Function at 0x10000ec50
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push rbx
push rbp
push r15
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
mov rcx, qword [0x1000290c0]
add rax, rcx
mov r15, r8
mov ebp, edx
cmp rcx, 0x1480
jge 0x10000ec83
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rsi
test rax, rax
je 0x10000ec99
mov rsi, qword [rax + 0xd8]
test rsi, rsi
jne 0x10000eccb
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x1000290c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10000ecc4
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [rax + 0xd8]
test ebp, ebp
je 0x10000ed18
mov rcx, qword [rsi + reloc.sqllang.dll_Ordinal_528]
test rcx, rcx
je 0x10000ed18
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x10000ed18
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x10000ed18
mov eax, dword [rax + 0x2d8]
test al, al
js 0x10000ed18
bt eax, 8
jb 0x10000ed18
mov eax, 2
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rbp
pop rbx
ret
mov r8, qword [rsi + 0x218]
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rsp + 0x58], r14
test r8, r8
je 0x10000ee1b
rdtsc
shl rdx, 0x20
movabs r14, 0x7fffffffffffffff
or rax, rdx
mov rdx, qword [rsi + 0x2f8]
cmp rax, rdx
ja 0x10000ed6f
mov rcx, rdx
sub rcx, rax
cmp rcx, qword [r8 + 0xab0]
jbe 0x10000ee1b
cmp rdx, r14
je 0x10000ee1b
cmp dword [rbx], 1
jne 0x10000ee1b
test ebp, ebp
je 0x10000ee1b
mov rcx, qword [0x1000290c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10000eda2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10000edb3
mov rcx, qword [rax + 0xd8]
test rcx, rcx
jne 0x10000ede5
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x1000290c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10000edde
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x10000ee15
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x10000ee1b
cmp r8, r14
je 0x10000ee1b
call qword [sym.imp.sqldk.dll_Ordinal_623_1]
lea r14, [rbx + 0x20]
call qword [sym.imp.sqldk.dll_Ordinal_362]
mov edx, eax
xor eax, eax
lock cmpxchg dword [r14], edx
je 0x10000ee38
mov rcx, r14
call fcn.100006880
cmp dword [rbx], edi
jne 0x10000ee95
test ebp, ebp
je 0x10000ee8b
mov rax, qword [rbx + 8]
lea rdx, [rbx + 8]
mov rcx, r15
mov qword [rsi], rax
mov rax, qword [rdx]
mov qword [rax + 8], rsi
mov qword [rdx], rsi
mov qword [rsi + 8], rdx
mov qword [rsi + reloc.sqlmin.dll_Ordinal_656], rdx
mov qword [rsi + 0x298], r14
mov dword [r14], edi
call qword [sym.imp.sqldk.dll_Ordinal_631]
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.sqldk.dll_Ordinal_843]
mov rcx, r15
mov edi, eax
call qword [sym.imp.sqldk.dll_Ordinal_628]
jmp 0x10000eea9
mov dword [r14], edi
mov edi, 0x102
jmp 0x10000eea9
cmp dword [rbx + 4], 1
jne 0x10000eea6
mov eax, dword [rbx]
dec qword [rbx + 0x18]
cmove eax, edi
mov dword [rbx], eax
mov dword [r14], edi
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rbp
pop rbx
ret