joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100075740
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100075775
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rdi, qword [rbx + 0xd8]
test rdi, rdi
je 0x10007581d
mov rdi, qword [rdi + 0x2e8]
call fcn.10011b7d0
test eax, eax
je 0x1000757a7
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
jmp 0x1000757af
mov rbx, qword [0x7ffe0008]
cmp rbx, rdi
jb 0x1000757ce
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x1000757d0
or rdx, rbx
mov rax, rdx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
call fcn.10011b7d0
test eax, eax
je 0x1000757fe
call fcn.10011b7f0
imul rbx, rbx, 0x3e8
xor edx, edx
mov r11, rax
mov rax, rbx
div r11
mov rdx, rax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movabs rax, 0x346dc5d63886594b
mul rbx
shr rdx, 0xb
mov rax, rdx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x100075830
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100075865
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x10007588e
mov rax, qword [rax + 0x218]
test rax, rax
je 0x10007588e
mov eax, dword [rax + 0xabc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000758b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000758e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x10007590f
mov rcx, qword [rax + 0x388]
test rcx, rcx
je 0x10007590f
movzx eax, word [rcx + 0x88]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100075930
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100075965
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x10007598b
mov rax, qword [rax + 0x1f0]
test rax, rax
je 0x10007598b
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000759a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000759d5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1000759fb
mov rax, qword [rax + 0x1f0]
test rax, rax
je 0x1000759fb
mov eax, dword [rax + 0x54]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100075a30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp dword [rdx + 0x20], 1
mov rsi, rdx
mov rbp, rcx
jne 0x100075a73
call fcn.10011b7d0
test eax, eax
je 0x100075a67
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x48]
mov qword [rsi + 0x28], r11
jmp 0x100075a73
mov rax, qword [0x7ffe0008]
mov qword [rsi + 0x28], rax
mov rdi, qword [rsi + 0x28]
call fcn.10011b7d0
test eax, eax
je 0x100075a92
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x50]
jmp 0x100075a9a
mov rbx, qword [0x7ffe0008]
cmp rbx, rdi
jb 0x100075aaa
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
je 0x100075aeb
jmp 0x100075aac
xor ebx, ebx
call fcn.10011b7d0
test eax, eax
je 0x100075ad1
call fcn.10011b7f0
imul rbx, rbx, 0x3e8
xor edx, edx
mov r11, rax
mov rax, rbx
div r11
mov rdx, rax
jmp 0x100075ae2
movabs rax, 0x346dc5d63886594b
mul rbx
shr rdx, 0xb
cmp rdx, 0x4e20
jbe 0x100075b67
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x100075afb
or dword [rbx + 0x2d8], 0x10
mov rdx, rsi
mov rcx, rbp
call fcn.100075ba0
mov r8d, 0x1388
mov rdx, rsi
mov rcx, rbp
call fcn.100075cd0
call fcn.10011b7d0
test eax, eax
je 0x100075b36
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x58]
mov qword [rsi + 0x28], r11
jmp 0x100075b42
mov rax, qword [0x7ffe0008]
mov qword [rsi + 0x28], rax
test rbx, rbx
je 0x100075b83
mov eax, dword [rbx + 0x2d8]
mov ecx, eax
xor ecx, 0x10
and ecx, eax
mov dword [rbx + 0x2d8], ecx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
test byte [rsi + 0x20], 7
mov rdx, rsi
mov rcx, rbp
je 0x100075b78
xor r8d, r8d
jmp 0x100075b7e
mov r8d, 1
call fcn.100075cd0
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x100076c00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, edx
mov rdi, rcx
mov dword [rcx + 4], r8d
test r8d, r8d
je 0x100076cb6
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076c51
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100076c62
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x100076c99
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076c92
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov dword [rcx + 0x7c], ebp
mov rcx, qword [rcx + 0x228]
mov edx, ebp
call fcn.100089910
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov dword [rdi], eax
mov rax, rdi
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x100076cd0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 4], 0
mov rdi, rcx
je 0x100076d7d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076d18
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100076d29
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x100076d60
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076d59
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov eax, dword [rdi]
mov dword [rcx + 0x7c], eax
mov edx, dword [rdi]
mov rcx, qword [rcx + 0x228]
call fcn.100089910
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100076d90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, r9d
mov r14, r8
mov r15d, edx
mov rsi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076ddf
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100076df0
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100076e27
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076e20
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
lea rax, [rsi + 0x28]
mov r9d, ebp
mov r8, r14
mov edx, r15d
mov rcx, rsi
mov qword [rbx + 0xd0], rax
call fcn.10005ae60
mov edi, eax
test eax, eax
jne 0x100076e53
mov rcx, rsi
call fcn.100076e80
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov qword [rbx + 0xd0], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x100076e80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076ebd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100076ece
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100076f05
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100076efe
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x210]
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 0x28], rax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x100076f30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r14d, r8d
mov esi, edx
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100076f7e
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100076f8f
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x100076fc6
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100076fbf
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rdi, qword [rdi + 0xd8]
test r14d, r14d
je 0x100077008
mov rcx, qword [rdi + 0x210]
test rcx, rcx
je 0x100077008
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x100077008
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x100077008
mov eax, dword [rax + 0x2d8]
test al, al
js 0x100077008
bt eax, 8
jb 0x100077008
mov eax, 2
jmp 0x10007706d
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
je 0x10007701f
mov rcx, rbx
call fcn.100076600
cmp esi, 1
jne 0x10007703c
cmp dword [rbx + 0x20], 2
je 0x100077050
cmp dword [rbx + 0x1c], 0
jne 0x100077050
inc dword [rbx + 0x18]
xor eax, eax
mov dword [rbx + 0x20], esi
mov dword [rbx], eax
jmp 0x100077064
cmp esi, 2
jne 0x100077050
cmp dword [rbx + 0x20], 0
jne 0x100077050
xor eax, eax
mov dword [rbx + 0x20], esi
mov dword [rbx], eax
jmp 0x100077064
mov r9, r15
mov r8d, r14d
mov edx, esi
mov rcx, rbx
call fcn.1001049c0
test eax, eax
jne 0x10007706d
cmp esi, 2
jne 0x10007706d
mov qword [rbx + 0x28], rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1000778c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
movzx ecx, byte [rcx + 0xcc]
mov r12d, edx
shl r12d, cl
mov qword [rsp + 0x60], rsi
mov r15d, edx
add r12, qword [r13 + 0xc0]
xor ebp, ebp
mov qword [rsp + 0x68], rdi
lea r14d, [rbp + 1]
nop dword [rax]
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x10007796c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r8d, r8d
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x10007795f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x100077963
nop dword [rax + rax]
cmp rcx, rbx
jae 0x100077963
lea rdx, [rcx + 0x40]
mov rax, rcx
lock cmpxchg qword [rbx + 0x18], rdx
je 0x10007794f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x100077930
jmp 0x100077963
cmp rdx, rbx
jne 0x10007795c
mov qword [rbx + 0x18], 0
mov r8, rcx
lock dec dword [rbx + 0x28]
test r8, r8
jne 0x100077ab8
movzx ecx, byte [r13 + 0xcc]
mov esi, r15d
shl esi, cl
add rsi, qword [r13 + 0xc0]
movzx edi, word [rsi]
cmp di, 0x40
jne 0x1000779a5
call fcn.10006b940
test eax, eax
je 0x1000779a3
mov ecx, r15d
call fcn.10006be50
movzx edi, word [rax + 2]
mov word [rsi], di
jmp 0x1000779a5
xor edi, edi
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.100078280
test eax, eax
jne 0x1000779e4
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.100078440
test eax, eax
jne 0x1000779e4
test ebp, ebp
jne 0x100077abd
lea ebp, [rax + 1]
test r14d, 0x1fff
jne 0x100077ab0
call fcn.100089d00
test eax, eax
jne 0x100077abd
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100077a29
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100077a3a
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x100077a71
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100077a6a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x100077aab
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x100077ab0
movabs rax, 0x7fffffffffffffff
cmp r8, rax
je 0x100077ab0
call fcn.1000655c0
inc r14d
jmp 0x100077900
mov rax, r8
jmp 0x100077abf
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x100077fc0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r14, rcx
mov eax, 1
xchg dword [0x1002562e8], eax
mov qword [rcx], rdx
mov rdx, qword [0x1002562f0]
add rcx, 0xc0
call fcn.1000f39d0
xor r12d, r12d
mov edi, r12d
cmp dword [r14 + 0xc8], r12d
jbe 0x100078180
lea r13d, [r12 + 0x40]
call fcn.10006aec0
mov esi, r12d
cmp edi, eax
setb sil
mov dword [rsp + 0x64], esi
test esi, esi
je 0x1000780c6
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100078068
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100078079
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000780b1
call fcn.100063d30
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000780aa
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov dword [rcx + 0x7c], edi
mov edx, edi
mov rcx, qword [rcx + 0x228]
call fcn.100089910
mov dword [rsp + 0x60], eax
movzx ecx, byte [r14 + 0xcc]
mov eax, edi
shl eax, cl
mov ecx, eax
add rcx, qword [r14 + 0xc0]
mov qword [rcx + 8], r12
mov word [rcx], r13w
test esi, esi
je 0x100078171
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100078116
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100078127
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007815e
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100078157
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov edx, dword [rsp + 0x60]
mov dword [rcx + 0x7c], edx
mov rcx, qword [rcx + 0x228]
call fcn.100089910
inc edi
cmp edi, dword [r14 + 0xc8]
jb 0x100078022
call fcn.10006bea0
mov word [r14 + 8], ax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100078a70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov rsi, rcx
call fcn.100078cd0
mov ebp, 2
lea r14, [0x10024d700]
mov rdi, rax
test rax, rax
je 0x100078b4f
mov rax, qword [rdi + 0x10]
cmp rax, rdi
je 0x100078b3b
cmp rax, qword [rsi + 0x20]
jne 0x100078ade
call fcn.100068b60
test eax, eax
je 0x100078ade
cmp dword [rdi + 0x30], 1
jne 0x100078ade
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x40]
mov edx, 0x1000
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, rdi
and rbx, 0xffffffffffffe000
add rbx, 0x1fc0
lock inc dword [rbx + 0x28]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov ecx, dword [rbx + 0x30]
dec ecx
jne 0x100078b3b
mov eax, 1
lock cmpxchg dword [rbx + 0x30], ebp
jne 0x100078b3b
mov eax, dword [rbx + 0x28]
movzx r8d, word [rbx + 0x2c]
cdq
and edx, 0x1f
add eax, edx
lea rdx, [rbx + 0x10]
sar eax, 5
movsxd rcx, eax
lea rcx, [rcx + r8*8]
shl rcx, 4
add rcx, r14
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov rcx, rsi
call fcn.100078cd0
mov rdi, rax
test rax, rax
jne 0x100078aa2
mov rdi, qword [rsp + 0x48]
nop word [rax + rax]
lea rcx, [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
je 0x100078bd7
cmp qword [rax + 0x10], rax
je 0x100078b60
mov rbx, rax
and rbx, 0xffffffffffffe000
add rbx, 0x1fc0
lock inc dword [rbx + 0x28]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov ecx, dword [rbx + 0x30]
dec ecx
jne 0x100078b60
mov eax, 1
lock cmpxchg dword [rbx + 0x30], ebp
jne 0x100078b60
mov eax, dword [rbx + 0x28]
movzx r8d, word [rbx + 0x2c]
cdq
and edx, 0x1f
add eax, edx
lea rdx, [rbx + 0x10]
sar eax, 5
movsxd rcx, eax
lea rcx, [rcx + r8*8]
shl rcx, 4
add rcx, r14
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
jmp 0x100078b60
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x1000791d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
movzx ecx, byte [rcx + 0xcc]
mov r12d, edx
shl r12d, cl
mov qword [rsp + 0x60], rsi
mov r15d, edx
add r12, qword [r13 + 0xc0]
xor ebp, ebp
mov qword [rsp + 0x68], rdi
lea r14d, [rbp + 1]
nop dword [rax]
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x10007927c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r8d, r8d
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x10007926f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x100079273
nop dword [rax + rax]
cmp rcx, rbx
jae 0x100079273
lea rdx, [rcx + 0x30]
mov rax, rcx
lock cmpxchg qword [rbx + 0x18], rdx
je 0x10007925f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x100079240
jmp 0x100079273
cmp rdx, rbx
jne 0x10007926c
mov qword [rbx + 0x18], 0
mov r8, rcx
lock dec dword [rbx + 0x28]
test r8, r8
jne 0x1000793c8
movzx ecx, byte [r13 + 0xcc]
mov esi, r15d
shl esi, cl
add rsi, qword [r13 + 0xc0]
movzx edi, word [rsi]
cmp di, 0x40
jne 0x1000792b5
call fcn.10006b940
test eax, eax
je 0x1000792b3
mov ecx, r15d
call fcn.10006be50
movzx edi, word [rax + 2]
mov word [rsi], di
jmp 0x1000792b5
xor edi, edi
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.100079b90
test eax, eax
jne 0x1000792f4
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.100079db0
test eax, eax
jne 0x1000792f4
test ebp, ebp
jne 0x1000793cd
lea ebp, [rax + 1]
test r14d, 0x1fff
jne 0x1000793c0
call fcn.100089d00
test eax, eax
jne 0x1000793cd
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100079339
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007934a
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x100079381
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10007937a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x1000793bb
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x1000793c0
movabs rax, 0x7fffffffffffffff
cmp r8, rax
je 0x1000793c0
call fcn.1000655c0
inc r14d
jmp 0x100079210
mov rax, r8
jmp 0x1000793cf
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1000798d0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r14, rcx
mov eax, 1
xchg dword [0x1002562f8], eax
mov qword [rcx], rdx
mov rdx, qword [0x100256300]
add rcx, 0xc0
call fcn.1000f39d0
xor r12d, r12d
mov edi, r12d
cmp dword [r14 + 0xc8], r12d
jbe 0x100079a90
lea r13d, [r12 + 0x40]
call fcn.10006aec0
mov esi, r12d
cmp edi, eax
setb sil
mov dword [rsp + 0x64], esi
test esi, esi
je 0x1000799d6
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100079978
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100079989
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000799c1
call fcn.100063d30
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000799ba
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov dword [rcx + 0x7c], edi
mov edx, edi
mov rcx, qword [rcx + 0x228]
call fcn.100089910
mov dword [rsp + 0x60], eax
movzx ecx, byte [r14 + 0xcc]
mov eax, edi
shl eax, cl
mov ecx, eax
add rcx, qword [r14 + 0xc0]
mov qword [rcx + 8], r12
mov word [rcx], r13w
test esi, esi
je 0x100079a81
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100079a26
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100079a37
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x100079a6e
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100079a67
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov edx, dword [rsp + 0x60]
mov dword [rcx + 0x7c], edx
mov rcx, qword [rcx + 0x228]
call fcn.100089910
inc edi
cmp edi, dword [r14 + 0xc8]
jb 0x100079932
call fcn.10006bea0
mov word [r14 + 8], ax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret