eax
call fcn.100072e10
lea rdx, [r14 - 0x40]
lea rcx, [rsp + 0x60]
call fcn.100072e20
mov r11, qword [r14 - 0x40]
lea rcx, [r14 - 0x40]
call qword [r11 + 0x18]
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.100072e30
lea rcx, [rsp + 0x60]
call fcn.100072e80
test r15, r15
je 0x1000e2ea7
mov eax, dword [rsp + 0x50]
mov dword [r15], eax
mov rax, rdi
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10005f420
mov rbx, qword [rsp + 0x348]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000e36e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x2d8
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r12d, dword [rcx + 0x58c]
mov r14d, r9d
mov rbp, r8
mov r15, rdx
mov rsi, rcx
call fcn.100073010
test eax, eax
je 0x1000e382f
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x2d0], rdi
call fcn.100072fa0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e3760
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e3771
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
jne 0x1000e37a8
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e37a1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rdx, qword [rbx + 0xd8]
lea rcx, [rsp + 0x40]
call fcn.100073030
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.100073040
lea rcx, [rsp + 0x40]
mov edx, 0x2000
call fcn.100073050
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.100073060
lea rcx, [rsp + 0x40]
mov edx, r14d
call fcn.100073070
mov edx, dword [rsp + 0x330]
lea rcx, [rsp + 0x40]
call fcn.100073080
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.100073090
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + 0x18]
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.1000730a0
lea rcx, [rsp + 0x40]
call fcn.1000730f0
mov rdi, qword [rsp + 0x2d0]
mov rax, qword [rsi + 0x40]
mov ebx, dword [rsi + 0x598]
lea rcx, [rsi + 0x40]
call qword [rax + 0x20]
mov r9d, r14d
mov r8, rbp
mov rcx, rax
mov eax, dword [rsp + 0x338]
mov rdx, r15
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
call fcn.100086260
sub rsi, 0xffffffffffffff80
lea eax, [r14 - 1]
cdqe
mov rdx, rbp
lea rcx, [rax + rax*4]
shl rcx, 6
add rcx, rsi
call fcn.100093010
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x2d8
pop r15
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret

Function at 0x1000e3de0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x594]
cmp eax, 0x40
jne 0x1000e3e8e
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e3e28
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e3e39
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000e3e70
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e3e69
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x1f0]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 0x190]
mov eax, dword [rcx + 0x1f0]
add rsp, 0x28
ret
Function at 0x1000e8190
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000e81d4
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000e81e5
mov rdx, qword [rdi + 0xd8]
test rdx, rdx
jne 0x1000e821c
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8215
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rdx, qword [rdi + 0xd8]
mov qword [rbx + 8], rdx
test ebp, ebp
je 0x1000e8234
test byte [rdx + 0x2d8], 4
jne 0x1000e8234
mov eax, 1
jmp 0x1000e8236
xor eax, eax
mov dword [rbx], eax
test eax, eax
je 0x1000e824d
mov rcx, qword [rdx + 0x218]
mov qword [rbx + 0x10], rcx
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000e83f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ebp, ecx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8434
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov qword [rbx + rbp*8], rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rax + 0x38]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1000e8470
Capabilities:
Get thread local storage value

Disassembly:
movsxd rax, r8d
lea r8, [rcx + 0x2a8]
shl rax, 4
add r8, rax
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
mov rax, qword [r8 + 8]
mov qword [rax], rdx
mov qword [r8 + 8], rdx
mov qword [rdx], r8
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e84b4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e84c5
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000e84fc
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e84f5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov r8d, esi
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x100065720
Function at 0x1000e8530
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x10006576c
mov rax, qword [rdx]
mov qword [rax + 8], rcx
mov qword [rcx], rax
xor eax, eax
mov qword [rdx + 8], rax
mov qword [rdx], rax
repz ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8574
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e8585
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000e85bc
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e85b5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov r8d, esi
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x100065750