Function at 0x140011b40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x1a0
mov r14d, r9d
mov r13, r8
mov r12, rdx
mov r15, rcx
xor ebx, ebx
mov esi, ebx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp - 0x78], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp - 0x18], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp - 0x70], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp - 0x20], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp + 0x10], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp + 0x30], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp + 0x28], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.140059d40
mov qword [rbp + 8], rax
mov word [rax], bx
movzx edi, byte [rbp + 0xf0]
cmp r14d, 0xffffffff
jne 0x140011e48
mov qword [rbp - 0x28], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x30], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x80], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x38], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x40], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x48], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x50], rbx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x58], rbx
lea rbx, [0x14007a7c4]
test r13, r13
cmovne rbx, r13
mov rcx, rbx
call fcn.140059d48
mov qword [rbp - 0x58], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x58]
mov rdx, r12
lea rcx, [rbp - 8]
call fcn.14001f610
mov rdi, rax
xor r14d, r14d
mov qword [rbp - 0x60], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x60], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x68], r14
mov rcx, rbx
call fcn.140059d48
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x68]
mov rdx, r12
lea rcx, [rbp]
call fcn.14001f610
nop
movzx ecx, byte [rbp + 0xf0]
mov dword [rsp + 0x80], 0xffffffff
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x58], rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
lea r8d, [r14 - 1]
mov rcx, r15
call fcn.140014980
mov r14d, eax
mov rcx, qword [rbp]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x68]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x60]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 8]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x58]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x48]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x40]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x38]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x30]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x28]
call fcn.140059d2c
movzx edi, byte [rbp + 0xf0]
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call fcn.14001d250
test eax, eax
jne 0x14001251d
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [rbp - 0x10]
call fcn.14002d2c0
test eax, eax
jne 0x140012512
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x10]
call fcn.14001d250
test eax, eax
jne 0x1400124ef
lea r8, [rbp - 0x18]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x10]
call fcn.14002d590
test eax, eax
jne 0x1400124e5
mov rax, qword [rbp - 0x78]
mov word [rax], bx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShellComponent
mov rcx, qword [rbp + 0x20]
call fcn.14002d4d0
test eax, eax
jne 0x140011f14
mov rax, qword [rbp - 0x78]
cmp word [rax], 0
jne 0x140011f41
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.StubPath
mov rcx, qword [rbp + 0x20]
call fcn.14002d4d0
mov rax, qword [rbp - 0x78]
cmp word [rax], 0
je 0x1400124e5
mov rbx, qword [rbp - 0x18]
cmp word [rbx], 0
jne 0x140011f63
lea rcx, [0x140081cb0]
call fcn.140059d48
mov qword [rbp - 0x18], rax
mov rcx, rbx
call fcn.140059d2c
mov ecx, 2
call fcn.140059d40
mov qword [rbp + 0x38], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rcx
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp - 0x78]
call fcn.14001e010
mov rax, qword [rbp - 0x78]
mov rbx, qword [rbp + 8]
lea rcx, [0x14007a7c4]
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rbp + 8], rax
mov rcx, rbx
call fcn.140059d2c
xor r9d, r9d
lea r8, [rbp + 0x38]
mov rdx, r15
lea rcx, [rbp + 0x58]
call fcn.140018960
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x20]
lea rcx, [0x14007a7c4]
test rdx, rdx
cmovne rcx, rdx
call fcn.140059d48
mov qword [rbp - 0x20], rax
mov rcx, rbx
call fcn.140059d2c
mov rcx, qword [rbp + 0x58]
call fcn.140059d2c
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x10]
mov rdx, qword [rbp - 0x20]
mov rcx, r15
call fcn.1400185f0
mov r13d, eax
mov qword [rbp - 0x80], 0
lea r15, [0x14007a7c4]
mov rax, qword [rbp + 0xe0]
test rax, rax
cmovne r15, rax
mov rcx, r15
call fcn.140059d48
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x80]
mov rdx, r12
lea rcx, [rbp + 0x68]
call fcn.14001f610
mov rbx, rax
mov qword [rbp - 0x30], 0
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x28], 0
mov rcx, r15
call fcn.140059d48
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov rdx, r12
lea rcx, [rbp + 0x60]
call fcn.14001f610
nop
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x18]
mov r8, rbx
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.140014330
movzx ebx, al
mov rcx, qword [rbp + 0x60]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x30]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x68]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
test bl, bl
je 0x14001245e
cmp r14d, 0xffffffff
jne 0x14001235d
xor r14d, r14d
mov qword [rbp - 0x80], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 8], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 8], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp + 0x18], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp + 0x18], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x68], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x60], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x60], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x58], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x58], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x50], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x48], r14
mov rcx, r15
call fcn.140059d48
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x48]
mov rdx, r12
lea rcx, [rbp + 0x78]
call fcn.14001f610
mov rbx, rax
mov qword [rbp - 0x40], r14
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov qword [rbp - 0x38], r14
mov rcx, r15
call fcn.140059d48
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov rdx, r12
lea rcx, [rbp + 0x70]
call fcn.14001f610
nop
movzx edi, dil
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x58], r14
lea rcx, [rbp - 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
lea r8d, [r14 - 1]
mov rcx, qword [rbp + 0xd0]
call fcn.140014980
mov r14d, eax
mov rcx, qword [rbp + 0x70]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x38]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x40]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x78]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x48]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x50]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x58]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x60]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x68]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x18]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 8]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
jmp 0x140012361
movzx edi, dil
mov qword [rbp - 0x80], 0
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov rbx, qword [rbp + 0x80]
mov qword [rbp], 0
mov rcx, r15
call fcn.140059d48
mov qword [rbp], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, [rbp - 0x70]
lea r8, [rbp]
mov rdx, r12
lea rcx, [rbp + 0x88]
call fcn.14001f610
nop
mov dword [rsp + 0x80], 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x58], rbx
lea rcx, [rbp + 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, r14d
mov edx, r13d
mov r15, qword [rbp + 0xd0]
mov rcx, r15
call fcn.140014980
nop
mov rcx, qword [rbp + 0x88]
call fcn.140059d2c
nop
mov rcx, qword [rbp]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x80]
call fcn.140059d2c
jmp 0x140012465
mov r15, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x1400124dc
mov rdi, qword [rbp + 0x48]
cmp rbx, rdi
je 0x14001248c
mov rcx, qword [rbx]
call fcn.140059d2c
add rbx, 8
cmp rbx, rdi
jne 0x140012477
mov rbx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x50]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400124c4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001258a
mov rcx, rbx
call fcn.14004bd8c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x38]
call fcn.140059d2c
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
lea r8, [rbp - 0x70]
mov edx, esi
mov rcx, qword [rbp - 0x10]
call fcn.14002d2c0
test eax, eax
jne 0x140012512
movzx edi, byte [rbp + 0xf0]
xor ebx, ebx
jmp 0x140011e92
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 8]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x28]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x30]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x10]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x20]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x70]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x18]
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov eax, r14d
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14005a178
nop
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx]
mov r14, rcx
test rdi, rdi
je 0x14001269c
mov qword [rsp + 0x48], rbp
mov rbp, qword [rcx + 8]
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
cmp rdi, rbp
je 0x140012649
nop dword [rax + rax]
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140012638
mov rsi, qword [rdi + 0x10]
cmp rbx, rsi
je 0x1400125f3
mov rcx, qword [rbx]
call fcn.140059d2c
add rbx, 8
cmp rbx, rsi
jne 0x1400125e2
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140012627
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400126a4
mov rcx, r8
call fcn.14004bd8c
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov rcx, qword [rdi]
call fcn.140059d2c
add rdi, 0x20
cmp rdi, rbp
jne 0x1400125d0
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140012678
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400126a4
mov rcx, r8
call fcn.14004bd8c
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov qword [r14], r15
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r15
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
ret
call fcn.14005a178
int3