joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100116a20
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, r9
mov r15, r8
mov r12d, edx
mov rbp, rcx
xor r13d, r13d
call fcn.100068a00
mov rdi, rax
mov rax, qword gs:[0x30]
lea rbx, [rax + rdi]
mov rcx, rdi
call fcn.10006c530
test eax, eax
jne 0x100116a7f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100116a90
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100116ac8
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rax, qword gs:[0x30]
lea rdi, [rax + rbx]
mov rcx, rbx
call fcn.10006c530
test eax, eax
jne 0x100116ac1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
test dword [rax + 0x220], 0x800
jne 0x100116b9d
lea rbx, [rbp + 0x78]
mov eax, 1
xchg dword [rbx], eax
test eax, eax
jne 0x100116b9d
mov edx, 0x800
lea rcx, [rsp + 0x48]
call fcn.100057f20
nop
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], 1
mov esi, 0xa
mov rax, qword [rbp + 0x70]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x100116b36
test byte [rdi + 0xc], 1
je 0x100116b36
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test eax, eax
je 0x100116b36
mov dword [rbx], r13d
mov dword [rsp + 0x40], r13d
jmp 0x100116b79
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rbp
call fcn.100116bd0
mov esi, eax
test rdi, rdi
je 0x100116b74
test byte [rdi + 0xc], 2
je 0x100116b74
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], 0
je 0x100116b88
mov dword [rbx], r13d
mov dword [rsp + 0x40], r13d
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
not eax
and dword [rcx + 0x220], eax
mov eax, esi
jmp 0x100116ba0
mov eax, r13d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100117e70
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
xor edx, edx
test byte [rcx + 0x5e0], 0x20
mov rdi, rcx
je 0x100117f21
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100117ebd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100117ece
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100117f05
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100117efe
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov edx, dword [rax + 0x7c]
mov ecx, dword [rdi + 0x5e8]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp edx, ecx
jl 0x100117f21
mov eax, edx
cdq
idiv ecx
mov rax, qword [rdi + 0x5f0]
movsxd rcx, edx
mov rax, qword [rax + rcx*8]
add rsp, 0x20
pop rdi
ret
Function at 0x10011a640
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x594]
mov r8, rdx
mov dword [rsp + 0x30], eax
cmp eax, 0x40
jne 0x10011a713
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.100080b00
test eax, eax
jne 0x10011a70f
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10011a6a4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10011a6b5
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10011a6ec
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10011a6e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x1f0]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rax + 0x190]
mov eax, dword [rcx + 0x1f0]
add rsp, 0x28
ret
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x10011b810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
or eax, 0xffffffff
mov r10, rdx
mov r11, rcx
test rdx, rdx
je 0x10011b854
mov qword [rsp], rbx
lea rbx, [0x10002dbf0]
nop dword [rax]
movzx r9d, byte [r11]
mov r8d, eax
mov ecx, eax
xor r9, r8
shr ecx, 8
inc r11
movzx edx, r9b
mov eax, dword [rbx + rdx*4]
xor eax, ecx
dec r10
jne 0x10011b830
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x10011b860
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
je 0x10011b88e
lea r11, [0x10002dbf0]
nop
movzx r9d, byte [r10]
mov eax, ecx
inc r10
xor r9, rax
shr eax, 8
movzx edx, r9b
mov ecx, dword [r11 + rdx*4]
xor ecx, eax
dec r8d
jne 0x10011b870
mov eax, ecx
ret
Function at 0x10011c4e0
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
lea rax, [fcn.100062040]
mov qword [r11 - 0x78], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [r11 - 0x30]
call fcn.10005b410
nop
call fcn.100058d10
movzx ecx, word [rax + 0x88]
mov word [0x10022f390], cx
call fcn.100122d60
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x10011c558
mov dword [rsp + 0xa0], ebx
lea r8d, [rbx + 1]
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call fcn.10011f990
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x68]
call fcn.10005b4f0
nop
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10011c58e
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10011c59f
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10011c5d6
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10011c5cf
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x10011c5e4
call fcn.1000618f0
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x10011f850
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10011f88d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x10011f89c
cmp qword [rdi + 0xd8], 0
jne 0x10011f8bd
call fcn.100063d30
call fcn.100068a00
mov rcx, rax
mov rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10011f8bd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rbx + 0x30]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], rax
jne 0x10011f975
xor edi, edi
mov qword [rbx + 0x20], rdi
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
je 0x10011f8f8
mov rcx, rbx
call fcn.10005ad30
lea rdx, [rbx + 8]
cmp qword [rdx + 8], rdx
je 0x10011f931
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov rax, qword [rdx + 8]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rax], rcx
mov qword [rdx + 8], rdx
mov qword [rdx], rdx
mov qword [rbx + 0x18], rdi
mov dword [rbx], edi
nop word [rax + rax]
mov rcx, qword [rsp + 0x28]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x10011f975
test rcx, rcx
je 0x10011f975
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rax + 8], rdx
mov qword [rdx], rax
xor edx, edx
mov qword [rcx + 8], rdi
mov qword [rcx], rdi
call fcn.1000d5520
jmp 0x10011f940
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x10011f990
Capabilities:
Get hostname

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov edi, r8d
mov rsi, rdx
mov qword [rsp + 0x30], 0xffffffffffffffff
mov eax, dword [0x10029a8b0]
and eax, 0x20004
cmp eax, 0x20004
jne 0x10011f9ef
mov rax, qword [0x1004e2c80]
test rax, rax
je 0x10011f9ef
mov r8, rcx
mov rdx, qword [0x1004e2c80]
lea rcx, [rsp + 0x30]
call fcn.100126900
xor ebp, ebp
mov ebx, ebp
mov eax, 1
lock xadd dword [0x100296780], eax
inc eax
cmp eax, 1
je 0x10011fa5d
test byte [0x10029a8b0], 2
je 0x10011fb6f
mov rax, qword [0x1004e2860]
test rax, rax
je 0x10011fb6f
cmp qword [0x10023faa8], 0xffffffffffffffff
je 0x10011fb6f
mov qword [rsp + 0x20], rbp
mov r9, qword [0x1004e2860]
mov r8d, 0xf1000
mov rdx, qword [0x1004e2298]
mov rcx, qword [0x10023faa8]
call qword [0x10023faf0]
jmp 0x10011fb6f
call fcn.100122f70
mov dword [rsp + 0x68], 0xff
lea rdx, [rsp + 0x68]
lea rcx, [0x100296790]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x10011fac0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test byte [0x10029a8b0], 2
je 0x10011fb1b
mov rcx, qword [0x1004e2868]
test rcx, rcx
je 0x10011fb1b
mov ecx, 0xc3b4
call fcn.10011bd50
mov r8, qword [0x1004e2868]
mov edx, 0xf5000
mov rcx, qword [0x1004e22a0]
jmp 0x10011fb08
lea rcx, [0x10029a8a0]
call fcn.100121ba0
mov ebx, eax
test eax, eax
je 0x10011fb65
test byte [0x10029a8b0], 2
je 0x10011fb1b
mov rax, qword [0x1004e2870]
test rax, rax
je 0x10011fb1b
mov ecx, 0xc3b4
call fcn.10011bd50
mov r8, qword [0x1004e2870]
mov edx, 0xf7800
mov rcx, qword [0x1004e22a8]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov r9d, 0xa
call fcn.100126850
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8d, 0xc3b4
mov edx, ebx
lea ecx, [r9 + 0xa]
call fcn.100128b90
mov rcx, qword [0x10029a8a0]
test rcx, rcx
je 0x10011fb55
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x10029a8a0], rbp
mov qword [0x100296788], rbp
lock dec dword [0x100296780]
jmp 0x10011fb6f
mov edx, edi
mov rcx, rsi
call fcn.100128da0
mov eax, dword [0x10029a8b0]
and eax, 0x20002
cmp eax, 0x20002
jne 0x10011fba9
mov rax, qword [0x1004e2878]
test rax, rax
je 0x10011fba9
mov r9d, ebx
mov r8, qword [0x1004e2878]
mov edx, 0x10d000
mov rcx, qword [0x1004e22b0]
call fcn.100126850
nop
lea rcx, [rsp + 0x30]
call fcn.100126960
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x100121a30
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rcx
mov edx, 1
lea rcx, [rax - 0x40]
call fcn.100057f20
nop
mov dword [rsp + 0x38], 0x400113
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rbp
mov rbx, qword [rbx + 8]
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100121aac
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100121abd
mov rdx, qword [rdi + 0xd8]
test rdx, rdx
jne 0x100121af5
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100121aee
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rdx, qword [rsi + 0xd8]
mov rax, qword [rdx + 0x218]
mov ecx, 0x3e8
cmp rax, qword [rbx + 0x28]
cmove rcx, rbp
mov rax, qword [rbx + 0x18]
cmp rdx, rax
je 0x100121b61
xor eax, eax
lock cmpxchg qword [rbx + 0x18], rdx
je 0x100121b3a
mov rax, rcx
dec rcx
test rax, rax
jg 0x100121b12
lea r9, [rsp + 0x38]
or r8d, 0xffffffff
mov rcx, rbx
call fcn.100104580
jmp 0x100121b65
mov rax, qword [rdx + 0x218]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], 1
mov rax, qword [rdx + 0x210]
mov qword [rbx + 0x20], rax
mov qword [rdx + 0xd0], rbp
jmp 0x100121b65
inc qword [rbx + 0x30]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
not eax
and dword [rcx + 0x220], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x100123bb0
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xc0
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov dword [r11 - 0x48], 0
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x140]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x130]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x128]
mov qword [r11 - 0x70], rax
mov rax, qword [rsp + 0x120]
mov qword [r11 - 0x78], rax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x20], eax
call fcn.100124b40
mov dword [rsp + 0x80], eax
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123c90
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100123ca1
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100123cd8
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123cd1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x100123ce6
call fcn.1000618f0
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret

Function at 0x100123d10
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x30], 0
mov edx, 1
call fcn.100125670
mov dword [rsp + 0x30], eax
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123d68
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100123d79
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100123db0
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123da9
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x100123dbe
call fcn.1000618f0
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x100123de0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x30], 0
call fcn.1001256f0
mov dword [rsp + 0x30], eax
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123e33
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100123e44
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100123e7b
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123e74
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x100123e89
call fcn.1000618f0
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x100123eb0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x40
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
lea r14, [0x10023fa48]
mov qword [rax - 0x18], r14
xor ebp, ebp
mov dword [rax - 0x10], ebp
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123f10
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100123f21
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100123f59
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100123f52
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rcx, qword [rax + 0x210]
test rcx, rcx
je 0x100123f8f
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x100123f8f
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x100123f8f
mov eax, dword [rax + 0x2d8]
test al, al
js 0x100123f8f
bt eax, 8
jae 0x100124002
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [0x10023fa48], edx
mov ecx, ebp
sete cl
test ecx, ecx
jne 0x100123fb1
mov rcx, r14
call fcn.100076600
cmp dword [0x10023fa68], 2
je 0x100123fdb
cmp dword [0x10023fa64], 0
jne 0x100123fdb
inc dword [0x10023fa60]
mov dword [0x10023fa68], 1
mov dword [0x10023fa48], ebp
jmp 0x100123ff7
lea r9, [0x10023fa78]
or r8d, 0xffffffff
mov edx, 1
mov rcx, r14
call fcn.1001049c0
test eax, eax
jne 0x100124002
mov ebx, 1
mov dword [rsp + 0x38], ebx
jmp 0x100124006
mov ebx, dword [rsp + 0x38]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [0x100246608]
test rcx, rcx
je 0x10012405c
cmp dword [rcx + 0xd8], 0
je 0x10012405c
mov r8, rdi
mov rdx, rsi
call fcn.100124aa0
test eax, eax
je 0x10012405c
mov rcx, qword [0x100246608]
mov rax, qword [rcx]
call qword [rax]
mov rdi, qword [0x100246608]
test ebx, ebx
je 0x100124054
mov edx, ebx
mov rcx, r14
call fcn.1001047d0
mov dword [rsp + 0x38], ebp
mov rax, rdi
jmp 0x100124101
mov rcx, qword [0x1002465f8]
test rcx, rcx
je 0x100124095
cmp dword [rcx + 0xd8], 0
je 0x100124095
mov r8, rdi
mov rdx, rsi
call fcn.100124aa0
test eax, eax
je 0x100124095
mov rcx, qword [0x1002465f8]
mov rax, qword [rcx]
call qword [rax]
mov rdi, qword [0x1002465f8]
jmp 0x100124042
mov rcx, qword [0x100246600]
test rcx, rcx
je 0x1001240d1
cmp dword [rcx + 0xd8], 0
je 0x1001240d1
mov r8, rdi
mov rdx, rsi
call fcn.100124aa0
test eax, eax
je 0x1001240d1
mov rcx, qword [0x100246600]
mov rax, qword [rcx]
call qword [rax]
mov rdi, qword [0x100246600]
jmp 0x100124042
mov r9, rsi
lea r8, [0x100034020]
mov edx, 1
mov rcx, qword [0x10029b218]
call fcn.100156ed0
nop
test ebx, ebx
je 0x1001240ff
mov edx, ebx
mov rcx, r14
call fcn.1001047d0
mov dword [rsp + 0x38], ebp
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1001246e0
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov esi, edx
mov rdi, rcx
lea rbx, [rcx + 8]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x28], 0x80000c2
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x10], rax
lea r8, [r11 - 0x30]
or edx, 0xffffffff
mov rcx, rbx
call fcn.10005b250
nop
mov rcx, qword [rdi + 0xf0]
test rcx, rcx
je 0x100124757
cmp dword [rdi + 0xf8], esi
jne 0x100124757
call fcn.100124810
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.100124780
nop
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.10005b360

Function at 0x100124780
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 8]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x28], 0x80000c2
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x10], rax
lea r8, [r11 - 0x30]
or edx, 0xffffffff
mov rcx, rbx
call fcn.10005b250
nop
mov qword [rsi + 0xf0], rdi
mov dword [rsi + 0xf8], ebp
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
jmp fcn.10005b360
Function at 0x1001256f0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r14d, edx
mov ebp, ecx
xor esi, esi
lea r12, [0x10023fa48]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x30], esi
call fcn.100068a00
mov rdi, rax
mov rax, qword gs:[0x30]
lea rbx, [rax + rdi]
mov rcx, rdi
call fcn.10006c530
test eax, eax
jne 0x100125755
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100125766
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x10012579e
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rax, qword gs:[0x30]
lea rdi, [rax + rbx]
mov rcx, rbx
call fcn.10006c530
test eax, eax
jne 0x100125797
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rbx, qword [rdi + 0xd8]
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x1001257d4
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x1001257d4
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x1001257d4
mov eax, dword [rax + 0x2d8]
test al, al
js 0x1001257d4
bt eax, 8
jae 0x100125846
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [0x10023fa48], edx
mov eax, 0
sete al
test eax, eax
jne 0x1001257f9
mov rcx, r12
call fcn.100076600
mov edi, 2
cmp dword [0x10023fa68], 0
jne 0x100125817
mov dword [0x10023fa68], edi
xor eax, eax
mov dword [0x10023fa48], eax
jmp 0x100125830
lea r9, [0x10023fa78]
or r8d, 0xffffffff
mov edx, edi
mov rcx, r12
call fcn.1001049c0
test eax, eax
jne 0x100125846
mov qword [0x10023fa70], rbx
mov ebx, dword [rsp + 0x30]
test eax, eax
cmove ebx, edi
mov dword [rsp + 0x30], ebx
jmp 0x10012584a
mov ebx, dword [rsp + 0x30]
mov ecx, ebp
sub ecx, 2
je 0x100125888
dec ecx
je 0x10012587f
dec ecx
je 0x100125876
mov r9d, ebp
lea r8, [0x100033e18]
mov edx, 1
mov rcx, qword [0x10029b218]
call fcn.100156ed0
jmp 0x100125894
lea rax, [0x100246608]
jmp 0x10012588f
lea rax, [0x100246600]
jmp 0x10012588f
lea rax, [0x1002465f8]
test rax, rax
jne 0x10012589b
mov esi, 0x54f
jmp 0x1001258ac
mov rcx, qword [rax]
test rcx, rcx
je 0x1001258ac
mov edx, r14d
call fcn.1001246e0
nop
test ebx, ebx
je 0x1001258c2
mov edx, ebx
mov rcx, r12
call fcn.1001047d0
mov dword [rsp + 0x30], 0
mov eax, esi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret